Relay method, relay device, and program

Abstract

Provided is a relay method that is executed by a relay device in an internal network of a mobile body. The internal network includes a plurality of electronic control units. Each of the plurality of electronic control units transmits and receives a frame to and from each other via the relay device. In the relay method, the plurality of electronic control units are classified into a plurality of segments according to the state of the mobile body (S104), and the transmission and the reception of frames between the plurality of segments are controlled.

Description

Relay method, relay device, and program

[0001] The present disclosure relates to a relay method, a relay device, and a program.

[0002] There is a technology relating to a vehicle gateway system that is part of a communication system.

[0003] For example, Patent Document 1 discloses a vehicle gateway device that records information obtained through communication with outside the vehicle if it is software update information, and transfers it if it is determined not to be vehicle-related information.

[0004] Patent No. 5382131

[0005] However, if a remote attacker were to take over some of the devices inside a vehicle, it is conceivable that they could launch an attack on another device by transmitting software update information using the local network. In this case, the technology in the prior art document would transmit the information as soon as it was determined to be software update information, making it difficult to prevent such attacks. In other words, the prior art document has the problem that it is difficult to prevent security attacks on the local network of a mobile object.

[0006] In response to this, the present disclosure provides a relay method, a relay device, and a program that can suppress security attacks in a local network of a mobile body.

[0007] A relay method according to one aspect of the present disclosure is a relay method executed by a relay device in an internal network of a mobile body, the internal network including a plurality of electronic control units, each of which transmits and receives frames to and from the other via the relay device, and the relay method classifies the plurality of electronic control units into a plurality of segments depending on the state of the mobile body, and controls the transmission and reception of frames between the plurality of segments.

[0008] A relay device according to one aspect of the present disclosure is a relay device in an internal network of a mobile body, the internal network including a plurality of electronic control units, each of which transmits and receives frames to and from the other via the relay device, and the relay device classifies the plurality of electronic control units into one or more segments depending on the state of the mobile body, and controls the transmission and reception of frames between the segments.

[0009] A program according to one aspect of the present disclosure is a program for causing a computer to execute the relay method described above.

[0010] These comprehensive or specific aspects may be realized as a system, an apparatus, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM, or may be realized as any combination of a system, an apparatus, an integrated circuit, a computer program, and a recording medium.

[0011] According to the relay method and the like of the present disclosure, attacks on the local network of a mobile body can be suppressed.

[0012] FIG. 1 is a schematic diagram showing the configuration of a communication system according to a first embodiment. FIG. 2 is a block diagram showing the configuration of a network device according to the first embodiment. FIG. 3 is an explanatory diagram showing a status notification frame according to the first embodiment. FIG. 4 is an explanatory diagram showing a mobile object status list according to the first embodiment. FIG. 5 is an explanatory diagram showing a segment list according to the first embodiment. FIG. 6 is an explanatory diagram showing a segment setting table according to the first embodiment. FIG. 7 is a flowchart showing a segment setting method of a network device according to the first embodiment. FIG. 8 is a sequence diagram showing a segment update operation of a communication system according to the first embodiment. FIG. 9 is an explanatory diagram showing a transfer control table for controlling frame transfer by a network device according to the first embodiment. FIG. 10 is an explanatory diagram showing a frame rejection table for controlling frame transfer by a network device according to the first embodiment. FIG. 11 is a flowchart showing a frame transfer method of a network device according to the first embodiment. FIG. 12 is a first sequence diagram showing a frame transfer operation of a communication system according to the first embodiment. FIG. 13 is a second sequence diagram showing a frame transfer operation of a communication system according to the first embodiment. FIG. 14 is a schematic diagram showing the configuration of a communication system according to a second embodiment. FIG. 15 is an explanatory diagram showing an update frame according to the second embodiment. FIG. 16 is an explanatory diagram showing a segment setting table in embodiment 2. FIG. 17 is a sequence diagram showing a segment update operation of the communication system in embodiment 2. FIG. 18 is an explanatory diagram showing a transfer control table that controls frame transfer by the network device in embodiment 2. FIG. 19 is a first sequence diagram showing a frame transfer operation of the communication system in embodiment 2. FIG. 20 is a second sequence diagram showing a frame transfer operation of the communication system in embodiment 2. FIG. 21 is a schematic diagram showing the configuration of a communication system in embodiment 3. FIG. 22 is an explanatory diagram showing a charge / discharge control frame in embodiment 3. FIG. 23 is an explanatory diagram showing a segment setting table in embodiment 3. FIG. 24 is a sequence diagram showing a segment update operation of the communication system in embodiment 3.Fig. 25 is an explanatory diagram showing a transfer control table for controlling frame transfer by network devices in embodiment 3. Fig. 26 is a first sequence diagram showing frame transfer operations of the communication system in embodiment 3. Fig. 27 is a second sequence diagram showing frame transfer operations of the communication system in embodiment 3. Fig. 28 is a third sequence diagram showing frame transfer operations of the communication system in embodiment 3.

[0013] A relay method according to a first aspect of the present disclosure is a relay method executed by a relay device in an internal network of a mobile body, the internal network including a plurality of electronic control units, each of which transmits and receives frames to and from the other via the relay device, and the relay method classifies the plurality of electronic control units into a plurality of segments according to the state of the mobile body, and controls the transmission and reception of frames between the plurality of segments.

[0014] This allows control of frame transmission and reception between multiple segments classified according to the state of the mobile body, making it possible to control whether or not to forward frames depending on the state of the mobile body. In other words, it is possible to prevent unauthorized frames from being communicated between segments depending on the state of the mobile body. Therefore, the relay method can prevent security attacks on the local network of the mobile body. Note that unauthorized frames may be frames that a remote attacker sends using the local network to attack other devices when they have taken over some of the devices inside the mobile body.

[0015] Also, for example, the relay method according to the second aspect may be the relay method according to the first aspect, wherein the state of the moving body includes the running state of the moving body, and when the running state indicates that the moving body is running, the relay method may classify the multiple electronic control units into a first segment related to running and one or more other second segments.

[0016] This makes it possible to suppress security attacks on the local network of the mobile body when the mobile body is in a moving state.

[0017] Also, for example, a relay method according to a third aspect may be a relay method according to the first or second aspect, wherein the state of the mobile body includes a software update state of the mobile body, and when the software update state indicates that the software of the mobile body is being updated, the relay method may classify the plurality of electronic control units into a first segment related to the software update and one or more other second segments.

[0018] This makes it possible to suppress security attacks on the local network of the mobile body when the mobile body is in a software update state.

[0019] Also, for example, a relay method according to a fourth aspect is a relay method according to any one of the first to third aspects, wherein the state of the mobile body includes a charging / discharging state of a battery of the mobile body, and the relay method may classify the plurality of electronic control units into a first segment related to charging / discharging of the battery and one or more other second segments when the charging / discharging state indicates that the mobile body is currently charging or discharging.

[0020] This makes it possible to suppress security attacks on the local network of the mobile body when the mobile body is in a charging / discharging state.

[0021] Furthermore, for example, a relay method according to a fifth aspect is a relay method according to any one of the first to fourth aspects, wherein the state of the mobile body includes a running state of the mobile body and a software update state of the mobile body, and when the software update state indicates that the software of the mobile body is being updated and the running state indicates that the mobile body is running, the relay method may classify the multiple electronic control units into a first segment related to running, a third segment related to the software update, and one or more other second segments.

[0022] This makes it possible to suppress security attacks on the local network of the mobile body when the mobile body is in a traveling state and a software update state.

[0023] Furthermore, for example, a relay method according to a sixth aspect may be a relay method according to any one of the second to fifth aspects, and may control the transmission and reception of frames between the plurality of segments based on predetermined rules for the transmission and reception of frames between the plurality of segments, the predetermined rules corresponding to the state of the moving body.

[0024] This makes it possible to prevent unauthorized frames from being communicated between segments by using predetermined rules that are switched according to the state of the mobile unit.

[0025] Also, for example, the relay method according to the seventh aspect may be the relay method according to the sixth aspect, in which the segment to which an electronic control unit among the plurality of electronic control units that transmitted a frame that was determined not to be forwarded based on the specified rule belongs may be changed to one of the one or more other second segments.

[0026] This makes it possible to prevent an electronic control unit that has transmitted a frame that has been determined not to be forwarded from launching a security attack on other electronic control units that belong to the same segment.

[0027] Also, for example, the relay method according to the eighth aspect may be the relay method according to the sixth aspect, and may output an instruction to turn off the power of an electronic control unit among the plurality of electronic control units that transmitted a frame that was determined not to be forwarded based on the predetermined rule.

[0028] This makes it possible to prevent security attacks by electronic control units that have transmitted frames that have been determined not to be forwarded.

[0029] Also, for example, the relay method according to the ninth aspect may be the relay method according to the sixth aspect, in which a frame transmitted by an electronic control unit among the plurality of electronic control units that has transmitted a frame that has been determined not to be forwarded based on the specified rule is discarded.

[0030] This makes it possible to prevent an electronic control unit that has transmitted a frame that has been determined not to be forwarded from launching a security attack on an electronic control unit that belongs to another segment.

[0031] Also, for example, a relay method according to a tenth aspect may be a relay method according to any one of the sixth to ninth aspects, and the predetermined rule may include a first rule that permits the transfer of frames from the first segment to the second segment and denies the transfer of frames from the second segment to the first segment.

[0032] This means that if no frames are sent from the second segment to the first segment in the state of the mobile body, the frames sent from the second segment to the first segment are likely to be invalid frames, and therefore the frames can be refused from being forwarded.

[0033] Also, for example, a relay method according to an eleventh aspect is a relay method according to any one of the sixth to tenth aspects, and the predetermined rule may include a second rule that refuses to forward a predetermined type of frame when the moving body is in a predetermined state.

[0034] This makes it possible to refuse to transfer frames of a type that cannot be transmitted in the state of the mobile unit.

[0035] Also, for example, a relay method according to a twelfth aspect is a relay method according to an eleventh aspect, wherein the predetermined rule further includes a first rule that permits the transfer of a frame from the first segment to the second segment and denies the transfer of a frame from the second segment to the first segment, and a determination using the second rule may be performed on a frame that is determined to be permitted to be transferred under the first rule.

[0036] This allows two rules, the first rule and the second rule, to be used to determine whether or not a frame can be forwarded, thereby making it possible to better suppress security attacks in the local network of a mobile device than when a single rule is used.

[0037] Also, for example, the relay method according to the thirteenth aspect may be the relay method according to the twelfth aspect, in which, when the source segment and destination segment of the frame are the same, it is determined whether to forward the frame using only the second rule out of the first rule and the second rule.

[0038] This makes it possible to reject the transfer of frames when transmitting and receiving frames between electronic control units within the same segment.

[0039] Furthermore, for example, a relay method according to a fourteenth aspect is a relay method according to any one of the first to thirteenth aspects, wherein the plurality of segments include a driving control segment including one or more electronic control units related to the driving of the mobile body, an autonomous driving control segment including one or more electronic control units related to the autonomous driving of the mobile body, and one or more other segments, and the predetermined rules for transmitting and receiving frames between the plurality of segments, the predetermined rules according to the state of the mobile body, may include permitting the transfer of frames from the driving control segment and the autonomous driving control segment to the one or more other segments, and refusing the transfer of frames from the one or more other segments to the driving control segment and the autonomous driving control segment, and permitting the transfer of frames from the autonomous driving control segment to the driving control segment, and refusing the transfer of frames from the driving control segment to the autonomous driving control segment.

[0040] This allows the vehicle to travel in an autonomous driving mode when the vehicle is in an autonomous driving state.

[0041] Also, for example, a relay method according to a fifteenth aspect may be a relay method according to any one of the first to fourteenth aspects, and each time the state of the moving body changes, the plurality of electronic control units may be reclassified into a plurality of segments according to the state of the moving body after the change.

[0042] This makes it possible to suppress security attacks on the local network of the mobile body even if the state of the mobile body changes.

[0043] Furthermore, a relay device according to a sixteenth aspect of the present disclosure is a relay device in an internal network of a mobile body, the internal network including a plurality of electronic control units, each of which transmits and receives frames to and from the other via the relay device, and the relay device classifies the plurality of electronic control units into one or more segments depending on the state of the mobile body, and controls the transmission and reception of frames between the segments.

[0044] This provides the same effect as the above relay method.

[0045] A program according to a seventeenth aspect of the present disclosure is a program for causing a computer to execute the relay method according to any one of the first to fifteenth aspects.

[0046] This provides the same effect as the above relay method.

[0047] The embodiments will be specifically described with reference to the drawings.

[0048] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, component placement and connection configurations, steps, and step order shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not described in the independent claims that represent the highest concepts are described as optional components.

[0049] Furthermore, in this specification, terms indicating relationships between elements such as "same," as well as numerical values ​​and numerical ranges, are not expressions that express only the strict meaning, but are expressions that also include a substantially equivalent range, for example, a difference of about several percent (or about 10%).

[0050] Furthermore, in this specification, ordinal numbers such as "first" and "second" do not refer to the number or order of components unless otherwise specified, but are used for the purpose of avoiding confusion and distinguishing between components of the same type.

[0051] (First Embodiment) In this embodiment, a method for configuring network devices that can suppress security attacks in a mobile communication system will be described with reference to Figures 1 to 13. Note that a security attack refers to an attack that a remote attacker launches against another device using a local network when they have taken over part of a device inside a mobile device, or a cyber attack on the mobile device from outside the mobile device.

[0052] [1-1. Configuration of Communication System] First, the configuration of a communication system according to this embodiment will be described with reference to FIGS. 1 to 6. FIG.

[0053] FIG. 1 is a schematic diagram showing the configuration of a communication system 1 according to the present embodiment.

[0054] 1 is a communication system in a network (internal network) of a mobile object M. The communication system 1 is configured to include a plurality of devices mounted on the mobile object M and constituting a network.

[0055] The communication system 1 includes a network device 10 , a status notification ECU 20 , and an ECU 30 .

[0056] The status notification ECU 20 and the ECU 30 are so-called ECUs (Electronic Control Units) that correspond to devices (also simply referred to as devices) connected to the communication system 1. The communication system 1 includes a plurality of ECUs. Each of the plurality of ECUs can transmit and receive frames to and from each other via the network device 10.

[0057] The network device 10 corresponds to a device (also simply referred to as a device) that can communicate with each of the devices connected to the communication system 1. The network device 10 is a relay device that transfers a communication frame (also simply referred to as a frame) transmitted by one of the multiple devices to another of the multiple devices in the network of the mobile object M.

[0058] The devices connected to the communication system 1 are not limited to the status notification ECU 20, the ECU 30, and the network device 10. The number of status notification ECUs 20 and ECUs 30 connected to the communication system 1 is not particularly limited, and may be one or more.

[0059] The ECU 30 is an ECU that controls the moving object M. The ECU 30 may be an ECU that controls the moving object M, such as an ECU that controls the braking, steering, etc. of the moving object M, or an ECU that controls multimedia such as audio, navigation, etc., but is not limited to these.

[0060] The status notification ECU 20 is an ECU that has a function of notifying the mobile body status, which is the status of the mobile body M. The mobile body status may be, for example, a running status of the mobile body M (running, stopped, autonomous driving, etc.), an OTA (Over The Air) status (no OTA, ECU 30 OTA in progress, etc.), a diagnostic status (no diagnosis, ECU 30 diagnosis in progress, etc.), a charge / discharge status (no charging / discharging, charging, discharging, etc.), a connection status of an information processing terminal (no information processing terminal connection, smartphone connection, etc.), etc., but is not limited to these. The OTA status is an example of a software update status, and being OTA means that software is being updated. The charge / discharge status includes the charge / discharge status of a battery installed in the mobile body M.

[0061] The state notification ECU 20 may, for example, acquire information on shifting, braking, steering, etc. from the ECU 30 and notify the network device 10 of the driving state based on the acquired information.

[0062] The default segment 40 and the cruise control segment 50 are so-called segments, which are units of range that make up a network and are frame transfer ranges. Specifically, the segments may be realized by a Virtual Local Area Network (VLAN) or by segments in Software Defined Networking (SDN). The segments are not limited to the default segment 40 and the cruise control segment 50.

[0063] The default segment 40 is a segment set in the initial state of the network device 10, and may be a segment to which devices that are not segment-controlled by the network device 10 belong. For example, if all ECUs are not segment-controlled, all ECUs belong to the default segment 40. FIG. 1 shows an example in which the default segment 40 is composed only of the status notification ECU 20. Note that the number of ECUs that belong to the default segment 40 is not particularly limited and may be two or more. The default segment 40 is an example of one or more other second segments.

[0064] The driving control segment 50 may be composed of one or more devices that control driving operations of the moving object M, such as driving, turning, and stopping. The device that controls driving operations may be composed of, for example, a device that can control the steering of the moving object M. FIG. 1 shows an example in which the driving control segment 50 is composed only of an ECU 30. Note that the number of ECUs belonging to the driving control segment 50 is not particularly limited and may be two or more. The driving control segment 50 is an example of a first segment related to driving.

[0065] The number of segments included in the communication system 1 is not particularly limited as long as it is two or more, and may be, for example, three or more. Furthermore, each ECU belonging to each segment is connected to a network device 10 within the communication system 1.

[0066] 2 is a block diagram showing the configuration of the network device 10 according to the present embodiment. The network device 10 executes a process of switching segments (ECUs constituting the segments) depending on the mobile object status based on a status notification frame 60 (see FIG. 3, which will be described later).

[0067] 2, the network device 10 includes an acquisition unit 11, a determination unit 12, a management unit 13, a communication unit 14, and a storage unit 15. Some or all of the functional units included in the network device 10 are realized by a processor (e.g., a CPU (Central Processing Unit)) included in the network device 10 executing a predetermined program using a memory.

[0068] The communication unit 14 is a communication interface connected to a device. The communication unit 14 may include one or more wired communication interfaces (e.g., Ethernet (registered trademark), etc., the same applies hereinafter), one or more wireless communication interfaces (e.g., Wi-Fi (registered trademark), etc., the same applies hereinafter), or both of the above communication interfaces. The wired communication interface has a physical port to which a communication cable (also simply referred to as a cable) is connected. The wireless communication interface has a communication antenna and a wireless circuit.

[0069] The communication unit 14 receives frames from devices connected to the network device 10, and transfers the received frames using the result of the determination made by the determination unit 12 as to whether the frames can be transferred.

[0070] The acquisition unit 11 acquires a frame received by the communication unit 14 .

[0071] When the acquisition unit 11 acquires a frame, the determination unit 12 determines whether the frame can be forwarded. When the acquired frame is a status notification frame 60, the determination unit 12 further determines whether the mobile object status of the mobile object M has changed.

[0072] The storage unit 15 stores tables and lists. The tables and lists stored in the storage unit 15 can be used when the network device 10 sets segments and controls frame forwarding. The storage unit 15 can store, for example, a mobile object status list, a segment list, a forwarding control table, a frame rejection table, a segment setting table, etc. The tables and lists stored in the storage unit 15 will be described later with reference to FIGS. 4 to 6, 9, and 10. The storage unit 15 can be realized by, for example, a semiconductor memory or a hard disk drive (HDD), but is not limited to these.

[0073] The management unit 13 manages which segment each ECU belongs to. For example, when the determination unit 12 determines that the mobile object state of the mobile object M has changed or when the determination unit 12 determines that frame transfer is not permitted, the management unit 13 updates the list held by the storage unit 15.

[0074] When the determination unit 12 determines that the mobile body state of the mobile body M has changed, the management unit 13 records the changed mobile body state in the mobile body state list held by the storage unit 15. The management unit 13 further updates the segment list so that the segments and segment configuration in the communication system 1 correspond to the changed mobile body state.

[0075] Furthermore, when the determination unit 12 determines that the forwarding of the frame is not permitted, the management unit 13 updates the segment list held by the storage unit 15 so that the source device of the frame belongs to the default segment 40. By the above process, the management unit 13 isolates the source device that sent the frame whose forwarding is denied from the segment to which the source device belonged to the default segment 40, thereby suppressing security attacks against other devices in the segment to which the source device belonged. Instead of changing the source device to the default segment 40, the management unit 13 may suppress security attacks by turning off the power to the source device or by refusing to forward all frames transmitted by the source device. Note that refusing to forward all frames includes, for example, refusing to forward frames regardless of the destination segment or frame type.

[0076] FIG. 3 is an explanatory diagram showing a status notification frame 60 in this embodiment.

[0077] The status notification frame 60 is an example of a frame. The status notification frame 60 can be used when notifying devices connected to the communication system 1 of the mobile unit status of the mobile unit M.

[0078] The status notification frame 60 includes source information 61 , destination information 62 , and mobile unit status 63 .

[0079] The source information 61 and the destination information 62 are identifiers that can uniquely identify the source and destination of a frame. The source information 61 and the destination information 62 may be, for example, a Media Access Control (MAC) address or an Internet Protocol (IP) address. Note that if the communication protocol is a message addressing system, the source information 61 may be empty, and the destination information 62 may be an identifier that can uniquely identify a frame (for example, a CAN-ID if the communication protocol is CAN).

[0080] The mobile object state 63 indicates the state of the mobile object M. The mobile object state 63 may be, for example, the running state of the mobile object M (running, stopped, autonomous driving, etc.), the OTA state (no OTA, OTA of the ECU 30, etc.), the diagnostic state (no diagnosis, diagnosing the ECU 30, etc.), the charge / discharge state (no charging / discharging, charging, discharging, etc.), the connection state of the information processing terminal (no information processing terminal connection, smartphone connected, etc.), etc. The mobile object state 63 can be identified based on sensing results of various sensors mounted on the mobile object M, etc.

[0081] FIG. 4 is an explanatory diagram showing a moving object state list in this embodiment.

[0082] The moving object status list is a list for storing the moving object status of the moving object M. The moving object status list is held by the storage unit 15 and can be updated by the management unit 13.

[0083] In FIG. 4, the moving object state is shown as being in motion.

[0084] The number and types of states included in the mobile object state shown in the mobile object state list are not limited to the number (one) and type (traveling state) shown in Fig. 4, and may be composed of one or more states, or may include other states. The other mobile object state may be, for example, at least one of an OTA state, a diagnostic state, a charge / discharge state, a connection state of the information processing terminal, etc.

[0085] 5 is an explanatory diagram showing a segment list in this embodiment. Fig. 5 shows an example of a segment list when the moving object state is moving. The segment list is generated for each state of the moving object M, for example.

[0086] The segment list is a list for storing segments and segment configurations, i.e., devices included in each segment, in the communication system 1. The segment list is held in the storage unit 15 and can be updated by the management unit 13. For example, the segment list can be updated by the management unit 13 every time the state of the mobile object changes.

[0087] 5 shows a default segment 40 and a cruise control segment 50. In FIG. 5, the default segment 40 includes the status notification ECU 20, and the cruise control segment 50 includes the ECU 30, as the segment configuration.

[0088] The number and types of segments shown in the segment list are not limited to the two segments shown in Fig. 5, and may be composed of one or more segments, or may include other segments. The other segments may be, for example, at least one of an OTA segment, a diagnostic segment, a charge / discharge segment, an information processing terminal segment, etc.

[0089] Furthermore, the segment configuration shown in the segment list is not limited to the combination of devices shown in Figure 5, but may be composed of devices connected to the communication system 1, or there may be no devices belonging to the segment.

[0090] When the communication protocol is a message addressing system, the segment configuration shown in the segment list may be configured by the communication interface of the communication unit 14 instead of the devices belonging to each segment.

[0091] 6 is an explanatory diagram showing a segment setting table in this embodiment, which shows how segments are configured for each moving body state.

[0092] The segment setting table is a table for updating the segment list, and records the segments and segment configurations for each mobile object state. The segment setting table can be stored in the storage unit 15.

[0093] The segment setting table shown in FIG. 6 shows two moving states (stopped and moving) as moving body states, as well as the segments and segment configurations for each moving body state.

[0094] The segment setting table indicates that, for example, when the vehicle is stopped, the default segment 40 is made up of the status notification ECU 20 and the ECU 30, and the driving control segment 50 has no constituent devices.

[0095] In the segment setting table, the mobile object state, segments, and segment configuration may be updated in accordance with the addition / removal of devices connected to the communication system 1, the addition / removal of device functions, etc.

[0096] Note that the moving object states, segments, and segment configurations shown in the segment setting table are not limited to those described above, and may be moving object states, segments, and segment configurations other than those described above.

[0097] In addition, when the communication protocol is a message addressing system, the segment configuration shown in the segment setting table may be configured by the communication interface of the communication unit 14 instead of the devices belonging to each segment.

[0098] [1-2. Operation of the Communication System] Next, the operation of the communication system configured as described above will be described with reference to Fig. 7 to Fig. 13. Fig. 7 is a flowchart showing a segment setting method (relay method) of the network device 10 in this embodiment. Fig. 7 shows, as an example, the segment setting method of the network device 10 when the status notification ECU 20 transmits a status notification frame 60.

[0099] In step S101 , the acquisition unit 11 acquires the state notification frame 60 transmitted by the state notification ECU 20 and received by the communication unit 14 .

[0100] In step S102, the determination unit 12 determines whether the mobile object state of the mobile object M has changed. The determination unit 12 compares the mobile object state listed in the mobile object state list held by the storage unit 15 (for example, the mobile object state listed in the previously acquired state notification frame 60) with the mobile object state 63 listed in the state notification frame 60 acquired in step S101, and if the mobile object states are different, determines that the mobile object state of the mobile object M has changed to the mobile object state 63 listed in the state notification frame 60. If the determination unit 12 determines that the mobile object state has changed (Yes in S102), the process proceeds to step S103; if not (No in S102), the determination unit 12 ends the segment setting of the network device 10.

[0101] In step S103, the management unit 13 updates the mobile body state listed in the mobile body state list held by the memory unit 15 to the mobile body state 63 notified in the state notification frame 60 (i.e., the latest state notification frame) acquired in step S101.

[0102] In step S104, the management unit 13 updates the segment list held by the storage unit 15 so that the segments and segment configuration in the communication system 1 correspond to the mobile object state updated in step S103. The management unit 13 first identifies, in the segment setting table, the segments and segment configuration corresponding to the mobile object state listed in the mobile object state list. The management unit 13 then updates the segment list based on the identified segments and segment configuration. Step S104 is an example of a process of classifying multiple ECUs into multiple segments according to the state of the mobile object M. Note that the management unit 13 may reclassify the multiple ECUs into multiple segments each time the state of the mobile object M changes. Furthermore, the multiple classified segments may be set for each state of the mobile object M. For example, each time the state of the mobile object M changes, the multiple ECUs may be reclassified into multiple segments according to the state of the mobile object M after the change.

[0103] FIG. 8 is a sequence diagram showing the segment update operation (relay method) of the communication system 1 in this embodiment. The sequence diagram shown in FIG. 8 shows the operation of the communication system 1 when the state notification ECU 20 notifies the network device 10 that the traveling state is traveling using the state notification frame 60. The traveling state of the mobile object described in the mobile object state list is assumed to be stopped. That is, FIG. 8 will be used to explain the update process of the mobile object state list and the segment list when the mobile object state changes from stopped to traveling. Note that the same processes as those shown in FIG. 7 are assigned the same reference numerals, and detailed description thereof will be omitted.

[0104] In step S201, the status notification ECU 20 transmits the status notification frame 60 including the mobile object status 63 indicating that the traveling state is traveling to the network device 10. The network device 10 acquires the transmitted status notification frame 60 (S101).

[0105] In step S102, the network device 10 determines that the running state of the mobile body M has changed from stopped to running because the running state listed in the mobile body state list is stopped and the running state listed in the mobile body state 63 of the state notification frame 60 is running.

[0106] In step S103, the network device 10 updates the traveling state in the moving object state list from stopped to traveling.

[0107] In step S104, if the driving state is "driving," the network device 10 identifies a segment corresponding to the "driving" driving state and the segment configuration based on the segment setting table. Based on the identified segment and segment configuration, the network device 10 updates the segment list so that the default segment 40 is configured with the status notification ECU 20 and the driving control segment 50 is configured with the ECU 30. Specifically, the management unit 13 of the network device 10 updates the segment list so that the default segment 40 is configured with the status notification ECU 20 instead of being configured with the status notification ECU 20 and the ECU 30, and so that the driving control segment 50 is configured with the ECU 30 instead of being configured with an ECU.

[0108] Step S104 can also be said to be a process in which, when the driving state is driving, the network device 10 classifies multiple ECUs into a driving control segment 50 related to driving and one or more other segments (here, the default segment 40).

[0109] By the above process, the network device 10 can update the segments and segment configuration of the communication system 1 in response to changes in the mobile state of the mobile unit M.

[0110] As described above, the communication unit 14 transfers frames using the result of the determination made by the determination unit 12 as to whether or not the frame can be transferred. The determination unit 12 can control the determination as to whether or not the frame can be transferred between different segments in accordance with predetermined transfer control information. A transfer control table, which is an example of the transfer control information, will be described with reference to FIG. 9 .

[0111] 9 is an explanatory diagram showing a transfer control table for controlling frame transfer by the network device 10 in this embodiment. The transfer control table can be held in the storage unit 15.

[0112] The transfer control table shown in Figure 9 includes a source segment indicating the segment to which the device indicated by the source information of the frame belongs, a destination segment indicating the segment to which the device indicated by the destination information belongs, and an entry indicating whether or not the frame can be transferred from the source segment to the destination segment (whether to allow (written as "OK") or to reject (written as "NG")). Note that Figure 9 shows the transfer control table when the mobile object state is moving. The transfer control table may be set individually for each mobile object state, for example. The transfer control table is an example of a predetermined rule (first rule).

[0113] FIG. 9 shows that frame transfer from the default segment 40 (second segment) to the cruise control segment 50 (first segment) is denied. The default segment 40 is a segment not related to cruise control. When the vehicle state is in a driving state, frame transfer from the default segment 40, which is not related to cruise control, to the cruise control segment 50 related to cruise control is denied. FIG. 9 also shows that frame transfer from the cruise control segment 50 (first segment) to the default segment 40 (second segment) is permitted. When the vehicle state is in a driving state, frame transfer from the cruise control segment 50, which is related to cruise control, to another segment not related to cruise control is permitted. For example, when the vehicle state is in a driving state and the default segment 40 includes a car navigation ECU that controls a car navigation system, frames from the cruise control segment 50 are transferred to the car navigation ECU to display information related to the vehicle M. However, because the car navigation ECU does not control cruise control, frame transfer from the car navigation ECU to the cruise control segment 50 is denied.

[0114] The transfer control table may have entries updated to indicate whether to allow or deny transfer of source segments, destination segments, and frames in accordance with the addition / removal of devices connected to the communication system 1, or the addition / removal of device functions.

[0115] The source segments, destination segments, and entries included in the transfer control table are not limited to those described above, and may include source segments, destination segments, and entries other than those described above.

[0116] When the acquisition unit 11 receives a frame, the determination unit 12 can determine whether to allow or deny the transfer of the frame using the transfer control table shown in Figure 9 based on the segment to which the device indicated in the frame's source information belongs and the segment to which the device indicated in the frame's destination information belongs.

[0117] Even if the determination unit 12 permits the transfer of a frame in accordance with the transfer control information, there may be cases where the determination unit 12 ultimately rejects the transfer of the frame using predetermined frame rejection information. A frame rejection table, which is an example of frame rejection information, will be described with reference to FIG. 10 .

[0118] 10 is an explanatory diagram showing a frame rejection table for controlling frame forwarding by the network device 10 in this embodiment. The frame rejection table can be held in the storage unit 15.

[0119] The frame rejection table shown in Fig. 10 includes the mobile unit status and the frame type for which forwarding is rejected. The frame rejection table is an example of a predetermined rule (second rule).

[0120] For example, the frame rejection table indicates that transfer of charge / discharge control frames is rejected when the vehicle is in motion. Since charge / discharge control frames are not transmitted while the vehicle is moving, transfer of frames of a type included in the frame rejection table (charge / discharge control frames in the example of FIG. 10) is rejected even if the frame is from a source segment to a destination segment where transfer is permitted.

[0121] In this way, the frame rejection table includes information that rejects the transfer of frames of a predetermined type when the mobile unit M is in a predetermined state.

[0122] The frame rejection table may be updated with the mobile state and frame type in accordance with the addition / removal of devices connected to the communication system 1, the addition / removal of device functions, and the like.

[0123] The moving object states and frame types listed in the frame rejection table are not limited to those shown in FIG.

[0124] The determination unit 12 can use a frame rejection table to determine whether or not to forward a frame (whether to allow or reject the forwarding) based on the mobile body status listed in the mobile body status list held by the memory unit 15 and the frame type of the frame acquired by the acquisition unit 11.

[0125] 11 is a flowchart showing a frame forwarding method (relay method) of the network device 10 according to this embodiment. Fig. 11 shows the operation of controlling the transmission and reception of frames between multiple segments after multiple ECUs are classified into multiple segments according to the state of the mobile object M.

[0126] In step S301, the acquisition unit 11 acquires a frame received by the communication unit 14.

[0127] In step S302, the determination unit 12 determines whether the frame source (source segment) and the frame destination (destination segment) are in the same segment. The determination unit 12 determines whether the frame can be forwarded based on the determination of whether the frames are in the same segment.

[0128] The determination unit 12 first identifies the source device and the destination device based on the source information and destination information written in the frame. Note that if the source information is empty, the source device may be the communication interface through which the communication unit 14 received the frame. Furthermore, if the destination information is an identifier that can uniquely identify the frame, the destination device may be the device that processes the frame or a communication interface that can communicate with the device that processes the frame.

[0129] The determination unit 12 then refers to the segment list held in the storage unit 15 and identifies the source segment, which is the segment to which the source device belongs, and the destination segment, which is the segment to which the destination device belongs. If the source segment and the destination segment are the same (Yes in S302), the determination unit 12 proceeds to step S304, and if the source segment and the destination segment are different (No in S302), the determination unit 12 proceeds to step S303.

[0130] In step S303, the determination unit 12 determines whether or not frame transfer from the source segment to the destination segment is permitted based on whether or not the transfer control table permits frame transfer. If frame transfer is permitted (Yes in S303), the process proceeds to step S304, and if frame transfer is denied (No in S303), the process proceeds to step S305. In step S303, the transmission and reception of frames between multiple segments is controlled based on a predetermined rule for transmitting and receiving frames between multiple segments (here, the transfer control table).

[0131] In step S304, even if the frame transfer was permitted in step S302 or step S303, the determination unit 12 determines whether or not the frame can ultimately be transferred based on whether the mobile object status listed in the mobile object status list held by the storage unit 15 and the frame type of the frame acquired by the acquisition unit 11 match the frame rejection table. If they match the frame rejection table (Yes in S304), the process proceeds to step S305; if they do not match the frame rejection table (No in S304), the process proceeds to step S306. In step S304, the transmission and reception of frames between multiple segments can also be said to be controlled based on a predetermined rule for transmission and reception of frames between multiple segments (here, the frame rejection table).

[0132] In this way, step S304 may be executed for a frame determined as Yes in step S303. For example, for a frame determined as permitted for forwarding using the forwarding control table, a determination as to whether or not to forward the frame may be executed using the frame rejection table.

[0133] In this way, for a frame determined as Yes in step S302, it may be determined whether to forward the frame using only the frame rejection table out of the forwarding control table and the frame rejection table, i.e., it may be determined whether the type of the frame matches the frame type included in the frame rejection table.

[0134] If the answer is No in step S303 or Yes in step S304, the determination unit 12 determines that refusal of the frame is permitted, and if the answer is No in step S304, the determination unit 12 determines that transfer of the frame is permitted.

[0135] In step S305, since the determination unit 12 determines that the transfer of the frame is to be rejected, the communication unit 14 does not transfer the frame acquired by the acquisition unit 11. Note that the communication unit 14 may transmit an error frame indicating that the transfer of the frame has been rejected to the device that sent the frame.

[0136] In step S306, since the determining unit 12 determines that the transfer of the frame is permitted, the communication unit 14 transfers the frame acquired by the acquisition unit 11 to the destination device.

[0137] In step S307, the management unit 13 changes (updates) the segment list so that the sender (sender device) belongs to the default segment 40 (an example of one or more other segments). In the segment list held by the storage unit 15, the management unit 13 changes the segment to which the sender device belongs to the default segment 40. For example, the management unit 13 changes the segment of a plurality of ECUs that has transmitted a frame that has been determined not to be forwarded based on a predetermined rule to one of one or more other segments (here, the default segment 40).

[0138] This allows the ECU related to the mobile body state and the source ECU that may be under attack to belong to different segments, thereby improving security for the ECU related to the mobile body state.

[0139] 11, an example in which the determinations of both steps S303 and S304 are executed has been described, but the present invention is not limited to this, and only one of the determinations of steps S303 and S304 may be executed. In other words, it is sufficient that the determination is executed using at least one of the forwarding control table and the frame rejection table in FIG. 11. Furthermore, if step S304 is not executed, the network device 10 passes through frames transmitted and received between ECUs in the same segment (forwards the frames as they are without determining whether the frames can be forwarded).

[0140] In step S307, instead of changing the segment list, the management unit 13 may output an instruction to turn off the power of a source device that has transmitted a frame determined not to be forwarded based on a predetermined rule, to the source device, via the communication unit 14. In addition, in step S307, instead of changing the segment list, the management unit 13 may discard a frame transmitted by an ECU (source device) that has transmitted a frame determined not to be forwarded based on a predetermined rule, among the multiple ECUs.

[0141] 12 is a first sequence diagram showing the frame forwarding operation (relay method) of the communication system 1 in this embodiment. The sequence diagram shown in FIG. 12 shows the operation of the communication system 1 when a state notification ECU 20 belonging to a default segment 40 transmits a frame to an ECU 30 also belonging to the default segment 40. The mobile object state listed in the mobile object state list is assumed to be a stopped running state. Furthermore, the transfer control table and the frame rejection table are assumed to be in the states shown in FIGS. 9 and 10. Note that the same processes as those shown in FIG. 11 are assigned the same reference numerals, and detailed explanations will be omitted.

[0142] In step S401, the status notification ECU 20 transmits a frame, and the network device 10 receives the transmitted frame (S301).

[0143] In step S302, the network device 10 first identifies that the source device is the status notification ECU 20 and that the destination device is the ECU 30 based on the source information and destination information of the frame. The network device 10 then references the segment list and identifies that the source segment and destination segment are the default segment 40. The network device 10 permits the forwarding of the frame if the source segment and destination segment belong to the same segment. In other words, the determination unit 12 of the network device 10 may uniformly permit the transmission and reception of frames between ECUs within the same segment. In this case, the transfer control table and frame rejection table are not used.

[0144] In step S304, if the traveling state listed in the mobile object state list is not traveling and the frame type of the frame acquired by the network device 10 is not a charge / discharge control frame, the frame does not match the entry in the frame rejection table, so the network device 10 allows the frame to be transferred. Step S304 corresponds to step S304 shown in Fig. 11, and a check (determination) is made to see if the frame type of the frame matches the frame rejection table.

[0145] In step S306, the network device 10 transfers the frame acquired in step S301 to the ECU 30, which is the destination device.

[0146] Through the above process, the network device 10 can transfer the frame transmitted by the status notification ECU 20 to the ECU 30 .

[0147] 13 is a second sequence diagram showing the frame forwarding operation (relay method) of the communication system 1 in this embodiment. The sequence diagram shown in FIG. 13 shows the operation of the communication system 1 when the state notification ECU 20 belonging to the default segment 40 transmits a frame to the ECU 30 belonging to the driving control segment 50. The moving object state listed in the moving object state list is assumed to be in driving. The forwarding control table and the frame rejection table are assumed to be in the states shown in FIGS. 9 and 10. Note that the same processes as those shown in FIG. 11 are assigned the same reference numerals, and detailed description thereof will be omitted.

[0148] In step S402, the status notification ECU 20 transmits a frame. The network device 10 receives the transmitted frame (S301).

[0149] In step S302, the network device 10 first identifies, based on the source information and destination information of the frame, that the source device is the status notification ECU 20 and that the destination device is the ECU 30. The network device 10 further references the segment list and identifies that the source segment is the default segment 40 and the destination segment is the driving control segment 50. If the source segment and the destination segment are different, the network device 10 determines whether to forward the frame using the forwarding control table.

[0150] In step S303, the network device 10 refers to the transfer control table and denies the frame transfer because frame transfer from the default segment 40 to the driving control segment 50 is denied when the driving state is in motion. Step S303 corresponds to step S303 shown in Fig. 11, and a check (determination) is made as to whether or not the transfer is permitted in the transfer control table.

[0151] In step S305, the network device 10 does not forward the frame acquired in step S301 to the destination device, ECU 30, but instead sends an error frame indicating that the forwarding of the frame has been rejected to the source device, status notification ECU 20.

[0152] In step S307, the network device 10 changes the segment of the status notification ECU 20, which is the source device, to the default segment 40. The network device 10 may change the segment list so that the source device belongs to the default segment 40, for example.

[0153] By the above process, when the traveling state of the mobile object M is in motion, the network device 10 does not transfer the frame transmitted from the status notification ECU 20 to the ECU 30. In other words, even if the status notification ECU 20 is taken over by an attacker and transmits a security attack frame to the ECU 30, if the mobile object M is in motion, the ECU 30 belonging to the driving control segment 50 can be protected from the attack, and therefore security attacks can be suppressed when the mobile object M is in a high-risk state, such as when it is in motion.

[0154] In this way, the network device 10 can suppress security attacks by changing the segments and segment configuration depending on the mobile state of the mobile object M.

[0155] Second Embodiment In this embodiment, a method of setting up network devices that can suppress security attacks in a mobile communication system will be described with reference to FIGS.

[0156] [2-1. Configuration of the Communication System] First, the configuration of the communication system according to this embodiment will be described with reference to FIGS.

[0157] In this embodiment, another configuration example of a network device that can suppress security attacks in a mobile body communication system will be described. In this embodiment, it is assumed that software of an ECU in a mobile body M is updated. In addition, in this embodiment, the mobile body state includes a software update state.

[0158] FIG. 14 is a schematic diagram showing the configuration of a communication system 2 according to this embodiment.

[0159] The communication system 2 shown in FIG. 14 is a communication system in a network of mobile units M, similar to the communication system 1 in FIG.

[0160] The communication system 2 includes a network device 10 , an external communication device 70 , an OTA control device 80 , a status notification ECU 20 , and an ECU 30 .

[0161] The network device 10, the status notification ECU 20, and the ECU 30 are the same as the network device 10, the status notification ECU 20, and the ECU 30 in FIG.

[0162] The external communication device 70 and the OTA control device 80 correspond to devices (also simply referred to as devices) connected to the communication system 2 .

[0163] It should be noted that the devices connected to the communication system 2 are not limited to the external communication device 70 , the OTA control device 80 , the status notification ECU 20 , the ECU 30 , and the network device 10 .

[0164] The default segment 40 and the cruise control segment 50 are similar to the default segment 40 and the cruise control segment 50 of FIG.

[0165] The OTA segment 90 is a so-called segment that corresponds to the transfer range of a communication frame (also simply referred to as a frame) transmitted by a device in the network of the mobile body M. Note that the segments are not limited to the default segment 40, the OTA segment 90, and the driving control segment 50.

[0166] The external network N may include an internet service provider's network, a mobile communication system (3G (3rd Generation), 4G (4th Generation), 5G (5th Generation), etc.), or the internet.

[0167] The external communication device 70 is a device that communicates with a communication device such as the OTA server 100 connected to the external network N. The external communication device 70 may be, for example, a DCM (Data Communication Module).

[0168] The external communication device 70 is connected to an external network N and is capable of communicating with a communication device connected beyond the external network N. The external communication device 70 transfers frames between the external network N and the network device 10, thereby enabling communication between the communication device connected beyond the external network N and a device connected to the network device 10. The external communication device 70 is also connected between the external network N and the network device 10.

[0169] The OTA control device 80 is a device that uses OTA technology to obtain information about a specific program from an external communication device 70 or an OTA server 100 that distributes programs via a network, and updates the programs of devices connected to the communication system 2 using the obtained information about the program.

[0170] The OTA control device 80 may notify the device of the OTA status (no OTA, ECU 30 OTA in progress, etc.) in a status notification frame 60 at the start or end of OTA, in order to notify the device whether a program update is being performed using OTA technology.

[0171] The OTA segment 90 is a unit of a range constituting a network, and is a so-called segment that is a frame transfer range. Specifically, the segment may be realized by a VLAN or a segment in an SDN.

[0172] The OTA segment 90 may be configured of any of the following: a device that is the target of OTA, a device that controls OTA, or a device that transmits frames related to OTA. The OTA segment 90 may be configured of, for example, an external communication device 70 that can transfer frames including an update program, an OTA control device 80 that controls program updates, and a device that can be the target of a program update (e.g., the external communication device 70, the OTA control device 80, the network device 10, the status notification ECU 20, or the ECU 30).

[0173] Figure 14 shows an example in which the default segment 40 is composed only of the status notification ECU 20, the OTA segment 90 is composed of an external communication device 70 and an OTA control device 80, and the driving control segment 50 is composed only of the ECU 30.

[0174] FIG. 15 is an explanatory diagram showing the update frame 110 in this embodiment.

[0175] The update frame 110 is an example of a frame and can be used when notifying the destination device of an update program.

[0176] The update frame 110 includes source information 111 , destination information 112 , and an update program 113 .

[0177] The source information 111 and destination information 112 are the same as the source information 61 and destination information 62 of the status notification frame 60 in FIG.

[0178] The update program 113 is a program for updating firmware or software of devices connected to the communication system 2. The update program 113 may be, for example, a patch for a vulnerability in the ECU, a program for adding functions to the ECU, or information for updating a table held in the storage unit 15.

[0179] FIG. 16 is an explanatory diagram showing a segment setting table in this embodiment. While the OTA status when the vehicle is stopped in FIG. 16 shows two cases, "no OTA" and "ECU OTA in progress," it may also be three cases, "no OTA," "ECU OTA in progress," and "status notification ECU OTA in progress," as in the case when the vehicle is stopped. Furthermore, while the OTA status when the vehicle is moving in FIG. 16 shows three cases, "no OTA," "ECU OTA in progress," and "status notification ECU OTA in progress," it may also be two cases, "no OTA" and "ECU OTA in progress," as in the case when the vehicle is stopped.

[0180] The segment setting table is a table for updating the segment list, and records the segments and segment configurations for each mobile object state. The segment setting table can be stored in the storage unit 15.

[0181] The segment setting table shown in FIG. 16 shows combinations of two mobile object states (traveling state and OTA state), segments for each combination of mobile object states, and segment configurations.

[0182] The segment setting table shows that, for example, when the driving state is stopped and the OTA state is no OTA, the default segment 40 is composed of an external communication device 70, an OTA control device 80, a status notification ECU 20, and an ECU 30, and the driving control segment 50 and the OTA segment 90 do not have any constituent devices.

[0183] In this way, the segment setting table may include, as the mobile object state, the driving state of the mobile object M and the software update state (OTA state) of the mobile object M. In this case, when the software update state indicates that the software of the mobile object M is being updated and the driving state indicates that the mobile object M is driving, the management unit 13 may classify the multiple ECUs into a driving control segment (first segment) related to driving, an OTA segment 90 (third segment) related to software updates, and a default segment 40 (one or more other second segments). Note that the combination may be a combination of three or more states. Furthermore, one ECU is classified to belong to any one of the multiple segments.

[0184] The segment setting table may be updated with respect to the mobile object state, segments, and segment configuration in accordance with the addition / removal of devices connected to the communication system 2, or the addition / removal of device functions.

[0185] The combinations of the mobile object states, segments, and segment configurations shown in the segment setting table are not limited to those described above, and may be combinations of the mobile object states, segments, and segment configurations other than those described above. For example, the combinations of the mobile object states may be combinations of at least two of the traveling state, OTA state, diagnostic state, charge / discharge state, and connection state of the information processing terminal of the mobile object M.

[0186] In addition, when the communication protocol is a message addressing system, the segment configuration shown in the segment setting table may be configured by the communication interface of the communication unit 14 instead of the devices belonging to each segment.

[0187] [2-2. Operation of Communication System] Next, the operation of the communication system 2 according to the present embodiment will be described with reference to FIGS.

[0188] 17 is a sequence diagram showing a segment update operation (relay method) of the communication system 2 in this embodiment. The sequence diagram shown in FIG. 17 shows the operation of the communication system 2 when the OTA control device 80 notifies the network device 10, using the status notification frame 60, that the OTA status of the ECU 30 is in OTA. The mobile object status listed in the mobile object status list is assumed to be a driving status of "driving" and an OTA status of "no OTA." Note that the same processes as those shown in FIG. 7 are denoted by the same reference numerals, and detailed description thereof will be omitted.

[0189] In step S501, the OTA control device 80 transmits to the network device 10 a status notification frame 60 including a mobile object status 63 in which the OTA status is in progress of OTA of the ECU 30. The network device 10 acquires the transmitted status notification frame 60 (S101).

[0190] In step S102, if the OTA status listed in the mobile status list is no OTA and the OTA status listed in the mobile status 63 of the status notification frame 60 is in OTA of the ECU 30, the network device 10 determines that the OTA status has changed to in OTA of the ECU 30.

[0191] In step S103, the network device 10 updates the OTA status of the mobile unit status list to "ON" for the ECU 30.

[0192] In step S104, the network device 10 identifies, based on the segment setting table, a segment and a segment configuration corresponding to the driving state being driving and the OTA state being OTA of the ECU 30. Based on the identified segment and segment configuration, the network device 10 updates the segment list so that the default segment 40 is configured by the state notification ECU 20, the driving control segment 50 is configured by the ECU 30, and the OTA segment 90 is configured by the external communication device 70 and the OTA control device 80.

[0193] In this way, when the software update status indicates that the software of the mobile unit M is being updated, the network device 10 classifies the multiple ECUs into an OTA segment 90 (first segment) related to the software update and one or more other segments (second segments). The one or more other segments include at least one of the default segment 40 and the cruise control segment 50.

[0194] Through the above process, the network device 10 can update the segments and segment configuration of the communication system 2 in response to changes in the mobile state of the mobile unit M.

[0195] As described above, the communication unit 14 transfers frames using the result of the determination made by the determination unit 12 as to whether or not the frame can be transferred. The determination unit 12 can control the determination as to whether or not the frame can be transferred between different segments in accordance with predetermined transfer control information. A transfer control table, which is an example of the transfer control information, will be described with reference to FIG. 18 .

[0196] 18 is an explanatory diagram showing a transfer control table for controlling frame transfer by the network device 10 in this embodiment. The transfer control table can be held in the storage unit 15.

[0197] The transfer control table shown in Figure 18 includes a source segment indicating the segment to which the device indicated by the source information of the frame belongs, a destination segment indicating the segment to which the device indicated by the destination information belongs, and an entry indicating whether the frame can be transferred from the source segment to the destination segment (whether to allow (written as "OK") or to reject (written as "NG")).

[0198] For example, the forwarding control table indicates that forwarding of frames between segments other than the default segment 40 (specifically, the OTA segment 90 and the driving control segment 50) is to be denied. The forwarding control table also indicates that forwarding of frames from the default segment 40 to segments other than the default segment 40 is to be denied. The forwarding control table also indicates that forwarding of frames from segments other than the default segment 40 to the default segment 40 is permitted.

[0199] Specifically, the forwarding control table indicates that forwarding of a frame whose source is the OTA segment 90 and whose destination is the traffic control segment 50 is to be denied. The forwarding control table also indicates that forwarding of a frame whose source is the OTA segment 90 and whose destination is the default segment 40 is permitted. Other frames are also permitted as shown in FIG. 18.

[0200] The transfer control table may have entries updated to indicate whether to allow or deny transfer of source segments, destination segments, and frames in accordance with the addition / removal of devices connected to the communication system 2, or the addition / removal of device functions.

[0201] The source segments, destination segments, and entries included in the transfer control table are not limited to those described above, and may include source segments, destination segments, and entries other than those described above.

[0202] When the acquisition unit 11 receives a frame, the judgment unit 12 can use the transfer control table shown in Figure 18 to determine whether to allow or deny the transfer of the frame based on the segment to which the device indicated in the frame's source information belongs and the segment to which the device indicated in the frame's destination information belongs.

[0203] 18, transfers between segments isolated from the default segment 40 (between the cruise control segment 50 and the OTA segment 90 in the example of FIG. 18) are denied. ECUs that communicate with each other are grouped together in one segment, and so if they were in different segments, they would not communicate, and so transfers of frames between segments are denied.

[0204] FIG. 19 is a first sequence diagram illustrating a frame forwarding operation (relay method) of the communication system 2 according to the present embodiment. The sequence diagram illustrated in FIG. 19 illustrates the operation of the communication system 2 when an OTA control device 80 belonging to an OTA segment 90 transmits an update frame 110 to update the firmware of a status notification ECU 20 also belonging to the OTA segment 90. The mobile object status listed in the mobile object status list is assumed to be a driving status of "driving" and an OTA status of "in OTA" for the status notification ECU 20. Furthermore, the transfer control table and the frame rejection table are assumed to be in the states illustrated in FIGS. 18 and 10. Note that the same processes as those illustrated in FIG. 11 are denoted by the same reference numerals, and detailed descriptions thereof will be omitted.

[0205] In step S601, the OTA control device 80 transmits the update frame 110. The network device 10 acquires the transmitted update frame 110 (S301a).

[0206] In step S302, the network device 10 first identifies that the source device is the OTA control device 80 and that the destination device is the status notification ECU 20 based on the source information 111 and destination information 112 of the update frame 110. The network device 10 then refers to the segment list and identifies that the source segment and destination segment are the OTA segment 90. If the source segment and destination segment are the same, the network device 10 allows the forwarding of the frame.

[0207] In step S304, the network device 10 allows the frame to be transferred because the type of the frame acquired by the network device 10 is not a charge / discharge control frame and does not match the description in the frame rejection table, although the mobile state listed in the mobile state list indicates that the mobile state is currently moving.

[0208] In step S306, the network device 10 transfers the update frame 110 acquired in step S301 to the status notification ECU 20, which is the destination device.

[0209] Through the above process, the network device 10 can transfer the update frame 110 transmitted by the OTA control device 80 to the status notification ECU 20. This allows the mobile object M to update the firmware of the status notification ECU 20 even while the mobile object M is traveling.

[0210] 20 is a second sequence diagram showing the frame forwarding operation (relay method) of the communication system 2 in this embodiment. The sequence diagram shown in FIG. 20 illustrates the operation of the communication system 2 when the OTA control device 80 belonging to the OTA segment 90 transmits an update frame 110 to the ECU 30 belonging to the driving control segment 50. It is assumed that the mobile object state listed in the mobile object state list is a driving state in motion and an OTA state in which the ECU 30 is performing OTA. It is assumed that the transfer control table and the frame rejection table are in the states shown in FIG. 18 and FIG. 10. Note that the same processes as those shown in FIG. 11 are denoted by the same reference numerals, and detailed description thereof will be omitted.

[0211] In step S602, the OTA control device 80 transmits the update frame 110. The network device 10 acquires the transmitted update frame 110 (S301a).

[0212] In step S302, the network device 10 first identifies that the source device is the OTA control device 80 and the destination device is the ECU 30 based on the source information 111 and destination information 112 of the update frame 110. The network device 10 further references the segment list and identifies that the source segment is the OTA segment 90 and the destination segment is the driving control segment 50. If the source segment and the destination segment are different, the network device 10 determines whether to forward the frame using the forwarding control table.

[0213] In step S303, the network device 10 refers to the transfer control table and denies the transfer of the frame since the frame transfer from the OTA segment 90 to the driving control segment 50 is denied.

[0214] In step S305, the network device 10 does not forward the update frame 110 acquired in step S301 to the destination device, ECU 30, but instead sends an error frame indicating that the frame forwarding has been rejected to the source device, OTA control device 80.

[0215] In step S307, the network device 10 changes the segment of the OTA control device 80, which is the source device, from the OTA segment 90 to the default segment 40.

[0216] By the above process, when the mobile object M is in a driving state, the network device 10 does not transfer the frame transmitted from the OTA control device 80 to the ECU 30. As a result, the ECU 30 does not operate in accordance with the update frame 110. In other words, even if the OTA control device 80 is hijacked by an attacker and transmits a frame imitating the update frame 110 to the ECU 30, if the mobile object M is in driving, the ECU 30 belonging to the driving control segment 50 can be protected from the attack, thereby suppressing security attacks in high-risk states for the mobile object M, such as when the mobile object M is in driving.

[0217] Furthermore, through the above processing, the network device 10 changes the segment of the OTA control device 80, which is the source device, from the OTA segment 90 to the default segment 40. Therefore, frames subsequently transmitted by the OTA control device 80 will not be forwarded to the OTA segment 90 based on the forwarding control table. In other words, even if the OTA control device 80 is hijacked by an attacker and continues to transmit frames imitating the update frame 110, devices belonging to the OTA segment 90 can be protected from attack regardless of the traveling state of the mobile unit M, thereby suppressing security attacks.

[0218] In this way, the network device 10 can suppress security attacks by changing the segments and segment configuration depending on the mobile state of the mobile object M.

[0219] Third Embodiment In this embodiment, another example of the configuration of a network device that can suppress security attacks in a mobile communication system will be described with reference to FIGS.

[0220] 3-1. Configuration of the Communication System First, the configuration of the communication system according to this embodiment will be described with reference to Fig. 21 to Fig. 23. Fig. 21 is a schematic diagram showing the configuration of a communication system 3 according to this embodiment.

[0221] The communication system 3 shown in FIG. 21 is a communication system in a network of mobile units M, similar to the communication system 1 in FIG. 1 and the communication system 2 in FIG.

[0222] The communication system 3 includes a network device 10 , a charge / discharge connector 120 , a charge / discharge control device 130 , a state notification ECU 20 , and an ECU 30 .

[0223] The network device 10, the status notification ECU 20, and the ECU 30 are the same as the network device 10, the status notification ECU 20, and the ECU 30 in FIG.

[0224] The charge / discharge connector 120 and the charge / discharge control device 130 correspond to devices (also simply referred to as devices) connected to the communication system 3 .

[0225] The devices connected to the communication system 3 are not limited to the charge / discharge connector 120 , the charge / discharge control device 130 , the status notification ECU 20 , the ECU 30 , and the network device 10 .

[0226] The default segment 40 and the cruise control segment 50 are similar to the default segment 40 and the cruise control segment 50 of FIG.

[0227] The charge / discharge segment 140 is a so-called segment that corresponds to the transmission range of a communication frame (also simply referred to as a frame) transmitted by a device in the network of the mobile body M. Note that the segments are not limited to the default segment 40, the charge / discharge segment 140, and the driving control segment 50.

[0228] The charging / discharging device 150 is a device that charges / discharges the moving object M. The charging / discharging device 150 may be, for example, an electric vehicle supply equipment (EVSE) that charges an automobile.

[0229] The charging / discharging connector 120 is a connector for connecting the charging / discharging device 150 to the mobile object M. The charging / discharging connector 120 may be, for example, a connector conforming to a standard for AC normal charging such as SAE J1772, or a connector conforming to a standard for AC quick charging such as CHAdeMO, CCS, GB / T, or NACS.

[0230] The charging / discharging connector 120 transfers frames between the charging / discharging device 150 connected to the mobile body M and the network device 10, thereby enabling communication between the charging / discharging device 150 and devices connected to the network device 10.

[0231] The charge / discharge control device 130 is a device that controls the speed, timing, etc. of charging and discharging performed by the charge / discharge device 150 on the mobile object M. The charge / discharge control device 130 controls the speed, timing, etc. of charging and discharging by transmitting information regarding charging and discharging to the charge / discharge device 150. For example, the charge / discharge control device 130 may control the charge / discharge speed by transmitting, as information regarding charging and discharging, the battery status of the mobile object M, the power used for charging and discharging, etc. to the charge / discharge device 150, or may control the timing of charging and discharging by transmitting, for example, a charge / discharge schedule of the mobile object M.

[0232] The charge / discharge control device 130 may notify the device of the charge / discharge status (no charge / discharge, charging / discharge in progress, etc.) in a status notification frame 60 at the start or end of charging / discharge to notify the device whether charging / discharge is being performed.

[0233] The charge / discharge segment 140 is a unit of range constituting a network, and is a so-called segment that is a frame transfer range. Specifically, the segment may be realized by a VLAN or a segment in an SDN.

[0234] The charging / discharging segment 140 may be composed of any of devices for connecting the charging / discharging device 150, devices for controlling charging / discharging, and devices for transmitting frames related to charging / discharging. The charging / discharging segment 140 may be composed of, for example, a charging / discharging connector 120 that connects the charging / discharging device 150 and can transmit frames related to charging / discharging, and a charging / discharging control device 130 that controls charging / discharging.

[0235] Figure 21 shows an example in which the default segment 40 is composed only of a status notification ECU 20, the charge / discharge segment 140 is composed of a charge / discharge connector 120 and a charge / discharge control device 130, and the driving control segment 50 is composed only of an ECU 30.

[0236] FIG. 22 is an explanatory diagram showing a charge / discharge control frame 160 in this embodiment.

[0237] The charge / discharge control frame 160 is an example of a frame and can be used to notify the device and the charge / discharge device 150 of information related to charging and discharging.

[0238] The charge / discharge control frame 160 includes source information 161 , destination information 162 , and charge / discharge information 163 .

[0239] The source information 161 and destination information 162 are the same as the source information 61 and destination information 62 of the status notification frame 60 in FIG.

[0240] The charge / discharge information 163 is information for controlling the speed and timing of charging / discharging performed by the charge / discharge device 150 on the mobile object M. The charge / discharge information 163 may include, for example, the battery status of the mobile object M, a charge / discharge schedule for the mobile object M, and the chargeable / dischargeable power of the charge / discharge device 150.

[0241] FIG. 23 is an explanatory diagram showing a segment setting table in this embodiment.

[0242] The segment setting table is a table for updating the segment list, and records the segments and segment configurations for each mobile object state. The segment setting table can be stored in the storage unit 15.

[0243] The segment setting table shown in FIG. 23 shows combinations of two mobile object states (traveling state and charging / discharging state), segments for each combination of mobile object states, and segment configurations.

[0244] The segment setting table shows that, for example, when the driving state is stopped and the charging / discharging state is no charging / discharging, the default segment 40 is composed of the charging / discharging connector 120, the charging / discharging control device 130, the status notification ECU 20, and the ECU 30, and the driving control segment 50 and the charging / discharging segment 140 do not have any constituent equipment.

[0245] The segment setting table may be updated with respect to the mobile object state, segments, and segment configuration in accordance with the addition / removal of devices connected to the communication system 3, the addition / removal of device functions, and the like.

[0246] It should be noted that the combinations of moving body states, segments, and segment configurations shown in the segment setting table are not limited to those described above, and may be combinations of moving body states, segments, and segment configurations other than those described above.

[0247] In addition, when the communication protocol is a message addressing system, the segment configuration shown in the segment setting table may be configured by the communication interface of the communication unit 14 instead of the devices belonging to each segment.

[0248] 24 is a sequence diagram showing a segment update operation (relay method) of the communication system 3 in this embodiment. The sequence diagram shown in FIG. 24 shows the operation of the communication system 3 when the charge / discharge control device 130 notifies the network device 10, using the state notification frame 60, that the charge / discharge state is charging / discharging. The mobile object state listed in the mobile object state list is assumed to be a traveling state in which the mobile object is traveling and a charging / discharging state in which the mobile object is not charging / discharging. Note that the same processes as those shown in FIG. 7 are denoted by the same reference numerals, and detailed description thereof will be omitted.

[0249] In step S701, the charge / discharge control device 130 transmits a status notification frame 60 including a mobile object status 63 in which the charge / discharge status is charging / discharging to the network device 10. The network device 10 acquires the transmitted status notification frame 60 (S101).

[0250] In step S102, the network device 10 determines that the charging / discharging state has changed to charging / discharging because the charging / discharging state listed in the mobile object state list is no charging / discharging and the charging / discharging state listed in the mobile object state 63 of the state notification frame 60 is charging / discharging.

[0251] In step S103, the network device 10 updates the charging / discharging state in the mobile object state list to "charging / discharging."

[0252] In step S104, the network device 10 identifies a segment and a segment configuration corresponding to the driving state being driving and the charge / discharge state being charging / discharging, based on the segment setting table. Based on the identified segment and segment configuration, the network device 10 updates the segment list so that the default segment 40 is configured by the state notification ECU 20, the driving control segment 50 is configured by the ECU 30, and the charge / discharge segment 140 is configured by the charge / discharge connector 120 and the charge / discharge control device 130.

[0253] In this way, when the charge / discharge status indicates that the mobile object M is being charged or discharged, the network device 10 classifies the multiple ECUs into a charge / discharge segment 140 (first segment) related to charging / discharging the battery and one or more other segments (second segments). The one or more other segments include at least one of the default segment 40 and the driving control segment 50.

[0254] By the above process, the network device 10 can update the segments and segment configuration of the communication system 3 in accordance with changes in the mobile state of the mobile unit M.

[0255] As described above, the communication unit 14 transfers frames using the result of the determination made by the determination unit 12 as to whether or not the frame can be transferred. The determination unit 12 can control the determination as to whether or not the frame can be transferred between different segments in accordance with predetermined transfer control information. A transfer control table, which is an example of the transfer control information, will be described with reference to FIG. 25 .

[0256] 25 is an explanatory diagram showing a transfer control table for controlling frame transfer by the network device 10 in this embodiment. The transfer control table can be held in the storage unit 15.

[0257] The transfer control table shown in Figure 25 includes a source segment indicating the segment to which the device indicated by the frame's source information belongs, a destination segment indicating the segment to which the device indicated by the destination information belongs, and an entry indicating whether the frame can be transferred from the source segment to the destination segment (whether to allow (written as "OK") or to reject (written as "NG")).

[0258] For example, the transfer control table indicates that transfer of frames between segments other than the default segment 40 (specifically, the charge / discharge segment 140 and the cruise control segment 50) is to be denied. The transfer control table also indicates that transfer of frames from the default segment 40 to segments other than the default segment 40 is to be denied. The transfer control table also indicates that transfer of frames from segments other than the default segment 40 to the default segment 40 is permitted.

[0259] Specifically, the transfer control table indicates that the transfer of a frame whose source is the charge / discharge segment 140 and whose destination is the driving control segment 50 is to be denied. The transfer control table also indicates that the transfer of a frame whose source is the charge / discharge segment 140 and whose destination is the default segment 40 is permitted. The other frames are also as shown in FIG. 25.

[0260] The transfer control table may have entries updated to indicate whether to allow or deny transfer of source segments, destination segments, and frames in accordance with the addition / removal of devices connected to the communication system 3, or the addition / removal of device functions.

[0261] The source segments, destination segments, and entries included in the transfer control table are not limited to those described above, and may include source segments, destination segments, and entries other than those described above.

[0262] When the acquisition unit 11 receives a frame, the judgment unit 12 can use the transfer control table shown in Figure 25 to determine whether to allow or deny the transfer of the frame based on the segment to which the device indicated in the frame's source information belongs and the segment to which the device indicated in the frame's destination information belongs.

[0263] FIG. 26 is a first sequence diagram showing the frame forwarding operation (relay method) of the communication system 3 in this embodiment. The sequence diagram shown in FIG. 26 illustrates the operation of the communication system 3 when a charge / discharge control device 130 belonging to a charge / discharge segment 140 transmits a charge / discharge control frame 160 to a charge / discharge connector 120 also belonging to the charge / discharge segment 140. The mobile object state listed in the mobile object state list is assumed to be a stopped running state and a charging / discharging state. Furthermore, the transfer control table and the frame rejection table are assumed to be in the states shown in FIGS. 25 and 10. Note that the same processes as those shown in FIG. 11 are denoted by the same reference numerals, and detailed descriptions thereof will be omitted.

[0264] In step S801, the charge / discharge control device 130 transmits the charge / discharge control frame 160. The network device 10 acquires the transmitted charge / discharge control frame 160 (S301b).

[0265] In step S302, the network device 10 first identifies that the source device is the charge / discharge control device 130 and that the destination device is the charge / discharge connector 120 based on the source information 161 and destination information 162 of the charge / discharge control frame 160. The network device 10 then refers to the segment list and identifies that the source segment and destination segment are the charge / discharge segment 140. If the source segment and the destination segment are the same, the network device 10 allows the transfer of the frame.

[0266] In step S304, the network device 10 allows the frame to be transferred because the frame type of the frame acquired by the network device 10 is a charge / discharge control frame, but the running state of the mobile body listed in the mobile body state list is stopped, which does not match the description in the frame rejection table.

[0267] In step S306, the network device 10 transfers the charge / discharge control frame 160 acquired in step S301b to the charge / discharge connector 120, which is the destination device.

[0268] Through the above process, the network device 10 can transfer the charge / discharge control frame 160 transmitted by the charge / discharge control device 130 to the charge / discharge device 150 via the charge / discharge connector 120. This allows the mobile object M to control charging / discharging of the mobile object M while the mobile object M is stopped.

[0269] 27 is a second sequence diagram showing the frame forwarding operation (relay method) of the communication system 3 in this embodiment. The sequence diagram shown in FIG. 27 shows the operation of the communication system 3 when a charge / discharge control device 130 belonging to a charge / discharge segment 140 transmits a charge / discharge control frame 160 to an ECU 30 belonging to a driving control segment 50. The mobile object state listed in the mobile object state list is assumed to be a driving state of "driving" and a charging / discharging state of "charging / discharging." The transfer control table and the frame rejection table are assumed to be in the states shown in FIG. 25 and FIG. 10. Note that the same processes as those shown in FIG. 11 are assigned the same reference numerals, and detailed description thereof will be omitted.

[0270] In step S802, the charge / discharge control device 130 transmits the charge / discharge control frame 160. The network device 10 acquires the transmitted charge / discharge control frame 160 (S301b).

[0271] In step S302, the network device 10 first identifies that the source device is the charge / discharge control device 130 and that the destination device is the ECU 30 based on the source information 161 and destination information 162 of the charge / discharge control frame 160. The network device 10 further refers to the segment list and identifies that the source segment is the charge / discharge segment 140 and the destination segment is the driving control segment 50. If the source segment and the destination segment are different, the network device 10 determines whether to forward the frame using the forwarding control table.

[0272] In step S303, the network device 10 refers to the transfer control table and denies the frame transfer since the frame transfer from the charge / discharge segment 140 to the driving control segment 50 is denied.

[0273] In step S305, the network device 10 does not forward the charge / discharge control frame 160 acquired in step S301b to the destination device, the ECU 30, but instead sends an error frame indicating that the frame forwarding has been rejected to the source device, the charge / discharge control device 130.

[0274] In step S307 , the network device 10 changes the segment of the charge / discharge control device 130 , which is the transmission source device, from the charge / discharge segment 140 to the default segment 40 .

[0275] By the above process, the network device 10 does not transfer the frame transmitted from the charge / discharge control device 130 when the mobile object M is in a driving state to the ECU 30. In other words, even if the charge / discharge control device 130 is taken over by an attacker and transmits a frame imitating the charge / discharge control frame 160 to the ECU 30, if the mobile object M is in a driving state, the ECU 30 belonging to the driving control segment 50 can be protected from the attack, and therefore security attacks can be suppressed when the mobile object M is in a high-risk state, such as when it is in a driving state.

[0276] Furthermore, through the above process, the network device 10 changes the segment of the charge / discharge control device 130, which is the transmission source device, from the charge / discharge segment 140 to the default segment 40. Therefore, frames subsequently transmitted by the charge / discharge control device 130 are not forwarded to the charge / discharge segment 140 based on the forwarding control table. In other words, even if the charge / discharge control device 130 is hijacked by an attacker and continues to transmit frames imitating the charge / discharge control frame 160, the devices belonging to the charge / discharge segment 140 can be protected from the attack regardless of the traveling state of the mobile body M, thereby suppressing security attacks.

[0277] FIG. 28 is a third sequence diagram showing the frame forwarding operation (relay method) of the communication system 3 in this embodiment. The sequence diagram shown in FIG. 28 illustrates the operation of the communication system 3 when a charge / discharge control device 130 belonging to a charge / discharge segment 140 transmits a charge / discharge control frame 160 to a state notification ECU 20 belonging to a default segment 40. The mobile object state listed in the mobile object state list is assumed to be a traveling state of "traveling" and a charging / discharging state of "charging / discharging." The transfer control table and the frame rejection table are assumed to be in the states shown in FIGS. 25 and 10. Note that the same processes as those shown in FIG. 11 are denoted by the same reference numerals, and detailed descriptions thereof will be omitted. FIG. 28 illustrates a sequence diagram when it is determined to reject a transfer using the frame rejection table.

[0278] In step S803, the charge / discharge control device 130 transmits the charge / discharge control frame 160. The network device 10 acquires the transmitted charge / discharge control frame 160 (S301b).

[0279] In step S302, the network device 10 first identifies that the source device is the charge / discharge control device 130 and that the destination device is the status notification ECU 20 based on the source information 161 and destination information 162 of the charge / discharge control frame 160. The network device 10 further refers to the segment list and identifies that the source segment is the charge / discharge segment 140 and the destination segment is the default segment 40. If the source segment and the destination segment are different, the network device 10 determines whether to forward the frame using the forwarding control table.

[0280] In step S303, the network device 10 refers to the transfer control table, and since frame transfer from the charge / discharge segment 140 to the default segment 40 is permitted, the network device 10 permits the frame transfer.

[0281] In step S304, the network device 10 rejects the transfer of the frame because the mobile state listed in the mobile state list indicates that the mobile state is moving, and the frame type of the frame acquired by the network device 10 is a charge / discharge control frame, which matches the entry in the frame rejection table.

[0282] In step S305, the network device 10 does not forward the charge / discharge control frame 160 acquired in step S301 to the destination device, the status notification ECU 20, but instead sends an error frame indicating that the frame forwarding has been rejected to the source device, the charge / discharge control device 130.

[0283] In step S307 , the network device 10 changes the segment of the charge / discharge control device 130 , which is the transmission source device, from the charge / discharge segment 140 to the default segment 40 .

[0284] Because the above process makes it difficult to connect the charging / discharging device 150 to the charging / discharging connector 120 to charge / discharge while the mobile object M is moving, the network device 10 does not transfer the charge / discharge control frame 160 that notifies information related to charging / discharging to the status notification ECU 20. In other words, even if the charge / discharge control device 130 is taken over by an attacker and a frame imitating the charge / discharge control frame 160 is transmitted to the status notification ECU 20 even when the mobile object M is moving, the network device 10 can protect the status notification ECU 20 from attack, thereby suppressing security attacks.

[0285] In this way, the network device 10 can suppress security attacks by changing the segments and segment configuration depending on the mobile state of the mobile object M.

[0286] 18 and 25, only the transfer of frames from two segments corresponding to the state of the mobile object (the driving control segment 50 and the OTA segment 90 in FIG. 18, and the driving control segment 50 and the charge / discharge segment 140 in FIG. 25) to the default segment 40 is permitted, and the transfer of frames from one of the two segments to the other is denied. However, this is not limited to this. For example, if the multiple segments include, in addition to the default segment 40 and the driving control segment 50, an autonomous driving control segment including one or more ECUs involved in the autonomous driving of the mobile object M, the transfer control table may include the following: permitting the transfer of frames from the driving control segment 50 and the autonomous driving control segment to the default segment 40, and denying the transfer of frames from the default segment 40 to the driving control segment 50 and the autonomous driving control segment; permitting the transfer of frames from the autonomous driving control segment to the driving control segment 50, and denying the transfer of frames from the driving control segment 50 to the autonomous driving control segment. An autonomous driving control segment is, for example, a segment classified when the state of the mobile body is an autonomous driving state in which autonomous driving is performed. In this way, frame transfer between segments that require cooperation during the travel of the mobile body M may be permitted. For example, frame transfer from one of two segments corresponding to the mobile body state to the other may be permitted, and frame transfer from the other to the one may be denied.

[0287] In each of the above embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory. Here, the software that realizes the network devices and the like in each of the above embodiments is a program such as the following.

[0288] That is, the program causes a computer to execute a method for use in a network device in an internal network of a mobile object, the internal network including a plurality of electronic control units, each of which transmits and receives frames to and from the other electronic control units via the network device, the method classifying the plurality of electronic control units into one or more segments according to the state of the mobile object, and controlling the transmission and reception of frames between the segments. For example, one aspect of the present disclosure may be a computer program causing a computer to execute each of the characteristic steps included in the relay method shown in any of Figures 8, 11 to 13, 17, 19, 20, 24, and 26 to 28.

[0289] Furthermore, for example, the program may be a program to be executed by a computer. Another aspect of the present disclosure may be a computer-readable non-transitory recording medium on which such a program is recorded. For example, such a program may be recorded on a recording medium and distributed or circulated. For example, the distributed program may be installed in a device having another processor, and the program may be executed by the processor, thereby causing the device to perform each of the above processes.

[0290] The order in which the steps in the flowchart are executed is merely an example for specifically explaining the present disclosure, and other orders may be used. Some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0291] The division of functional blocks in the block diagram is an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block.Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or time-shared by a single piece of hardware or software.

[0292] Furthermore, the network device according to each of the above embodiments may be realized as a single device or may be realized by multiple devices. When a network device is realized by multiple devices, the components of the network device may be distributed in any manner among the multiple devices. When a network device is realized by multiple devices, the communication method between the multiple devices is not particularly limited and may be wireless communication or wired communication. Furthermore, wireless communication and wired communication may be combined between the devices.

[0293] In each of the above embodiments, the mobile object M may be an automobile, construction machinery, agricultural machinery, a ship, a railway, an aircraft (e.g., an airplane, a drone), or the like. The scope of application is not limited to mobile objects. The communication system 1 of the present application may also be applied to a communication network used in an industrial control system of a factory or a building, a communication network for controlling embedded devices, or the like. The mobile object M may be a manually operable mobile object or an automatically operable mobile object (e.g., a fully automated vehicle or a semi-automated vehicle).

[0294] While the network device 10 according to one or more aspects has been described above based on each embodiment, the present disclosure is not limited to these embodiments. As long as they do not deviate from the spirit of the present disclosure, various modifications conceivable by those skilled in the art to the present embodiments and configurations constructed by combining components of different embodiments may also be included within the scope of one or more aspects.

[0295] The present disclosure is applicable to network devices that constitute a network of mobile devices.

[0296] 1, 2, 3 Communication system 10 Network device (relay device) 11 Acquisition unit 12 Determination unit 13 Management unit 14 Communication unit 15 Storage unit 20 Status notification ECU 30 ECU 40 Default segment 50 Driving control segment 60 Status notification frame 61, 111, 161 Source information 62, 112, 162 Destination information 63 Mobile object status 70 External communication device 80 OTA control device 90 OTA segment 100 OTA server 110 Update frame 113 Update program 120 Charging / discharging connector 130 Charging / discharging control device 140 Charging / discharging segment 150 Charging / discharging device 160 Charging / discharging control frame 163 Charging / discharging information M Mobile object N External network

Claims

1. A relay method executed by a relay device in an internal network of a mobile body, the internal network including a plurality of electronic control units, each of the plurality of electronic control units transmitting and receiving frames to and from each other via the relay device, the relay method classifying the plurality of electronic control units into a plurality of segments according to a state of the mobile body, and controlling the transmission and reception of frames between the plurality of segments.

2. The relay method according to claim 1, wherein the state of the moving body includes a driving state of the moving body, and when the driving state indicates that the moving body is driving, the relay method classifies the plurality of electronic control units into a first segment related to driving and one or more other second segments.

3. The relay method of claim 1, wherein the state of the mobile body includes a software update state of the mobile body, and when the software update state indicates that the software of the mobile body is being updated, the relay method classifies the plurality of electronic control units into a first segment related to the software update and one or more other second segments.

4. The relay method of claim 1, wherein the state of the moving body includes a charging / discharging state of a battery of the moving body, and when the charging / discharging state indicates that the moving body is being charged or discharged, the relay method classifies the plurality of electronic control units into a first segment related to charging / discharging of the battery and one or more other second segments.

5. The relay method of claim 1, wherein the state of the mobile body includes a driving state of the mobile body and a software update state of the mobile body, and when the software update state indicates that the software of the mobile body is being updated and the driving state indicates that the mobile body is driving, the relay method classifies the multiple electronic control units into a first segment related to driving, a third segment related to the software update, and one or more other second segments.

6. A relay method according to any one of claims 2 to 5, further comprising controlling transmission and reception of frames between the plurality of segments based on a predetermined rule for transmission and reception of frames between the plurality of segments, the predetermined rule corresponding to a state of the moving body.

7. The relay method according to claim 6, further comprising changing a segment to which an electronic control unit that has transmitted a frame determined not to be forwarded based on said predetermined rule belongs, to one of said one or more other second segments.

8. The relay method according to claim 6, further comprising outputting an instruction to turn off the power of an electronic control unit, among said plurality of electronic control units, that has transmitted a frame that has been determined not to be forwarded based on said predetermined rule.

9. The relay method according to claim 6, further comprising discarding a frame transmitted by an electronic control unit, among said plurality of electronic control units, that has transmitted a frame that has been determined not to be forwarded based on said predetermined rule.

10. The relay method according to claim 6, wherein the predetermined rules include a first rule that permits forwarding of a frame from the first segment to the second segment and denies forwarding of a frame from the second segment to the first segment.

11. The relay method according to claim 6, wherein the predetermined rules include a second rule that rejects the transfer of a predetermined type of frame when the moving object is in a predetermined state.

12. The relay method according to claim 11, wherein the predetermined rules further include a first rule that permits forwarding of a frame from the first segment to the second segment and denies forwarding of a frame from the second segment to the first segment, and a determination is made using the second rule for a frame whose forwarding is determined to be permitted under the first rule.

13. The relay method according to claim 12, further comprising: determining whether or not to forward the frame using only the second rule out of the first rule and the second rule when the source segment and destination segment of the frame are the same.

14. The relay method described in claim 1, wherein the multiple segments include a driving control segment including one or more electronic control units related to the driving of the moving body, an autonomous driving control segment including one or more electronic control units related to the autonomous driving of the moving body, and one or more other segments, and the predetermined rules for transmitting and receiving frames between the multiple segments, the predetermined rules according to the state of the moving body, include: permitting transfer of frames from the driving control segment and the autonomous driving control segment to the one or more other segments, and refusing transfer of frames from the one or more other segments to the driving control segment and the autonomous driving control segment; permitting transfer of frames from the autonomous driving control segment to the driving control segment, and refusing transfer of frames from the driving control segment to the autonomous driving control segment.

15. A relay method according to any one of claims 1 to 5, further comprising the step of reclassifying the plurality of electronic control units into a plurality of segments according to the changed state of the moving body each time the state of the moving body changes.

16. A relay device in an internal network of a mobile body, the internal network including a plurality of electronic control units, each of the plurality of electronic control units transmitting and receiving frames to and from each other via the relay device, the relay device classifying the plurality of electronic control units into one or more segments according to a state of the mobile body, and controlling the transmission and reception of frames between the segments.

17. A program for causing a computer to execute the relay method according to any one of claims 1 to 5 and 14.

Images