Authentication control device, authentication control method, and authentication control program

An authentication control device includes: an acquisition unit configured to acquire predetermined identification information regarding an on-vehicle device to be newly added to an on-vehicle network; and a determination unit configured to determine which of a plurality of types of authentication procedures is to be applied as an authentication process for the on-vehicle device, on the basis of the identification information acquired by the acquisition unit.

TECHNICAL FIELD

The present invention relates to an authentication control device, an authentication control method, and an authentication control program.

This application claims priority on Japanese Patent Application No. 2017-134272 filed on Jul. 10, 2017, the entire contents of which are incorporated herein by reference.

BACKGROUND ART

PATENT LITERATURE 1 (Japanese Laid-Open Patent Publication No. 2013-168865) discloses an on-vehicle network system as follows. That is, the on-vehicle network system includes: an on-vehicle control device having a memory that stores therein definition data defining a part, of a communication protocol used in an on-vehicle network, which depends on implementation on the on-vehicle network; and a communication protocol issuing device that issues the definition data to the on-vehicle control device. When the communication protocol issuing device receives, from a registration device that allows the on-vehicle control device to participate in the on-vehicle network, a registration request that requests participation of the on-vehicle control device in the on-vehicle network, the communication protocol issuing device performs authentication for the registration device, creates the definition data based on implementation on the on-vehicle network, and returns the definition data to the registration device. The registration device receives the definition data transmitted from the communication protocol issuing device, and requests the on-vehicle control device to store the received definition data in the memory. Then, the on-vehicle control device receives the definition data from the registration device, stores the definition data in the memory, and performs communication by using the on-vehicle network, based on the part, of the communication protocol, defined by the definition data.

CITATION LIST

Patent Literature

SUMMARY OF INVENTION

(1) An authentication control device according to the present disclosure includes: an acquisition unit configured to acquire predetermined identification information regarding an on-vehicle device to be newly added to an on-vehicle network; and a determination unit configured to determine which of a plurality of types of authentication procedures is to be applied as an authentication process for the on-vehicle device, on the basis of the identification information acquired by the acquisition unit.

(17) An authentication control method according to the present disclosure is an authentication control method in an authentication control device, the authentication control method including the steps of: acquiring predetermined identification information regarding an on-vehicle device to be newly added to an on-vehicle network; and determining which of a plurality of types of authentication procedures is to be applied as an authentication process for the on-vehicle device, on the basis of the acquired identification information.

(18) An authentication control program according to the present disclosure is an authentication control program used in an authentication control device, the authentication control program causing a computer to function as: an acquisition unit configured to acquire predetermined identification information regarding an on-vehicle device to be newly added to an on-vehicle network; and a determination unit configured to determine which of a plurality of types of authentication procedures is to be applied as an authentication process for the on-vehicle device, on the basis of the identification information acquired by the acquisition unit.

One mode of the present disclosure can be realized not only as an authentication control device including such a characteristic processing unit but also as an on-vehicle communication system including such an authentication control device. Further, one mode of the present disclosure can be realized as a semiconductor integrated circuit that realizes a part or the entirety of the authentication control device.

DESCRIPTION OF EMBODIMENTS

Hitherto, on-vehicle network systems for improving security in an on-vehicle network have been developed.

Problems to be Solved by the Present Disclosure

In the on-vehicle network system disclosed in PATENT LITERATURE 1, an on-vehicle control device that performs communication not complying with a communication protocol, for example, a denial-of-service (DoS) attack, eavesdropping, etc., is detected as an unauthorized on-vehicle control device.

Thus, the on-vehicle control device can perform a DoS attack and eavesdropping until the same is detected as an unauthorized on-vehicle control device.

In order to prevent such a DoS attack, eavesdropping, etc., from being performed, a configuration that does not permit an unauthorized on-vehicle control device to participate in the on-vehicle network system is preferable. However, such a configuration is not disclosed in PATENT LITERATURE 1.

The present disclosure has been made to solve the above problem, and an object of the present disclosure is to provide an authentication control device, an authentication control method, and an authentication control program that are capable of providing satisfactory communication in an on-vehicle network.

Effects of the Present Disclosure

According to the present disclosure, it is possible to provide satisfactory communication in an on-vehicle network.

Description of Embodiments of the Present Disclosure

First, contents of embodiments of the present disclosure are listed and described.

(1) An authentication control device according to an embodiment of the present disclosure includes: an acquisition unit configured to acquire predetermined identification information regarding an on-vehicle device to be newly added to an on-vehicle network; and a determination unit configured to determine which of a plurality of types of authentication procedures is to be applied as an authentication process for the on-vehicle device, on the basis of the identification information acquired by the acquisition unit.

With the configuration to determine which of the plurality of types of authentication procedures is to be applied on the basis of the identification information as described above, for example, authentication corresponding to an on-vehicle device to be newly added can be performed. Thus, whether or not the on-vehicle device is valid can be more correctly determined. Accordingly, an unauthorized on-vehicle device can be detected before unauthorized communication such as a DoS attack and eavesdropping is performed, and thus occurrence of unauthorized communication in the on-vehicle network can be prevented. Therefore, satisfactory communication can be provided in the on-vehicle network.

(2) Preferably, the determination unit determines reliability of the on-vehicle device on the basis of the identification information acquired by the acquisition unit, and determines the authentication procedure corresponding to the determined reliability.

With this configuration, for example, a strict authentication procedure can be applied for an on-vehicle device for which the reliability has been determined as being low. Thus, the accuracy of detection of an unauthorized on-vehicle device can be improved. In addition, for example, a simple authentication procedure can be applied for an on-vehicle device for which the reliability has been determined as being high. Thus, the load of the authentication process can be reduced.

(3) Preferably, the identification information is information with which a place where work for mounting the on-vehicle device is performed is identifiable.

For example, the degree of involvement of a vehicle manufacturer with respect to an on-vehicle device is different depending on a place where work for mounting the on-vehicle device is performed, such as a manufacturing factory, a dealer, or another place. With the above configuration, appropriate evaluation for the reliability, the validity, etc., of an on-vehicle device can be performed on the basis of the degree of involvement corresponding to a place where work for mounting the on-vehicle device has been performed.

(4) Preferably, the identification information is at least either one of a product number and a model number of the on-vehicle device.

With this configuration, for example, the manufacturer, the production time, and the specifications of an on-vehicle device can be recognized on the basis of at least either one of the product number and the model number of the on-vehicle device. Thus, appropriate evaluation for the reliability, the validity, etc., of the on-vehicle device can be performed.

(5) Preferably, the identification information is information with which the on-vehicle device is uniquely identifiable.

With this configuration, for example, the manufacturer, the production time, the specifications, etc., corresponding to the identification information can be acquired from a server retaining a correspondence relationship between: information with which an on-vehicle device is uniquely identifiable; and the manufacturer, the production time, the specifications, etc., of the on-vehicle device. Thus, appropriate evaluation for the reliability, the validity, etc., of the on-vehicle device can be performed.

(6) Preferably, the determination unit determines the authentication procedure to be newly applied, further on the basis of the authentication procedure applied for the on-vehicle device in the past.

With this configuration, for example, a simple authentication procedure can be newly applied for an on-vehicle device for which an authentication result by an authentication procedure applied in the past is satisfactory. In addition, a strict authentication procedure can be newly applied for an on-vehicle device for which the above authentication result is bad. That is, the authentication procedure corresponding to the above authentication result can be applied. Therefore, the authentication process can be efficiently performed.

(7) Preferably, the authentication control device is included in a relay device configured to relay data in the on-vehicle network.

With the configuration in which the authentication control device is included in the relay device capable of more assuredly performing communication with an on-vehicle device as described above, an authentication procedure can be more assuredly determined.

(8) More preferably, the identification information is included in an authentication key used in the authentication process with the relay device.

The configuration in which the identification information is included in the authentication key can make it difficult to falsify the identification information in order to cause a simpler authentication procedure to be determined. Thus, an unauthorized on-vehicle device can be prevented from successfully impersonating a valid on-vehicle device.

(9) Preferably, the plurality of types of authentication procedures include a plurality of authentication procedures different from each other in number of authentication devices performing the authentication process for the on-vehicle device.

With this configuration, the number of authentication devices can be varied in accordance with the reliability, the validity, etc., of an on-vehicle device. Thus, the strictness of each authentication procedure can be adjusted as appropriate.

(10) Preferably, the plurality of types of authentication procedures include a plurality of authentication procedures different from each other in authentication devices performing the authentication process for the on-vehicle device.

With this configuration, different authentication devices can be used depending on the reliability, the validity, etc., of an on-vehicle device. Thus, the strictness of each authentication procedure can be adjusted as appropriate.

(11) More preferably, an authentication key used in the authentication process is different for each authentication device.

With the configuration in which the authentication key is made different for each authentication device as described above, the authentication process can be complicated. Thus, it can be made difficult to break through the authentication process by fraud. That is, the security in the on-vehicle network can be improved.

(12) More preferably, a relay device configured to relay data in the on-vehicle network is included in the authentication device.

With the configuration in which the relay device which is the linchpin of data transmission in the on-vehicle network is included in the authentication device as described above, for example, when an authenticated on-vehicle device is actually unauthorized, data transmission by unauthorized communication of the on-vehicle device can be more assuredly stopped.

(13) More preferably, when the authentication process for the on-vehicle device by the relay device has been successfully performed, the relay device instructs another on-vehicle device that is to be a communication partner for the on-vehicle device, to start the authentication process.

With the configuration to perform the authentication process between on-vehicle devices, which are to perform communication with each other in the on-vehicle network, when the authentication process by the relay device has been successfully performed as described above, the validity of a newly added on-vehicle device can be more correctly determined.

(14) More preferably, when the authentication process for the on-vehicle device by the relay device has been successfully performed, the relay device instructs another relay device to start the authentication process.

With the configuration to cause the other relay device to perform the authentication process for a newly added on-vehicle device when the authentication process by the relay device has been successfully performed as described above, the validity of the on-vehicle device can be more correctly determined.

(15) Preferably, the plurality of types of authentication procedures include a plurality of authentication procedures having different security levels.

With this configuration, the security level can be varied in accordance with the reliability, the validity, etc., of an on-vehicle device. Thus, the strictness of each authentication procedure can be adjusted as appropriate.

(16) Preferably, the determination unit determines the reliability of the on-vehicle device on the basis of the identification information acquired by the acquisition unit, and determines the authentication procedure having a larger number of authentication devices performing the authentication process for the on-vehicle device when the determined reliability is lower.

With the configuration to cause more authentication devices to authenticate an on-vehicle device having low reliability, that is, an on-vehicle device that is highly likely to be unauthorized, as described above, whether or not a newly added on-vehicle device is valid can be more correctly determined.

(17) An authentication control method according to an embodiment of the present disclosure is an authentication control method in an authentication control device, the authentication control method including the steps of: acquiring predetermined identification information regarding an on-vehicle device to be newly added to an on-vehicle network; and determining which of a plurality of types of authentication procedures is to be applied as an authentication process for the on-vehicle device, on the basis of the acquired identification information.

With the configuration to determine which of the plurality of types of authentication procedures is to be applied on the basis of the identification information as described above, for example, authentication corresponding to an on-vehicle device to be newly added can be performed. Thus, whether or not the on-vehicle device is valid can be more correctly determined. Accordingly, an unauthorized on-vehicle device can be detected before unauthorized communication such as a DoS attack and eavesdropping is performed, and thus occurrence of unauthorized communication in the on-vehicle network can be prevented. Therefore, satisfactory communication can be provided in the on-vehicle network.

(18) An authentication control program according to an embodiment of the present disclosure is an authentication control program used in an authentication control device, the authentication control program causing a computer to function as: an acquisition unit configured to acquire predetermined identification information regarding an on-vehicle device to be newly added to an on-vehicle network; and a determination unit configured to determine which of a plurality of types of authentication procedures is to be applied as an authentication process for the on-vehicle device, on the basis of the identification information acquired by the acquisition unit.

With the configuration to determine which of the plurality of types of authentication procedures is to be applied on the basis of the identification information as described above, for example, authentication corresponding to an on-vehicle device to be newly added can be performed. Thus, whether or not the on-vehicle device is valid can be more correctly determined. Accordingly, an unauthorized on-vehicle device can be detected before unauthorized communication such as a DoS attack and eavesdropping is performed, and thus occurrence of unauthorized communication in the on-vehicle network can be prevented. Therefore, satisfactory communication can be provided in the on-vehicle network.

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference characters, and description thereof is not repeated. At least some parts of the embodiments described below may be combined together as desired.

[Configuration and Basic Operation]

FIG. 1is a diagram showing the configuration of a communication system according to the embodiment of the present disclosure.

With reference toFIG. 1, a communication system201includes a server181and an on-vehicle communication system301. The on-vehicle communication system301is mounted on a vehicle1.

FIG. 2is a diagram showing the configuration of the on-vehicle communication system according to the embodiment of the present disclosure.

Hereinafter, each of the on-vehicle ECUs111A to111F is also referred to as on-vehicle ECU111. In addition, each of the relay devices151A and151B is also referred to as relay device151. The on-vehicle ECU111and the relay device151are examples of an on-vehicle device.

The on-vehicle communication system301is not limited to a configuration including six on-vehicle ECUs111, and may have a configuration including five or less on-vehicle ECUs111, or seven or more on-vehicle ECUs111. The on-vehicle communication system301is not limited to a configuration including two relay devices151, and may have a configuration including one relay device151or three or more relay devices151.

The on-vehicle ECU111A is, for example, a telematics communication unit (TCU). Hereinafter, the on-vehicle ECU111A is also referred to as TCU111A.

Examples of the on-vehicle ECUs111B to111F include an autonomous driving electronic control unit (ECU), a sensor, a navigation device, a human machine interface, and a camera.

In an on-vehicle network12, the on-vehicle ECUs111A and111C are each connected to the relay device151A via an Ethernet (registered trademark) cable. The on-vehicle ECUs111D to111F are each connected to the relay device151B via an Ethernet cable.

The relay devices151A and151B are, for example, switch devices and are connected to each other via an Ethernet cable. The relay devices151A and151B may be gateway devices.

For example, the on-vehicle ECU111B is not connected to the relay device151A in the initial state. For example, at any of a manufacturing factory for the vehicle1, a dealer for the vehicle1, a retailer for replacement parts for the vehicle1, etc., the on-vehicle ECU111B is mounted to the vehicle1and connected to the relay device151A via an Ethernet cable.

In this example, a communication partner for the on-vehicle ECU111B in the case where the on-vehicle ECU111B has been connected to the relay device151A is, for example, the on-vehicle ECU111C.

Hereinafter, the on-vehicle ECUs111B and111C are also referred to as expansion device111B and communication partner device111C, respectively.

The relay device151performs a relay process for an Ethernet frame in accordance with a communication standard of Ethernet.

Specifically, for example, the relay device151relays an Ethernet frame that is sent/received between the on-vehicle ECUs111. An IP packet is stored in the Ethernet frame.

The on-vehicle communication system301is not limited to the configuration to perform relay of an Ethernet frame in accordance with the communication standard of Ethernet, and may be configured to perform data relay in accordance with a communication standard such as controller area network (CAN) (registered trademark), FlexRay (registered trademark), media oriented systems transport (MOST) (registered trademark), or local interconnect network (LIN).

With reference toFIG. 1andFIG. 2, the TCU111A is capable of communicating with the server181. In detail, for example, the TCU111A is capable of communicating with the server181via a wireless base station device161in accordance with the IP protocol.

In more detail, for example, the TCU111A is capable of performing wireless communication with the wireless base station device161in accordance with a communication standard such as Long Term Evolution (LTE) or 3G.

Specifically, for example, when the TCU111A has received a wireless frame in which an IP packet from an IP server is stored from the wireless base station device161, the TCU111A acquires the IP packet from the received wireless frame, stores the acquired IP packet in an Ethernet frame, and then transmits the Ethernet frame to the relay device151A.

Upon receiving an Ethernet frame from the relay device151A, the TCU111A acquires an IP packet from the received Ethernet frame, stores the acquired IP packet in a wireless frame, and transmits the wireless frame to the wireless base station device161.

Upon receiving the wireless frame from the TCU111A, the wireless base station device161acquires the IP packet from the received wireless frame and transmits the acquired IP packet to the server181via an external network11.

Upon receiving an IP packet from the server181via the external network11, the wireless base station device161stores the received IP packet in a wireless frame and transmits the wireless frame to the TCU111A.

FIG. 3is a diagram showing the configuration of the relay device in the on-vehicle communication system according to the embodiment of the present disclosure.

With reference toFIG. 3, the relay device151A includes a relay processing unit51, communication ports52A,52B,52C, and52D, and an authentication control device101.

AlthoughFIG. 3shows the configuration of the relay device151A, the relay device151B has a configuration that is the same as that of the relay device151A.

Hereinafter, each of the communication ports52A,52B,52C, and52D is also referred to as communication port52. The communication port52is, for example, a terminal connectable with an Ethernet cable.

In this example, the communication ports52A,52B, and52C are connected to the relay device151B, the TCU111A, and the communication partner device111C, respectively.

The communication port52D is, for example, a communication port used for connection of the expansion device111B (hereinafter, also referred to as expansion port), and is a free port in the initial state.

The relay processing unit51performs a relay process for an Ethernet frame. Specifically, for example, when the relay processing unit51has received an Ethernet frame via the communication port52, the relay processing unit51performs a layer-2 switch process and a layer-3 relay process for the received Ethernet frame.

Then, the relay processing unit51transmits, via another communication port52, the Ethernet frame that has undergone the switch process and the relay process.

The relay processing unit51retains registration information indicating a communication path in which a switch process and a relay process are permitted. The communication path is specified by, for example, a pair of a transmission-source media access control (MAC) address and a transmission-destination MAC address, a pair of a transmission-source IP address and a transmission-destination IP address, etc.

For example, the relay processing unit51performs a filter process for an Ethernet frame on the basis of the retained registration information.

FIG. 4is a diagram showing the configuration of the authentication control device in the on-vehicle communication system according to the embodiment of the present disclosure.

With reference toFIG. 4, the authentication control device101includes an acquisition unit21and a determination unit22.

Each device in the communication system201includes a computer, and a calculation processing unit such as a CPU in the computer reads a program including some or all of steps in the following sequence chart or flowchart from a memory (not shown), and executes the program. The programs for the plurality of devices can each be installed from the outside. The programs for the plurality of devices are each distributed in a state of being stored in a storage medium.

FIG. 5is a chart showing an example of a sequence in the case where the expansion device has been connected to the on-vehicle network in the on-vehicle communication system according to the embodiment of the present disclosure.

With reference toFIG. 3toFIG. 5, a situation where the expansion device111B has been connected to the expansion port is assumed.

First, for example, the expansion device111B transmits an Ethernet frame including the MAC address of the expansion device111B and the MAC address of the communication partner device111C as a transmission-source MAC address and a transmission-destination MAC address, respectively, as a communication request to the relay device151A (step S102).

Next, upon receiving the Ethernet frame from the expansion device111B via the expansion port, the relay processing unit51in the relay device151A acquires the transmission-source MAC address and the transmission-destination MAC address included in the received Ethernet frame, and confirms whether or not a communication path based on the acquired transmission-source MAC address and transmission-destination MAC address is registered in the registration information (step S104).

Here, the relay processing unit51confirms that the communication path is not registered in the registration information.

Next, since the communication path is not registered in the registration information, the relay processing unit51transmits, as an authentication key request, an Ethernet frame including a request for an authentication key used for authentication of the expansion device111B, to the expansion device111B (step S106).

FIG. 6shows an example of data of an authentication key to be transmitted by the expansion device in the on-vehicle communication system according to the embodiment of the present disclosure.

With reference toFIG. 6, the data of the authentication key (hereinafter, also referred to as authentication key data) is used in an authentication process with the relay device151A.

The authentication key data includes a type that is an example of predetermined identification information regarding the expansion device111B, and an authentication key KA that is used for authentication with the relay device151A. The size of the authentication key data is Z bits that is the sum of X bits as the size of the type and Y bits as the size of the authentication key KA.

Here, the type is, for example, information with which a place where work for mounting the expansion device111B is performed is identifiable.

Specifically, for example, when the on-vehicle ECU111B is an on-vehicle device that is mounted at the manufacturing factory for the vehicle1, the type indicates manufacturer option.

For example, when the on-vehicle ECU111B is an on-vehicle device that is mounted at the dealer for the vehicle1, the type indicates dealer option.

For example, when the on-vehicle ECU111B is an on-vehicle device that is mounted at the retailer for replacement parts for the vehicle1or the like, the type indicates user custom.

Reliability of the manufacturer option, reliability of the dealer option, and reliability of the user custom are high, medium, and low, respectively. Here, the reliability represents the degree of trust of the mounting side for the expansion device111B. More specifically, the reliability represents the degree of trust of the mounting person and the mounting procedure for the expansion device111B. Specifically, when the reliability is higher, the expansion device111B is mounted to the vehicle1by a more reliable mounting person according to a more reliable mounting procedure.

Referring back toFIG. 3toFIG. 5, next, upon receiving the authentication key request from the relay device151A, in accordance with the received authentication key request, the expansion device111B encrypts the authentication key data shown inFIG. 6and transmits an Ethernet frame including the encrypted authentication key data, as authentication key information to the relay device151A (step S108).

Next, upon receiving the Ethernet frame from the expansion device111B, the relay processing unit51in the relay device151A acquires the authentication key data from the received Ethernet frame, and acquires the type and the authentication key KA by decrypting the acquired authentication key data (step S110).

Next, the authentication control device101determines the reliability of the expansion device111B (step S112).

In more detail, the relay processing unit51outputs type information indicating the acquired type, to the authentication control device101.

The acquisition unit21in the authentication control device101acquires predetermined identification information regarding an on-vehicle device that is to be newly added to the on-vehicle network12.

Specifically, upon receiving the type information from the relay processing unit51, the acquisition unit21outputs the received type information to the determination unit22.

On the basis of the identification information acquired by the acquisition unit21, the determination unit22determines which of a plurality of types of authentication procedures is to be applied as an authentication process for the expansion device111B.

In detail, for example, the determination unit22determines the reliability of the on-vehicle device on the basis of the identification information acquired by the acquisition unit21.

In more detail, upon receiving the type information from the acquisition unit21, the determination unit22determines the reliability of the expansion device111B on the basis of the received type information.

Specifically, when the type information indicates the manufacturer option, the determination unit22determines that the reliability of the expansion device111B is high.

When the type information indicates the dealer option, the determination unit22determines that the reliability of the expansion device111B is intermediate.

When the type information indicates the user custom, the determination unit22determines that the reliability of the expansion device111B is low.

Next, the authentication control device101determines an authentication procedure (step S114). In detail, for example, the determination unit22determines the authentication procedure corresponding to the determined reliability, from among the plurality of types of authentication procedures.

For example, the plurality of types of authentication procedures include a plurality of authentication procedures that are different from each other in number of authentication devices performing an authentication process for the expansion device111B and in authentication devices performing an authentication process for the expansion device111B.

Moreover, for example, the plurality of types of authentication procedures include a plurality of authentication procedures that are different from each other in security level. Here, examples of authentication devices include the relay device151A which relays data in the on-vehicle network12.

In this example, the determination unit22determines the authentication procedure corresponding to the determined reliability, from among authentication procedures PH, PM, and PL.

Here, the authentication procedure PH is an authentication procedure including an authentication process PA for the expansion device111B by the relay device151A.

The authentication procedure PM is an authentication procedure including the authentication process PA and an authentication process PB for the expansion device111B by the communication partner device111C.

The authentication procedure PL is an authentication procedure including the authentication process PA, the authentication process PB, and an authentication process PC for the expansion device111B by the relay device151B.

The authentication key used in each authentication process is different, for example, for each authentication device. Specifically, authentication keys KA, KB, and KC different from each other are used in the authentication processes PA, PB, and PC, respectively.

The lengths of the authentication keys KA, KB, and KC become longer in this order. That is, the security levels of the authentication processes PA, PB, and PC become higher in this order.

Moreover, authentication methods MA, MB, and MC different from each other are used in the authentication processes PA, PB, and PC, respectively. The security levels of the authentication methods MA, MB, and MC become higher in this order.

For example, when the determined reliability of the on-vehicle device is lower, the determination unit22determines an authentication procedure having a larger number of authentication devices performing an authentication process for the on-vehicle device.

Specifically, when the determination unit22determines that the reliability of the expansion device111B is high, the determination unit22determines the authentication procedure PH. When the determination unit22determines that the reliability of the expansion device111B is intermediate, the determination unit22determines the authentication procedure PM.

When the determination unit22determines that the reliability of the expansion device111B is low, the determination unit22determines the authentication procedure PL. The determination unit22outputs determination information indicating the determination result, to the relay processing unit51.

FIG. 7is a chart showing an example of a sequence in the case where the authentication process for the expansion device is performed in the on-vehicle communication system according to the embodiment of the present disclosure.

With reference toFIG. 7, a situation where the determination unit22in the authentication control device101has determined the authentication procedure PH is assumed.

First, upon receiving determination information indicating the authentication procedure PH from the authentication control device101, the relay processing unit51in the relay device151A starts the authentication procedure PH in accordance with the received determination information.

In detail, the relay processing unit51performs the authentication process PA (step S202). In more detail, the relay processing unit51authenticates the authentication key KA included in the authentication key information received from the expansion device111B, in accordance with the predetermined authentication method MA. Here, the relay processing unit51successfully authenticates the authentication key KA.

Next, the relay processing unit51registers the communication path based on the MAC address of the expansion device111B and the MAC address of the communication partner device111C, which are included in the communication request, in the registration information (step S204).

Accordingly, relay of Ethernet frames transmitted between the expansion device111B and the communication partner device111C is permitted.

Next, the relay processing unit51transmits authentication completion information indicating that the expansion device111B has been successfully authenticated, to the expansion device111B (step S206).

Next, the relay processing unit51relays and transmits the communication request to the communication partner device111C (step S208).

Next, by the relay processing unit51relaying Ethernet frames transmitted between the expansion device111B and the communication partner device111C, communication between the expansion device111B and the communication partner device111C is started (step S210).

When the relay processing unit51fails the authentication of the authentication key KA in step S202described above, the relay processing unit51does not register the communication path based on the MAC address of the expansion device111B and the MAC address of the communication partner device111C, which are included in the communication request, in the registration information.

With this configuration, Ethernet frames transmitted between the communication partner device111C and the expansion device111B that is highly likely to be an unauthorized on-vehicle device are not relayed at the relay processing unit51, and thus a DoS attack, eavesdropping, etc., by the expansion device111B can be prevented.

FIG. 8is a chart showing an example of the sequence in the case where the authentication process for the expansion device is performed in the on-vehicle communication system according to the embodiment of the present disclosure.

With reference toFIG. 8, a situation where the determination unit22in the authentication control device101has determined the authentication procedure PM is assumed.

First, upon receiving determination information indicating the authentication procedure PM from the authentication control device101, the relay processing unit51in the relay device151A starts the authentication procedure PM in accordance with the received determination information.

In detail, the relay processing unit51performs the authentication processing PA (step S302). In more detail, the relay processing unit51authenticates the authentication key KA included in the communication request received from the expansion device111B, in accordance with the predetermined authentication method MA (step S302). Here, the relay processing unit51successfully authenticates the authentication key KA.

Next, for example, when the authentication process PA for the expansion device111B by the relay device151A has been successfully performed, the relay processing unit51instructs the communication partner device111C, which is to be a communication partner for the expansion device111B, to start the authentication process PB.

Specifically, the relay processing unit51transmits, as an authentication request, an Ethernet frame including a request for authenticating the expansion device111B, via the communication port52C to the communication partner device111C (step S304).

Next, upon receiving the authentication request from the relay device151A, the communication partner device111C transmits an authentication key request, the destination of which is the expansion device111B, to the relay device151A in accordance with the received authentication request (step S306).

Next, upon receiving the authentication key request from the communication partner device111C, the relay processing unit51in the relay device151A relays and transmits the received authentication key request to the expansion device111B (step S308).

Next, upon receiving the authentication key request from the relay device151A, the expansion device111B transmits, as authentication key information, an Ethernet frame including the encrypted authentication key KB, to the relay device151A in accordance with the received authentication key request (step S310). The destination of the authentication key information is the communication partner device111C.

Next, upon receiving the authentication key information from the expansion device111B, the relay processing unit51in the relay device151A relays and transmits the received authentication key information to the communication partner device111C (step S312).

Next, the communication partner device111C performs the authentication process PB (step S314). In more detail, upon receiving the authentication key information from the relay device151A, the communication partner device111C decrypts and authenticates the authentication key KB included in the received authentication key information, in accordance with the predetermined authentication method MB (step S314). Here, the communication partner device111C successfully authenticates the authentication key KB.

Next, the communication partner device111C transmits authentication completion information indicating that the expansion device111B has been successfully authenticated, to the relay device151A (step S316).

Next, upon receiving the authentication completion information from the communication partner device111C, the relay processing unit51in the relay device151A recognizes that the expansion device111B has been successfully authenticated by the communication partner device111C, on the basis of the received authentication completion information, and performs the following processes.

Specifically, the relay processing unit51registers the communication path based on the MAC address of the expansion device111B and the MAC address of the communication partner device111C, which are included in the communication request, in the registration information (step S318).

Accordingly, relay of Ethernet frames transmitted between the expansion device111B and the communication partner device111C is permitted.

Next, the relay processing unit51transmits authentication completion information indicating that the expansion device111B has been successfully authenticated by the communication partner device111C and the relay device151A including the relay processing unit51, to the expansion device111B (step S320).

Next, the relay processing unit51relays and transmits the communication request to the communication partner device111C (step S322).

Next, by the relay processing unit51relaying Ethernet frames transmitted between the expansion device111B and the communication partner device111C, communication between the expansion device111B and the communication partner device111C is started (step S324).

When the relay processing unit51fails at least either one of the authentication of the authentication key KA in step S302described above and the authentication of the authentication key KB in step S314described, the relay processing unit51does not register the communication path based on the MAC address of the expansion device111B and the MAC address of the communication partner device111C, which are included in the communication request, in the registration information.

The order of step S302described above and steps S304to S316described above is not limited to the above order, and may be reversed.

FIG. 9is a chart showing an example of the sequence in the case where the authentication process for the expansion device is performed in the on-vehicle communication system according to the embodiment of the present disclosure.

With reference toFIG. 9, a situation where the determination unit22in the authentication control device101has determined the authentication procedure PL is assumed.

Operation in steps S402to S416is the same as the operation in steps S302to S316shown inFIG. 8.

Next, upon receiving the authentication completion information from the communication partner device111C, the relay processing unit51in the relay device151A recognizes that the expansion device111B has been successfully authenticated by the communication partner device111C, on the basis of the received authentication completion information, and performs the following processes.

Specifically, for example, when the authentication process PA for the expansion device111B by the relay processing unit51has been successfully performed, the relay processing unit51instructs another relay device, here, the relay device151B, to start the authentication process PC.

Specifically, the relay processing unit51transmits, as an authentication request, an Ethernet frame including a request for authenticating the expansion device111B, via the communication port52A to the relay device151B (step S418).

Next, upon receiving the authentication request from the relay device151A, the relay device151B transmits an authentication key request, the destination of which is the expansion device111B, to the relay device151A in accordance with the received authentication request (step S420).

Next, upon receiving the authentication key request from the relay device151B, the relay processing unit51in the relay device151A relays and transmits the received authentication key request to the expansion device111B (step S422).

Next, upon receiving the authentication key request from the relay device151A, the expansion device111B transmits, as authentication key information, an Ethernet frame including the encrypted authentication key KC, to the relay device151A in accordance with the received authentication key request (step S424). The destination of the authentication key information is the relay device151B.

Next, upon receiving the authentication key information from the expansion device111B, the relay processing unit51in the relay device151A relays and transmits the received authentication key information to the relay device151B (step S426).

Next, the relay device151B performs the authentication process PC (step S428). In more detail, upon receiving the authentication key information from the relay device151A, the relay device151B decrypts and authenticates the authentication key KC included in the received authentication key information, in accordance with the predetermined authentication method MC. Here, the relay device151B successfully authenticates the authentication key KC.

Next, the relay device151B transmits authentication completion information indicating that the expansion device111B has been successfully authenticated, to the relay device151A (step S430).

Next, upon receiving the authentication completion information from the relay device151B, the relay processing unit51in the relay device151A recognizes that the expansion device111B has been successfully authenticated by the relay device151B, on the basis of the received authentication completion information, and performs the following processes.

Specifically, the relay processing unit51registers the communication path based on the MAC address of the expansion device111B and the MAC address of the communication partner device111C, which are included in the communication request, in the registration information (step S432).

Accordingly, relay of Ethernet frames transmitted between the expansion device111B and the communication partner device111C is permitted.

Next, the relay processing unit51transmits authentication completion information indicating that the expansion device111B has been successfully authenticated by the relay device151A including the relay processing unit51, the communication partner device111C, and the relay device151B, to the expansion device111B (step S434).

Next, the relay processing unit51relays and transmits the communication request to the communication partner device111C (step S436).

Next, by the relay processing unit51relaying Ethernet frames transmitted between the expansion device111B and the communication partner device111C, communication between the expansion device111B and the communication partner device111C is started (step S438).

When the relay processing unit51fails at least one of the authentication of the authentication key KA in step S402described above, the authentication of the authentication key KB in step S414described above, and the authentication of the authentication key KC in step S428described above, the relay processing unit51does not register the communication path based on the MAC address of the expansion device111B and the MAC address of the communication partner device111C, which are included in the communication request, in the registration information.

The order of step S402described above, steps S404to S416described above, and steps S418to S430described above is not limited to the above order, and a part or all of the order may be changed.

FIG. 10shows an example of an authentication history table retained in the determination unit in the authentication control device according to the embodiment of the present disclosure.

With reference toFIG. 10, the authentication history table includes a correspondence relationship between an ID of an on-vehicle device added, reliability determined for the on-vehicle device, and an authentication result for the on-vehicle device.

In this example, the ID of the on-vehicle device is the MAC address of the on-vehicle device. The ID of the on-vehicle device may be, for example, the serial number of the on-vehicle device.

FIG. 11is a chart showing an example of the sequence in the case where the expansion device has been connected to the on-vehicle network in the on-vehicle communication system according to the embodiment of the present disclosure.

With reference toFIG. 3,FIG. 4, andFIG. 11, a situation where the expansion device111B has been connected to the expansion port in the relay device151A is assumed.

Operation in steps S502to S510is the same as the operation in steps S102to S110shown inFIG. 5.

Next, the authentication control device101determines the reliability of the expansion device111B (step S512).

In more detail, the relay processing unit51outputs type information indicating the acquired type, and the transmission-source MAC address included in the communication request, that is, the MAC address of the expansion device111B, to the authentication control device101.

Upon receiving the type information and the transmission-source MAC address from the relay processing unit51, the acquisition unit21in the authentication control device101outputs the received type information and transmission-source MAC address to the determination unit22.

Upon receiving the type information and the transmission-source MAC address from the acquisition unit21, the determination unit22determines the reliability of the expansion device111B on the basis of the received type information. Here, the determination unit22determines the reliability of the expansion device111B as being intermediate.

Next, the determination unit22determines whether or not the MAC address of the expansion device111B is registered in the authentication history table (seeFIG. 10) (step S514).

Here, the determination unit22confirms that the MAC address of the expansion device111B is not registered in the authentication history table.

Next, the determination unit22determines an authentication procedure (step S516). In detail, for example, the determination unit22determines an authentication procedure to be newly applied, on the basis of the identification information acquired by the acquisition unit21and the authentication procedure applied for the on-vehicle device in the past.

Here, since the MAC address of the expansion device111B is not registered in the authentication history table, the determination unit22determines the authentication procedure PM corresponding to the determined reliability, from among the authentication procedures PH PM, and PL, and outputs determination information indicating the determination result, to the relay processing unit51.

Next, the determination unit22monitors the authentication procedure PM (FIG. 8) performed by the relay processing unit51(step S518).

Here, the authentication process PA (step S302) and the authentication process PB (step S314) shown inFIG. 8are successfully performed, and the expansion device111B starts communication with the communication partner device111C via the relay device151A (step S324).

Next, the determination unit22registers the monitoring result of the authentication procedure PM in the authentication history table (step S520).

FIG. 12shows an example of the authentication history table retained in the determination unit in the authentication control device according to the embodiment of the present disclosure.

With reference toFIG. 12, the determination unit22confirms that the authentication processes PA and PB have been successfully performed, and registers the “MAC address of the expansion device111B”, “intermediate”, and “success” as “MAC address”, “reliability”, and “authentication result” in the authentication history table, respectively.

At this time, the communication path based on the MAC address of the expansion device111B and the MAC address of the communication partner device111C is deleted from the registration information.

Next, the expansion device111B is connected to the expansion port in the relay device151A again (step S524).

Operation in steps S526to S536is the same as the operation in steps S502to S512described above.

Next, the determination unit22confirms whether or not the MAC address of the expansion device111B is registered in the authentication history table (seeFIG. 12) (step S538).

Here, the determination unit22confirms that the MAC address of the expansion device111B is registered in the authentication history table.

Next, the determination unit22determines an authentication procedure (step S540). Here, since the MAC address of the expansion device111B for which the reliability has been determined as being intermediate (step S536) is registered in the authentication history table, the determination unit22increases the reliability from intermediate to high, for example.

Then, the determination unit22determines the authentication procedure PH corresponding to the increased reliability, from among the authentication procedures PH, PM, and PL, and outputs determination information indicating the determination result, to the relay processing unit51.

Whereas the determination unit22registers “success” of the authentication of the expansion device111B in the authentication history table in step S520described above, the determination unit22registers “failure” in the authentication history table when the determination unit22fails the authentication of the expansion device111B.

In this case, in step S540described above, since “failure” is registered as “authentication result” of the expansion device111B in the authentication history table, the determination unit22may keep the reliability intermediate or may decrease the reliability to low, instead of increasing the reliability from intermediate to high.

The determination unit22in the authentication control device101is configured to determine an authentication procedure on the basis of the type which is an example of the identification information inFIG. 5. However, the present disclosure is not limited thereto. The identification information may be, for example, information with which an on-vehicle device is uniquely identifiable. Specifically, the determination unit22determines an authentication procedure on the basis of the MAC address of the on-vehicle device.

FIG. 13is a chart showing an example of the sequence in the case where the expansion device has been connected to the on-vehicle network in the on-vehicle communication system according to the embodiment of the present disclosure.

With reference toFIG. 3,FIG. 4, andFIG. 13, a situation where the expansion device111B has been connected to the expansion port is assumed.

First, for example, the expansion device111B transmits, as a communication request, an Ethernet frame including the MAC address of the expansion device111B and the MAC address of the communication partner device111C as a transmission-source MAC address and a transmission-destination MAC address, respectively, to the relay device151A (step S620).

Next, upon receiving the Ethernet frame from the expansion device111B via the expansion port, the relay processing unit51in the relay device151A acquires the transmission-source MAC address and the transmission-destination MAC address included in the received Ethernet frame, and confirms whether or not the communication path based on the acquired transmission-source MAC address and transmission-destination MAC address is registered in the registration information (step S604).

Here, the relay processing unit51confirms that the communication path is not registered in the registration information, and outputs MAC address information indicating the acquired transmission-source MAC address, that is, the MAC address of the expansion device111B, to the authentication control device101.

Next, upon receiving the MAC address information from the relay processing unit51via the acquisition unit21, the determination unit22in the authentication control device101transmits the MAC address information to the server181via the relay processing unit51in order to inquire about the reliability corresponding to the MAC address indicated by the received MAC address information (step S606).

Next, upon receiving the MAC address information from the relay device151A, the server181determines the reliability of the expansion device111B on the basis of the received MAC address information (step S608).

FIG. 14shows an example of a reliability table retained in the server in the communication system according to the embodiment of the present disclosure.

With reference toFIG. 14, the reliability table includes a correspondence relationship between the MAC address of an on-vehicle device and the reliability of the on-vehicle device. The correspondence relationship is, for example, registered by the manufacturer of the vehicle1.

Referring back toFIG. 3,FIG. 4, andFIG. 13, next, the server181acquires the reliability corresponding to the MAC address of the expansion device111B indicated by the received MAC address information, which in this case is intermediate, from the reliability table, and transmits reliability information indicating the acquired reliability, to the relay device151A (step S610).

Next, upon receiving the reliability information from the server181, the relay processing unit51in the relay device151A outputs the received reliability information to the authentication control device101.

Upon receiving the reliability information from the relay processing unit51via the acquisition unit21, the determination unit22in the authentication control device101determines the authentication procedure PM corresponding to the reliability indicated by the received reliability information, from among the authentication procedures PH, PM, and PL, and outputs determination information indicating the determination result, to the relay processing unit51(step S612).

Next, upon receiving the determination information from the authentication control device101, the relay processing unit51starts the authentication procedure PM in accordance with the received determination information.

In detail, the relay processing unit51transmits an authentication key request to the expansion device111B (step S614).

Next, upon receiving the authentication key request from the relay device151A, the expansion device111B transmits, as authentication key information, an Ethernet frame including the encrypted authentication key KA, to the relay device151A in accordance with the received authentication key request (step S616).

Thereafter, for example, the flow of operation shown inFIG. 8is performed in the expansion device111B, the relay device151A, and the communication partner device111C.

The order of steps S606to S612described above and steps S614to S616described above is not limited to the above order, and may be reversed.

The identification information is the MAC address. However, the present disclosure is not limited thereto. The identification information may be the serial number of an on-vehicle device. In this case, for example, the server181retains a reliability table including a correspondence relationship between the serial number of an on-vehicle device and the reliability of the on-vehicle device.

For example, the relay device151A acquires the serial number of the expansion device111B from the expansion device111B, and transmits serial number information indicating the acquired serial number, to the server181. Upon receiving the serial number information from the relay device151A, the server181determines the reliability of the on-vehicle device on the basis of the received serial number information and the reliability table.

The determination unit22in the authentication control device101is configured to determine an authentication procedure on the basis of the type which is an example of the identification information inFIG. 5. However, the present disclosure is not limited thereto. The identification information may indicate, for example, the product number of an on-vehicle device. Specifically, the determination unit22determines an authentication procedure on the basis of the product number of the on-vehicle device.

FIG. 15is a chart showing an example of the sequence in the case where the expansion device has been connected to the on-vehicle network in the on-vehicle communication system according to the embodiment of the present disclosure.

With reference toFIG. 3,FIG. 4, andFIG. 15, a situation where the expansion device111B has been connected to the expansion port is assumed.

First, for example, the expansion device111B transmits, as a communication request, an Ethernet frame including the MAC address of the expansion device111B and the MAC address of the communication partner device111C as a transmission-source MAC address and a transmission-destination MAC address, respectively, to the relay device151A (step S702).

Next, upon receiving the Ethernet frame from the expansion device111B via the expansion port, the relay processing unit51in the relay device151A acquires the transmission-source MAC address and the transmission-destination MAC address included in the received Ethernet frame, and confirms whether or not the communication path based on the acquired transmission-source MAC address and transmission-destination MAC address is registered in the registration information (step S704).

Here, the relay processing unit51confirms that the communication path is not registered in the registration information.

Next, since the communication path is not registered in the registration information, the relay processing unit51transmits, as a product number request, an Ethernet frame including a request for the product number of the expansion device111B, to the expansion device111B (step S706).

Next, upon receiving the product number request from the relay device151A, the expansion device111B transmits an Ethernet frame including product number information indicating the product number of the expansion device111B, to the relay device151A in accordance with the received product number request (step S708).

Next, upon receiving the Ethernet frame from the expansion device111B, the relay processing unit51in the relay device151A acquires the product number information from the received Ethernet frame, and outputs the acquired product number information to the authentication control device101.

Upon receiving the product number information from the relay processing unit51via the acquisition unit21, the determination unit22in the authentication control device101transmits the product number information to the server181via the relay processing unit51(step S710) in order to inquire about the reliability corresponding to the product number indicated by the received product number information.

Next, upon receiving the product number information from the relay device151A, the server181determines the reliability of the expansion device111B on the basis of the received product number information (step S712).

FIG. 16shows an example of the reliability table retained in the server in the communication system according to the embodiment of the present disclosure.

With reference toFIG. 16, the reliability table includes a correspondence relationship between the product number of an on-vehicle device and the reliability of the on-vehicle device. The correspondence relationship is, for example, registered by the manufacturer of the vehicle1.

Referring back toFIG. 3,FIG. 4, andFIG. 15, next, the server181acquires the reliability corresponding to the product number of the expansion device111B indicated by the received product number information, which in this case is intermediate, from the reliability table, and transmits reliability information indicating the acquired reliability, to the relay device151A (step S714).

Operation in steps S716to S720is the same as the operation in steps S612to S616shown inFIG. 13.

The order of steps S706to S716described above and steps S718to S720described above is not limited to the above order, and may be reversed.

The identification information indicates the product number of an on-vehicle device. However, the present disclosure is not limited thereto. The identification information may indicate the model number of an on-vehicle device, or may indicate the product number and the model number of an on-vehicle device. In this case, for example, the server181retains a reliability table including at least a correspondence relationship between the model number of an on-vehicle device and the reliability of the on-vehicle device.

The relay device151A acquires the model number of the expansion device111B from the expansion device111B (step S708), and transmits model number information indicating the acquired model number, to the server181(step S710). Upon receiving the model number information from the relay device151A, the server181determines the reliability of the on-vehicle device on the basis of the received model number information and the reliability table (step S712).

The authentication control device according to the embodiment of the present invention is configured such that the authentication control device is provided in the relay device151. However, the present disclosure is not limited thereto. The authentication control device101may be configured such that the authentication control device101is provided in a device outside the relay device151, such as the on-vehicle ECU111and the server181.

In the authentication control device according to the embodiment of the present disclosure, the acquisition unit21is configured to acquire one piece of identification information, and the determination unit22is configured to perform the determination process of determining which of the plurality of types of authentication procedures is to be applied as an authentication process, on the basis of the one piece of identification information acquired by the acquisition unit21. However, the present disclosure is not limited thereto. The acquisition unit21may be configured to acquire a plurality of pieces of identification information, and the determination unit22may be configured to perform the determination process on the basis of the plurality of pieces of identification information acquired by the acquisition unit21.

In the authentication control device according to the embodiment of the present disclosure, the determination unit22is configured to determine the reliability of an on-vehicle device on the basis of identification information and determine the authentication procedure corresponding to the determined reliability. However, the present disclosure is not limited thereto. For example, the determination unit22may be configured to retain a correspondence relationship between identification information and an authentication procedure and determine the authentication procedure corresponding to the identification information on the basis of the correspondence relationship.

In the authentication control device according to the embodiment of the present disclosure, the plurality of types of authentication procedures, specifically, the authentication procedures PH, PM, and PL, include a plurality of authentication procedures different from each other in number of authentication devices performing the authentication processes PA, PB, and PC for an on-vehicle device. However, the present disclosure is not limited thereto. The plurality of types of authentication procedures may include a plurality of authentication procedures that are the same in number of authentication devices performing an authentication process for an on-vehicle device.

In the authentication control device according to the embodiment of the present disclosure, the plurality of types of authentication procedures, specifically, the authentication procedures PH, PM, and PL, include a plurality of authentication procedures different from each other in authentication devices performing the authentication processes PA, PB, and PC for an on-vehicle device. However, the present disclosure is not limited thereto. The plurality of types of authentication procedures may include a plurality of authentication procedures that are the same in authentication devices performing an authentication process for an on-vehicle device.

In the authentication control device according to the embodiment of the present disclosure, the authentication keys KA, KB, and KC used in the authentication processes PA, PB, and PC, respectively, are different for each authentication device. However, the present disclosure is not limited thereto. Some or all of the authentication keys KA, KB, and KC used in the authentication processes PA, PB, and PC, respectively, may be the same.

In the authentication control device according to the embodiment of the present disclosure, the relay device151A is configured to authenticate the expansion device111B in the authentication procedure PH shown inFIG. 7. However, the present disclosure is not limited thereto. The communication partner device111C may be configured to authenticate the expansion device111B in the authentication procedure PH.

In the authentication control device according to the embodiment of the present disclosure, the relay device151A is configured to instruct the communication partner device111C, which is to be a communication partner for the expansion device111B, to start the authentication process PB when the authentication process PA for the expansion device111B by the relay device151A has been successfully performed, in the authentication procedure PM shown inFIG. 8. However, the present disclosure is not limited thereto. The relay device151A may be configured to instruct the relay device151B to start the authentication process PC when the authentication process PA for the expansion device111B by the relay device151A has been successfully performed, in the authentication procedure PM.

In the authentication control device according to the embodiment of the present disclosure, the lengths of the authentication keys KA, KB, and KC used in the authentication processes PA, PB, and PC, respectively, become longer in this order. However, the present disclosure is not limited thereto. Some or all of the lengths of the authentication keys KA, KB, and KC may be the same.

In the authentication control device according to the embodiment of the present disclosure, the security levels of the authentication methods MA, MB, and MC used in the authentication processes PA, PB, and PC, respectively, become higher in this order. However, the present disclosure is not limited thereto. Some or all of the security levels of the authentication methods MA, MB, and MC may be the same.

In the authentication control device according to the embodiment of the present disclosure, the determination unit22is configured to determine an authentication procedure having a larger number of authentication devices performing an authentication process for an on-vehicle device when the determined reliability is lower. However, the present disclosure is not limited thereto. The determination unit22may be configured to determine an authentication procedure having a smaller number of authentication devices performing an authentication process for an on-vehicle device when the determined reliability is lower.

Meanwhile, in the on-vehicle network system disclosed in PATENT LITERATURE 1, an on-vehicle control device that performs communication not complying with a communication protocol, for example, a DOS attack, eavesdropping, etc., is detected as an unauthorized on-vehicle control device.

Thus, the on-vehicle control device can perform a DoS attack and eavesdropping until the same is detected as an unauthorized on-vehicle control device.

In order to prevent such a DoS attack, eavesdropping, etc., from being performed, a configuration that does not permit an unauthorized on-vehicle control device to participate in the on-vehicle network system is preferable. However, such a configuration is not disclosed in PATENT LITERATURE 1.

In contrast, in the authentication control device according to the embodiment of the present disclosure, the acquisition unit21acquires predetermined identification information regarding an on-vehicle device to be newly added to the on-vehicle network12. Then, on the basis of the identification information acquired by the acquisition unit21, the determination unit22determines which of the plurality of types of authentication procedures is to be applied as an authentication process for the on-vehicle device.

With the configuration to determine which of the plurality of types of authentication procedures is to be applied on the basis of the identification information as described above, for example, authentication corresponding to an on-vehicle device to be newly added can be performed. Thus, whether or not the on-vehicle device is valid can be more correctly determined. Accordingly, an unauthorized on-vehicle device can be detected before unauthorized communication such as a DoS attack and eavesdropping is performed, and thus occurrence of unauthorized communication in the on-vehicle network12can be prevented. Therefore, satisfactory communication can be provided in the on-vehicle network.

In the authentication control device according to the embodiment of the present disclosure, the determination unit22determines the reliability of an on-vehicle device on the basis of the identification information acquired by the acquisition unit21, and determines the authentication procedure corresponding to the determined reliability.

With this configuration, for example, a strict authentication procedure can be applied for an on-vehicle device for which the reliability has been determined as being low. Thus, the accuracy of detection of an unauthorized on-vehicle device can be improved. In addition, for example, a simple authentication procedure can be applied for an on-vehicle device for which the reliability has been determined as being high. Thus, the load of the authentication process can be reduced.

In the authentication control device according to the embodiment of the present disclosure, the identification information is information with which a place where work for mounting an on-vehicle device is performed is identifiable.

For example, the degree of involvement of a vehicle manufacturer with respect to an on-vehicle device is different depending on a place where work for mounting the on-vehicle device is performed, such as a manufacturing factory, a dealer, or another place. With the above configuration, appropriate evaluation for the reliability, the validity, etc., of an on-vehicle device can be performed on the basis of the degree of involvement corresponding to a place where work for mounting the on-vehicle device has been performed.

In the authentication control device according to the embodiment of the present disclosure, the identification information indicates at least either one of the product number and the model number of an on-vehicle device.

With this configuration, for example, the manufacturer, the production time, and the specifications of an on-vehicle device can be recognized on the basis of at least either one of the product number and the model number of the on-vehicle device. Thus, appropriate evaluation for the reliability, the validity, etc., of the on-vehicle device can be performed.

In the authentication control device according to the embodiment of the present disclosure, the identification information is information with which an on-vehicle device is uniquely identifiable.

With this configuration, for example, the manufacturer, the production time, the specifications, etc., corresponding to the identification information can be acquired from the server181retaining a correspondence relationship between: information with which an on-vehicle device is uniquely identifiable; and the manufacturer, the production time, the specifications, etc., of the on-vehicle device. Thus, appropriate evaluation for the reliability, the validity, etc., of the on-vehicle device can be performed.

In the authentication control device according to the embodiment of the present disclosure, the determination unit22determines an authentication procedure to be newly applied, on the basis of an authentication procedure applied for an on-vehicle device in the past.

With this configuration, for example, a simple authentication procedure can be newly applied for an on-vehicle device for which an authentication result by an authentication procedure applied in the past is satisfactory. In addition, a strict authentication procedure can be newly applied for an on-vehicle device for which the above authentication result is bad. That is, the authentication procedure corresponding to the above authentication result can be applied. Therefore, the authentication process can be efficiently performed.

In the authentication control device according to the embodiment of the present disclosure, the authentication control device101is included in the relay device151A which relays data in the on-vehicle network12.

With the configuration in which the authentication control device101is included in the relay device151A capable of more assuredly performing communication with an on-vehicle device as described above, an authentication procedure can be more assuredly determined.

In the authentication control device according to the embodiment of the present disclosure, the identification information is included in the authentication key data used in the authentication process with the relay device151A.

The configuration in which the identification information is included in the authentication key data can make it difficult to falsify the identification information in order to cause a simpler authentication procedure to be determined. Thus, an unauthorized on-vehicle device can be prevented from successfully impersonating a valid on-vehicle device.

In the authentication control device according to the embodiment of the present disclosure, the plurality of types of authentication procedures include a plurality of authentication procedures different from each other in number of authentication devices performing an authentication process for an on-vehicle device.

With this configuration, the number of authentication devices can be varied in accordance with the reliability, the validity, etc., of an on-vehicle device. Thus, the strictness of each authentication procedure can be adjusted as appropriate.

In the authentication control device according to the embodiment of the present disclosure, the plurality of types of authentication procedures include a plurality of authentication procedures different from each other in authentication devices performing an authentication process for an on-vehicle device.

With this configuration, different authentication devices can be used depending on the reliability, the validity, etc., of an on-vehicle device. Thus, the strictness of each authentication procedure can be adjusted as appropriate.

In the authentication control device according to the embodiment of the present disclosure, the authentication key used in the authentication process is different for each authentication device.

With the configuration in which the authentication key is made different for each authentication device as described above, the authentication process can be complicated. Thus, it can be made difficult to break through the authentication process by fraud. That is, the security in the on-vehicle network12can be improved.

In the authentication control device according to the embodiment of the present disclosure, the relay device151A which relays data in the on-vehicle network12is included in the authentication device.

With the configuration in which the relay device151A which is the linchpin of data transmission in the on-vehicle network12is included in the authentication device as described above, for example, when an authenticated on-vehicle device is actually unauthorized, data transmission by unauthorized communication of the on-vehicle device can be more assuredly stopped.

In the authentication control device according to the embodiment of the present disclosure, when the authentication process for an on-vehicle device by the relay device151A has been successfully performed, the relay device151A instructs another on-vehicle device that is to be a communication partner for the on-vehicle device, to start the authentication process.

With the configuration to perform the authentication process between on-vehicle devices, which are to perform communication with each other in the on-vehicle network12, when the authentication process by the relay device151A has been successfully performed as described above, the validity of a newly added on-vehicle device can be more correctly determined.

In the authentication control device according to the embodiment of the present disclosure, when the authentication process for an on-vehicle device by the relay device151A has been successfully performed, the relay device151A instructs the relay device151B to start the authentication process.

With the configuration to cause the relay device151B to perform the authentication process for a newly added on-vehicle device when the authentication process by the relay device151A has been successfully performed as described above, the validity of the on-vehicle device can be more correctly determined.

In the authentication control device according to the embodiment of the present disclosure, the plurality of types of authentication procedures include a plurality of authentication procedures different from each other in security level.

With this configuration, the security level can be varied in accordance with the reliability, the validity, etc., of an on-vehicle device. Thus, the strictness of each authentication procedure can be adjusted as appropriate.

In the authentication control device according to the embodiment of the present disclosure, the determination unit22determines the reliability of an on-vehicle device on the basis of the identification information acquired by the acquisition unit21, and determines an authentication procedure having a larger number of authentication devices performing an authentication process for an on-vehicle device when the determined reliability is lower.

With the configuration to cause more authentication devices to authenticate an on-vehicle device having low reliability, that is, an on-vehicle device that is highly likely to be unauthorized, as described above, whether or not a newly added on-vehicle device is valid can be more correctly determined.

The above embodiments are illustrative in all aspects and should not be recognized as being restrictive. The scope of the present invention is defined by the scope of the claims rather than the above description, and is intended to include meaning equivalent to the scope of the claims and all modifications within the scope.

The above description includes the features in the additional note below.

An authentication control device including:

an acquisition unit configured to acquire predetermined identification information regarding an on-vehicle device to be newly added to an on-vehicle network; and

a determination unit configured to determine which of a plurality of types of authentication procedures is to be applied as an authentication process for the on-vehicle device, on the basis of the identification information acquired by the acquisition unit, wherein

the on-vehicle device is a telematics communication unit (TCU), an autonomous driving electronic control unit (ECU), a sensor, a navigation device, a human machine interface, or a camera,

the authentication control device is included in a server or a relay device configured to relay data in the on-vehicle network, and

the identification information is a type included in an authentication key used in the authentication process with the relay device, or a media access control (MAC) address, a serial number, a product number, or a model number of the on-vehicle device.

REFERENCE SIGNS LIST