Security device, security method and program

Abstract

To provide a security device capable of appropriately supporting a user when receiving a cyber attack to a vehicle where the user is not on board.SOLUTION: A security device 100 includes: a boarding determination part 131 determining whether boarding of a user x on a vehicle 10 is possible or not when the vehicle 10 where the user x is not on board receives a cyber attack; and a notification processing part 133 notifying a determination result by the boarding determination part 131 to a terminal device 200 located outside the vehicle 10 and utilized by the user x.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates to a security device that deals with cyber attacks on vehicles. [Background technology]

[0002] Conventionally, security devices for keeping vehicles safe against cyber attacks have been proposed (see, for example, Patent Document 1, Patent Document 2, and Patent Document 3). Patent Document 1 discloses a cyber attack notification device as the above-mentioned security device. This cyber attack notification device detects a cyber attack on a vehicle and notifies a device inside or outside the vehicle of the cyber attack based on whether the driver is inside or outside the vehicle. Patent Document 2 discloses a vehicle system as the above-mentioned security device. This vehicle system changes a communication method to the outside of the vehicle, a defense method against the unauthorized attack, a log storage method, and the like, depending on the depth of the intrusion of the unauthorized attack into the vehicle. The security device disclosed in Patent Document 3 detects an attack on an equipment network, calculates the risk level of the equipment network, and determines an attack response to be implemented against the attack based on the risk level. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-219709 A [Patent Document 2] JP 2019-125344 A [Patent Document 3] International Publication No. 2021-019635 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the security devices of Patent Documents 1 to 3 have a problem in that they provide insufficient support to a user when a cyber-attack occurs on a vehicle in which the user is not aboard. For example, the cyber-attack notification device of Patent Document 1 notifies a device outside the vehicle of a cyber-attack. However, even if the user of the vehicle becomes aware of the cyber-attack notified to the device, the user cannot easily determine what to do.

[0005] Therefore, the present disclosure provides a security device or the like that can appropriately support a user when a cyber attack occurs on a vehicle in which the user is not present. [Means for solving the problem]

[0006] A security device according to one embodiment of the present disclosure includes a boarding determination unit that determines whether a user is able to board a vehicle in which the user is not riding when the vehicle is subjected to a cyber-attack, and a notification processing unit that notifies a terminal device outside the vehicle used by the user of the determination result made by the boarding determination unit.

[0007] These comprehensive or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM, or may be realized by any combination of the system, the method, the integrated circuit, the computer program, and the recording medium. The recording medium may be a non-transitory recording medium. Effect of the Invention

[0008] The security device of the present disclosure is capable of preventing a cyber attack on a vehicle in which a user is not present. In such a case, the user can be appropriately supported.

[0009] Further advantages and effects of one aspect of the present disclosure will become apparent from the specification and drawings. Such advantages and / or effects are provided by some of the embodiments and configurations described in the specification and drawings, but not all of the configurations are necessarily required. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing the overall configuration of a security system according to an embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a functional configuration of a vehicle according to the embodiment. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a functional configuration of a terminal device according to the embodiment. [Figure 4] FIG. 4 is a block diagram showing an example of a functional configuration of a security device according to the embodiment. [Diagram 5] FIG. 5 is a diagram showing an example of each piece of information stored in the second account unit of the security device in the embodiment. [Figure 6] FIG. 6 is a diagram showing an example of each piece of information stored in the database of the security device in the embodiment. [Figure 7] FIG. 7 is a diagram showing an example of each piece of information stored in the first account unit of the vehicle in the embodiment. [Figure 8] FIG. 8 is a sequence diagram showing an example of the processing operation of the security system in the embodiment. [Figure 9] FIG. 9 is a sequence diagram showing another example of the processing operation of the security system in the embodiment. [Figure 10] FIG. 10 is a sequence diagram showing another example of the processing operation of the security system in the embodiment. [Figure 11] FIG. 11 is a flowchart showing an example of a processing operation of a vehicle in the embodiment. [Figure 12]FIG. 12 is a flowchart showing an example of a processing operation of the security device in the embodiment. [Figure 13] FIG. 13 is a diagram showing an example of a situation notification image and a handling result image according to the embodiment. [Figure 14] FIG. 14 is a diagram showing other examples of the situation notification image and the handling result image in the embodiment. [Figure 15] FIG. 15 is a diagram showing other examples of the situation notification image and the handling result image in the embodiment. [Figure 16] FIG. 16 is a diagram showing other examples of the situation notification image and the handling result image in the embodiment. [Figure 17] FIG. 17 is a diagram showing other examples of the situation notification image and the handling result image in the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] A security device according to a first aspect of the present disclosure includes a boarding determination unit that, when a vehicle in which a user is not riding is subjected to a cyber attack, determines whether or not the user is allowed to ride the vehicle, and a notification processing unit that notifies a terminal device that is outside the vehicle and used by the user of the determination result by the boarding determination unit. Note that the terminal device may be a smartphone or the like.

[0012] In this way, if a vehicle is attacked by a cyberattack while the user is not in the vehicle, a determination is made as to whether the user can board the vehicle or not, and the result of the determination is transmitted to the terminal device. Therefore, if the user carries the terminal device, the user can easily know whether boarding the vehicle is possible or not. In addition, it is possible to prevent the user from boarding a dangerous vehicle that is under cyber attack. As a result, it is possible to appropriately support the user. Note that hereinafter, boarding possible will also be expressed as boarding allowed, and boarding not possible will also be expressed as boarding not allowed.

[0013] In addition, in a security device according to a second aspect which is dependent on the first aspect, the notification processing unit may notify the terminal device of travel support information regarding a means of travel other than the vehicle when the boarding determination unit determines that boarding is not permitted as the determination result.

[0014] In this way, since the travel support information is notified to the terminal device, the user can easily learn information about a means of transportation other than a vehicle from the terminal device. As a result, the user can travel using a means of transportation other than a vehicle without getting into a vehicle. Therefore, the user's travel can be supported.

[0015] In addition, in a security device according to a third aspect which is dependent on the second aspect, the notification processing unit may notify the terminal device of the travel support information regarding a means of travel selected from among a plurality of means of travel in response to an input operation by the user into the terminal device.

[0016] This allows the user to select a desired means of transportation by inputting information and easily obtain information about that means of transportation, thereby providing further support for the user's travel.

[0017] In addition, in a security device according to a fourth aspect which is dependent on any one of the first to third aspects, the security device may further include a response instruction unit which instructs the vehicle to respond to the cyber-attack received by the vehicle when the boarding determination unit determines that boarding is not permitted as the determination result.

[0018] This allows the vehicle to receive instructions on how to deal with a cyberattack, so even if the vehicle is unable to do so on its own, it can follow the instructions of the security device and take action. For example, a program that has been altered by a cyberattack can be repaired using a patch provided by the security device.

[0019] In the security device according to a fifth aspect dependent on the fourth aspect, the countermeasure instruction unit may instruct the vehicle to stop starting the vehicle in the instruction to deal with the cyber-attack. Note that stopping the start of the vehicle means making it impossible to start the vehicle, and may also be called starting prohibition.

[0020] As a result, the vehicle will not start, preventing the vehicle from being driven in an unintended manner by the user and improving safety.

[0021] In addition, in a security device according to a sixth aspect which is dependent on the fifth aspect, the response instruction unit may further instruct the vehicle to cancel a start-stop of the vehicle when the cyber-attack is dealt with in the vehicle.

[0022] As a result, once the cyber-attack has been dealt with, the vehicle's start-stop function will be released, allowing the vehicle to be driven in accordance with the user's intentions while ensuring safety.

[0023] In addition, in a security device according to a seventh aspect dependent on any one of the first to sixth aspects, the notification processing unit determines that boarding is not permitted as the determination result by the boarding determination unit. When it is determined that the boarding refusal is not allowed, the distance between the terminal device and the vehicle may be specified, and a notification mode for notifying the boarding refusal may be changed according to the distance. Note that the notification in the notification mode may be an initial temporary notification when the boarding refusal is determined, and when the notification is continuously performed, the notification mode may be changed according to the distance at each time the notification is performed.

[0024] This allows the notification mode to change depending on the distance between the terminal device and the vehicle, i.e., the distance between the user carrying the terminal device and the vehicle, making it possible to more clearly inform a user attempting to board the vehicle that they are unable to board the vehicle.

[0025] For example, in a security device according to an eighth aspect which is dependent on the seventh aspect, the notification aspect is represented by at least one of a sound output from the terminal device and a vibration of the terminal device, and the notification processing unit may change the notification aspect according to the distance such that the shorter the distance, the louder at least one of the sound and the vibration.

[0026] As a result, when a user approaches a vehicle to board the vehicle, a loud sound is output from the terminal device carried by the user, or the terminal device vibrates strongly, making it possible to more clearly inform the user who is about to board the vehicle that he or she cannot board the vehicle, and to strongly warn the user not to board the vehicle.

[0027] In addition, in a security device according to a ninth aspect which is dependent on any one of the first to eighth aspects, the notification processing unit, when the boarding determination unit determines that boarding is not permitted as the determination result, may identify the elapsed time since the boarding denial was determined, and change the notification mode for continuously notifying the boarding denial in accordance with the elapsed time.

[0028] This allows the notification mode to change depending on the elapsed time, making it possible for the user to easily notice that he or she is not allowed to board the vehicle.

[0029] For example, in a security device according to a tenth aspect which is dependent on the ninth aspect, the notification aspect is represented by at least one of a sound output from the terminal device and a vibration of the terminal device, and the notification processing unit may change the notification aspect in accordance with the elapsed time such that at least one of the sound and the vibration becomes louder the longer the elapsed time is.

[0030] In this way, even if the user does not realize that boarding is not permitted due to the initial sound or vibration notification, the sound or vibration will grow louder as time passes. As a result, even for users who have difficulty noticing notifications, it is possible to more clearly communicate that boarding the vehicle is not permitted, and to strongly warn the user not to board the vehicle.

[0031] In addition, in a security device according to an eleventh aspect which is dependent on the ninth aspect, the notification mode is represented by a period of at least one of a sound repeatedly output from the terminal device and a vibration of the terminal device which occurs repeatedly, and the notification processing unit may change the notification mode in accordance with the elapsed time such that the longer the elapsed time is, the shorter the period is.

[0032] Thus, even if the user does not realize that boarding is not permitted due to the notification by sound or vibration according to the initial cycle, the cycle of the sound or vibration becomes shorter according to the elapsed time. As a result, even for users who have difficulty noticing notifications, it is possible to more clearly inform them that they are not permitted to board the vehicle, and to strongly warn them not to board the vehicle.

[0033] In addition, in a security device according to a twelfth aspect dependent on any one of the seventh to eleventh aspects, the notification processing unit, in response to an answerback signal from the terminal device, The continuous notification of boarding denial in the notification mode may be stopped.

[0034] In this way, after the user realizes that boarding is not permitted, the user can stop the notification by having the terminal device transmit an answerback signal, which can eliminate unnecessary notifications and reduce the processing load on the security device and the terminal device.

[0035] (Embodiment) FIG. 1 is a diagram showing the overall configuration of a security system according to the present embodiment.

[0036] The security system 1 in this embodiment includes a vehicle 10, a security device 100, and a terminal device 200. The vehicle 10, the security device 100, and the terminal device 200 are connected to each other so as to be able to communicate with each other via a communication network Nt such as the Internet.

[0037] The vehicle 10 is a vehicle used by a user x and includes an electronic control system. The electronic control system has a driving control function, an automatic driving function, a telematics-related function, etc. Therefore, the electronic control system of the vehicle 10 may be subject to a cyber attack.

[0038] The terminal device 200 is a communication terminal used by the user x, and is configured as, for example, a smartphone, a tablet terminal, a personal computer, etc. Such a terminal device 200 is carried by the user x, and is located outside the vehicle 10 when the user x is not on board the vehicle 10.

[0039] When the vehicle 10 is subjected to a cyber-attack, the security device 100 instructs the vehicle 10 to deal with the cyber-attack. Furthermore, when the vehicle 10 is subjected to a cyber-attack while the user x is not on board the vehicle 10, the security device 100 in this embodiment notifies the terminal device 200 of the status of the vehicle 10, i.e., information on the cyber-attack, via the communication network Nt. The status of the vehicle 10 includes whether or not it is possible to board the vehicle 10. Note that when the terminal device 200 is carried by the user x, the notification to the terminal device 200 can also be said to be a notification to the user x.

[0040] FIG. 2 is a block diagram showing an example of a functional configuration of the vehicle 10. As shown in FIG.

[0041] The vehicle 10 includes ECUs (Electronic Control Units) 11 to 14, a first communication unit 15, a game device, and a The system includes a gateway 16, a first accounting unit 17, and a first location acquisition unit 18. These components configure a network such as a Controller Area Network (CAN). These components can also be said to constitute the electronic control system described above.

[0042] The ECUs 11 to 14 control the steering, vehicle speed, braking, etc. of the vehicle 10. The ECUs 11 to 14 may also control a car audio system, a car navigation system, a driving recorder, etc. These ECUs 11 to 14 realize driving control functions, automatic driving functions, and functions related to telematics. At least one of the ECUs 11 to 14 may determine whether or not a user x is riding in the vehicle 10 based on a sensing result by a sensor or the like attached to the vehicle 10. The sensor may be a camera or a weight sensor.

[0043] The first communication unit 15 communicates with the security device 100 and the terminal device 200 via the communication network Nt.

[0044] The gateway 16 transmits the security device 100 and the terminal device 200 to the communication network. When the first communication unit 15 receives a signal via the communication network Nt, the gateway 16 outputs the signal to at least one of the ECUs 11 to 14. On the other hand, when at least one of the ECUs 11 to 14 outputs a signal, the gateway 16 transmits the signal from the first communication unit 15 to at least one of the security device 100 and the terminal device 200 via the communication network Nt. The gateway 16 also monitors signals transmitted and received between the ECUs 11 to 14 and the first communication unit 15 to detect a cyber-attack. Then, the gateway 16 notifies the security device 100 of a request to deal with the cyber-attack via the first communication unit 15 according to the content of the cyber-attack. Note that the notification of the request to deal with the cyber-attack conveys the content of the cyber-attack and the boarding status of the vehicle 10 to the security device 100. The boarding status indicates whether or not the user x is on board the vehicle 10, and is identified by a determination by at least one of the ECUs 11 to 14. Furthermore, the gateway 16 takes action against the detected cyber-attack.

[0045] The first accounting unit 17 is a recording medium that holds information about the user x, the vehicle 10, and the security device 100. For example, the first accounting unit 17 is a hard disk drive, a RAM (Random Access Memory), a ROM (Read Only Memory), or a semiconductor memory. Note that such a first accounting unit 17 may be volatile or non-volatile.

[0046] The first position acquisition unit 18 acquires vehicle position information indicating the position of the vehicle 10 using a global navigation satellite system (GNSS) such as a global positioning system (GPS). Such vehicle position information is transmitted from the first position acquisition unit 18 to the security device 100 via the gateway 16 and the first communication unit 15 as needed.

[0047] FIG. 3 is a block diagram showing an example of a functional configuration of the terminal device 200. As shown in FIG.

[0048] The terminal device 200 includes a control unit 201 , a third communication unit 215 , a memory 222 , a second position acquisition unit 218 , a display unit 241 , a speaker 242 , a vibrator 243 , and an input unit 244 .

[0049] The control unit 201 is, for example, a central processing unit (CPU), a processor, etc. The terminal device 200 controls each of the components provided in the terminal device 200 by executing a program stored in the memory 222.

[0050] The third communication unit 215 communicates with the vehicle 10 and the security device 100 via the communication network Nt in response to control by the control unit 201.

[0051] The memory 222 is a recording medium that stores the above-mentioned programs, information, data, etc. For example, the memory 222 is a RAM, a ROM, a semiconductor memory, etc. Note that such memory 222 may be volatile or non-volatile.

[0052] The second position acquisition unit 218 uses a GNSS such as GPS to acquire terminal position information indicating the position of the terminal device 200. Such terminal position information is transmitted from the second position acquisition unit 218 to the security device 100 via the third communication unit 215 as needed.

[0053] The display unit 241 is a display that displays images or characters under the control of the control unit 201. Specifically, the display unit 241 is a liquid crystal display, an organic EL (Electro-Luminescence) display, or the like, but is not limited to these.

[0054] The speaker 242 outputs sound or voice according to the control of the control unit 201 .

[0055] The vibrator 243 vibrates in response to control by the control unit 201. This vibration is transmitted to the entire terminal device 200. Therefore, the vibrator 243 vibrates the terminal device 200.

[0056] The input unit 244 accepts an input operation by the user x and outputs a signal corresponding to the input operation to the control unit 201. Such an input unit 244 may be configured integrally with the display unit 241. In this case, the input unit 244 and the display unit 241 are configured as a touch panel. Specifically, the input unit 244 is disposed on the display unit 241 and configured as a touch sensor that accepts an operation corresponding to an image such as an icon displayed on the display unit 241 when the user x touches the image. The input unit 244 may also include a physical button, and accept an input operation corresponding to the button when the user x presses the button.

[0057] FIG. 4 is a block diagram showing an example of the functional configuration of the security device 100. As shown in FIG.

[0058] The security device 100 includes a second communication unit 115, a boarding determination unit 131, a notification method determination unit 132, a notification processing unit 133, a database 134, an analysis unit 135, a handling instruction unit 136, and a second accounting unit 117.

[0059] The second communication unit 115 communicates with the vehicle 10 and the terminal device 200 via the communication network Nt. For example, the second communication unit 115 receives a request notified from the vehicle 10 to take action against a cyber attack.

[0060] When the vehicle 10 in which the user x is not boarding is subjected to a cyber-attack, the boarding determination unit 131 determines whether or not the user x can board the vehicle 10. Specifically, when the second communication unit 115 receives the above-mentioned notification of the request for action, the boarding determination unit 131 determines whether or not boarding is possible in response to the notification of the request for action. The request for action indicates the content of the cyber-attack and the boarding status of the vehicle 10.

[0061] The notification method determination unit 132 determines a notification method for notifying the user x of the denial of boarding when the boarding determination unit 131 determines that boarding is not permitted (i.e., boarding is denied).

[0062] The notification processing unit 133 notifies the result of the determination made by the boarding determination unit 131 via the second communication unit 115 to the terminal device 200 that is located outside the vehicle 10 and is used by the user x.

[0063] In response to a response request from the vehicle 10 described above, the analysis unit 135 analyzes the cyber-attack on the vehicle 10 and notifies the response instruction unit 136 of the analysis results.

[0064] When the countermeasure instruction unit 136 receives a notification of the analysis result from the analysis unit 135, the countermeasure instruction unit 136 instructs the vehicle 10 via the second communication unit 115 to deal with the cyber-attack according to the analysis result. For example, in the present embodiment, the countermeasure instruction unit 136 instructs the vehicle 10 to deal with the cyber-attack received by the vehicle 10 when the boarding determination unit 131 determines as the determination result that boarding is not permitted. The countermeasure instruction unit 136 may also instruct the vehicle 10 to deal with the cyber-attack received by the vehicle 10 when the determination result is that boarding is permitted.

[0065] The second account unit 117 is a recording medium that stores information relating to the user x, the vehicle 10, and various security-related organizations.

[0066] The database 134 stores data used in the decision by the notification method decision unit 132, The second accounting unit 117 and the database 134 are a recording medium for storing data used in the processing of the second accounting unit 117 and the database 134. The second accounting unit 117 and the database 134 are a hard disk drive, a RAM, a ROM, a semiconductor memory, or the like. Note that the second accounting unit 117 and the database 134 may be either volatile or non-volatile.

[0067] FIG. 5 is a diagram showing an example of each piece of information stored in the second account section 117 of the security device 100. As shown in FIG.

[0068] The second account section 117 stores user information a1, vehicle information a2, and contact information a3.

[0069] The user information a1 indicates, for each user, the user's user ID (identification), name, address, telephone number, email address, vehicle ID, location, and relationship. The user ID is information for identifying the user. The email address is an email address that can be used by the user's terminal device. The vehicle ID is information for identifying the vehicle used by the user. The location is the location of the user's terminal device, and is the location coordinates of the terminal device obtained by GNSS or the like. In addition, when the terminal device is carried by the user, the location can also be said to be the user's location. The relationship indicates, for example, whether the user is a contractor of the security service by the security system 1 or a family member of the contractor. The user information a1 also indicates the user ID, name, address, etc. of user x. For example, the user ID of user x is "AAA" and is associated with the relationship "contractor". In addition, the location of user x indicated by the user information a1 is the location indicated by the terminal location information obtained by the second location acquisition unit 218 of the terminal device 200.

[0070] Such user information a1 is generated, for example, by the vehicle 10 and transmitted to the security device 100. Furthermore, the location of each user indicated by the user information a1 is updated as needed by terminal location information transmitted from the terminal device of that user.

[0071] In addition, the user information a1 indicates the email address of each user, but other addresses may be indicated instead of or in addition to the email address. The other addresses may be, for example, the IP (Internet Protocol ) address, MAC (Media Access Control) address, etc.

[0072] The vehicle information a2 indicates the vehicle ID, vehicle name, vehicle number, parking position, and IP address of the vehicle 10. The vehicle ID is information for identifying the vehicle 10. The parking position is a position indicated by the vehicle position information obtained by the first position acquisition unit 18 of the vehicle 10.

[0073] Like the user information a1, the vehicle information a2 is generated by, for example, the vehicle 10 and transmitted to the security device 100. In addition, the parking position indicated by the vehicle information a2 is updated at any time by vehicle position information transmitted from the vehicle 10.

[0074] The contact information a3 indicates, for each security-related organization, the organization's ID, company name, address, location, telephone number, email address, and URL (Uniform Resource Locator). These organizations may include the police, etc. The location of the organization is, for example, the latitude and longitude of the location corresponding to the organization's address.

[0075] FIG. 6 is a diagram showing an example of each piece of information stored in the database 134 of the security device 100. As shown in FIG.

[0076] The database 134 stores notification method information b1 and movement support list information b2. There are.

[0077] The notification method information b1 indicates a plurality of notification methods of a cyber attack. The notification method determination unit 132 selects at least one notification method from the plurality of notification methods. The selected at least one notification method is used by the notification processing unit 133 to notify the terminal device 200. Specifically, these notification methods are methods for notifying the status of the vehicle 10 including the judgment result by the boarding judgment unit 131. The judgment result is a judgment result of whether or not the user x is able to board the vehicle 10. Such notification method information b1 indicates, for each notification method, the notification ID of the notification method and the content of the notification method.

[0078] The content of the notification method associated with the notification ID "ID-000" is normal notification. In normal notification, when the vehicle 10 is subjected to a cyber-attack, a status notification image showing the status of the vehicle 10 is displayed on the display unit 241 of the terminal device 200. Furthermore, a warning sound is output from the speaker of the terminal device 200, and the terminal device 200 vibrates by the vibrator 243 of the terminal device 200.

[0079] Specifically, when the second communication unit 115 receives a notification of a request for action from the vehicle 10, the notification method determination unit 132 of the security device 100 first selects the notification method of the notification ID "ID-000" regardless of the judgment result of the boarding judgment unit 131. Then, the notification processing unit 133 performs normal notification. That is, the notification processing unit 133 identifies the email address of the user x associated with the relationship "contractor" from the user information a1 of the second account unit 117. Note that the notification of the request for action is a notification requesting action against a cyber attack. Then, the notification processing unit 133 transmits an email showing the above-mentioned situation notification image to the email address via the second communication unit 115. At this time, the notification processing unit 133 further transmits a notification signal to the terminal device 200 via the second communication unit 115. The notification signal indicates, for example, a volume and a vibration parameter (for example, a vibration frequency or an amplitude). When the third communication unit 215 receives the notification signal, the control unit 201 of the terminal device 200 causes the speaker 242 to output a warning sound at a volume indicated by the notification signal, and further causes the vibrator 243 to vibrate according to the vibration parameters indicated by the notification signal.

[0080] The notification method associated with each of the notification IDs "ID-001" to "ID-004" is a notification (i.e., additional notification) that is additional to the normal notification. The additional notification is continuously performed until the user x confirms the notification of the status of the vehicle 10.

[0081] The notification processing unit 133 of the security device 100 knows that the user x has confirmed the notification of the status of the vehicle 10 by the answerback from the user x. That is, when the input unit 244 of the terminal device 200 accepts the answerback from the user x as an input operation, it outputs a signal indicating the answerback (hereinafter also referred to as an answerback signal) to the control unit 201. Then, the control unit 201 transmits the answerback signal from the third communication unit 215 to the security device 100 via the communication network Nt. When the second communication unit 115 of the security device 100 receives the answerback signal, it outputs the answerback signal to the notification processing unit 133. As a result, the notification processing unit 133 knows that there has been an answerback, that is, that the user x has confirmed the notification of the status of the vehicle 10, by acquiring the answerback signal.

[0082] In the notification method of notification ID "ID-001", when user x approaches the vehicle 10 by a predetermined distance or more, the status of the vehicle 10 is notified by louder volume and vibration than normal notification. The predetermined distance may be 10 m or 50 m, and is not limited to these distances. In addition, after user x approaches the vehicle 10 by a predetermined distance or more, when user x approaches the vehicle 10 by a predetermined distance or more again, the status of the vehicle 10 is notified by louder volume and vibration than the previous notification. The status of the vehicle 10 is notified.

[0083] Specifically, when the boarding determination unit 131 determines that boarding is not permitted as the determination result, the notification method determination unit 132 of the security device 100 selects not only the notification method of the notification ID "ID-000" but also the notification method of the notification ID "ID-001". Then, the notification processing unit 133 performs a normal notification, and then performs an additional notification of the selected notification method. In the additional notification, the notification processing unit 133 first specifies the distance between the position of the terminal device 200 indicated in the user information a1 (i.e., the position of the user x) and the parking position indicated in the vehicle information a2 as the user-to-vehicle distance. Then, the notification processing unit 133 transmits the above-mentioned notification signal to the terminal device 200 via the second communication unit 115 each time the user-to-vehicle distance becomes shorter by the above-mentioned predetermined distance. For each notification signal transmitted, the notification processing unit 133 increases the volume and vibration parameters indicated by the notification signal. When the third communication unit 215 receives the notification signal, the control unit 201 of the terminal device 200 causes the speaker 242 to output a warning sound at a volume indicated by the notification signal, and further causes the vibrator 243 to vibrate according to the vibration parameters indicated by the notification signal.

[0084] In this way, when the boarding determination unit 131 determines that boarding is not permitted as the determination result, the notification processing unit 133 in this embodiment specifies the distance between the terminal device 200 and the vehicle 10, and changes the notification mode for notifying the boarding denial according to the distance. The distance is the above-mentioned user-vehicle distance. Specifically, the notification mode is expressed by at least one of a sound output from the terminal device 200 and a vibration of the terminal device 200. Then, the notification processing unit 133 changes the notification mode according to the distance so that at least one of the sound and the vibration becomes louder as the distance becomes shorter.

[0085] As a result, the notification mode changes depending on the distance between the terminal device 200 and the vehicle 10, i.e., the distance between the user x carrying the terminal device 200 and the vehicle 10, so that it is possible to more clearly inform the user x who is about to board the vehicle 10 that he / she cannot board the vehicle 10. In other words, when the user x approaches the vehicle 10 to board the vehicle 10, a loud sound is output from the terminal device 200 carried by the user x, or the terminal device 200 vibrates strongly. As a result, it is possible to more clearly inform the user x who is about to board the vehicle 10 that he / she cannot board the vehicle 10, and it is possible to strongly call the user's attention not to board the vehicle 10.

[0086] In the above example, the notification method of the notification ID "ID-000" and the notification ID "ID-001" is selected and the notification is performed continuously, but only the notification ID "ID-000" may be selected and the notification may be performed temporarily. Even in this case, the notification processing unit 133 may change the notification mode according to the user-vehicle distance so that at least one of the warning sound and the vibration becomes louder as the user-vehicle distance at the time of the notification of the request for action is shorter. In other words, the notification by the notification mode according to the user-vehicle distance may be the first temporary notification when the request for action is notified and boarding is determined to be impossible. For example, if the vehicle 10 is subjected to a cyber attack and the user-vehicle distance at the time of the notification of the request for action is 1 km, the status of the vehicle 10 is notified to the terminal device 200 and the user x by a small warning sound and vibration. On the other hand, if the vehicle 10 is subjected to a cyber attack different from the above and the user-vehicle distance at the time of the notification of the request for action is 10 m, the status of the vehicle 10 is notified to the terminal device 200 and the user x by a large warning sound and vibration.

[0087] In the additional notification with the notification ID "ID-002," other users who are family members of the user x are also notified of the status of the vehicle 10. The other users are users with the relationship "family" indicated in the user information a1.

[0088] Specifically, when the boarding determination unit 131 determines that boarding is not permitted as the determination result, the notification method determination unit 132 of the security device 100 selects not only the notification method of the notification ID "ID-000" but also the notification method of the notification ID "ID-001". Then, the notification processing unit 133 performs a normal notification, and then performs an additional notification using the selected notification method. In the additional notification, the notification processing unit 133 first identifies an email address associated with the relationship "family" in the user information a1. Then, the notification processing unit 133 sends an email showing the above-mentioned status notification image to that email address via the second communication unit 115.

[0089] This notifies the family members' terminal devices that they are not allowed to board the vehicle 10, thereby preventing the family members from boarding the vehicle 10.

[0090] In the additional notification with the notification ID "ID-003," notification of the status of the vehicle 10 is periodically and repeatedly provided. The longer the time that has elapsed since boarding was determined to be unacceptable, the louder the volume of the warning sound and vibration used for notification will be.

[0091] Specifically, when the boarding determination unit 131 determines that boarding is not permitted as the determination result, the notification method determination unit 132 of the security device 100 selects not only the notification method of the notification ID "ID-000" but also the notification method of the notification ID "ID-003". Then, the notification processing unit 133 performs a normal notification, and then performs an additional notification of the selected notification method. In the additional notification, the notification processing unit 133 first transmits the above-mentioned notification signal to the terminal device 200 via the second communication unit 115 at a predetermined cycle. Then, for each notification signal transmitted, the notification processing unit 133 increases the volume and vibration parameters indicated by the notification signal. When the third communication unit 215 receives the notification signal, the control unit 201 of the terminal device 200 causes the speaker 242 to output a warning sound of the volume indicated by the notification signal, and further causes the vibrator 243 to vibrate according to the vibration parameters indicated by the notification signal.

[0092] In this way, when the boarding determination unit 131 determines that boarding is not allowed as the determination result, the notification processing unit 133 in this embodiment specifies the elapsed time from when boarding was determined to be not allowed, and changes the notification mode for continuously notifying the boarding denial according to the elapsed time. Note that, when a notification signal is transmitted at a predetermined cycle as described above, the elapsed time is specified by the notification processing unit 133, and continuous notification is performed. Specifically, the notification mode is expressed by at least one of a sound output from the terminal device 200 and a vibration of the terminal device 200. Then, the notification processing unit 133 changes the notification mode according to the elapsed time so that at least one of the sound and the vibration becomes louder as the elapsed time becomes longer.

[0093] This allows the notification mode to change according to the elapsed time, so that the user x can easily notice that he / she cannot board the vehicle 10. In other words, even if the user x does not notice that he / she cannot board the vehicle 10 due to the initial notification by sound or vibration, the sound or vibration becomes louder according to the elapsed time. As a result, even for the user x who has difficulty noticing the notification, it is possible to more clearly inform him / her that he / she cannot board the vehicle 10, and to strongly warn him / her not to board the vehicle 10.

[0094] The additional notification with the notification ID "ID-004" periodically and repeatedly notifies the status of the vehicle 10. The longer the time that has elapsed since boarding was determined to be impossible, the shorter the cycle at which the notification is repeated.

[0095] Specifically, when the boarding determination unit 131 determines that boarding is not permitted as a result of the determination, the notification method determination unit 132 of the security device 100 determines whether the notification method of the notification ID "ID-000" is to be used. In addition to the notification method, the notification processing unit 133 also selects the notification method of the notification ID "ID-004". Then, after performing the normal notification, the notification processing unit 133 further performs an additional notification using the selected notification method. In the additional notification, the notification processing unit 133 first transmits the above-mentioned notification signal to the terminal device 200 via the second communication unit 115 at a predetermined cycle. Then, the longer the elapsed time, the shorter the cycle becomes.

[0096] Thus, in this embodiment, the notification mode is expressed by the period of at least one of the sound repeatedly output from the terminal device 200 and the vibration repeatedly generated in the terminal device 200. The notification processing unit 133 changes the notification mode according to the elapsed time so that the longer the elapsed time is, the shorter the period becomes.

[0097] Thus, even if the user x does not realize that boarding is not permitted due to the notification by sound or vibration according to the initial cycle, the cycle of the sound or vibration becomes shorter according to the elapsed time. As a result, even for the user x who has difficulty in noticing the notification, it is possible to more clearly inform the user that boarding the vehicle 10 is not permitted, and to strongly warn the user not to board the vehicle 10.

[0098] The notification method determination unit 132 in this embodiment may select one notification method from a plurality of notification methods for additional notification indicated by the notification method information b1, depending on, for example, the type of cyber attack, the degree of danger, the extent of damage, the location of the attack, etc. Also, the notification method determination unit 132 may select the notification method set by the user x.

[0099] In addition, the notification processing unit 133 in this embodiment stops the notification of boarding denial in the above-mentioned notification mode that is being continued in response to the answerback signal from the terminal device 200. The notification of boarding denial is the notification of the status of the vehicle 10 described above.

[0100] In this way, after the user x realizes that he or she will not be able to board the flight, the user x can stop the notification by having the terminal device 200 transmit an answerback signal. As a result, it is possible to eliminate unnecessary notifications, and reduce the processing load on the security device 100 and the terminal device 200.

[0101] The travel support list information b2 is information for presenting to the user x means of travel other than the vehicle 10 when the boarding judging unit 131 of the security device 100 judges that boarding is not permitted. The means of travel include a taxi, a replacement car, and public transportation.

[0102] The transportation support list information b2 indicates, for each means of transportation, the support ID of that means of transportation, the name of the company related to that means of transportation, the address, location, telephone number, email address, and URL. For example, information associated with support ID "SP-001" is information about a taxi company. Information associated with support ID "SP-002" is information about a company that arranges replacement cars. Information associated with support ID "SP-003" is information about public transportation.

[0103] In response to an input operation by user x on the input unit 244 of the terminal device 200, the notification processing unit 133 of the security device 100 transmits information on the means of transportation indicated in the travel support list information b2 as travel support information to the terminal device 200 via the second communication unit 115.

[0104] In this manner, when the boarding determination unit 131 determines that boarding is not permitted as a determination result, the notification processing unit 133 in this embodiment notifies the terminal device 200 of travel support information related to a means of travel other than the vehicle 10. Specifically, the notification processing unit 133 notifies the terminal device 200 of travel support information related to a means of travel selected in response to an input operation by the user x to the terminal device 200 from among a plurality of means of travel.

[0105] As a result, since the travel support information is notified to the terminal device 200, the user x can easily learn information about a means of travel other than the vehicle 10 from the terminal device 200. As a result, the user x can travel using a means of travel other than the vehicle 10 without getting on the vehicle 10. Therefore, the travel of the user x can be supported. In addition, the user x can select a desired means of travel by an input operation and easily learn information about the means of travel. Therefore, the travel of the user x can be further supported.

[0106] FIG. 7 is a diagram showing an example of each piece of information stored in the first accounting unit 17 of the vehicle 10. As shown in FIG.

[0107] The first account section 17 stores user information c1, vehicle information c2, and security device information c3.

[0108] The user information c1 and the vehicle information c2 are, for example, the same as the user information a1 and the vehicle information a2 stored in the second account section 117 of the security device 100. Such user information c1 and vehicle information c2 are transmitted from the vehicle 10 to the security device 100 and stored in the second account section 117 of the security device 100.

[0109] The security device information c3 is information related to the security device 100. Specifically, the security device information c3 indicates the device ID, device name, and IP address of the security device 100. Such security device information c3 is used when the first communication unit 15 of the vehicle 10 transmits information, data, or a signal to the security device 100.

[0110] Fig. 8 is a sequence diagram showing an example of a processing operation of the security system 1. The processing operation shown in Fig. 8 is an operation performed when the vehicle 10 is subjected to a cyber-attack while the user x is not on board the vehicle 10. In this processing operation, the vehicle 10 responds to the cyber-attack based on an instruction from the security device 100, and the terminal device 200 is notified that boarding is permitted.

[0111] Specifically, first, the vehicle 10 is subjected to a cyber-attack (step S1). The gateway 16 of the vehicle 10 detects the cyber-attack and confirms the details of the cyber-attack. Then, when the gateway 16 determines based on the details of the cyber-attack that the vehicle 10 alone cannot handle the cyber-attack, it decides to notify the security device 100 of a request for action (step S2). Then, the gateway 16 notifies the security device 100 of the request for action via the first communication unit 15 (step S3).

[0112] When the second communication unit 115 receives the notification of the action request in step S3, the analysis unit 135 of the security device 100 checks and analyzes the content of the cyber attack indicated in the action request. The action instruction unit 136 determines a method of dealing with the cyber attack based on the analysis result of the content of the cyber attack by the analysis unit 135. Furthermore, the boarding determination unit 131 determines whether or not the user x can board the vehicle 10 based on the analysis result by the analysis unit 135 and the action method determined by the action instruction unit 136 (step S4). That is, the boarding determination unit 131 determines whether or not the user x can board (in other words, whether or not the user x can board). Here, the boarding determination unit 131 determines that the user x can board.

[0113] The notification processing unit 133 of the security device 100 notifies the terminal device 200 of the status of the vehicle 10 via the second communication unit 115 (step S5). This notification of the status of the vehicle 10 may be made by only the normal notification described above, or may be made by the normal notification and additional notification. In addition, the status of the vehicle 10 includes that a cyber-attack has been carried out on the vehicle 10, but the vehicle 10 is available for boarding, i.e., boarding permitted. When the third communication unit 215 receives the notification in step S5, the control unit 201 of the terminal device 200 displays a status notification image indicating the notified status of the vehicle 10 on the display unit 241 (step S6). At this time, the control unit 201 further controls the speaker 242 and the vibrator 243 to output a warning sound and vibrate the terminal device 200.

[0114] The countermeasure instruction unit 136 of the security device 100 instructs the vehicle 10 to take the countermeasure according to the determined countermeasure method (step S7). The countermeasure method is, for example, repairing a program used in any of the ECUs 11 to 14, and in one specific example, applying a patch to the program. The patch is also called a correction program or an update program. That is, the countermeasure instruction unit 136 transmits the patch and a command signal for repairing the program based on the patch to the vehicle 10 via the second communication unit 115. When the first communication unit 15 receives the patch and the command signal, the gateway 16 of the vehicle 10 uses the patch to repair the program. That is, the vehicle 10 takes the countermeasure according to the countermeasure method determined by the countermeasure instruction unit 136 (step S8). When the countermeasure is completed, the gateway 16 notifies the security device 100 of the countermeasure result via the first communication unit 15 (step S9).

[0115] When the second communication unit 115 receives the notification in step S9, the notification processing unit 133 of the security device 100 checks the result of the countermeasure and stores information indicating the result of the countermeasure in, for example, the database 134 (step S10). Furthermore, the notification processing unit 133 notifies the terminal device 200 of the result of the countermeasure via the second communication unit 115 (step S11). That is, the notification processing unit 133 sends an email indicating the result of the countermeasure to the email address of user x. When the third communication unit 215 receives the notification in step S11, the control unit 201 of the terminal device 200 displays an image indicating the result of the countermeasure as a countermeasure result image on the display unit 241 (step S12).

[0116] Fig. 9 is a sequence diagram showing another example of the processing operation of the security system 1. The processing operation shown in Fig. 9 is an operation performed when the vehicle 10 is subjected to a cyber-attack while the user x is not aboard the vehicle 10, similar to the example in Fig. 8. In this processing operation, the vehicle 10 responds to the cyber-attack based on an instruction from the security device 100, and the terminal device 200 is notified of the boarding or non-boarding, unlike the example in Fig. 8.

[0117] Specifically, similarly to the example shown in FIG. 8, the vehicle 10 performs the processing operations of steps S1 to S3. When the second communication unit 115 receives the notification of the action request in step S3, the analysis unit 135 of the security device 100 checks and analyzes the content of the cyber attack indicated in the action request. The action instruction unit 136 determines a method of dealing with the cyber attack based on the analysis result of the content of the cyber attack by the analysis unit 135. Here, the action method includes not only program repair but also starting and stopping the vehicle 10. In addition, the boarding determination unit 131 determines whether or not the user x can board the vehicle 10 based on the analysis result of the content of the cyber attack by the analysis unit 135 and the action method determined by the action instruction unit 136 (step S4). Here, unlike the example of FIG. 8, the boarding determination unit 131 determines that boarding is not allowed.

[0118] For example, when the damage caused by the cyber-attack is large and the time required for dealing with the damage is long, the boarding determination unit 131 determines that boarding is not permitted. The extent of the damage may be the number of ECUs affected by the cyber-attack, or may be specified by the type of ECU or device affected by the cyber-attack. The time required for dealing with the damage may be specified by the method of dealing with the damage. For example, the larger the amount of data of the patch to be applied, the longer the time that may be specified. If the extent of the damage is equal to or greater than a threshold value and the time required for dealing with the damage is equal to or greater than a threshold value, the boarding determination unit 131 may determine that boarding is not permitted on the vehicle 10, i.e., that boarding is not permitted.

[0119] The countermeasure instruction unit 136 of the security device 100 instructs the vehicle 10 to take the countermeasure according to the determined countermeasure method (step S7). That is, the countermeasure instruction unit 136 transmits a command signal for starting and stopping the vehicle 10, a patch, and a command signal for repairing the program based on the patch to the vehicle 10 via the second communication unit 115. When the first communication unit 15 receives the patch and the command signal, the gateway 16 of the vehicle 10 first instructs the ECU that controls the engine or motor among the ECUs 11 to 14 to stop starting the vehicle 10 (step S21). That is, the gateway 16 prohibits the ECU from driving the engine or motor so that the vehicle 10 does not start or run. Furthermore, the gateway 16 notifies the security device 100 of the processing result performed according to the command signal for starting and stopping via the first communication unit 15 (step S22). Next, the gateway 16 repairs the program using the patch transmitted from the security device 100. That is, the vehicle 10 takes action according to the action method determined by the action instruction unit 136 (step S8). When the action is completed, the gateway 16 notifies the security device 100 of the action result via the first communication unit 15 (step S9).

[0120] After the process of step S4, the notification processing unit 133 of the security device 100 notifies the terminal device 200 of the status of the vehicle 10 via the second communication unit 115 (step S23). The notification performed in step S23 may be only the normal notification described above, or may be the normal notification and additional notification. The status of the vehicle 10 includes a cyber attack on the vehicle 10 and the inability to board the vehicle 10, that is, boarding refusal. That is, the notification processing unit 133 transmits a status notification image indicating that the vehicle 10 has been subjected to a cyber attack and boarding the vehicle 10 is not possible to the terminal device 200 by email or the like. Here, since boarding the vehicle 10 is not possible, the status notification image also includes a support reception image for receiving support for other means of transportation. Specifically, the support reception image is an image showing a plurality of means of transportation such as a taxi, a replacement car, and public transportation, and for receiving support for any of the plurality of means of transportation.

[0121] When the third communication unit 215 receives the notification of step S23, the control unit 201 of the terminal device 200 displays a status notification image showing the notified status of the vehicle 10 on the display unit 241 (step S24). That is, an image showing the status of the vehicle 10 and a support reception image are displayed. At this time, the control unit 201 further controls the speaker 242 and the vibrator 243 to output a warning sound and vibrate the terminal device 200. Since the notified status of the vehicle 10 includes boarding or not, the volume of the warning sound and the vibration of the terminal device 200 at this time may be larger than the volume and vibration at step S6 in FIG. 8. Furthermore, by looking at the status notification image, the user x understands that the vehicle 10 has been subjected to a cyber attack and cannot board the vehicle 10. Furthermore, the user x selects one desired means of transportation from the multiple means of transportation shown in the support reception image. For example, the user x selects a taxi as the means of transportation. This selection is performed by an input operation on the input unit 244. When such a selection is made, the control unit 201 requests the security device 100 to support the selected means of transportation via the third communication unit 215 (step S25).

[0122] When the second communication unit 115 accepts a request for support of a means of transportation, the notification processing unit 133 of the security device 100 refers to the travel support list information b2 stored in the database 134. Then, the notification processing unit 133 determines travel support information corresponding to the requested means of transportation from the travel support list information b2 (step S26). For example, the notification processing unit 133 determines the company name, address, location, telephone number, email address, and URL associated with the support ID "SP-001" from the travel support list information b2 as the travel support information. Then, the notification processing unit 133 uses the determined travel support information The port information is transmitted to the terminal device 200 via the second communication unit 115 (step S27). When the third communication unit 215 receives the travel support information, the control unit 201 of the terminal device 200 displays the travel support information on the display unit 241 (step S28).

[0123] Furthermore, when the second communication unit 115 receives the notification of step S9, the notification processing unit 133 of the security device 100 checks the result of the countermeasure taken in step S8, and stores information indicating the result of the countermeasure in, for example, the database 134 (step S10). Then, the countermeasure instruction unit 136 transmits a command signal for canceling the start-stop of the vehicle 10 to the vehicle 10 via the second communication unit 115 (step S29). That is, the countermeasure instruction unit 136 instructs the vehicle 10 to cancel the start-stop. When the first communication unit 15 receives the command signal, the gateway 16 of the vehicle 10 causes the ECU operating in accordance with the command signal for the start-stop to cancel the start-stop (step S30). That is, the start prohibition is canceled. Furthermore, the gateway 16 notifies the security device 100 of the result of the process performed in accordance with the command signal for canceling the start-stop via the first communication unit 15 (step S31).

[0124] When the second communication unit 115 receives the notification in step S31, the notification processing unit 133 of the security device 100 notifies the terminal device 200 of the countermeasure result via the second communication unit 115 (step S32). That is, the notification processing unit 133 sends an email indicating the countermeasure result to the email address of the user x. The countermeasure result includes that boarding the vehicle 10 is permitted. When the third communication unit 215 receives the notification in step S32, the control unit 201 of the terminal device 200 displays an image indicating the countermeasure result as a countermeasure result image on the display unit 241 (step S33).

[0125] As shown in the example of FIG. 9, the countermeasure instruction unit 136 in this embodiment instructs the vehicle 10 to start and stop the vehicle 10 in response to a cyber-attack. As a result, the vehicle 10 is not started, and thus it is possible to suppress the vehicle 10 from traveling contrary to the user x's intention, thereby improving safety. Furthermore, when the cyber-attack is countered in the vehicle 10, the countermeasure instruction unit 136 instructs the vehicle 10 to cancel the start and stop of the vehicle 10. As a result, after the cyber-attack is countered, the start and stop of the vehicle 10 is canceled, and therefore it is possible to realize the vehicle 10 traveling according to the user x's intention while ensuring safety.

[0126] Fig. 10 is a sequence diagram showing another example of the processing operation of the security system 1. The processing operation shown in Fig. 10 is an operation performed when the vehicle 10 is subjected to a cyber-attack while the user x is not on board the vehicle 10, similar to the examples of Fig. 8 and Fig. 9. Also, in this processing operation, unlike the examples of Fig. 8 and Fig. 9, the vehicle 10 deals with the cyber-attack without receiving instructions from the security device 100, and the terminal device 200 is notified that boarding is permitted.

[0127] Specifically, first, the vehicle 10 is subjected to a cyber-attack (step S1). The gateway 16 of the vehicle 10 detects the cyber-attack and confirms the details of the cyber-attack. Then, based on the details of the cyber-attack, the gateway 16 determines that the vehicle 10 can deal with the cyber-attack by itself without receiving instructions from the security device 100, and takes action. Furthermore, the gateway 16 determines that the security device 100 and the terminal device 200 are to be notified of the result of the action (step S2). The result of the action indicates, for example, that the vehicle 10 has been subjected to a cyber-attack, that the cyber-attack has been dealt with, and that boarding the vehicle 10 is possible.

[0128] Next, the gateway 16 notifies the terminal device 200, which is the notification destination determined in step S2, of the handling result via the first communication unit 15 (step S41). When the third communication unit 215 of the control unit 201 of the terminal device 200 receives the notification in step S41, the control unit 201 displays an image showing the handling result as a handling result image on the display unit 241 (step S42).

[0129] Furthermore, the gateway 16 notifies the security device 100, which is the notification destination determined in step S2, of the countermeasure result via the first communication unit 15 (step S43). When the second communication unit 115 receives the notification in step S43, the notification processing unit 133 of the security device 100 checks the countermeasure result and stores information indicating the countermeasure result in, for example, the database 134 (step S44).

[0130] 10, the terminal device 200 is notified that boarding is permitted, but may be notified that boarding is prohibited. In this case, the vehicle 10 notifies the terminal device 200 of the status of the vehicle 10 including whether boarding is permitted before notifying the terminal device 200 of the handling result including whether boarding is permitted.

[0131] 11 is a flowchart showing an example of a processing operation of the vehicle 10. Specifically, the flowchart in FIG.

[0132] First, the gateway 16 checks for a cyber-attack when the user x is not in the vehicle 10 (step S101). For example, the gateway 16 detects that a cyber-attack has occurred when it is determined by at least one of the ECUs 11 to 14 that the user x is not in the vehicle 10.

[0133] Then, based on the content of the cyber-attack, the gateway 16 determines whether or not the vehicle 10 can deal with the cyber-attack by itself without receiving instructions from the security device 100 (step S102). If the gateway 16 determines that it can deal with the cyber-attack (Yes in step S102), it deals with the cyber-attack (step S103) and determines the security device 100 and the terminal device 200 as the notification destinations of the result of the deal (step S104). The gateway 16 then notifies the determined notification destinations, the security device 100 and the terminal device 200, of the result of the deal via the first communication unit 15 (step S105).

[0134] On the other hand, if the gateway 16 determines that it cannot handle the problem (No in step S102), it determines the notification destination to be only the security device 100 (step S106). Then, the gateway 16 notifies the security device 100, which is the determined notification destination, of the request for handling via the first communication unit 15 (step S107).

[0135] Furthermore, after the process of step S107, the gateway 16 takes measures against the cyber attack in accordance with instructions from the security device 100 (step S108), and notifies the security device 100 of the results of the measures via the first communication unit 15 (step S109).

[0136] FIG. 12 is a flowchart showing an example of the processing operation of the security device 100.

[0137] The second communication unit 115 of the security device 100 receives a notification of a request for dealing with a cyber attack from the vehicle 10 when the user x is not on board the vehicle 10 (step S201). The analysis unit 135 checks and analyzes the content of the cyber attack indicated by the notification, and the handling instruction unit 136 determines a method for dealing with the cyber attack based on the analysis result (step S202). The boarding determination unit 131 determines whether the user x can board the vehicle 10 based on the analysis result of the cyber attack and the determined handling method (step S203). Note that the boarding status of the vehicle 10 is indicated in the handling request, so the boarding determination unit 131 can determine whether the user x can board the vehicle 10 after understanding that the user x is not on board the vehicle 10.

[0138] Here, if the boarding determination unit 131 determines that boarding is permitted (step S If the answer is "yes" in step S203), the notification processing unit 133 notifies the terminal device 200 of the status of the vehicle 10 via the second communication unit 115 (step S204). That is, the terminal device 200 is notified that the vehicle 10 has been subjected to a cyber-attack, but boarding the vehicle 10 is possible. Furthermore, the countermeasure instruction unit 136 instructs the vehicle 10 to take countermeasures using the countermeasure method determined in step S202 via the second communication unit 115 (step S205). Then, the notification processing unit 133 notifies the terminal device 200 of the countermeasure result via the second communication unit 115 (step S206).

[0139] On the other hand, if the boarding determination unit 131 determines that boarding is not possible (No in step S203), the countermeasure instruction unit 136 instructs the vehicle 10 to take the countermeasure according to the countermeasure method determined in step S202 via the second communication unit 115 (step S207). This countermeasure may include not only program repair but also starting and stopping the vehicle 10. Then, the notification processing unit 133 notifies the terminal device 200 of the status of the vehicle 10 via the second communication unit 115 (step S208). In other words, the terminal device 200 is notified that the vehicle 10 has been subjected to a cyber attack and boarding the vehicle 10 is not possible. This notification may be made by a status notification image including the support acceptance image described above.

[0140] Furthermore, the notification processing unit 133 judges whether or not the second communication unit 115 has accepted the request for support of the transportation means after the notification of step S208 (step S209). If it is judged that the request has been accepted (Yes in step S209), the notification processing unit 133 transmits transportation support information corresponding to the request to the terminal device 200 via the second communication unit 115 (step S210). Then, if the notification processing unit 133 judges that the second communication unit 115 has not accepted the request for support of the transportation means (No in step S209), or after the transmission of step S210, the notification processing unit 133 notifies the terminal device 200 of the result of the action via the second communication unit 115 (step S211). Note that, in step S207, if the vehicle 10 is instructed to take action including starting and stopping, the action instruction unit 136 instructs the vehicle 10 to release the start and stop after the action is taken and before the processing of step S211.

[0141] Fig. 13 is a diagram showing an example of a status notification image and a countermeasure result image. The status notification image and the countermeasure result image in Fig. 13 are images that are displayed when the vehicle 10 alone cannot deal with a cyber attack and a decision is made to not allow boarding.

[0142] For example, the notification processing unit 133 of the security device 100 notifies the terminal device 200 of the status of the vehicle 10 that has been subjected to a cyber-attack. In response to the notification, the terminal device 200 displays a status notification image P1 on the display unit 241, as shown in (a) of Fig. 13. Such a status notification image P1 is displayed in step S24 of Fig. 9.

[0143] The status notification image P1 indicates that the vehicle 10 has been subjected to a cyber attack, that driving has been impeded, that boarding the vehicle 10 is not possible, the vehicle number of the vehicle 10, that the vehicle 10 has been stopped, that measures are being taken, the estimated time of vehicle recovery, etc. The status notification image P1 also includes a support reception image Pa1.

[0144] Specifically, the notification processing unit 133 determines, based on the analysis result by the analysis unit 135 and the determination result by the boarding determination unit 131, that boarding to the vehicle 10 is not possible and that driving is being hindered. Furthermore, the notification processing unit 133 identifies the vehicle number of the vehicle 10 by referring to the vehicle information a2 of the second accounting unit 117. Furthermore, the notification processing unit 133 determines the countermeasure method determined by the countermeasure instruction unit 136, and calculates the vehicle recovery scheduled time according to the countermeasure method. Then, the notification processing unit 133 generates the above-mentioned situation notification image P1 indicating the determined, specified and calculated information. Furthermore, if the vehicle recovery scheduled time is a predetermined time ahead from the current time, the notification processing unit 133 includes a support acceptance image Pa1 in the situation notification image P1. The predetermined time may be one minute, five minutes or ten minutes. The predetermined time may be, but is not limited to, 0 minutes.

[0145] The support reception image Pa1 includes buttons Bt1, Bt2, and Bt3 for receiving support for a means of transportation. When the button Bt1 is selected by the user x through an input operation on the input unit 244, the control unit 201 of the terminal device 200 requests support for arranging a replacement vehicle from the security device 100 through the third communication unit 215. In this case, the notification processing unit 133 refers to the travel support list information b2 in the database 134 and identifies information associated with the support ID "SP-002" as travel support information. That is, information such as the company name "LMN Agency", the address "aaa", and the telephone number "ccc" is identified as travel support information. The notification processing unit 133 transmits the travel support information to the terminal device 200 through the second communication unit 115. As a result, the travel support information is displayed on the display unit 241 of the terminal device 200.

[0146] Furthermore, when the button Bt2 is selected by the user x's input operation on the input unit 244, the control unit 201 of the terminal device 200 requests taxi support from the security device 100 via the third communication unit 215. In this case, the notification processing unit 133 refers to the travel support list information b2 in the database 134 and identifies information associated with the support ID "SP-001" as travel support information. That is, information such as the company name "ABC Taxi", the address "RRR", and the telephone number "TTT" is identified as travel support information. The notification processing unit 133 transmits the travel support information to the terminal device 200 via the second communication unit 115. As a result, the travel support information is displayed on the display unit 241 of the terminal device 200.

[0147] Furthermore, when the button Bt3 is selected by the user x's input operation on the input unit 244, the control unit 201 of the terminal device 200 requests support for public transportation from the security device 100 via the third communication unit 215. In this case, the notification processing unit 133 refers to the travel support list information b2 in the database 134 and identifies information associated with the support ID "SP-003" as travel support information. That is, information such as the company name "XYZ Guide" and the URL "fff" is identified as travel support information. The notification processing unit 133 transmits the travel support information to the terminal device 200 via the second communication unit 115. As a result, a URL such as a public transportation transfer guide is displayed as travel support information on the display unit 241 of the terminal device 200.

[0148] In this way, when the boarding determination unit 131 determines that boarding is not possible as the determination result, the notification processing unit 133 in this embodiment notifies the terminal device 200 of travel support information related to a means of travel other than the vehicle 10. As a result, since the travel support information is notified to the terminal device 200, the user x can easily know information related to a means of travel other than the vehicle 10 from the terminal device 200. As a result, the user x can travel using a means of travel other than the vehicle 10 without boarding the vehicle 10. Therefore, the travel of the user x can be supported. Specifically, the notification processing unit 133 notifies the terminal device 200 of travel support information related to a means of travel selected in response to an input operation by the user x to the terminal device 200 from among multiple means of travel. As a result, the user x can select a desired means of travel by an input operation and easily know information related to the means of travel. Therefore, the travel of the user x can be further supported.

[0149] Here, the situation notification image P1 further includes a button Bt. The button Bt is a button for transmitting the above-mentioned answerback signal, and is a so-called confirmation button for notifying the security device 100 that the situation of the vehicle 10 has been confirmed. When the button Bt is selected by the user x through an input operation on the input unit 244, the control unit 201 of the terminal device 200 transmits the answerback signal to the security device 100 via the third communication unit 215. This will stop the ongoing additional notifications mentioned above.

[0150] When the cyber-attack of the vehicle 10 has been dealt with, the notification processing unit 133 of the security device 100 notifies the terminal device 200 of the result of the deal via the second communication unit 115. In response to the notification, the terminal device 200 displays a deal result image P2 on the display unit 241, as shown in (b) of FIG. 13. Such a deal result image P2 is displayed in step S33 of FIG. 9. The deal result image P2 indicates that the cyber-attack of the vehicle 10 has been dealt with, that boarding is possible, the vehicle number of the vehicle 10, that the vehicle 10 can be started, etc.

[0151] FIG. 14 is a diagram showing other examples of the status notification image and the countermeasure result image. Note that, like the example of FIG. 13, the status notification image and the countermeasure result image of FIG. 14 are images that are displayed when the vehicle 10 alone cannot deal with the cyberattack and a decision is made to not allow boarding. Also, in the example of FIG. 14, the vehicle 10 has an automatic driving function. Therefore, if a cyberattack is made against the automatic driving function, the vehicle 10 may run on its own regardless of the user x's intention. Note that the vehicle 10 may run even if it receives a command signal to start and stop.

[0152] In such a case, the terminal device 200 displays a status notification image P1 shown in (a) of FIG. 14 on the display unit 241 in response to notification of the status of the vehicle 10 from the security device 100. Such a status notification image P1 is displayed in step S24 of FIG. 9. The status notification image P1 shown in (a) of FIG. 14 indicates that the autonomous driving function of the vehicle 10 has been subjected to a cyber attack, that approaching the vehicle 10 is dangerous and therefore should not be undertaken, that boarding the vehicle 10 is not permitted, that measures are being taken, the vehicle license plate number of the vehicle 10, and the estimated time of vehicle recovery. The status notification image P1 also includes a support reception image Pa1, similar to the example of FIG. 13.

[0153] Specifically, the notification processing unit 133 determines, based on the analysis result by the analysis unit 135, that the target of the cyber attack is the autonomous driving function of the vehicle 10 and that the user should not approach the vehicle 10 due to danger. Furthermore, based on the determination result by the boarding determination unit 131, the notification processing unit 133 determines that boarding the vehicle 10 is not possible. Then, the notification processing unit 133 generates the above-mentioned situation notification image P1 indicating the determined information. Note that this situation notification image P1 includes the button Bt and the support reception image Pa1, similar to the example of FIG. 13.

[0154] When the cyber-attack of the vehicle 10 has been dealt with, the notification processing unit 133 of the security device 100 notifies the terminal device 200 of the result of the deal via the second communication unit 115. In response to the notification, the terminal device 200 displays a deal result image P2 on the display unit 241, as shown in (b) of FIG. 14. Such a deal result image P2 is displayed in step S33 of FIG. 9. This deal result image P2 indicates that the cyber-attack of the vehicle 10 has been dealt with, that boarding is permitted, the vehicle license plate number of the vehicle 10, etc.

[0155] In addition, when a cyber attack is made against the autonomous driving function of the vehicle 10, the countermeasure instruction unit 136 of the security device 100 may prohibit unlocking of all doors of the vehicle 10 as one of countermeasures against the cyber attack. This can effectively prevent the user x from getting into the dangerous vehicle 10.

[0156] FIG. 15 is a diagram showing other examples of the status notification image and the countermeasure result image. Note that the status notification image and the countermeasure result image in FIG. 15 are images that are displayed when it is determined that boarding is permitted even if the vehicle 10 is unable to deal with the cyber-attack by itself. Also, in the example of FIG. 15, the car navigation device (hereinafter also referred to as the car navigation) installed in the vehicle 10 is subjected to a cyber-attack. A cyber-attack on the car navigation does not impair the driving control functions of the vehicle 10. Note that the driving control functions are functions such as running, turning, and stopping. Or In this case, it can be said that the damage caused by a cyber attack on the car navigation system is small, or that the impact on the driving control function of the cyber attack on the car navigation system is small. Therefore, when a cyber attack is made on the car navigation system, the user x may board the vehicle 10.

[0157] Therefore, the notification processing unit 133 of the security device 100 notifies the terminal device 200 that the status of the vehicle 10 that has been subjected to a cyber-attack is that boarding is possible. In response to the notification, the terminal device 200 displays a status notification image P1 on the display unit 241, as shown in (a) of Fig. 15. Such a status notification image P1 is displayed in step S6 of Fig. 8. As shown in (a) of Fig. 15, the status notification image P1 indicates that the vehicle 10 has been subjected to a cyber-attack, that the car navigation system of the vehicle 10 cannot be operated, that boarding is possible in the vehicle 10, the vehicle license plate number of the vehicle 10, etc.

[0158] Specifically, the notification processing unit 133 determines, based on the analysis result by the analysis unit 135, that a cyber-attack has been made on the car navigation system, that the car navigation system cannot be operated, and so on. Furthermore, based on the determination result by the boarding determination unit 131, the notification processing unit 133 determines, for example, that boarding the vehicle 10 is possible because the impact of the cyber-attack on the driving control function is small. Furthermore, the notification processing unit 133 identifies the vehicle number of the vehicle 10. Then, the notification processing unit 133 generates the above-mentioned situation notification image P1 showing the understood and identified information.

[0159] When the cyber-attack on the vehicle 10 has been dealt with, the notification processing unit 133 of the security device 100 notifies the terminal device 200 of the result of the deal via the second communication unit 115. In response to the notification, the terminal device 200 displays a deal result image P2 on the display unit 241, as shown in (b) of FIG. 15. Such a deal result image P2 is displayed in step S12 of FIG. 8. The deal result image P2 indicates that the cyber-attack on the vehicle 10 has been dealt with, the vehicle license plate number of the vehicle 10, and the like.

[0160] The situation notification image P1 and the countermeasure result image P2 shown in Fig. 15 may also be displayed when the cyber-attack is countered by the vehicle 10 alone without receiving instructions from the security device 100. That is, before the countermeasure is performed in the process of step S2 in Fig. 10, the vehicle 10 may notify the terminal device 200 of the situation of the vehicle 10, and the terminal device 200 may display the situation notification image P1 shown in Fig. 15(a) in response to the notification. Then, in step S42 in Fig. 10, the terminal device 200 may display the countermeasure result image P2 shown in Fig. 15(b).

[0161] FIG. 16 is a diagram showing other examples of the status notification image and the countermeasure result image. The status notification image and the countermeasure result image in FIG. 16 are images that are displayed when it is determined that boarding is permitted even if the vehicle 10 alone cannot handle the cyberattack, as in the example of FIG. 15. In addition, in the example of FIG. 16, the driving recorder mounted on the vehicle 10 is subjected to a cyberattack. The driving recorder is a device that records and displays the distance traveled by the vehicle 10. A cyberattack on this driving recorder does not impede the driving control function of the vehicle 10. Alternatively, it can be said that the damage caused by the cyberattack on the driving recorder is small, or that the impact on the driving control function caused by the cyberattack on the driving recorder is small. Therefore, when a cyberattack is made on the driving recorder, the user x may board the vehicle 10.

[0162] Therefore, the notification processing unit 133 of the security device 100 notifies the terminal device 200 that the status of the vehicle 10 that has been subjected to a cyber-attack is that boarding is possible. In response to the notification, the terminal device 200 displays a status notification image P1 on the display unit 241, as shown in FIG. 16(a). Such a status notification image P1 is displayed in step S6 of FIG. 8. As shown in FIG. 16(a), the status notification image P1 notifies the user that the vehicle 10 has been subjected to a cyber-attack, It indicates that the mileage displayed is incorrect, that passengers are permitted to board vehicle 10, and the vehicle number of vehicle 10, etc.

[0163] Specifically, the notification processing unit 133 determines, based on the analysis result by the analysis unit 135, that a cyber-attack has been carried out on the driving recorder, that the display of the driving recorder is incorrect, etc. Furthermore, based on the determination result by the boarding determination unit 131, the notification processing unit 133 determines, for example, that boarding the vehicle 10 is possible because the impact of the cyber-attack on the driving control function is small. Furthermore, the notification processing unit 133 identifies the vehicle number of the vehicle 10. Then, the notification processing unit 133 generates the above-mentioned situation notification image P1 showing the understood and identified information.

[0164] When the cyber-attack of the vehicle 10 is dealt with, the notification processing unit 133 of the security device 100 notifies the terminal device 200 of the result of the deal via the second communication unit 115. In response to the notification, the terminal device 200 displays a deal result image P2 on the display unit 241, as shown in (b) of FIG. 16. Such a deal result image P2 is displayed in step S12 of FIG. 8. The deal result image P2 may be the same as the example in (b) of FIG. 15, or may be an image different from that example.

[0165] Note that the situation notification image P1 and the countermeasure result image P2 shown in Fig. 16 may also be displayed when the cyber-attack is countered by the vehicle 10 alone without receiving instructions from the security device 100, as in the example of Fig. 15. That is, before the countermeasure is performed in the process of step S2 in Fig. 10, the vehicle 10 may notify the terminal device 200 of the situation of the vehicle 10, and the terminal device 200 may display the situation notification image P1 shown in Fig. 16(a) in response to the notification. Then, in step S42 in Fig. 10, the terminal device 200 may display the countermeasure result image P2 shown in Fig. 16(b).

[0166] FIG. 17 is a diagram showing other examples of the status notification image and the countermeasure result image. The status notification image and the countermeasure result image in FIG. 17 are images that are displayed when it is determined that boarding is permitted even if the vehicle 10 alone cannot handle the cyberattack, as in the examples in FIG. 15 and FIG. 16. In addition, in the example in FIG. 17, the door of the vehicle 10 is unlocked by a cyberattack. A cyberattack on this door key does not impede the driving control function of the vehicle 10. Alternatively, it can be said that the damage caused by the cyberattack on the door key is small, or that the impact on the driving control function by the cyberattack on the door key is small. Therefore, when a cyberattack is made on the key, the user x may board the vehicle 10.

[0167] Therefore, the notification processing unit 133 of the security device 100 notifies the terminal device 200 that the status of the vehicle 10 that has been subjected to a cyber-attack is that boarding is possible. In response to the notification, the terminal device 200 displays a status notification image P1 on the display unit 241 as shown in (a) of FIG. 17. Such a status notification image P1 is displayed in step S6 of FIG. 8. As shown in (a) of FIG. 17, the status notification image P1 indicates that the vehicle 10 has been subjected to a cyber-attack, that the door is unlocked, that boarding to the vehicle 10 is possible, that the key to the vehicle 10 needs to be checked immediately, the vehicle number of the vehicle 10, and the like. Furthermore, the status notification image P1 includes a security-related contact image Pa2. The contact image Pa2 indicates that each security-related organization has been notified of the damage caused by the cyber-attack, and information regarding each organization. The information regarding each organization is the name of the organization (i.e., the company name), a telephone number, an email address, and the like.

[0168] Specifically, the notification processing unit 133 determines, based on the analysis result by the analysis unit 135, that a cyber-attack has been made on the door lock, that the door has been unlocked, etc. Furthermore, based on the determination result by the boarding determination unit 131, the notification processing unit 133 determines, based on the analysis result by the boarding determination unit 131, that a cyber-attack has been made on the door lock, that the door has been unlocked, etc. The notification processing unit 133 grasps that the impact on the driving control function caused by the driver's seat is small and therefore the driver can board the vehicle 10. Furthermore, the notification processing unit 133 identifies the vehicle number of the vehicle 10. Then, the notification processing unit 133 generates the above-mentioned situation notification image P1 indicating the grasped and identified information. Furthermore, the notification processing unit 133 refers to the contact information a3 in the second account unit 117, generates a contact image Pa2 indicating all or a part of the contact information a3, and includes the contact image Pa2 in the situation notification image P1.

[0169] When the cyber-attack of the vehicle 10 is dealt with, the notification processing unit 133 of the security device 100 notifies the terminal device 200 of the result of the deal via the second communication unit 115. In response to the notification, the terminal device 200 displays a deal result image P2 on the display unit 241, as shown in (b) of FIG. 17. Such a deal result image P2 is displayed in step S12 of FIG. 8. The deal result image P2 may be the same as the examples in (b) of FIG. 15 and (b) of FIG. 16, or may be an image different from those examples.

[0170] 15 and 16, the situation notification image P1 and the countermeasure result image P2 shown in Fig. 17 may also be displayed when the cyber-attack is countered by the vehicle 10 alone without receiving instructions from the security device 100. That is, before the countermeasure is performed in the process of step S2 in Fig. 10, the vehicle 10 may notify the terminal device 200 of the situation of the vehicle 10, and the terminal device 200 may display the situation notification image P1 shown in Fig. 17(a) in response to the notification. Then, in step S42 in Fig. 10, the terminal device 200 may display the countermeasure result image P2 shown in Fig. 17(b).

[0171] As described above, when a vehicle 10 in which user x is not aboard is subjected to a cyber-attack, the security device 100 in this embodiment determines whether or not user x is permitted to board the vehicle 10. Then, the security device 100 notifies the terminal device 200, which is located outside the vehicle 10 and used by user x, of the determination result as to whether user x is permitted to board the vehicle 10.

[0172] As a result, if the vehicle 10 is subjected to a cyber-attack while the user x is not in the vehicle 10, it is determined whether the user x can board the vehicle 10 or not, and the determination result is notified to the terminal device 200. Therefore, if the user x carries the terminal device 200, the user x can easily know whether the user x can board the vehicle 10 or not. In addition, it is possible to prevent the user x from boarding a dangerous vehicle 10 that is under a cyber-attack. As a result, it is possible to appropriately support the user x.

[0173] Although the security device of the present disclosure has been described based on the above embodiment, the present disclosure is not limited to the embodiment. As long as it does not deviate from the spirit of the present disclosure, various modifications conceivable by those skilled in the art to the above embodiment may also be included in the present disclosure.

[0174] For example, in the above embodiment, the vehicle 10 determines whether or not the vehicle 10 can handle the cyber-attack by itself in step S102 in Fig. 11. However, the security device 100 may determine whether or not the vehicle 10 can handle the cyber-attack by itself instead of the vehicle 10.

[0175] In the above-described embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory. Here, the software for realizing the vehicle 10 and the security device 100 of each of the above-described embodiments is a computer program that causes a computer to execute each step of the flowcharts shown in FIG. 11 and FIG. 12.

[0176] The following cases are also included in this disclosure:

[0177] (1) The at least one device is specifically a computer system consisting of a microprocessor, ROM, RAM, a hard disk unit, a display unit, a keyboard, a mouse, etc. A computer program is stored in the RAM or hard disk unit. The at least one device achieves its functions by the microprocessor operating in accordance with the computer program. Here, the computer program is composed of a combination of multiple instruction codes that indicate commands for a computer to achieve a specified function.

[0178] (2) A part or all of the components constituting at least one of the above devices are considered to be composed of a single system LSI (Large Scale Integration). A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on a single chip, and specifically, is a computer system including a microprocessor, ROM, RAM, etc. A computer program is stored in the RAM. The system LSI achieves its functions by the microprocessor operating in accordance with the computer program.

[0179] (3) A part or all of the components constituting at least one of the above devices may be composed of an IC card or a standalone module that is detachable from the device. The IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunction LSI. The IC card or module achieves its functions by the microprocessor operating according to a computer program. This IC card or module may be tamper-resistant.

[0180] (4) The present disclosure may be embodied as any of the methods described above, a computer program for implementing these methods on a computer, or a digital signal comprising a computer program.

[0181] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD (Compact Disc)-ROM, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Also, the present disclosure may be a digital signal recorded on such a recording medium.

[0182] The present disclosure may also involve transmitting a computer program or a digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0183] Furthermore, the program or digital signal may be recorded on a recording medium and transferred, or the program or digital signal may be transferred via a network or the like, so that the program or digital signal may be implemented by another independent computer system. [Industrial Applicability]

[0184] The security device of the present disclosure can be applied to, for example, a device or system for dealing with cyber attacks on vehicles. [Explanation of symbols]

[0185] 1. Security System 10 Vehicles 11, 12, 13, 14 ECUs 15 First Communications Department 16 Gateway 17 1st Accounts Department 18 1st position acquisition part 100 Security Devices 115 2nd Communications Department 117 2nd Accounts Department 131 Boarding Judgment Department 132 Notification method determination unit 133 Notification Processing Unit 134 Database 135 Analysis Department 136 Response Instructions Department 200 Terminal Equipment 201 Control section 215 3rd Communications Department 218 Second position acquisition unit 222 Memory 241 Display section 242 Speaker 243 Vibrator 244 Input section a1 User information a2 Vehicle information a3 Contact information b1 Notification method information b2 Travel support list information Bt, Bt1, Bt2, Bt3 buttons c1 User information c2 vehicle information c3 security device information Nt Communication Network P1 Status notification image P2 Treatment result image Pa1 Support reception image Pa2 Contact Image x User

Claims

1. an on-boarding determination unit that, when a vehicle in which a user is not on board is subjected to a cyber attack, determines whether or not the user is allowed to board the vehicle; a notification processing unit that notifies a determination result by the boarding determination unit to a terminal device that is outside the vehicle and is used by the user, The notification processing unit: When the boarding determination unit determines that boarding is not permitted as the determination result, the boarding determination unit notifies the terminal device used by the user of the determination result, and then notifies the terminal device of a family member of the user of the determination result. Security device.

2. The notification processing unit: When the boarding determination unit determines that boarding is not permitted as the determination result, the boarding determination unit notifies the terminal device of travel support information related to a means of transportation other than the vehicle. The security device of claim 1 .

3. The notification processing unit: notifying the terminal device of the transportation support information related to a transportation means selected in response to an input operation by the user from among a plurality of transportation means; The security device of claim 2.

4. The security device further comprises: and a countermeasure instruction unit that instructs the vehicle to deal with the cyber attack received by the vehicle when the boarding determination unit determines that boarding is not permitted as the determination result. The security device of claim 1 .

5. The response instruction unit, in the instruction for responding to the cyber attack, Instructing the vehicle to start or stop the vehicle; 5. A security device according to claim 4.

6. The handling instruction unit further When the cyber attack is dealt with in the vehicle, instruct the vehicle to cancel the start / stop of the vehicle.

6. A security device according to claim 5.

7. The notification processing unit: When the boarding determination unit determines that boarding is not permitted as the determination result, the boarding determination unit specifies a distance between the terminal device and the vehicle, and changes a notification mode for notifying the boarding denial in accordance with the distance. The security device of claim 1 .

8. the notification mode is expressed by at least one of a sound output from the terminal device and a vibration of the terminal device, The notification processing unit: changing the notification mode according to the distance such that at least one of the sound and the vibration becomes louder as the distance becomes shorter; 8. A security device according to claim 7.

9. The notification processing unit: when the boarding determination unit determines that boarding is not permitted as the determination result, specifying an elapsed time from when the boarding is not permitted, and changing a notification mode for continuously notifying the boarding denial in accordance with the elapsed time. The security device of claim 1 .

10. the notification mode is expressed by at least one of a sound output from the terminal device and a vibration of the terminal device, The notification processing unit: changing the notification mode according to the elapsed time such that at least one of the sound and the vibration becomes louder as the elapsed time becomes longer; 10. A security device according to claim 9.

11. the notification mode is represented by a period of at least one of a sound repeatedly output from the terminal device and a vibration repeatedly generated by the terminal device, The notification processing unit: changing the notification mode according to the elapsed time such that the longer the elapsed time is, the shorter the period is; 10. A security device according to claim 9.

12. The notification processing unit: Stopping the continuous notification of boarding denial in the notification mode in response to an answerback signal from the terminal device. A security device according to any one of claims 7 to 11.

13. 1. A computer implemented security method comprising: When a vehicle in which a user is not riding is subjected to a cyber attack, determining whether or not the user is allowed to ride in the vehicle; notifying a terminal device outside the vehicle and used by the user of a result of the determination as to whether or not the user is allowed to board the vehicle; If it is determined that boarding is not permitted as the determination result, the determination result is notified to the terminal device used by the user, and then the determination result is notified to a terminal device of a family member of the user. Security methods.

14. When a vehicle in which a user is not riding is subjected to a cyber attack, determining whether or not the user is allowed to ride in the vehicle; notifying a terminal device outside the vehicle and used by the user of a result of the determination as to whether or not the user is allowed to board the vehicle; If it is determined that boarding is not permitted as the determination result, the determination result is notified to the terminal device used by the user, and then the determination result is notified to a terminal device of a family member of the user. A program that causes a computer to do something.

Images