On-board device, server computer, communication system, control method, and computer program

Abstract

This on-board device is installed in a vehicle and causes a communication unit, which communicates with an external device located outside the vehicle, to restrict the communication with the external device in accordance with a security rule generated on the basis of road / vehicle information, including vehicle information about the vehicle and roadside information regarding outside of the vehicle, wherein the vehicle information includes application operation information for identifying an application operating in the vehicle and / or connection information indicating a communication connection state with the external device.

Description

In-vehicle device, server computer, communication system, control method, and computer program

[0001] The present disclosure relates to an in-vehicle device, a server computer, a communication system, a control method, and a computer program.

[0002] It is known that cybersecurity attacks on computer systems and networks by malicious third parties can be prevented by appropriately setting security rules (e.g., communication access permission lists and communication filter thresholds). Patent Document 1 below discloses a security configuration assistance device that calculates predicted values ​​of security setting parameters through machine learning using features of traffic data related to DDoS (Distributed Denial of Service) attacks. The security configuration assistance device provides security configuration assistance based on the results of a prior evaluation of security settings based on the predicted values.

[0003] International Publication No. 2022 / 009274

[0004] An on-board device according to one aspect of the present disclosure is an on-board device mounted on a vehicle, which causes a communication unit that communicates with an external device outside the vehicle to restrict communication with the external device in accordance with security rules generated based on road-vehicle information including vehicle information about the vehicle and roadside information about the outside of the vehicle, and the vehicle information includes at least one of application operation information that identifies an application running in the vehicle and connection information that indicates the communication connection status with the external device.

[0005] FIG. 1 is a schematic diagram showing a configuration of a communication system according to an embodiment of the present disclosure. FIG. 2 is a block diagram showing a hardware configuration of the in-vehicle system shown in FIG. 1. FIG. 3 is a block diagram showing a hardware configuration of the roadside device shown in FIG. 1. FIG. 4 is a block diagram showing a hardware configuration of a server (i.e., a server computer) shown in FIG. 1. FIG. 5 is a block diagram showing a functional configuration of the in-vehicle system shown in FIG. 2. FIG. 6 is a flowchart showing an operation related to determining a security rule among the operations of the in-vehicle system. FIG. 7 is a flowchart showing an operation related to communication among the operations of the in-vehicle system. FIG. 8 is a diagram showing a first example showing a change in security rules in response to a change in application operation status in a vehicle. FIG. 9 is a diagram showing the position of a vehicle. FIG. 10 is a diagram showing a second example showing a change in security rules in response to a change in application operation status in a vehicle. FIG. 11 is a diagram showing a third example showing a change in security rules in response to a change in communication connection status in a vehicle. FIG. 12 is a diagram showing a fourth example showing a change in security rules in response to a change in application operation status and communication connection status in a vehicle. FIG. 13 is a block diagram showing a functional configuration of an in-vehicle system according to a modified example. FIG. 14 is a diagram showing an example in which a security rule table is generated from application specifications.

[0006] [Problem to be Solved by the Present Disclosure] In an in-vehicle network, application programs (e.g., user-oriented application programs, hereinafter simply referred to as applications) running in the vehicle are switched. Furthermore, external communication parameters (e.g., network information such as a destination IP address and a port number, communication volume, etc.) vary depending on the connection status with an external device (e.g., a server computer, etc.). Therefore, in order to counter cybersecurity attacks, it is necessary to dynamically control security rules using the limited resources of the in-vehicle device. However, the method disclosed in Patent Literature 1 requires a high computational cost for machine learning of features (i.e., a large load due to arithmetic processing), and thus requires a large number of resources. Furthermore, a large number of resources are also required when using the machine learning results. Therefore, it is difficult to apply the method disclosed in Patent Literature 1 to an in-vehicle device with limited resources.

[0007] Therefore, the present disclosure aims to provide an in-vehicle device, a server computer, a communication system, a control method, and a computer program that can determine security rules with low computational cost and dynamically control security rules according to at least one of the operating status of applications in the vehicle in which the device is installed and the connection status with an external device.

[0008] [Effects of the Invention] According to the present disclosure, it is possible to provide an in-vehicle device, a server computer, a communication system, a control method, and a computer program that can determine security rules with low computational cost and dynamically control security rules according to at least one of the operating status of an application in the vehicle in which it is installed and the connection status with an external device.

[0009] [Description of Embodiments of the Present Disclosure] The contents of the embodiments of the present disclosure will be listed and described below. At least some of the embodiments described below may be combined in any combination.

[0010] (1) An in-vehicle device according to a first aspect of the present disclosure is an in-vehicle device mounted on a vehicle, and causes a communication unit that communicates with an external device outside the vehicle to restrict communication with the external device in accordance with security rules generated based on road-to-vehicle information including vehicle information about the vehicle and roadside information about the outside of the vehicle, the vehicle information including at least one of application operation information that identifies applications running in the vehicle and connection information that indicates a communication connection status with the external device. This enables security rules to be determined with low computational cost and the security rules to be dynamically controlled in accordance with the operation status of applications in the vehicle in which the in-vehicle device is mounted and the connection status with the external device.

[0011] (2) In the above (1), the in-vehicle device can receive security rules from an external device, thereby reducing the load of calculations required to determine security rules in the in-vehicle device.

[0012] (3) In the above (1), the in-vehicle device may further include a roadside information acquisition unit that acquires roadside information from an external device, a road-to-vehicle information generation unit that generates road-to-vehicle information by adding vehicle information to the roadside information, a determination unit that determines outside-vehicle communication parameter determination information based on the road-to-vehicle information, and a security rule generation unit that generates security rules based on the outside-vehicle communication parameter determination information. This makes it possible to determine appropriate security rules depending on the operating status of applications in the vehicle and the connection status with the external device.

[0013] (4) In the above (3), the road-to-vehicle information may include at least one of location information and map information in addition to at least one of application operation information and connection information, thereby determining the outside-vehicle communication parameters for generating an appropriate security rule.

[0014] (5) In the above (3) or (4), the exterior-vehicle communication parameter determination information may include at least one of application operation information and connection information, thereby enabling the generation of appropriate security rules.

[0015] (6) In the above (5), the exterior communication parameter determination information may include at least application operation information. When the application operation information indicates that no application is running, the security rule generation unit may generate a security rule including a first communication filter threshold value. When the application operation information indicates that an application that controls the opening and closing of the vehicle doors is running, the security rule generation unit may generate a security rule including a second communication filter threshold value that is greater than the first communication filter threshold value. This makes it possible to filter the transmitted data when data exceeding an expected communication volume (i.e., the first communication filter threshold value) is transmitted to the in-vehicle system while the vehicle is parked and before authentication (i.e., when no application is running). This makes it possible to take measures against, for example, Denial of Service (DoS) attacks.

[0016] (7) In the above (5) or (6), the exterior communication parameter determination information may include at least application operation information. The security rule generation unit may generate security rules that do not include access permissions when it determines from the application operation information that no application is running, and may generate security rules that include access permissions to external devices that provide services to the driving assistance application when it determines from the application operation information that a driving assistance application is running. This allows access from an unexpected destination to be restricted when the vehicle is located in an area outside the scope of the driving assistance service (i.e., when no application is running). For example, this enables measures to be taken against access from a false destination (i.e., spoofing).

[0017] (8) In any one of (5) to (7) above, the out-of-vehicle communication parameter determination information may include at least connection information. When the vehicle location identified from the road-vehicle information is within a first area including multiple intersections, the security rule generation unit may generate a security rule including a third communication filter threshold value identified by the connection information corresponding to the first area. When the vehicle location identified from the road-vehicle information is within a second area narrower than the first area and including one intersection, the security rule generation unit may generate a security rule including a fourth communication filter threshold value identified by the connection information corresponding to the second area. The fourth communication filter threshold value may be greater than the third communication filter threshold value. This makes it possible to filter data transmitted to the in-vehicle system when the vehicle is located within the first area (e.g., a cloud communication area) exceeding the expected communication volume (i.e., the third communication filter threshold value) based on the connection state. This, for example, enables countermeasures against DoS attacks.

[0018] (9) In the above (5), the exterior-of-vehicle communication parameter determination information may include application operation information, and when the security rule generation unit determines that multiple applications are running in the vehicle based on the exterior-of-vehicle communication parameter determination information, the security rule generation unit may generate a security rule table for each of the multiple running applications and integrate the multiple security rule tables to generate a security rule. This makes it possible to efficiently generate a security rule that restricts communication of one communication unit.

[0019] (10) In any one of (4) to (9) above, if the road-to-vehicle information does not include connection information, the determination unit may generate connection information from the road-to-vehicle information as outside-vehicle communication parameter determination information. This allows operation information and connection information to be generated from the road-to-vehicle information, and appropriate security rules to be generated.

[0020] (11) In any one of (1) to (10) above, the security rule may include restrictions on at least one of the access frequency, communication speed, number of sessions, number of SYN packets, communication address of the communication destination, and port number of the communication destination, which can improve the security of the communication by the communication unit.

[0021] (12) In any one of (1) to (11) above, the in-vehicle device may further include an update unit that updates the security rules, and the update unit may update the security rules upon receiving, via the communication unit, a new application to be run in the vehicle or an update application for an application running in the vehicle. This allows the security rules to be maintained in an appropriate state.

[0022] (13) In the above (12), new security rules corresponding to the new application or the updated application may be received from an external device, and the update unit may update the security rules using the new security rules. This further reduces the load of calculations required to determine security rules according to the operating status of the application.

[0023] (14) A server computer according to a second aspect of the present disclosure includes a generation unit that generates, for an in-vehicle device mounted on a vehicle, security rules that restrict communication between the in-vehicle device and the outside of the vehicle based on vehicle information about the vehicle and road-vehicle information including roadside information about the outside of the vehicle, and a communication unit that transmits the security rules to the in-vehicle device, wherein the vehicle information includes at least one of application operation information that identifies applications running in the vehicle and connection information that indicates a communication connection status with an external device. This enables the in-vehicle system to dynamically control communication with the outside of the vehicle in accordance with the security rules that correspond to the operation status of the applications in the vehicle and the connection status with the external device.

[0024] (15) In the above (14), the communication unit can receive vehicle information from the in-vehicle device, and the server computer can further include a road-to-vehicle information generation unit that generates road-to-vehicle information by adding the vehicle information received by the communication unit to the roadside information, and a determination unit that determines exterior-vehicle communication parameter determination information based on the road-to-vehicle information, and the generation unit can generate security rules based on the exterior-vehicle communication parameter determination information. This reduces the load of calculations required to determine security rules in the in-vehicle device.

[0025] (16) A communication system according to a third aspect of the present disclosure includes the in-vehicle device according to any one of (1) to (13) above and the server computer according to (14), wherein the in-vehicle device causes a communication unit mounted on the vehicle to communicate with the server computer as an external device, thereby enabling the in-vehicle device to dynamically control security rules according to the operating status of applications in the vehicle and the connection status with the external device.

[0026] (17) A communication system according to a fourth aspect of the present disclosure includes the in-vehicle device according to (1) or (2) above and the server computer according to (15) above, wherein the in-vehicle device causes a communication unit mounted on the vehicle to communicate with the server computer as an external device, thereby enabling the in-vehicle device to dynamically control security rules according to the operating status of applications in the vehicle and the connection status with the external device.

[0027] (18) A control method according to a fifth aspect of the present disclosure is a control method for an in-vehicle system mounted on a vehicle, the control method including a step of causing an in-vehicle device included in the in-vehicle system to restrict communication with an external device outside the vehicle in accordance with security rules generated based on vehicle information about the vehicle and road-vehicle information including roadside information about the outside of the vehicle, the vehicle information including at least one of application operation information identifying an application running in the vehicle and connection information indicating a communication connection status with the external device, thereby enabling the in-vehicle device to dynamically control the security rules in accordance with the operation status of the application in the vehicle and the connection status with the external device.

[0028] (19) A computer program according to a sixth aspect of the present disclosure causes a computer mounted on a vehicle to perform a function of restricting communication with an external device in a communication unit that communicates with an external device outside the vehicle in accordance with security rules generated based on road-to-vehicle information including vehicle information about the vehicle and roadside information about the outside of the vehicle, the vehicle information including at least one of application operation information that identifies an application running in the vehicle and connection information that indicates a communication connection status with the external device. This allows the in-vehicle device to dynamically control the security rules in accordance with the operation status of the application in the vehicle and the connection status with the external device.

[0029] [Details of the embodiments of the present disclosure] In the following embodiments, the same components are denoted by the same reference numerals, and their names and functions are also the same. Therefore, detailed descriptions thereof will not be repeated.

[0030] 1 , a communication system 100 according to an embodiment of the present disclosure includes a vehicle 104 equipped with an in-vehicle system 102, and a server (i.e., a server computer) 112 capable of communicating with the in-vehicle system 102 via a base station 108 and a network 110. The communication system 100 may also include a roadside device 106 including a sensor that is fixedly installed on the roadside. The server 112 provides services such as transmitting driving assistance information to the in-vehicle system 102. The in-vehicle system 102 and the roadside device 106 transmit (hereinafter also referred to as uploading) data to the server 112 to be used to generate the driving assistance information to be transmitted by the server 112.

[0031] The base station 108 provides mobile communication services using, for example, 4G (i.e., a fourth-generation mobile communication system) lines and 5G (i.e., a fifth-generation mobile communication system) lines. The base station 108 is connected to a network 110. The in-vehicle system 102 installed in the vehicle 104 has communication functions according to the communication specifications (i.e., 4G lines, 5G lines, etc.) provided by the base station 108. The roadside unit 106 is also connected to the network 110 via the base station 108. Note that communication between the server 112 and the in-vehicle system 102 and the roadside unit 106 is not limited to communication via the network 110, but may be wireless communication such as Wi-Fi. Furthermore, communication between the server 112 and the fixedly installed roadside unit 106 may be wired communication without going through the base station 108.

[0032] Sensor data acquired by sensors mounted on the vehicle 104 (hereinafter also referred to as in-vehicle sensors) is analyzed in the in-vehicle system 102, and the analysis results are stored as dynamic information. The dynamic information is used in the autonomous driving function of the vehicle. The sensor data and dynamic information are also uploaded from the in-vehicle system 102 to the server 112.

[0033] The roadside device 106 is installed on the roadside and acquires information on the roadside using sensors (hereinafter also referred to as infrastructure sensors). The sensor data is analyzed in the roadside device 106, and dynamic objects and the like are detected. The sensor data and analysis results are uploaded from the roadside device 106 to the server 112. The vehicle 104 shown in FIG. 1 is a detection target of the infrastructure sensors of the roadside device 106, and is detected as a dynamic object.

[0034] The dynamic information is information about dynamic objects detected by sensors (i.e., infrastructure sensors and on-board sensors). Dynamic objects are not limited to moving objects (e.g., people, vehicles, etc.), but also include stationary objects that have the ability to move. The dynamic information is used as driving assistance information for use in the autonomous driving of the host vehicle. The dynamic information is also transmitted to the server 112 and used to generate driving assistance information that is transmitted from the server 112 to vehicles (including the vehicle 104 and vehicles other than the vehicle 104).

[0035] 1 shows one base station 108, one roadside device 106, and one vehicle 104 equipped with an in-vehicle system 102. However, this is merely an example. Typically, there are multiple base stations and multiple vehicles equipped with in-vehicle systems. There may be vehicles that do not have an in-vehicle system that can communicate with the server 112. Vehicles that do not have an in-vehicle system are detected as dynamic objects.

[0036] [Hardware Configuration of In-Vehicle System] Referring to Figure 2, an example of the hardware configuration of the in-vehicle system 102 mounted on the vehicle 104 is shown. The in-vehicle system 102 includes an exterior communication unit 120, an in-vehicle device 122, sensors 124, an automatic driving ECU (Electronic Control Unit) 126, an authentication ECU 128, a drive ECU 130, and a bus 132. Note that the in-vehicle system 102 includes multiple ECUs, and Figure 2 shows the automatic driving ECU 126, the authentication ECU 128, and the drive ECU 130 as examples.

[0037] The exterior communication unit 120 performs wireless communication with devices external to the vehicle 104 (e.g., communication with the server 112 via the base station 108). The exterior communication unit 120 includes an integrated circuit (IC) for performing modulation and multiplexing employed in wireless communication, an antenna for transmitting and receiving radio waves at a predetermined frequency, and an RF (Radio Frequency) circuit. The exterior communication unit 120 also has a communication function with a global navigation satellite system (GNSS) such as a global positioning system (GPS) in order to acquire information for identifying the current location of the vehicle 104. The exterior communication unit 120 may also have a communication function such as Wi-Fi.

[0038] The in-vehicle device 122 includes a control unit 140 and a memory 142. The control unit 140 includes a CPU (Central Processing Unit) and controls the memory 142. The memory 142 is, for example, a rewritable nonvolatile semiconductor memory and stores a computer program (hereinafter simply referred to as a program) executed by the control unit 140. The memory 142 provides a work area for the program executed by the control unit 140. The control unit 140 acquires data to be processed directly from the exterior communication unit 120 and acquires data from sources other than the exterior communication unit 120 via the bus 132. The control unit 140 stores data received from the exterior communication unit 120 and data received via the bus 132 in the memory 142 as appropriate. The control unit 140 stores the processing results in the memory 142 and outputs them to the bus 132.

[0039] The in-vehicle device 122 serves as a gateway (i.e., communication protocol conversion, etc.) connecting communication functions with the outside of the vehicle (specifically, communication specifications) with communication functions within the vehicle (i.e., communication specifications). The autonomous driving ECU 126, authentication ECU 128, etc. can communicate with external devices via the in-vehicle device 122 and the exterior communication unit 120. As will be described later, the in-vehicle device 122 controls security rules related to communication with the outside of the vehicle. Furthermore, the in-vehicle device 122 transmits, for example, driving assistance information received from the outside via the exterior communication unit 120 to the autonomous driving ECU 126. The bus 132 performs communication functions within the in-vehicle system. Communication (i.e., data exchange) between the in-vehicle device 122, sensor 124, autonomous driving ECU 126, authentication ECU 128, and drive ECU 130 is performed via the bus 132. The bus 132 may be, for example, a CAN (Controller Area Network).

[0040] The sensor 124 is mounted on the vehicle 104 and includes a sensor for acquiring information outside the vehicle 104 (for example, a video imaging device (for example, a digital camera (CCD (Charge-Coupled Device) camera, CMOS (Complementary Metal-Oxide Semiconductor) camera)), a laser sensor (LiDAR), etc.). The sensor 124 may also include a sensor for acquiring information about the vehicle itself (an acceleration sensor, a load sensor, etc.). The sensor 124 acquires information within a detection range (an imaging range in the case of a camera) and outputs it as sensor data. If the sensor 124 is a digital camera, it outputs digital image data. A detection signal (i.e., an analog or digital signal) from the sensor 124 is output as digital data to the bus 132 via an I / F unit (not shown) and transmitted to the on-board device 122, the autonomous driving ECU 126, etc.

[0041] The autonomous driving ECU 126 controls the driving of the vehicle 104. For example, the autonomous driving ECU 126 acquires sensor data from the sensors 124, analyzes the data to understand the situation around the vehicle, and transmits the data to the drive ECU 130, which is a mechanism related to autonomous driving. The drive ECU 130 controls the drive unit 134 (e.g., mechanisms such as the engine, motor, transmission, steering, and brakes). The autonomous driving ECU 126 uses driving assistance information acquired from the in-vehicle device 122 for autonomous driving. The authentication ECU 128, as will be described later, performs user authentication to permit the unlocking of the doors of the vehicle 104, etc.

[0042] [Hardware Configuration of Roadside Device] An example of the hardware configuration of the roadside device 106 is shown with reference to Fig. 3. The roadside device 106 includes a communication unit 150, a control unit 152, a sensor 154, a memory 156, and a bus 158. Data exchange between the control unit 152, the sensor 154, and the memory 156 is performed via the bus 158. The communication unit 150 receives data from the server 112 and transmits data to the server 112. The communication unit 150 obtains transmission data from the control unit 152 and outputs received data to the control unit 152. The data received by the communication unit 150 is stored in the memory 156 as appropriate.

[0043] The control unit 152 is configured to include, for example, a CPU. The memory 156 is, for example, a rewritable nonvolatile semiconductor memory, and stores the program executed by the control unit 152. The memory 156 provides a work area for the program executed by the control unit 152. The memory 156 may include a large-capacity storage device such as a hard disk drive. The sensor 154 is a sensor for acquiring information outside the roadside unit 106, and includes, for example, an image sensor (for example, a digital surveillance camera), a radar (for example, a millimeter-wave radar), or a laser sensor (for example, a LiDAR). The sensor 154 acquires information within a detection range (for example, an imaging range in the case of a camera) and outputs it as sensor data. The sensor data is stored in the memory 156.

[0044] The control unit 152 reads out the sensor data from the memory 156 and outputs it to the communication unit 150. As a result, the sensor data of the sensor 154 is transmitted from the communication unit 150 to the server 112. The control unit 152 also reads out the sensor data from the memory 156 and analyzes it. As a result of the analysis, a dynamic object or the like is detected. The control unit 152 outputs information about the detected dynamic object or the like to the communication unit 150. As a result, the analysis result of the control unit 152 is transmitted from the communication unit 150 to the server 112, and the server 112 can generate information about the outside of the vehicle 104 (hereinafter referred to as roadside information), as will be described later.

[0045] [Hardware Configuration of Server] Referring to FIG. 4 , the server 112 includes a control unit 160 that controls each unit, a memory 162 that stores data, a communication unit 164 that performs communication, and a bus 166 for exchanging data among the units. The control unit 160 includes a CPU and realizes the functions described below by controlling each unit. The memory 162 includes a rewritable semiconductor nonvolatile memory and a large-capacity storage device such as a hard disk drive. The communication unit 164 receives data uploaded from the in-vehicle system 102 and the roadside unit 106. The data received by the communication unit 164 is transmitted to and stored in the memory 162. The server 112 analyzes the received data to generate roadside information and transmits it to the in-vehicle system 102. If the server 112 provides a driving assistance service, the server 112 analyzes the received data to generate driving assistance information and transmits it to the vehicle (i.e., the in-vehicle system).

[0046] [Functional Configuration of In-Vehicle System] The function of the in-vehicle device 122, i.e., the function of controlling security rules, will be described with reference to Figure 5. The in-vehicle device 122 includes a roadside information acquisition unit 200, a road-to-vehicle information generation unit 202, an exterior-vehicle communication parameter determination information determination unit 204, and a security rule generation unit 206. The functions of the roadside information acquisition unit 200, the road-to-vehicle information generation unit 202, the exterior-vehicle communication parameter determination information determination unit 204, and the security rule generation unit 206 are realized by the control unit 140 and memory 142 shown in Figure 2. The exterior-vehicle communication unit 120 includes a security unit 208 that implements communication security such as a packet filter. As described below, the in-vehicle device 122 outputs the determined security rules to the security unit 208 and causes the security unit 208 to restrict communication performed by the exterior-vehicle communication unit 120 in accordance with the input rules.

[0047] The roadside information acquisition unit 200 acquires roadside information transmitted from the server 112 via the exterior communication unit 120. The roadside information is information about the outside of the in-vehicle system 102 and includes map information. The map information includes, for example, a road map around the in-vehicle system 102 and location information of exterior devices such as servers that can communicate with the in-vehicle system 102 (hereinafter referred to as an exterior device map). Based on the exterior device map, the communication range of each server, etc. can be determined, and the communication connection status between the exterior device and the vehicle can be derived. The exterior device map is used when connection information (i.e., information indicating the communication connection status with external devices), which will be described later, cannot be directly acquired. The acquired roadside information is stored in the memory 142.

[0048] The road-vehicle information generation unit 202 generates road-vehicle information by adding roadside information acquired by the roadside information acquisition unit 200 to information acquired from the exterior communication unit 120, the autonomous driving ECU 126, the drive ECU 130, etc. (hereinafter referred to as vehicle information). The generated road-vehicle information is stored in the memory 142. The vehicle information includes, for example, location information indicating the location of the vehicle 104, application operation information identifying user-oriented applications running in the vehicle 104, and connection information indicating the communication connection status with external devices. Therefore, the road-vehicle information includes, for example, location information, map information, application operation information, and connection information. The road-vehicle information generation unit 202 can identify applications running in the vehicle 104 and generate application operation information by communicating with each unit in the in-vehicle system 102, for example, via the bus 132. This allows the exterior communication parameters for generating appropriate security rules to be determined, as described below.

[0049] An application is, for example, a program executed in the in-vehicle system 102 to receive a service provided by the server 112. The application may be any program that can be executed in the vehicle 104, and is not limited to programs executed by the in-vehicle device 122, but also includes programs executed by ECUs such as the autonomous driving ECU 126, the authentication ECU 128, and the drive ECU 130.

[0050] Note that there are cases where the road-to-vehicle information does not include connection information, i.e., the road-to-vehicle information generation unit 202 cannot acquire connection information. Even in such cases, as will be described later, connection information can be generated from information included in the road-to-vehicle information. Therefore, it is sufficient for the road-to-vehicle information to include at least a portion of the above-mentioned information.

[0051] The exterior-vehicle communication parameter determination information determination unit 204 determines exterior-vehicle communication parameter determination information from the road-to-vehicle information generated by the road-to-vehicle information generation unit 202. The determined exterior-vehicle communication parameter determination information is stored in the memory 142. The exterior-vehicle communication parameter determination information is information for determining security rules related to wireless communication between the exterior-vehicle communication unit 120 and the outside of the vehicle 104, i.e., information used to determine which exterior-vehicle communication parameters related to communication with the outside of the vehicle are to be restricted by the security rules. The exterior-vehicle communication parameter determination information includes, for example, application operation information and connection information. This makes it possible to generate appropriate security rules, as described below. When the road-to-vehicle information includes either application operation information or connection information, the exterior-vehicle communication parameter determination information determination unit 204 determines that information included in the road-to-vehicle information as the exterior-vehicle communication parameter determination information.

[0052] As described above, the road-to-vehicle information may not include connection information. In such cases, the exterior-vehicle communication parameter determination information determiner 204 indirectly determines the connection information not included in the road-to-vehicle information. That is, the exterior-vehicle communication parameter determination information determiner 204 estimates the connection information not included from the information included in the road-to-vehicle information. For example, the exterior-vehicle communication parameter determination information determiner 204 can estimate the external device (e.g., IP address and port number) and its communication status (e.g., communication speed) to which the exterior-vehicle communication unit 120 is connected, based on the location information and map information (including an exterior-vehicle device map) included in the road-to-vehicle information, and therefore can determine the connection information. This allows the connection information to be generated from the road-to-vehicle information, and appropriate security rules to be generated.

[0053] The security rule generation unit 206 generates security rules from the exterior communication parameter determination information determined by the exterior communication parameter determination information determination unit 204. The exterior communication parameters, which are parameters related to communication by the exterior communication unit 120, include, for example, the frequency of access from outside, the communication volume (i.e., communication speed), the number of established communication sessions, the number of SYN packets communicated to establish communication, the destination IP address, and the destination port number. As described below, this improves the security of communication by the exterior communication unit 120. The exterior communication parameters are not limited to these. The security rule generation unit 206 identifies exterior communication parameters to be restricted from the exterior communication parameter determination information (e.g., application operation information and connection information), determines the content of the restriction, and generates, for example, a table (hereinafter referred to as a security rule table) that associates the exterior communication parameters with the content of the restriction, and uses the table as a security rule. The security rule generation unit 206 outputs the determined security rules to the security unit 208 of the exterior communication unit 120. Furthermore, the security rule generating unit 206 stores the generated security rules in the memory 142 .

[0054] Since the application operation information identifies an application, if the specifications of the out-of-vehicle communication for that application are known, the security rule generation unit 206 can determine out-of-vehicle communication parameters, generate a security rule table for each application, and store it in the memory 142. Therefore, the communication specifications for each application may be stored in the memory 142 in advance. For example, each application may be analyzed and the communication specifications may be stored in the memory 142. By analyzing an application downloaded and stored in the in-vehicle system 102, the communication conditions of the application (e.g., destination IP address, destination port number, communication volume, etc.) can be identified, and a security rule table can be generated. Furthermore, as described below, the communication specifications of the application may be downloaded from a server and stored in the memory 142. Note that when multiple applications are launched, out-of-vehicle communication parameters corresponding to each application are obtained. However, because the out-of-vehicle communication path that is restricted is a single out-of-vehicle communication unit 120, the security rule generation unit 206 integrates the multiple security rule tables. For example, if multiple security rule tables each include communication volume, a security rule including the sum of these values ​​is generated. When a plurality of security rule tables each contain a combination of a communication destination IP address and a communication destination port number, a security rule including all of the combinations is generated, thereby enabling efficient generation of security rules that restrict communication by the exterior communication unit 120.

[0055] The security unit 208 stores the input security rules in its internal memory and restricts communications performed by the exterior-vehicle communication unit 120 in accordance with the security rules. This improves the security of communications by the exterior-vehicle communication unit 120. The above-described processes by the roadside information acquisition unit 200, the road-to-vehicle information generation unit 202, the exterior-vehicle communication parameter determination information determination unit 204, the security rule generation unit 206, and the security rule generation unit 206 are repeatedly executed, and security rules are repeatedly generated. The road-to-vehicle information changes in response to changes in the operating status of applications in the vehicle 104 and the connection status with external devices, and the exterior-vehicle communication parameter determination information changes in response to these changes. Therefore, the security rules change in response to changes in the operating status of applications in the vehicle 104 and the connection status with external devices. When a new security rule is input from the security rule generation unit 206, the security unit 208 rewrites and updates the security rules stored in its internal memory with the new security rule.

[0056] This allows the in-vehicle system 102 (specifically, the in-vehicle device 122) to determine appropriate security rules depending on the operating status of applications in the vehicle 104 in which it is installed and the connection status with external devices. Furthermore, the in-vehicle system 102 can dynamically control security rules depending on changes in the operating status of applications in the vehicle 104 and the connection status with external devices. This allows for countermeasures against cybersecurity attacks and improves the safety of communications with the outside world. Since the security rules can be determined by processing information obtainable within the vehicle 104 and information obtainable from a server, this can be achieved with low computational cost without executing resource-intensive processes such as machine learning.

[0057] Although the above description has been given of the case where the security rule generation unit 206 stores a security rule table for each application, the present invention is not limited to this. The security rule generation unit 206 only needs to store, for each application, the exterior-vehicle communication parameters used to generate a security rule. The storage format may be a format other than a table.

[0058] [Operation of the In-Vehicle Device] With reference to Fig. 6, the control operation of the security rules by the in-vehicle device 122 will be described with reference to the functions shown in Fig. 5. The process shown in Fig. 6 is realized when power is supplied to the in-vehicle system 102 from an in-vehicle battery or the like, and the control unit 140 (see Fig. 2) of the in-vehicle device 122 reads and executes a predetermined program from the memory 142. Note that the results of the execution of the process shown below are stored in the memory 142 as appropriate.

[0059] In step 300, the control unit 140 determines whether or not roadside information has been received via the exterior communication unit 120. If it is determined that the roadside information has been received, control proceeds to step 302. If not, control proceeds to step 304. The roadside information is transmitted from the server 112, for example.

[0060] In step 302, the control unit 140 stores the roadside information received in step 300 in the memory 142. Thereafter, control proceeds to step 304. The processing in steps 300 and 302 corresponds to the function of the roadside information acquisition unit 200 in FIG.

[0061] In step 304, the control unit 140 acquires vehicle information about the vehicle 104 in which the in-vehicle system 102 is installed. The control unit 140 stores the acquired vehicle information in the memory 142. Thereafter, control proceeds to step 306. The vehicle information includes, for example, location information, application operation information, and connection information of the vehicle 104. The vehicle 104 acquires the vehicle information from the exterior communication unit 120, the autonomous driving ECU 126, the drive ECU 130, etc.

[0062] In step 306, the control unit 140 reads from the memory 142 the vehicle information acquired in step 304 and the roadside information received in step 300, combines the vehicle information and the roadside information to generate road-to-vehicle information, and stores the information in the memory 142. If the vehicle information and the roadside information contain overlapping information, the control unit 140 leaves one of the overlapping pieces of information in the road-to-vehicle information. Then, control proceeds to step 308. The processing in steps 304 and 306 corresponds to the function of the road-to-vehicle information generation unit 202 in FIG. 5 .

[0063] In step 308, the control unit 140 determines exterior-vehicle communication parameter determination information based on the road-to-vehicle information generated in step 306, and stores the information in the memory 142. Thereafter, control proceeds to step 310. The processing in step 308 corresponds to the function of the exterior-vehicle communication parameter determination information determiner 204 shown in FIG.

[0064] In step 310, the control unit 140 generates a security rule based on the exterior communication parameter determination information determined in step 308. Thereafter, control proceeds to step 312.

[0065] In step 312, the control unit 140 outputs the security rule to the security unit 208. Thereafter, control proceeds to step 314. The processes of steps 310 and 312 correspond to the function of the security rule generation unit 206 shown in FIG.

[0066] In step 314, the control unit 140 determines whether or not to terminate the program. If it is determined that the program should be terminated, the program terminates. If not, control returns to step 300, and the above-described processing is repeated. The termination instruction is issued, for example, by stopping the power supply to the in-vehicle device 122.

[0067] [Operation of Security Unit] The operation of restricting communication by security unit 208 (see FIG. 5) of exterior communication unit 120 will be described with reference to Fig. 7. The process shown in Fig. 7 is realized, for example, by a control unit (e.g., a CPU) within security unit 208 reading and executing a predetermined program from the internal memory of security unit 208.

[0068] In step 400, the security unit 208 determines whether or not a security rule has been acquired from the in-vehicle device 122. If it is determined that the security rule has been acquired, control proceeds to step 402. Otherwise, control proceeds to step 404. The security rule is output from the in-vehicle device 122 to the security unit 208 in step 312 shown in FIG. 6 .

[0069] In step 402, the security unit 208 updates the currently used security rules. Specifically, the security unit 208 replaces the currently used security rules with the security rules acquired in step 400 (for example, by overwriting them in the internal memory of the security unit 208). Then, control proceeds to step 404.

[0070] In step 404, the security unit 208 determines whether communication violating a security rule has occurred. If it is determined that communication has occurred, control proceeds to step 406. If not, control proceeds to step 408. Communication violating a security rule refers to communication that deviates from the range of exterior-vehicle communication parameters defined as the security rule. For example, if the security rule includes a communication volume as an exterior-vehicle communication parameter and the threshold (i.e., upper limit) is set to a (bps), the security unit 208 determines that communication violating a security rule has occurred when data exceeding a (bps) is received from outside the vehicle 104. For example, if the security rule includes a destination IP address as an exterior-vehicle communication parameter, the security unit 208 determines that communication violating a security rule has occurred when packet data is received that includes, as a source address, an IP address different from the destination IP address.

[0071] The period for executing the process of step 404 may vary depending on the exterior-vehicle communication parameters included in the security rule. For example, if the security rule includes a destination IP address as an exterior-vehicle communication parameter, the security unit 208 determines, for each received packet, whether the source address included in the packet is the destination IP address. On the other hand, if the security rule includes a communication volume (threshold value: a (bps)) as an exterior-vehicle communication parameter, the security unit 208 buffers the received packets for a predetermined period and determines whether the total value is a (bps) or less.

[0072] In step 406, the security unit 208 allows only data that conforms to the security rules to be communicated. That is, the security unit 208 discards any received packet that is determined to violate the security rules in step 404 and does not pass that packet to an application. The security unit 208 passes any received packet that is determined not to violate the security rules in step 404 to the application corresponding to the port number included in that packet. Then, control proceeds to step 410.

[0073] In step 408, the security unit 208 enables communication of all received data and passes each packet to the application corresponding to the port number included in the packet. Thereafter, control proceeds to step 410.

[0074] In step 410, the security unit 208 determines whether or not to terminate the program. If it is determined that the program should be terminated, the program terminates. If not, control returns to step 400, and the above-described processing is repeated. The instruction to terminate the program is given, for example, by stopping the power supply to the exterior communication unit 120.

[0075] As described above, the in-vehicle system 102 (specifically, the in-vehicle device 122) can determine appropriate security rules according to the operating status of applications in the vehicle 104 in which it is installed and the connection status with external devices. Furthermore, the in-vehicle system 102 can dynamically control security rules according to changes in the operating status of applications in the vehicle 104 and the connection status with external devices. Therefore, the in-vehicle system 102 can take measures against cybersecurity attacks and improve the safety of communications with the outside world. Since the security rules can be determined by processing information obtainable within the vehicle 104 and information obtainable from a server, the security rules can be determined with low computational cost without executing resource-intensive processes such as machine learning.

[0076] In the above description, the in-vehicle device 122, which serves as a gateway, has the function of controlling security rules. However, this is not limiting. An element (e.g., the exterior communication unit 120) other than the in-vehicle device 122 that constitutes the in-vehicle system 102 may have the function of controlling security rules. Furthermore, the in-vehicle system 102 may have a dedicated ECU for controlling security rules. The exterior communication unit 120 and the dedicated ECU are also mounted on the vehicle 104 and are included in the in-vehicle device.

[0077] Specific examples are shown with reference to FIGS. 8 to 12 . [First Example] Referring to FIG. 8 , an example of directly determining application operation information included in the exterior communication parameter determination information used to generate security rules will be described. Here, it is assumed that the doors of the vehicle 104 are locked when the vehicle 104 is parked, and an application for opening and closing (i.e., unlocking and locking) the doors of the vehicle 104 is launched after authentication. The left side of FIG. 8 shows information when the vehicle 104 is parked and before authentication. The right side of FIG. 8 shows information when the vehicle 104 is parked and after authentication. For example, the user's smartphone is used for authentication, and the authentication ECU 128 (see FIG. 2 ) of the in-vehicle system 102 communicates with the user's smartphone via the exterior communication unit 120. For example, the authentication ECU 128 of the in-vehicle system 102 receives an authentication trigger signal transmitted from the user's smartphone.

[0078] The road-to-vehicle information includes application operation information. As described above, the in-vehicle device 122 can communicate with each component of the in-vehicle system 102 to acquire the application operation information included in the road-to-vehicle information. The vehicle 104 is parked, the doors are locked, and no applications are running. The application operation information included in the road-to-vehicle information is set to information indicating that no applications are running (e.g., "none"). The in-vehicle device 122 can determine that authentication has not yet occurred by the authentication ECU 128 not receiving an authentication trigger signal. The in-vehicle device 122 determines the application operation information in the exterior-vehicle communication parameter determination information to be "none" directly from the application operation information included in the road-to-vehicle information. As a result, the in-vehicle device 122 sets a communication filter threshold (i.e., an upper limit value) corresponding to the communication volume limit to Th1 as a security rule. Th1 is a small value that allows the in-vehicle device 122 to receive an authentication trigger signal from the outside (i.e., the user's smartphone) via the exterior-vehicle communication unit 120. Th1 may be set to an appropriate value in advance.

[0079] When the authentication ECU 128 receives the authentication trigger signal, authentication is performed, and the in-vehicle device 122 acquires information indicating post-authentication from the authentication ECU 128. The in-vehicle device 122 can identify that the vehicle 104 is parked and has been authenticated. The in-vehicle device 122 also attempts to communicate with each component of the in-vehicle system 102, identifies that a door opening / closing application is running, and sets information identifying the door opening / closing application (i.e., "door open / close") in the application operation information included in the road-to-vehicle information. The in-vehicle device 122 determines the application operation information in the exterior-vehicle communication parameter determination information as "door open / close" directly from the application operation information included in the road-to-vehicle information. While FIG. 8 illustrates a case in which the application name is used as the information identifying the application, numbers, symbols, or combinations thereof uniquely corresponding to each application may also be used. Based on the exterior-vehicle communication parameter determination information, the in-vehicle device 122 sets a communication filter threshold value Th2 for limiting communication volume as a security rule. Th2 is a value greater than Th1. For example, Th2 may be set to a value that allows reception of data (e.g., including a code specifying locking or unlocking) transmitted from the smartphone in response to a user's smartphone screen operation (e.g., touching a lock or unlock button displayed on a touch panel). Furthermore, assuming that applications other than the door opening / closing application are running, Th2 may be determined taking into consideration the amount of communication data generated by those applications. Note that if applications that can be started in the in-vehicle system 102 are associated with their external communication parameters (e.g., communication volume, destination IP address, destination port number, etc.) and stored in advance in the memory 142, security rules can be generated based on application operation information.

[0080] As a result, when data exceeding an expected communication volume (i.e., Th1) is transmitted to the in-vehicle system 102 while the vehicle 104 is parked and before authentication, the transmitted data can be filtered. Therefore, it becomes possible to take measures against, for example, DoS attacks.

[0081] [Second Example] Figures 9 and 10 show an example different from that shown in Figure 8 in which application operation information included in the exterior communication parameter determination information used to generate security rules is directly determined. Referring to Figure 9, it is assumed that a driving assistance service is provided by an edge server (not shown) in an edge service area 222 that includes an intersection, but that the service is not provided in a broader cloud service area 220 that includes the edge service area 222. In Figure 9, the current vehicle position is indicated by a solid line, and past positions are indicated by dashed lines. Vehicles 104B and 104A indicate the current and past vehicle positions of the same vehicle 104. The driving direction of each vehicle is indicated by an arrow.

[0082] Referring to FIG. 10 , the left side shows information when vehicle 104A is located on a straight road outside the edge service area 222. The right side of FIG. 10 shows information when vehicle 104B is located within the edge service area 222. The road-to-vehicle information includes application operation information. The in-vehicle device 122 of vehicle 104A, which is located on a straight road outside the edge service area 222, attempts to communicate with each component of the in-vehicle system 102, determines that no applications are running, and sets the application operation information included in the road-to-vehicle information to "none." As a result, the in-vehicle device 122 directly determines the application operation information in the out-of-vehicle communication parameter determination information to "none" from the application operation information included in the road-to-vehicle information. As a result, the in-vehicle device 122 sets the security rule to "no communication access permission," i.e., to not allow communication outside the vehicle.

[0083] The in-vehicle device 122 of the vehicle 104B, which is located on the right-turn line of an intersection within the edge service area 222, attempts to communicate with each component of the in-vehicle system 102, determines that the right-turn assist application is running, and sets information identifying the right-turn assist application (i.e., "right-turn assist") in the application operation information included in the road-to-vehicle information. As a result, the in-vehicle device 122 determines the application operation information in the out-of-vehicle communication parameter determination information to be "right-turn assist" directly from the application operation information included in the road-to-vehicle information. Based on this out-of-vehicle communication parameter determination information, the in-vehicle device 122 permits communication access with the edge server that provides the right-turn assist information service. That is, the in-vehicle device 122 generates a security rule that includes the IP address and port number of the edge server as the destination IP address and destination port number.

[0084] This allows the in-vehicle system 102 to be restricted from access from an unexpected destination when the vehicle 104 is located in an area not covered by the service. For example, it becomes possible to prevent access from a false destination (i.e., spoofing).

[0085] [Third Example] With reference to Figure 11, an example of indirectly determining connection information (i.e., information indicating the communication connection status with an external device) included in the exterior communication parameter determination information used to generate security rules will be described. Here, it is assumed that the position of the vehicle 104 changes as in the second example (see Figure 9). However, unlike the second example, in the third example, it is assumed that the in-vehicle system 102 communicates with a cloud server (not shown) in the cloud service area 220 outside the edge service area 222. Note that this example will only describe the connection information, and will omit information about operating applications.

[0086] Referring to FIG. 11 , the left side shows information when the vehicle 104A is located on a road within the cloud service area 220 but outside the edge service area 222, while the right side shows information when the vehicle 104B is located on a road within the edge service area 222. The road-vehicle information includes, for example, location information and map information, but does not include connection information. The on-board device 122 of the vehicle 104A can identify the vehicle location as the cloud service area 220 (i.e., cloud communication area) outside the edge service area 222 from the road-vehicle information (e.g., location information and map information). The on-board device 122 determines the connection information in the off-vehicle communication parameter determination information as cloud connection. As a result, the on-board device 122 sets a communication filter threshold (i.e., upper limit) corresponding to a communication volume limit to Th3 as a security rule. Th3 may be set in advance based on the services provided by the cloud server.

[0087] The on-board device 122 of the vehicle 104B can identify the vehicle position as being within the edge service region 222 (i.e., the edge server communication area) from the road-vehicle information. The on-board device 122 determines that the connection information in the exterior communication parameter determination information indicates an edge server connection. As a result, the on-board device 122 sets a communication filter threshold corresponding to a communication volume limit to Th4 as a security rule. Th4 may be set in advance based on the service provided by the edge server (e.g., a right-turn assistance service). In general, communication between an on-board system and an edge server that provides services in a narrow area, such as an intersection, is likely to have a higher real-time nature than communication with a cloud server that provides services in a wide area, since there are many dynamic objects, such as people, near the vehicle. Therefore, for example, Th4 is set to be greater than Th3.

[0088] As a result, when the vehicle 104 is located within a cloud communication area, if data exceeding the communication volume expected from the connection state is transmitted to the in-vehicle system 102, the transmitted data can be filtered. Therefore, it becomes possible to take measures against, for example, DoS attacks.

[0089] [Fourth Example] With reference to Figure 12, an example in which a security rule is generated when multiple applications are running will be described. Here, the position of the vehicle 104 changes in the same way as in the second example (see Figure 9). However, unlike the second example, in the fourth example, the in-vehicle system 102 runs a route guidance application and communicates with a cloud server in a cloud service area 220 that includes an edge service area 222.

[0090] Referring to FIG. 12 , the left side shows information when the vehicle 104A is located on a road within the cloud service area 220 but outside the edge service area 222, while the right side shows information when the vehicle 104B is located on a road within the edge service area 222. The road-to-vehicle information includes, for example, location information, map information, and application operation information. The in-vehicle device 122 of the vehicle 104A can identify the vehicle location as being in the cloud service area 220 (i.e., the cloud communication area) from the location information and map information included in the road-to-vehicle information. As a result, the in-vehicle device 122 sets the connection information in the exterior-vehicle communication parameter determination information to “cloud connection.” The in-vehicle device 122 also attempts to communicate with each component of the in-vehicle system 102, identifies that a route guidance application is running, and sets information identifying the route guidance application (i.e., “route guidance”) in the application operation information included in the road-to-vehicle information. As a result, the in-vehicle device 122 directly sets the application operation information in the exterior-vehicle communication parameter determination information to “route guidance” from the application operation information included in the road-to-vehicle information. Based on this exterior communication parameter determination information (i.e., the connection information is "cloud connection" and the application operation information is "route guidance"), the in-vehicle device 122 permits communication access with the cloud server that provides the route guidance service. That is, the in-vehicle device 122 generates a security rule in which the destination IP address and destination port number include the IP address and port number of the cloud server, and the communication filter threshold (i.e., upper limit) corresponding to the communication volume restriction is a (Mbps). a (Mbps) may be set in advance based on the route guidance service.

[0091] The in-vehicle device 122 of the vehicle 104B can identify the vehicle position as the right-turn line of an intersection within the edge service area 222 included in the cloud service area 220, based on the position information and map information included in the road-to-vehicle information. As a result, the in-vehicle device 122 sets "cloud connection" and "edge server connection" to the connection information in the exterior-vehicle communication parameter determination information. The in-vehicle device 122 also attempts to communicate with each component of the in-vehicle system 102, determines that a right-turn assist application is running in addition to the route guidance application that is already running, and sets "route guidance" and information specifying the right-turn assist application (i.e., "right-turn assist") to the application operation information included in the road-to-vehicle information. As a result, the in-vehicle device 122 sets "route guidance" and "right-turn assist" to the application operation information in the exterior-vehicle communication parameter determination information directly from the application operation information included in the road-to-vehicle information. Based on this exterior communication parameter determination information (i.e., the connection information is "cloud connection" and "edge server connection," and the application operation information is "route guidance" and "right turn assistance"), the in-vehicle device 122 permits communication access with the cloud server providing the route guidance service and the edge server providing the right turn assistance service. That is, the in-vehicle device 122 generates a security rule in which the destination IP address and destination port number include the IP addresses and port numbers of the cloud server and the edge server, and the communication filter threshold (i.e., upper limit) corresponding to the communication volume restriction is a + b (Mbps). b (Mbps) is a value preset based on the right turn assistance service.

[0092] As a result, when the vehicle 104 is located in a cloud communication area and data exceeding the communication volume expected from the connection state is transmitted to the in-vehicle system 102, the transmitted data can be filtered. Therefore, it is possible to take measures against, for example, DoS attacks. Also, when the vehicle 104 is located in an area where services are provided from a server, if the in-vehicle system 102 is accessed from an unexpected destination, the access can be restricted. For example, it is possible to take measures against access from a false destination (i.e., spoofing).

[0093] [Modification] An application running in the vehicle 104 may be newly downloaded from a server by the in-vehicle system 102. Also, an application already stored in the in-vehicle system 102 may be updated, i.e., the in-vehicle system 102 may download a new version of the application (hereinafter referred to as an updated application) from a server. In either case, this affects the generation of security rules in the in-vehicle system 102. A communication system according to a modification can handle this and efficiently generate security rules.

[0094] The communication system according to the modified example has the same configuration as the communication system 100 shown in Fig. 1, and the hardware configurations of the in-vehicle system, roadside unit, and server are respectively the same as those shown in Fig. 2, Fig. 3, and Fig. 4. However, unlike the communication system 100, the communication system according to the modified example has Fig. 13 instead of Fig. 5, which shows the functional configuration of the in-vehicle device of the in-vehicle system, and transmits applications (including updated applications) from the server 112. In the following, reference numerals shown in Figs. 1 to 4 will be referred to as appropriate.

[0095] [Functional Configuration of an In-Vehicle System According to a Modification] With reference to Figure 13, functions of an in-vehicle device 122A according to a modification, i.e., functions related to security rule control, will be described. The in-vehicle device 122A includes a roadside information acquisition unit 200, a road-vehicle information generation unit 202, an exterior-vehicle communication parameter determination information determination unit 204, a security rule generation unit 206, and a security rule table update unit 230. The exterior-vehicle communication unit 120 includes a security unit 208 that implements communication security such as a packet filter. Figure 13 is a configuration similar to Figure 5, with the addition of a security rule table update unit 230. In Figure 13, elements with the same reference numerals as those in Figure 5 have the same functions as those in Figure 5. Therefore, the following description will not be repeated and will mainly focus on the differences.

[0096] The functions of the security rule table update unit 230 are realized by the control unit 140 and memory 142 shown in FIG. 2 , similarly to the roadside information acquisition unit 200, the road-to-vehicle information generation unit 202, the exterior-vehicle communication parameter judgment information determination unit 204, and the security rule generation unit 206. The roadside information acquisition unit 200 acquires roadside information transmitted from the server 112 via the exterior-vehicle communication unit 120. The road-to-vehicle information generation unit 202 generates road-to-vehicle information by adding the roadside information acquired by the roadside information acquisition unit 200 to the vehicle information acquired from the exterior-vehicle communication unit 120, the autonomous driving ECU 126, the drive ECU 130, etc. The exterior-vehicle communication parameter judgment information determination unit 204 determines exterior-vehicle communication parameter judgment information from the road-to-vehicle information created by the road-to-vehicle information generation unit 202. The security rule generation unit 206 generates security rules from the exterior-vehicle communication parameter determination information determined by the exterior-vehicle communication parameter determination information determination unit 204, and outputs the generated security rules to the security unit 208 of the exterior-vehicle communication unit 120. The security rule generation unit 206 generates a security rule table for each application and stores it in the memory 142. The security unit 208 restricts communication performed by the exterior-vehicle communication unit 120 in accordance with the input security rules.

[0097] The security rule table update unit 230 determines whether a new application or an updated application has been downloaded from the server 112, and if it determines that a new application or an updated application has been downloaded, it updates the security rule table. Specifically, when a new application is downloaded, the security rule table update unit 230 determines the exterior communication parameters of the downloaded application from the communication specifications of the application, generates a security rule table, and stores it in the memory 142. When an updated application is downloaded, the security rule table update unit 230 determines the exterior communication parameters of the application from the communication specifications of the downloaded application, generates a security rule table, and overwrites the old version of the security rule table already stored in the memory 142.

[0098] Referring to FIG. 14 , examples of application specification information representing application specifications and a security table are shown. In FIG. 14 , the upper part shows application specification information for receiving right-turn assistance in a tabular format. The application specification information can be generated by analyzing an application downloaded by the in-vehicle device 122 from the server 112. The communication destination field indicates the party with which the entity executing the application (i.e., the in-vehicle system 102) communicates, and includes the IP address of the off-vehicle server (i.e., the server 112) and a port number for identifying the service. The communication content field indicates information transmitted from the server 112 as a service, and is information regarding objects (mainly dynamic objects) within a predetermined area including an intersection that the server 112 provides service to. The communication volume field includes information for calculating the communication volume transmitted from the server 112 to the in-vehicle system. Specifically, the information includes information indicating that a maximum of a (bits) is assigned to one object within a predetermined area, the upper limit of the number of objects to which data can be assigned is b, and the update period of information transmitted from the server 112 is c (ms).

[0099] The security rule table update unit 230 generates a security table as shown in the tabular form at the bottom of Fig. 14 from the application specification information. The communication access permission includes the IP address and port number of the external server (i.e., server 112) that is the communication destination. The communication filter threshold (i.e., upper limit) is a value calculated from the information included in the communication volume column of the application specification information.

[0100] As a result, when the downloaded application is run, the exterior-vehicle communication parameter determination information determination unit 204 determines exterior-vehicle communication parameter specifying information using the exterior-vehicle communication parameters newly stored in the memory 142. Based on the determined exterior-vehicle communication parameter specifying information, the security rule generation unit 206 generates new security rules using the new security rule table stored in the memory 142.

[0101] In some cases, the updated application is an important application and needs to be quickly started in place of the currently running application. In such cases, the currently running application is stopped quickly, the updated application is started, and the exterior-vehicle communication parameter determination information determiner 204 determines exterior-vehicle communication parameter identification information using the exterior-vehicle communication parameters newly stored in memory 142. This causes the security rule generator 206 to generate new security rules.

[0102] In this way, by updating the security rules (specifically, the security rule table) when an application (including a new application and an updated application) is downloaded, the security rules can be maintained in an appropriate state.

[0103] In the above description, the case where the application specification information is generated by the in-vehicle device 122 analyzing an application downloaded from the server 112 has been described, but the present invention is not limited to this. The application specification information may be transmitted from the server 112 to the in-vehicle device 122. The server 112 that transmits the application stores the application specifications, and therefore can generate and transmit the application specification information to the in-vehicle device 122. This reduces the load of the calculation process for determining security rules in the in-vehicle device 122.

[0104] For example, the server 112 transmits application specification information when transmitting new applications and updated applications to the in-vehicle system 102. By receiving specification information of applications executed in the in-vehicle system 102 from a device external to the in-vehicle system 102, the in-vehicle device 122 does not need to analyze the running applications to generate security rules. Therefore, the in-vehicle device 122 can further reduce the load of calculations required to determine security rules according to the operating status of the applications.

[0105] In the above description, the in-vehicle system 102 (specifically, the in-vehicle device 122) generates security rules and restricts communication with the outside of the vehicle in accordance with the security rules. However, this is not limited to this. An external device of the vehicle 104 (e.g., the server 112 or the roadside device 106) may generate security rules for the in-vehicle system 102 and transmit them to the in-vehicle system 102, and the in-vehicle system 102 may restrict communication with the outside of the vehicle in accordance with the security rules received. For example, the server 112 may include a generation unit that generates security rules that restrict communication with the outside of the vehicle 104 by the in-vehicle system 102 based on information about the outside of the vehicle 104 and road-vehicle information including vehicle information about the vehicle 104, and a communication unit that transmits the security rules to the in-vehicle system 102. This allows the in-vehicle system 102 to dynamically control communication with the outside of the vehicle in accordance with the security rules received from the server 112.

[0106] Furthermore, the communication unit 164 of the server 112 can receive vehicle information of the vehicle 104 from the in-vehicle system 102. The server 112 can further include a road-to-vehicle information generation unit that generates road-to-vehicle information by adding the vehicle information received by the communication unit 164 to roadside information, which is information about the outside of the vehicle 104, and a determination unit that determines outside-vehicle communication parameter determination information based on the road-to-vehicle information, and the generation unit can generate security rules based on the outside-vehicle communication parameter determination information. This can reduce the load of calculation processing for determining security rules in the in-vehicle system 102.

[0107] Each process (each function) in the above-described embodiments may be realized by a processing circuit (circuitry) including one or more processors. The processing circuit may be configured by an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the program read from the one or more memories, or according to a logic circuit designed in advance to execute each of the processes. The processor may be any of various processors suitable for computer control, such as a CPU, a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), or an ASIC (Application Specific Integrated Circuit).

[0108] Furthermore, a recording medium can be provided that stores a program that causes a computer to execute the processing of the in-vehicle system 102 (specifically, the processing executed by the in-vehicle device 122 (e.g., the processing shown in FIG. 6 )). The recording medium can be, for example, an optical disc (such as a DVD (Digital Versatile Disc)) or a removable semiconductor memory (such as a USB (Universal Serial Bus) memory). While a computer program can be transmitted via a communication line, the recording medium refers to a non-transitory recording medium. By having the computer installed in the vehicle load the program stored in the recording medium, the computer can transmit data that can be effectively used by a service provided by the external device, taking into account delay time and communication bandwidth, when the in-vehicle system uploads data to an external device such as a roadside device, as described above.

[0109] (Additional Note) In other words, the computer-readable non-transitory recording medium stores a computer program that causes a communication unit that communicates with an external device outside the vehicle to realize a security function that restricts communication with the external device in accordance with security rules generated based on vehicle information about the vehicle and road-vehicle information including roadside information, which is information about the outside of the vehicle, and the vehicle information includes at least one of application operation information that identifies an application running in the vehicle and connection information that indicates the communication connection status with the external device.

[0110] Although the present disclosure has been described above by explaining the embodiments, the above-described embodiments are merely examples, and the present disclosure is not limited to only the above-described embodiments. The scope of the present disclosure is defined by the claims in the scope of the claims, taking into consideration the description of the detailed description of the invention, and includes all modifications within the meaning and scope equivalent to the wording described therein.

[0111] 100 Communication system 102 In-vehicle system 104, 104A, 104B Vehicle 106 Roadside device 108 Base station 110 Network 112 Server 120 Exterior communication unit 122, 122A In-vehicle device 124, 154 Sensor 126 Autonomous driving ECU 128 Authentication ECU 130 Drive ECU 132, 158, 166 Bus 134 Drive unit 140, 152, 160 Control unit 142, 156, 162 Memory 150, 164 Communication unit 200 Roadside information acquisition unit 202 Road-vehicle information generation unit 204 Exterior communication parameter judgment information determination unit 206 Security rule generation unit 208 Security unit 220 Cloud service area 222 Edge service area 230 Security rule table update unit 300, 302, 304, 306, 308, 310, 312, 314, 400, 402, 404, 406, 408, 410 steps

Claims

1. An in-vehicle device mounted on a vehicle, causing a communication unit that communicates with an external device outside the vehicle to restrict communication with the external device in accordance with a security rule generated based on vehicle information of the vehicle and road-vehicle information including roadside information relating to the outside of the vehicle; The vehicle information includes at least one of application operation information that identifies an application running in the vehicle and connection information that indicates a communication connection state with the external device.

2. The in-vehicle device according to claim 1 , wherein the security rule is received from the external device.

3. a roadside information acquisition unit that acquires the roadside information from the external device; a road-to-vehicle information generating unit that generates the road-to-vehicle information by adding the vehicle information to the roadside information; a determination unit that determines exterior-vehicle communication parameter determination information based on the road-to-vehicle information; The in-vehicle device according to claim 1 , further comprising: a security rule generation unit that generates the security rule based on the exterior-vehicle communication parameter determination information.

4. The in-vehicle device according to claim 3 , wherein the road-to-vehicle information includes at least one of location information and map information in addition to at least one of the application operation information and the connection information.

5. The in-vehicle device according to claim 3 , wherein the exterior communication parameter determination information includes at least one of the application operation information and the connection information.

6. the exterior-vehicle communication parameter determination information includes at least the application operation information, The security rule generation unit When it is determined from the application operation information that no application is running, the security rule including a first communication filter threshold is generated; 6. The in-vehicle device according to claim 5, wherein when the application operation information identifies an application that controls door opening and closing of the vehicle, the in-vehicle device generates the security rule including a second communication filter threshold value that is greater than the first communication filter threshold value.

7. the exterior-vehicle communication parameter determination information includes at least the application operation information, The security rule generation unit If it is determined from the application operation information that no application is running, the security rule is generated that does not include access permission; The in-vehicle device according to claim 5 , wherein when it is determined from the application operation information that a driving assistance application is running, the in-vehicle device generates the security rule including access permission to an external device that provides a service to the driving assistance application.

8. the exterior-vehicle communication parameter determination information includes at least the connection information, The security rule generation unit When the position of the vehicle identified from the road-vehicle information is within a first area including a plurality of intersections, generating the security rule including a third communication filter threshold identified by the connection information corresponding to the first area; generating the security rule including a fourth communication filter threshold value specified by the connection information corresponding to a second area when the position of the vehicle specified from the road-vehicle information is within a second area that is smaller than the first area and includes one intersection; The in-vehicle device according to claim 5 , wherein the fourth communication filter threshold is greater than the third communication filter threshold.

9. the exterior-vehicle communication parameter determination information includes the application operation information, When the security rule generation unit determines that a plurality of applications are running in the vehicle based on the exterior-vehicle communication parameter determination information, generating a security rule table for each of the plurality of running applications; The in-vehicle device according to claim 5 , wherein the security rule is generated by integrating a plurality of the security rule tables.

10. The in-vehicle device according to claim 4 , wherein, if the road-to-vehicle information does not include the connection information, the determination unit generates connection information as the outside-vehicle communication parameter determination information from the road-to-vehicle information.

11. 3. The in-vehicle device according to claim 1, wherein the security rules include restrictions on at least one of an access frequency, a communication speed, a number of sessions, a number of SYN packets, a communication address of a communication destination, and a port number of a communication destination, related to communication by the communication unit.

12. further comprising an update unit that updates the security rules; 3. The in-vehicle device according to claim 1, wherein the update unit updates the security rules when a new application to be run in the vehicle or an update application for an application running in the vehicle is received by the communication unit.

13. new security rules corresponding to the new application or the updated application are received from the external device; The in-vehicle device according to claim 12 , wherein the update unit updates the security rule by using the new security rule.

14. a security rule generation unit that generates, for an on-board device mounted on a vehicle, a security rule that restricts communication between the on-board device and the outside of the vehicle, based on vehicle information of the vehicle and road-vehicle information including roadside information relating to the outside of the vehicle; a communication unit that transmits the security rule to the in-vehicle device, The vehicle information includes at least one of application operation information that identifies an application running in the vehicle and connection information that indicates a communication connection status with an external device outside the vehicle.

15. the communication unit receives the vehicle information from the in-vehicle device; a road-to-vehicle information generating unit that generates the road-to-vehicle information by adding the vehicle information received by the communication unit to the roadside information; a determination unit that determines outside-vehicle communication parameter determination information based on the road-to-vehicle information; The server computer according to claim 14 , wherein the security rule generation unit generates the security rule based on the exterior-vehicle communication parameter determination information.

16. an on-vehicle device according to claim 1 or 2; and the server computer of claim 14, The in-vehicle device causes the communication unit mounted on the vehicle to communicate with the server computer as the external device.

17. an on-vehicle device according to claim 1 or 2; and the server computer according to claim 15, The in-vehicle device causes the communication unit mounted on the vehicle to communicate with the server computer as the external device.

18. A control method for an in-vehicle system mounted on a vehicle, comprising: a step of causing an in-vehicle device included in the in-vehicle system to restrict communication with an external device outside the vehicle by a communication unit that communicates with the external device in accordance with a security rule generated based on vehicle information of the vehicle and road-vehicle information including roadside information relating to the outside of the vehicle; A control method, wherein the vehicle information includes at least one of application operation information that identifies an application running in the vehicle and connection information that indicates a communication connection state with the external device.

19. a computer mounted on the vehicle is caused to realize a function of restricting communication with an external device in a communication unit that communicates with the vehicle in accordance with a security rule generated based on road-vehicle information including vehicle information of the vehicle and roadside information relating to the outside of the vehicle; The vehicle information includes at least one of application operation information that identifies an application running in the vehicle and connection information that indicates a communication connection state with the external device.