Vehicle access control system, access control method, and program

Abstract

To provide a vehicle access control system and the like that can apply segment separation to even in-vehicle systems on the assumption of adopting a plurality of communication methods.SOLUTION: A vehicle access control system 1 is mounted on a vehicle and includes a first access control unit 51, a second access control unit 52, and a third access control unit 53. The first access control unit 51 controls communication in a first area of a segment made up of multiple areas. The second access control unit 52 controls communication in a second area of the segment. The third access control unit 53 controls communication in a third area different from the first and second areas and has a function of converting a communication method. When sending a message from the first area to the second area, the first access control unit 51 relays the message through the third area.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a vehicle access control system mounted on a vehicle. [Background technology]

[0002] The evolution of in-vehicle architecture is shifting from the current gateway architecture to a domain controller architecture. DC (Domain Controller) architectures use virtualization technology to integrate the functions of multiple ECUs (Electronic Control Units) into a single ECU. Furthermore, an increasing number of vehicles are now capable of post-purchase software updates, such as paid upgrades in software-defined vehicles (SDVs) or the incorporation of third-party applications. As a result, user convenience is expected to improve, and the amount of information flowing within vehicles, as well as the use and utilization of that information, is expected to rapidly increase.

[0003] Each of the multiple DCs generates data required for services. Data is also exchanged between the multiple DCs. Each DC is divided into multiple areas using virtualization technology or the like, and data is generated in each of the multiple areas. Each DC performs control by utilizing data not only from the same DC but also from areas of other DCs. Here, an area refers to a range in which a certain type of data may exist. An area may be an area divided by a virtualization platform, or may be a program unit such as an application or process provided by an OS (Operating System), or a core in a multi-core CPU (Central Processing Unit).

[0004] Against this background, the protection of personal information is required by the laws and regulations of each country.To achieve control of data between services as well as between inside and outside the vehicle, it is necessary to control not only data between multiple data centers but also data between multiple domains.

[0005] In recent years, in the field of information and communications, access control systems that allow normal messages to pass and block attacks have been considered for communication access control.

[0006] For example, Patent Document 1 discloses a technique for grouping a plurality of hosts into several domains and performing access control. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] International Publication No. 2022 / 118395 Summary of the Invention [Problem to be solved by the invention]

[0008] Incidentally, some in-vehicle systems contain a mixture of conventional ECUs and DCs. Even in such in-vehicle systems that contain multiple ECUs (including DCs) and undergo dynamic software updates, it is necessary to separate the entry point (EP) that connects to the outside world from the vehicle's safety functions, i.e., to separate segments.

[0009] In addition, in an in-vehicle system, in addition to communication using a CAN (Control Area Network) or serial communication, a combination of multiple communication methods such as communication using Ethernet or communication between virtual machines (VMs) on a virtualization platform can be used. In such an in-vehicle system, when transmitting and receiving data between multiple areas, it is possible to logically separate the multiple areas into multiple segments.

[0010] A segment consists of one or more areas and is defined for each type of message (data), such as personal information, corporate information, or driving control information. Messages corresponding to any segment can exist within that segment, but in principle, are not permitted to be sent outside that segment. On the other hand, if certain conditions are met, it may be permitted to temporarily send information outside the segment. To achieve this separation of segments, a security policy must be applied to functions that communicate between multiple areas. The security policy includes rules, such as allowing certain types of messages to be sent from one area to another area between two areas.

[0011] However, the technology disclosed in Patent Document 1 is a technology for grouping multiple hosts on the assumption that a single communication method such as Ethernet is used, and has the problem that it cannot handle segment separation in an in-vehicle system that is based on the assumption that multiple communication methods are used.

[0012] Therefore, the present disclosure provides a vehicle access control system etc. that can apply segment separation to an in-vehicle system that is premised on adopting multiple communication methods. [Means for solving the problem]

[0013] A vehicle access control system according to one aspect of the present disclosure is a vehicle access control system mounted on a vehicle. The vehicle access control system includes a first access control unit, a second access control unit, and a third access control unit. The first access control unit controls communication in a first area of a segment composed of multiple areas. The second access control unit controls communication in a second area of the segment. The third access control unit controls communication in a third area different from the first area and the second area and has a function of converting the communication method. When sending a message from the first area to the second area, the first access control unit relays the message through the third area.

[0014] An access control method according to one aspect of the present disclosure is an access control method executed by a vehicle access control system mounted on a vehicle. The vehicle access control system controls communication in a first area of a segment consisting of multiple areas. The vehicle access control system controls communication in a second area of the segment. The vehicle access control system has a function of converting a communication method and controls communication in a third area different from the first area and the second area. When sending a message from the first area to the second area, the vehicle access control system relays the message through the third area.

[0015] A program according to one aspect of the present disclosure causes one or more processors to execute the access control method. [Effects of the Invention]

[0016] According to one aspect of the present disclosure, it is possible to realize a vehicle access control system or the like that can apply segment separation to an in-vehicle system that is premised on adopting multiple communication methods. [Brief explanation of the drawings]

[0017] [Figure 1] FIG. 1 is a block diagram illustrating an example of a functional configuration of a vehicle access control system according to an embodiment. [Figure 2]FIG. 2 is a diagram illustrating an example of a segment. [Figure 3] FIG. 3 is a diagram illustrating an example of communication data. [Figure 4] FIG. 4 is a diagram illustrating an example of the conversion data. [Figure 5] FIG. 5 is a block diagram illustrating a first communication example of the vehicle access control system according to the embodiment. [Figure 6] FIG. 6 is a block diagram showing a second communication example of the vehicle access control system according to the embodiment. [Figure 7] FIG. 7 is a sequence diagram illustrating a second communication example of the vehicle access control system according to the embodiment. [Figure 8] FIG. 8 is a diagram illustrating an example of a policy used in the second communication example of the vehicle access control system according to the embodiment. [Figure 9] FIG. 9 is a block diagram illustrating a third communication example of the vehicle access control system according to the embodiment. [Figure 10] FIG. 10 is a sequence diagram illustrating a third communication example of the vehicle access control system according to the embodiment. [Figure 11] FIG. 11 is a diagram illustrating an example of a policy used in the third communication example of the vehicle access control system according to the embodiment. [Figure 12] FIG. 12 is a block diagram illustrating an example of a functional configuration of a vehicle access control system according to a modified example of the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0018] Hereinafter, the embodiments will be specifically described with reference to the drawings.

[0019] The embodiments described below are all comprehensive or specific examples, and the numerical values, shapes, materials, components, arrangement positions and connection forms of the components shown in the following embodiments are merely examples and are not intended to limit the present disclosure.

[0020] (Embodiment) A vehicle access control system according to an embodiment will be described below.

[0021] [1. Vehicle access control system configuration] 1 is a block diagram showing an example of a functional configuration of a vehicle access control system 1 according to an embodiment. The vehicle access control system 1 is mounted on a vehicle (an example of a moving object). The vehicle access control system 1 is a system that controls communication for each of a plurality of segments obtained by logically dividing a plurality of areas.

[0022] A segment is composed of multiple areas in which messages (data) are allowed to exist, for example, for each type of message. Here, an area is a division of a microcontroller or a virtual machine in a device such as an ECU (including a DC). An area may also be a division of an application or service level (process). Since segments are defined for each type of message, an area may belong to multiple segments. Also, multiple areas within the same ECU may belong to the same segment, or areas of multiple different ECUs may belong to the same segment. In other words, a segment may be composed of one or more areas in one ECU (including a DC). For example, if a first DC and a second DC exist in a vehicle, one segment may be composed of the area of the first DC and the area of the second DC.

[0023] Alternatively, a segment may be defined by defining multiple regions belonging to each type of segment. In this case, a message type corresponding to the type of the segment is defined within the segment, and the message cannot exist in other segments as a general rule. For example, if a message is "privacy information," the message can exist in the "privacy" segment, but cannot exist in the "safety" segment as a general rule.

[0024] Although communication between different segments is prohibited in principle, such communication may be permitted depending on restrictions or conditions.

[0025] Fig. 2 is a diagram showing an example of a segment. Fig. 2(a) is a diagram showing a first example of a segment, and Fig. 2(b) is a diagram showing a second example of a segment. In Fig. 2, "DC" represents a domain controller, "MCU (Micro Controller Unit)" represents a microcontroller, and "VM" represents a virtual machine. Also, in Fig. 2, "TCU" represents a Telematics Control Unit.

[0026] In the first example, a segment is defined for each message type. In the example shown in FIG. 2(a), the segment whose message type is "location information" includes the "Infotainment-DC:VM1" area, the "Powertrain-DC:MCU2" area, and the "TCU:MCU1" area. In addition, the segment whose message type is "cruising control information" includes the "Body-DC:MCU1" area and the "Powertrain-DC:MCU2" area. In the example shown in FIG. 2(a), the "Powertrain-DC:MCU2" area belongs to two segments.

[0027] In the second example, segments are defined by determining one or more areas that belong to each segment for each segment type. In the example shown in FIG. 2(b), the "Infotainment-DC:VM1" area, the "Powertrain-DC:MCU2" area, and the "TCU:MCU1" area belong to the segment whose segment type is "Entry Point." In addition, the "Body-DC:MCU1" area and the "Powertrain-DC:MCU2" area belong to the segment whose segment type is "Safety." In the example shown in FIG. 2(b), the "Powertrain-DC:MCU2" area also belongs to two segments.

[0028] Although not shown, the "entry point" segment allows messages with a message type of "location information," and the "safety" segment allows messages with a message type of "functional safety information." In other words, each segment is associated with a message type that is allowed to exist. Furthermore, the same message type may be associated with multiple segments.

[0029] 1, the vehicle access control system 1 is mounted on DCs 100, 110 provided in a vehicle, and includes a first access control unit 51, a second access control unit 52, and a third access control unit 53. In the embodiment, the first access control unit 51, the second access control unit 52, and the third access control unit 53 each correspond to one of a plurality of filters 50. Note that the vehicle access control system 1 only needs to include these components, and the configuration of the DCs 100, 110 provided in the vehicle excluding these components does not necessarily have to be a component of the vehicle access control system 1.

[0030] In the example shown in Figure 1, the filter 50 called "Filter 1-B" corresponds to the first access control unit 51, the filter 50 called "Filter 2-A" corresponds to the second access control unit 52, and the filter 50 called "Filter 1-A" corresponds to the third access control unit 53.

[0031] In other words, each filter 50 has the functions of all of the first access control unit 51, the second access control unit 52, and the third access control unit 53, and which of the functions of the first access control unit 51, the second access control unit 52, and the third access control unit 53 it will perform is determined based on the communication conditions.

[0032] The DC 100 is a computer that includes a processor (microprocessor), a memory, etc. The memory is a read-only memory (ROM) and a random access memory (RAM), etc., and can store programs that are executed by the processor.

[0033] The DC 100 includes, as hardware, an SoC (System On Chip) 10 and an MCU 20. The hardware is a machine or device that can accept data, perform logical operations on the data, store the data in memory, and display the data on a display or the like. The hardware may include a processor and memory. The hardware also includes a communication interface for communicating with other hardware in the vehicle via, for example, Ethernet, CAN, serial communication, or SPI (Serial Peripheral Interface), etc.

[0034] In this embodiment, the SoC 10 includes an Ethernet communication unit 10A, which is an Ethernet communication interface for an external device (here, the DC 110). The MCU 20 includes a CAN communication unit 20A, which is a CAN communication interface for an external device (here, the DC 110). The SoC 10 and the MCU 20 are configured to be able to communicate with each other via a serial communication unit 40A, which is a communication interface for serial communication.

[0035] A virtualization platform 30 runs on SoC10. The virtualization platform 30 is, for example, a hypervisor, and is software that serves as a virtualization infrastructure for running one or more virtual machines. One or more virtual machines (here, three virtual machines) that are isolated from each other are running on the virtualization platform 30. In the embodiment, a virtual machine in "Area 1-A", a virtual machine in "Area 1-B", and a virtual machine in "Area 1-C" are running on the virtualization platform 30. "Area 1-A" is, for example, an externally connected area, "Area 1-C" is, for example, a secure area, and "Area 1-B" is, for example, an intermediate area via which communication takes place between the externally connected area and the secure area.

[0036] The external connection area is an area including, for example, an entry point (EP), a communication function with the outside, or a TLS (Transport Level Security) termination, and is an area having an external connection function that can be an entry point for an attacker. The safety area is an area including, for example, functions related to the safety of the vehicle (functions such as running, turning, and stopping).

[0037] The virtualization platform 30 also includes an inter-VM communication unit 30A. The inter-VM communication unit 30A controls communications originating from any one of the one or more virtual machines and communications destined to any one of the one or more virtual machines. In other words, communications with one or more virtual machines in the SoC 10 are possible only via the inter-VM communication unit 30A.

[0038] In the MCU 20, a virtual machine in "Area 1-D" realized by a hardware virtualization support mechanism is running. "Area 1-D" is, for example, a secure area. Communication with the virtual machine in the MCU 20 (here, the virtual machine in "Area 1-D") is possible only via the CAN communication unit 20A or the serial communication unit 40A. Note that "Area 1-D" may also be a process realized by the OS.

[0039] Messages are sent and received via an Ethernet communication unit 10A, a CAN communication unit 20A, an inter-VM communication unit 30A, and a serial communication unit 40A. Access control of message sending and receiving in each of the communication units 10A, 20A, 30A, and 40A is realized by a plurality of filters 50. Each filter 50 may be implemented within each of the communication units 10A, 20A, 30A, and 40A, or may be implemented as software on the SoC 10 or MCU 20 in which each of the communication units 10A, 20A, 30A, and 40A is implemented.

[0040] In the embodiment, the vehicle access control system 1 has "Filter 1-A," "Filter 1-B," "Filter 1-C," and "Filter 1-D," which correspond to "Area 1-A," "Area 1-B," "Area 1-C," and "Area 1-D," respectively.

[0041] The DC 110 includes, as hardware, an SoC 11 and an MCU 21. In this embodiment, the SoC 11 includes an Ethernet communication unit 11A, which is an Ethernet communication interface for an external device (here, the DC 100). The MCU 21 includes a CAN communication unit 21A, which is a CAN communication interface for an external device (here, the DC 100). The SoC 11 and the MCU 21 are configured to be able to communicate with each other via a serial communication unit 41A, which is a communication interface for serial communication.

[0042] A virtualization platform 31 runs on SoC11. One or more virtual machines (three virtual machines in this example) that are isolated from one another are running on virtualization platform 31. In the embodiment, a virtual machine in "area 2-A," a virtual machine in "area 2-B," and a virtual machine in "area 2-C" are running on virtualization platform 31. "Area 2-A" is, for example, an external connection area, "Area 2-C" is, for example, a safety area, and "Area 2-B" is, for example, an intermediate area.

[0043] The virtualization platform 31 also includes an inter-VM communication unit 31A. Communication with one or more virtual machines in the SoC 11 is possible only via the inter-VM communication unit 31A.

[0044] In the MCU 21, a virtual machine in "area 2-D" realized by a hardware virtualization support mechanism is running. "Area 2-D" is, for example, a secure area. Communication with the virtual machine in the MCU 21 (here, the virtual machine in "area 2-D") is possible only via the CAN communication unit 21A or the serial communication unit 41A. Note that "area 2-D" may also be a process realized by the OS.

[0045] Messages are sent and received via the Ethernet communication unit 11A, the CAN communication unit 21A, the inter-VM communication unit 31A, and the serial communication unit 41A. Access control of message sending and receiving in each of the communication units 11A, 21A, 31A, and 41A is realized by a plurality of filters 50. Each filter 50 may be implemented in each of the communication units 11A, 21A, 31A, and 41A, or may be implemented as software on the SoC 11 or MCU 21 on which each of the communication units 11A, 21A, 31A, and 41A is implemented.

[0046] In the embodiment, the vehicle access control system 1 has "Filter 2-A," "Filter 2-B," "Filter 2-C," and "Filter 2-D," which correspond to "Area 2-A," "Area 2-B," "Area 2-C," and "Area 2-D," respectively.

[0047] Each filter 50 has a policy including rules regarding received messages. In the embodiment, the policy defines, for each data type, a destination area, a source area, and intermediate destination areas that the message must pass through on its way to the destination area. Note that, depending on the data type and filter 50, the intermediate destinations may not be described in the policy. Each filter 50 then executes a determination process to determine whether to send a received message based on the policy. For example, if the data type, destination, source, and intermediate destinations in a received message are described in the policy, each filter 50 sends the message to the intermediate destination. Note that, if the received message does not include an intermediate destination, each filter 50 sends the message to the destination. On the other hand, if at least one of the data type, destination, source, and intermediate destinations in a received message is not described in the policy, each filter 50 discards the message.

[0048] As already described, in the embodiment, the first access control unit 51, the second access control unit 52, and the third access control unit 53 each correspond to one of the multiple filters 50. The first access control unit 51, the second access control unit 52, and the third access control unit 53 will be described below.

[0049] The first access control unit 51 controls communication in a first area of a segment made up of multiple areas. In the example shown in Fig. 1, "Filter 1-B" is the first access control unit 51, and the segment (see the area surrounded by the dotted line) is made up of "Area 1-B" of DC100 and "Area 2-A" of DC110. Then, "Filter 1-B" controls communication in the first area ("Area 1-B") of the segment.

[0050] Specifically, when the first access control unit 51 receives a message from an application in the first area, for example, it executes a determination process to determine whether to send the received message based on the policy it holds. Then, depending on the result of the determination process, the first access control unit 51 sends the message to the destination or an intermediate destination, or discards the message. Furthermore, if the destination of the message is the area to which the first access control unit 51 belongs, the first access control unit 51 sends the message to the application in that area.

[0051] The second access control unit 52 controls communication in a second area of the segment. In the example shown in Fig. 1, "filter 2-A" is the second access control unit 52. "filter 2-A" controls communication in the second area ("area 2-A") of the segment.

[0052] Specifically, when the second access control unit 52 receives a message, it executes a determination process to determine whether to send the received message based on the policy it holds. Then, depending on the result of the determination process, the second access control unit 52 sends the message to the destination or an intermediate destination, or discards the message. Furthermore, if the destination of the message is the area to which the second access control unit 52 belongs, the second access control unit 52 sends the message to an application in that area.

[0053] The third access control unit 53 controls communication in a third area that is different from the first area and the second area. The third access control unit 53 also has a function of converting the communication method. In the example shown in FIG. 1, "Filter 1-A" is the third access control unit 53. "Filter 1-A" controls communication in a third area ("Area 1-A") that is an area outside the segment to which the first area ("Area 1-B") and the second area ("Area 2-A") belong. The "Filter 1-A" also has a function of converting between the communication method using the inter-VM communication unit 30A and the communication method using the Ethernet communication unit 11A.

[0054] Specifically, when the third access control unit 53 receives a message, it executes a determination process to determine whether to send the received message based on the policy it holds. Then, depending on the result of the determination process, the third access control unit 53 sends the message to the destination or an intermediate destination, or discards the message. Furthermore, if the destination of the message is the area to which the third access control unit 53 belongs, the third access control unit 53 sends the message to an application in that area.

[0055] Here, when sending a message from the first area to the second area, the first access control unit 51 relays the message through the third area. In the example shown in FIG. 1, when sending a message from the first area ("area 1-B") to the second area ("area 2-A"), the first access control unit 51 must communicate via the Ethernet communication unit 10A, but does not have the function of communicating via the Ethernet communication unit 10A. In other words, in the example shown in FIG. 1, the first area ("area 1-B") and the second area ("area 2-A") cannot communicate directly with each other.

[0056] Therefore, in the above case, the first access control unit 51 relays the message through the third area ("area 1-A"). That is, "filter 1-A", which is the third access control unit 53 of the third area ("area 1-A"), has a function of converting between the communication method using the inter-VM communication unit 30A and the communication method using the Ethernet communication unit 11A, and therefore the first access control unit 51 can transmit the message to the second area ("area 2-A") by relaying the message through the third area ("area 1-A").

[0057] The following describes an example in which the third access control unit 53 converts the communication method of a message received from the first access control unit 51 and transmits it to another area. The third access control unit 53 adds communication data 64 (see FIG. 3) used in communication with the destination of the message to the received message and transmits the message.

[0058] Fig. 3 is a diagram showing an example of communication data. Fig. 3 shows data included in a message. The message includes an identifier 61 indicating the type of data, a sender 62, a destination 63, and communication data 64. The identifier 61, sender 62, and destination 63 are data that each filter 50 refers to in its determination process, and are common data that do not depend on the communication method. The communication data 64 is data specific to the communication method. Note that the common data may also include an intermediate destination.

[0059] FIG. 3A shows a case where a device-dependent format used in SPI communication, i.e., serial communication, is added as communication data 64. FIG. 3B shows a case where a destination MAC (Media Access Control) address, a source MAC address, and a type used in Ethernet communication are added as communication data 64. FIG. 3C shows a case where a HV (Hypervisor)-dependent format used in inter-VM communication is added as communication data 64. FIG. 3D shows a case where a CAN ID and a CF (Control Field) used in CAN communication are added as communication data 64. FIG. 3E shows a case where a protected field including an ID, size, etc. used in LIN (Local Interconnect Network) communication is added as communication data 64. FIG. 3F shows a case where a source port, a destination port, a sequence number, etc. used in socket communication using TCP (Transmission Control Protocol), UDP (User Datagram Protocol), IP (Internet Protocol), etc. are added as communication data 64.

[0060] FIG. 4 is a diagram showing an example of conversion data. The conversion data is data for converting communication data 64 included in a received message into common data in a determination process. The example shown in FIG. 4 is an example of conversion data held by "Filter 2-D" that can perform CAN communication. For example, when "Filter 2-D" receives a message with a CAN ID of "XX", it refers to the conversion data and converts the CAN ID "XX" into the corresponding common data (here, the destination and source).

[0061] [2. Example of communication in a vehicle access control system] Below, communication examples of the vehicle access control system 1 according to the embodiment are listed. In the block diagrams of each communication example (FIGS. 5, 6, and 9), multiple areas belonging to the same segment are enclosed by dotted lines, and message transmission paths are represented by arrows. In the diagrams showing examples of policies for each communication example (FIGS. 8 and 11), "area XY" represents the area described for each policy, but this will not be mentioned in the following explanation.

[0062] [2-1. First communication example] 5 is a block diagram showing a first communication example of the vehicle access control system 1 according to the embodiment. The first communication example is a communication example in which a first area and a second area can directly communicate with each other. Specifically, when a message is sent from "area 1-A" of DC100 to "area 2-A" of DC110 that belongs to the same "segment α," "filter 1-A" corresponding to "area 1-A" and "filter 2-A" corresponding to "area 2-A" can directly communicate with each other via Ethernet communication.

[0063] Therefore, when "Filter 1-A" receives a message from an application in "Area 1-A," it performs a determination process, and if the data type, destination (here, "Area 2-A"), and sender (here, "Area 1-A") of the received message are described in the policy, it transmits the message to the destination via Ethernet communication units 10A and 11A. Then, when "Filter 2-A" receives a message, it performs a determination process, and if the data type, destination (here, "Area 2-A"), and sender (here, "Area 1-A") of the received message are described in the policy, it transmits the message to the application in "Area 2-A." In this case, "Filter 1-A" functions as the first access control unit 51, and "Filter 2-A" functions as the second access control unit 52.

[0064] Similarly, when sending a message from "Area 1-D" of DC100 to "Area 2-D" of DC110 belonging to the same "Segment β," "Filter 1-D" corresponding to "Area 1-D" and "Filter 2-D" corresponding to "Area 2-D" can communicate directly with each other via CAN communication.

[0065] Therefore, when "Filter 1-D" receives a message from an application in "Area 1-D," it performs a determination process, and if the data type, destination (here, "Area 2-D"), and sender (here, "Area 1-D") of the received message are described in the policy, it transmits the message to the destination via the CAN communication units 20A and 21A. Then, when "Filter 2-D" receives a message, it performs a determination process, and if the data type, destination (here, "Area 2-D"), and sender (here, "Area 1-D") of the received message are described in the policy, it transmits the message to the application in "Area 2-D." In this case, "Filter 1-D" functions as the first access control unit 51, and "Filter 2-D" functions as the second access control unit 52.

[0066] [2-2. Second communication example] Fig. 6 is a block diagram showing a second communication example of the vehicle access control system 1 according to the embodiment. Fig. 7 is a sequence diagram showing the second communication example of the vehicle access control system 1 according to the embodiment. Fig. 8 is a diagram showing an example of a policy used in the second communication example of the vehicle access control system 1 according to the embodiment.

[0067] The second communication example is an example of communication when the first area and the second area cannot communicate directly. Specifically, when sending a message from "Area 1-B" of DC100 to "Area 2-D" of DC110 that belongs to the same "Segment γ," "Filter 1-B" corresponding to "Area 1-B" and "Filter 2-D" corresponding to "Area 2-D" cannot communicate directly with each other via CAN communication.

[0068] Therefore, in the second communication example, "Filter 1-B" corresponding to "Area 1-B" which is the first area transmits a message to "Filter 2-D" corresponding to "Area 2-D" which is the second area, via "Filter 1-C" corresponding to "Area 1-C" which is the third area, and "Filter 1-D" corresponding to "Area 1-D" which is the third area. Therefore, in the second communication example, "Filter 1-B" functions as the first access control unit 51, "Filter 2-D" functions as the second access control unit 52, and "Filter 1-C" and "Filter 1-D" function as the third access control unit 53.

[0069] Specific communication modes will be described below with reference to Figures 7 and 8. First, when "Filter 1-B" receives a message with a data type of "ID1" from an application in "Area 1-B", it executes a determination process to determine whether the data type, destination, sender, and intermediate destination of the message are described in the policy it holds (S101). If it determines that they are described in the policy, "Filter 1-B" transmits the message to "Filter 1-C" in "Area 1-C", which is the intermediate destination, by inter-VM communication (S102).

[0070] When "Filter 1-C" receives a message from "Filter 1-B," it executes a determination process to determine whether the data type, destination, sender, and intermediate destinations of the message are described in the policy it holds (S103). If it determines that the data type, destination, sender, and intermediate destinations of the message are described in the policy, "Filter 1-C" transmits the message via serial communication to "Filter 1-D" in "Area 1-D," which is the intermediate destination (S104).

[0071] When "Filter 1-D" receives a message from "Filter 1-C," it executes a determination process to determine whether the data type, destination, sender, and intermediate destinations of the message are described in the policy it holds (S105). If it determines that the data type, destination, sender, and intermediate destinations of the message are described in the policy, "Filter 1-C" transmits the message to "Filter 2-D" in "Area 2-D," which is the destination, via CAN communication (S106).

[0072] When "Filter 2-D" receives a message from "Filter 1-D," it executes a determination process to determine whether the data type, destination, sender, and intermediate destinations of the message are described in the policy it holds (S107). Since the destination of the message matches the destination described in the policy, "Filter 2-D" sends the message to the corresponding application in "Area 2-D." In this way, communication is possible between "Area 1-B" and "Area 2-D," which cannot communicate directly with each other, by relaying communication through "Area 1-C" and "Area 1-D."

[0073] [2-3. Third communication example] Fig. 9 is a block diagram showing a third communication example of the vehicle access control system 1 according to the embodiment. Fig. 10 is a sequence diagram showing the third communication example of the vehicle access control system 1 according to the embodiment. Fig. 11 is a diagram showing an example of a policy used in the third communication example of the vehicle access control system 1 according to the embodiment.

[0074] Like the second communication example, the third communication example is an example of communication when the first area and the second area cannot communicate directly. Specifically, when sending a message from "Area 1-C" of DC100 to "Area 2-C" of DC110 that belongs to the same "segment σ," "Filter 1-C" corresponding to "Area 1-C" and "Filter 2-C" corresponding to "Area 2-C" cannot communicate directly with each other via Ethernet.

[0075] Therefore, in the third communication example, "Filter 1-C" corresponding to "Area 1-C" which is the first area transmits a message to "Filter 2-C" corresponding to "Area 2-C" which is the second area, via "Filter 1-A" corresponding to "Area 1-A" which is the third area, and "Filter 2-A" corresponding to "Area 2-A" which is the third area. Therefore, in the third communication example, "Filter 1-C" functions as the first access control unit 51, "Filter 2-C" functions as the second access control unit 52, and "Filter 1-A" and "Filter 2-A" function as the third access control unit 53. Note that in the third communication example, "Filter 2-B" which corresponds to "Area 2-B" is used as a relay, but "Filter 2-B" does not convert the communication method, so "Filter 2-B" does not correspond to the third access control unit 53.

[0076] Specific communication modes will be described below with reference to Figures 10 and 11. First, when "Filter 1-C" receives a message with a data type of "ID2" from an application in "Area 1-C", it executes a determination process to determine whether the data type, destination, sender, and intermediate destination of the message are described in the policy it holds (S201). If it determines that they are described in the policy, "Filter 1-C" transmits the message to "Filter 1-A" in "Area 1-A", which is the intermediate destination, by inter-VM communication (S202).

[0077] When "Filter 1-A" receives a message from "Filter 1-C," it executes a determination process to determine whether the data type, destination, sender, and intermediate destinations of the message are described in the policy it holds (S203). If it determines that they are described in the policy, "Filter 1-A" transmits the message via Ethernet communication to "Filter 2-A" in "Area 2-A," which is the intermediate destination (S204).

[0078] When "Filter 2-A" receives a message from "Filter 1-A," it executes a determination process to determine whether the data type, destination, sender, and intermediate destination of the message are described in the policy it holds (S205). If it determines that they are described in the policy, "Filter 2-A" transmits the message to "Filter 2-B" in "Area 2-B," which is the intermediate destination, via inter-VM communication (S206).

[0079] When "Filter 2-B" receives a message from "Filter 2-A," it executes a determination process to determine whether the data type, destination, sender, and intermediate destinations of the message are described in the policy it holds (S207). If it determines that the data type, destination, sender, and intermediate destinations of the message are described in the policy, "Filter 2-B" transmits the message to "Filter 2-C" in "Area 2-C," which is the destination, via inter-VM communication (S208).

[0080] When "Filter 2-C" receives a message from "Filter 2-B," it executes a determination process to determine whether the data type, destination, sender, and intermediate destinations of the message are described in the policy it holds (S209). Since the destination of the message matches the destination described in the policy, "Filter 2-C" sends the message to the corresponding application in "Area 2-C." In this way, "Area 1-C" and "Area 2-C," which cannot communicate directly with each other, can communicate by relaying through "Area 1-A," "Area 2-A," and "Area 2-B."

[0081] In the third communication example, when sending a message from "Area 2-A" to "Area 2-C," security is improved by relaying the message through "Area 2-B," which functions as a gateway, but this is not limited to this. For example, in the third communication example, a message may be sent from "Area 2-A" to "Area 2-C" without relaying through "Area 2-B."

[0082] [3. Advantages] The advantages of the vehicle access control system 1 according to the embodiment will be described below. As described above, the vehicle access control system 1 according to the embodiment is capable of communicating between the first and second domains by relaying the message through a third domain having a function for converting the communication method, even when a message is sent from a first domain to a second domain and the first and second domains cannot communicate directly. Furthermore, the vehicle access control system 1 according to the embodiment is capable of improving the security of communication between the first and second domains by relaying the message through the third domain, even when the first and second domains can communicate directly. Therefore, the vehicle access control system 1 according to the embodiment has the advantage that segment separation can be applied to an in-vehicle system that employs multiple communication methods, and segment separation can be easily achieved at a relatively low cost.

[0083] (Other embodiments) As described above, the embodiments have been described as examples of the technology according to the present disclosure. However, the technology according to the present disclosure is not limited to these, and can be applied to embodiments in which appropriate modifications, substitutions, additions, omissions, etc. are made. For example, the following modifications are also included in one embodiment of the present disclosure.

[0084] For example, in the above embodiment, when each of the first access control unit 51, the second access control unit 52, and the third access control unit 53 transmits a message from its own segment to another segment, the message may be encrypted before transmission. For example, when transmitting a message from the first area to the second area via a third area outside the segment, there is a possibility that data of a type that is permitted to exist only within the segment may leak outside the segment, but encrypting the message in this manner makes it easier to avoid this leakage. Note that instead of encrypting the message, the filter 50 corresponding to the third area may delete the data from memory after transmitting or receiving the message.

[0085] Furthermore, in the above embodiment, if any of the filters 50 or the policies held by any of the filters 50 are tampered with, there is a possibility that data may be leaked outside the segment. Therefore, in order to prevent data leakage, a digital signature may be attached to each filter 50 and the policies held by that filter 50, and the integrity of that filter 50 and the policies held by that filter 50 may be ensured by verifying the digital signature when a device (for example, a DC) is started up or when communication is performed.

[0086] Also, for example, only when a predetermined condition is satisfied, a part of the policy held by each filter 50 may be temporarily changed or the policy may be switched to another policy. Such a configuration will be described below with reference to FIG.

[0087] 12 is a block diagram showing an example of a functional configuration of a vehicle access control system 1A according to a modified example of the embodiment. The vehicle access control system 1A according to this modified example differs from the vehicle access control system 1 according to the embodiment in that it further includes a trigger detection unit 70 and a policy management unit 80.

[0088] The trigger detection unit 70 is provided, for example, in an area other than the external connection area, and detects triggers related to the vehicle. The trigger detection unit 70 is provided in an area according to the type of trigger listed below. In the example shown in FIG. 12, the trigger detection unit 70 is provided in "Area 1-C" of DC100, which is a safe area.

[0089] The trigger detection unit 70 detects a trigger corresponding to, for example, the state of the vehicle. The state of the vehicle may include, for example, a state in which the vehicle is running, a state in which the vehicle is stopped, a state in which the vehicle is located at a specific location such as a residence, workplace, or store, a state in which the vehicle is charging if the vehicle is an electric vehicle, a state in which the vehicle is capable of or unable to communicate, or a state in which the vehicle is being manually or automatically driven. As an example, when the vehicle is being charged, the external connection area needs to be temporarily included in a segment including a safety area in order to notify the user's information processing device, such as a smartphone, of the vehicle's charging status. In such a case, the trigger detection unit 70 detects a trigger corresponding to the state in which the vehicle is being charged.

[0090] The trigger detection unit 70 also detects triggers corresponding to, for example, the contract status or usage status of a connected service used in the vehicle. As an example, in order to obtain information regarding whether or not a connected service contract is in place or information required when using the service from outside the vehicle, it is necessary to temporarily include the external connection area in a segment including a safety area. In such a case, the trigger detection unit 70 detects triggers corresponding to the contract status or usage status of the connected service.

[0091] The trigger detection unit 70 also detects a trigger corresponding to, for example, a vehicle occupant. As an example, the information accessible to each vehicle occupant may be limited. In such a case, the trigger detection unit 70 detects a trigger corresponding to the occupant's identification information. The identification information may include, for example, a vehicle key or biometric information such as the occupant's face or fingerprint.

[0092] Furthermore, the trigger detection unit 70 detects a trigger corresponding to an abnormal state of the vehicle, such as an attack by external access or a vehicle breakdown. As an example, if the vehicle is attacked by external access, it is necessary to separate the attacked area from the segment. In such a case, the trigger detection unit 70 detects a trigger corresponding to an attack by external access.

[0093] The policy management unit 80 is provided, for example, at a lower layer than the virtual machines, and manages the policies of each filter 50, in other words, the policies of the first access control unit 51, the second access control unit 52, and the third access control unit 53. In the example shown in FIG. 12 , the policy management unit 80 is provided in the virtualization platform 30 of the DC 100.

[0094] The policy management unit 80 changes the policy when the trigger detection unit 70 detects a trigger. Here, changing the policy may include changing part of the policy of each filter 50 (in other words, the policy of each of the first access control unit 51, the second access control unit 52, and the third access control unit 53), or changing the policy of each filter 50 to another policy that has been prepared in advance. Furthermore, the change of the policy may be temporary or permanent.

[0095] For example, when the trigger detection unit 70 detects a trigger corresponding to an attack caused by external access, the policy management unit 80 changes the policy of each filter 50 so as to separate the attacked area from the segment. In this way, the vehicle access control system 1A according to this modification has the advantage of being able to dynamically change the policy according to the state of the vehicle.

[0096] For example, in the above embodiment, each of the DCs 100 and 110 has four virtual machines, but may have three or fewer virtual machines, or may have five or more virtual machines. Furthermore, in the above embodiment, the segments are configured in units of virtual machines, but they may be configured in units of containers, or may be configured as a mixture of virtual machines and containers. Furthermore, the segments may be configured in units of applications or processes. In this case, the filter 50 may be disposed in a communication unit that performs communication between applications or a communication unit that performs communication between processes.

[0097] For example, in the above embodiment, rules that are independent of the communication method are implemented in each filter 50, and are dynamically converted into rules that are dependent on the communication method using conversion data such as that shown in FIG. 4, but rules that are dependent on the communication method may also be implemented in each filter 50.

[0098] Specifically, the data type in the common data of the message may include data specific to the communication method. For example, if the communication method is CAN communication, the CAN ID is the data type in the common data. If the communication method is Ethernet communication, the destination MAC address and source MAC address are the data types in the common data. If the communication method is socket communication, the destination port and source port are the data types in the common data. In this case, the third access control unit 53 does not need to add the communication data 64 to the message.

[0099] For example, in the above embodiment, if the SoC 10 and the MCU 20 each have multiple CPU cores, communication between the CPU cores may be adopted instead of communication between virtual machines if hardware or software for controlling communication between the CPU cores is provided. In this case, the virtualization platform 30 and the hardware virtualization support mechanism are not required in each of the SoC 10 and the MCU 20.

[0100] For example, in the above embodiment, an example was described in which the vehicle access control system 1 is realized by DC100, 110, but this is not limited to this and the system may also be realized by HPC (High-Performance Computing).

[0101] The order in which each step is executed in the sequence diagram is merely an example for specifically explaining the present disclosure, and an order other than the above may be used. Also, some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0102] The division of functional blocks in the block diagram is an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block.Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in time-sharing by a single piece of hardware or software.

[0103] Furthermore, each component described in the above embodiments may be implemented as software or, typically, as an LSI, an integrated circuit. These components may be integrated individually on a single chip, or some or all of them may be integrated on a single chip. While LSI is used here, it may also be referred to as an IC, system LSI, super LSI, or ultra LSI depending on the level of integration. Furthermore, the integration method is not limited to LSI; it may be implemented using a dedicated circuit (a general-purpose circuit that executes a dedicated program) or a general-purpose processor. It is also possible to use a field programmable gate array (FPGA), which can be programmed after LSI fabrication, or a reconfigurable processor, which allows the connection or settings of circuit cells within an LSI to be reconfigured. Furthermore, if an integrated circuit technology that can replace LSI emerges due to advances in semiconductor technology or a derivative technology, that technology may naturally be used to integrate the components.

[0104] A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple processing units on a single chip, and is specifically a computer system consisting of a microprocessor, ROM, RAM, etc. The ROM stores computer programs. The system LSI achieves its functions when the microprocessor operates in accordance with the computer programs.

[0105] Furthermore, one aspect of the present disclosure may be a computer program that causes a computer to execute each of the characteristic steps included in the security method shown in any of the above first to twelfth communication examples.

[0106] Furthermore, for example, the program may be a program to be executed by a computer. Another aspect of the present disclosure may be a computer-readable non-transitory recording medium on which such a program is recorded. For example, such a program may be recorded on a recording medium and distributed or circulated. For example, the distributed program may be installed in a device having another processor, and the program may be executed by the processor, thereby causing the device to perform each of the above processes.

[0107] In addition, this disclosure also includes forms obtained by making various modifications to the embodiments that a person skilled in the art would think of, and forms realized by arbitrarily combining the components and functions in each embodiment within the scope of the present disclosure.

[0108] (summary) As described above, the vehicle access control system 1, 1A according to the first aspect is a vehicle access control system 1, 1A mounted on a vehicle. The vehicle access control system 1, 1A includes a first access control unit 51, a second access control unit 52, and a third access control unit 53. The first access control unit 51 controls communication in a first area of a segment made up of multiple areas. The second access control unit 52 controls communication in a second area of the segment. The third access control unit 53 controls communication in a third area different from the first and second areas and has a function of converting the communication method. When sending a message from the first area to the second area, the first access control unit 51 relays the message through the third area.

[0109] According to this, when a message is sent from a first area to a second area and the first area and the second area cannot communicate directly, communication between the first area and the second area is possible by relaying through a third area having a function of converting the communication method. Also, according to this, even when the first area and the second area can communicate directly, the security of communication between the first area and the second area can be improved by relaying through the third area. Therefore, this has the advantage that segment separation can be applied to in-vehicle systems that are premised on employing multiple communication methods, and segment separation can be easily achieved at a relatively low cost.

[0110] In addition, in the vehicle access control system 1, 1A according to the second aspect, in the first aspect, each of the first access control unit 51, the second access control unit 52, and the third access control unit 53 has a policy including rules regarding received messages, and determines whether or not to transmit the received message based on the policy.

[0111] This has the advantage that only permitted messages can be transmitted, making it easier to ensure security inside the vehicle.

[0112] In the vehicle access control system 1, 1A according to the third aspect, in the second aspect, the third access control unit 53 adds communication data 64 used in communication with the destination of the message to the message and transmits the message.

[0113] This has the advantage that communication compatible with various communication methods can be performed by adding communication data 64 corresponding to the communication method to the message.

[0114] In addition, in the vehicle access control system 1, 1A relating to the fourth aspect, in the second or third aspect, when each of the first access control unit 51, the second access control unit 52, and the third access control unit 53 sends a message from the segment to which it belongs to another segment, it encrypts the message and sends it.

[0115] This has the advantage that when sending a message from the first area to the second area via a third area outside the segment, there is a possibility that data of a type that is only allowed to exist within that segment may leak outside the segment, but encrypting the message in this way makes it easier to avoid leakage.

[0116] Furthermore, the vehicle access control system 1A according to a fifth aspect is the same as in any one of the second to fourth aspects, and further includes a trigger detection unit 70 and a policy management unit 80. The trigger detection unit 70 detects a trigger related to the vehicle. The policy management unit 80 manages the policies of the first access control unit 51, the second access control unit 52, and the third access control unit 53. When the trigger detection unit 70 detects a trigger, the policy management unit 80 changes the policy.

[0117] This has the advantage that the policy can be dynamically changed depending on the state of the vehicle.

[0118] An access control method according to a sixth aspect is an access control method executed by a vehicle access control system 1, 1A mounted on a vehicle. The vehicle access control system 1, 1A controls communication in a first area of a segment made up of multiple areas. The vehicle access control system 1, 1A controls communication in a second area of the segment. The vehicle access control system 1, 1A has a function of converting the communication method and controls communication in a third area different from the first and second areas. When sending a message from the first area to the second area, the vehicle access control system 1, 1A relays the message through the third area.

[0119] According to this, when a message is sent from a first area to a second area and the first area and the second area cannot communicate directly, communication between the first area and the second area is possible by relaying through a third area having a function of converting the communication method. Also, according to this, even when the first area and the second area can communicate directly, the security of communication between the first area and the second area can be improved by relaying through the third area. Therefore, this has the advantage that segment separation can be applied to in-vehicle systems that are premised on employing multiple communication methods, and segment separation can be easily achieved at a relatively low cost.

[0120] A program according to a seventh aspect causes one or more processors to execute the access control method according to the sixth aspect.

[0121] According to this, when a message is sent from a first area to a second area and the first area and the second area cannot communicate directly, communication between the first area and the second area is possible by relaying through a third area having a function of converting the communication method. Also, according to this, even when the first area and the second area can communicate directly, the security of communication between the first area and the second area can be improved by relaying through the third area. Therefore, this has the advantage that segment separation can be applied to in-vehicle systems that are premised on employing multiple communication methods, and segment separation can be easily achieved at a relatively low cost. [Industrial Applicability]

[0122] The present disclosure can be applied to in-vehicle networks and the like. [Explanation of symbols]

[0123] 1,1A Vehicle Access Control System 10,11 SoC 10A,11A Ethernet communication section 20,21 MCU 20A,21A CAN communication section 30,31 Virtualization Platform 30A,31A VM communication section 40A, 41A Serial communication section 50 filters 51 First access control unit 52 Second access control section 53 Third access control section 70 Trigger detection unit 80 Policy Management Department 100,110 DC

Claims

1. A vehicle access control system mounted on a vehicle, comprising: The vehicle access control system includes: a first access control unit that controls communication in a first area of a segment that is configured with a plurality of areas; a second access control unit that controls communication in a second area of the segment; a third access control unit having a function of controlling communication in a third area different from the first area and the second area and converting a communication method; the first access control unit causes the third area to be a relay when transmitting a message from the first area to the second area; Vehicle access control system.

2. each of the first access control unit, the second access control unit, and the third access control unit has a policy including rules regarding the received message, and determines whether or not to transmit the received message based on the policy; The vehicle access control system of claim 1 .

3. the third access control unit adds communication data to the message to be used in communication with the destination of the message and transmits the message; The vehicle access control system of claim 2 .

4. When transmitting the message from the segment to which the first access control unit, the second access control unit, and the third access control unit belong to another segment, each of the first access control unit, the second access control unit, and the third access control unit encrypts and transmits the message.

4. A vehicle access control system according to claim 2 or 3.

5. a trigger detection unit that detects a trigger related to the vehicle; a policy management unit that manages the policies of the first access control unit, the second access control unit, and the third access control unit, the policy management unit changes the policy when the trigger detection unit detects the trigger; 4. A vehicle access control system according to claim 2 or 3.

6. 1. An access control method executed by a vehicle access control system mounted on a vehicle, comprising: The vehicle access control system includes: Controlling communication in a first area of a segment made up of a plurality of areas; Controlling communication in a second region of the segment; a communication system converting function for converting a communication method, and controlling communication in a third area different from the first area and the second area; When transmitting a message from the first area to the second area, the message is relayed through the third area. Access control methods.

7. one or more processors, Executing the access control method according to claim 6, program.

Images