Relay device, vehicle communication method, and vehicle communication program

Abstract

To provide a relay device and a vehicle communication method capable of improving security in an in-vehicle network.SOLUTION: A relay device 100 includes: an authentication processing unit 140 that is mounted on a vehicle equipped with a TCU 200A, an in-vehicle ECU 200B, and an in-vehicle ECU 200C which are a plurality of functional units in an in-vehicle network, and acquires authentication information for the functional units from an external device outside the vehicle, and performs authentication processing for the functional units using the acquired authentication information; and a relay processing unit 120 that relays information between the functional units on the basis of a result of the authentication processing by the authentication processing unit. When the validity of the authentication information expires, the authentication processing unit acquires new authentication information from the external device.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates to a relay device and a vehicle communication method. This application claims priority based on Japanese Patent Application No. 2019-126255, filed on July 5, 2019, the disclosure of which is incorporated herein in its entirety. [Background technology]

[0002] Patent Document 1 (JP Patent Publication 2013-193598 A) discloses a vehicle authentication device as follows. That is, the vehicle authentication device is a vehicle authentication device (11) provided in an electronic control unit (1) mounted on a vehicle and connected via an in-vehicle network to an in-vehicle communication device (2) capable of communicating at least wirelessly with an external device (3) outside the vehicle using an Internet Protocol, and includes an identification information acquisition means (11, S1) for acquiring identification information when information including identification information for identifying the external device is transmitted from the external device to the communication device, a state determination means (11, S5) for determining whether the state of the vehicle corresponds to a security ensured state, which is a state indicating that a legitimate user who is authorized to operate the vehicle will operate or has operated the vehicle, and ...6) for determining whether the state of the vehicle corresponds to a security ensured state, which is a state indicating that a legitimate user who is authorized to operate the vehicle will operate the vehicle or has operated the vehicle, and a state determination means (11, S7) for determining whether the state of the vehicle corresponds to a security ensured state, which is a state indicating that a legitimate user who is authorized to operate the vehicle will operate the vehicle or has operated the vehicle, and a state determination means (11, S8) for determining whether the state of the vehicle corresponds to a security ensured state. The electronic control device further includes a registration means (11, S7) for registering the identification information acquired by the information acquisition means in a storage device (12) mounted on the vehicle, but not registering the identification information in the storage device if it is determined that the vehicle does not fall under a security assured state; a registration determination means (11, S2) for determining whether or not the identification information is registered in the storage device when the identification information is acquired by the identification information acquisition means; and an authentication means (11, S3, S6) for permitting information exchange between an external device identified by the identification information and the electronic control device if the registration determination means determines that the identification information is registered in the storage device, but prohibiting information exchange between the external device identified by the identification information and the electronic control device based on the determination by the registration determination means that the identification information is not registered in the storage device. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2013-193598 A Summary of the Invention

[0004] The relay device of the present disclosure is a relay device mounted on a vehicle having multiple functional units, and includes an authentication processing unit that obtains authentication information for the functional units from an external device outside the vehicle and performs authentication processing for the functional units using the obtained authentication information, and a relay processing unit that relays information between the functional units and other functional units based on the result of the authentication processing by the authentication processing unit, and when the authentication information has expired, the authentication processing unit obtains new authentication information from the external device.

[0005] The vehicle communication method disclosed herein is a vehicle communication method in a relay device mounted on a vehicle having a plurality of functional units, and includes the steps of obtaining authentication information of the functional units from an external device outside the vehicle, performing an authentication process for the functional units using the obtained authentication information, relaying information between the functional units and other functional units based on a result of the authentication process, and, if the authentication information has expired, obtaining new authentication information from the external device.

[0006] One aspect of the present disclosure may be realized as a semiconductor integrated circuit that realizes a part or all of a relay device, or as a system including a relay device. Also, one aspect of the present disclosure may be realized as a program that causes a computer to execute the steps of processing in the relay device. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a diagram illustrating a configuration of a communication system according to an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram showing a configuration of an in-vehicle communication system according to an embodiment of the present invention. [Diagram 3] FIG. 3 is a diagram illustrating a configuration of an in-vehicle ECU according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating a configuration of a relay device according to an embodiment of the present disclosure. [Diagram 5] FIG. 5 is a flowchart that defines an operation procedure when a relay device in a communication system according to an embodiment of the present disclosure relays information between in-vehicle ECUs based on a result of authentication processing. [Figure 6] FIG. 6 is a diagram illustrating an example of a sequence of an outside-vehicle authentication process in the communication system according to the embodiment of the present disclosure. [Figure 7] FIG. 7 is a diagram illustrating an example of a sequence of the outside-vehicle authentication process and the inside-vehicle authentication process in the communication system according to the embodiment of the present disclosure. [Figure 8] FIG. 8 is a diagram illustrating an example of a sequence of an in-vehicle authentication process in the communication system according to the embodiment of the present disclosure. [Figure 9] FIG. 9 is a diagram illustrating another example of the sequence of the outside-vehicle authentication process and the inside-vehicle authentication process in the communication system according to the embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Conventionally, in-vehicle network systems have been developed to improve security in in-vehicle networks.

[0009] [Problem that this disclosure aims to solve] There is a demand for a technology that can improve security in an in-vehicle network beyond the technology described in Patent Document 1.

[0010] The present disclosure has been made to solve the above-mentioned problems, and has an object to provide a relay device and a vehicle communication method that can improve security in an in-vehicle network.

[0011] [Effects of this disclosure] According to the present disclosure, it is possible to improve security in an in-vehicle network.

[0012] [Description of the embodiments of the present disclosure] First, the contents of the embodiments of the present disclosure will be listed and described.

[0013] (1) A relay device according to an embodiment of the present disclosure is a relay device mounted on a vehicle having a plurality of functional units, and includes an authentication processing unit that obtains authentication information for the functional units from an external device outside the vehicle and performs authentication processing for the functional units using the obtained authentication information, and a relay processing unit that relays information between the functional units and other functional units based on a result of the authentication processing by the authentication processing unit, and when the authentication information has expired, the authentication processing unit obtains new authentication information from the external device.

[0014] In this manner, by acquiring authentication information of the functional unit from an external device outside the vehicle, even if a new unknown functional unit is added to the in-vehicle network, the authentication information of the functional unit can be acquired. Furthermore, by acquiring new authentication information when the expiration date has expired, performing authentication processing of the functional unit using the acquired authentication information, and relaying information between the functional units based on the result of the authentication processing, the security of the in-vehicle network can be guaranteed, and even in a situation where the communication environment between the relay device and the external device is poor due to the driving environment of the vehicle and it is difficult to acquire new authentication information from the external device, the authentication processing of the functional unit can be continuously performed using the authentication information. Therefore, the security of the in-vehicle network can be improved.

[0015] (2) Preferably, when the authentication information has expired and the relay device is unable to communicate with the external device, the authentication processing unit performs an extension process to maintain the validity of the authentication information, and performs authentication processing of the functional unit corresponding to the authentication information using extended authentication information, which is the authentication information that has maintained its validity.

[0016] With this configuration, even if the communication environment between the relay device and the external device is poor due to the vehicle's driving environment and new authentication information cannot be obtained when the authentication information expires, the authentication process can be performed and the relay of information between the functional units based on the authentication result can be continued. As a result, for example, in a configuration in which security is improved by updating the contents of the authentication information outside the vehicle, stable communication in the in-vehicle network can be managed regardless of the vehicle's driving environment.

[0017] (3) Preferably, the relay processing unit determines, depending on the type of the functional unit, the contents of the information to be relayed when the authentication processing unit has successfully completed the authentication processing using the extended authentication information.

[0018] With this configuration, it is possible to limit some of the information to be relayed when extension processing is performed depending on the type of functional unit. For example, by continuing to relay information between functional units that affect the operation of the vehicle while stopping the relaying of information between functional units that do not affect the operation of the vehicle, it is possible to suppress a decrease in security in the in-vehicle network while maintaining good operation of the vehicle.

[0019] (4) Preferably, the relay processing unit determines, depending on the type of information received from the functional unit, whether or not to perform relay when the authentication processing by the authentication processing unit using the extended authentication information is successful.

[0020] With this configuration, it is possible to limit some of the information to be relayed when extension processing is performed depending on the type of information received from the functional unit. For example, by continuing to relay information that affects the vehicle's operation while stopping the relaying of information that does not affect the vehicle's operation, it is possible to suppress a decrease in security in the in-vehicle network while maintaining good operation of the vehicle.

[0021] (5) Preferably, the authentication processing unit acquires from the external device the authentication information whose contents are different each time the authentication information is acquired.

[0022] With this configuration, new authentication information can be obtained each time the expiration date expires, and the authentication information can be used to perform authentication processing for the functional unit, thereby further improving security in the in-vehicle network.

[0023] (6) Preferably, when the relay device is capable of communicating with the external device and the authentication information has expired, and the vehicle is traveling, the authentication processing unit performs an extension process to maintain the validity of the authentication information without obtaining new authentication information from the external device.

[0024] With this configuration, for example, it is possible to avoid an authentication error occurring when performing authentication processing using new authentication information, which would cause the relay of some or all of the information between functional units to be halted while the vehicle is traveling, thereby maintaining smooth operation of the vehicle.

[0025] (7) A vehicle communication method according to an embodiment of the present disclosure is a vehicle communication method in a relay device mounted on a vehicle having a plurality of functional units, and includes the steps of obtaining authentication information of the functional units from an external device outside the vehicle, performing an authentication process for the functional units using the obtained authentication information, relaying information between the functional units and other functional units based on a result of the authentication process, and, if the authentication information has expired, obtaining new authentication information from the external device.

[0026] In this way, by the method of acquiring authentication information of a functional unit from an external device outside the vehicle, even if a new unknown functional unit is added to the in-vehicle network, the authentication information of the functional unit can be acquired. Furthermore, by the method of acquiring new authentication information when the expiration date has expired, performing authentication processing of the functional unit using the acquired authentication information, and relaying information between the functional units based on the result of the authentication processing, the security of the in-vehicle network can be guaranteed, and even in a situation where the communication environment between the relay device and the external device is poor due to the driving environment of the vehicle and it is difficult to acquire new authentication information from the external device, the authentication processing of the functional unit can be continuously performed using the authentication information. Therefore, the security of the in-vehicle network can be improved.

[0027] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and the description thereof will not be repeated. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0028] [Communication Systems] FIG. 1 is a diagram illustrating a configuration of a communication system according to an embodiment of the present disclosure.

[0029] 1, the communication system 401 includes the server 181 and an in-vehicle communication system 301. The in-vehicle communication system 301 is mounted on a vehicle 1.

[0030] FIG. 2 is a diagram showing a configuration of an in-vehicle communication system according to an embodiment of the present invention.

[0031] 2, an in-vehicle communication system 301 includes in-vehicle electronic control units (ECUs) 200A to 200D and a relay device 100. The relay device 100 is a relay device that is connected to the in-vehicle communication system 301.

[0032] Hereinafter, each of the in-vehicle ECUs 200A to 200D is also referred to as an in-vehicle ECU 200. The in-vehicle ECU 200 and the relay device 100 are examples of an in-vehicle device.

[0033] The in-vehicle communication system 301 is not limited to a configuration including four in-vehicle ECUs 200, but may be a configuration including three or less, or five or more in-vehicle ECUs 200. The in-vehicle communication system 301 is not limited to a configuration including one relay device 100, but may be a configuration including two or more relay devices 100.

[0034] The in-vehicle ECU 200 and the relay device 100 configure an in-vehicle network 12. The in-vehicle ECU 200 is an example of a functional unit in the in-vehicle network 12.

[0035] In the in-vehicle network 12, the in-vehicle ECU 200 is connected to the relay device 100 via an Ethernet (registered trademark) cable 13, for example.

[0036] The relay device 100 is, for example, a switch device, and is capable of relaying information between a plurality of in-vehicle ECUs 200 connected thereto. More specifically, the relay device 100 is capable of performing relay processing according to, for example, layer 2 and layer 3 that is higher than layer 2.

[0037] The in-vehicle ECU 200A is, for example, a TCU (Telematics Communication Unit) and will hereinafter also be referred to as the TCU 200A.

[0038] The in-vehicle ECUs 200B to 200D are, for example, an automatic driving ECU (Electronic Control Unit), a sensor, a navigation device, an accelerator control ECU, a brake control ECU, a steering control ECU, and a human-machine interface.

[0039] For example, the in-vehicle ECU 200D is not initially connected to the relay device 100. The in-vehicle ECU 200D is installed in the vehicle 1, for example, at a manufacturing plant of the vehicle 1, a dealer of the vehicle 1, or a dealer of aftermarket parts for the vehicle 1, and is connected to the relay device 100 via an Ethernet cable.

[0040] The relay device 100 relays Ethernet frames in accordance with the Ethernet communication standard. Specifically, the relay device 100 relays Ethernet frames exchanged between the in-vehicle ECUs 200, for example. An IP packet is stored in the Ethernet frame.

[0041] In addition, the in-vehicle communication system 301 is not limited to a configuration in which Ethernet frames are relayed in accordance with the Ethernet communication standard, but may be a configuration in which data is relayed in accordance with communication standards such as CAN (Controller Area Network) (registered trademark), FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), and LIN (Local Interconnect Network).

[0042] 1 and 2, the TCU 200A is capable of communicating with a server 181 outside the vehicle 1. In particular, the TCU 200A is capable of communicating with the server 181 via the wireless base station device 161 by using, for example, an IP packet.

[0043] More specifically, the TCU 200A is capable of performing wireless communication with a wireless base station device 161 outside the vehicle 1 in accordance with a communication standard such as LTE (Long Term Evolution) or 3G.

[0044] Specifically, when the wireless base station device 161 receives an IP packet from the server 181 outside the vehicle 1 via the external network 11, the wireless base station device 161 transmits the received IP packet in a wireless signal to the TCU 200A.

[0045] For example, when TCU 200A receives a wireless signal including an IP packet from server 181 from wireless base station device 161, it acquires the IP packet from the received wireless signal, stores the acquired IP packet in an Ethernet frame, and transmits the frame to relay device 100.

[0046] Furthermore, when TCU 200A receives an Ethernet frame from relay device 100, it acquires an IP packet from the received Ethernet frame, and transmits the acquired IP packet to wireless base station device 161 by including the IP packet in a wireless signal.

[0047] When the wireless base station device 161 receives a wireless signal from the TCU 200A, it acquires an IP packet from the received wireless signal and transmits the acquired IP packet to the server 181 via the external network 11.

[0048] [In-vehicle ECU] FIG. 3 is a diagram illustrating a configuration of an in-vehicle ECU according to an embodiment of the present disclosure.

[0049] 3, in-vehicle ECU 200 includes a communication unit 210, a processing unit 220, an authentication request unit 230, and a storage unit 240. Storage unit 240 is, for example, a flash memory.

[0050] When the communication unit 210 receives an Ethernet frame from the relay device 100 via the corresponding Ethernet cable 13 , the communication unit 210 outputs the received Ethernet frame to the processing unit 220 .

[0051] The processing unit 220 acquires information contained in the Ethernet frame received from the communication unit 210, and performs a predetermined process using the acquired information.

[0052] Furthermore, the processing unit 220 generates an Ethernet frame addressed to another in-vehicle ECU 200 , and outputs the generated Ethernet frame to the communication unit 210 .

[0053] When the communication unit 210 receives an Ethernet frame from the processing unit 220 , it transmits the received Ethernet frame to the relay device 100 via the corresponding Ethernet cable 13 .

[0054] Furthermore, when the processing unit 220 acquires a common key (described later) from an Ethernet frame received from the communication unit 210 , the processing unit 220 outputs the acquired common key to the authentication request unit 230 .

[0055] Upon receiving the common key from the processing unit 220 , the authentication request unit 230 stores the received common key in the storage unit 240 .

[0056] In addition, when the authentication request unit 230's own in-vehicle ECU 200 is connected to the relay device 100 via the Ethernet cable 13, the authentication request unit 230 generates an Ethernet frame in which authentication request information including the own ID, for example, a MAC address, is stored, and transmits the generated Ethernet frame to the relay device 100 via the communication unit 210.

[0057] [Repeater] FIG. 4 is a diagram illustrating a configuration of a relay device according to an embodiment of the present disclosure.

[0058] 4, relay device 100 includes communication ports 52A, 52B, 52C, and 52D, a communication unit 110, a relay processing unit 120, a detection unit 130, an authentication processing unit 140, a storage unit 150, and a timer 160. Storage unit 150 is, for example, a flash memory.

[0059] For example, the relay device 100 includes timers 160 whose number corresponds to the communication ports 52A, 52B, 52C, and 52D. Specifically, the relay device 100 includes, as the timers 160, timers 160A, 160B, 160C, and 160D.

[0060] Hereinafter, each of the communication ports 52A, 52B, 52C, and 52D will also be referred to as a communication port 52. The communication port 52 is, for example, a terminal to which an Ethernet cable can be connected.

[0061] In this example, the communication ports 52A, 52B, and 52C are connected to the TCU 200A, the in-vehicle ECU 200B, and the in-vehicle ECU 200C, respectively.

[0062] When communication unit 110 receives an Ethernet frame from a certain in-vehicle ECU 200 via a corresponding communication port 52 , it outputs the received Ethernet frame to relay processing unit 120 .

[0063] Furthermore, when the communication unit 110 receives an Ethernet frame addressed to a certain in-vehicle ECU 200 from the relay processing unit 120 , the communication unit 110 transmits the received Ethernet frame to the in-vehicle ECU 200 via the corresponding communication port 52 .

[0064] Relay processing unit 120 performs relay processing of Ethernet frames between in-vehicle ECUs 200. Specifically, when relay processing unit 120 receives an Ethernet frame from communication unit 110, relay processing unit 120 performs layer 2 relay processing and layer 3 relay processing on the received Ethernet frame.

[0065] In addition, when the relay processing unit 120 receives an Ethernet frame containing authentication request information from an in-vehicle ECU 200 that is to be newly added to the in-vehicle network 12, the relay processing unit 120 acquires the authentication request information from the received Ethernet frame and outputs the acquired authentication request information to the detection unit 130.

[0066] [Detection section] The detection unit 130 detects a new functional unit that is newly added to the in-vehicle network 12. For example, the detection unit 130 detects the in-vehicle ECU 200D that is newly added to the in-vehicle network 12 as a new functional unit.

[0067] 2 and 4, the in-vehicle ECU 200D is connected to a communication port 52D in the relay device 100 via an Ethernet cable 13. As shown in FIG.

[0068] The detection unit 130 in the relay device 100 detects the addition of the in-vehicle ECU 200D to the in-vehicle network 12 by receiving the authentication request information from the in-vehicle ECU 200D via the relay processing unit 120.

[0069] The detection unit 130 outputs the authentication request information received from the relay processing unit 120 to the authentication processing unit 140 .

[0070] [Authentication processing section] The authentication processing unit 140 acquires authentication information for the in-vehicle ECU 200 from an external device outside the vehicle 1.

[0071] More specifically, when the authentication processing unit 140 receives authentication request information from the detection unit 130, it acquires authentication information of the in-vehicle ECU 200D, which is a new function unit indicated by the authentication request information, from the server 181 in a procedure conforming to IEEE802.1X, for example.

[0072] The server 181 performs authentication processing for the in-vehicle ECU 200 using an authentication protocol in a procedure conforming to, for example, IEEE802.1X, thereby generating authentication information for the in-vehicle ECU 200. Hereinafter, the authentication processing for the in-vehicle ECU 200 by the server 181 is also referred to as off-vehicle authentication processing.

[0073] Here, the authentication method in the outside-vehicle authentication process by the server 181 may be, for example, EAP (Extended Authentication Protocol)-MD (Message Digest algorithm)5, EAP-TLS (Transport Layer Security), PEAP (Protected EAP), LEAP (Lightweight EAP), and EAP-TTLS (EAP-Tunneled Transport Layer Security), depending on the authentication protocol used in the authentication process.

[0074] For example, the storage unit 150 stores an authentication method in the outside-vehicle authentication process performed by the server 181.

[0075] When the authentication processing unit 140 receives authentication request information from the detection unit 130, it obtains from the memory unit 150 the authentication method for the off-vehicle authentication processing by the server 181, and transmits authentication method information indicating the obtained authentication method to the on-vehicle ECU 200D, which is a new functional unit indicated by the authentication request information, via the relay processing unit 120 and the communication unit 110.

[0076] The in-vehicle ECU 200D and the server 181 exchange EAP messages, including information necessary for the outside-vehicle authentication process, via the relay device 100.

[0077] The authentication processing unit 140 in the relay device 100 relays EAP messages and the like exchanged between the server 181 and the in-vehicle ECU 200D.

[0078] More specifically, when the authentication processing unit 140 receives an Ethernet frame containing an EAP message from the in-vehicle ECU 200D via the communication unit 110 and the relay processing unit 120, the authentication processing unit 140 converts the received Ethernet frame into a RADIUS (Remote Authentication Dial In User Service) frame and transmits the converted RADIUS frame to the server 181 via the communication unit 110 and the TCU 200A.

[0079] In addition, when the authentication processing unit 140 receives a RADIUS frame from the server 181 via the TCU 200A, the communication unit 110, and the relay processing unit 120, it converts the received RADIUS frame into an Ethernet frame and transmits the converted Ethernet frame to the in-vehicle ECU 200D via the communication unit 110.

[0080] The server 181 performs an outside-vehicle authentication process for the in-vehicle ECU 200D by using the EAP message received from the in-vehicle ECU 200 via the relay device 100. When the server 181 succeeds in authenticating the in-vehicle ECU 200D by the outside-vehicle authentication process, the server 181 generates authentication information indicating successful authentication, and transmits the generated authentication information to the relay device 100 via the wireless base station device 161 and the TCU 200A.

[0081] On the other hand, if the server 181 fails to authenticate the in-vehicle ECU 200D, the server 181 generates authentication information indicating the authentication failure, and transmits the generated authentication information to the relay device 100 via the wireless base station device 161 and the TCU 200A.

[0082] When the authentication processing unit 140 receives authentication information indicating successful authentication from the server 181 via the TCU 200A, the communication unit 110, and the relay processing unit 120, the authentication processing unit 140 generates off-vehicle authentication success information indicating that the off-vehicle authentication process was successful, and outputs the generated off-vehicle authentication success information to the relay processing unit 120.

[0083] When the relay processing unit 120 receives the outside-vehicle authentication success information from the authentication processing unit 140, the relay processing unit 120 transmits the received outside-vehicle authentication success information via the communication unit 110 to the in-vehicle ECU 200D.

[0084] Here, when authentication processing unit 140 receives authentication information indicating successful authentication from server 181 via communication unit 110 and relay processing unit 120, authentication processing unit 140 sets the validity period of the authentication information in timer 160 for each in-vehicle ECU 200.

[0085] For example, the authentication processing unit 140 sets the validity time of the authentication information of TCU 200A connected to communication port 52A in timer 160A, sets the validity time of the authentication information of in-vehicle ECU 200B connected to communication port 52A in timer 160B, sets the validity time of the authentication information of in-vehicle ECU 200C connected to communication port 52C in timer 160C, and sets the validity time of the authentication information of in-vehicle ECU 200D connected to communication port 52D in timer 160D.

[0086] On the other hand, when authentication processing unit 140 receives authentication information indicating a failure of authentication from server 181 via TCU 200 A, communication unit 110 and relay processing unit 120 , it outputs connection refusal information to relay processing unit 120 .

[0087] When relay processing unit 120 receives the connection denial information from authentication processing unit 140, relay processing unit 120 transmits the received connection denial information via communication unit 110 to in-vehicle ECU 200D.

[0088] The authentication processing unit 140 performs authentication processing of the in-vehicle ECU 200 using authentication information indicating successful authentication, acquired from the server 181. Hereinafter, the authentication processing of the in-vehicle ECU 200 performed by the authentication processing unit 140 is also referred to as in-vehicle authentication processing.

[0089] The relay processing unit 120 relays information between the in-vehicle ECUs 200 based on the result of the in-vehicle authentication processing by the authentication processing unit 140 .

[0090] (Authentication example 1) For example, the authentication information that the authentication processing unit 140 receives from the server 181 and indicates successful authentication includes a common key.

[0091] When authentication processing unit 140 receives authentication information of in-vehicle ECU 200 from server 181 via TCU 200A, communication unit 110 and relay processing unit 120, authentication processing unit 140 sets a predetermined valid time of the received authentication information in a corresponding timer 160.

[0092] Then, the authentication processing unit 140 acquires a common key from the received authentication information, and stores the acquired common key in the storage unit 150 in association with the in-vehicle ECU 200. For example, the authentication processing unit 140 stores the acquired common key in the storage unit 150 in association with the communication port 52.

[0093] Furthermore, the authentication processing unit 140 generates outside-vehicle authentication success information including the common key, and transmits the generated outside-vehicle authentication success information to the corresponding in-vehicle ECU 200 via the communication unit 110 .

[0094] Referring again to Figure 3, when the authentication request unit 230 in the on-board ECU 200 receives off-vehicle authentication success information from the authentication processing unit 140 in the relay device 100 via the communication unit 210, the authentication request unit 230 obtains a common key from the received off-vehicle authentication success information and stores the obtained common key in the memory unit 240.

[0095] The authentication processing unit 140 in the relay device 100 performs the in-vehicle authentication process for each on-board ECU 200 by using the common key in the storage unit 150, for example, periodically or irregularly.

[0096] Specifically, the authentication processing unit 140 generates, for example, a random number and transmits the generated random number to the corresponding in-vehicle ECU 200 via the communication unit 110. In addition, the authentication processing unit 140 encrypts the generated random number by using a common key to generate encrypted data.

[0097] When the authentication request unit 230 in the in-vehicle ECU 200 receives the random number, the authentication request unit 230 generates encrypted data by encrypting the received random number using the common key in the storage unit 240. The in-vehicle ECU 200 transmits the generated encrypted data to the relay device 100.

[0098] When the authentication processing unit 140 in the relay device 100 receives the encrypted data from the in-vehicle ECU 200 via the communication unit 110, the authentication processing unit 140 compares the received encrypted data with encrypted data generated by the relay device 100 itself.

[0099] When the encrypted data received from the in-vehicle ECU 200 matches the encrypted data generated by the authentication processing unit 140, the authentication processing unit 140 determines that the in-vehicle authentication process of the in-vehicle ECU 200 has been successful. Then, the authentication processing unit 140 outputs to the relay processing unit 120 in-vehicle authentication success information indicating that the authentication of the in-vehicle ECU 200 has been successful.

[0100] When relay processing unit 120 receives the in-vehicle authentication success information from authentication processing unit 140, relay processing unit 120 starts or continues relaying information between in-vehicle ECU 200 and another in-vehicle ECU 200.

[0101] More specifically, when relay processing unit 120 receives in-vehicle authentication success information from authentication processing unit 140, relay processing unit 120 starts or continues relaying Ethernet frames between in-vehicle ECU 200 and another in-vehicle ECU 200.

[0102] On the other hand, when the encrypted data received from the in-vehicle ECU 200 does not match the encrypted data generated by the authentication processing unit 140, the authentication processing unit 140 determines that the in-vehicle authentication process of the in-vehicle ECU 200 has failed. Then, the authentication processing unit 140 outputs to the relay processing unit 120 in-vehicle authentication failure information indicating that the authentication of the in-vehicle ECU 200 has failed.

[0103] When relay processing unit 120 receives the in-vehicle authentication failure information from authentication processing unit 140, relay processing unit 120 stops relaying information between in-vehicle ECU 200 and another in-vehicle ECU 200.

[0104] More specifically, when relay processing unit 120 receives in-vehicle authentication failure information from authentication processing unit 140, it begins discarding Ethernet frames received from in-vehicle ECU 200 and Ethernet frames received from other in-vehicle ECUs 200 and addressed to that in-vehicle ECU 200.

[0105] Furthermore, if the in-vehicle authentication process of the in-vehicle ECU 200 fails, the authentication processing unit 140 acquires new authentication information for the in-vehicle ECU 200 from the server 181, for example, in accordance with a procedure conforming to IEEE802.1X.

[0106] When authentication processing unit 140 receives authentication information indicating successful authentication as new authentication information from server 181, it stores the common key included in the received authentication information in storage unit 150 and sets a predetermined valid time for the new authentication information in timer 160. In addition, authentication processing unit 140 transmits the common key to in-vehicle ECU 200 via relay processing unit 120 and communication unit 110.

[0107] Then, the authentication processing unit 140 uses the common key to again perform in-vehicle authentication processing of the in-vehicle ECU 200. Specifically, the authentication processing unit 140 generates random numbers and encrypted data, transmits the generated encrypted data to the in-vehicle ECU 200, and compares the encrypted data received from the in-vehicle ECU 200 with the encrypted data generated by the authentication processing unit 140.

[0108] On the other hand, when authentication processing unit 140 receives from server 181 authentication information indicating an authentication failure as new authentication information, it outputs connection refusal information to relay processing unit 120 .

[0109] (Authentication example 2) For example, the authentication information that the authentication processing unit 140 receives from the server 181 includes the MAC address of the in-vehicle ECU 200 that has been authenticated by the server 181. Hereinafter, the MAC address of the authenticated in-vehicle ECU 200 is also referred to as an authenticated MAC address.

[0110] When authentication processing unit 140 receives authentication information of in-vehicle ECU 200 from server 181 via TCU 200A, communication unit 110, and relay processing unit 120, authentication processing unit 140 sets a predetermined valid time of the received authentication information in corresponding timer 160.

[0111] Then, authentication processing unit 140 acquires an authenticated MAC address from the received authentication information, and stores the acquired authenticated MAC address in storage unit 150 in association with the in-vehicle ECU 200. For example, authentication processing unit 140 stores the acquired authenticated MAC address in storage unit 150 in association with communication port 52.

[0112] Furthermore, the authentication processing unit 140 transmits outside-vehicle authentication success information to the corresponding in-vehicle ECU 200 via the communication unit 110 .

[0113] The authentication processing unit 140 performs authentication processing for each on-board ECU 200 by using the authenticated MAC addresses in the storage unit 150, for example, periodically or irregularly.

[0114] For example, the authentication processing unit 140 acquires a source MAC address contained in an Ethernet frame received by the communication unit 110 from the corresponding in-vehicle ECU 200 via the communication port 52, and compares the acquired source MAC address with an authenticated MAC address associated with the communication port 52.

[0115] When the acquired source MAC address matches the authenticated MAC address, the authentication processing unit 140 outputs to the relay processing unit 120 in-vehicle authentication success information indicating that the authentication of the in-vehicle ECU 200 has been successful.

[0116] When relay processing unit 120 receives the in-vehicle authentication success information from authentication processing unit 140, relay processing unit 120 starts or continues relaying information between in-vehicle ECU 200 and another in-vehicle ECU 200.

[0117] On the other hand, if the acquired source MAC address does not match the authenticated MAC address, authentication processing unit 140 outputs to relay processing unit 120 in-vehicle authentication failure information indicating that authentication of in-vehicle ECU 200 has failed.

[0118] When relay processing unit 120 receives the in-vehicle authentication failure information from authentication processing unit 140, relay processing unit 120 starts discarding Ethernet frames received from in-vehicle ECU 200 and Ethernet frames received from other in-vehicle ECUs 200 and addressed to that in-vehicle ECU 200.

[0119] Furthermore, if the in-vehicle authentication process of the in-vehicle ECU 200 fails, the authentication processing unit 140 acquires new authentication information of the in-vehicle ECU 200 connected to the communication port 52 from the server 181 in a procedure conforming to IEEE802.1X, for example.

[0120] When the authentication processing unit 140 receives authentication information indicating successful authentication as new authentication information from the server 181, the authentication processing unit 140 stores the authenticated MAC address included in the received authentication information in the memory unit 150 and sets a specified validity period of the new authentication information in the timer 160.

[0121] Then, using the authenticated MAC address, authentication processing unit 140 performs authentication processing again for in-vehicle ECU 200. Specifically, authentication processing unit 140 acquires a source MAC address included in an Ethernet frame received by communication unit 110 via communication port 52, and compares the acquired source MAC address with an authenticated MAC address associated with communication port 52.

[0122] On the other hand, when authentication processing unit 140 receives from server 181 authentication information indicating an authentication failure as new authentication information, it outputs connection refusal information to relay processing unit 120 .

[0123] [Update authentication information] When the validity period of authentication information for a certain in-vehicle ECU 200 has expired, the authentication processing unit 140 acquires new authentication information for the in-vehicle ECU 200 from the server 181 .

[0124] More specifically, when the timer 160 of the corresponding in-vehicle ECU 200 expires, the authentication processing unit 140 discards the common key or the authenticated MAC address in the storage unit 150 .

[0125] Then, the authentication processing unit 140 acquires new authentication information for the in-vehicle ECU 200 from the server 181 in accordance with a procedure conforming to, for example, IEEE802.1X.

[0126] For example, the server 181 generates authentication information with different contents every time the server 181 performs the outside-vehicle authentication process and the authentication is successful. More specifically, the server 181 generates authentication information including a different common key every time the server 181 performs the outside-vehicle authentication process and the authentication is successful.

[0127] That is, authentication processing unit 140 acquires authentication information whose contents are different every time authentication processing unit 140 acquires the authentication information from server 181. More specifically, authentication processing unit 140 acquires authentication information from server 181 whose common key is updated every time authentication processing unit 140 acquires the authentication information.

[0128] When authentication processing unit 140 receives new authentication information from server 181, it stores the common key included in the received authentication information in storage unit 150, and sets a predetermined valid time for the authentication information in timer 160. In addition, authentication processing unit 140 transmits the common key to in-vehicle ECU 200 via relay processing unit 120 and communication unit 110.

[0129] [Extend processing] When the authentication information has expired and the relay device 100 cannot communicate with the server 181, the authentication processing unit 140 performs an extension process for maintaining the validity of the authentication information.

[0130] For example, when timer 160 expires, authentication processing unit 140 transmits a communication confirmation request to server 181 via communication unit 110 and TCU 200A to confirm whether communication with server 181 is possible.

[0131] When server 181 receives the communication confirmation request, server 181 transmits communication availability information to relay device 100 via wireless base station device 161 and TCU 200A as a response to the communication confirmation request.

[0132] When the authentication processing unit 140 receives the communication availability information from the server 181 via the communication unit 110 and the relay processing unit 120 , it deletes the common key or the authenticated MAC address of the corresponding in-vehicle ECU 200 from the storage unit 150 .

[0133] Then, the authentication processing unit 140 acquires new authentication information for the in-vehicle ECU 200 from the server 181 in accordance with a procedure conforming to, for example, IEEE802.1X.

[0134] On the other hand, if the authentication processing unit 140 does not receive communication possible information within a predetermined period of time after sending the communication confirmation request, it determines that the relay device 100 and the server 181 are not able to communicate with each other, and performs an extension process to maintain the validity of the authentication information.

[0135] More specifically, the authentication processing unit 140 sets a predetermined extension time for the authentication information in the timer 160 without discarding the common key or the authenticated MAC address of the corresponding in-vehicle ECU 200 in the storage unit 150 .

[0136] Alternatively, for example, when communication between the relay device 100 and the server 181 is possible and the authentication information has expired, and the vehicle 1 is traveling, the authentication processing unit 140 performs an extension process without obtaining new authentication information from the server 181.

[0137] For example, the authentication processing unit 140 acquires, via the communication unit 110 and the relay processing unit 120, information indicating whether the vehicle 1 is traveling or not from the in-vehicle ECU 200 such as an autonomous driving ECU.

[0138] Even when the authentication processing unit 140 receives communication availability information from the server 181 via the communication unit 110 and the relay processing unit 120, if the vehicle 1 is traveling, the authentication processing unit 140 sets a predetermined extension time for the authentication information in the timer 160 without discarding the common key or authenticated MAC address of the corresponding in-vehicle ECU 200 in the memory unit 150.

[0139] After the extension process, the authentication processing unit 140 uses the extended authentication information, which is authentication information that maintains its validity, to perform an in-vehicle authentication process for the corresponding in-vehicle ECU 200. Specifically, the authentication processing unit 140 performs the authentication process for the in-vehicle ECU 200 by using the common key or the authenticated MAC address in the storage unit 150, which corresponds to the extended authentication information.

[0140] When the authentication processing unit 140 performs the authentication process for the in-vehicle ECU 200 using the extended authentication information and the authentication of the in-vehicle ECU 200 is successful, the authentication processing unit 140 outputs extended authentication success information to the relay processing unit 120.

[0141] When relay processing unit 120 receives the extended authentication success information from authentication processing unit 140, relay processing unit 120 continues relaying information between in-vehicle ECU 200 and the other in-vehicle ECU 200.

[0142] After performing the extension process, the authentication processing unit 140 periodically or irregularly transmits a communication confirmation request to the server 181 and attempts to obtain new authentication information.

[0143] The authentication processing unit 140 performs authentication processing of the in-vehicle ECU 200 using the extended authentication information until new authentication information is acquired.

[0144] [Relay processing based on extended authentication information] The relay processing unit 120 determines, depending on the type of the in-vehicle ECU 200, the contents of the information to be relayed when the authentication processing by the authentication processing unit 140 using the extended authentication information is successful.

[0145] Alternatively, relay processing unit 120 determines, depending on the type of information received from in-vehicle ECU 200, whether or not to relay when authentication processing unit 140 has successfully completed authentication processing using the extended authentication information.

[0146] Relay processing unit 120 determines the content of information to be relayed when extended authentication success information is received from authentication processing unit 140, from among the information received from in-vehicle ECU 200 and the information addressed to in-vehicle ECU 200.

[0147] For example, the authentication information that the authentication processing unit 140 receives from the server 181 includes the MAC address, IP address and port number of the in-vehicle ECU 200 with which the corresponding in-vehicle ECU 200 communicates, as well as the port number of the corresponding in-vehicle ECU 200.

[0148] When authentication processing unit 140 acquires this information from the authentication information, it outputs the acquired information to relay processing unit 120.

[0149] Based on the information received from authentication processing unit 140, relay processing unit 120 determines the content of the information to be relayed when extended authentication success information is received from authentication processing unit 140.

[0150] For example, the relay processing unit 120 relays all information between the in-vehicle ECU 200 and other in-vehicle ECUs, such as an autonomous driving ECU, that affects the driving status of the vehicle 1. On the other hand, the relay processing unit 120 stops relaying information between the in-vehicle ECU 200 and other in-vehicle ECUs that does not affect the driving status of the vehicle 1.

[0151] Also, for example, the relay processing unit 120 determines information that affects the driving condition of the vehicle 1 based on the port number of the information from the corresponding in-vehicle ECU 200 and the port number of the information from the in-vehicle ECU 200 that is the communication target of the corresponding in-vehicle ECU 200, and relays all information between the in-vehicle ECU 200 and other in-vehicle ECUs that affects the driving condition of the vehicle 1.

[0152] In addition, the relay processing unit 120 may be configured to determine whether to relay some or all of the information when the authentication processing unit 140 is successful in the authentication processing using the extended authentication information, depending on both the type of the in-vehicle ECU 200 and the type of information received from the in-vehicle ECU 200.

[0153] [Operation flow] Each device in the communication system according to the embodiment of the present disclosure includes a computer including a memory, and a processor such as a CPU in the computer reads out from the memory and executes a program including some or all of the steps in the following flowcharts and sequences. Each of the programs for the devices can be installed from the outside. Each of the programs for the devices is distributed in a state in which it is stored in a recording medium.

[0154] FIG. 5 is a flowchart that defines an operation procedure when a relay device in a communication system according to an embodiment of the present disclosure relays information between in-vehicle ECUs based on a result of authentication processing.

[0155] Referring to FIG. 5, first, the relay device 100 waits for the addition of a new functional unit to the in-vehicle network 12 (NO in step S102), and when it detects the addition of the in-vehicle ECU 200D to the in-vehicle network 12 (YES in step S102), it obtains authentication information for the detected in-vehicle ECU 200D from the server 181 (step S104).

[0156] Next, when the relay device 100 acquires authentication information indicating a failure of authentication from the server 181 (NO in step S106), the relay device 100 transmits connection denial information to the in-vehicle ECU 200D (step S108).

[0157] Next, the relay device 100 waits for a new functional unit to be added to the in-vehicle network 12 (NO in step S102).

[0158] On the other hand, when the relay device 100 acquires authentication information indicating successful authentication from the server 181 (YES in step S106), the relay device 100 transmits outside-vehicle authentication successful information to the corresponding in-vehicle ECU 200D (step S110).

[0159] Next, the relay device 100 performs an in-vehicle authentication process for the in-vehicle ECU 200D using the authentication information acquired from the server 181 (step S112).

[0160] Next, if the in-vehicle authentication process of the in-vehicle ECU 200D fails (YES in step S114), the relay device 100 stops relaying information between the in-vehicle ECU 200D and the other in-vehicle ECUs 200 (step S116).

[0161] Next, the relay device 100 acquires new authentication information of the in-vehicle ECU 200D from the server 181 (step S104).

[0162] On the other hand, if the in-vehicle authentication process of the in-vehicle ECU 200D is successful (NO in step S114), the relay device 100 starts or continues relaying information between the in-vehicle ECU 200D and the other in-vehicle ECUs 200 (step S118).

[0163] Next, if the authentication information of the in-vehicle ECU 200D has not expired (NO in step S120), the relay device 100 performs the in-vehicle authentication process of the in-vehicle ECU 200D using the authentication information at the timing of the next in-vehicle authentication process (step S112).

[0164] On the other hand, when the validity period of the authentication information of the in-vehicle ECU 200D has expired (YES in step S120), the relay device 100 checks whether or not communication with the server 181 is possible (step S122).

[0165] Next, if the relay device 100 is able to communicate with the server 181 (YES in step S122) and the vehicle 1 is not traveling (YES in step S124), the relay device 100 acquires new authentication information for the in-vehicle ECU 200D from the server 181 (step S104).

[0166] On the other hand, if the relay device 100 is not in a state where communication with the server 181 is possible (NO in step S122), or if the relay device 100 is in a state where communication with the server 181 is possible (YES in step S122) and the vehicle 1 is traveling (NO in step S124), the relay device 100 performs an extension process (step S126).

[0167] Next, at the timing of the next in-vehicle authentication process, the relay device 100 performs the in-vehicle authentication process of the in-vehicle ECU 200D by using the extended authentication information, which is the authentication information whose validity is maintained by the extension process (step S112).

[0168] FIG. 6 is a diagram illustrating an example of a sequence of an outside-vehicle authentication process in the communication system according to the embodiment of the present disclosure.

[0169] 6, first, when the in-vehicle ECU 200D, which is a new functional unit newly added to the in-vehicle network 12, is connected to the relay device 100, the in-vehicle ECU 200D transmits authentication request information including its own MAC address to the relay device 100 (step S202).

[0170] Next, when the relay device 100 receives the authentication request information from the in-vehicle ECU 200D, the relay device 100 transmits authentication method information indicating the authentication method in the outside-vehicle authentication process to the in-vehicle ECU 200D (step S204).

[0171] Next, the in-vehicle ECU 200D and the server 181 exchange EAP messages including information necessary for the outside-vehicle authentication process via the relay device 100 (step S206).

[0172] Next, the server 181 performs an outside-vehicle authentication process for the in-vehicle ECU 200D using the EAP message received from the in-vehicle ECU 200 via the relay device 100 (step S208).

[0173] Next, when the server 181 succeeds in authenticating the in-vehicle ECU 200D through the outside-vehicle authentication process, the server 181 generates authentication information indicating the success of the authentication, and transmits the generated authentication information to the relay 100 (step S210).

[0174] Next, when the relay device 100 receives the authentication information from the server 181, the relay device 100 transmits outside-vehicle authentication success information to the in-vehicle ECU 200D (step S212).

[0175] FIG. 7 is a diagram illustrating an example of a sequence of the outside-vehicle authentication process and the inside-vehicle authentication process in the communication system according to the embodiment of the present disclosure.

[0176] 7, first, the relay device 100 relays information between the in-vehicle ECU 200C and the in-vehicle ECU 200D based on the result of the in-vehicle authentication process using the common key. That is, the in-vehicle ECU 200C and the in-vehicle ECU 200D communicate with each other via the relay device 100 based on the result of the in-vehicle authentication process by the relay device 100 (step S302).

[0177] Next, when the validity period of the authentication information of the in-vehicle ECU 200D expires, the relay device 100 transmits a communication confirmation request to the server 181 (step S304).

[0178] Next, if relay device 100 does not receive communication availability information from server 181 within a predetermined time after sending the communication confirmation request, relay device 100 determines that relay device 100 and server 181 are not able to communicate with each other, and performs an extension process to maintain the validity of authentication information including the common key (step S306).

[0179] Next, the relay device 100 continues to relay information between the in-vehicle ECU 200C and the in-vehicle ECU 200D based on the result of the in-vehicle authentication process using the common key. Then, the in-vehicle ECU 200C and the in-vehicle ECU 200D communicate with each other via the relay device 100 based on the result of the in-vehicle authentication process by the relay device 100 (step S308).

[0180] Next, the relay device 100 again transmits a communication confirmation request to the server 181 (step S310).

[0181] Next, upon receiving the communication confirmation request, the server 181 transmits communication availability information to the relay device 100 as a response to the communication confirmation request (step S312).

[0182] Next, the in-vehicle ECU 200D and the server 181 exchange EAP messages including information necessary for the outside-vehicle authentication process via the relay device 100. Then, the server 181 performs the outside-vehicle authentication process of the in-vehicle ECU 200D by using the EAP message received from the in-vehicle ECU 200 via the relay device 100 (step S314).

[0183] Next, when the server 181 succeeds in authenticating the in-vehicle ECU 200D through the outside-vehicle authentication process, the server 181 generates authentication information including a new common key and transmits the generated authentication information to the relay 100 (step S316).

[0184] Next, when the relay device 100 receives the authentication information including the new common key from the server 181, the relay device 100 transmits outside-vehicle authentication success information including the new common key to the in-vehicle ECU 200D (step S318).

[0185] Next, the relay device 100 starts relaying information between the in-vehicle ECU 200C and the in-vehicle ECU 200D based on the result of the in-vehicle authentication process using the new common key. Then, the in-vehicle ECU 200C and the in-vehicle ECU 200D communicate with each other via the relay device 100 based on the result of the in-vehicle authentication process by the relay device 100 (step S320).

[0186] 8 is a diagram showing an example of a sequence of an in-vehicle authentication process in the communication system according to the embodiment of the present disclosure, and shows details of the processes of steps S302, S308, and S320 in FIG.

[0187] Referring to FIG. 8, first, relay device 100 generates a random number (step S402).

[0188] Next, relay device 100 transmits the generated random number to in-vehicle ECU 200D that is the target of the in-vehicle authentication process (step S404).

[0189] Next, the relay device 100 encrypts the generated random number using a common key to generate encrypted data (step S406).

[0190] Furthermore, the in-vehicle ECU 200D encrypts the random number received from the relay device 100 by using the common key, thereby generating encrypted data (step S408).

[0191] Next, the in-vehicle ECU 200D transmits the generated encrypted data to the relay device 100 (step S410).

[0192] When the relay device 100 receives the encrypted data from the in-vehicle ECU 200D, the relay device 100 compares the received encrypted data with encrypted data generated by itself (step S412).

[0193] Next, if the encryption data received from the in-vehicle ECU 200D matches the encryption data generated by the relay device 100, the relay device 100 determines that the in-vehicle authentication process of the in-vehicle ECU 200D has been successful, and starts or continues relaying information between the in-vehicle ECU 200D and other in-vehicle ECUs 200 (step S414).

[0194] FIG. 9 is a diagram illustrating another example of the sequence of the outside-vehicle authentication process and the inside-vehicle authentication process in the communication system according to the embodiment of the present disclosure.

[0195] 9, first, the relay device 100 relays information between the in-vehicle ECU 200C and the in-vehicle ECU 200D based on the result of the in-vehicle authentication process using the authenticated MAC address. That is, the in-vehicle ECU 200C and the in-vehicle ECU 200D communicate with each other via the relay device 100 based on the result of the in-vehicle authentication process by the relay device 100 (step S502).

[0196] Next, when the validity period of the authentication information of the in-vehicle ECU 200D expires, the relay device 100 transmits a communication confirmation request to the server 181 (step S504).

[0197] Next, if relay device 100 does not receive communication availability information from server 181 within a specified time after sending the communication confirmation request, it determines that relay device 100 and server 181 are not able to communicate with each other, and performs an extension process to maintain the validity of the authentication information including the authenticated MAC address (step S506).

[0198] Next, the relay device 100 continues to relay information between the in-vehicle ECU 200C and the in-vehicle ECU 200D based on the result of the in-vehicle authentication process using the authenticated MAC address. Then, the in-vehicle ECU 200C and the in-vehicle ECU 200D communicate with each other via the relay device 100 based on the result of the in-vehicle authentication process by the relay device 100 (step S508).

[0199] Next, the relay device 100 again transmits a communication confirmation request to the server 181 (step S510).

[0200] Next, upon receiving the communication confirmation request, the server 181 transmits communication availability information to the relay device 100 as a response to the communication confirmation request (step S512).

[0201] Next, the in-vehicle ECU 200D and the server 181 exchange EAP messages including information necessary for the outside-vehicle authentication process via the relay device 100. Then, the server 181 performs the outside-vehicle authentication process of the in-vehicle ECU 200D by using the EAP message received from the in-vehicle ECU 200 via the relay device 100 (step S514).

[0202] Next, when the server 181 succeeds in authenticating the in-vehicle ECU 200D through the outside-vehicle authentication process, the server 181 transmits new authentication information including the authenticated MAC address to the relay device 100 (step S516).

[0203] Next, when the relay device 100 receives new authentication information from the server 181, the relay device 100 transmits, to the in-vehicle ECU 200D, outside-vehicle authentication success information including the authenticated MAC address corresponding to the received authentication information (step S518).

[0204] Next, the relay device 100 starts relaying information between the in-vehicle ECU 200C and the in-vehicle ECU 200D based on the result of the in-vehicle authentication process using the new authenticated MAC address. Then, the in-vehicle ECU 200C and the in-vehicle ECU 200D communicate with each other via the relay device 100 based on the result of the in-vehicle authentication process by the relay device 100 (step S520).

[0205] In the relay device 100 according to the embodiment of the present disclosure, the authentication processing unit 140 is configured to perform an extension process for maintaining the validity of the authentication information when the authentication information has expired and the relay device 100 cannot communicate with the server 181, and to perform an in-vehicle authentication process of the corresponding in-vehicle ECU 200 using the extended authentication information that is the authentication information that has maintained its validity, but this is not limited thereto. The authentication processing unit 140 may be configured to stop the in-vehicle authentication process until new authentication information is acquired without performing the extension process when the authentication information has expired and the relay device 100 cannot communicate with the server 181. Furthermore, the relay processing unit 120 may be configured to stop relaying information between the in-vehicle ECUs 200 until the authentication processing unit 140 acquires new authentication information and performs the in-vehicle authentication process using the acquired new authentication information.

[0206] In the relay device 100 according to the embodiment of the present disclosure, the relay processing unit 120 is configured to determine the content of information to be relayed when the authentication process by the authentication processing unit 140 using the extended authentication information is successful according to the type of the in-vehicle ECU 200, but is not limited to this. The relay processing unit 120 may be configured to relay all information including various contents between the in-vehicle ECU 200 and another in-vehicle ECU 200 when the authentication process by the authentication processing unit 140 using the extended authentication information is successful, regardless of the type of the in-vehicle ECU 200.

[0207] In the relay device 100 according to the embodiment of the present disclosure, the relay processing unit 120 is configured to determine whether to relay when the authentication processing unit 140 has successfully performed the authentication process using the extended authentication information, depending on the type of information received from the in-vehicle ECU 200, but the present invention is not limited to this. The relay processing unit 120 may be configured to relay all information received from the in-vehicle ECU 200 and addressed to another in-vehicle ECU 200, when the authentication processing unit 140 has successfully performed the authentication process using the extended authentication information, regardless of the type of information received from the in-vehicle ECU 200.

[0208] In the relay device 100 according to the embodiment of the present disclosure, the authentication processing unit 140 is configured to acquire authentication information in which the common key is updated every time the authentication information is acquired from the server 181, but this is not limited to the above. The server 181 may be configured to generate authentication information including the same corresponding common key every time the server 181 performs the outside-vehicle authentication process and succeeds in authentication, and transmit the generated authentication information to the relay device 100.

[0209] In the relay device 100 according to the embodiment of the present disclosure, the authentication processing unit 140 is configured to perform an extension process to maintain the validity of the authentication information without acquiring new authentication information from the server 181 when the relay device 100 is able to communicate with the server 181 and the authentication information has expired and the vehicle 1 is traveling, but this is not limited to the above. The authentication processing unit 140 may be configured to acquire new authentication information from the server 181 when the relay device 100 is able to communicate with the server 181 and the authentication information has expired, regardless of whether the vehicle 1 is traveling or not.

[0210] Meanwhile, there is a demand for technology that can improve security in in-vehicle networks.

[0211] Specifically, for example, when configuring a new in-vehicle network by installing a new in-vehicle ECU in an existing in-vehicle network, a technique is desired that can improve the security of the new in-vehicle network.

[0212] In contrast, the relay device 100 according to the embodiment of the present disclosure is mounted on a vehicle 1 including a plurality of on-board ECUs 200. The authentication processing unit 140 acquires authentication information of the on-board ECU 200 from a server 181 outside the vehicle 1, and performs authentication processing of the on-board ECU 200 using the acquired authentication information. The relay processing unit 120 relays information between the on-board ECU 200 and another on-board ECU 200 based on a result of the authentication processing by the authentication processing unit 140. When the authentication information has expired, the authentication processing unit 140 acquires new authentication information from the server 181.

[0213] In this manner, by acquiring the authentication information of the in-vehicle ECU 200 from the server 181 outside the vehicle 1, even when a new unknown in-vehicle ECU 200 is added to the in-vehicle network, it is possible to acquire the authentication information of the in-vehicle ECU. Furthermore, by acquiring new authentication information when the expiration date has expired, performing authentication processing of the in-vehicle ECU 200 using the acquired authentication information, and relaying information between the in-vehicle ECU 200 and another in-vehicle ECU 200 based on the result of the authentication processing, it is possible to ensure the security of the in-vehicle network, and also to continuously perform authentication processing of the in-vehicle ECU 200 using the authentication information even in a situation where it is difficult to acquire new authentication information from the server 181 due to the driving environment of the vehicle 1.

[0214] Therefore, the relay device 100 according to the embodiment of the present disclosure can improve security in an in-vehicle network.

[0215] In addition, in the relay device 100 according to the embodiment of the present disclosure, when the authentication information has expired and the relay device 100 cannot communicate with the server 181, the authentication processing unit 140 performs an extension process to maintain the validity of the authentication information, and performs authentication processing of the in-vehicle ECU 200 corresponding to the authentication information using the extended authentication information, which is the authentication information that has maintained its validity.

[0216] With this configuration, even if the communication environment between relay device 100 and server 181 is poor due to the driving environment of vehicle 1 and new authentication information cannot be obtained when the authentication information expires, authentication processing can be performed and information relay between in-vehicle ECUs 200 based on the authentication result can be continued. As a result, for example, in a configuration in which security is improved by updating the contents of authentication information outside vehicle 1, stable communication in the in-vehicle network can be managed regardless of the driving environment of vehicle 1.

[0217] In addition, in the relay device 100 according to an embodiment of the present disclosure, the relay processing unit 120 determines the content of the information to be relayed when the authentication processing by the authentication processing unit 140 using the extended authentication information is successful, depending on the type of the in-vehicle ECU 200.

[0218] With this configuration, it is possible to limit some of the information to be relayed when extension processing is performed depending on the type of in-vehicle ECU 200. For example, by continuing to relay information between in-vehicle ECUs 200 that affects the driving of vehicle 1 while stopping the relaying of information between in-vehicle ECUs 200 that does not affect the driving of vehicle 1, it is possible to suppress a deterioration in security in the in-vehicle network while maintaining good driving of vehicle 1.

[0219] In addition, in the relay device 100 according to an embodiment of the present disclosure, the relay processing unit 120 determines whether to perform relaying when the authentication processing by the authentication processing unit 140 using the extended authentication information is successful, depending on the type of information received from the in-vehicle ECU 200.

[0220] With this configuration, it is possible to limit some of the information to be relayed when extension processing is performed depending on the type of information received from the in-vehicle ECU 200. For example, by continuing to relay information that affects the driving of the vehicle 1 while stopping the relaying of information that does not affect the driving of the vehicle 1, it is possible to suppress a decrease in security in the in-vehicle network while maintaining good driving of the vehicle 1.

[0221] Furthermore, in the relay device 100 according to the embodiment of the present disclosure, the authentication processing unit 140 acquires from the server 181 authentication information whose contents are different each time the authentication information is acquired.

[0222] With this configuration, new authentication information can be obtained every time the validity period expires, and the authentication process for the in-vehicle ECU 200 can be performed using the new authentication information, thereby further improving the security of the in-vehicle network.

[0223] In addition, in the relay device 100 according to the embodiment of the present disclosure, when communication between the relay device 100 and the server 181 is possible and the authentication information has expired, and the vehicle 1 is traveling, the authentication processing unit 140 performs an extension process to maintain the validity of the authentication information without obtaining new authentication information from the server 181.

[0224] With this configuration, for example, an authentication error caused by performing authentication processing using new authentication information can be avoided, which would cause the relay of some or all of the information between the on-board ECUs 200 to stop while the vehicle 1 is traveling, thereby enabling the vehicle 1 to be maintained in a smooth traveling state.

[0225] Moreover, the vehicle communication method according to the embodiment of the present disclosure is a vehicle communication method in a relay device 100 mounted on a vehicle 1 having a plurality of vehicle ECUs 200. In this vehicle communication method, first, authentication information of the vehicle ECU 200 is acquired from an external device outside the vehicle 1. Next, an authentication process of the vehicle ECU 200 is performed using the acquired authentication information. Next, information of the vehicle ECU 200 and other vehicle ECUs 200 is relayed based on a result of the authentication process. Next, when the authentication information has expired, new authentication information is acquired from a server 181.

[0226] In this manner, by the method of acquiring the authentication information of the in-vehicle ECU 200 from the server 181 outside the vehicle 1, even when a new unknown in-vehicle ECU 200 is added to the in-vehicle network, it is possible to acquire the authentication information of the in-vehicle ECU. Furthermore, by the method of acquiring new authentication information when the expiration date has expired, performing authentication processing of the in-vehicle ECU 200 using the acquired authentication information, and relaying information between the in-vehicle ECU 200 and another in-vehicle ECU 200 based on the result of the authentication processing, it is possible to ensure the security of the in-vehicle network, and also to continuously perform authentication processing of the in-vehicle ECU 200 using the authentication information even in a situation where it is difficult to acquire new authentication information from the server 181 due to the driving environment of the vehicle 1.

[0227] Therefore, the vehicle communication method according to the embodiment of the present disclosure can improve security in an in-vehicle network.

[0228] The above-described embodiments should be considered as illustrative and not restrictive in all respects. The scope of the present invention is defined by the claims, not the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0229] The above description includes the following additional features. [Appendix 1] A relay device mounted on a vehicle having a plurality of functional units, an authentication processing unit that acquires authentication information of the functional unit from an external device outside the vehicle and performs authentication processing of the functional unit using the acquired authentication information; a relay processing unit that relays information between the functional unit and another functional unit based on a result of the authentication process by the authentication processing unit, the authentication processing unit acquires new authentication information from the external device when the authentication information has expired; The authentication processing unit acquires the authentication information including a different common key from the external device each time the authentication information is acquired, and performs authentication processing of the functional unit using the common key included in the acquired authentication information. [Explanation of symbols]

[0230] 1 vehicle 11 External Network 12 In-vehicle network 13 Ethernet cable 52 Communication Port 100 Repeater 110 Communications Department 120 Relay Processing Unit 130 Detection unit 140 Authentication processing unit 150 Storage section 160 Timer 161 Wireless base station equipment 181 Server 200 Automotive ECU 210 Communications Department 220 Processing section 230 Authentication Request Section 240 Storage section 301 In-vehicle communication system 401 Communication Systems

Claims

1. A relay device mounted on a vehicle having a plurality of functional units, an authentication processing unit that acquires authentication information of the functional unit from an external device outside the vehicle and performs authentication processing of the functional unit using the acquired authentication information; a relay processing unit that relays information between the functional unit and another functional unit based on a result of the authentication process by the authentication processing unit, the authentication processing unit acquires new authentication information from the external device when the authentication information has expired; The authentication processing unit of the relay device performs an extension process to maintain the validity of the authentication information without obtaining new authentication information from the external device when the vehicle is traveling and communication between the relay device and the external device is possible and the authentication information has expired.

2. The relay device according to claim 1 , wherein the authentication processing unit acquires the authentication information from the external device, the authentication information having different contents each time the authentication information is acquired.

3. A vehicle communication method in a relay device mounted on a vehicle having a plurality of functional units, comprising: acquiring authentication information of the functional unit from an external device outside the vehicle; performing an authentication process for the functional unit using the acquired authentication information; relaying information between the functional unit and another functional unit based on a result of the authentication process; When the authentication information has expired, acquiring new authentication information from the external device; A vehicle communication method comprising: when the vehicle is traveling while communication between the relay device and the external device is possible and the authentication information has expired, performing an extension process to maintain the validity of the authentication information without obtaining new authentication information from the external device.

4. A vehicle communication program for use in a relay device mounted on a vehicle having a plurality of functional units, Computer, an authentication processing unit that acquires authentication information of the functional unit from an external device outside the vehicle and performs authentication processing of the functional unit using the acquired authentication information; a relay processing unit that relays information between the functional unit and another functional unit based on a result of the authentication process by the authentication processing unit; It is a program to function as the authentication processing unit acquires new authentication information from the external device when the authentication information has expired; The authentication processing unit is a vehicle communication program that performs an extension process to maintain the validity of the authentication information without obtaining new authentication information from the external device when the vehicle is traveling while communication between the relay device and the external device is possible and the authentication information has expired.

Images