Authentication system and relay device

Abstract

An authentication system (1) is provided with service applications (41, 42, 51, 52, 82, 84), service managers (54-56), service buses (43, 57), and an authorization confirmation unit (63). The service applications provide services to a vehicle by using vehicle information. The service managers acquire the vehicle information. The service buses manage data transmission and reception between the service applications and the service managers. When a service application issues a vehicle information acquisition request for requesting provision of secret information, the authorization confirmation unit confirms whether or not to authorize the secret information acquisition request on the basis of the presence or absence of user agreement. The authorization confirmation unit is provided in a service bus or a service manager.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This international application claims priority based on Japanese Patent Application No. 2022-59057, filed with the Japan Patent Office on March 31, 2022, the entire contents of which are incorporated herein by reference. [Technical field]

[0002] The present disclosure relates to an authentication system and a relay device. [Background technology]

[0003] Patent document 1 describes an in-vehicle device that includes a plurality of applications configured to provide predetermined services to a vehicle driver, and a plurality of managers configured to transfer vehicle information to the plurality of applications in response to information acquisition requests from the plurality of applications. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2007-90951 A Summary of the Invention

[0005] As a result of detailed consideration by the inventors, it was found that in a system comprising the above-mentioned application and the above-mentioned manager, there is a problem in that the manager may provide vehicle information to the application that should not be provided to the application in response to an information acquisition request from the application.

[0006] The present disclosure aims to improve the security level in providing information.

[0007] One aspect of the present disclosure is an authentication system that includes at least one service application, a service manager, at least one service bus, and an authorization checker.

[0008] The at least one service application is configured to utilize the vehicle information regarding the vehicle to provide a service to the vehicle.

[0009] The service manager is configured to obtain vehicle information stored in an electronic control unit of the vehicle.

[0010] At least one service bus is configured to manage the transmission and reception of data between at least one service application and a service manager.

[0011] The authorization confirmation unit is configured to confirm whether or not to authorize the request to acquire the confidential information based on whether or not a user has consented, when at least one service application makes a vehicle information acquisition request that requests the provision of confidential information among the vehicle information.

[0012] The authorization checker is then mounted on at least one of the service bus or the service manager.

[0013] In the authentication system of the present disclosure configured as above, the authorization confirmation unit is mounted on at least one service bus or service manager. Therefore, the authentication system of the present disclosure can determine whether or not to provide vehicle information in response to a vehicle information acquisition request from a service application. As a result, the authentication system of the present disclosure can prevent the occurrence of a situation in which vehicle information that should not be provided to a service application is provided to the service application, and can improve the security level in providing information.

[0014] Another aspect of the present disclosure is a relay device that relays data transmitted from an electronic control unit to a vehicle's communication network, the relay device comprising at least one service application, a service manager, at least one service bus, and an authorization verification unit.

[0015] The at least one service application is configured to utilize the vehicle information regarding the vehicle to provide a service to the vehicle.

[0016] The service manager is configured to obtain the vehicle information stored in the first storage unit of the relay device or the second storage unit of the electronic control device.

[0017] At least one service bus is configured to manage the transmission and reception of data between at least one service application and a service manager.

[0018] The authorization confirmation unit is configured to confirm whether or not to authorize the request to acquire confidential information based on whether or not a user has consented when at least one service application makes a vehicle information acquisition request requesting the provision of confidential information among the vehicle information stored in the second memory unit of the electronic control device or the first memory unit of the relay device.

[0019] The authorization checker is then mounted on at least one of the service bus or the service manager.

[0020] The relay device of the present disclosure configured in this manner is a device that constitutes the authentication system of the present disclosure, and can obtain the same effects as the authentication system of the present disclosure. [Brief description of the drawings]

[0021] [Figure 1] FIG. 1 is a block diagram showing a configuration of a vehicle control system. [Diagram 2] FIG. 2 is a functional block diagram showing a functional configuration of an ECU. [Diagram 3] FIG. 2 is a block diagram showing a data communication path in the ECU of the first embodiment. [Figure 4] FIG. 4 is a sequence diagram showing a procedure for acquiring current location information in the first embodiment. [Diagram 5] FIG. 4 is a sequence diagram showing a procedure for making a service request in the first embodiment. [Figure 6] FIG. 2 is a block diagram showing paths of data communication in the vehicle control system. [Figure 7] FIG. 11 is a block diagram showing a data communication path in an ECU according to a second embodiment. [Figure 8] FIG. 11 is a sequence diagram showing a procedure for acquiring current location information in the second embodiment. [Figure 9] FIG. 13 is a sequence diagram showing a procedure for making a service request in the third embodiment. [Figure 10] FIG. 13 is a block diagram showing a data communication path in an ECU according to a fourth embodiment. [Figure 11] FIG. 13 is a block diagram showing a data communication path in an ECU according to a fifth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] [First embodiment] A first embodiment of the present disclosure will be described below with reference to the drawings.

[0023] The vehicle control system 1 of the present embodiment is mounted on a vehicle. The vehicle may have an automatic driving function in addition to a manual driving function. The vehicle may be a hybrid vehicle having an engine and an electric motor as a driving source. The vehicle is not limited to a vehicle having an automatic driving function and a hybrid vehicle, but may be a vehicle having only a manual driving function, or a vehicle having only an engine or only an electric motor as a driving source. In the following, a vehicle equipped with the vehicle control system 1 is simply referred to as a vehicle.

[0024] 1, a vehicle control system 1 includes one ECU 2 and multiple ECUs 3. ECU is an abbreviation for Electronic Control Unit.

[0025] The ECU 2 controls a plurality of ECUs 3 to realize coordinated control of the entire vehicle.

[0026] The ECU 3 is provided for each domain that is divided according to the function in the vehicle, and mainly controls a plurality of ECUs 4 that exist in that domain. The domains are, for example, a power train, a body, and a chassis.

[0027] To the ECU 3 belonging to the power train domain, for example, an ECU 4 that controls an engine, an ECU 4 that controls a motor, and an ECU 4 that controls a battery are connected.

[0028] To the ECU 3 belonging to the body domain, for example, an ECU 4 that controls an air conditioner, an ECU 4 that controls doors, and the like are connected.

[0029] To the ECU 3 belonging to the chassis domain, for example, an ECU 4 that controls braking, an ECU 4 that controls steering, and the like are connected.

[0030] The ECU 3 is an electronic control device that is mainly composed of a microcomputer including a CPU 24, a ROM 25, a RAM 26, and the like.

[0031] The ECU 4 is an electronic control device that is mainly composed of a microcomputer including a CPU 27, a ROM 28, a RAM 29, and the like.

[0032] The ECU 2 includes a control unit 11 and an in-vehicle communication unit 12 .

[0033] The control unit 11 is an electronic control device mainly composed of a microcomputer including a CPU 21, a ROM 22, a RAM 23, etc. Various functions of the microcomputer are realized by the CPU 21 executing a program stored in a non-transient real recording medium. In this example, the ROM 22 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 21 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 11 may be one or more.

[0034] The in-vehicle communication unit 12 is connected to a plurality of ECUs 3 via CAN or Ethernet, and performs data communication with the plurality of ECUs 3. CAN is an abbreviation for Controller Area Network. CAN is a registered trademark. Ethernet is a registered trademark.

[0035] The vehicle control system 1 further includes an external vehicle communication device 5. The external vehicle communication device 5 performs data communication with a communication device outside the vehicle via a wide area wireless communication network. The external vehicle communication device 5 is an electronic control device mainly composed of a microcomputer having a CPU, ROM, RAM, etc. The ECU 2 performs data communication with the external vehicle communication device 5 via an in-vehicle communication unit 12.

[0036] As shown in FIG. 2, the ECU 2 includes a hypervisor 31, a first virtual machine 32, and a second virtual machine 33.

[0037] The hypervisor 31 has a function of managing the first virtual machine 32 and the second virtual machine 33 so that the first virtual machine 32 and the second virtual machine 33 can be executed in parallel on the CPU 21.

[0038] The first virtual machine 32 includes a service application 41, a service application 42, and a first service bus 43 as functional blocks that are realized by the CPU 21 executing a program stored in the ROM 22.

[0039] The service applications 41 and 42 are low-trust applications manufactured under a process in which privacy protection cannot be guaranteed, and are, for example, applications manufactured by a third party to provide a service to a vehicle user. The third party is a third party other than the vehicle owner and the OEM. An example of a third party is a data utilization company that provides a service by collecting data from the vehicle. The OEM is a vehicle manufacturer that manufactured the vehicle. OEM is an abbreviation for Original Equipment Manufacturer.

[0040] Services provided to vehicle users include, for example, a service that controls the air conditioner to wake up the driver and controls the wipers to support the driver's visibility in response to weather changes and the driver's fatigue state on the vehicle's planned driving route. The above service requires, for example, acquisition from inside the vehicle of planned driving route information, vehicle interior temperature information, vehicle exterior temperature information, vehicle current position information, driver's age information, driver's gender information, and driver's body temperature information. Furthermore, the above service requires acquisition of rainy road information on the planned driving route from, for example, a social infrastructure platform outside the vehicle. Of the above information acquired from inside the vehicle, the vehicle current position information, driver's age information, gender information, and body temperature information correspond to privacy information.

[0041] The privacy information may be stored in the ECU 2, or in the ECU 3 or ECU 4. For example, information indicating the home address of the owner of the vehicle may be stored in the ECU that controls the navigation device (i.e., any one of the ECU 2, ECU 3, and ECU 4). Also, image data of a face photograph of the driver may be stored in the ECU that controls the driver status monitor (i.e., any one of the ECU 2, ECU 3, and ECU 4).

[0042] The service applications 41 and 42 provide different services to the vehicle user.

[0043] The first service bus 43 is an application that provides messaging processing that manages the exchange of messages (for example, API calls) between the service applications 41 and 42 and the outside of the first virtual machine 32. API is an abbreviation for Application Programming Interface.

[0044] In this embodiment, the first service bus 43 is, for example, an in-vehicle software platform that complies with AUTOSAR. AUTOSAR is an abbreviation for Automotive Open System Architecture. AUTOSAR is a registered trademark.

[0045] The second virtual machine 33 includes functional blocks realized by CPU 21 executing a program stored in ROM 22, such as a service application 51, a service application 52, an authentication and authorization system 53, a first service manager 54, a second service manager 55, a third service manager 56, and a second service bus 57.

[0046] The service applications 51 and 52 are highly trusted applications produced under a process that can guarantee privacy protection, for example, applications produced by an OEM to provide services to vehicle users.

[0047] The authentication and authorization system 53 is an application that authenticates the vehicle user and authorizes access from the service applications 41 and 42 and the service applications 51 and 52.

[0048] The first, second and third service managers 54, 55 and 56 are applications that collect vehicle information and control the vehicle in order to provide services to the vehicle users. The first, second and third service managers 54, 55 and 56 provide different services to the vehicle users.

[0049] Since the first, second and third service managers 54, 55 and 56 are mounted on the ECU 2, when vehicle information that needs to be collected is stored in the ECU 2, the first, second and third service managers 54, 55 and 56 can directly acquire the vehicle information from the ECU 2. On the other hand, when vehicle information that needs to be collected is stored in the ECUs 3 and 4, the first, second and third service managers 54, 55 and 56 acquire the vehicle information from the ECUs 3 and 4 by transmitting an instruction to acquire the vehicle information to the ECUs 3 and 4 via the vehicle's communication network (i.e., CAN or Ethernet).

[0050] Examples of the vehicle information include vehicle speed, engine RPM, steering angle, acceleration, and position, etc. This vehicle information is information stored in the ECU 4 that controls the engine, the ECU 4 that controls the steering, the ECU 4 that controls the airbags, and the external vehicle communication device 5.

[0051] The vehicle information may be images captured by an in-vehicle camera and images captured by an exterior camera. The vehicle information is stored in the ECU 4 that controls the cameras.

[0052] The vehicle information may also be an address registered in a navigation device. This address is information stored in the navigation device connected to the ECU 2.

[0053] The second service bus 57 is an application that provides messaging processing that manages the exchange of messages between the service applications 51 and 52 and the authentication and authorization system 53 and the first, second and third service managers 54, 55 and 56. In this embodiment, the second service bus 57 is, for example, an in-vehicle software platform that complies with AUTOSAR.

[0054] As shown in FIG. 3, the second service bus 57 includes a communication manager 61, an access manager 62, and an authorization checker 63.

[0055] The communication management unit 61 manages communications between the service applications 41 and 42 and the service applications 51 and 52 and the first, second and third service managers 54, 55 and 56. In order to simplify the illustration, the service application 42, the service application 52 and the second and third service managers 55 and 56 are omitted in FIG.

[0056] The access management unit 62 manages access from the service applications 41 and 42 and the service applications 51 and 52 to the first, second and third service managers 54, 55 and 56.

[0057] The authorization confirmation unit 63 performs consent confirmation of the vehicle user regarding authorization for access from the service applications 41, 42 and the service applications 51, 52 to the first, second and third service managers 54, 55 and 56.

[0058] The first service bus 43 and the second service bus 57 are configured to be able to communicate data with each other. Therefore, the service applications 41 and 42 installed in the first virtual machine 32 can access the first, second and third service managers 54, 55 and 56 via the first service bus 43 and the second service bus 57.

[0059] Although not shown in the figure, the first service bus 43 has functions corresponding to a communication management unit 61, an access management unit 62, and an authorization confirmation unit 63.

[0060] Next, a procedure for the service application 41 to acquire the vehicle current position information from the first service manager 54 will be described with reference to FIG.

[0061] 4, when the service application 41 transmits a location information acquisition request to the second service bus 57, the access management unit 62 of the second service bus 57 determines whether the service application 41 is permitted to acquire vehicle information as shown in process P2. Specifically, the access management unit 62 checks the reliability of the service application 41, and determines whether the acquisition of vehicle information is permitted based on the reliability.

[0062] If the access management unit 62 determines that the service application 41 is permitted to obtain vehicle information, the authorization confirmation unit 63 transmits a user authorization confirmation request to the authentication and authorization system 53 as shown in process P3.

[0063] When the authentication and authorization system 53 receives the user authorization confirmation request, it performs consent confirmation of the vehicle user for the access authorization, as shown in process P4.

[0064] Then, the authentication and authorization system 53 transmits a user authorization confirmation result indicating the result of the consent confirmation of the vehicle user to the authorization confirmation unit 63 as shown in process P5.

[0065] Upon receiving the user authorization confirmation result, the authorization confirmation unit 63 determines whether or not the user of the vehicle has consented to the authorization of access based on the received user authorization confirmation result.

[0066] If the vehicle user agrees to the access authorization, the authorization confirmation unit 63 transmits a location information acquisition request to the first service manager 54, as shown in process P6.

[0067] If the vehicle user does not consent to the authorization of access, the authorization confirmation unit 63 transmits an access denial response to the service application 41, as shown in process P7.

[0068] Next, the procedure when the service application 41 makes a service request to the first service manager 54 will be described with reference to Fig. 5. Note that the procedure shown in Fig. 4 is a simplification of the procedure shown in Fig. 5.

[0069] 5, the service application 41 transmits a service request to the second service bus 57. The service request includes a service identifier for identifying a service provided by the service application 41, and a data identifier for identifying data requested by the service application 41.

[0070] When the access management unit 62 receives a service request, it determines whether the service application 41 is permitted to obtain vehicle information based on the service identifier included in the service request.

[0071] When it is determined that acquisition of the vehicle information is permitted, the access management unit 62 transmits an access permission confirmation request to the authorization confirmation unit 63 as shown in process P12. The access permission confirmation request includes a service identifier and a data identifier.

[0072] The authorization confirmation unit 63 has a privacy information table 71 in the ROM 22. The privacy information table 71 sets whether or not each of a plurality of data types specified by a data identifier corresponds to privacy information.

[0073] When the authorization confirmation unit 63 receives the access permission confirmation request, it determines whether or not the data requested by the service application 41 corresponds to privacy information, based on the data identifier included in the access permission confirmation request.

[0074] If the information does not correspond to privacy information, the authorization confirmation unit 63 transmits to the access management unit 62 an access permission indicating that the access is authorized.

[0075] If the information corresponds to privacy information, the authorization confirmation unit 63 transmits a user consent confirmation request to the authentication and authorization system 53 to confirm the presence or absence of the user's consent, as shown in process P13. The user consent confirmation request includes the above-mentioned service identifier and a privacy information identifier for identifying the privacy information requested by the service application 41.

[0076] The authentication and authorization system 53 includes a user identification database 72 and a user consent database 73 in the ROM 22 .

[0077] The user identification database 72 stores user identification information for identifying the current user of the vehicle. The current user is identified by an authentication device mounted on the vehicle, and the authentication result by the authentication device is stored in the user identification database 72. The authentication device identifies the current user by an authentication method such as password authentication or facial authentication. Password authentication is authentication performed by the user inputting a password into the authentication device. Facial authentication is authentication performed by image analysis of a facial image of the user's face. The user identification database 72 stores, for example, a user ID, an authentication method, and an authentication result.

[0078] The user consent database 73 stores information indicating whether or not each of a plurality of users identified by user identification information has consented to access to privacy information. The user consent database 73 is stored in the ROM 22. The presence or absence of consent may be stored separately for each type of privacy information. The user consent database 73 stores, for example, a user ID, a target privacy information identifier, and the presence or absence of consent.

[0079] When the authentication and authorization system 53 receives a user consent confirmation request, it refers to the user identification database 72 and the user consent database 73 to determine whether the current user has consented to accessing the privacy information of the specified identifier.

[0080] If it is determined that the current user has consented to the access to the privacy information, the authentication and authorization system 53 transmits an access consent result (access consented) indicating that the access has been consented to to the authorization confirmation unit 63.

[0081] If it is determined that the current user has not consented to access to the privacy information, the authentication and authorization system 53 sends an access consent confirmation request to the second service bus 57 to obtain the user's access consent, as shown in process P14.

[0082] When the second service bus 57 receives the access consent confirmation request, it transmits the access consent confirmation request to the screen display service application 58 installed in the ECU 2 as shown in process P15.

[0083] When the screen display service application 58 receives the access consent confirmation request, as shown in process P16, it displays an image on the display screen of the display device in the vehicle cabin to confirm whether or not the user agrees to the service application 41 accessing the privacy information.

[0084] Then, as shown in process P17, when the vehicle user performs an access consent operation to indicate whether or not he or she agrees to the access, the screen display service application 58 transmits an access consent confirmation result indicating whether or not the user has agreed to the access to the second service bus 57, as shown in process P18.

[0085] Upon receiving the access consent confirmation result, the second service bus 57 transmits the access consent confirmation result to the authentication and authorization system 53 as shown in process P19.

[0086] When the authentication and authorization system 53 receives the access consent confirmation result, it stores the access consent confirmation result in the user consent database 73, and further, as shown in process P20, transmits a user consent confirmation result indicating whether or not the current user has agreed to the access to the authorization confirmation unit 63 based on the access consent confirmation result.

[0087] When the authorization confirmation unit 63 receives the user agreement confirmation result, as shown in process P21, it transmits to the access management unit 62 an access permission confirmation result indicating whether or not access to the privacy information is authorized based on the user agreement confirmation result.

[0088] If access to the privacy information is authorized, the access management unit 62 sends a service request to the first service manager 54, as shown in process P22.

[0089] If access to the private information is not permitted, the access management unit 62 transmits an access denial response to the service application 41 .

[0090] As shown in FIG. 6, one of the plurality of ECUs 3 includes an in-vehicle communication unit 81, a service application 82, and a third service bus 83.

[0091] The in-vehicle communication unit 81 is connected to the ECU 2, and performs data communication between the ECU 2 and other ECUs (that is, the ECUs 3 and 4 and the external communication device 5).

[0092] The service application 82 is an application created by a third party to provide a service to the vehicle user. The service application 82 provides a service different from the service applications 41 and 42 to the vehicle user.

[0093] The third service bus 83 is an application that provides a messaging process that manages the exchange of messages between the service application 82 and the outside of the ECU 3 .

[0094] When the ECU 2 receives a service request from the service application 82, the ECU 2 transmits the privacy information to the service application 82 in the same manner as when the ECU 2 receives a service request from the service applications 41 and 42.

[0095] The ECU 2 performs data communication with the center 7 via the external communication device 5 .

[0096] The center 7 includes a service application 84. The service application 84 is an application produced by a third party to provide a service to the vehicle user. The service application 84 provides a service different from the service applications 41, 42, and 82 to the vehicle user.

[0097] When the ECU 2 receives a service request from the service application 84, the ECU 2 transmits the privacy information to the service application 84 in the same manner as when the ECU 2 receives a service request from the service applications 41 and 42.

[0098] The vehicle control system 1 of the first embodiment configured as described above includes the service applications 41, 42 and service applications 51, 52, first, second and third service managers 54, 55 and 56, first and second service buses 43 and 57, and an authorization confirmation unit 63. Hereinafter, the service applications 41, 42 and service applications 51, 52 will be collectively referred to as service applications 41, 42, 51, 52.

[0099] The service applications 41, 42, 51, 52 are configured to utilize vehicle information relating to the vehicle to provide services to the vehicle.

[0100] The first, second and third service managers 54, 55 and 56 are configured to acquire vehicle information stored in other ECUs of the vehicle (i.e., the ECUs 3 and 4 and the exterior communication device 5) and to transmit commands to other ECUs of the vehicle. Hereinafter, the first, second and third service managers 54, 55 and 56 are collectively referred to as the service managers 54, 55 and 56.

[0101] The first and second service buses 43 and 57 are configured to manage the transmission and reception of data between the service applications 41, 42, 51 and 52 and the service managers 54, 55 and 56.

[0102] The authorization confirmation unit 63 is configured to confirm whether or not to authorize the service request for privacy information (provision of privacy information) based on whether or not the user has consented when the service application 41, 42, 51, 52 makes a service request to the service manager 54, 55, 56 to request the provision of privacy information among the vehicle information.

[0103] The authorization confirmation unit 63 is mounted on the second service bus 57 .

[0104] In such a vehicle control system 1, the authorization confirmation unit 63 is mounted on the second service bus 57. Therefore, the vehicle control system 1 can determine whether or not to provide vehicle information in response to a service request by the service applications 41, 42, 51, and 52. This makes it possible for the vehicle control system 1 to prevent the occurrence of a situation in which vehicle information that should not be provided to the service applications 41, 42, 51, and 52 is provided to the service applications 41, 42, 51, and 52, and thus makes it possible to improve the security level in providing information.

[0105] The vehicle control system 1 also includes an authentication and authorization system 53 that confirms whether or not the user has consented to the service request. When the service application 41, 42, 51, or 52 makes a service request, the authorization confirmation unit 63 is configured to confirm with the authentication and authorization system 53 whether or not the user has consented to the service request, and to authorize the service request if the user has consented. Such a vehicle control system 1 can determine whether or not to authorize the service request based on the consent of the vehicle user.

[0106] The vehicle control system 1 also includes an ECU 2. The ECU 2 includes service managers 54, 55, and 56 and first and second service buses 43 and 57. A service application 82 is mounted on an ECU 3 mounted on the vehicle and configured to be able to communicate data with the ECU 2. A service application 84 is mounted on a center 7 installed outside the vehicle and configured to be able to communicate data with the ECU 2. This allows the ECU 2 to determine whether to authorize a service request from the ECU 3 mounted on the vehicle and a service request from the center 7 installed outside the vehicle.

[0107] The vehicle control system 1 also includes a privacy information table 71 and a user consent database 73. The privacy information table 71 stores privacy setting information indicating whether or not each of a plurality of vehicle information corresponds to privacy information. The user consent database 73 stores access consent information indicating whether or not the user consents to access to the privacy information. The authorization confirmation unit 63 then uses the privacy setting information stored in the privacy information table 71 and the access consent information stored in the user consent database 73 to confirm whether or not to authorize the service request.

[0108] This allows the authorization confirmation unit 63 to eliminate the need to confirm vehicle information that does not fall under privacy information with the authentication and authorization system 53. Therefore, the vehicle control system 1 can reduce the processing load of the authorization confirmation unit 63.

[0109] The ECU 2 is a relay device that relays data transmitted from the ECUs 3 and 4 to the vehicle's CAN or Ethernet.

[0110] The ECU 2 includes service applications 41 and 42 , service applications 51 and 52 , service managers 54 , 55 and 56 , first and second service buses 43 and 57 , and an authorization confirmation unit 63 .

[0111] The service managers 54, 55, 56 are configured to acquire vehicle information stored in the ROM 22 and RAM 23 of the ECU 2, or the ROMs 25, 28 and RAMs 26, 29 of the ECUs 3, 4.

[0112] The authorization confirmation unit 63 is configured to confirm whether or not to authorize the service request for the privacy information based on the presence or absence of consent of the user when the service application 41, 42, 51, 52 makes a service request for providing privacy information among the vehicle information stored in the ROM 25, 28 and RAM 26, 29 of the ECUs 3, 4, or the ROM 22 and RAM 23 of the ECU 2. The authorization confirmation unit 63 is mounted on the second service bus 57.

[0113] Like the vehicle control system 1, such an ECU 2 can improve the security level in providing information.

[0114] In the embodiment described above, the vehicle control system 1 corresponds to an authentication system, the first and second service buses 43, 57 correspond to service buses, a service request corresponds to a vehicle information acquisition request and an acquisition request, the authentication and authorization system 53 corresponds to a user consent confirmation unit, and the ECUs 3, 4 and the external communication device 5 correspond to electronic control devices of the vehicle.

[0115] In addition, ECU2 corresponds to the first electronic control unit, ECU3 corresponds to the second electronic control unit, privacy information corresponds to confidential information, privacy setting information corresponds to confidential setting information, privacy information table 71 corresponds to the confidential setting memory unit, and user consent database 73 corresponds to the user consent memory unit.

[0116] Moreover, the ECU 2 corresponds to a relay device, the CAN and the Ethernet correspond to a communication network, the ROM 22 and the RAM 23 correspond to a first storage unit, and the ROMs 25, 28 and the RAMs 26, 29 correspond to a second storage unit.

[0117] [Second embodiment] A second embodiment of the present disclosure will be described below with reference to the drawings. In the second embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0118] The vehicle control system 1 of the second embodiment differs from the first embodiment in that the configuration of the ECU 2 is changed.

[0119] Specifically, as shown in FIG. 7, the second embodiment differs from the first embodiment in that the first, second and third service managers 54, 55 and 56 include an authorization confirmation unit 63 instead of the second service bus 57.

[0120] Next, a procedure for the service application 41 to obtain the vehicle current position information from the first service manager 54 will be described.

[0121] As shown in process P31 of FIG. 8, when the service application 41 sends a request to obtain location information to the second service bus 57, the access management unit 62 of the second service bus 57 determines whether the service application 41 is permitted to obtain vehicle information, as shown in process P32.

[0122] If the access management unit 62 determines that the service application 41 is permitted to obtain vehicle information, the access management unit 62 transmits a location information obtainment request to the first service manager 54 as shown in process P33.

[0123] When the authorization confirmation unit 63 of the first service manager 54 receives the location information acquisition request, it transmits a user authorization confirmation request to the authentication and authorization system 53 as shown in process P34.

[0124] Upon receiving the user authorization confirmation request, the authentication and authorization system 53 performs a confirmation of the consent of the vehicle user regarding the authorization of access, as shown in process P35.

[0125] Then, the authentication and authorization system 53 transmits a user authorization confirmation result indicating the result of the consent confirmation of the vehicle user to the authorization confirmation unit 63 of the first service manager 54 as shown in process P36.

[0126] Upon receiving the user authorization confirmation result, the authorization confirmation unit 63 determines whether or not the user of the vehicle has consented to the authorization of access based on the received user authorization confirmation result.

[0127] If the vehicle user consents to the access authorization, the authorization confirmation unit 63 transmits a location information acquisition request to the service providing unit 66 of the first service manager 54, as shown in process P37.

[0128] If the vehicle user does not consent to the access authorization, the authorization confirmation unit 63 transmits an access denial response to the second service bus 57 as shown in process P38. Upon receiving the access denial response, the second service bus 57 transmits the access denial response to the service application 41 as shown in process P39.

[0129] The vehicle control system 1 of the second embodiment thus configured includes service applications 41, 42, 51, and 52, service managers 54, 55, and 56, first and second service buses 43 and 57, and an authorization confirmation unit 63. The authorization confirmation unit 63 is mounted on the service managers 54, 55, and 56.

[0130] In such a vehicle control system 1, the authorization confirmation unit 63 is mounted on the service managers 54, 55, and 56. Therefore, the vehicle control system 1 can determine whether or not to provide vehicle information in response to a service request from the service applications 41, 42, 51, and 52. This makes it possible for the vehicle control system 1 to prevent the occurrence of a situation in which vehicle information that should not be provided to the service applications 41, 42, 51, and 52 is provided to the service applications 41, 42, 51, and 52, and thus makes it possible to improve the security level in providing information.

[0131] [Third embodiment] A third embodiment of the present disclosure will be described below with reference to the drawings. In the third embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0132] The vehicle control system 1 of the third embodiment differs from the first embodiment in that the configuration of the ECU 2 is changed.

[0133] Specifically, as shown in FIG. 9, the second embodiment differs from the first embodiment in that an authorization confirmation unit 63 includes a user consent database 73 instead of the authentication and authorization system 53.

[0134] Next, a procedure when the service application 41 makes a service request to the first service manager 54 will be described with reference to FIG.

[0135] As shown in process P51 of FIG. 9, the service application 41 transmits a service request to the second service bus 57.

[0136] When the access management unit 62 receives a service request, it determines whether the service application 41 is permitted to obtain vehicle information based on the service identifier included in the service request.

[0137] If it is determined that acquisition of the vehicle information is permitted, the access management unit 62 transmits an access permission confirmation request to the authorization confirmation unit 63 as shown in process P52.

[0138] When the authorization confirmation unit 63 receives the access permission confirmation request, it determines whether or not the data requested by the service application 41 corresponds to privacy information, based on the data identifier included in the access permission confirmation request.

[0139] If the information does not correspond to privacy information, the authorization confirmation unit 63 transmits to the access management unit 62 an access permission indicating that the access is authorized.

[0140] If the information corresponds to privacy information, the authorization confirmation unit 63 transmits a user ID acquisition request to the authentication and authorization system 53, requesting user identification information for identifying the current user, as shown in process P53.

[0141] When the authentication and authorization system 53 receives the user ID acquisition request, it extracts the user identification information from the user identification database 72, and transmits the extracted user identification information to the authorization confirmation unit 63 as shown in process P54.

[0142] When the authorization confirmation unit 63 receives the user identification information, it refers to the user consent database 73 to determine whether or not the current user has consented to accessing privacy information.

[0143] If it is determined that the current user has consented to the access to the privacy information, the authorization confirmation unit 63 transmits to the access management unit 62 an access consent result indicating that the access has been consented to.

[0144] If it is determined that the current user has not consented to the access to the privacy information, the authorization confirmation unit 63 transmits an access consent confirmation request to the screen display service application 58 as shown in process P55.

[0145] When the screen display service application 58 receives the access consent confirmation request, as shown in process P56, it displays an image on the display screen of the display device in the vehicle cabin to confirm whether or not the user agrees to the service application 41 accessing the privacy information.

[0146] Then, as shown in process P57, when the vehicle user performs an access consent operation to indicate whether or not he or she agrees to the access, the screen display service application 58 transmits an access consent confirmation result indicating whether or not the user has agreed to the access to the second service bus 57, as shown in process P58.

[0147] When the authorization confirmation unit 63 of the second service bus 57 receives the access consent confirmation result, it stores the access consent confirmation result in the user consent database 73, and further, as shown in process P59, transmits to the access management unit 62 an access permission confirmation result indicating whether or not access to the privacy information has been authorized based on the access consent confirmation result.

[0148] If access to the privacy information is authorized, the access management unit 62 sends a service request to the first service manager 54, as shown in process P60.

[0149] If access to the private information is not permitted, the access management unit 62 transmits an access denial response to the service application 41 .

[0150] The vehicle control system 1 of the third embodiment thus configured can improve the security level in providing information, similarly to the first embodiment.

[0151] [Fourth embodiment] A fourth embodiment of the present disclosure will be described below with reference to the drawings. In the fourth embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same components.

[0152] The vehicle control system 1 of the fourth embodiment differs from the first embodiment in that the configuration of the ECU 2 is changed.

[0153] Specifically, as shown in FIG. 10, the second embodiment differs from the first embodiment in that a user authentication and authorization unit 69 is provided instead of the authorization confirmation unit 63 and the authentication and authorization system 53.

[0154] The user authentication and authorization unit 69 is mounted on the second service bus 57. The second service bus 57 is configured to have the functions of the authorization confirmation unit 63 and the functions of the authentication and authorization system 53.

[0155] In the vehicle control system 1 of the fourth embodiment configured as described above, the authorization confirmation unit 63 and the authentication and authorization system 53 are mounted on the second service bus 57. As a result, like the first embodiment, the vehicle control system 1 of the fourth embodiment can prevent the occurrence of a situation in which vehicle information that should not be provided to the service applications 41, 42, 51, and 52 is provided to the service applications 41, 42, 51, and 52, and can improve the security level in providing information.

[0156] [Fifth embodiment] A fifth embodiment of the present disclosure will be described below with reference to the drawings. In the fifth embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0157] The vehicle control system 1 of the fifth embodiment differs from the first embodiment in that the configuration of the ECU 2 is changed.

[0158] Specifically, as shown in Fig. 11, the second embodiment differs from the first embodiment in that the service applications 51 and 52 include an authorization confirmation unit 91. For simplicity, the service application 52 is not shown in Fig. 11. Here, both the service applications 41 and 51 may be third-party applications, or the service application 41 may be a third-party application and the service application 51 may be an OEM application.

[0159] The authorization confirmation unit 91 has the same function as the authorization confirmation unit 63 .

[0160] That is, before the service application 51 transmits a service request to the second service bus 57, the authorization confirmation unit 91 of the service application 51 first transmits a user agreement confirmation request to the authentication and authorization system 53.

[0161] Then, when the authorization confirmation unit 91 receives a user agreement confirmation result from the authentication and authorization system 53, it determines whether or not access to the privacy information is authorized based on the user agreement confirmation result.

[0162] Here, if access to the privacy information is authorized, the service application 51 transmits a service request to the second service bus 57. The second service bus 57 does not perform authorization confirmation with the authorization confirmation unit 63.

[0163] On the other hand, if access to the privacy information is not authorized, the service application 51 stops sending the service request.

[0164] Therefore, in the vehicle control system 1 of the fifth embodiment, the authorization confirmation unit 63 executes processing for authorization confirmation when a service request is sent from the service applications 41, 42, and does not execute processing for authorization confirmation when a service request is sent from the service applications 51, 52.

[0165] In the vehicle control system 1 of the fifth embodiment configured as described above, the service applications 51, 52 include an authorization confirmation unit 91. When the service applications 51, 52 make a service request to the service managers 54, 55, 56, the authorization confirmation unit 91 is configured to confirm whether or not to authorize the service request of the service applications 51, 52. The authorization confirmation unit 63 is configured to confirm with the authentication and authorization system 53 whether or not the user has consented to the service request from the service applications 41, 42.

[0166] Such a vehicle control system 1 can prevent the occurrence of a situation in which vehicle information that should not be provided to the service applications 41, 42, 51, and 52 is provided to the service applications 41, 42, 51, and 52, and can improve the security level in providing information.

[0167] In the above-described embodiment, the service applications 41 and 42 correspond to third-party service applications, the service applications 51 and 52 correspond to OEM service applications, and the authorization check unit 91 corresponds to an OEM authorization check unit.

[0168] Although one embodiment of the present disclosure has been described above, the present disclosure is not limited to the above embodiment and can be implemented in various modified forms.

[0169] [Variation 1] For example, in the above embodiment, a form was shown in which it was determined whether the user of the vehicle has consented to a request to obtain privacy information, but it would also be acceptable for the OEM of the vehicle to determine whether or not the OEM has consented to a request to obtain privacy information.

[0170] [Variation 2] In the above embodiment, the ECU 2 includes the in-vehicle communication unit 12, but the ECU 2 does not necessarily need to include the in-vehicle communication unit 12. The in-vehicle communication unit 12 may be included in another ECU, or may be mounted on another independent ECU.

[0171] [Variation 3] In the above embodiment, the ECU 2 is shown to have two virtual machines, but the ECU 2 may have functions equivalent to the first and second virtual machines 32 and 33 without having any virtual machines, or may have three or more virtual machines.

[0172] [Variation 4] In the above embodiment, the low-trust service applications 41 and 42 manufactured under a process in which privacy protection cannot be guaranteed are installed in the first virtual machine 32. However, the low-trust service applications do not need to be installed in the first virtual machine 32. For example, the low-trust service applications may be installed on any virtual machine, or may be installed directly in a hypervisor when no virtual machine is provided.

[0173] [Variation 5] In the above embodiment, the highly reliable service applications 51 and 52 manufactured under a process that can guarantee privacy protection are installed in the second virtual machine 33. However, the highly reliable service applications do not need to be installed in the second virtual machine 33. For example, the highly reliable service applications may be installed on any virtual machine, or may be installed directly in a hypervisor when no virtual machine is provided.

[0174] [Variation 6] In the above embodiment, the first, second, and third service managers 54, 55, and 56 are mounted on the second virtual machine 33. However, the service managers do not need to be mounted on the second virtual machine 33. For example, the service managers may be mounted on any virtual machine, or may be mounted directly on a hypervisor when no virtual machine is provided.

[0175] [Variation 7] In the above embodiment, the authentication and authorization system 53 is mounted on the second virtual machine 33. However, the authentication and authorization system does not need to be mounted on the second virtual machine 33. For example, the authentication and authorization system may be mounted on any virtual machine, or may be directly mounted on a hypervisor when no virtual machine is provided.

[0176] The control unit 11 and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control unit 11 and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit 11 and the method described in the present disclosure may be realized by one or more dedicated computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. In addition, the computer program may be stored in a computer-readable non-transient tangible recording medium as instructions executed by a computer. The method for realizing the functions of each unit included in the control unit 11 does not necessarily need to include software, and all of the functions may be realized using one or more hardware.

[0177] In the above embodiments, multiple functions of one component may be realized by multiple components, or one function of one component may be realized by multiple components. Also, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, part of the configuration of the above embodiments may be omitted. Also, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0178] In addition to the ECU 2 described above, the present disclosure can also be realized in various forms, such as a system including the ECU 2 as a component, a program for causing a computer to function as the ECU 2, a non-transient physical recording medium such as a semiconductor memory on which this program is recorded, and an authentication method. [Technical idea disclosed in this specification] [Item 1] at least one service application (41, 42, 51, 52, 82, 84) configured to utilize vehicle information relating to the vehicle to provide services to said vehicle; a service manager (54, 55, 56) configured to obtain the vehicle information stored in an electronic control unit of the vehicle; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request requesting provision of confidential information among the vehicle information, confirm whether or not to authorize the request for obtaining the confidential information based on the presence or absence of a user's consent; Equipped with The authorization confirmation unit is an authentication system (1) installed in the at least one service bus or the service manager.

[0179] [Item 2] Item 1, an authentication system comprising: the at least one service bus accepts the vehicle information acquisition request from the at least one service application; the service manager receives the vehicle information acquisition request from the at least one service bus; The authorization confirmation unit is configured to confirm whether or not to authorize the request to obtain confidential information based on whether or not the user has consented when the authorization confirmation unit receives a request to obtain vehicle information from the at least one service application or when the authorization confirmation unit receives a request to obtain vehicle information from the at least one service bus.

[0180] [Item 3] The authentication system according to item 1 or 2, a user consent confirmation unit (53) for confirming whether or not the user consents to the vehicle information acquisition request, the authorization confirmation unit is configured, when the at least one service application makes the vehicle information acquisition request, to confirm with the user consent confirmation unit whether or not the user has consented to the vehicle information acquisition request, and to authorize the acquisition request if the user has consented; The authorization verification unit is an authentication system installed in the at least one service bus.

[0181] [Item 4] Item 3. An authentication system according to claim 3, The authorization verification unit and the user consent verification unit are installed in the at least one service bus.

[0182] [Item 5] The authentication system according to item 1 or 2, a user consent confirmation unit (53) for confirming with the user whether or not the user consents to the vehicle information acquisition request, the authorization confirmation unit is configured, when the at least one service application makes the vehicle information acquisition request, to confirm with the user consent confirmation unit whether or not the user has consented to the vehicle information acquisition request, and to authorize the acquisition request if the user has consented; The authorization confirmation unit is an authentication system installed in the service manager.

[0183] [Item 6] An authentication system according to any one of items 3 to 5, The at least one service application includes a third-party service application (41, 42) manufactured by a third party and an OEM service application (51, 52) manufactured by an OEM; The OEM service application an OEM authorization confirmation unit (91) configured to confirm whether or not to authorize the vehicle information acquisition request of the OEM service application when the OEM service application makes the vehicle information acquisition request; An authentication system, wherein the authorization confirmation unit is configured to confirm with the user consent confirmation unit whether the user has consented to the vehicle information acquisition request from the third-party service application.

[0184] [Item 7] Item 6. An authentication system according to item 6, The OEM service application is configured to, before making the vehicle information acquisition request to the at least one service bus, confirm with the OEM authorization confirmation unit whether or not the vehicle information acquisition request is authorized; The OEM service application is configured to make the vehicle information acquisition request to the at least one service bus when the OEM authorization confirmation unit is able to confirm that the vehicle information acquisition request is authorized; An authentication system configured such that, when the OEM service application makes a vehicle information acquisition request to the at least one service bus, the at least one service bus makes the vehicle information acquisition request to the service manager without confirming with the authorization confirmation unit whether or not to authorize the vehicle information acquisition request.

[0185] [Item 8] An authentication system according to any one of items 1 to 7, The authentication system includes: a first electronic control unit (2) mounted on the vehicle and including the service manager and the at least one service bus; The at least one service application (82, 84) is an authentication system mounted on at least one of a center (7) installed outside the vehicle and configured to be able to communicate data with the first electronic control unit, and a second electronic control unit (3) mounted on the vehicle and configured to be able to communicate data with the first electronic control unit.

[0186] [Item 9] An authentication system according to any one of items 1 to 7, The authentication system includes: a confidential setting storage unit (71) that stores confidential setting information indicating whether each of the plurality of vehicle information corresponds to the confidential information; a user consent storage unit (73) for storing access consent information indicating whether or not the user consents to accessing the secret information, An authentication system in which the authorization confirmation unit confirms whether to authorize the acquisition request using the confidentiality setting information stored in the confidentiality setting memory unit and the access agreement information stored in the user agreement memory unit.

[0187] [Item 10] An authentication system according to any one of items 1 to 9, The authentication system includes: a first electronic control unit (2) mounted on the vehicle and including the service manager and the at least one service bus; The at least one service application includes a third-party service application (41, 42) manufactured by a third party and an OEM service application (51, 52) manufactured by an OEM; The first electronic control unit is a hypervisor (31) configured to manage a first virtual machine (32) and a second virtual machine (33) so as to enable the first virtual machine (32) and the second virtual machine (33) to be executed in parallel on a CPU (21); the at least one service bus includes a first service bus (43) and a second service bus (57); the third party service application and the first service bus are installed on the first virtual machine; The OEM service application and the second service bus are installed on the second virtual machine.

[0188] [Item 11] A relay device (2) that relays data transmitted from an electronic control device (3, 4) to a communication network of a vehicle, at least one service application (41, 42, 51, 52) configured to utilize vehicle information relating to said vehicle to provide services to said vehicle; a service manager (54, 55, 56) configured to acquire the vehicle information stored in a first storage unit (22, 23) of the relay device or a second storage unit (25, 26, 28, 29) of the electronic control device; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request for requesting provision of confidential information among the vehicle information stored in the second storage unit of the electronic control device or the first storage unit of the relay device, confirm whether or not to authorize the request for obtaining the confidential information based on the presence or absence of a user's consent; Equipped with The authorization confirmation unit is a relay device mounted on the at least one service bus or the service manager.

[0189] [Item 12] Item 12. A relay device according to item 11, The service manager is configured to transmit an instruction to acquire the confidential information from the electronic control device via the communication network when the authorization confirmation unit confirms that the request to acquire the confidential information is authorized.

Claims

1. at least one service application (41, 42, 51, 52, 82, 84) configured to utilize vehicle information relating to the vehicle to provide services to said vehicle; a service manager (54, 55, 56) configured to obtain the vehicle information stored in an electronic control unit of the vehicle; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request requesting provision of confidential information among the vehicle information, confirm whether or not to authorize the request to acquire the confidential information based on the presence or absence of a user's consent; Equipped with The authorization check unit is mounted on the at least one service bus; a user consent confirmation unit (53) for confirming whether or not the user consents to the vehicle information acquisition request; the authorization confirmation unit is configured, when the at least one service application makes the vehicle information acquisition request, to confirm with the user consent confirmation unit whether or not the user has consented to the vehicle information acquisition request, and to authorize the acquisition request if the user has consented; said at least one service application includes a first service application (41, 42) produced by a third party and a second service application (51, 52) produced by the manufacturer of the vehicle; The second service application a second authorization confirmation unit (91) configured to confirm whether or not to authorize the vehicle information acquisition request of the second service application when the second service application makes the vehicle information acquisition request; An authentication system (1), wherein the authorization confirmation unit is configured to confirm with the user consent confirmation unit whether or not the user has consented to the vehicle information acquisition request from the first service application.

2. An authentication system as claimed in claim 1, The authorization verification unit and the user consent verification unit are installed in the at least one service bus.

3. At least one service application (41, 42, 51, 52, 82, 84) configured to utilize vehicle information relating to a vehicle to provide a service to the vehicle; a service manager (54, 55, 56) configured to obtain the vehicle information stored in an electronic control unit of the vehicle; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request requesting provision of confidential information among the vehicle information, confirm whether or not to authorize the request to acquire the confidential information based on the presence or absence of a user's consent; Equipped with The authorization check unit is mounted on the at least one service bus or the service manager; a user consent confirmation unit (53) for confirming with the user whether or not the user consents to the vehicle information acquisition request, the authorization confirmation unit is configured, when the at least one service application makes the vehicle information acquisition request, to confirm with the user consent confirmation unit whether or not the user has consented to the vehicle information acquisition request, and to authorize the acquisition request if the user has consented; The authorization confirmation unit is installed in the service manager, said at least one service application includes a first service application (41, 42) produced by a third party and a second service application (51, 52) produced by the manufacturer of the vehicle; The second service application a second authorization confirmation unit (91) configured to confirm whether or not to authorize the vehicle information acquisition request of the second service application when the second service application makes the vehicle information acquisition request; The authorization confirmation unit is configured to confirm with the user consent confirmation unit whether the user has consented to the vehicle information acquisition request from the first service application.

4. An authentication system according to any one of claims 1 to 3, The second service application is configured to, before making the vehicle information acquisition request to the at least one service bus, confirm with the second authorization confirmation unit whether to authorize the vehicle information acquisition request; the second service application is configured to, when the second authorization confirmation unit is able to confirm that the vehicle information acquisition request is authorized, make the vehicle information acquisition request to the at least one service bus; An authentication system configured such that, when the second service application makes a vehicle information acquisition request to the at least one service bus, the at least one service bus makes the vehicle information acquisition request to the service manager without checking with the authorization confirmation unit whether or not to authorize the vehicle information acquisition request when the second service application makes the vehicle information acquisition request to the at least one service bus.

5. At least one service application (41, 42, 51, 52, 82, 84) configured to utilize vehicle information relating to a vehicle to provide a service to the vehicle; a service manager (54, 55, 56) configured to obtain the vehicle information stored in an electronic control unit of the vehicle; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request requesting provision of confidential information among the vehicle information, confirm whether or not to authorize the request to acquire the confidential information based on the presence or absence of a user's consent; Equipped with The authorization check unit is mounted on the at least one service bus or the service manager; a first electronic control unit (2) mounted on the vehicle and including the service manager and the at least one service bus; The at least one service application (82, 84) is an authentication system mounted on at least one of a center (7) installed outside the vehicle and configured to be able to communicate data with the first electronic control unit, and a second electronic control unit (3) mounted on the vehicle and configured to be able to communicate data with the first electronic control unit.

6. At least one service application (41, 42, 51, 52, 82, 84) configured to utilize vehicle information relating to a vehicle to provide a service to the vehicle; a service manager (54, 55, 56) configured to obtain the vehicle information stored in an electronic control unit of the vehicle; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request requesting provision of confidential information among the vehicle information, confirm whether or not to authorize the request to acquire the confidential information based on the presence or absence of a user's consent; Equipped with The authorization check unit is mounted on the at least one service bus or the service manager; a confidential setting storage unit (71) that stores confidential setting information indicating whether each of the plurality of vehicle information corresponds to the confidential information; a user consent storage unit (73) for storing access consent information indicating whether or not the user consents to access to the secret information, An authentication system in which the authorization confirmation unit confirms whether to authorize the acquisition request using the confidentiality setting information stored in the confidentiality setting memory unit and the access agreement information stored in the user agreement memory unit.

7. At least one service application (41, 42, 51, 52, 82, 84) configured to utilize vehicle information relating to a vehicle to provide a service to the vehicle; a service manager (54, 55, 56) configured to obtain the vehicle information stored in an electronic control unit of the vehicle; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request requesting provision of confidential information among the vehicle information, confirm whether or not to authorize the request to acquire the confidential information based on the presence or absence of a user's consent; Equipped with The authorization check unit is mounted on the at least one service bus or the service manager; a first electronic control unit (2) mounted on the vehicle and including the service manager and the at least one service bus; said at least one service application includes a first service application (41, 42) produced by a third party and a second service application (51, 52) produced by the manufacturer of the vehicle; The first electronic control unit is a hypervisor (31) configured to manage a first virtual machine (32) and a second virtual machine (33) so as to enable the first virtual machine (32) and the second virtual machine (33) to be executed in parallel on a CPU (21); the at least one service bus includes a first service bus (43) and a second service bus (57); the first service application and the first service bus are installed on the first virtual machine; The second service application and the second service bus are installed in the second virtual machine.

8. A relay device (2) that relays data transmitted from an electronic control device (3, 4) to a communication network of a vehicle, at least one service application (41, 42, 51, 52) configured to utilize vehicle information relating to said vehicle to provide services to said vehicle; a service manager (54, 55, 56) configured to acquire the vehicle information stored in a first storage unit (22, 23) of the relay device or a second storage unit (25, 26, 28, 29) of the electronic control device; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request for requesting provision of confidential information among the vehicle information stored in the second storage unit of the electronic control device or the first storage unit of the relay device, confirm whether or not to authorize the request for acquiring the confidential information based on the presence or absence of a user's consent; Equipped with The authorization check unit is mounted on the at least one service bus or the service manager; a user consent confirmation unit (53) for confirming whether or not the user consents to the vehicle information acquisition request; the authorization confirmation unit is configured, when the at least one service application makes the vehicle information acquisition request, to confirm with the user consent confirmation unit whether or not the user has consented to the vehicle information acquisition request, and to authorize the acquisition request if the user has consented; The authorization check unit is mounted on the at least one service bus; said at least one service application includes a first service application (41, 42) produced by a third party and a second service application (51, 52) produced by the manufacturer of the vehicle; The second service application a second authorization confirmation unit (91) configured to confirm whether or not to authorize the vehicle information acquisition request of the second service application when the second service application makes the vehicle information acquisition request; The relay device is configured so that the authorization confirmation unit confirms with the user consent confirmation unit whether or not the user has consented to the vehicle information acquisition request from the first service application.

9. A relay device (2) that relays data transmitted from an electronic control device (3, 4) to a communication network of a vehicle, at least one service application (41, 42, 51, 52) configured to utilize vehicle information relating to said vehicle to provide services to said vehicle; a service manager (54, 55, 56) configured to acquire the vehicle information stored in a first storage unit (22, 23) of the relay device or a second storage unit (25, 26, 28, 29) of the electronic control device; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request for requesting provision of confidential information among the vehicle information stored in the second storage unit of the electronic control device or the first storage unit of the relay device, confirm whether or not to authorize the request for acquiring the confidential information based on the presence or absence of a user's consent; Equipped with The authorization check unit is mounted on the at least one service bus or the service manager; a user consent confirmation unit (53) for confirming with the user whether or not the user consents to the vehicle information acquisition request, the authorization confirmation unit is configured, when the at least one service application makes the vehicle information acquisition request, to confirm with the user consent confirmation unit whether or not the user has consented to the vehicle information acquisition request, and to authorize the acquisition request if the user has consented; The authorization confirmation unit is installed in the service manager, said at least one service application includes a first service application (41, 42) produced by a third party and a second service application (51, 52) produced by the manufacturer of the vehicle; The second service application a second authorization confirmation unit (91) configured to confirm whether or not to authorize the vehicle information acquisition request of the second service application when the second service application makes the vehicle information acquisition request; The relay device is configured so that the authorization confirmation unit confirms with the user consent confirmation unit whether or not the user has consented to the vehicle information acquisition request from the first service application.

10. A relay device (2) that relays data transmitted from an electronic control device (3, 4) to a communication network of a vehicle, comprising: at least one service application (41, 42, 51, 52) configured to utilize vehicle information relating to said vehicle to provide services to said vehicle; a service manager (54, 55, 56) configured to acquire the vehicle information stored in a first storage unit (22, 23) of the relay device or a second storage unit (25, 26, 28, 29) of the electronic control device; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request for requesting provision of confidential information among the vehicle information stored in the second storage unit of the electronic control device or the first storage unit of the relay device, confirm whether or not to authorize the request for acquiring the confidential information based on the presence or absence of a user's consent; Equipped with The authorization check unit is mounted on the at least one service bus or the service manager; a confidential setting storage unit (71) that stores confidential setting information indicating whether each of the plurality of vehicle information corresponds to the confidential information; a user consent storage unit (73) for storing access consent information indicating whether or not the user consents to access to the secret information, The authorization confirmation unit is a relay device that uses the confidentiality setting information stored in the confidentiality setting memory unit and the access consent information stored in the user consent memory unit to confirm whether to authorize the acquisition request.

11. A relay device according to any one of claims 8 to 10, The service manager is configured to transmit an instruction to acquire the confidential information from the electronic control device via the communication network when the authorization confirmation unit confirms that the request to acquire the confidential information is authorized.

12. At least one service application (41, 42, 51, 52, 82, 84) configured to utilize vehicle information relating to a vehicle to provide a service to the vehicle; a service manager (54, 55, 56) configured to obtain the vehicle information stored in an electronic control unit of the vehicle; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request for requesting provision of confidential information among the vehicle information, confirm whether or not to authorize the request for acquiring the confidential information based on the presence or absence of a user's consent; A hypervisor having a function of managing a plurality of virtual machines so that the plurality of virtual machines can be executed in parallel on a CPU; Equipped with The at least one service bus and the at least one service application are installed on the virtual machine; The authorization check unit is an authentication system (1) installed on the at least one service bus.

13. At least one service application (41, 42, 51, 52, 82, 84) configured to utilize vehicle information relating to a vehicle to provide a service to the vehicle; a service manager (54, 55, 56) configured to obtain the vehicle information stored in an electronic control unit of the vehicle; at least one service bus (43, 57) configured to manage the transmission and reception of data between said at least one service application and said service manager; an authorization confirmation unit (63) configured to, when the at least one service application makes a vehicle information acquisition request for requesting provision of confidential information among the vehicle information, confirm whether or not to authorize the request for acquiring the confidential information based on the presence or absence of a user's consent; a hypervisor having a function of managing the first virtual machine and the second virtual machine so as to enable the first virtual machine and the second virtual machine to be executed in parallel on a CPU; Equipped with The authorization check unit is mounted on the at least one service bus or the service manager; a user consent confirmation unit (53) for confirming whether or not the user consents to the vehicle information acquisition request; said at least one service application includes a first service application (41, 42) produced by a third party and a second service application (51, 52) produced by the manufacturer of the vehicle; The first service application is installed on the first virtual machine; The second service application is installed on the second virtual machine; An authentication system (1) configured to confirm with the user consent confirmation unit whether the user has consented to the vehicle information acquisition requests from the first service application and the second service application.

Images