Information processing device, information processing method, and information processing program

Abstract

This information processing device includes a diagnostic service interface that enables diagnostic communication between an ECU and a network service bus of a vehicle or diagnostic communication with an application, and includes, in a secure zone, a diagnostic service firewall that separates network segments between communication by a communication program in a non-secure zone and communication by a communication program in the secure zone, wherein: communication is controlled by the diagnostic service firewall in accordance with at least one of a vehicle status of the vehicle and a status of a diagnostic request from a diagnostic tester; the non-secure zone is a memory space that is accessible from an external network and in which a program executed by the diagnostic service interface operates; and the secure zone is a memory space independent of the non-secure zone.

Description

Information processing apparatus, information processing method and information processing program

[0001] The present invention relates to an information processing apparatus, an information processing method, and an information processing program.

[0002] A technology is known that includes a service interface module configured to enable diagnostic communication between an ECU and a network service bus of a vehicle, in which a diagnostic server module provided in the ECU executes a diagnostic task to generate diagnostic object data, and a tester acquires the diagnostic object data via the service interface module (Patent Document 1).

[0003] International Publication No. 2021 / 043660

[0004] However, the technology described in Patent Document 1 has a problem that there is a possibility of receiving a cyber attack from outside the vehicle via a service interface module connected to an external network, which increases the risk of cybersecurity.

[0005] The problem to be solved by the present invention is to provide an information processing apparatus, an information processing method, and an information processing program that can reduce cybersecurity risks.

[0006] The present invention includes a diagnostic service interface that enables diagnostic communication between an ECU and a vehicle network service bus or diagnostic communication with an application, and a diagnostic service firewall is provided in a secure zone that separates network segments between communication by a communication program in a non-secure zone and communication by a communication program in the secure zone. The diagnostic service firewall controls communication in accordance with at least one of a vehicle state of the vehicle and a state of a diagnostic request from a diagnostic tester, the non-secure zone is a memory space accessible from an external network in which a program executed by the diagnostic service interface operates, and the secure zone is a memory space independent of the non-secure zone, thereby solving the above problem.

[0007] According to the present invention, cybersecurity risks can be reduced.

[0008] Figure 1 is a schematic diagram of the configuration of an information processing system equipped with an information processing device according to this embodiment. Figure 2 is a flowchart showing an example of the control flow of an information processing method executed by the information processing device according to this embodiment. Figure 3 is a diagram showing an example of a vehicle state rule and an authentication state rule according to this embodiment. Figure 4 is a flowchart showing an example of the processing procedure of a communication control method according to the vehicle state according to this embodiment. Figure 5 is a flowchart showing an example of the processing procedure of a communication control method according to the authentication state according to this embodiment.

[0009] Hereinafter, embodiments of an information processing system equipped with the information processing device according to the present invention will be described based on the drawings. Figure 1 is a schematic diagram of the configuration of an information processing system equipped with the information processing device according to this embodiment. The information processing system 100 according to this embodiment is a system for performing service-oriented vehicle diagnostics (SOVD; Service-Oriented Vehicle Diagnostics) on a vehicle 10, and includes a diagnostic tester 1 and a vehicle 10. SOVD is a software-based standardized interface (API) for diagnosing and communicating with vehicles. The vehicle 10 is a hybrid vehicle equipped with an engine and a motor, an electric vehicle, a vehicle that obtains power from an engine (ICE vehicle), etc. The vehicle 10 is equipped with an information processing device 2 and a plurality of ECUs 3 (3a, 3b, 3c). The information processing device 2 has a diagnostic service interface 4, a diagnostic service firewall 5, a diagnostic service database 6, a vehicle status manager 7, and a plurality of application services 8 (8a, 8b, 8c).

[0010] The information processing system 100 constructs a communication network consisting of an external network and a vehicle network. The external network is an external communication network such as a local network or the Internet. The external network is an example of the "external network" described in the claims. The diagnostic tester 1 and the diagnostic service interface 4 are connected via the external network. The vehicle network is an internal communication network such as Ethernet® or CAN. Each module included in the vehicle is connected via the vehicle network. Each ECU 3, including ECUs 3a, 3b, and 3c, performs a different function. The number of ECUs is not limited to three; it may be two or less, or four or more. Each application service 8, including application services 8a, 8b, and 8c, performs a different function. The number of application services is not limited to three; it may be two or less, or four or more.

[0011] The diagnostic tester 1 performs diagnostic communication with the vehicle 10 to be diagnosed. HTTP communication is used for communication between the diagnostic tester 1 and the diagnostic service interface 4. First, the diagnostic tester 1 sends a diagnostic request to the diagnostic service interface 4. The diagnostic request includes a request to execute a diagnostic task for the vehicle to be diagnosed. The diagnostic task includes self-diagnosis, reading data related to in-vehicle devices and sensors, and controlling the actuator of the vehicle to be diagnosed. The diagnostic tester 1 sends the diagnostic request after specifying the ECU 3 and / or application service 8 to be diagnosed. For example, the diagnostic request is sent in a communication packet that includes the destination address. After sending the diagnostic request, the diagnostic tester 1 receives diagnostic data for the ECU 3 or application service 8 from the diagnostic service interface 4. The diagnostic data is a response to the diagnostic request sent from the diagnostic tester 1. The diagnostic tester 1 may be one unit or multiple units, and may be a device mounted on the vehicle or a device located outside the vehicle.

[0012] The information processing device 2 is a high-performance in-vehicle computer (HPC) that manages the SOVD. The information processing device 2 has memory for storing programs and a processor for executing programs, and the processor realizes each function by executing the programs stored in memory. One or more processors and memories are provided. In this embodiment, an information processing program for managing service-oriented vehicle diagnostics, to be executed by the information processing device 2, is stored in memory. The information processing program includes an interface program, a firewall program, a communication program, and other programs, and the operation of each program causes the information processing device 2 to execute each function.

[0013] In the information processing device 2, a vehicle network is constructed to connect the diagnostic service interface 4, the diagnostic service firewall 5, the diagnostic service database 6, the vehicle status manager 7, and the application service 8. Communication between each module within the information processing device 2 is connected via the vehicle's network service bus through the vehicle network. The information processing device 2 has security zones configured for the communication network. The security zones are hierarchical and include multiple zones with different security levels. In the example in Figure 1, the security zones are divided into an unsecure zone Z1 and a secure zone Z2. The unsecure zone Z1 is a memory space accessible from the external network. Interface programs executed by the diagnostic service interface 4 run in the unsecure zone Z1. The unsecure zone Z1 includes communication programs to control communication in the unsecure zone Z1. The secure zone Z2 is a memory space independent of the unsecure zone Z1 and is isolated so that it cannot be accessed from the external network. Other programs that require protection from the external network run in the secure zone Z2. These other programs include a firewall program and communication programs to control communication in the secure zone Z2. In this embodiment, the memory is logically divided into a non-secure zone Z1 and a secure zone Z2 by the separation of network segments by the diagnostic service firewall 5. Note that the number of memory units is not limited to one, but may be multiple, as long as the memory space corresponding to the non-secure zone and the memory space corresponding to the secure zone are independent of each other.

[0014] As shown in Figure 1, the diagnostic service interface 4 is located in the non-secure zone Z1. The diagnostic service interface 4 is an interface module for providing diagnostic services, and is provided by operating an interface program using the processor of the information processing device 2. Specifically, the diagnostic service interface 4 enables diagnostic communication between the ECU 3 and the network service bus via the vehicle network, or diagnostic communication with the application service 8. That is, the interface program is a program configured to enable diagnostic communication between the ECU 3 and the vehicle network, or diagnostic communication with the application service 8, and operates to execute each function of the diagnostic service interface 4. The interface program is a program that operates within the non-secure zone.

[0015] The diagnostic service interface 4 needs to be in a state where it can receive data from the external network, which increases the chances of it being vulnerable to cybersecurity attacks. In this embodiment, the SOVD server implements the functions of the diagnostic service interface 4. The SOVD server is an HTTP server that provides services using HTTP (Hypertext Transfer Protocol) as its communication protocol. SOVD defines an API (REST API) that conforms to the REST protocol based on HTTP. REST APIs often involve more complex data processing than conventional diagnostic communications in order to ensure scalability, which increases the likelihood of creating cybersecurity vulnerabilities. Furthermore, if an attack on the HTTP server becomes possible, there is a possibility that the attack will propagate within the vehicle network using the HTTP server as a stepping stone. In conventional technology, for the reasons described above, the introduction of SOVD increases the risk of cybersecurity. In contrast, in this embodiment, as will be described later, the information processing device 2 is equipped with a diagnostic service firewall 5. The diagnostic service interface 4 performs diagnostic communication between the ECU 3 and the network service bus via the vehicle network, or with the application service 8, via the diagnostic service firewall 5. This reduces cybersecurity risks.

[0016] The diagnostic service interface 4 receives a diagnostic request from the diagnostic tester 1. When the diagnostic service interface 4 receives a diagnostic request, it sends the diagnostic request to the diagnostic service firewall 5. The diagnostic service interface 4 then receives diagnostic data generated by each ECU 3 or each application service 8 from each ECU 3 or each application service 8 via the diagnostic service firewall 5. The diagnostic service interface 4 sends the received diagnostic data to the diagnostic tester 1.

[0017] As shown in Figure 1, the diagnostic service firewall 5 is located in secure zone Z2. The diagnostic service firewall 5 separates the network segments of communication by communication programs operating in non-secure zone Z1 and communication by communication programs operating in secure zone Z2. By separating the network segments with the diagnostic service firewall 5, the security zone is divided into non-secure zone Z1 and secure zone Z2. Non-secure zone Z1 is located upstream of the location where the diagnostic service firewall 5 is located, and secure zone Z2 is located downstream of the location where the diagnostic service firewall 5 is located. In this embodiment, "upstream" and "downstream" refer to the flow of signals in the communication network, with the diagnostic tester 1 side being referred to as "upstream" with respect to the diagnostic service firewall 5, and the ECU 3 side being referred to as "downstream" with respect to the diagnostic service firewall 5.

[0018] The diagnostic service firewall 5 is provided by running a firewall program using the processor of the information processing device 2. The diagnostic service firewall 5 blocks direct communication from the diagnostic service interface 4 to the diagnostic target (ECU 3 or application service 8). That is, the firewall program is a program configured to block direct communication from the diagnostic service interface 4 to the ECU 3 or application service 8, and operates to execute each function of the diagnostic service firewall 5. The firewall program is a program that operates within a secure zone. In addition, the diagnostic service firewall 5 blocks communication other than diagnostic requests to the diagnostic target.

[0019] The following describes an example of how the diagnostic service firewall 5 controls communication. The diagnostic service firewall 5 controls communication according to at least one of the following: the vehicle status of the vehicle 10 and the status of the diagnostic request. For example, when the diagnostic service firewall 5 receives a diagnostic request from the diagnostic service interface 4, it controls the communication of the diagnostic request. The status of the diagnostic request includes, for example, the authentication status by the diagnostic tester 1, which indicates whether or not the user has been authenticated by the diagnostic tester 1. For example, the diagnostic request includes authentication information (e.g., a token) indicating the authentication status by the diagnostic tester 1. In addition, if the diagnostic service firewall 5 detects abnormal communication, it saves event information indicating that abnormal communication has been detected as a security log.

[0020] Here, an example of the control procedure for the information processing method executed by the information processing device 2 will be described using Figure 2. Figure 2 is a flowchart of an example of the control flow of the information processing method executed by the information processing device according to this embodiment. When a diagnostic request is sent from the diagnostic tester 1, the information processing device 2 starts the control flow from step S1. In step S1, the information processing device 2 receives the diagnostic request from the diagnostic tester 1 via the diagnostic service interface 4. In step S2, the information processing device 2 controls the communication of the diagnostic request using the diagnostic service firewall 5. The control of the communication is performed according to at least one of the vehicle status of the vehicle 10 and the status of the diagnostic request. In step S3, the information processing device 2 receives diagnostic data from the ECU 3 or application service 8 via the diagnostic service interface 4. In step S4, the information processing device 2 sends the diagnostic data to the diagnostic tester 1 via the diagnostic service interface 4. In this embodiment, the flowchart shown in Figure 2 does not need to include all steps, some steps may be omitted, or additional steps may be added as appropriate. The processing order of each step in the control flow may also be changed as appropriate.

[0021] Next, the details of communication control according to the vehicle status will be explained. The diagnostic service firewall 5 obtains the vehicle status from the vehicle status manager 7. The timing of obtaining the vehicle status is at regular intervals or when a diagnostic request is received. When the diagnostic service firewall 5 receives a diagnostic request via the diagnostic service interface 4, it refers to the type of diagnostic request and the vehicle status to determine whether the diagnostic request satisfies the permission conditions of the vehicle status rule relating to the type of diagnostic request and the vehicle status. In the vehicle status rule, permission conditions or denial conditions relating to the type of diagnostic request and the vehicle status are determined for each diagnostic target. For example, for each diagnostic target, either a "permit" or "deny" judgment is associated with the combination of the type of diagnostic request and the vehicle status. The type of diagnostic request is the content of the diagnostic service, and includes, for example, reading data related to in-vehicle devices and sensors, and controlling the actuator to be diagnosed.

[0022] The diagnostic service firewall 5 determines that a diagnostic request satisfies the permission conditions of the vehicle status rule if the determination corresponding to the combination of the diagnostic target specified in the received diagnostic request, the type of the diagnostic request, and the vehicle status is "permitted". For example, if the type of a diagnostic request that targets the headlights is to turn the headlights on or off, and the vehicle status is stopped, the diagnostic service firewall 5 determines that the diagnostic request satisfies the permission conditions of the vehicle status rule. If the diagnostic service firewall 5 determines that the diagnostic request satisfies the permission conditions of the vehicle status rule, it permits the transmission of the diagnostic request to the ECU 3 or application service 8. The diagnostic service firewall 5 transmits the communication packet containing the diagnostic request to the ECU 3 or application service 8 that is the specified target for diagnosis. If the diagnostic service firewall 5 determines that the diagnostic request does not satisfy the permission conditions of the vehicle status rule, it rejects the communication of the diagnostic request. If communication is rejected, the diagnostic service firewall 5 may save a security log.

[0023] Next, we will explain the details of communication control according to the authentication status. When the diagnostic service firewall 5 receives a diagnostic request via the diagnostic service interface 4, it determines whether the diagnostic request satisfies the permission conditions of the authentication status rules relating to the type of diagnostic request and the authentication status, depending on the type of diagnostic request and the authentication status. In the authentication status rules, permission conditions or denial conditions relating to the type of diagnostic request and the authentication status are determined for each diagnostic target. For example, for each diagnostic target, either a "permit" or "deny" judgment is associated with the combination of the type of diagnostic request and the authentication status.

[0024] The diagnostic service firewall 5 determines that a diagnostic request satisfies the permission conditions of the authentication status rule if the determination corresponding to the combination of the diagnostic target specified in the received diagnostic request, the type of the diagnostic request, and the authentication status is "permitted". If the diagnostic service firewall 5 determines that the diagnostic request satisfies the permission conditions of the authentication status rule, it permits the diagnostic request to be sent to the ECU 3 or application service 8. The diagnostic service firewall 5 sends the communication packet containing the diagnostic request to the ECU 3 or application service 8, which is the specified target for diagnosis. If the diagnostic service firewall 5 determines that the diagnostic request does not satisfy the permission conditions of the authentication status rule, it rejects the communication of the diagnostic request. If communication is rejected, the diagnostic service firewall 5 may save a security log.

[0025] Here, an example of the vehicle state rule and authentication state rule according to this embodiment will be explained using Figure 3. Figure 3 is a diagram showing an example of the vehicle state rule and authentication state rule according to this embodiment. The upper table in Figure 3 shows an example of the vehicle state rule according to this embodiment. The lower table in Figure 3 shows an example of the authentication state rule according to this embodiment. In the vehicle state rule, permission conditions or denial conditions regarding the type of diagnostic request and vehicle state are determined for each diagnostic target. For example, as shown in Figure 3, the permission condition when the diagnostic target is VIN is when the type of diagnostic request is "Read". The vehicle state is not particularly limited and may be any state. The permission condition when the diagnostic target is Head Lamp is when the type of diagnostic request is "On", i.e., a control to turn on the head lamp. The vehicle state is not particularly limited and may be any state. Also, the permission condition when the diagnostic target is Head Lamp may be when the type of diagnostic request is "Off", i.e., a control to turn off the head lamp, and the vehicle speed is 0 km / h. As shown in Figure 3, the vehicle status rules pre-define the combination of diagnostic request type and vehicle status that constitutes the conditions for allowing communication for each diagnostic target.

[0026] The authentication status rules define the permit or denial conditions for the type of diagnostic request and authentication status for each diagnostic target. For example, as shown in Figure 3, the permit condition when the diagnostic target is VIN is that the type of diagnostic request is "Read". The authentication status is not particularly limited and can be any state. When the diagnostic target is Head Lamp, the permit condition is that the type of diagnostic request is "On", i.e., a control to turn on the head lamp, and the authentication status is "Done", i.e., authentication has been performed by diagnostic tester 1. Alternatively, when the diagnostic target is Head Lamp, the permit condition may also be that the type of diagnostic request is "Off", i.e., a control to turn off the head lamp, and the authentication status is "Done". As shown in Figure 3, the authentication status rules pre-define the combinations of diagnostic request types and authentication statuses that permit communication for each diagnostic target. In this embodiment, the diagnostic service firewall 5 is not limited to allowing communication only when either the vehicle status rule or the authentication status rule's permission condition is met; it may also allow communication only when both permission conditions are met. Furthermore, in this embodiment, it is sufficient to control communication according to at least one of the vehicle status or authentication status, and the vehicle status rule and authentication status rule are not mandatory configurations but can be adopted as needed.

[0027] Next, an example of a communication control method performed by the diagnostic service firewall 5 according to the vehicle status will be described using Figure 4. Figure 4 is a flowchart showing an example of the processing procedure for the communication control method according to the vehicle status according to this embodiment. In this embodiment, when the diagnostic service firewall 5 receives a communication packet from the diagnostic service interface 4, the diagnostic service firewall 5 starts the control flow from step S11.

[0028] In step S11, the diagnostic service firewall 5 determines whether the received communication packet is from the diagnostic service interface 4. If it determines that the communication packet is from the diagnostic service interface 4, the diagnostic service firewall 5 proceeds to step S12. If it determines that the communication packet is not from the diagnostic service interface 4, the diagnostic service firewall 5 proceeds to step S15. In step S12, the diagnostic service firewall 5 checks the vehicle status of the vehicle 10. For example, the diagnostic service firewall 5 obtains the vehicle status from the vehicle status manager 7. In step S13, the diagnostic service firewall 5 determines whether the diagnostic request contained in the communication packet satisfies the permission conditions of the vehicle status rule. If it determines that the diagnostic request satisfies the permission conditions of the vehicle status rule, the diagnostic service firewall 5 proceeds to step S14. If it determines that the diagnostic request does not satisfy the permission conditions of the vehicle status rule, the diagnostic service firewall 5 proceeds to step S15. In step S14, the diagnostic service firewall 5 permits the communication of the communication packet. The diagnostic service firewall 5 sends the communication packet containing the diagnostic request to the ECU 3 or application service 8. In step S15, the diagnostic service firewall 5 rejects the communication packet. In step S16, the diagnostic service firewall 5 saves a security log regarding the communication rejection.

[0029] Next, an example of a communication control method performed by the diagnostic service firewall 5 according to the authentication status will be described using Figure 5. Figure 5 is a flowchart showing an example of the processing procedure for the communication control method according to the authentication status according to this embodiment. In this embodiment, when the diagnostic service firewall 5 receives a communication packet from the diagnostic service interface 4, the diagnostic service firewall 5 starts the control flow from step S21.

[0030] In step S21, the diagnostic service firewall 5 determines whether the received communication packet originates from the diagnostic service interface 4. If it determines that the communication packet originates from the diagnostic service interface 4, the diagnostic service firewall 5 proceeds to step S22. If it determines that the communication packet does not originate from the diagnostic service interface 4, the diagnostic service firewall 5 proceeds to step S25. In step S22, the diagnostic service firewall 5 checks the authentication status of the diagnostic request. In step S23, the diagnostic service firewall 5 determines whether the diagnostic request satisfies the permission conditions of the authentication status rule. If it determines that the diagnostic request satisfies the permission conditions of the authentication status rule, the diagnostic service firewall 5 proceeds to step S24. If it determines that the diagnostic request does not satisfy the permission conditions of the authentication status rule, the diagnostic service firewall 5 proceeds to step S25. In step S24, the diagnostic service firewall 5 allows the communication of the communication packet. The diagnostic service firewall 5 sends the communication packet to the ECU 3 or application service 8. In step S25, the diagnostic service firewall 5 rejects the communication of the communication packet. In step S26, the diagnostic service firewall 5 saves a security log regarding the communication rejection.

[0031] In this embodiment, the flowcharts shown in Figures 4 and 5 do not need to include all steps; some steps may be omitted, or additional steps may be added as appropriate. The processing order of each step in the control flow may also be changed as appropriate. The diagnostic service firewall 5 may combine the control flow in Figure 4 and the control flow in Figure 5 to perform communication control.

[0032] The ECUs 3 (3a, 3b, 3c) are electronic control units that control in-vehicle devices to perform the functions of the vehicle 10. Each ECU 3 acquires vehicle data and sensor data from the in-vehicle devices and sensors it controls. Each ECU 3 is connected downstream of the information processing device 2. Specifically, each ECU 3 and the application service 8 are connected by a network service bus via the vehicle network. Examples of ECUs 3 may include a powertrain ECU that controls the drive source of the vehicle 10, a body system ECU that controls body-related in-vehicle equipment, a multimedia system ECU that controls information display devices such as car navigation systems, and an ADAS system ECU that controls in-vehicle devices related to driving assistance control.

[0033] Each ECU 3 (3a, 3b, 3c) is equipped with a diagnostic server 31 (31a, 31b, 31c). The diagnostic server 31 performs diagnostic tasks such as self-diagnosis, reading data related to in-vehicle devices and sensors, and controlling the actuator to be diagnosed, in accordance with the diagnostic request, and generates diagnostic data including the diagnostic results. Self-diagnosis is a diagnosis of whether there are any faults or malfunctions related to the components, software, and sensors of the ECU 3. The ECU 3 transmits the diagnostic data, including the diagnostic results from the diagnostic server 31, to the diagnostic tester 1 via the information processing device 2. For example, the diagnostic data from each ECU 3 is aggregated in the application service 8 and transmitted from the application service 8 to the diagnostic service firewall 5. The diagnostic data from each ECU 3 is transmitted from the diagnostic service firewall 5 to the diagnostic tester 1 via the diagnostic service interface 4.

[0034] The diagnostic service database 6 is a storage medium that stores data related to diagnostic services. The diagnostic service database 6 is located in a secure zone. The diagnostic service database 6 is connected to the diagnostic service firewall 5 via the vehicle network. The diagnostic service database 6 stores authentication status rules related to the type of diagnostic request and the authentication status of the diagnostic request by the diagnostic tester 1. In SOVD, since the diagnostic request has changed from a conventional ID-based designation to a service-oriented API designation, the authentication status rules are defined to match the API designation. The authentication status rules are updated based on the updated authentication status rules for which authentication processing has been performed. For example, the authentication status rules are updated in conjunction with the update of the service-oriented API. The diagnostic service database 6 also stores vehicle status rules related to the type of diagnostic request and the vehicle status. Similar to the authentication status rules, the vehicle status rules are defined to match the API designation. The vehicle status rules are updated based on the updated vehicle status rules for which authentication processing has been performed. The authentication processing of the update data is performed by verifying the source of the update data and the authenticity of the data. This improves the security of updating the authentication status rules and vehicle status rules.

[0035] The vehicle status manager 7 manages the vehicle status of vehicle 10. The vehicle status manager 7 is located in a secure zone. The vehicle status manager 7 is connected to the diagnostic service firewall 5. The vehicle status manager 7 periodically acquires data on in-vehicle devices and sensors from each ECU 3 and sensor, and monitors the vehicle status. The vehicle status manager 7 transmits data on the vehicle status to the diagnostic service firewall 5.

[0036] Application services 8 (8a, 8b, 8c) provide services such as vehicle diagnosis, data collection, and software updates for vehicle 10. Specifically, application services 8 aggregate diagnostic data received from each ECU 3 and provide the diagnostic data to the diagnostic service interface 4 via the diagnostic service firewall 5. In addition, application services 8 perform diagnostic tasks such as vehicle diagnosis and data collection in response to diagnostic requests and generate diagnostic data including diagnostic results. Each application service 8 sends the diagnostic data including diagnostic results to the diagnostic tester 1. For example, the diagnostic data from each application service 8 is sent to the diagnostic service firewall 5. The diagnostic data from each application service 8 is then sent from the diagnostic service firewall 5 to the diagnostic tester 1 via the diagnostic service interface 4.

[0037] As described above, in this embodiment, the information processing device for managing service-oriented vehicle diagnostics includes a diagnostic service interface that enables diagnostic communication between one or more ECUs and the vehicle's network service bus, or with one or more applications within the information processing device. The secure zone includes a diagnostic service firewall that separates the network segments of communication by communication programs operating in the non-secure zone from communication by communication programs operating in the secure zone. The diagnostic service firewall controls communication according to at least one of the vehicle's status and the status of diagnostic requests from the diagnostic tester. Diagnostic data received from the ECU or application is transmitted to the diagnostic tester via the diagnostic service interface. The non-secure zone is a memory space accessible from the external network where programs executed by the diagnostic service interface operate, and the secure zone is a memory space independent of the non-secure zone where programs requiring protection from the external network operate. This reduces cybersecurity risks.

[0038] Furthermore, the information processing device according to this embodiment further includes a diagnostic service database in the secure zone that stores authentication status rules relating to the type of diagnostic request and the authentication status of the diagnostic tester for the diagnostic request. When the diagnostic service firewall receives a diagnostic request via the diagnostic service interface, it refers to the type of diagnostic request and the authentication status to determine whether the diagnostic request satisfies the permission conditions of the authentication status rule. If it is determined that the diagnostic request satisfies the permission conditions of the authentication status rule, it sends the diagnostic request to the ECU or application. This allows communication to be controlled according to the authentication status of the diagnostic request.

[0039] Furthermore, in the information processing device according to this embodiment, the authentication status rule is updated based on the updated authentication status rule for which the authentication process has been performed. This allows the rules for communication control to be updated in a more secure state.

[0040] Furthermore, the information processing device according to this embodiment further includes a vehicle status manager in the secure zone for managing the vehicle status. The diagnostic service firewall obtains the vehicle status from the vehicle status manager, and when it receives a diagnostic request via the diagnostic service interface, it refers to the type of the diagnostic request and the vehicle status to determine whether the diagnostic request satisfies the permission conditions of the vehicle status rule relating to the type of diagnostic request and the vehicle status. If it is determined that the diagnostic request satisfies the permission conditions of the vehicle status rule, it sends the diagnostic request to the ECU or application. This allows communication to be controlled according to the vehicle status.

[0041] Furthermore, the information processing method according to this embodiment is an information processing method for managing service-oriented vehicle diagnostics, which is executed by an information processing device, and the information processing device includes a diagnostic service interface that enables diagnostic communication between one or more ECUs and the vehicle's network service bus, or diagnostic communication with one or more applications within the information processing device, and a diagnostic service firewall in the secure zone that separates the network segments of communication by communication programs operating in the non-secure zone from communication by communication programs operating in the secure zone, and the information processing method includes the steps of controlling communication by the diagnostic service firewall according to at least one of the vehicle status of the vehicle and the status of diagnostic requests from a diagnostic tester, and transmitting diagnostic data received from the ECU or application to the diagnostic tester via the diagnostic service interface, the non-secure zone is a memory space on which programs executed in the diagnostic service interface operate, which is accessible from the external network, and the secure zone is a memory space independent of the non-secure zone, which is a memory space on which programs that require protection from the external network operate. This reduces cybersecurity risks.

[0042] Furthermore, the information processing program according to this embodiment is an information processing program for managing service-oriented vehicle diagnostics, which is to be executed by an information processing device. The information processing device includes a diagnostic service interface that enables diagnostic communication between one or more ECUs and the vehicle's network service bus, or diagnostic communication with one or more applications within the information processing device. The secure zone includes a diagnostic service firewall that separates the network segments of communication by communication programs operating in the non-secure zone from communication by communication programs operating in the secure zone. The information processing program causes the information processing device to execute the following steps: controlling communication according to at least one of the vehicle status of the vehicle and the status of diagnostic requests from a diagnostic tester using the diagnostic service firewall; and transmitting diagnostic data received from the ECU or application to the diagnostic tester via the diagnostic service interface. The non-secure zone is a memory space accessible from an external network where programs executed on the diagnostic service interface operate, and the secure zone is a memory space independent of the non-secure zone where programs requiring protection from the external network operate. This reduces cybersecurity risks.

[0043] 100... Information processing system 1... Diagnostic tester 10... Vehicle 2... Information processing device 4... Diagnostic service interface 5... Diagnostic service firewall 6... Diagnostic service database 7... Vehicle status manager 8... Application service 3... ECU

Claims

1. An information processing device for managing service-oriented vehicle diagnostics, comprising a diagnostic service interface that enables diagnostic communication between one or more ECUs and the vehicle's network service bus, or with one or more applications within the information processing device, a diagnostic service firewall in the secure zone that separates network segments of communication by communication programs operating in a non-secure zone from communication by communication programs operating in a secure zone, the information processing device controls communication by the diagnostic service firewall according to at least one of the vehicle status of the vehicle and the status of diagnostic requests from a diagnostic tester, transmits diagnostic data received from the ECU or the application to the diagnostic tester via the diagnostic service interface, the non-secure zone being a memory space accessible from an external network on which a program executed by the diagnostic service interface operates, and the secure zone being a memory space independent of the non-secure zone on which a program requiring protection from the external network operates.

2. An information processing device according to claim 1, further comprising a diagnostic service database in the secure zone that stores authentication status rules relating to the type of diagnostic request and the authentication status of the diagnostic request by the diagnostic tester, wherein the diagnostic service firewall, upon receiving the diagnostic request via the diagnostic service interface, refers to the type of the diagnostic request and the authentication status to determine whether the diagnostic request satisfies the permission conditions of the authentication status rules, and transmits the diagnostic request to the ECU or the application if it is determined that the diagnostic request satisfies the permission conditions of the authentication status rules.

3. An information processing device according to claim 2, wherein the authentication status rule is updated based on the updated authentication status rule on which the authentication process has been performed.

4. An information processing device according to any one of claims 1 to 3, further comprising a vehicle status manager for managing the vehicle status in the secure zone, wherein the diagnostic service firewall obtains the vehicle status from the vehicle status manager, and when it receives the diagnostic request via the diagnostic service interface, it refers to the type of the diagnostic request and the vehicle status to determine whether the diagnostic request satisfies the permission conditions of the vehicle status rule relating to the type of the diagnostic request and the vehicle status, and if it is determined that the diagnostic request satisfies the permission conditions of the vehicle status rule, it transmits the diagnostic request to the ECU or the application.

5. An information processing method for managing service-oriented vehicle diagnostics, performed by an information processing device, wherein the information processing device includes a diagnostic service interface that enables diagnostic communication between one or more ECUs and the vehicle's network service bus, or with one or more applications within the information processing device, and the secure zone includes a diagnostic service firewall that separates network segments of communication by communication programs operating in a non-secure zone from communication by communication programs operating in a secure zone, the information processing method includes the steps of controlling communication by the diagnostic service firewall according to at least one of the vehicle status of the vehicle and the status of a diagnostic request from a diagnostic tester, and transmitting diagnostic data received from the ECU or the application to the diagnostic tester via the diagnostic service interface, wherein the non-secure zone is a memory space accessible from an external network on which a program executed by the diagnostic service interface operates, and the secure zone is a memory space independent of the non-secure zone on which a program requiring protection from the external network operates.

6. An information processing program for managing service-oriented vehicle diagnostics, to be executed by an information processing device, wherein the information processing device includes a diagnostic service interface that enables diagnostic communication between one or more ECUs and the vehicle's network service bus, or diagnostic communication with one or more applications within the information processing device, and the secure zone includes a diagnostic service firewall that separates network segments of communication by communication programs operating in an unsecure zone from communication by communication programs operating in a secure zone, the information processing program causes the information processing device to execute the steps of: controlling communication by the diagnostic service firewall according to at least one of the vehicle status of the vehicle and the status of a diagnostic request from a diagnostic tester; and transmitting diagnostic data received from the ECU or the application to the diagnostic tester via the diagnostic service interface, wherein the unsecure zone is a memory space accessible from an external network on which a program executed by the diagnostic service interface operates, and the secure zone is a memory space independent of the unsecure zone on which a program requiring protection from the external network operates.

Images