Charge control method, charge control device, and program

Abstract

A charge control method according to the present disclosure is used in a charge control device communicably connected to both an electric vehicle and a charging facility. On the basis of software information including at least firmware information for an electronic control device installed in an electric vehicle, it is determined whether or not there is a security risk for a plurality of travel functions of the electric vehicle as caused by the firmware, and, when at least one travel function having a security risk is disabled, it is determined whether or not it is possible to travel via another travel function and to avoid the security risk of the electric vehicle. When at least one travel function is disabled, the vehicle can travel via another travel function, and the security risk can be avoided, a power supply device of a charging facility is permitted to supply power to the electric vehicle with the at least one travel function having been disabled.

Description

Charging control method, charging control device and program

[0001] The present disclosure relates to a charge control method, a charge control device, and a program.

[0002] 2. Description of the Related Art Conventionally, there are known techniques for protecting a plurality of on-board computers, such as ECUs (Electronic Control Units) for controlling a vehicle, from security risks that affect vehicle control, such as unauthorized communications.

[0003] JP 2020-065243 A JP 2020-125036 A

[0004] In such circumstances, if the latest update patches are not applied to the onboard computer, there is a risk that unaddressed security risks could be exploited to illegally manipulate the vehicle's functions, threatening the safety of the vehicle and the driver.

[0005] One of the problems that the present disclosure aims to solve is to protect electric vehicles that are connected to charging equipment when power is supplied from security risks that arise from the electric vehicles.

[0006] A charging control method according to one aspect of the present disclosure is a charging control method used in a charging control device that is communicatively connected to both an electric vehicle and a power supply device for charging the electric vehicle, and includes: a first determination based on software information including at least firmware information of an electronic control device mounted on the electric vehicle to determine whether or not there is a security risk to multiple driving functions of the electric vehicle due to the firmware of the electronic control device; and, if the result of the first determination indicates that there is a security risk, a second determination is made to determine whether or not it is possible to disable at least one driving function of the multiple driving functions that poses the security risk and then drive the electric vehicle using another driving function of the multiple driving functions and avoid the security risk of the electric vehicle; and, if it is possible to disable at least one driving function and then drive the electric vehicle using the other driving function and avoid the security risk, the at least one driving function is disabled and then the power supply device is permitted to supply power to the electric vehicle.

[0007] According to the present disclosure, an electric vehicle connected to charging equipment during power supply can be protected from security risks caused by the electric vehicle.

[0008] FIG. 1 is a diagram illustrating an example of the configuration of a charging system according to a first embodiment. FIG. 2 is a diagram illustrating an example of the configuration of a charging facility according to the first embodiment. FIG. 3 is a diagram illustrating an example of the configuration of a charging station management terminal according to the first embodiment. FIG. 4 is a diagram illustrating an example of the configuration of a charging station management server according to the first embodiment. FIG. 5 is a diagram illustrating an example of the configuration of a charging control unit according to the first embodiment. FIG. 6 is a diagram illustrating an example of the configuration of an electric vehicle according to the first embodiment. FIG. 7 is a diagram illustrating an example of the configuration of a vehicle management server according to the first embodiment. FIG. 8 is a diagram illustrating an example of vehicle software configuration information according to the first embodiment. FIG. 9 is a diagram illustrating an example of vehicle management information according to the first embodiment. FIG. 10A is a flowchart illustrating an example of a power supply process executed in the charging control unit according to the first embodiment when a vehicle detection is used as a trigger. FIG. 10B is a flowchart illustrating an example of a power supply process executed in the charging control unit according to the first embodiment when a vehicle detection is used as a trigger. FIG. 11 is a flowchart illustrating an example of a verification process executed in the charging control unit according to the first embodiment for reconnecting a power supply device to an equipment communication network. FIG. 12 is a sequence diagram illustrating an example of a power supply process executed in the charging system according to the first embodiment when a vehicle detection is used as a trigger. FIG. 13 is a sequence diagram showing an example of a verification process for reconnecting a power supply device to an equipment communication network, which is executed in the charging system according to the first embodiment. FIG. 14 is a diagram showing an example of the configuration of a charging system according to the second embodiment. FIG. 15 is a flowchart showing an example of a power supply process executed in a charging control unit and a reservation management unit according to the third embodiment when a charging reservation is used as a trigger. FIG. 16 is a sequence diagram showing an example of a power supply process executed in the charging system according to the third embodiment when a charging reservation is used as a trigger. FIG. 17 is a diagram showing an example of the configuration of a charging facility according to a fourth embodiment. FIG. 18 is a diagram showing an example of the configuration of a charging control unit according to the fourth embodiment. FIG. 19 is a diagram showing an example of vehicle software configuration information according to the fourth embodiment. FIG. 20 is a diagram showing an example of vehicle management information according to the fourth embodiment.Fig. 21 is a diagram showing an example of a corresponding function of an ECU related to automatic driving control according to the fourth embodiment. Fig. 22 is a diagram showing an example of a corresponding function of an ECU related to manual driving control according to the fourth embodiment. Fig. 23 is a flowchart showing an example of a power supply process executed in a charge control unit according to the fourth embodiment when triggered by vehicle detection. Fig. 24 is a sequence diagram showing an example of a power supply process executed in a charging system according to the fourth embodiment when triggered by vehicle detection. Fig. 25 is a flowchart showing an example of a power supply process executed in a charge control unit and a reservation management unit according to the fifth embodiment when triggered by a charge reservation. Fig. 26 is a sequence diagram showing an example of a power supply process executed in a charging system according to the fifth embodiment when triggered by a charge reservation.

[0009] Hereinafter, embodiments of a charging system, a charging control method, a charging control device, a program, and a recording medium according to the present disclosure will be described with reference to the drawings.

[0010] In the description of the present disclosure, components having the same or substantially the same functions as those described above with respect to the previously-mentioned drawings may be given the same reference numerals, and descriptions thereof may be omitted as appropriate. Furthermore, even when the same or substantially the same parts are shown, the dimensions and proportions may be different depending on the drawing. Furthermore, for example, in order to ensure the visibility of the drawings, reference numerals may be given to only the main components in the description of each drawing, and reference numerals may not be given to components having the same or substantially the same functions as those described above with respect to the previously-mentioned drawings.

[0011] In the description of the present disclosure, components having the same or substantially the same functions may be distinguished by adding an alphanumeric character to the end of the reference symbol. Alternatively, when multiple components having the same or substantially the same functions are not distinguished, they may be collectively described by omitting the alphanumeric character at the end of the reference symbol.

[0012] First Embodiment Conventionally, there is known a technique for protecting a plurality of on-board computers, such as ECUs (Electronic Control Units) for controlling a vehicle, from security risks that affect vehicle control, such as unauthorized communications.

[0013] In this environment, vehicles that run on battery power, such as electric vehicles, are connected to charging equipment via a charging cable, for example. In some cases, charging control is performed by communicating via the charging cable. Therefore, if there is a security risk in the onboard computer, the charging equipment may also be affected.

[0014] Therefore, in this embodiment, a charging system that can protect charging equipment connected to an electric vehicle during power supply from security risks caused by the electric vehicle will be described.

[0015] 1 is a diagram illustrating an example of the configuration of a charging system 1a according to a first embodiment. The charging system 1a includes a charging facility 3, a charging station management server 4, an electric vehicle 5, and a vehicle management server 6. Here, the charging system 1a according to the first embodiment is an example of a charging system 1 according to an embodiment of the present disclosure.

[0016] The charging facility 3, the charging station management server 4, the electric vehicle 5, and the vehicle management server 6 are each connected to an external network N so as to be able to communicate with each other.

[0017] The charging equipment 3 is configured to be capable of charging the battery mounted on the electric vehicle 5 with power. The charging equipment 3 is installed in a charging station and provides a charging service to the electric vehicle 5 that visits the charging station. In other words, in the present disclosure, a charging station is a facility where the charging equipment 3 is installed and where the electric vehicle 5 that visits can be charged. This charging station may be installed as a facility dedicated to charging the electric vehicle 5, or may be installed as a facility where the charging equipment 3 is installed adjacent to another facility such as a parking lot where the electric vehicle 5 can be parked.

[0018] 2 is a diagram showing an example of the configuration of the charging facility 3 according to the first embodiment. The charging facility 3 includes a charging station management terminal 31 and a plurality of power supply devices 32.

[0019] 2 illustrates, as the multiple power supply devices 32, power supply devices 32a to 32i connected to an equipment communication network 33 and power supply devices 32j to 32n connected to a verification network 34. Here, the equipment communication network 33 according to the embodiment is an example of a communication network. Note that the number of power supply devices 32 provided in the charging equipment 3 can be changed as appropriate and may be one or two or more.

[0020] Here, the equipment communication network 33 is a network for communication between the charging station management terminal 31 and each of the plurality of power supply devices 32. The verification network 34 is a network separated from the equipment communication network 33, and is a network for verifying whether the power supply devices 32 connected to electric vehicles 5 that pose a security risk have been tampered with. Note that while it is preferable that the equipment communication network 33 and the verification network 34 are physically isolated from each other by hardware, a configuration in which they are isolated by software can also be used.

[0021] The charging station management terminal 31 is connected to the charging station management server 4 via an external network N. The charging station management terminal 31 is connected to each of the plurality of power supply devices 32 via an equipment communication network 33 or a verification network 34.

[0022] 3 is a diagram showing an example of the configuration of the charging station management terminal 31 according to the first embodiment. The charging station management terminal 31 has a processor and a memory and has a hardware configuration using a typical computer. The processor executes a program loaded in a memory such as a RAM (Random Access Memory) to implement a detection unit 311, a first communication control unit 312, and a power supply device management unit 313. As the processor, various types of processors such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), an ASIC (Application Specific Integrated Circuit), and an FPGA (Field Programmable Gate Array) can be used as appropriate. As the memory, various recording media and recording devices such as RAM, ROM (Read Only Memory), HDD (Hard Disk Drive), SSD (Solid State Drive), and Flash memory can be used as appropriate.

[0023] The detection unit 311 of the charging station management terminal 31 detects the electric vehicle 5 to be charged. When the first communication control unit 312 detects the electric vehicle 5 to be charged, it outputs a detection notification to the charging station management server 4. The detection notification includes vehicle identification information for identifying the detected electric vehicle 5.

[0024] For example, the detection unit 311 may detect the electric vehicle 5 to be charged based on an image captured within the charging station. For example, the detection unit 311 acquires an image of at least the license plate of the electric vehicle 5 and performs image analysis on the acquired image, such as character recognition, to acquire the license plate number of the electric vehicle 5 as vehicle identification information. Note that the image analysis of the acquired image may be performed outside the charging station management terminal 31, such as on the charging station management server 4. For example, the image analysis may be performed by edge detection processing or may be performed using a machine learning model such as a convolutional neural network (CNN). When using a machine learning model, parameters of the machine learning model may be determined to output, for example, feature quantities related to the vehicle in response to input of an image including the vehicle. The feature quantities related to the vehicle may be, for example, at least one of the shape and size of the vehicle, the license plate number, and the body color of the vehicle, but may also be other information. Note that the image analysis may be performed using a model other than the machine learning model.

[0025] The charging system 1a according to the embodiment may further include a camera configured to capture an image of at least the license plate of the electric vehicle 5. The camera may be located in the charging station where the power supply device 32 is installed, such as at the power supply device 32 or the vehicle entrance / exit gate of the charging station. Alternatively, the charging system 1a according to the embodiment may be configured to acquire images from an external camera configured to capture an image of at least the license plate of the electric vehicle 5. As the external camera, for example, a surveillance camera installed at the installation location of the power supply device 32 can be used as appropriate, for example, when the charging equipment 3 is installed in a parking lot.

[0026] In order to obtain an image of at least the license plate of the electric vehicle 5, the camera may be configured to capture an image, for example, when the electric vehicle 5 stops in a predetermined area depending on the position of the power supply device 32, when the power supply device 32 is operated, or when the electric vehicle 5 is connected via the connection member 301. Furthermore, the charging system 1a may be separately provided with a sensor configured to be able to detect the electric vehicle 5 in a predetermined area depending on the position of the power supply device 32. In addition, when the camera is configured to obtain an image of at least the license plate of the electric vehicle 5 in response to the electric vehicle 5 being connected via the connection member 301, it is assumed that power and communication between the electric vehicle 5 and the power supply device 32 are cut off at the stage when the electric vehicle 5 is connected via the connection member 301.

[0027] Here, the connection member 301 is a member for supplying power from the power supply device 32 of the charging facility 3 to the electric vehicle 5 and for communication between the power supply device 32 and the electric vehicle 5. For example, the power supply device 32 and the electric vehicle 5 are detachably connected using the connection member 301. The connection member 301 is configured using elements such as a cable and a connector. The connection member 301 may be a member belonging to either the charging facility 3 or the electric vehicle 5. The power supply from the power supply device 32 to the electric vehicle 5 and the communication between the power supply device 32 and the electric vehicle 5 are realized, for example, by a common connection member 301, but may also be realized by different connection members 301 of different systems. The communication between the power supply device 32 and the electric vehicle 5 is not limited to wired communication via the connection member 301, and may also be performed wirelessly. Note that communication using various standards, such as 4G, 5G, 6G, Wi-Fi (registered trademark), Bluetooth (registered trademark), and infrared communication, can be used as the wireless communication.

[0028] Furthermore, for example, the detection unit 311 may detect the electric vehicle 5 to be charged based on a user's check-in at a charging station. In this case, the detection unit 311 may acquire authentication information at the time of check-in as vehicle identification information. Here, checking in at a charging station is a user authentication process performed using a card issued to a user who has registered with the charging service, an application program installed on a mobile device used by the user such as a smartphone, or an in-vehicle terminal such as a car navigation system. Furthermore, the authentication information as vehicle identification information includes, for example, at least one of user information entered at the time of check-in and user information used for authentication at the time of check-in. Furthermore, the authentication information as vehicle identification information includes vehicle information for identifying the electric vehicle 5 entered by the user at the time of registration with the charging service, any time after registration, or at the time of check-in. Note that one user may own multiple electric vehicles 5. Therefore, for example, the user may specify the electric vehicle 5 to be charged, for example, at the time of check-in.

[0029] The power supply device management unit 313 operates the power supply device 32 to which the electric vehicle 5 is connected in accordance with an instruction from the charging station management server 4 .

[0030] The power supply device management unit 313 degrades the functions of the charging facility 3 in accordance with an instruction from the charging station management server 4. For example, the power supply device management unit 313 disconnects the target power supply device 32 from the facility communication network 33. For example, the power supply device management unit 313 connects the target power supply device 32 to the verification network 34. For example, the power supply device management unit 313 reconnects the target power supply device 32 to the facility communication network 33. As an example, if the first verification by the first verification unit 416 does not show any unauthorized tampering, the power supply device management unit 313 reconnects the power supply device 32 to the facility communication network 33. As an example, even if the first verification shows any unauthorized tampering, the power supply device management unit 313 reconnects the power supply device 32 to the facility communication network 33 if the second verification shows no unauthorized operation. In other words, the power supply device management unit 313 switches the connection destination of the target power supply device 32 between the facility communication network 33 and the verification network 34. For example, the power supply device management unit 313 limits the power supply speed. For example, the power supply device management unit 313 limits the vehicle communication function for communicating with the electric vehicle 5 via the connection member 301. Here, limiting the vehicle communication function means, for example, limiting communication between the electric vehicle 5 and the outside of the charging system 1a.

[0031] Each of the plurality of power supply devices 32 is detachably connected to the electric vehicle 5 via a connection member 301, and is configured to be able to supply power to the connected electric vehicle 5 and communicate with the electric vehicle 5. Each of the plurality of power supply devices 32 has a communication interface for connecting to the facility communication network 33, a communication interface for connecting to the verification network 34, a connection interface for connecting to the electric vehicle 5 via the connection member 301, a connection interface for connecting to a power supply device or an external power source, and a control device for controlling the operation of the device itself.

[0032] The control device of the power supply device 32 has a processor and memory, and is configured as hardware using a normal computer. The processor executes programs loaded into memory such as RAM to realize the functions of the power supply device 32. As the processor, various processors such as a CPU, GPU, ASIC, and FPGA can be used as appropriate. As the memory, various recording media and recording devices such as RAM, ROM, HDD, SSD, and flash memory can be used as appropriate.

[0033] As an example, the power supply device 32 supplies power to the electric vehicle 5 connected to the power supply device 32 under the control of the power supply device management unit 313 of the charging station management terminal 31 .

[0034] The charging station management server 4 is communicatively connected to each of the charging facility 3, the electric vehicle 5, and the vehicle management server 6 via an external network N. The charging station management server 4 is configured to be able to control the power supply to the electric vehicle 5 by the charging facility 3. The charging station management server 4 is installed, for example, at a location different from the charging station, but may also be installed in the charging station together with the charging facility 3. The charging facility 3 and the charging station management server 4 may also be configured integrally. Alternatively, some of the functions of the charging station management server 4, such as the charging control unit 41, may be implemented by the charging station management terminal 31 of the charging facility 3. Similarly, some of the functions of the charging station management terminal 31 may also be implemented in the charging station management server 4. The charging station management server 4 is operated, for example, by the same operator as the charging facility 3, but may also be operated by a different operator.

[0035] 4 is a diagram showing an example of the configuration of the charging station management server 4 according to the first embodiment. The charging station management server 4 includes a charging control unit 41, a first storage unit 42, a reservation management unit 43, a display unit 44, and a first communication unit 45.

[0036] The charging station management server 4 has a processor and a memory and has a hardware configuration using a normal computer. The processor executes a program loaded into a memory such as a RAM to implement the charging control unit 41 and the reservation management unit 43. As the processor, various types of processors such as a CPU, GPU, ASIC, and FPGA can be used as appropriate. As the memory, various types of recording media and recording devices such as a RAM, ROM, HDD, SSD, and Flash memory can be used as appropriate. Note that the charging control unit 41 and the reservation management unit 43 may each have a processor and a memory and have a hardware configuration using a normal computer as an independent device.

[0037] The charging control unit 41 performs charging control based on the security risk of the electric vehicle 5 to be charged. Fig. 5 is a diagram showing an example of the configuration of the charging control unit 41 according to the first embodiment. The charging control unit 41 has a first determination unit 411, a second determination unit 412, a charging control instruction unit 413, a storage control unit 414, a second communication control unit 415, a first verification unit 416, and a second verification unit 417.

[0038] The first determination unit 411 performs a first determination to determine whether or not there is a security risk or threat to the charging function of the electric vehicle 5. As an example, the first determination includes determining whether or not there is a security risk to the charging function of the electric vehicle 5 caused by the ECU FW (firmware) of the ECU, based on vehicle software configuration information (see FIG. 7 ) that includes at least the ECU FW version of the ECU mounted on the electric vehicle 5.

[0039] The second determination unit 412 performs a second determination to determine whether charging is possible and whether a security risk to the charging function needs to be avoided. As an example, the second determination includes a determination of whether a security risk in the charging facility 3 can be avoided by degrading the functions of the power supply device 32, based on vehicle software configuration information including at least the ECUFW version of the ECU mounted in the electric vehicle 5. As an example, the second determination includes a determination of whether the security risk is a first type of security risk that can be avoided in the charging facility 3 by disconnecting the power supply device 32 from the facility communication network 33.

[0040] The first determination unit 411 and the second determination unit 412 may be configured as an integrated unit. Here, the first determination unit 411 is an example of a determination unit that performs a first determination. Similarly, the second determination unit 412 is an example of a determination unit that performs a second determination.

[0041] The charging control instruction unit 413 outputs a charging control instruction according to the determination results of the first determination unit 411 and the second determination unit 412 and the verification results of the first verification unit 416 and the second verification unit 417 to the charging station management terminal 31. Here, the charging control instruction unit 413 is an example of a control unit.

[0042] As an example, when the result of the first determination indicates a security risk, the charge control instruction unit 413 determines, based on the result of the second determination, a degeneration mode for degenerating the functions of the power supply device 32. Furthermore, the charge control instruction unit 413 controls the power supply to the electric vehicle 5 by the power supply device 32 in the determined degeneration mode.

[0043] As an example, when the security risk is a first type of security risk such as “malware,” the charging control instruction unit 413 controls the power supply to the electric vehicle 5 in a degenerate manner in which the power supply device 21 is disconnected from the facility communication network 33.

[0044] The storage control unit 414 controls the first storage unit 42 and stores various information in the first storage unit 42. For example, the storage control unit 414 stores in the first storage unit 42 vehicle software configuration information (see FIG. 7 ) and vehicle management information (see FIG. 8 ) for the target electric vehicle 5 acquired from the vehicle management server 6.

[0045] The second communication control unit 415 controls the first communication unit 45 to communicate with the outside of the charging station management server 4 .

[0046] The first verification unit 416 and the second verification unit 417 verify whether the power supply device 32 can be safely reconnected to the facility communication network 33 after the power supply device 32 is disconnected from the facility communication network 33 to avoid security risks to the charging facility 3. For example, the first verification unit 416 performs a memory / file system check on the target power supply device 32 connected to the verification network 34 to determine whether any unauthorized program or other tampering has been detected in the target power supply device 32. As an example, the first verification unit 416 performs a first verification to verify whether any unauthorized tampering has been detected in the power supply device 32 disconnected from the facility communication network 33. Here, the memory / file system check refers to checking for memory defects in the power supply device 32 and the integrity and corruption of various programs and data, such as firmware, stored in the memory. For example, the second verification unit 417 performs a second verification to verify whether any unauthorized communication or operation has occurred in the target power supply device 32 connected to the verification network 34. For example, if unauthorized alteration is found in the first verification, the second verification unit 417 rolls back the power supply device 32 and further verifies whether or not there is unauthorized operation. Note that the first verification unit 416 and the second verification unit 417 may be configured integrally.

[0047] The first storage unit 42 stores various data and programs used by the charging station management server 4. The first storage unit 42 may be configured using various recording media or recording devices such as a ROM, HDD, SSD, or flash memory as appropriate as a hardware configuration. The first storage unit 42 may further be provided with a RAM for temporarily storing data during work.

[0048] The reservation management unit 43 manages charging reservations made by the driver (user of the electric vehicle 5). As an example, the reservation management unit 43 accepts charging reservations from the electric vehicle 5 or a mobile terminal used by the driver via the external network N. The reservation management unit 43 also supplies reservation information related to the accepted charging reservations to the charging control unit 41.

[0049] The display unit 44 presents to the user of the charging station management server 4 information on the charging schedule, security risks related to the charging function of the electric vehicle 5, and information necessary for monitoring security risks or power supply of the charging equipment 3. As the display unit 44, a liquid crystal display (LCD), an organic electroluminescence (EL) display, a projector, or the like can be used as appropriate. The display unit 44 may be configured as a touch panel display. In this case, the touch panel of the display unit 44 is provided, for example, on the surface of the display unit 44 and outputs information according to the position touched. The touch panel of the display unit 44 is an example of an input interface that acquires operation inputs from the user of the charging station management server 4.

[0050] The charging station management server 4 may be provided with a keyboard or the like, instead of a touch panel, as an input interface for acquiring operation inputs from the user of the charging station management server 4 .

[0051] The first communication unit 45 communicates with the outside of the charging station management server 4 via an external network N. The first communication unit 45 has, as a hardware configuration, a communication circuit for wired or wireless communication. As the communication circuit for wireless communication, a communication circuit compatible with various standards such as 4G, 5G, 6G, Wi-Fi (registered trademark), Bluetooth (registered trademark), and infrared communication can be appropriately used.

[0052] The electric vehicle 5 is an example of a mobile object powered by power from an onboard battery. The mobile object is not limited to electric vehicles such as passenger cars, trucks, and motorcycles, but may also be an electric bicycle, an electric kick scooter, or an electric wheelchair. The mobile object is not limited to passenger vehicles, and may also be a cargo vehicle such as a luggage transport vehicle. The electric vehicle 5 is communicably connected to the charging station management server 4 and the vehicle management server 6 via an external network N. The electric vehicle 5 is also connected to the charging facility 3 via a connection member 301 so as to be capable of charging and communicating.

[0053] 6 is a diagram showing an example of the configuration of an electric vehicle 5 according to the first embodiment. The electric vehicle 5 is equipped with an in-vehicle network 51 including a controller area network (CAN) and Ethernet (registered trademark). The electric vehicle 5 has an external communication interface (I / F) 53, a power supply interface (I / F) 54, and a plurality of electronic control units (ECUs) 55. The external communication interface 53, the power supply interface 54, and the plurality of ECUs 55 are communicably connected to the in-vehicle network 51.

[0054] The external communication interface 53 is an interface for communicating with the outside of the electric vehicle 5 via an external network N. The external communication interface 53 includes communication circuits compatible with various standards such as 4G, 5G, 6G, Wi-Fi (registered trademark), Bluetooth (registered trademark), and infrared communication.

[0055] The power supply interface 54 is an interface for connecting to the power supply device 32 via the connection member 301. As an example, the power supply interface 54 includes a fitting member that fits with the connector of the connection member 301.

[0056] The multiple ECUs 55 control each function of the electric vehicle 5, such as power steering control, accelerator control, brake control, charging control, and autonomous driving control. Note that the control of each function of the electric vehicle 5 is realized by at least one ECU, and may be realized, for example, by cooperation between the multiple ECUs 55. Also, the control of multiple functions of the electric vehicle 5 may be realized by a single ECU 55. FIG. 6 illustrates ECUs 55a, 55b, 55c, ..., 55n as examples of the multiple ECUs 55. Note that the number of ECUs 55 provided in the electric vehicle 5 can be designed as desired. Here, each of the multiple ECUs 55 is an example of at least one electronic control device.

[0057] The vehicle management server 6 is communicatively connected to each of the charging station management server 4 and the electric vehicle 5 via the external network N. The vehicle management server 6 is configured to be able to manage information related to the electric vehicle 5. The vehicle management server 6 may be installed in the charging station similar to the charging facility 3, or may be installed together with the charging station management server 4, or may be installed in a different location from these. Furthermore, the vehicle management server 6 is operated by, for example, a different operator from the charging facility 3 and the charging station management server 4, but may also be operated by the same operator as at least one of them. Furthermore, the charging station management server 4 and the vehicle management server 6 may be configured as an integrated unit.

[0058] 7 is a diagram showing an example of the configuration of the vehicle management server 6 according to the first embodiment. The vehicle management server 6 includes an information search unit 61, a second communication unit 62, and a second storage unit 63.

[0059] The information search unit 61 has a processor and memory, and has a hardware configuration using a normal computer. The processor executes a program loaded into a memory such as a RAM, thereby realizing the functions of the information search unit 61. As the processor, various processors such as a CPU, GPU, ASIC, and FPGA can be used as appropriate. As the memory, various recording media and recording devices such as a RAM, ROM, HDD, SSD, and flash memory can be used as appropriate.

[0060] As an example, the information search unit 61 receives search information such as vehicle identification information from the charging station management server 4 via the second communication unit 62 .

[0061] As an example, the information search unit 61 outputs search results such as vehicle software configuration information 71 a (see FIG. 8 ) and vehicle management information 72 a (see FIG. 9 ) for the electric vehicle 5 connected to the power supply device 32 via the second communication unit 62 to the charging station management server 4.

[0062] As an example, the information search unit 61 is configured to output vehicle management information 72a of the electric vehicle 5 connected to the power supply device 32 and vehicle software configuration information 71a of the electric vehicle 5 in response to a request from the charging station management server 4. For example, the information search unit 61 outputs the vehicle management information 72a of the electric vehicle 5 corresponding to the vehicle identification information from the charging station management server 4, such as a vehicle identifier 721 and owner information 723. Furthermore, the information search unit 61 identifies a vehicle model 724 and a vehicle firmware (FW) version 725 of the electric vehicle 5 connected to the power supply device 32 based on the vehicle identification information and the vehicle management information 72a. Furthermore, the information search unit 61 outputs vehicle software configuration information 71a corresponding to the identified vehicle model 724 and vehicle FW version 725, such as an ECU ID 713, a relevant function 714, an ECUFW version 715, and details 716.

[0063] The second communication unit 62 communicates with the outside of the vehicle management server 6 via an external network N. The second communication unit 62 has a hardware configuration including a communication circuit for wired or wireless communication. As the communication circuit for wireless communication, a communication circuit compatible with various standards such as 4G, 5G, 6G, Wi-Fi (registered trademark), Bluetooth (registered trademark), and infrared communication can be used as appropriate.

[0064] The second storage unit 63 stores various data and programs used by the vehicle management server 6. For example, the second storage unit 63 stores vehicle software configuration information 71a (see FIG. 8) for each vehicle model and vehicle management information 72a (see FIG. 9) for each vehicle. The second storage unit 63 may appropriately use various recording media and recording devices, such as ROM, HDD, SSD, and flash memory, as its hardware configuration. The second storage unit 63 may further be provided with RAM for temporarily storing data being worked on.

[0065] The vehicle management information 72 a may be stored in the first storage unit 42 of the charging station management server 4. The vehicle management information 72 a may also store information necessary for establishing communication between the power supply device 32 and the electric vehicle 5.

[0066] Here, the vehicle software configuration information 71a and the vehicle management information 72a according to this embodiment will be described with reference to the drawings.

[0067] FIG. 8 is a diagram illustrating an example of vehicle software configuration information 71a according to the first embodiment. The vehicle software configuration information 71a includes fields such as a vehicle model 711, a vehicle firmware version 712, an ECU ID 713, a corresponding ECU function 714, an ECU firmware version 715, and details 716. The vehicle software configuration information 71a is information indicating the latest vehicle firmware for a certain vehicle model 711 and the functions and firmware versions of each ECU installed in the electric vehicle 5 included in the firmware. The vehicle software configuration information 71a may also include update information such as release notes, which can be used to assess security risks when the vehicle software configuration information 71a is acquired. Here, the vehicle software configuration information 71a is an example of software information that includes at least firmware information of an electronic control unit. Similarly, the ECU firmware version 715 is an example of firmware information of an electronic control unit.

[0068] In the example of FIG. 8 , vehicle software configuration information 71a stores vehicle firmware versions 712 of "Ver. 1.0" and "Ver. 1.1" for vehicle model 711 of "Car-Model01," and vehicle firmware versions 712 of "Ver. 1.0" and "Ver. 2.0" for vehicle model 711 of "Car-Model02." For example, "Ver. 1.1" for "Car-Model01" and "Ver. 2.0" for "Car-Model02" are vehicle firmware versions 712 indicating the latest firmware for each vehicle model. In the example of FIG. 8 , for "Ver. 1.1," which is the latest firmware for "Car-Model01," ECU ID 713, which is information that uniquely identifies the associated ECU, is "ECU-001," "ECU-002," "ECU-003," and so on. The corresponding functions 714 of these ECUs are "power steering," "acceleration control," "charging control," etc. The ECUFW versions 715 of these ECUs are "Ver. 1.0.0," "Ver. 1.0.1," "Ver. 1.1.0," etc. The details 716 of these ECUs store update contents such as release notes, such as "First release," "Improved functionality," and "Security update: Addressed malware infection issue (CVW-2023-XXXX1)."

[0069] 9 is a diagram showing an example of vehicle management information 72a according to the first embodiment. The vehicle management information 72a includes items such as a vehicle identifier 721, a license plate number 722, owner information 723, a vehicle model 724, and a vehicle firmware version 725. The vehicle management information 72a is information indicating the owner of a vehicle and the current vehicle firmware version. The vehicle management information 72a is collected, for example, when a user registers for a charging service provided by the charging facility 3, or is updated when the firmware of the electric vehicle 5 is updated. The vehicle management information 72a may also include other information such as the shape, size, and body color of the electric vehicle 5.

[0070] In the example of FIG. 9 , information about each electric vehicle 5 uniquely identified by a vehicle identifier 721 such as "CAR-A01," "CAR-A02," "CAR-A03," and so on is stored as the vehicle management information 72a. For example, for the electric vehicle 5 with the vehicle identifier 721 of "CAR-A01," the vehicle number 722 displayed on the license plate, owner information 723 indicating the owner, vehicle model 724, and vehicle firmware version 725 indicating the vehicle firmware currently applied to the electric vehicle 5 are registered as "12-34," "Owner001," "Car-Model01," and "Ver. 1.0," respectively. Here, the number 722 in the vehicle management information 72a is an example of vehicle identification information transmitted from the charging station management server 4 to the vehicle management server 6. Note that, if it can be identified by the vehicle management server 6, other vehicle management information 72a other than the number 722 may be used as vehicle identification information.

[0071] For example, when focusing on an electric vehicle 5 with a vehicle identifier 721 of "CAR-A01," the vehicle software configuration information 71a indicates that the latest version of the vehicle firmware is "Ver. 1.1," while the vehicle management information 72a indicates that the currently applied version is "Ver. 1.0," which is not the latest version. Furthermore, when the vehicle firmware of "Ver. 1.0" is applied, the vehicle software configuration information 71a indicates that a security update has not yet been applied to the corresponding function 714 of "charging control," which poses a security risk.

[0072] An example of the operation of the charging system 1a according to the embodiment will be described below with reference to the drawings. Note that the processing described below is an example, and the processing order can be changed, some processing can be deleted, and other processing can be added.

[0073] 10A and 10B are flowcharts showing an example of a power supply process executed by the charge control unit 41 according to the first embodiment when the detection of a vehicle is used as a trigger.

[0074] The charging control unit 41 acquires vehicle identification information such as the license plate number of the electric vehicle 5 (S101). As an example, if a camera is provided at the charging station, the charging control unit 41 acquires the license plate number obtained based on an image of the license plate number as the vehicle identification information. As an example, the charging control unit 41 acquires authentication information obtained when the user of the electric vehicle 5 checks in to the charging station as the vehicle identification information.

[0075] The charging control unit 41 outputs the acquired vehicle identification information to the vehicle management server 6, and acquires vehicle software configuration information 71a and vehicle management information 72a corresponding to the acquired vehicle identification information from the vehicle management server 6 (S102). As an example, the charging control unit 41 acquires vehicle management information 72a including at least a vehicle model 724 and a vehicle firmware version 725 for the electric vehicle 5 to be charged that is identified by the vehicle management server 6 based on the vehicle identification information and the vehicle management information 72a. Furthermore, the charging control unit 41 further acquires, based on the vehicle software configuration information 71a, related information for each of the latest vehicle firmware version 712 and the current vehicle firmware version 725 for the vehicle model 711 that corresponds to the electric vehicle 5 to be charged.

[0076] The charging control unit 41 determines whether or not there is a security risk in the vehicle FW of the electric vehicle 5 (S103). As an example, the charging control unit 41 determines whether or not there is a security risk in the vehicle FW of the electric vehicle 5, based on the difference between the latest vehicle FW version 712 of the vehicle model 711 and the vehicle FW version 725 currently applied to the electric vehicle 5, for the electric vehicle 5 to be charged. For example, if the latest vehicle FW version 712 of the vehicle model 711 and the currently applied vehicle FW version 725 are different versions, the charging control unit 41 determines that there is a security risk in the vehicle FW of the electric vehicle 5.

[0077] If it is determined that there is no security risk in the vehicle FW of the electric vehicle 5 (S103: No), the charging control unit 41 outputs a power supply notification permitting power supply, thereby causing the power supply device 32 to supply power (S104). After that, the flow of FIG. 10A and FIG. 10B ends.

[0078] On the other hand, if it is determined that the vehicle FW of the electric vehicle 5 has a security risk (S103: Yes), the charging control unit 41 extracts the FW of the electric vehicle 5 that has a security risk (S105). As an example, the charging control unit 41 extracts the FW that has a security risk based on a difference in the ECUFW version 715. For example, the charging control unit 41 extracts the ECUFW of the ECU 55 whose ECUFW version 715 differs between the latest vehicle FW version 712 of the vehicle model 711 and the vehicle FW version 725 currently applied to the electric vehicle 5.

[0079] The charging control unit 41 determines whether or not there is a security risk to the charging function (S106). As an example, if the corresponding function 714 of the extracted ECUFW is a charging function such as “charging control,” the charging control unit 41 determines that there is a security risk to the charging function.

[0080] If it is determined that there is no security risk to the charging function (S106: No), the flow of FIGS. 10A and 10B proceeds to the processing of S104.

[0081] On the other hand, if it is determined that there is a security risk to the charging function (S106: Yes), the charging control unit 41 determines whether the security risk can be avoided (S107). As an example, the charging control unit 41 refers to the item in the details 716 between ECUFWs with different ECUFW versions 715. The charging control unit 41 determines whether the spread of damage can be suppressed, that is, whether the charging equipment 3 can avoid the security risk, by referring to information on common vulnerabilities and exposures (CVE) between the ECUFWs and the details of the countermeasures. For example, if the security risk that is addressed or reported between the different ECUFW versions 715 is a security risk such as "malware infection" or "the ability to execute arbitrary code," the charging control unit 41 determines that the security risk can be avoided in the charging equipment 3. For example, if the security risk that has been addressed or reported is a security risk such as an attack that disrupts communication between the electric vehicle 5 and the power supply device 32, or if the security risk cannot be determined from the description in the details 716 item, the charging control unit 41 determines that the security risk cannot be avoided in the charging equipment 3.

[0082] If it is determined that the security risk cannot be avoided by the charging equipment 3 (S107: No), the charging control unit 41 notifies the driver that power supply is not possible and requests the driver to update the vehicle firmware (S108). As an example, the charging control unit 41 notifies the driver by transmitting a notification of the power supply not possible and a request to update the vehicle firmware to the power supply device 32, the electric vehicle 5, and a mobile terminal (not shown) used by the driver via the external network N, thereby causing the notification of the power supply not possible and the request to update the vehicle firmware. The notification to the driver may be performed by displaying a notification screen on a display or by outputting a notification sound or voice from a speaker. Therefore, the power supply device 32 may be provided with at least one of a display and a speaker. The flow of FIGS. 10A and 10B then ends. Disabling the power supply device 32 from supplying power in response to a security risk is an example of a degraded mode in which the functions of the power supply device 32 are degraded.

[0083] On the other hand, if it is determined that the charging facility 3 can avoid the security risk (S107: Yes), the charging control unit 41 determines whether or not there is a security risk of infecting the power supply device 32 with malware (S109). As an example, the charging control unit 41 refers to the item in the details 716 between ECUFWs with different ECUFW versions 715, and if the addressed or reported security risk is "malware infection," determines that there is a security risk of infecting the power supply device 32 with malware. Here, the addressed or reported security risk of "malware infection" is an example of a first type of security risk that the charging facility 3 can avoid by disconnecting the power supply device 32 from the facility communication network 33.

[0084] If it is determined that there is a security risk of malware infection of the power supply device 32 (S109: Yes), the charging control unit 41 creates a snapshot of the power supply device 32 (S110). Here, the snapshot of the power supply device 32 is information indicating the data state of the memory file system of the power supply device 32 at that time, such as the version state of each firmware and control program. The charging control unit 41 then stores the created snapshot in the first storage unit 42. The charging control unit 41 also disconnects the power supply device 32 from the facility communication network 33 (S111). As an example, the charging control unit 41 outputs a power supply device disconnection instruction to the charging station management terminal 31 via the external network N, which allows the power supply device 32 to supply power while disconnected from the facility communication network 33 (S104). Then, the flow of FIGS. 10A and 10B ends. Here, disconnecting the power supply device 32 from the facility communication network 33 in response to a security risk and then enabling power supply is an example of a degeneration mode in which the functions of the power supply device 32 are degraded.

[0085] On the other hand, if it is determined that there is no security risk of infecting the power supply device 32 with malware (S109: No), the charging control unit 41 determines whether there is a security risk to the charging equipment 3 regarding the battery or power supply (S112).

[0086] If it is determined that there is a security risk related to the battery or power supply (S112: Yes), the charging control unit 41 limits the power supply rate (S113). Thereafter, the charging control unit 41 outputs a power supply notification to the charging station management terminal 31 to permit power supply under the limited power supply rate, thereby allowing the power supply device 32 to supply power while limiting the power supply rate (S104). The flow of Fig. 10A and Fig. 10B then ends. Allowing power supply while limiting the power supply rate of the power supply device 32 in accordance with the security risk is an example of a degraded mode in which the functions of the power supply device 32 are degraded.

[0087] On the other hand, if it is determined that there is no security risk related to the battery or power supply (S112: No), the charging control unit 41 determines whether there is a security risk in the charging equipment 3 where charging is remotely operated (S114).

[0088] If it is determined that there is a security risk of remotely controlling charging (S114: Yes), the charging control unit 41 restricts the vehicle communication function (S115). Thereafter, the charging control unit 41 outputs a power supply notification to the charging station management terminal 31 to permit power supply under the restriction of the vehicle communication function, thereby supplying power from the power supply device 32 while restricting the vehicle communication function (S104). Then, the flow of Figures 10A and 10B ends. Here, restricting the vehicle communication function of the power supply device 32 in accordance with the security risk and then permitting power supply is an example of a degraded mode in which the functions of the power supply device 32 are degraded.

[0089] On the other hand, if it is determined that there is no security risk associated with remote charging (S114: No), the charging control unit 41 requests the driver to update the vehicle FW (S116), for example, in the same manner as in S108. After that, the flow of FIG. 10A and FIG. 10B proceeds to the process of S104.

[0090] Fig. 11 is a flowchart showing an example of a verification process executed in the charging control unit 41 according to the first embodiment for reconnecting the power supply device 32 to the facility communication network 33. The flow in Fig. 11 is started, for example, when a trigger is generated by the completion of power supply by the power supply device 32 that was disconnected from the facility communication network 33 in the power supply process in Figs. 10A and 10B . Note that the flow in Fig. 11 may also be started when a trigger is generated by the power supply device 32 becoming disconnected from the electric vehicle 5. Alternatively, the flow in Fig. 11 may be started at any timing after the completion of power supply by the power supply device 32 or after the power supply device 32 becomes disconnected from the electric vehicle 5.

[0091] The charging control unit 41 connects the power supply device 32, which has been disconnected from the facility communication network 33, to the verification network 34 (S201). As an example, the charging control unit 41 connects the power supply device 32 to the verification network 34 by outputting a verification network connection instruction to the charging station management terminal 31 via the external network N.

[0092] The charging control unit 41 performs a memory and file system check on the target power supply device 32 connected to the verification network 34 (S202). As an example, the charging control unit 41 checks for memory defects in the power supply device 32 and for consistency and damage to the file system in the memory.

[0093] The charging control unit 41 determines whether or not any alteration of the file system by an unauthorized program or the like has been detected (S203). If it is determined that no alteration of the file system by an unauthorized program or the like has been detected (S203: No), the flow of FIG. 11 proceeds to the processing of S207.

[0094] On the other hand, if it is determined that the file system has been altered by an unauthorized program or the like (S203: Yes), the charging control unit 41 rolls back the file system of the power supply device 32 using the snapshot created at the time of disconnection (S204).

[0095] Thereafter, the charging control unit 41 verifies whether or not unauthorized communication or operation is occurring in the target power supply device 32 (S205). As an example, the charging control unit 41 causes the power supply device 32 to execute a test process and determines whether or not the communication or operation is within a specified range. A verification program for executing the test process and verification data that specifies normal communication and operation are assumed to be predetermined and stored in, for example, the first storage unit 42. For example, the charging control unit 41 supplies the verification program to the power supply device 32 and causes it to execute the program. For example, the charging control unit 41 obtains the execution result of the verification program and detects unauthorized communication or operation by referring to the verification data.

[0096] The charging control unit 41 determines whether or not there is unauthorized communication or operation in the target power supply device 32 (S206). If it is determined that there is no unauthorized communication or operation in the target power supply device 32 (S206: No), the charging control unit 41 connects the power supply device 32 to the equipment communication network 33 (S207). As an example, the charging control unit 41 outputs an equipment communication network connection instruction to the charging station management terminal 31 via the external network N, thereby disconnecting the power supply device 32 from the verification network 34 and reconnecting it to the equipment communication network 33. On the other hand, if it is determined that there is unauthorized communication or operation in the target power supply device 32 (S206: Yes), the charging control unit 41 notifies the owner of the charging equipment 3 that the power supply device 32 cannot be restored (S208). After the processing of S207 or S208, the flow of FIG. 11 ends.

[0097] Here, an example of the operation of the charging system 1a according to the embodiment will be described in more detail.

[0098] 12 is a sequence diagram illustrating an example of a power supply process executed in the charging system 1 a according to the first embodiment when a vehicle detection is used as a trigger. Fig. 12 illustrates the power supply process when a security risk exists in the charging function of the electric vehicle 5 to be charged and the charging facility 3 can avoid the security risk.

[0099] The power supply device 32 of the charging facility 3 detects the electric vehicle 5 to be charged (S301), and when the electric vehicle 5 to be charged is detected, outputs a detection notification to the charging station management server 4 (S302). Here, it is assumed that the electric vehicle 5 assigned the vehicle identifier 721 of "CAR-A01" is detected, and a detection notification including the license plate number 722 of "12-34" as vehicle identification information is output.

[0100] The charging control unit 41 of the charging station management server 4 outputs a vehicle software configuration information request to the vehicle management server 6, requesting the vehicle software configuration information 71a and vehicle management information 72a corresponding to the electric vehicle 5 with the license plate number 722, "12-34" (S303).

[0101] The information search unit 61 of the vehicle management server 6 references the vehicle management information 72a based on the vehicle identification information "12-34" 722. As a result, the information search unit 61 determines that the vehicle model 724 of the electric vehicle 5 to be charged is "Car-Model01" and that the currently applied vehicle FW version 725 is "Ver. 1.0."

[0102] Furthermore, the information search unit 61 further refers to the vehicle software configuration information 71a, and reads out the vehicle software configuration information 71a for the vehicle model 711 of "Car-Model01" in accordance with the identified vehicle model 724 of "Car-Model01." Then, the information search unit 61 outputs the identified vehicle management information 72a and the read-out vehicle software configuration information 71a to the charging station management server 4 (S304).

[0103] The charging control unit 41 of the charging station management server 4 acquires the vehicle software configuration information 71a and the vehicle management information 72a from the vehicle management server 6 (S305).

[0104] In the security risk determination (S306), the charging control unit 41 determines that there is a security risk based on the difference between "Ver. 1.0," which is the vehicle FW version 725 currently applied to the electric vehicle 5 assigned the vehicle identifier 721 of "CAR-A01," and "Ver. 1.1," which is the latest vehicle FW version 712 of the vehicle model 711 of "Car-Model01" read from the vehicle software configuration information 71a. Furthermore, for the vehicle model 711 of "Car-Model01," the charging control unit 41 extracts the ECUFWs of the corresponding functions 714 of "acceleration control" and "charging control" for which there is a difference in ECUFW version 715 between the vehicle FW versions 725 of "Ver. 1.0" and "Ver. 1.1." Then, because the ECUFW of the corresponding function 714 of "charging control" was extracted, the charging control unit 41 determines that there is a security risk for the charging function.

[0105] Furthermore, in the security risk avoidance determination (S307), the charging control unit 41 refers to the description in the details 716 for the vehicle FW version 725 of the corresponding function 714 of "charging control" between "Ver. 1.0" and "Ver. 1.1". Then, the charging control unit 41 determines that the security risk addressed between the ECUFW versions 715 of "Ver. 1.0.0" and "Ver. 1.1.0" is the security risk of "malware infection", and therefore determines that the charging equipment 3 has an avoidable security risk, and that the currently applied ECUFW version 715 of "Ver. 1.0.0" poses the security risk of "malware infection".

[0106] Therefore, the charging control unit 41 creates a snapshot of the power supply device 32 and outputs a power supply device disconnection instruction to the charging facility 3, instructing the power supply device 32 to supply power while disconnected from the facility communication network 33 (S308).

[0107] The power supply device 32 of the charging facility 3 disconnects the target power supply device 32 from the facility communication network 33 in response to the power supply device disconnection instruction from the charging station management server 4 (S309). In addition, the power supply device 32 outputs a power supply notification to the electric vehicle 5 to establish communication between the power supply device 32 and the electric vehicle 5 and starts power supply (S310).

[0108] 13 is a sequence diagram showing an example of a verification process executed in the charging system 1a according to the first embodiment for reconnecting the power supply device 32 to the facility communication network 33. Fig. 13 illustrates the verification process when unauthorized alteration has been made to the power supply device 32 and it is determined by rollback using a snapshot that there is no unauthorized communication or operation.

[0109] The charging control unit 41 of the charging station management server 4 outputs a verification network connection instruction to the charging equipment 3 to instruct it to connect the power supply device 32, which was disconnected from the equipment communication network 33 during the power supply process, to the verification network 34 (S401).

[0110] The power supply device 32 of the charging facility 3 connects the target power supply device 32 to the verification network 34 in response to the verification network connection instruction from the charging station management server 4 (S402).

[0111] The charging control unit 41 of the charging station management server 4 verifies whether or not the file system has been altered by an unauthorized program or the like by inspecting the memory and file system of the power supply device 32 connected to the verification network 34 (S403). When the unauthorized alteration in the power supply device 32 is detected, the charging control unit 41 rolls back the file system of the power supply device 32 using the snapshot created when the power supply device 32 was disconnected from the facility communication network 33 during the power supply process.

[0112] Furthermore, the charging control unit 41 executes a verification program in the power supply device 32 to perform a test process that simulates communication and operation, and verifies whether or not there is unauthorized communication and operation (S404).

[0113] In addition, upon determining that there is no unauthorized communication or operation, the charging control unit 41 outputs an equipment communication network connection instruction to the charging equipment 3 to instruct it to reconnect to the equipment communication network 33 of the power supply device 32 (S405).

[0114] The power supply device 32 of the charging facility 3 switches the connection destination of the target power supply device 32 from the verification network 34 to the facility communication network 33 in response to the facility communication network connection instruction from the charging station management server 4 (S406).

[0115] In this way, the charging control according to this embodiment determines whether there is a security risk to the charging function of the electric vehicle 5, based on the vehicle software configuration information 71a, and also determines whether the charging facility 3 can avoid the security risk by degrading the functions of the power supply device 32. Then, when there is a security risk to the charging function of the electric vehicle 5, the charging control according to this embodiment determines a degrading mode for degrading the functions of the power supply device 32, based on the determination result of whether the charging facility 3 can avoid the security risk by degrading the functions of the power supply device 32.

[0116] According to this configuration, the functions of the power supply device 32 can be degraded depending on the security risk to the charging function of the electric vehicle 5. Therefore, according to the charging control according to the embodiment, the safety of the charging station can be ensured without losing the original charging function of the charging station as much as possible, and power can be continuously supplied to the mobile object to be charged. In other words, the charging equipment 3 connected to the electric vehicle 5 during power supply can be protected from security risks caused by the electric vehicle 5.

[0117] Other embodiments of the charging system 1 according to the present disclosure will be described below with reference to the drawings. In the following description of each embodiment, differences will be mainly described, and descriptions of content that overlaps with the above-described content will be omitted as appropriate.

[0118] Second Embodiment A charging system 1b according to this embodiment is similar to the charging system 1a according to the first embodiment, except for the mode of communication between the charging facility 3 and the charging station management server 4. Here, the charging system 1b according to the second embodiment is an example of the charging system 1 according to an embodiment of the present disclosure. Note that in each embodiment of the present disclosure, when there is no need to distinguish between the charging system 1a and the charging system 1a, they may be collectively referred to as the charging system 1.

[0119] 14 is a diagram illustrating an example of the configuration of a charging system 1b according to the second embodiment. In the charging system 1b according to the present embodiment, the charging facility 3 is connected directly to the charging station management server 4 without going through the external network N.

[0120] In this way, the same effects as those of the above-described embodiment can be obtained even with a configuration in which the charging facility 3 and the charging station management server 4 are connected without going through the external network N. Furthermore, with this configuration, it is possible to speed up and stabilize communication between the charging facility 3 and the charging station management server 4, and to improve safety related to charging control by limiting the intrusion route to the charging facility 3 via the external network N.

[0121] Third Embodiment A charging system 1 according to this embodiment is similar to the charging system 1a according to the first embodiment, except that the power supply process is started in response to a charge reservation instead of a vehicle detection.

[0122] When accepting a charging reservation, the reservation management unit 43 according to the present embodiment sets a predetermined waiting time depending on the determination result of the security risk determination and / or the security risk avoidance determination. As an example, if there is a security risk and the charging equipment 3 can avoid the security risk, the reservation management unit 43 sets a reservation time to start power supply after setting a predetermined waiting time. Here, the reservation management unit 43 according to the embodiment is an example of a control unit.

[0123] 10A and 15 are flowcharts showing an example of a power supply process executed by the charge control unit 41 and the reservation management unit 43 according to the third embodiment when a charge reservation is used as a trigger. Here, differences from the power supply process according to the first embodiment (see FIGS. 10A and 10B) will be mainly described.

[0124] 10A and 15 , the charging control unit 41 acquires vehicle identification information such as owner information 723 and vehicle model 724 (S101). As an example, the charging control unit 41 acquires the vehicle identification information based on reservation information in the charging reservation registration that includes at least the owner information 723 and vehicle model 724. This reservation information can be acquired based on, for example, information input by the user of the electric vehicle 5 in the charging reservation registration or authentication information when the user logs in to the charging reservation registration service.

[0125] 10A and 15, if it is determined that there is no security risk in the vehicle FW of the electric vehicle 5 (S103: No), after the reservation management unit 43 accepts the charging reservation (S501), the charging control unit 41 outputs a power supply notification permitting power supply, thereby causing the power supply device 32 to supply power (S104).

[0126] Also, in the flows of Figures 10A and 15, if it is determined that there is no security risk to the charging function (S106: No), after the reservation management unit 43 accepts the charging reservation (S501), the process proceeds to S104.

[0127] 10A and 15 , if it is determined that the security risk can be avoided in the charging facility 3 (S107: Yes), the reservation management unit 43 accepts a charging reservation with a predetermined waiting time (S502). As an example, unlike the case where there is no security risk (S501), the reservation management unit 43 accepts a charging reservation at a reservation time with a predetermined waiting time, such as 30 minutes. Note that the predetermined waiting time is assumed to be predetermined and stored in the first storage unit 42, for example. At this time, the charging control unit 41 may issue an update request to the driver to update the vehicle firmware. Here, the reservation time according to the embodiment is an example of a power supply time.

[0128] When the reserved time arrives, the charging control unit 41 determines whether or not the security risk to the charging function has been resolved (S503). As an example, the charging control unit 41 determines whether or not there is a security risk to the charging function, for example, in the same manner as in S102 to S106, based on the vehicle firmware version 725 applied to the electric vehicle 5 to be charged at the reserved time. If it is determined that the security risk to the charging function has been resolved (S503: Yes), the flow of FIGS. 10A and 15 proceeds to the processing of S104. On the other hand, if it is not determined that the security risk to the charging function has been resolved (S503: No), the flow of FIGS. 10A and 15 proceeds to the processing of S109.

[0129] In this way, the charging control unit 41 according to the present embodiment performs the first determination again by the reserved time, and if the determination result of the first determination indicates that there is no security risk by the reserved time, controls the power supply to the electric vehicle 5 without degrading the function of the power supply device 32. Furthermore, if the determination result of the first determination does not indicate that there is no security risk by the reserved time, the charging control unit 41 controls the power supply to the electric vehicle 5 in a degraded mode in which the power supply device 32 is disconnected from the facility communication network 33.

[0130] Fig. 16 is a sequence diagram showing an example of power supply processing executed in the charging system 1 according to the third embodiment when a charging reservation is used as a trigger. Fig. 16 illustrates power supply processing when a security risk exists in the charging function of the electric vehicle 5 to be charged, the security risk can be avoided in the charging facility 3, and the security risk for the charging function has not been resolved at the reserved time. Here, differences from the power supply processing according to the first embodiment (see Fig. 12) will be mainly described.

[0131] The reservation management unit 43 starts charging reservation registration (S601). Furthermore, the reservation management unit 43 acquires reservation information including at least owner information 723 and vehicle model 724 based on information input by the user of the electric vehicle 5 and authentication information when the user logs in to the charging reservation registration service, and outputs the reservation information to the charging control unit 41 (S602). Here, it is assumed that reservation information including the owner information 723 of "Owner001" and the vehicle model 724 of "Car-Model01" has been output.

[0132] The charging control unit 41 of the charging station management server 4 outputs a vehicle software configuration information request to the vehicle management server 6, requesting vehicle software configuration information 71a and vehicle management information 72a corresponding to the owner information 723 of "Owner001" and the vehicle model 724 of "Car-Model01" (S303).

[0133] The information search unit 61 of the vehicle management server 6 references the vehicle management information 72a based on the owner information 723 of "Owner001" as vehicle identification information and the vehicle model 724 of "Car-Model01." As a result, the information search unit 61 identifies that the vehicle FW version 725 currently applied to the electric vehicle 5 to be charged is "Ver. 1.0."

[0134] After the security risk avoidance determination (S307), the charging control unit 41 determines that there is a security risk of "malware infection" for the charging function, and therefore instructs the reservation management unit 43 to schedule charging including a predetermined waiting time (S603). Furthermore, the charging control unit 41 may request the driver to update the vehicle FW during a predetermined waiting time before the reserved time by outputting a vehicle FW update request to the electric vehicle 5 (S604).

[0135] The reservation management unit 43 accepts a reservation for charging at a reservation time with a predetermined waiting time set in accordance with an instruction from the charging control unit 41 (S605). Furthermore, when the reservation time arrives, the charging control unit 41 determines whether the security risk to the charging function has been resolved (S606), and if it is determined that the security risk to the charging function has not been resolved, issues an instruction to create a snapshot of the power supply device 32 and disconnect it from the facility communication network 33 (S308).

[0136] In this way, the charging system 1 according to this embodiment performs the power supply process using a charge reservation as a trigger, and if it is determined that there is a security risk to the charging function, it sets the reservation time with a waiting time. This configuration provides the same effects as the above-described embodiment, as well as the effect of being able to update the vehicle firmware during the waiting time until the reservation time. Therefore, the charging system 1 according to this embodiment can further improve the safety of the charge control.

[0137] The waiting time set when reserving charging may be a predetermined fixed time, or may be varied depending on the security risk assessment result, such as by lengthening the waiting time in cases where the power supply rate is limited depending on the security risk to the charging function. Furthermore, the length of the waiting time may be varied depending on the number of ECUFWs to be updated, the amount of data, and the predicted time required for updating to the latest vehicle FW applicable to the electric vehicle 5 to be charged. This configuration makes it easier to update the vehicle FW during the waiting time until the reserved time, thereby further improving the safety of charging control.

[0138] The technology according to this embodiment can be appropriately applied to the charging system 1 according to each of the above-described embodiments.

[0139] (Fourth embodiment) If the latest update patch is not applied to the in-vehicle computer, there is a risk that the safety of the vehicle and the driver may be threatened by exploiting unaddressed security risks, such as unauthorized manipulation of vehicle functions.

[0140] Therefore, in this embodiment, a charging system 1 that can protect an electric vehicle connected to a charging facility during power supply from security risks caused by the electric vehicle will be described.

[0141] The charging system 1 according to this embodiment is similar to the charging system 1a according to the first embodiment, except that charging control is performed in response to a security risk to the driving function instead of a security risk to the charging function of the electric vehicle 5 to be charged. In this embodiment, differences from the charging system 1a according to the first embodiment will be mainly described.

[0142] Fig. 17 is a diagram showing an example of the configuration of a charging facility 3 according to a fourth embodiment. The charging facility 3 according to this embodiment is similar to the charging facility 3 according to the first embodiment (see Fig. 2 ) except that the charging facility 3 does not include an facility communication network 33 and a verification network 34. Specifically, in the charging facility 3 according to this embodiment, a charging station management terminal 31 is connected to each of a plurality of power supply devices 32 via one network.

[0143] 18 is a diagram showing an example of the configuration of a charge control unit 41 according to the fourth embodiment. Unlike the charge control unit 41 according to the first embodiment (see FIG. 5), the charge control unit 41 according to this embodiment does not include a first verification unit 416 and a second verification unit 417. Here, the first determination unit 411 and the second determination unit 412 according to this embodiment are also an example of a determination unit. Similarly, the charge control instruction unit 413 according to this embodiment is also an example of a control unit.

[0144] Furthermore, the first determination unit 411 and the second determination unit 412 according to the present embodiment determine a security risk for the driving function, instead of a security risk for the charging function according to the first embodiment. As an example, the first determination unit 411 performs a first determination to determine whether or not there is a security risk for the driving function of the electric vehicle 5 due to firmware in the ECU 55. As an example, when the result of the first determination indicates a security risk, the second determination unit 412 performs a second determination to determine whether the electric vehicle 5 to be charged can avoid the security risk by disabling at least one driving function that poses a security risk and then driving using other driving functions. In other words, the first determination according to the present embodiment is a determination of whether or not there is a security risk for at least one driving function of the electric vehicle 5 due to firmware in at least one ECU 55. Furthermore, the second determination according to the present embodiment is a determination of whether or not the security risk for the electric vehicle 5 to be charged can be avoided by disabling a specific function among at least one driving function of the electric vehicle 5 when there is a security risk.

[0145] The charging control instructing unit 413 adds a charging control instruction according to the determination results of the first determination unit 411 and the second determination unit 412 to the charging station management terminal 31 and outputs the instruction to the electric vehicle 5 to be charged. As an example, when the electric vehicle 5 can be driven using other driving functions after disabling at least one driving function that poses a security risk and the security risk can be avoided for the electric vehicle 5, the charging control instructing unit 413 disables at least one driving function that poses a security risk and then permits power supply to the electric vehicle 5. As an example, when the electric vehicle 5 can be driven using other driving functions after disabling at least one driving function that poses a security risk and the security risk can be avoided for the electric vehicle 5 to be charged, the charging control instructing unit 413 outputs notification information to confirm with the driver whether or not to disable the at least one driving function that poses a security risk. As an example, when the charging control instructing unit 413 acquires notification information indicating the driver's consent to the disabling of the at least one driving function that poses a security risk, it outputs instruction information to the electric vehicle 5 to disable the at least one driving function that poses a security risk.

[0146] 19 is a diagram illustrating an example of vehicle software configuration information 71b according to the fourth embodiment. The vehicle software configuration information 71b illustrated in FIG. 19 is the same as the vehicle software configuration information 71a illustrated in FIG. 8, except that the ECUFW version 715 for the vehicle model 711 of “Car-Model02” is different.

[0147] Fig. 20 is a diagram showing an example of vehicle management information 72b according to the fourth embodiment. The vehicle management information 72b shown in Fig. 20 is the same as the vehicle management information 72a shown in Fig. 9, except that the vehicle FW versions 725 for the electric vehicles 5 with the vehicle identifiers 721 of "CAR-A02" and "CAR-A03" are different.

[0148] Here, an outline of the charging control executed by the charging system 1 according to this embodiment in response to security risks to the driving function will be described with reference to the drawings.

[0149] FIG. 21 is a diagram showing an example of the functions 714 of the ECU 55 related to autonomous driving control according to the fourth embodiment. When a security risk exists for the driving functions related to autonomous driving, such as the lane keeping function (No. 1), the preceding vehicle following function (No. 2), the parking assistance function (No. 3), and the fully autonomous driving function (No. 4) among the functions 714 of the ECU 55, i.e., the autonomous driving function, in the electric vehicle 5 to be charged, the charging control unit 41 performs charging control to restrict autonomous driving in accordance with the security risk. As an example, when a security risk exists for at least one of the autonomous driving functions No. 1 to No. 3, the charging control unit 41 restricts that function and the fully autonomous driving function No. 4, which has a higher level. As an example, when a security risk exists for the autonomous driving function No. 4, the charging control unit 41 restricts only the fully autonomous driving function (No. 4). For example, these restrictions may be applied to all of the functions No. 1 to No. 3. This is based on the fact that each of the autonomous driving functions in No. 1 to No. 3 is an independent function, while the fully autonomous driving function (No. 4) is a function that encompasses each of the autonomous driving functions in No. 1 to No. 3. The levels assigned to each autonomous driving function can be changed as appropriate.

[0150] 22 is a diagram showing an example of the functions 714 of the ECU 55 related to manual driving control according to the fourth embodiment. When a security risk exists for a driving function related to manual driving, such as power steering (No. 1), accelerator control (No. 2), and brake control (No. 3) among the functions 714 of the ECU 55, i.e., a manual driving function, in the electric vehicle 5 to be charged, the charging control unit 41 performs charging control to restrict manual driving in accordance with the security risk. As an example, when a security risk exists for any of the manual driving functions No. 1 to No. 3, the charging control unit 41 restricts manual driving. For example, these restrictions are based on the fact that each of the manual driving functions No. 1 to No. 3 is a driving function required for manual driving.

[0151] 23 is a flowchart showing an example of a power supply process executed by the charge control unit 41 according to the fourth embodiment when a vehicle detection is used as a trigger. Here, differences from the power supply process according to the first embodiment (see FIGS. 10A and 10B) will be mainly described.

[0152] 23 , the charging control unit 41 extracts FW that has a security risk (S105), and then determines whether the corresponding function 714 of the extracted FW poses a security risk related to the autonomous driving function (S701). As an example, if the corresponding function 714 of the extracted ECUFW is a driving function such as "autonomous driving control," the charging control unit 41 determines that the corresponding function 714 poses a security risk related to the autonomous driving function.

[0153] If it is determined that the function 714 of the extracted FW is not a security risk related to the automatic driving function (S701: No), the charging control unit 41 determines whether the function 714 of the extracted FW is a security risk related to the manual driving function (S702). As an example, if the function 714 of the extracted ECUFW is a driving function such as "power steering," "accelerator control," or "brake control," the charging control unit 41 determines that the function 714 is a security risk related to the manual driving function.

[0154] If it is determined that there is no security risk related to the manual driving function (S702: No), the flow of FIG. 23 proceeds to the processing of S104.

[0155] On the other hand, if it is determined that there is a security risk related to the automatic driving function or the manual driving function (S701: Yes, S702: Yes), the charging control unit 41 notifies the driver of consent confirmation as to whether or not to disable (restrict) at least one driving function that poses a security risk until measures such as a vehicle firmware update are implemented (S703). Here, the at least one driving function that poses a security risk is assumed to be the automatic driving function or the manual driving function that has been determined to pose a security risk.

[0156] The charging control unit 41 determines whether the user of the electric vehicle 5 has consented to disabling the automatic driving function or the manual driving function (S704). If it is determined that the user has consented to disabling the automatic driving function or the manual driving function (S704: Yes), the charging control unit 41 disables the automatic driving function or the manual driving function that the user has consented to (S705). Thereafter, the flow of FIG. 23 proceeds to the processing of S104.

[0157] On the other hand, if it is determined that the user of the electric vehicle 5 does not consent to disabling the automatic driving function or the manual driving function (S704: No), the charging control unit 41 requests the user to update the vehicle FW (S706). Then, the flow in FIG. 23 ends.

[0158] Fig. 24 is a sequence diagram showing an example of a power supply process executed in the charging system 1 according to the fourth embodiment when vehicle detection is used as a trigger. Fig. 24 illustrates a power supply process when there is a security risk in the manual driving function and the autonomous driving function installed in the electric vehicle 5 to be charged, and the driver's consent to disabling the manual driving function has been obtained. Here, differences from the power supply process according to the first embodiment (see Fig. 12) will be mainly described.

[0159] The charging control unit 41 of the charging station management server 4 acquires (S305) the vehicle software configuration information 71b and the vehicle management information 72b from the vehicle management server 6, and then performs (S801) and (S802) a security risk determination related to the autonomous driving function. Here, it is assumed that the vehicle model 724 of the electric vehicle 5 to be charged is "Car-Model02," and the currently applied vehicle FW version 725 is "Ver. 1.0."

[0160] In the security risk determination (S801) related to the automatic driving function and the security risk determination (S802) related to the manual driving function, the charging control unit 41 determines that there is a security risk based on the difference between "Ver. 1.0", which is the vehicle FW version 725 currently applied to the electric vehicle 5 to be charged, and "Ver. 2.0", which is the latest vehicle FW version 712 of the vehicle model 711 of "Car-Model 02" read from the vehicle software configuration information 71b. Furthermore, for the vehicle model 711 of "Car-Model 02", the charging control unit 41 extracts the ECUFW of the corresponding functions 714 of "automatic driving control" and "brake control" for which there is a difference in ECUFW version 715 between the vehicle FW versions 725 of "Ver. 1.0" and "Ver. 2.0". Then, since the ECUFW of the corresponding functions 714 of "automatic driving control" and "brake control" has been extracted, the charging control unit 41 determines that there is a security risk to the automatic driving function and the manual driving function.

[0161] The charging control unit 41 of the charging station management server 4 outputs a consent confirmation notification to the electric vehicle 5 for disabling the driving functions that pose a security risk (S803). The consent confirmation notification according to the present embodiment is an example of notification information. The ECU 55, which controls the on-board display or on-board speaker of the electric vehicle 5, confirms the consent of the user of the electric vehicle 5 for disabling the driving functions that pose a security risk (S804). For example, the ECU 55 displays a confirmation screen or outputs a confirmation voice to confirm the consent of the user. In addition, the ECU 55 outputs a consent notification to the charging station management server 4 for disabling the driving functions that pose a security risk, indicating consent to disabling the manual driving functions, in accordance with the driver's consent to disabling the manual driving functions (S805). This consent notification to disabling the driving functions that pose a security risk is also an example of notification information. The consent confirmation notification is not limited to being output to the electric vehicle 5, but may also be performed using a display or speaker mounted on a mobile device used by the driver, such as a smartphone, or on the power supply device 32.

[0162] In response to the driver's consent to the disabling of the manual driving function, the charging control unit 41 of the charging station management server 4 outputs an instruction to disable the manual driving function to the electric vehicle 5 (S806). Here, the instruction to disable the manual driving function according to this embodiment is an example of instruction information for disabling at least one driving function that poses a security risk. Furthermore, the ECU 55 assigned the ECU ID 713 of "ECU-004" that realizes the function 714 of "brake control" of the electric vehicle 5, or the ECU 55 that controls all of the manual driving functions, disables the manual driving function (S807) and outputs a notification of the disabling to the charging station management server 4 (S808).

[0163] Thereafter, in response to the notification of invalidation from the electric vehicle 5, the charging control unit 41 of the charging station management server 4 outputs a power supply instruction to the charging facility 3 (S809). Furthermore, in response to the power supply instruction from the charging station management server 4, the power supply device 32 of the charging facility 3 outputs a power supply notification to the electric vehicle 5 to establish communication between the power supply device 32 and the electric vehicle 5 and start power supply (S310).

[0164] Note that, if the electric vehicle 5 can run using other driving functions after disabling at least one driving function that poses a security risk and the electric vehicle 5 can avoid the security risk, the charging control unit 41 may output instruction information to the vehicle management server 6 to disable at least one driving function that poses a security risk (S806). In this case, the charging control unit 41 may permit power supply to the electric vehicle 5 when it receives a notification from the electric vehicle 5 that at least one driving function that poses a security risk has been disabled (S808).

[0165] In the charging system 1 according to the present embodiment, the charging control unit 41 may be configured to cancel the disabling of the at least one driving function that poses a security risk, i.e., to enable the at least one driving function that poses a security risk, on the condition that the latest firmware is applied when the disabling instruction for the at least one driving function that poses a security risk is issued, when the update is confirmed by referring to the vehicle management information 72b of the vehicle management server 6. Alternatively, the electric vehicle 5 may be configured to retain information indicating the latest firmware when the at least one driving function that poses a security risk was disabled, and, when the firmware applied in the firmware update matches the latest firmware indicated by the retained information, to output a notification of this match to the charging station management server 4 or the vehicle management server 6. In this case, the charging control unit 41 of the charging station management server 4 may be configured to output an instruction to the electric vehicle 5 to cancel the disabling of the driving function that poses a security risk, when the notification of match from the electric vehicle 5 is confirmed.

[0166] In this way, the charging control by the charging system 1 according to this embodiment determines whether there is a security risk for the driving functions of the electric vehicle 5 based on the vehicle software configuration information 71b, and also determines whether the electric vehicle 5 to be charged can be driven using other driving functions after disabling at least one driving function that poses a security risk and can avoid the security risk. If the electric vehicle 5 can be driven using other driving functions after disabling at least one driving function that poses a security risk and the electric vehicle 5 can avoid the security risk, the charging control according to this embodiment disables the at least one driving function that poses a security risk and then permits power supply to the electric vehicle 5.

[0167] According to this configuration, when power is supplied at the charging station, the driving functions of the electric vehicle 5 that pose a security risk are disabled, thereby ensuring the safety of the electric vehicle 5. According to a configuration in which power supply is permitted on the condition that driving functions that pose a security risk are disabled, the electric vehicle 5 can obtain power after charging and then drive safely. In other words, the electric vehicle 5 that is connected to the charging facility 3 during power supply can be protected from security risks posed by the electric vehicle 5.

[0168] The technology according to this embodiment can be appropriately applied to the charging system 1 according to each of the above-described embodiments.

[0169] Fifth Embodiment The charging system 1 according to this embodiment is similar to the charging system 1 according to the fourth embodiment, except that the power supply process is started in response to a charge reservation instead of a vehicle detection. In other words, the differences between the charging system 1 according to this embodiment and the charging system 1 according to the fourth embodiment are similar to the differences between the charging system 1 a according to the first embodiment and the charging system 1 according to the third embodiment.

[0170] 25 is a flowchart showing an example of a power supply process executed by the charge control unit 41 and the reservation management unit 43 according to the fifth embodiment when a charge reservation is used as a trigger. Here, differences from the power supply process according to the fourth embodiment (see FIG. 23) will be mainly described.

[0171] In the flow of FIG. 25 , if it is determined that there is no security risk in the vehicle FW of the electric vehicle 5 (S103: No), after the reservation management unit 43 accepts the charging reservation (S501), the charging control unit 41 outputs a power supply notification permitting power supply, thereby causing the power supply device 32 to supply power (S104).

[0172] In the flow of FIG. 25 , if it is determined that there is a security risk related to the automatic driving function or the manual driving function (S701: Yes, S702: Yes), the charging control unit 41 notifies the user of the electric vehicle 5 of a request to update the vehicle FW (S901). Thereafter, the reservation management unit 43 accepts a charging reservation with a predetermined waiting time (S502). In other words, if there is a security risk and the electric vehicle 5 to be charged can avoid the security risk, the reservation management unit 43 sets a reservation time for starting power supply with a predetermined waiting time. Furthermore, when the reservation time arrives, the charging control unit 41 determines whether the security risk related to the charging function has been resolved (S503). If it is determined that the security risk related to the charging function has been resolved (S503: Yes), the flow of FIG. 25 proceeds to the processing of S104. That is, the charging control unit 41 performs the first determination again by the reserved time, and if the determination result of the first determination by the reserved time indicates that there is no security risk, the charging control unit 41 permits power supply to the electric vehicle 5 without disabling at least one driving function that poses a security risk. On the other hand, if it is not determined that the security risk for the charging function has been resolved (S503: No), the flow in Fig. 25 proceeds to the processing of S703. That is, the charging control unit 41 performs the first determination again by the reserved time, and if the determination result of the first determination does not indicate that there is no security risk by the reserved time, the charging control unit 41 permits power supply to the electric vehicle 5 after disabling at least one driving function that poses a security risk.

[0173] 26 is a sequence diagram showing an example of a power supply process executed in the charging system 1 according to the fifth embodiment when a charging reservation is used as a trigger. Here, differences from the power supply process according to the fourth embodiment (see FIG. 24) will be mainly described.

[0174] The reservation management unit 43 starts charging reservation registration (S601). Furthermore, the reservation management unit 43 acquires reservation information including at least owner information 723 and vehicle model 724 based on information input by the user of the electric vehicle 5 and authentication information when the user logs in to the charging reservation registration service, and outputs the reservation information to the charging control unit 41 (S602). Here, it is assumed that reservation information including the owner information 723 of "Owner002" and the vehicle model 724 of "Car-Model02" has been output.

[0175] The charging control unit 41 of the charging station management server 4 outputs a vehicle software configuration information request to the vehicle management server 6, requesting vehicle software configuration information 71b and vehicle management information 72b corresponding to the owner information 723 of "Owner002" and the vehicle model 724 of "Car-Model02" (S303).

[0176] The information search unit 61 of the vehicle management server 6 references the vehicle management information 72b based on the owner information 723 of "Owner002" as vehicle identification information and the vehicle model 724 of "Car-Model02." As a result, the information search unit 61 identifies that the vehicle FW version 725 currently applied to the electric vehicle 5 to be charged is "Ver. 1.0."

[0177] When it is determined in the security risk determination related to the automatic driving function (S801) and the security risk determination related to the manual driving function (S802) that there is a security risk to the automatic driving function and the manual driving function, the charging control unit 41 instructs the reservation management unit 43 to schedule charging including a predetermined waiting time (S603). Furthermore, the charging control unit 41 outputs a vehicle FW update request to the electric vehicle 5 (S604), thereby requesting the driver to update the vehicle FW during the predetermined waiting time before the reserved time.

[0178] The reservation management unit 43 accepts a reservation for charging at a reservation time with a predetermined waiting time set in accordance with an instruction from the charging control unit 41 (S605). Furthermore, when the reservation time arrives, the charging control unit 41 determines whether the security risk to the driving function has been resolved (S606), and when it is determined that the security risk to the driving function has not been resolved, outputs a notification to the electric vehicle 5 confirming consent to disable the driving function that poses a security risk (S803).

[0179] In this way, the charging system 1 according to this embodiment performs the power supply process using a charge reservation as a trigger, and if it is determined that there is a security risk to the driving function, a waiting time is provided before setting the reservation time. This configuration provides the same effect as the fifth embodiment, as well as the effect of being able to update the vehicle firmware during the waiting time until the reservation time. Therefore, the charging system 1 according to this embodiment can further improve the safety of the charge control.

[0180] The technology according to this embodiment can be appropriately applied to the charging system 1 according to each of the above-described embodiments. The charging system 1 according to this embodiment can be expressed as the charging system 1 according to the fourth embodiment to which the technology according to the third embodiment is applied.

[0181] In each of the above-described embodiments, the determination of "whether it is A or not" may be realized by determining only that it is A, or by determining only that it is not A, or by determining both of these.

[0182] The programs executed by each device of the charging system 1 of this embodiment are provided as files in an installable or executable format recorded on a computer-readable recording medium such as a CD-ROM, FD, CD-R, or DVD.

[0183] The programs executed by the devices in the charging system 1 of the present embodiment may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. The programs executed by the devices in the charging system 1 of the present embodiment may be provided or distributed via a network such as the Internet.

[0184] The programs executed by the devices in the charging system 1 of this embodiment may be provided by being pre-installed in a ROM or the like.

[0185] According to at least one of the embodiments described above, it is possible to protect charging equipment connected to an electric vehicle when supplying power from security risks caused by the electric vehicle.

[0186] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, as well as within the scope of the invention described in the claims and their equivalents.

[0187] (Additional Notes) The above embodiments disclose the following technologies: (A1) A charging control method used in a charging control device communicatively connected to charging equipment having a power supply device for charging an electric vehicle and a communication network connecting the power supply device, the charging control method comprising: based on software information including at least firmware information of at least one electronic control device mounted on the electric vehicle, performing a first determination to determine whether or not there is a security risk to a charging function of the electric vehicle caused by firmware of the at least one electronic control device; and a second determination to determine whether or not the charging equipment can avoid the security risk by degrading functions of the power supply device, and if the result of the first determination indicates there is a security risk, determining a degraded mode for degrading functions of the power supply device based on the result of the second determination, and controlling power supply from the power supply device to the electric vehicle in the determined degraded mode. (A2) The charging control method according to (A1), wherein the second determination includes determining whether the security risk is a first type of security risk that can be avoided by disconnecting the power supply device from the communication network, and when the security risk is the first type of security risk, controlling the power supply device to supply power to the electric vehicle in the degenerate mode in which the power supply device is disconnected from the communication network. (A3) The charging control method according to (A1) or (A2), wherein, if the determination result of the first determination is that there is a security risk and if the second determination is that the security risk can be avoided, a power supply time is set to start power supply after a predetermined waiting time, the first determination is made again by the power supply time, if the determination result of the first determination is that there is no security risk by the power supply time, power supply to the electric vehicle is controlled without degrading the function of the power supply device, and if the determination result of the first determination is not that there is no security risk by the power supply time, power supply to the electric vehicle by the power supply device is controlled in the degraded mode in which the power supply device is isolated from the communication network.(A4) The charging control method according to any one of (A1) to (A3), comprising verifying that the power supply device disconnected from the communication network has not been tampered with, and reconnecting the power supply device to the communication network if the tampering has not occurred, and rolling back the power supply device to further verify whether there is any tampering if the tampering has occurred, and reconnecting the power supply device to the communication network if the tampering has not occurred. (A5) The charging control method according to (A4), comprising verifying that the power supply device has not been tampered with after the power supply device disconnected from the communication network has completed power supply to the electric vehicle or after the power supply device has become disconnected from the electric vehicle. (A6) The charging control method according to any one of (A1) to (A5), wherein in the first determination, based on the software information, it is further determined whether or not there is a security risk to at least one driving function of the electric vehicle caused by firmware of the at least one electronic control device; and if the determination result of the first determination is that there is a security risk in a predetermined function of the at least one driving function, and the security risk can be avoided by disabling the predetermined function, the predetermined function of the electric vehicle is disabled and then the power supply device is permitted to supply power to the electric vehicle.(A7) A charging control device comprising: a determination unit that is communicatively connected to a charging facility having a power supply device for charging an electric vehicle and a communication network connecting the power supply device; and that performs, based on software information including at least firmware information of at least one electronic control device mounted on the electric vehicle, a first determination to determine whether or not there is a security risk to a charging function of the electric vehicle caused by firmware of the at least one electronic control device; and a second determination to determine whether or not the charging facility can avoid the security risk by degrading functions of the power supply device; and a control unit that, when the result of the first determination indicates there is a security risk, determines a degraded mode for degrading functions of the power supply device based on the result of the second determination, and controls power supply from the power supply device to the electric vehicle in the determined degraded mode. (A8) A program for causing a computer communicatively connected to charging equipment having a power supply device for charging an electric vehicle and a communication network connecting the power supply device to perform the following: based on software information including at least firmware information of at least one electronic control device mounted on the electric vehicle, making a first determination to determine whether or not there is a security risk to the charging function of the electric vehicle caused by the firmware of the at least one electronic control device; and a second determination to determine whether or not the charging equipment can avoid the security risk by degrading the function of the power supply device; if the result of the first determination indicates there is a security risk, determining a degraded mode for degrading the function of the power supply device based on the result of the second determination; and controlling power supply from the power supply device to the electric vehicle in the determined degraded mode.(B1) A charging control method used in a charging control device connected to be able to communicate with each of an electric vehicle and a power supply device for charging the electric vehicle, the charging control method comprising: performing a first determination based on software information including at least firmware information of an electronic control device mounted on the electric vehicle to determine whether or not there is a security risk to a plurality of driving functions of the electric vehicle caused by the firmware of the electronic control device; and, if the determination result of the first determination indicates that there is a security risk, performing a second determination to determine whether or not it is possible to disable at least one driving function of the plurality of driving functions that has the security risk and then drive the electric vehicle using another driving function of the plurality of driving functions and avoid the security risk of the electric vehicle; and, if it is possible to disable at least one driving function and then drive the electric vehicle using the other driving function and avoid the security risk of the electric vehicle, disabling the at least one driving function and then allowing the power supply device to supply power to the electric vehicle. (B2) The charging control method described in (B1) above, wherein, when the electric vehicle can be driven using the other driving functions after disabling the at least one driving function and the security risk can be avoided, notification information as to whether or not to disable the at least one driving function is output to the driver, and when notification information indicating consent to disabling the at least one driving function is obtained from the driver, instruction information for disabling the at least one driving function is output to the electric vehicle.(B3) The charging control method according to (B1) or (B2), wherein, if the determination result of the first determination is that there is a security risk and if the second determination is that the security risk can be avoided, a power supply time is set to start power supply after a predetermined waiting time, the first determination is made again by the power supply time, if the determination result of the first determination is that there is no security risk by the power supply time, power supply to the electric vehicle is permitted without disabling the at least one driving function, and if the determination result of the first determination is not that there is no security risk by the power supply time, power supply to the electric vehicle is permitted after disabling the at least one driving function. (B4) The charge control method according to any one of (B1) to (B3), wherein, when the electric vehicle can travel using the other driving functions after disabling the at least one driving function and the security risk can be avoided, instruction information for disabling the at least one driving function is output, and when a notification that the at least one driving function has been disabled is obtained from the electric vehicle, the charge control method according to any one of (B1) to (B3), further determines, in the first determination, based on the software information, whether or not there is a security risk to a charging function of the electric vehicle caused by firmware of the electronic control device, and when a determination result of the first determination indicates that there is a security risk to the charging function and the security risk can be avoided by degrading the functions of the power supply device, determines a degraded mode for degrading the functions of the power supply device in accordance with a type of the security risk, and controls the power supply from the power supply device in the determined degraded mode.(B6) A charging control device comprising: a determination unit that is communicatively connected to each of an electric vehicle and a power supply device that charges the electric vehicle, and that performs a first determination based on software information including at least firmware information of an electronic control device mounted on the electric vehicle to determine whether or not there is a security risk to multiple driving functions of the electric vehicle caused by the firmware of the electronic control device; and, if the determination result of the first determination indicates that there is a security risk, performs a second determination to determine whether or not the electric vehicle can be driven using another driving function of the multiple driving functions and the security risk can be avoided after disabling at least one driving function of the multiple driving functions that has the security risk; and a control unit that, if the electric vehicle can be driven using the other driving function after disabling the at least one driving function and the security risk can be avoided, disables the at least one driving function and allows the power supply device to supply power to the electric vehicle. (B7) A program for causing a computer communicatively connected to each of an electric vehicle and a power supply device for charging the electric vehicle to perform the following: a first determination based on software information including at least firmware information of an electronic control device mounted on the electric vehicle to determine whether or not there is a security risk to multiple driving functions of the electric vehicle caused by the firmware of the electronic control device; and, if the result of the first determination indicates that there is a security risk, a second determination to determine whether or not the electric vehicle can be driven using another driving function of the multiple driving functions after disabling at least one driving function that has the security risk and the security risk of the electric vehicle can be avoided; and, if the electric vehicle can be driven using the other driving function after disabling at least one driving function and the security risk can be avoided, disabling the at least one driving function and allowing the power supply device to supply power to the electric vehicle.(C1) A recording medium (Computer Program Product) on which the program described in (A8) or (B7) above is recorded, the program being executed by a computer.

[0188] REFERENCE SIGNS LIST 1 Charging system 3 Charging equipment 31 Charging station management terminal 311 Detection unit 312 First communication control unit 313 Power supply device management unit 32 Power supply device 33 Equipment communication network 34 Verification network 301 Connection member 4 Charging station management server 41 Charging control unit 411 First determination unit 412 Second determination unit 413 Charging control instruction unit 414 Storage control unit 415 Second communication control unit 416 First verification unit 417 Second verification unit 42 First storage unit 43 Reservation management unit 44 Display unit 45 First communication unit 5 Electric vehicle 51 In-vehicle network 53 External communication I / F 54 Power supply I / F 55 ECU 6 Vehicle management server 61 Information search unit 62 Second communication unit 63 Second storage unit N External network

Claims

1. A charging control method used in a charging control device connected to communicate with both an electric vehicle and a power supply device for charging the electric vehicle, comprising: a first determination based on software information including at least firmware information of an electronic control device mounted on the electric vehicle, determining whether or not there is a security risk to multiple driving functions of the electric vehicle caused by the firmware of the electronic control device; and if the result of the first determination indicates that there is a security risk, a second determination is made to determine whether or not the electric vehicle can be driven using another driving function of the multiple driving functions after disabling at least one driving function that has the security risk and the security risk of the electric vehicle can be avoided; and if the electric vehicle can be driven using the other driving function after disabling the at least one driving function and the security risk can be avoided, the charging control method disables the at least one driving function and permits the power supply device to supply power to the electric vehicle.

2. The charging control method described in claim 1, further comprising: outputting notification information to a driver as to whether or not to disable at least one driving function when the electric vehicle can be driven using the other driving function after disabling the at least one driving function and the security risk can be avoided; and outputting instruction information to disable the at least one driving function to the electric vehicle when notification information indicating agreement to disabling the at least one driving function is obtained from the driver.

3. The charging control method according to claim 1 or 2, further comprising: setting a power supply time to start power supply after a predetermined waiting time when the first determination results in the presence of a security risk and when the second determination can avoid the security risk; making the first determination again by the power supply time; permitting power supply to the electric vehicle without disabling the at least one driving function if the first determination results in no security risk by the power supply time; and permitting the power supply device to supply power to the electric vehicle after disabling the at least one driving function if the first determination does not result in no security risk by the power supply time.

4. The charging control method according to claim 1, further comprising: outputting instruction information for disabling the at least one driving function when the electric vehicle can be driven using the other driving function after disabling the at least one driving function and the security risk can be avoided; and permitting the power supply device to supply power to the electric vehicle when a notification that the at least one driving function has been disabled is obtained from the electric vehicle.

5. The charging control method according to claim 1, further comprising: in the first determination, based on the software information, determining whether or not there is a security risk to a charging function of the electric vehicle caused by firmware of the electronic control device; if a result of the first determination indicates that there is a security risk to the charging function and if the security risk can be avoided by degrading the function of the power supply device, determining a degraded mode for degrading the function of the power supply device in accordance with a type of the security risk; and controlling the power supply of the power supply device to the electric vehicle in the determined degraded mode.

6. A charging control device comprising: a determination unit that is communicatively connected to each of an electric vehicle and a power supply device for charging the electric vehicle, and that performs a first determination based on software information including at least firmware information of an electronic control device mounted on the electric vehicle to determine whether or not there is a security risk to multiple driving functions of the electric vehicle caused by the firmware of the electronic control device, and if the result of the first determination indicates that there is a security risk, a second determination to determine whether or not the electric vehicle can be driven using other driving functions of the multiple driving functions after disabling at least one driving function that has the security risk and the security risk of the electric vehicle can be avoided; and a control unit that disables the at least one driving function and allows the power supply device to supply power to the electric vehicle when the electric vehicle can be driven using other driving functions after disabling the at least one driving function and the security risk can be avoided.

7. A program for causing a computer communicatively connected to both an electric vehicle and a power supply device for charging the electric vehicle to perform the following: a first determination based on software information including at least firmware information of an electronic control device mounted on the electric vehicle, to determine whether or not there is a security risk to multiple driving functions of the electric vehicle caused by the firmware of the electronic control device; and, if the result of the first determination indicates that there is a security risk, a second determination to determine whether or not the electric vehicle can be driven using another driving function of the multiple driving functions after disabling at least one driving function that has the security risk and the security risk of the electric vehicle can be avoided; and, if the electric vehicle can be driven using the other driving function after disabling at least one driving function and the security risk can be avoided, disabling the at least one driving function and allowing the power supply device to supply power to the electric vehicle.

Images