In-vehicle system, in-vehicle device, data restoration program, and data distribution program

Abstract

To use concealed data more flexibly.SOLUTION: An in-vehicle system includes one or more storage devices that store storage destination information indicating storage destinations of multiple pieces of distributed data that are distributed data for restoring predetermined target data and distributed and stored in a plurality of storage destinations, and restoration information indicating a method for restoring the target data using the multiple pieces of distributed data, and a transmission device that transmits the storage destination information and the restoration information in the storage device to an external device.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle system, an in-vehicle device, a data restoration program, and a data distribution program. [Background technology]

[0002] Conventionally, techniques have been proposed that use secret sharing schemes to prevent data from being illegally obtained. For example, Patent Document 1 (JP 2022-42329 A) discloses the following key sharing method. That is, the key sharing method is a key sharing method between an authentication device and an authentication target device, in which the authentication device shares shared information with the authentication target device in advance, and one of the authentication device and the authentication target device generates a generated value using a predetermined method and shares it with the other. The authentication device and the authentication target device each generate a plurality of first shared information from the shared information using the generated value in a predetermined encoding method that can restore the pre-shared data by collecting all or part of the shared data obtained by dividing the pre-shared data into multiple pieces, and the authentication device and the authentication target device share one of the plurality of first shared information or derivative information derived from the one first shared information as a common key. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-42329 Summary of the Invention [Problem to be solved by the invention]

[0004] In the technology described in Patent Document 1, the destination for restoring data using distributed data is limited to a predetermined device.

[0005] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide an in-vehicle system, an in-vehicle device, a data recovery program, and a data distribution program that enable more flexible use of concealed data. [Means for solving the problem]

[0006] The in-vehicle system of the present disclosure includes one or more storage devices that store distributed data for restoring specified target data, where the distributed data is stored in a distributed manner in a plurality of storage locations, storage destination information indicating the storage destinations of the distributed data, and restoration information indicating a method for restoring the target data using the distributed data, and a transmission device that transmits the storage destination information and the restoration information in the storage device to an external device.

[0007] One aspect of the present disclosure may be realized not only as an in-vehicle system including such a characteristic processing unit, but also as a communication method including steps of such characteristic processing, or as a program for causing a computer to execute such steps. Furthermore, one aspect of the present disclosure may be realized not only as an in-vehicle device including such a characteristic processing unit, but also as a data distribution method including steps of such characteristic processing, or as a semiconductor integrated circuit that implements part or all of the in-vehicle device. Furthermore, one aspect of the present disclosure may be realized not only as an in-vehicle device including such a characteristic processing unit, but also as a data restoration method including steps of such characteristic processing, or as a semiconductor integrated circuit that implements part or all of the in-vehicle device. [Effects of the Invention]

[0008] According to the present disclosure, anonymized data can be used more flexibly. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating a configuration of a communication system according to an embodiment of the present disclosure. [Figure 2]FIG. 2 is a diagram illustrating a configuration of an in-vehicle ECU according to an embodiment of the present disclosure. [Figure 3] FIG. 3 is a diagram illustrating a configuration of another in-vehicle ECU according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a flowchart defining an example of an operation procedure when the in-vehicle ECU according to the embodiment of the present disclosure distributes distributed data. [Figure 5] FIG. 5 is a flowchart defining an example of an operation procedure when the in-vehicle ECU according to the embodiment of the present disclosure restores authentication data. [Figure 6] FIG. 6 is a diagram illustrating an example of a sequence of distributing distributed data in a communication system according to an embodiment of the present disclosure. [Figure 7] FIG. 7 is a diagram illustrating an example of a sequence of restoring authentication data in a communication system according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0010] First, the contents of the embodiments of the present disclosure will be listed and described. (1) An in-vehicle system according to an embodiment of the present disclosure includes one or more storage devices that store distributed data for restoring specified target data, the distributed data being stored in a distributed manner across multiple storage locations, storage destination information indicating the storage destinations of multiple pieces of the distributed data, and restoration information indicating a method for restoring the target data using the multiple pieces of distributed data; and a transmission device that transmits the storage destination information and the restoration information in the storage device to an external device.

[0011] With this configuration, the external device can acquire the distributed data from the storage destination indicated by the storage destination information and restore the target data based on the distributed data and the restoration information, so that the target data can be restored and used in devices other than the device that generated the distributed data, such as devices that do not have the storage destination information and restoration information in advance.This allows for more flexible use of the concealed data.

[0012] (2) In the above (1), the in-vehicle system may include a first storage device that is the storage device that stores the destination information, and a second storage device that is the storage device that stores the restoration information.

[0013] With this configuration, compared to a configuration in which the destination information and the restoration information are stored in a single storage device, the destinations for the destination information and the restoration information can be distributed and the communication paths for transmitting the destination information and the restoration information to an external device can be separated, thereby reducing the risk of the target data being illegally restored due to leakage of the destination information and the restoration information. Furthermore, compared to a configuration in which the destination information and the restoration information are stored in a single storage device, requirements such as the storage capacity of the storage device, the security of the storage device, and the processing performance of the transmission device can be reduced, making it possible to build an in-vehicle system with a simple configuration.

[0014] (3) In (2) above, the restoration information may be stored in advance in the second storage device, and the in-vehicle system may further include a distribution device that generates the plurality of distributed data and the storage destination information, stores the generated storage destination information in the first storage device, and stores the generated plurality of distributed data in a distributed manner.

[0015] With this configuration, the distribution device that stores the distributed data can generate and store destination information through simple processing.

[0016] (4) In the above (3), the first storage device and the second storage device may have higher tamper resistance than the distribution device.

[0017] With this configuration, the risk of leakage of the storage destination information and restoration information can be reduced compared to a configuration in which the distribution device stores the storage destination information and restoration information.

[0018] (5) An in-vehicle device according to an embodiment of the present disclosure is an in-vehicle device mounted on a vehicle, and includes: a destination information acquisition unit that acquires, from a device external to the in-vehicle device, destination information indicating the destinations of a plurality of distributed data for restoring specified target data, the distributed data being distributed and stored in a plurality of destinations; a restoration information acquisition unit that acquires, from a device external to the in-vehicle device, restoration information indicating a method for restoring the target data using the plurality of distributed data; a distributed data acquisition unit that acquires the plurality of distributed data based on the destination information acquired by the destination information acquisition unit; and a restoration unit that restores the target data based on the restoration information acquired by the restoration information acquisition unit and the plurality of distributed data acquired by the distributed data acquisition unit.

[0019] With this configuration, the distributed data that has been distributed and stored by other devices can be obtained based on the storage destination information, and the target data can be restored based on the distributed data and the restoration information. Therefore, the target data can be restored and used in devices other than the device that generated the distributed data, such as devices that do not have the storage destination information and restoration information in advance. Therefore, the confidential data can be used more flexibly.

[0020] (6) An in-vehicle device according to an embodiment of the present disclosure is an in-vehicle device mounted on a vehicle, and includes a distribution unit that generates multiple distributed data for restoring specified target data and distributes and stores the generated multiple distributed data across multiple storage devices, a generation unit that generates destination information indicating the destination where the multiple distributed data will be stored by the distribution unit, and a transmission unit that transmits the destination information generated by the generation unit to a device external to the in-vehicle device.

[0021] With this configuration, a device other than the in-vehicle device can acquire the distributed data from the storage destination indicated by the storage destination information and restore the target data based on the distributed data and the restoration information, so that the target data can be restored and used in a device other than the device that generated the distributed data, such as a device that does not have the storage destination information and the restoration information in advance. Therefore, the concealed data can be used more flexibly.

[0022] (7) A data restoration program according to an embodiment of the present disclosure is a data restoration program used in an on-board device mounted on a vehicle, and causes a computer to function as: a destination information acquisition unit that acquires, from a device external to the on-board device, destination information indicating the destinations of a plurality of distributed data pieces for restoring specified target data, the distributed data pieces being distributed and stored in a plurality of destinations; a restoration information acquisition unit that acquires, from a device external to the on-board device, restoration information indicating a method for restoring the target data using the plurality of distributed data pieces; a distributed data acquisition unit that acquires the plurality of distributed data pieces based on the destination information acquired by the destination information acquisition unit; and a restoration unit that restores the target data based on the restoration information acquired by the restoration information acquisition unit and the plurality of distributed data pieces acquired by the distributed data acquisition unit.

[0023] With this configuration, the distributed data that has been distributed and stored by other devices can be obtained based on the storage destination information, and the target data can be restored based on the distributed data and the restoration information. Therefore, the target data can be restored and used in devices other than the device that generated the distributed data, such as devices that do not have the storage destination information and restoration information in advance. Therefore, the confidential data can be used more flexibly.

[0024] (8) A data distribution program according to an embodiment of the present disclosure is a data distribution program used in an on-board device mounted in a vehicle, and is a program for causing a computer to function as a distribution unit that generates multiple pieces of distributed data for restoring specified target data and distributes and stores the generated multiple pieces of distributed data across multiple storage devices, a generation unit that generates destination information indicating the destination of the multiple pieces of distributed data stored by the distribution unit, and a transmission unit that transmits the destination information generated by the generation unit to a device external to the on-board device.

[0025] With this configuration, a device other than the in-vehicle device can acquire the distributed data from the storage destination indicated by the storage destination information and restore the target data based on the distributed data and the restoration information, so that the target data can be restored and used in a device other than the device that generated the distributed data, such as a device that does not have the storage destination information and the restoration information in advance. Therefore, the concealed data can be used more flexibly.

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0027] [Configuration and basic operation] FIG. 1 is a diagram illustrating a configuration of a communication system according to an embodiment of the present disclosure. Referring to FIG. 1, a communication system 501 includes a relay device 51, an in-vehicle ECU (Electronic Control Unit) 101, in-vehicle ECUs 201A and 201B that are in-vehicle ECUs 201, in-vehicle ECUs 301A and 301B that are in-vehicle ECUs 301, and a plurality of in-vehicle ECUs 401. The communication system 501 is mounted on a vehicle 1. The in-vehicle ECUs 101, 201, 301, and 401 and the relay device 51 are examples of in-vehicle devices. The in-vehicle ECU 101 is an example of a distributed device. The in-vehicle ECU 201 is an example of a restoration device. The in-vehicle ECU 301A is an example of a first storage device and an example of a transmission device. The in-vehicle ECU 301B is an example of a second storage device and an example of a transmission device.

[0028] The relay device 51 and the in-vehicle ECUs 101, 201, 301, and 401 are connected to one another via a transmission line 2. The transmission line 2 is, for example, an Ethernet (registered trademark) cable. Note that the transmission line 2 is not limited to an Ethernet cable, and may be a communication line conforming to other standards such as CAN (Controller Area Network) (registered trademark) and FlexRay (registered trademark).

[0029] The relay device 51 is capable of communicating with the in-vehicle ECUs 101, 201, 301, and 401. The relay device 51 performs a relay process of relaying communication data transmitted and received in the communication system 501. More specifically, the relay device 51 relays communication data transmitted and received between the in-vehicle ECUs 101, 201, 301, and 401, and communication data transmitted and received between the in-vehicle ECUs 101, 201, 301, and 401 and a communication device (not shown) outside the vehicle 1.

[0030] The in-vehicle ECU 101 generates a plurality of distributed data Dv1 for restoring the authentication data D1. The authentication data D1 is an example of target data. The authentication data D1 is highly confidential data including personal information of a user. The in-vehicle ECU 101 distributes and stores the generated plurality of distributed data Dv1. More specifically, the in-vehicle ECU 101 distributes the distributed data Dv1 to the in-vehicle ECU 401.

[0031] The in-vehicle ECU 301A stores storage destination information indicating storage destinations of the plurality of distributed data Dv1. For example, the in-vehicle ECU 101 generates storage destination information and stores the generated storage destination information in the in-vehicle ECU 301A. For example, the in-vehicle ECU 301A has higher tamper resistance than the in-vehicle ECU 101.

[0032] The in-vehicle ECU 301B stores restoration information indicating a method for restoring the authentication data D1 using the multiple pieces of distributed data Dv1. The restoration information is, for example, a pre-created application program for executing a restoration algorithm for restoring the authentication data D1. For example, the restoration information is stored in advance in a storage unit (not shown) in the in-vehicle ECU 301B. More specifically, the restoration information is stored in the in-vehicle ECU 301B by the manufacturer of the vehicle 1 before shipping the vehicle 1. Furthermore, for example, the in-vehicle ECU 301B has higher tamper resistance than the in-vehicle ECU 101.

[0033] The in-vehicle ECU 201 restores the authentication data D1 using the plurality of distributed data Dv1, and performs a predetermined target process using the restored authentication data D1. For example, the in-vehicle ECU 201A is equipped with a door opening / closing application. If the in-vehicle ECU 201A is successful in user authentication using the authentication data D1, the in-vehicle ECU 201A performs a process of automatically opening and closing the doors of the vehicle 1. Furthermore, the in-vehicle ECU 201B is equipped with an engine start application. If the in-vehicle ECU 201B is successful in user authentication using the authentication data D1, the in-vehicle ECU 201 performs a process of automatically starting the engine of the vehicle 1. The in-vehicle ECU 201 may be provided in the communication system 501 in advance before the vehicle 1 is shipped, or may be added to the communication system 501 after the vehicle 1 is shipped.

[0034] The processing of each in-vehicle device in communication system 501 will be described in detail below.

[0035] (In-vehicle ECU101) 2 is a diagram illustrating a configuration of an in-vehicle ECU according to an embodiment of the present disclosure. Referring to FIG. 2, the in-vehicle ECU 101 includes a communication unit 11 and a distributed processing unit 12. The communication unit 11 is an example of a transmission unit. The distributed processing unit 12 is an example of a distribution unit and an example of a generation unit. Some or all of the functions of the communication unit 11 and the distributed processing unit 12 are realized, for example, by a processing circuit including one or more processors.

[0036] The communication unit 11 transmits and receives communication data to and from the relay device 51. More specifically, the communication unit 11 transmits and receives frames including communication data to and from the relay device 51.

[0037] The distributed processing unit 12 generates a plurality of pieces of shared data Dv1 for restoring the authentication data D1. For example, the distributed processing unit 12 accepts registration of the authentication data D1 from the user of the vehicle 1. The distributed processing unit 12 generates the plurality of pieces of shared data Dv1 based on the registered authentication data D1, for example, according to a secret sharing scheme.

[0038] More specifically, the distribution processing unit 12 generates n pieces of shared data Dv1 according to a (k, n) threshold scheme, which is an example of a secret sharing scheme. The authentication data Dv1 can be restored using at least k pieces of shared data Dv1 among the n pieces of shared data Dv1. Here, n is an integer equal to or greater than 2. k is an integer equal to or greater than 2 and equal to or less than n. The distribution processing unit 12 may generate the shared data Dv1 according to a secret sharing scheme other than the (k, n) threshold scheme, such as the AONT (All Or Nothing Transformation) scheme. Alternatively, instead of using a secret sharing scheme, the distribution processing unit 12 may generate shared data Dv1, which is data obtained by dividing the authentication data D1 into multiple pieces.

[0039] The distributed processing unit 12 distributes and stores the generated plurality of distributed data Dv1 in a plurality of on-board ECUs 401. The distributed processing unit 12 generates storage destination information indicating storage destinations of the plurality of distributed data Dv1. More specifically, the distributed processing unit 12 selects n on-board ECUs 401 as storage destinations for the distributed data Dv1 from the plurality of on-board ECUs 401 in the communication system 501. The distributed processing unit 12 may select a predetermined n on-board ECUs 401, or may randomly select n on-board ECUs 401 from the on-board ECUs 401 in the communication system 501. The distributed processing unit 12 generates storage destination information indicating the ID of each selected on-board ECU 401, and outputs the generated storage destination information and the n pieces of distributed data Dv1 to the communication unit 11. Note that the distributed processing unit 12 may select the relay device 51 or a server outside the vehicle 1 as a storage destination for some of the n pieces of distributed data Dv1.

[0040] The communication unit 11 distributes the distributed data Dv1 received from the distributed processing unit 12 to the in-vehicle ECUs 401. More specifically, the communication unit 11 transmits the n pieces of distributed data Dv1 received from the distributed processing unit 12 to the n in-vehicle ECUs 401 via the relay device 51, respectively, in accordance with the storage destination information received from the distributed processing unit 12.

[0041] The in-vehicle ECU 401 receives the distributed data Dv1 from the in-vehicle ECU 101 via the relay device 51, and stores the received distributed data Dv1 in a storage unit (not shown) in the in-vehicle ECU 401.

[0042] Furthermore, the communication unit 11 transmits the storage destination information generated by the distributed processing unit 12 to the in-vehicle ECU 301A, which is an external device of the in-vehicle ECU 101. More specifically, the communication unit 11 transmits the storage destination information received from the distributed processing unit 12 to the in-vehicle ECU 301A via the relay device 51.

[0043] The in-vehicle ECU 301A receives the storage destination information from the in-vehicle ECU 101 via the relay device 51, and stores the received storage destination information in a storage unit (not shown) in the in-vehicle ECU 301A.

[0044] (In-vehicle ECU201) 3 is a diagram illustrating the configuration of another in-vehicle ECU according to an embodiment of the present disclosure. Referring to FIG. 3, the in-vehicle ECU 201 includes a communication unit 21, a processing unit 22, an acquisition unit 23, a restoration unit 24, and a storage unit 25. The acquisition unit 23 is an example of a storage destination information acquisition unit, an example of a restoration information acquisition unit, and an example of a distributed data acquisition unit. Some or all of the functions of the communication unit 21, the processing unit 22, the acquisition unit 23, and the restoration unit 24 are realized, for example, by a processing circuit including one or more processors. The storage unit 25 is, for example, a non-volatile memory included in the processing circuit.

[0045] The communication unit 21 transmits and receives communication data to and from the relay device 51. More specifically, the communication unit 21 transmits and receives frames including communication data to and from the relay device 51.

[0046] For example, the processing unit 22 receives authentication data Da from the user of the vehicle 1. Upon receiving the authentication data Da from the user, the processing unit 22 outputs a restoration instruction to the acquisition unit 23 indicating that the authentication data D1 should be restored in order to perform user authentication.

[0047] The acquisition unit 23 acquires the storage location information and the restoration information from a device external to the in-vehicle ECU 201. More specifically, upon receiving a restoration instruction from the processing unit 22, the acquisition unit 23 broadcasts a transmission request R1 for the storage location information and a transmission request R2 for the restoration information to the in-vehicle ECUs 101, 103, and 104 via the communication unit 21 and the relay device 51.

[0048] The in-vehicle ECU 301A transmits the storage location information to the in-vehicle ECU 201, which is an external device of the in-vehicle ECU 301A. More specifically, when the in-vehicle ECU 301A receives a transmission request R1 from the in-vehicle ECU 201, the in-vehicle ECU 301A acquires the storage location information from a storage unit in the in-vehicle ECU 301A, and transmits the acquired storage location information to the in-vehicle ECU 201 via the relay device 51 in response to the transmission request R1. The in-vehicle ECU 301A may transmit the storage location information encrypted according to a predetermined encryption method to the in-vehicle ECU 201, or may transmit the storage location information in plain text to the in-vehicle ECU 201.

[0049] The in-vehicle ECU 301B transmits the restoration information to the in-vehicle ECU 201, which is an external device of the in-vehicle ECU 301B. More specifically, when the in-vehicle ECU 301B receives a transmission request R2 from the in-vehicle ECU 201, the in-vehicle ECU 301B acquires the restoration information from a storage unit in the in-vehicle ECU 301B, and transmits the acquired restoration information to the in-vehicle ECU 201 via the relay device 51 in response to the transmission request R2. The in-vehicle ECU 301B may transmit the restoration information encrypted according to a predetermined encryption method to the in-vehicle ECU 201, or may transmit the restoration information in plain text to the in-vehicle ECU 201.

[0050] The acquisition unit 23 receives storage destination information from the in-vehicle ECU 301A via the relay device 51 and the communication unit 21, and stores the received storage destination information in the storage unit 25. The acquisition unit 23 also receives restoration information from the in-vehicle ECU 301B via the relay device 51 and the communication unit 21, and stores the received restoration information in the storage unit 25.

[0051] The acquisition unit 23 acquires the plurality of distributed data Dv1 based on the acquired storage destination information. More specifically, the acquisition unit 23 collects the distributed data Dv1 from the n in-vehicle ECUs 401 indicated by the acquired storage destination information. Specifically, the acquisition unit 23 transmits a transmission request R3 for the distributed data Dv1 to the n in-vehicle ECUs 401 via the communication unit 21 and the relay device 51.

[0052] When the in-vehicle ECU 401 receives a transmission request R2 from the in-vehicle ECU 201 via the relay device 51, it acquires the distributed data Dv1 from the memory unit in the in-vehicle ECU 401 and transmits the acquired distributed data Dv1 to the in-vehicle ECU 201 via the relay device 51 in response to the transmission request R3.

[0053] The acquisition unit 23 receives the distributed data Dv1 from each in-vehicle ECU 401 via the relay device 51 and the communication unit 21, and stores the received distributed data Dv1 in the storage unit 25.

[0054] The restoration unit 24 restores the authentication data D1 based on the restoration information acquired by the acquisition unit 23 and the plurality of distributed data Dv1 acquired by the acquisition unit 23. More specifically, when k or more pieces of distributed data Dv1 out of the n pieces of distributed data Dv1 are stored in the storage unit 25, the restoration unit 24 acquires the distributed data Dv1 and the restoration information from the storage unit 25. The restoration unit 24 restores the authentication data D1 based on the acquired distributed data Dv1 and restoration information.

[0055] The restoration unit 24 stores the restored authentication data D1 in the storage unit 25. The restoration unit 24 also outputs the authentication data D1 to the processing unit 22.

[0056] The processing unit 22 performs user authentication upon receiving the authentication data D1 from the restoration unit 24. More specifically, the processing unit 22 compares the authentication data D1 received from the restoration unit 24 with the authentication data Da received from the user.

[0057] If the user authentication is successful, i.e., if the authentication data D1 matches the authentication data Da, the processing unit 22 performs a predetermined target process. More specifically, if the user authentication is successful, the processing unit 22 in the in-vehicle ECU 201A performs a process of automatically opening and closing the doors of the vehicle 1. Furthermore, if the user authentication is successful, the processing unit 22 in the in-vehicle ECU 201B performs a process of automatically starting the engine of the vehicle 1.

[0058] When the processing unit 22 completes the target process, it erases the shared data Dv1, the authentication data D1, the storage destination information, and the restoration information from the storage unit 25.

[0059] [Operation flow] FIG. 4 is a flowchart defining an example of an operation procedure when the in-vehicle ECU according to the embodiment of the present disclosure distributes distributed data.

[0060] Referring to FIG. 4, first, the in-vehicle ECU 101 accepts registration of authentication data D1 from the user of the vehicle 1 (step S11).

[0061] Next, the in-vehicle ECU 101 generates n pieces of distributed data Dv1 based on the authentication data D1 (step S12).

[0062] Next, the in-vehicle ECU 101 selects n in-vehicle ECUs 401 as storage destinations for the distributed data Dv1 (step S13).

[0063] Next, the in-vehicle ECU 101 generates storage destination information indicating the ID of each selected in-vehicle ECU 401 (step S14).

[0064] Next, the in-vehicle ECU 101 distributes and stores the generated distributed data Dv1 among the selected n in-vehicle ECUs 401. More specifically, the in-vehicle ECU 101 transmits the n pieces of distributed data Dv1 to the n in-vehicle ECUs 401 via the relay device 51 (step S15).

[0065] Next, the in-vehicle ECU 101 transmits the generated storage destination information to the in-vehicle ECU 301A via the relay device 51 (step S16).

[0066] FIG. 5 is a flowchart defining an example of an operation procedure when the in-vehicle ECU according to the embodiment of the present disclosure restores authentication data.

[0067] Referring to FIG. 5, first, the in-vehicle ECU 201 waits for an opportunity to perform user authentication (NO in step S21), and when the opportunity to perform user authentication arrives after receiving authentication data Da from the user (YES in step S21), the in-vehicle ECU 201 acquires storage location information and restoration information from the in-vehicle ECUs 301A and 301B, respectively (step S22).

[0068] Next, the in-vehicle ECU 201 acquires the plurality of distributed data Dv1 based on the acquired storage destination information. More specifically, the in-vehicle ECU 201 collects the distributed data Dv1 from the n in-vehicle ECUs 401 indicated by the storage destination information (step S23).

[0069] Next, the in-vehicle ECU 201 restores the authentication data D1 based on the restoration information and the plurality of pieces of distributed data Dv1 (step S24).

[0070] Next, the in-vehicle ECU 201 performs user authentication. More specifically, the in-vehicle ECU 201 compares the authentication data D1 with the authentication data Da received from the user (step S25).

[0071] Next, if the user authentication is successful, the in-vehicle ECU 201 performs a predetermined target process (step S26).

[0072] Next, the in-vehicle ECU 201 erases the distributed data Dv1, the authentication data D1, the storage destination information, and the restoration information (step S27).

[0073] Next, the in-vehicle ECU 201 waits for a new opportunity to perform user authentication (NO in step S21).

[0074] FIG. 6 is a diagram illustrating an example of a sequence of distributing distributed data in a communication system according to an embodiment of the present disclosure.

[0075] Referring to FIG. 6, first, the in-vehicle ECU 101 accepts registration of authentication data D1 from the user of the vehicle 1, and generates n pieces of distributed data Dv1 based on the registered authentication data D1 (step S31).

[0076] Next, the in-vehicle ECU 101 selects n in-vehicle ECUs 401 as storage destinations for the distributed data Dv1, and generates storage destination information indicating the ID of each of the selected in-vehicle ECUs 401 (step S32).

[0077] Next, the in-vehicle ECU 101 transmits the n pieces of distributed data Dv1 to the n in-vehicle ECUs 401 via the relay device 51 (step S33).

[0078] Next, each of the in-vehicle ECUs 401 stores the distributed data Dv1 received from the in-vehicle ECU 101 in a storage unit (step S34).

[0079] Next, the in-vehicle ECU 101 transmits the storage destination information to the in-vehicle ECU 301A via the relay device 51 (step S35).

[0080] Next, the in-vehicle ECU 301A stores the storage destination information received from the in-vehicle ECU 101 in the storage unit (step S36).

[0081] FIG. 7 is a diagram illustrating an example of a sequence of restoring authentication data in a communication system according to an embodiment of the present disclosure.

[0082] 7, first, when an opportunity to perform user authentication arrives upon receiving authentication data Da from a user, in-vehicle ECU 201 broadcasts a transmission request R1 for storage location information via relay device 51 (step S41).

[0083] Next, in response to the transmission request R1, the in-vehicle ECU 301A transmits the storage destination information to the in-vehicle ECU 201 via the relay device 51 (step S42).

[0084] Next, the in-vehicle ECU 201 broadcasts a transmission request R2 for restoration information via the relay device 51 (step S43).

[0085] Next, the in-vehicle ECU 301B transmits the restoration information to the in-vehicle ECU 201 via the relay device 51 in response to the transmission request R2 (step S44).

[0086] Next, the in-vehicle ECU 201 transmits a transmission request R3 for the distributed data Dv1 to the n in-vehicle ECUs 401 indicated by the storage destination information via the relay device 51 (step S45).

[0087] Next, each in-vehicle ECU 401 transmits the distributed data Dv1 to the in-vehicle ECU 201 via the relay device 51 in response to the transmission request R3 (step S46).

[0088] Next, the in-vehicle ECU 201 restores the authentication data D1 based on the restoration information and the plurality of pieces of distributed data Dv1 (step S47).

[0089] Next, the in-vehicle ECU 201 performs user authentication, and if the user authentication is successful, performs a predetermined target process (step S48).

[0090] Next, the in-vehicle ECU 201 erases the distributed data Dv1, the authentication data D1, the storage destination information, and the restoration information (step S49).

[0091] In the communication system 501 according to the embodiment of the present disclosure, the in-vehicle ECU 101 is configured to generate a plurality of distributed data Dv1 for restoring the authentication data D1, but this is not limiting. The in-vehicle ECU 101 may be configured to generate a plurality of distributed data Dv1 for restoring other data, such as an encryption key and user biometric information, instead of the authentication data D1.

[0092] Furthermore, although the communication system 501 according to the embodiment of the present disclosure is configured to be mounted on the vehicle 1, the present disclosure is not limited to this. The communication system 501 may also be mounted on a consumer network, an industrial network, or the like.

[0093] Furthermore, in the communication system 501 according to the embodiment of the present disclosure, the in-vehicle ECU 101 is configured to generate the distributed data Dv1 and distribute the generated distributed data Dv1 to the in-vehicle ECU 401, but this is not limiting. Instead of the in-vehicle ECU 101, a device external to the communication system 501 may be configured to generate and store the distributed data Dv1 in accordance with a user operation.

[0094] Furthermore, although the communication system 501 according to the embodiment of the present disclosure is configured to include the in-vehicle ECUs 301A and 301B, the present disclosure is not limited to this. The communication system 501 may be configured to include a single in-vehicle ECU 301 that stores the storage destination information and the restoration information.

[0095] Furthermore, in the communication system 501 according to the embodiment of the present disclosure, the in-vehicle ECU 301 is configured to have higher tamper resistance than the in-vehicle ECU 101, but this is not limited to this. The in-vehicle ECU 301 may be configured to have the same tamper resistance as the in-vehicle ECU 101 or lower tamper resistance than the in-vehicle ECU 101.

[0096] In addition, in the communication system 501 according to the embodiment of the present disclosure, the restoration information is configured to be stored in advance in the in-vehicle ECU 301B, but this is not limited thereto. The in-vehicle ECU 101 may generate the restoration information and store the generated restoration information in the in-vehicle ECU 301B.

[0097] Furthermore, in the in-vehicle ECU 101 according to the embodiment of the present disclosure, the communication unit 11 is configured to transmit the storage destination information to the in-vehicle ECU 301A via the relay device 51, but this is not limited to this. The communication unit 11 may be configured not to transmit the storage destination information to the in-vehicle ECU 301A. In this case, the distributed processing unit 12 stores the generated storage destination information in a storage unit (not shown). Then, when the communication unit 11 receives a transmission request R1 from the in-vehicle ECU 201, it acquires the storage destination information from the storage unit and transmits the acquired storage destination information to the in-vehicle ECU 201 via the relay device 51 as a response to the transmission request R1.

[0098] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0099] Each process (each function) in the above-described embodiments is realized by a processing circuit including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the program read from the one or more memories, or according to a logic circuit pre-designed to execute each of the processes. The processor may be various processors suitable for computer control, such as a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a field programmable gate array (FPGA), and an application-specific integrated circuit (ASIC). Note that the physically separate processors may cooperate with each other to execute each of the processes. For example, the processors mounted on a plurality of physically separated computers may cooperate with each other to execute the above processes via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, etc. The program may be installed into the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and installed into the memory from the recording medium.

[0100] The above description includes the following additional features. [Appendix 1] A communication method in an in-vehicle system, comprising: the in-vehicle system includes one or more storage devices that store distributed data for restoring predetermined target data, the distributed data being distributed and stored in multiple storage locations, and storage destination information indicating the storage destinations of a plurality of the distributed data, and restoration information indicating a method for restoring the target data using the plurality of distributed data; The communication method includes: a step of receiving a request to transmit the storage location information by a first transmitting device; a step of the first transmitting device transmitting the storage destination information in the storage device to an external device; receiving a request to transmit the restoration information by the second transmitting device; the second transmitting device transmitting the restoration information in the storage device to an external device.

[0101] [Appendix 2] An in-vehicle device mounted on a vehicle, processing circuitry; The processing circuitry acquiring, from a device external to the in-vehicle device, storage destination information indicating storage destinations of a plurality of pieces of distributed data for restoring predetermined target data, the distributed data being distributed and stored in a plurality of storage destinations; acquiring restoration information indicating a method for restoring the target data using the plurality of pieces of distributed data from an external device of the in-vehicle device; acquiring the plurality of pieces of distributed data based on the acquired storage destination information; The in-vehicle device restores the target data based on the acquired restoration information and the acquired plurality of pieces of distributed data.

[0102] [Appendix 3] An in-vehicle device mounted on a vehicle, processing circuitry; The processing circuitry generating a plurality of pieces of distributed data for restoring predetermined target data, distributing and storing the generated plurality of pieces of distributed data in a plurality of storage devices; generating storage destination information indicating a storage destination of the plurality of distributed data; The in-vehicle device transmits the generated storage destination information to an external device of the in-vehicle device. [Explanation of symbols]

[0103] 1 vehicle 2 Transmission Lines 11 Communications Department 12 Distributed Processing Unit 21 Communications Department 22 Processing section 23 Acquisition Department 24 Restoration Section 25 Memory section 51 Relay device 101 Automotive ECU 201,201A,201B Automotive ECU 301,301A,301B Automotive ECU 401 Automotive ECU

Claims

1. one or more storage devices that store distributed data for restoring predetermined target data, the distributed data being distributed and stored in a plurality of storage locations, and storage destination information indicating the storage destinations of a plurality of the distributed data, and restoration information indicating a method for restoring the target data using the plurality of distributed data; a transmitting device that transmits the storage destination information and the restoration information in the storage device to an external device.

2. The in-vehicle system includes: a first storage device that stores the destination information; The in-vehicle system according to claim 1 , further comprising: a second storage device that stores the restoration information.

3. the restoration information is stored in advance in the second storage device; The in-vehicle system further comprises:

3. The in-vehicle system according to claim 2, further comprising a distribution device that generates the plurality of distributed data and the storage destination information, stores the generated storage destination information in the first storage device, and distributes and stores the generated plurality of distributed data in a plurality of storage devices.

4. The in-vehicle system according to claim 3 , wherein the first storage device and the second storage device have higher tamper resistance than the distributed device.

5. An in-vehicle device mounted on a vehicle, a storage destination information acquisition unit that acquires, from a device external to the in-vehicle device, storage destination information indicating storage destinations of a plurality of pieces of distributed data for restoring predetermined target data, the distributed data being distributed and stored in a plurality of storage destinations; a restoration information acquisition unit that acquires restoration information indicating a method for restoring the target data using the plurality of distributed data from an external device of the in-vehicle device; a shared data acquisition unit that acquires the plurality of shared data items based on the storage destination information acquired by the storage destination information acquisition unit; a restoration unit that restores the target data based on the restoration information acquired by the restoration information acquisition unit and the plurality of distributed data acquired by the distributed data acquisition unit.

6. An in-vehicle device mounted on a vehicle, a distribution unit that generates a plurality of pieces of distributed data for restoring predetermined target data and distributes and stores the generated plurality of pieces of distributed data in a plurality of storage devices; a generation unit that generates storage destination information indicating a storage destination of the plurality of distributed data by the distribution unit; a transmitting unit configured to transmit the storage destination information generated by the generating unit to a device external to the in-vehicle device.

7. A data recovery program for use in an in-vehicle device mounted in a vehicle, Computer, a storage destination information acquisition unit that acquires, from a device external to the in-vehicle device, storage destination information indicating storage destinations of a plurality of pieces of distributed data for restoring predetermined target data, the distributed data being distributed and stored in a plurality of storage destinations; a restoration information acquisition unit that acquires restoration information indicating a method for restoring the target data using the plurality of distributed data from an external device of the in-vehicle device; a shared data acquisition unit that acquires the plurality of shared data items based on the storage destination information acquired by the storage destination information acquisition unit; a restoration unit that restores the target data based on the restoration information acquired by the restoration information acquisition unit and the plurality of distributed data acquired by the distributed data acquisition unit; A data recovery program to function as a

8. A data distribution program used in an in-vehicle device mounted on a vehicle, Computer, a distribution unit that generates a plurality of pieces of distributed data for restoring predetermined target data and distributes and stores the generated plurality of pieces of distributed data in a plurality of storage devices; a generation unit that generates storage destination information indicating storage destinations of the plurality of distributed data stored by the distribution unit; a transmission unit that transmits the storage destination information generated by the generation unit to a device external to the in-vehicle device; A data distribution program to function as a

Images