Source: https://patents.google.com/patent/JP5838983B2/en
Timestamp: 2019-12-08 21:11:54
Document Index: 409462545

Matched Legal Cases: ['art 71', 'art 70', 'art 71', 'art 70', 'art 72', 'art 71', 'art 75', 'arts 62', 'arts 62', 'arts 62', 'art 70', 'art, 24', 'art, 70', 'art, 71', 'art, 72', 'art, 73', 'art, 74', 'art, 75', 'art, 11']

JP5838983B2 - Information processing apparatus and information processing method - Google Patents
JP5838983B2
JP5838983B2 JP2013034611A JP2013034611A JP5838983B2 JP 5838983 B2 JP5838983 B2 JP 5838983B2 JP 2013034611 A JP2013034611 A JP 2013034611A JP 2013034611 A JP2013034611 A JP 2013034611A JP 5838983 B2 JP5838983 B2 JP 5838983B2
JP2013034611A
JP2014165641A (en
友和 守谷
英樹 後藤
2013-02-25 Application filed by トヨタ自動車株式会社 filed Critical トヨタ自動車株式会社
2013-02-25 Priority to JP2013034611A priority Critical patent/JP5838983B2/en
2014-09-08 Publication of JP2014165641A publication Critical patent/JP2014165641A/en
2016-01-06 Publication of JP5838983B2 publication Critical patent/JP5838983B2/en
The present invention relates to an information processing apparatus and an information processing method for processing information transmitted between a plurality of networks mounted on a moving body such as an automobile.
As is well known, an automobile includes an electronic control device that electronically controls various in-vehicle devices such as engines and brakes, an electronic control device that controls devices such as meters that display various vehicle states, and a navigation system. Many electronic control devices such as an electronic control device are mounted. In an automobile, the electronic control devices are communicably connected via a communication line to form an in-vehicle network, and various data are transmitted and received between the electronic control devices via the in-vehicle network. Yes.
By the way, in the in-vehicle network, a particularly high security is required for the in-vehicle network to which an electronic control unit that controls the engine, the brake, and the like is connected. However, such an in-vehicle network was originally designed on the assumption that it would be isolated from the external network, so it could not be said that it would be sufficient for access from external devices. Therefore, conventionally, an in-vehicle communication system that can ensure security as an in-vehicle network for connection of external devices has been proposed. An example of such a system is described in Patent Document 1.
The system described in Patent Document 1 is an in-vehicle communication system that performs data communication between an external power line communication line and an in-vehicle network, and is an information processing that determines whether data communication is possible between the external power line communication line and the in-vehicle network. A security means, which is a device, and an electronic control device connected to the in-vehicle network. In this communication system, when the security means permits data communication, data communication between the external power line communication line and the in-vehicle network is performed via the electronic control unit. That is, the security of the in-vehicle network is ensured by determining whether communication from the external network to the in-vehicle network is possible by the security means.
JP 2012-10022 A
In recent years, demands for cooperation between in-vehicle networks and external devices have been increasing. That is, there is an increasing demand for providing vehicle information that the in-vehicle network has to an external device via an external network or the like. In addition, there are an increasing number of types of information that are required to be provided to the in-vehicle network, such as a variety of information processing in external devices. This means that if a large amount of information is provided in response to a request from an external device, a large number of services can be provided from the external device according to the amount of information provided. However, although the communication system described in Patent Document 1 can permit many communications in response to requests from external devices, on the other hand, if many communications are permitted, the security of the in-vehicle network is degraded. There is also concern.
The present invention has been made in view of such circumstances, and its purpose is to suitably ensure the security of the network in the mobile body relative to the external network while enabling communication with the external network outside the mobile body. It is to provide an information processing apparatus and an information processing method.
An information processing apparatus that solves the above problems includes a control network connected to a control system device in a mobile body, an information system network connected to an information system device in the mobile body, and an external device connected to an external device of the mobile body An information processing apparatus that performs information processing by being connected to a plurality of networks including a network, each including a firewall connected to each of the networks, and a processing unit connected to each network via the firewall, Each firewall isolates at least the control network from other networks by permitting only communication between the network to which the firewall is connected and the processing unit, and the processing unit transmits the received request signal. A proxy server for changing the destination and a response signal corresponding to the received request signal are generated. The proxy server changes the destination of the received request signal to the data server according to the processing content requested by the request signal, and the data server requests the request signal the control information of the control system equipment holds the holding portion in advance obtained from the control system network, transmission destination request signal that requests the control information of the control system equipment obtained from the control network by the proxy server The control information requested by the received request signal is acquired from the holding unit that acquires from the control system network based on being received from the other network due to the change in the network, and the acquired control information is included. A response signal responding to the request signal is created, and the created response signal is used as a network of the transmission source of the request signal To increase the transmission.
An information processing method for solving the above problems includes a control network connected to a control system device in a mobile body, an information system network connected to an information system device in the mobile body, and an external device connected to an external device of the mobile body An information processing method in an information processing apparatus for performing information processing connected to a plurality of networks including a network, a firewall connected to each of the networks, and a processing unit connected to each network via the firewall, And the firewall allows at least the control system network to be isolated from other networks by allowing only communication between the network to which the firewall is connected and the processing unit. A proxy server for changing the destination of the received request signal, and the received request A data server that creates a response signal corresponding to the signal, and the proxy server changes the transmission destination of the received request signal to the data server according to the processing content requested by the request signal, and the data the server control information of the control system equipment the request signal for requesting by holding the holding portion in advance obtained from the control system network, requests the control information of the control system equipment obtained from the control system network Based on receiving a request signal from another network by changing the transmission destination by the proxy server, the control signal requested by the received request signal is acquired from the holding unit that acquires from the control network. And generating a response signal that responds to the request signal including the acquired control information. The is summarized in that to transmit to the source of the network of the request signal No..
According to such a configuration or method, since the control system network is isolated from the external network to which the Internet and information terminals are connected, and the information system network to which information system devices such as audio devices and navigation devices are connected, The security of the control system network in which control information important for the movement of the mobile body is exchanged is preferably ensured.
In addition, each processing unit is connected to each network via a firewall, so that information in the control system network can be transferred to other networks via the processing unit even if the control system network is not directly accessed from other networks. It is also possible to communicate.
As a result, it is possible to suitably ensure the security of the control system network with respect to an external network or the like while enabling communication between the control system network and other networks.
Further, by interposing a processing unit for acquiring information from the control system network, the external network can acquire information in the control system network by a communication message that does not conform to the protocol of the control system network.
If the mobile body is a vehicle, the vehicle is usually provided with at least three networks having different required security levels, that is, a control network, an information network, and an external network. In other words, in a vehicle, each network should be secured by providing separate firewalls for control networks that require a high level of security, information networks that do not require such a high level of security, and external networks that are difficult to secure. The security level can be set appropriately.
Further, according to such a configuration or method, since the request signal from the external network or the information system network is processed into a predetermined process by the processing unit without being directly sent to the control system network, at least the security of the control system network is preferable. Maintained. For example, if the moving body is a vehicle, the processing unit acquires vehicle information such as speed information and sensor information of the control system network as control information based on the request signal, and includes the acquired control information in the request signal. Create a response signal that responds. As a result, even if a request signal from another network does not flow through the control network, information requested through the request signal is included in the response signal and transmitted to the transmission source of the request signal of the other network. .
Further, since the request signal received from the external network or the like is processed by the processing unit, the external network or the like does not need to adapt the request signal to the protocol of the control system network. For this reason, it becomes easy to acquire control information of the control system network by an external network or an information system network.
In addition, according to such a configuration, every time a request signal is received from an external network or the like, control information is acquired from the control network side, so that the real-time property of the control information for the received request signal can be improved. It becomes like this.
Furthermore, according to such a configuration, a response signal responding to a request signal received from an external network or an information system network is created based on control information acquired and held from the control system network. For this reason, the time required to transmit the response signal created corresponding to the received request signal is shortened, and the response of the response signal to the request signal is improved.
Further , according to such a configuration, the request signal from the external network or the like can hide the information on the transmission destination of the control system network from the external network through the proxy server. The security of the control network can be secured higher.
Further, by causing the data server to process the request signal, a response signal corresponding to the request signal can be created without transmitting a request signal from an external network or the like to the control network. This also keeps the security of the control network high.
As a preferred configuration, the processing unit further includes an authentication unit that authenticates a device that has transmitted the received request signal, and is required to control only the request signal transmitted from the device authenticated by the authentication unit. Get information.
According to such a configuration, since the processing unit performs the process of acquiring the control information only for the request signal transmitted from the authenticated device, the control information of the control network is illegally transmitted to the unauthenticated device. It is prevented from being acquired. Also by this, the security of the control system network can be kept high.
As a preferred configuration, the processing unit further includes a monitoring unit that monitors the received request signal according to a monitoring condition, and the monitoring unit generates an abnormality in the received request signal by monitoring according to the monitoring condition. When it is determined that the control information is acquired, the acquisition of control information by the processing unit is prohibited.
According to such a configuration, since acquisition of control information based on a request signal that is determined to be abnormal by monitoring is prohibited, this also improves the security of the control system network.
As a preferred configuration, the processing unit further includes a log unit that records the received request signal in time series.
According to such a configuration, the presence or absence of an abnormal request signal due to an attack from an external network or the like can be determined by storing the request signal as log data in time series or statistically. become. As a result, it is possible to suitably manage the communication system mounted on the mobile body, and further improve the security of the control system network.
As a preferred configuration, when the request by the received request signal is acquisition of a plurality of control information, the processing unit sequentially acquires a plurality of control information requested by the received request signal from the control system network one by one. Then, the creation of a response signal that responds to the request signal is repeated while sequentially including the acquired control information.
According to such a configuration, even if, for example, a plurality of continuous control information is requested by a request signal from the external network, it can be appropriately handled by the processing unit. That is, the processing unit can create a response signal that responds to the request signal while sequentially including a plurality of control information stored in time series in an appropriate storage unit. Moreover, you may produce the response signal containing the acquired control information in the order which acquires the control information which consists of short period information, divided | segmented information, etc. from a control system network. As a result, it is possible to satisfy a plurality of control information acquisition requests while ensuring high security of the control network.
As a preferred configuration, a protocol conversion unit is provided on the control system network side of the firewall connected to the control system network, and the communication protocol of the request signal processed by the processing unit is controlled through the protocol conversion unit. Convert to network communication protocol.
A communication protocol different from that of an external network is often adopted for a mobile control network. Therefore, according to such a configuration, even if the communication protocol of the control system network is different from the communication protocol of the external network, the communication protocol of the request signal input from the external network and processed by the processing unit is Converted to the communication protocol of the control network. As a result, information transmission between the external network and the control network is appropriately performed.
As a preferred configuration, the processing unit creates a transmission signal to be transmitted to the control system network based on setting data for devices in the control system network received from the information system network.
In general, an information network mounted on a moving body such as a vehicle has higher security than an external network. And according to such a structure, transmission of the setting data from the information system network to the apparatus of a control system network is permitted. As a result, it is possible to facilitate the management of the control system devices connected to the control system network while maintaining the security of the control system network with respect to the external network.
As a preferred configuration, the processing unit authenticates the transmission source of the request signal received from the information network, acquires control information requested by the received request signal from the holding unit , and acquires the control A response signal including information is transferred to the authenticated transmission source of the information network.
According to such a configuration, the response signal created including the control information acquired from the control system network is transferred to the transmission source of the authenticated information system network. As a result, the processing load on the processing unit can be reduced, and the control system network control information can be easily and quickly acquired by the information system network equipment.
1 is a block diagram showing a schematic configuration of an embodiment of an information processing apparatus and an example of a communication system including the information processing apparatus. The block diagram which shows schematic structure of the control-system bus | bath of the communication system. The block diagram which shows schematic structure of the information-system bus | bath of the communication system. The block diagram which shows schematic structure of DMZ of the communication system. The schematic diagram explaining the authentication aspect of the transmission source of the request signal from the external bus in the communication system. The schematic diagram explaining the transmission aspect of the response signal to the external bus in the communication system. The schematic diagram explaining the transmission aspect of the some response signal from the internal bus to an external bus in the communication system. The schematic diagram explaining the transmission aspect to the internal bus of the request signal from the information type bus | bath in the same communication system. The schematic diagram explaining the transmission aspect of the some response signal from the internal bus to the information system bus | bath in the communication system. The block diagram which shows schematic structure about other embodiment of information processing apparatus, and a communication system provided with this information processing apparatus. The block diagram which shows the schematic structure about further another embodiment of information processing apparatus, and a communication system provided with this information processing apparatus.
An embodiment of an information processing apparatus and an example of a communication system including the information processing apparatus will be described with reference to the drawings.
First, the outline of this communication system will be described with reference to FIG.
As shown in FIG. 1, a vehicle 1 as a moving body includes a plurality of communication networks that are communicably connected to an electronic control unit (ECU) of the vehicle 1. The plurality of communication networks include a control system bus 10 as a control system network, an information system bus 20 as an information system network, and an external bus 30 as an external network. Since the control bus 10 is a network to which an ECU or the like that performs control related to running, steering, and stopping of the vehicle 1 is connected, high reliability and safety, that is, high security is required. In the present embodiment, the control bus 10 includes a plurality of communication buses (bus 11 and bus 16). The information bus 20 is a network to which ECUs such as navigation devices and audio devices are connected. Although high security is still required, the required level is not as high as the security of the control bus 10. The external bus 30 is a network that can be connected to an in-vehicle fault diagnosis device (OBD), various external devices, or an external network such as the Internet via a data link connector (DLC) 32 or the like. That is, since the external bus 30 is open to the outside of the vehicle 1, it is difficult to maintain the security at a certain level, and the security level is naturally lower than that of the control bus 10 and the information bus 20. It will be a thing.
The vehicle 1 includes a central gateway 40 to which a control bus 10, an information bus 20, and an external bus 30 are connected. The central gateway 40 is a device having various functions for controlling communication using communication messages among the control bus 10, the information bus 20, and the external bus 30.
The central gateway 40 relays communication messages between a plurality of communication buses (such as the bus 11 and the bus 16) of the control system bus 10 and also controls the control system gateway 50 that relays communication messages inside and outside the control system bus 10. I have. The control system gateway 50 constitutes a part of the control system bus 10. In addition, the central gateway 40 includes a network area including various functions for ensuring security, that is, a so-called demilitarized zone (DMZ) 60. The DMZ 60 ensures the security of the control bus 10 and the information bus 20 with respect to the external bus 30. In the DMZ 60, the information bus 20 and the external bus 30 are connected to be communicable, and the control bus 10 is connected to be communicable via the communication bus 41. The DMZ 60 performs communication control for transmitting only the information content included in the communication message while restricting transmission of the communication message among the connected control bus 10, information bus 20 and external bus 30. Thus, high security of the control bus 10 and the information bus 20 is ensured. For example, communication messages from the information bus 20 and the external bus 30 are not transmitted to the control bus 10, and the control bus 10 is connected to the control bus 10 from the information bus 20 and the external bus 30. Isolated. Similarly, the information bus 20 is also isolated from the external bus 30 for communication message transmission. In this embodiment, an Ethernet (registered trademark) standard communication line is connected to the DMZ 60, and the Internet Protocol (IP) is used for communication. That is, the control bus 10, the information bus 20, and the external bus 30 are connected to the DMZ 60 via Ethernet (registered trademark), and communication with the DMZ 60 is performed based on IP.
Next, details of the communication system will be described.
As shown in FIG. 2, the control system bus 10 includes the above-described control system gateway 50 and a plurality of bus type networks connected to the control system gateway 50. The control system gateway 50 is communicably connected to the DMZ 60 via an Ethernet (registered trademark) standard communication bus 41. The control gateway 50 includes a power train gateway (GW) 51, a chassis GW 52, a safety GW 53, and a vehicle body GW 54. The power train GW 51, the chassis GW 52, the safety GW 53, and the vehicle body GW 54 are communicably connected to the communication bus 41. Thereby, the power train GW 51, the chassis GW 52, the safety GW 53, and the vehicle body GW 54 can communicate with each other via the communication bus 41. Further, the control system bus 10 is provided with first to fourth CAN (controller area network) buses 11 to 14 and a LIN (local interconnect network) bus 16 as a plurality of communication buses.
Each of the power train GW 51, the chassis GW 52, and the safety GW 53 includes a CAN controller (not shown) that enables communication using the CAN protocol. Each GW is connected to first to fourth CAN buses 11 to 14 corresponding to the CAN controller. That is, the first and second CAN buses 11 and 12 are communicably connected to the power train GW 51, the third CAN bus 13 is communicably connected to the chassis GW 52, and the fourth CAN is connected to the safety GW 53. The bus 14 is connected to be communicable.
The vehicle body GW 54 includes a LIN controller (not shown) that enables communication using the LIN protocol. The vehicle body GW 54 is communicably connected to the LIN controller via the LIN bus 16.
The power train GW 51, the chassis GW 52, and the safety GW 53 include protocol conversion units 511 to 513, respectively. The protocol conversion units 511 to 513 mutually convert the IP used for communication on the communication bus 41 and the CAN protocol used for communication on the first to fourth CAN buses 11 to 14. Thereby, mutual communication by the transfer of a communication message etc. can be performed between CAN buses 11-14 and communication bus 41 via each GW51-53. The power train GW 51 can also transfer CAN protocol communication messages between the two CAN buses 11 and 12.
The vehicle body GW 54 includes a protocol conversion unit 514. The protocol conversion unit 514 mutually converts the IP used for communication on the communication bus 41 and the LIN protocol used for communication on the LIN bus 16. As a result, mutual communication can be performed between the LIN bus 16 and the communication bus 41 by transferring a communication message or the like via the vehicle body GW 54.
Further, the power train GW 51, the chassis GW 52, the safety GW 53, and the vehicle body GW 54 can communicate with each other via communication messages converted into IP by the respective protocol converters 511 to 514.
Since the first to fourth CAN buses 11 to 14 are configured as a CAN network, the CAN protocol is applied as a communication protocol. The first to fourth CAN buses 11 to 14 are configured by communication lines such as twisted cables, and transmit communication messages as a unit of communication in the CAN protocol that is multi-master communication via the communication lines. To do. In addition, even if the 1st-4th CAN buses 11-14 contain the path | route by radio | wireless communication in a part of communication path, or the path | route which passes through another network via a gateway etc. is included. Good.
Since the LIN bus 16 is configured as a LIN network, the LIN protocol is applied as a communication protocol. The LIN bus 16 is composed of a communication line such as a single cable, and a communication message is transmitted via the communication line by a LIN protocol that is master-slave communication based on a time schedule. Note that the LIN bus 16 may include a wireless communication route as part of the communication route, or may include a route that passes through another network via a gateway or the like.
Various electronic control units (ECUs) 111 to 113, 131, 132, 141, 142, and 161 are connected to the first to fourth CAN buses 11 to 14 and the LIN bus 16. Each ECU (ECU 111, etc.) includes an information processing unit (not shown) that executes processing required for various controls, and a communication controller (not shown) that transmits and receives communication messages based on a protocol corresponding to the communication bus to be connected. And.
ECUs 111 to 113, 131, 132, 141, and 142 connected to the first to fourth CAN buses 11 to 14 are control devices used for various controls of the vehicle 1. Each ECU holds vehicle information as control information used for vehicle control, and can output the held vehicle information as a communication message to each connected communication bus. Each ECU is an ECU whose control target is, for example, a drive system, a traveling system, a chassis system, or a safety system. For example, an ECU for a drive system is an ECU for an engine, and an ECU for a travel system is an ECU for a steering or a brake, and an ECU for a chassis system These include a light ECU and a direction indicator ECU. Further, examples of ECUs that are controlled by a safety system include an ABS (anti-lock brake system) ECU and a collision prevention ECU. As described above, the first to fourth CAN buses 11 to 14 are connected to ECUs related to important control related to traveling, steering, and stopping of the vehicle 1. In this embodiment, the ECUs 111 and 112 are communicably connected to the first and second CAN buses 11 and 12, respectively, and the ECU 113 is communicably connected to the first and third CAN buses 11 and 13, respectively. Yes. Further, the two ECUs 131 and 132 included in one device are connected to the third CAN bus 13 so as to communicate with each other. Further, the ECU 141 is communicably connected to the fourth CAN bus 14, and the ECU 142 is communicably connected to the ECU 141.
The ECU 161 connected to the LIN bus 16 is a control device used for various controls of the vehicle 1, holds vehicle information used for vehicle control, and is connected to the stored vehicle information. It can be output as a communication message to the LIN bus 16. The ECU 161 is an ECU that controls the vehicle body system and the like. Examples of ECUs that control the vehicle system include mirror ECUs and window ECUs. In other words, the LIN bus 16 is connected to an ECU related to control of equipment that may affect the operation of the vehicle 1.
As shown in FIG. 3, the information bus 20 includes an Ethernet (registered trademark) standard communication bus 21, and is connected via the communication bus 21 so as to be able to communicate with the DMZ 60 by IP. An ECU 211 and two ECUs 213 and 214 via an Ethernet switch 212 are connected to the communication bus 21. The Ethernet switch 212 is a switching hub, and distributes a communication message input from the DMZ 60 via the communication bus 21 to an ECU (213 or 214) that is a transmission destination of the communication message. As a result, the Ethernet switch 212 reduces the congestion of communication on the respective communication lines between the two ECUs 213 and 214.
Each of the ECUs 211, 213, and 214 connected to the information bus 20 is an ECU used for each information device of the vehicle 1, for example, an ECU that controls an information device system such as an audio device or a navigation device. is there. In other words, the information bus 20 is connected to an ECU related to equipment control for guiding the travel route of the vehicle 1 and maintaining comfort in the vehicle. Each of the ECUs 211, 213, and 214 can output a communication message requesting vehicle information to the ECU of the control bus 10, so-called request signal.
As shown in FIG. 1, the external bus 30 includes an Ethernet (registered trademark) standard communication bus 31, and is connected to the DMZ 60 via the IP via the communication bus 31. A DLC (data link connector) 32 of the communication bus 31 is a connector for connecting an external device to the network of the vehicle 1 so as to be communicable, and is an external device such as an in-vehicle failure diagnosis device (OBD) or a portable information terminal such as a smartphone. Can be connected in a communicable manner. That is, an external device connected to the DLC 32 can transmit a communication message toward the control bus 10 and the information bus 20 via the DLC 32. The communication message that can be transmitted in this way includes a communication message that requests vehicle information from the ECU of the control bus 10 as a request signal. In the present embodiment, the communication message input from the DLC 32 is received by the central gateway 40 and the central gateway 40 performs processing according to the communication message. The communication message input from the external bus 30 does not flow directly to the control bus 10 or the information bus 20 or is transferred as it is.
In addition, a device that conforms to the Ethernet (registered trademark) standard, for example, the wireless communication unit 33 (see FIG. 5) can be connected to the communication bus 31 without using the DLC 32. As described above, the external bus 30 is open to the outside of the vehicle 1 and is used for connection of an external device via the DLC 32, a wireless communication device, or the like, or connection of a network outside the vehicle such as the Internet. For this reason, the external bus 30 cannot manage its security with the vehicle 1. Therefore, in this embodiment, the security of the control bus 10 and the information bus 20 with respect to the external bus 30 is maintained by interposing the DMZ 60.
As shown in FIG. 4, the DMZ 60 includes an internal bus 61 that can send IP (Internet Protocol) communication messages, and first to third firewall (FW) units 62 to 64 connected to the internal bus 61. It has. In addition, the DMZ 60 includes a processing unit 70 that performs various processes on communication messages that are sent to the internal bus 61. The DMZ 60 ensures the security of the control bus 10 and the information bus 20 through various processes in the processing unit 70.
The first FW unit 62 is provided between the internal bus 61 and the control bus 10, and the second FW unit 63 is provided between the internal bus 61 and the information bus 20, and the third FW The unit 64 is provided between the internal bus 61 and the external bus 30. The first to third FW units 62 to 64 communicate based on whether or not a transmission source or a transmission destination address included in a communication message such as a request signal meets each predetermined regulation condition. It determines whether messages can pass or not, and restricts communication. The first FW unit 62 permits the passage of communication messages between the internal bus 61 and the control bus 10 based on the restriction conditions, while the communication messages from the information bus 20 and the external bus 30 are internal. Inflow to the control bus 10 via the bus 61 is blocked. The second FW unit 63 permits the passage of communication messages between the internal bus 61 and the information bus 20 based on the regulation conditions, while the internal communication messages from the control bus 10 and the external bus 30 The flow into the information bus 20 via the bus 61 is blocked. The third FW unit 64 permits the passage of communication messages between the internal bus 61 and the external bus 30 based on the restriction conditions, while the internal communication messages from the control bus 10 and the information bus 20 The flow into the external bus 30 via the bus 61 is blocked.
The processing unit 70 monitors the communication status of the request signal, the proxy unit 71 that changes the transmission destination of the communication message received as the request signal into the processing unit 70, the authentication unit 72 that authenticates the request source device. Monitoring section 73. The processing unit 70 also includes a log unit 74 that stores the communication status of the request signal in a time series or statistical manner. Further, the processing unit 70 holds the vehicle information output from the ECU of the control system bus 10 and creates a communication message that responds as a response signal to request signals from the control system bus 10, the information system bus 20, and the external bus 30. The data server unit 75 is provided. In the processing unit 70, the proxy unit 71 and the first to third FW units 62 to 64 are connected to each other via the internal bus 61 so as to communicate with each other. In the processing unit 70, the proxy unit 71 is communicably connected to the authentication unit 72, the monitoring unit 73, the log unit 74, and the data server unit 75. In this embodiment, all communication messages input from the first to third FW units 62 to 64 are transmitted to the proxy unit 71 of the processing unit 70 via the internal bus 61.
The proxy unit 71 is a so-called proxy server, and changes the transmission destination of the request signal whose transmission destination is the ECU of each bus to the processing unit 70. Thereby, the processing of the request signal whose transmission destination is the ECU of the bus is first performed by the processing unit 70. The proxy unit 71 determines the processing requested by the request signal, and requests the authentication unit 72 and the data server unit 75 to perform processing according to the requested processing content. For example, when the proxy unit 71 determines that the request signal requests processing related to authentication, the proxy unit 71 transmits the request signal to the authentication unit 72 so that the authentication unit 72 processes the request signal. When proxy unit 71 determines that the request signal requests the ECU of control bus 10 to output vehicle information, proxy unit 71 transmits the request signal to data server unit 75 and is processed by data server unit 75. Like that. Further, the proxy unit 71 transmits a response signal obtained by performing predetermined processing on the communication message received from the control bus 10 to the authenticated external device connected to the information bus 20 or the external bus 30. You can also. Further, the proxy unit 71 manages information related to an unauthorized transmission source, and does not process a request signal from the unauthorized transmission source. For example, the proxy unit 71 does not process a request signal from an unauthorized transmission source, so that it does not respond to a request signal from an unauthorized transmission source. Further, the proxy unit 71 can update information on the unauthorized transmission source based on the authentication result of the transmission source by the authentication unit 72 and the monitoring result of the communication message by the monitoring unit 73. Further, the proxy unit 71 ensures the security of the control system bus 10 with respect to the external bus 30 by publishing to the outside another address instead of the address for communication to the ECU of the control system bus 10.
The authentication unit 72 authenticates whether an external device connected to the external bus 30 or an information system device connected to the information system bus 20 is a regular device based on a predetermined authentication condition. Is provided. In the authentication unit 72, information for specifying an external device permitted to communicate is set in advance as an authentication condition. When the authentication unit 72 starts communication with an external device connected to the information bus 20 or the external bus 30, the authentication unit 72 authenticates the external device to be communicated. As the authentication function, a known authentication function such as SSL (security socket layer) or TLS (transport layer security) can be adopted. Then, the authentication unit 72 transmits the authentication result to the proxy unit 71. Thereby, the proxy unit 71 prohibits the processing in the processing unit 70 of the request signal from the transmission source device that has not been authenticated. Thus, the request signal from the external device authenticated by the authentication unit 72 is processed in the processing unit 70 and a response signal is created. On the other hand, the request signal from the external device not authenticated by the authentication unit 72 is processed by the processing unit. No processing is performed at 70. Therefore, it is possible to prevent the security of the control system bus 10 and the information system bus 20 from being lowered due to a request signal from an unauthorized external device.
Although the request signal after authentication may be encrypted, the encrypted request signal may be decrypted by the authentication unit 72 or a key determined by the authentication unit 72 may be used. The proxy unit 71 may be used for decryption.
Further, the authentication unit 72 can stop the authentication based on the unauthorized request signal in response to the monitoring result by the monitoring unit 73.
The monitoring unit 73 has a monitoring function of monitoring the behavior of the request signal received from the external bus 30 or the information bus 20 and determining whether there is an abnormality in the request signal. The monitoring unit 73 has a monitoring condition for determining an illegal behavior of the request signal. In the monitoring condition, the communication frequency and communication interval determined as abnormal communication are set for the entire request signal or according to the type and content of the request signal. That is, the monitoring unit 73 monitors the behavior of the received request signal such as the communication frequency and communication interval according to the monitoring condition, and determines that the request signal corresponding to the monitoring condition is an abnormal request signal. Then, the monitoring unit 73 transmits the monitoring result of the request signal to the proxy unit 71. Thereby, the proxy part 71 prohibits the process in the process part 70 of the request signal determined to be abnormal. Therefore, it is possible to prevent the security of the control system bus 10 and the information system bus 20 from being lowered by an abnormal request signal.
The log unit 74 stores request signals received from the external bus 30 or the information bus 20 as log data. The log unit 74 stores request signals received from the external bus 30 and the information bus 20 together with time information, and stores results of processing such as statistical processing. In addition, the log unit 74 analyzes the stored log data, and determines whether there is an abnormality in the request signal received from the external bus 30 or the information bus 20 based on the analysis result. For example, the log unit 74 analyzes whether or not a request signal that is determined to be an invalid request is not included in the log data. Further, the log unit 74 can transmit the stored log data to a log analysis device outside the vehicle that analyzes the request signal via the external bus 30 or the information bus 20. An example of the analysis device outside the vehicle is a server of an automobile manufacturer. As a result, the presence or absence of an abnormality in the request signal received from the external bus 30 or the information bus 20 can be determined by a log analyzer outside the vehicle.
The data server unit 75 analyzes a request based on a request signal received from the external bus 30 or the information bus 20 and performs a process corresponding to the request. Further, the data server unit 75 can create a response signal in response to the received request signal. The data server unit 75 includes a holding unit (not shown) that periodically acquires and holds vehicle information of the control system bus 10 from the control system bus 10. For example, when the speed is requested as the vehicle information of the control system bus 10 by the request signal, the data server unit 75 stores the speed obtained directly from the control system bus 10 or from the control system bus 10. Get the speed indirectly from. Then, the data server unit 75 creates a response signal in response to the request and transmits the created response signal to the transmission source of the external bus 30.
The data server unit 75 can also acquire the vehicle information of the control system bus 10 from the message buffer 501 (see FIG. 6) of the control system gateway 50 that temporarily stores the vehicle information of the control system bus 10. Further, the data server unit 75 transmits a communication message for acquiring vehicle information of the control bus 10 to the ECU of the control bus 10, and acquires vehicle information to be acquired from the communication message returned from the transmitted ECU. May be.
Next, with reference to FIGS. 5 to 9, the operation of the information processing apparatus according to the present embodiment centering on the DMZ 60 will be described. In order to describe various operations of the DMZ 60, a configuration other than the above may be added to the control bus 10, the information bus 20, and the external bus 30 for convenience.
FIG. 5 shows processing for authenticating an external device by the processing unit 70.
As shown in FIG. 5, a wireless communication unit 33 that can be connected to the Internet W is connected to the external bus 30. The wireless communication unit 33 is connected to the external bus 30 via the DLC 32 and other connectors. The wireless communication unit 33 is a device that can secure a communication path to the Internet W, and is, for example, a smartphone, a mobile phone, a wireless LAN slave device, or a wireless router.
Then, it is assumed that a request signal MA1 for requesting the start of communication from the external device (not shown) connected to the Internet W via the external bus 30 to the control system bus 10 is transmitted to the vehicle 1. This request signal MA1 is first determined by the third FW unit 64 as to whether or not it can be passed, and is transmitted to the proxy unit 71 when passage is permitted. Note that the request signal MA1 input from the external bus 30 is prohibited from passing through the first and second FW units 62 and 63 and therefore is not transmitted to the control bus 10 or the information bus 20. Here, since the transmitted request signal MA1 is a communication message requesting the start of communication to the control bus 10, the proxy unit 71 determines that authentication of the transmission source of the request signal MA1 is necessary, The authentication unit 72 is requested for authentication processing. Upon receiving the request for authentication processing, the authentication unit 72 performs authentication processing on the external device that is the transmission source of the request signal MA1 based on a predetermined authentication procedure, and notifies the proxy unit 71 of the authentication result. When the transmission source of the request signal MA1 is authenticated, the proxy unit 71 permits the processing unit 70 to process the communication message transmitted from the external device. For example, when a request signal for requesting vehicle information that is control information of the control bus 10 is received from an external device, the data server unit 75 is requested to process the request signal. On the other hand, when the transmission source of the request signal MA1 is not authenticated, the proxy unit 71 prohibits the processing in the processing unit 70 of the request signal transmitted from the external device.
Each time the proxy unit 71 receives a request signal for requesting vehicle information of the control bus 10 from a transmission source that has not been authenticated by the authentication unit 72, the proxy unit 71 performs the authentication process for the transmission source of the request signal. 72. And the proxy part 71 permits the process in the process part 70 about the request signal which requests | requires vehicle information on condition that the transmission origin is authenticated by the authentication part 72. FIG.
During the authentication process, the monitoring unit 73 monitors the behavior of the request signal between the external device and the authentication unit 72. If the behavior of the request signal is normal, the monitoring unit 73 continues the authentication process of the authentication unit 72. On the other hand, if the monitoring unit 73 determines that the behavior of the request signal is suspicious, the authentication unit 72 performs the authentication process of the request signal. Stop it. Since the transmission source of the request signal is not authenticated by this cancellation, the proxy unit 71 prohibits the processing even if a request signal from the transmission source is received, that is, prevents the processing unit 70 from processing the request signal.
FIG. 6 shows a process of transmitting vehicle information of the control bus 10 in response to a request from an external device. Here, it is assumed that the external device has been authenticated by the authentication processing shown in FIG.
The vehicle 1 receives a request signal MB1 for requesting vehicle information from the external bus (not shown) connected to the Internet W via the external bus 30 to the control system bus 10. The request signal MB1 is transmitted to the proxy unit 71 when the third FW unit 64 determines whether or not the request signal MB1 is allowed to pass. The proxy unit 71 changes the transmission destination of the request signal MB1 to the data server unit 75 because the external device is authenticated and the communication message requests vehicle information of the control bus 10. That is, the proxy unit 71 requests the data server unit 75 to process the request signal MB1.
The data server unit 75 analyzes the request signal MB1 transmitted from the proxy unit 71 and acquires vehicle information requested by the request signal MB1. The data server unit 75 creates a communication message MB2 for obtaining the vehicle information thus obtained from the control bus 10, and transmits the created communication message MB2 to the proxy unit 71. The proxy unit 71 transmits the transmitted communication message MB2 to the control bus 10. The communication message MB2 is input to the control gateway 50 via the communication bus 41 when the first FW unit 62 determines whether or not the communication message MB2 is allowed to pass. At this time, the first FW unit 62 permits passage of the communication message MB2 on condition that the communication message MB2 is a communication message from the processing unit 70 to the control system bus 10. The control gateway 50 acquires the vehicle information requested by the communication message MB2 from the message buffer 501, generates a reply communication message MB3 including the acquired vehicle information, and sends it back to the data server unit 75. The communication message MB3 is also determined by the first FW unit 62 as to whether or not the communication message MB3 is allowed to pass. Also at this time, the first FW unit 62 permits passage of the communication message MB3 on condition that the communication message MB3 is a communication message from the control system bus 10 to the processing unit 70.
The data server unit 75 to which the communication message MB3 is transmitted acquires vehicle information from the communication message MB3, and creates a response signal MB4 including the acquired vehicle information as a response message to the request signal MB1 that requested the vehicle information. . That is, the response signal MB4 is created as a communication message that can be transmitted to the external bus 30. Then, the data server unit 75 transmits the created response signal MB4 to the proxy unit 71. The proxy unit 71 processes and changes the transmission source and transmission destination of the transmitted response signal MB4 as necessary, and then transmits the response signal MB4 to the external device connected to the external bus 30 that is the transmission source. . The response signal MB4 is transmitted to the external bus 30 when the third FW unit 64 determines whether or not the response signal MB4 is allowed to pass. At this time, the third FW unit 64 permits passage of the response signal MB4 on condition that the response signal MB4 is a communication message from the processing unit 70 to the external bus 30.
The log unit 74 acquires log data related to the request signal MB1. For example, the log unit 74 acquires log data from the start of communication with an external device to the end and analyzes the log data on the condition that the communication is ended to determine whether there is unauthorized communication. Or sending log data to an external log analyzer. The start of communication includes establishment of a connection route or a connection line, and the end of communication includes disconnection of the connection route or the connection line. Note that the log data acquisition by the log unit 74 may be omitted if a subsequent determination is unnecessary.
FIG. 7 shows a process for continuously transmitting vehicle information of the control bus 10 in response to a request from an external device. Here, the external device is authenticated by the authentication process shown in FIG. 5, and a request signal for continuously requesting vehicle information is also sent to the ECU of the destination control system bus 10 by the process shown in FIG. It has been transmitted.
Here, an Ethernet (registered trademark) standard communication bus 17 is further connected to the control system gateway 50, and the communication bus 17 has four cameras, that is, FR (front right side) cameras 171, FL ( Front left) camera 172, RR (rear right side) camera 173, RL (rear left side) camera 174 are connected. Each of the cameras 171 to 174 is a camera that images the environment outside the vehicle 1, the FR camera 171 images the front right side of the vehicle 1, the FL camera 172 images the front left side of the vehicle 1, and the RR camera 173 The rear right side of the vehicle 1 is imaged, and the RL camera 174 images the rear left side of the vehicle 1. For example, the FL camera 172 receives a request signal for continuously requesting vehicle information created by the data server unit 75 via the proxy unit 71, the first FW unit 62, and the control system gateway 50. The request signal for continuously requesting vehicle information is, for example, an instruction to continue sending images taken by a camera in a short cycle. Further, the proxy unit 71 stores that a request signal for continuously requesting vehicle information has been transmitted to the FL camera 172.
When a request signal for continuously requesting vehicle information is transmitted, the FL camera 172 periodically generates and transmits a reply communication message MC1 including a captured image according to the instruction. That is, the FL camera 172 transmits a moving image in real time. The FL camera 172 creates the communication message MC1 so that it can be transmitted by IP (Internet Protocol). The communication message MC1 transmitted from the FL camera 172 is transmitted from the control system gateway 50 to the first FW unit 62. The communication message MC1 is transmitted to the proxy unit 71 when the first FW unit 62 determines whether or not the communication message MC1 is allowed to pass. At this time, the first FW unit 62 permits the passage thereof on condition that the communication message MC1 is a communication message from the control bus 10 to the processing unit 70. When the proxy unit 71 determines that the communication message MC1 is a response message to the communication message that continuously requests the vehicle information transmitted to the FL camera 172, the proxy unit 71 needs information on the transmission destination and the transmission source of the communication message MC1. The response signal MC2 changed according to is processed and changed. Then, the proxy unit 71 transmits the processed / changed response signal MC2 to the external device of the external bus 30 via the third FW unit 64. The response signal MC2 is transmitted to the external bus 30 when the third FW unit 64 determines whether or not the response signal MC2 is allowed to pass. At this time, the third FW unit 64 also permits passage of the response signal MC2 on condition that the response signal MC2 is a communication message from the processing unit 70 to the external bus 30. Thus, by processing a communication message in the proxy part 71, it can prevent that the processing load of the data server part 75 rises by the vehicle information transmitted continuously. Even in this case, since the communication message MC1 from the control bus 10 is changed to the response signal MC2 by the processing of the proxy unit 71 and output, the processing unit can be processed without changing the restriction condition of the third FW unit 64. Passing from 70 to the external bus 30 is permitted. In addition, since it is not necessary to change the regulation conditions of the third FW unit 64, the security of the control bus 10 and the information bus 20 with respect to the external bus 30 is maintained high.
FIG. 8 shows a process of transmitting vehicle information that is control information of the control bus 10 in response to a request from the information providing server MS of the information bus 20. Here, it is assumed that the information providing server MS has been authenticated by the authentication processing illustrated in FIG.
The vehicle 1 is connected to an information providing server MS such as a navigation device via a wireless communication unit 23 of the information bus 20. Then, the vehicle 1 receives a request signal MD1 for requesting vehicle information of the control bus 10 from the information providing server MS. The request signal MD1 is transmitted to the proxy unit 71 when the second FW unit 63 determines whether or not the request signal MD1 is allowed to pass. Since the information providing server MS has been authenticated, the proxy unit 71 changes the transmission destination of the request signal MD1 to the data server unit 75. That is, the proxy unit 71 requests the data server unit 75 to process the request signal MD1. The data server unit 75 analyzes the request signal MD1 transmitted from the proxy unit 71. Since the request signal MD1 passing through the information bus 20 is normally connected to the manufacturer's information providing server MS and is considered to have higher security than the Internet, the security of the request signal MD1 is a message from the Internet. Is considered to be higher.
The data server unit 75 transmits a communication message MD2 for acquiring vehicle information created based on the request signal MD1 to the control bus 10 via the proxy unit 71 and the first FW unit 62. The control gateway 50 of the control bus 10 generates a return communication message MD3 including the vehicle information requested by the communication message MD2 acquired from the message buffer 501, and sends the first FW unit 62 and the proxy unit 71. To the data server unit 75. The data server unit 75 creates a response signal MD4 including the vehicle information acquired from the communication message MB3, and transmits this to the information bus 20 via the proxy unit 71. The created response signal MD4 is a response message to the request signal MD1 that requests the vehicle information included in the response signal MD4.
The log unit 74 does not acquire log data because the request signal MD1 input from the information bus 20 has a relatively high security. The log unit 74 may also acquire log data for the request signal MD1 and analyze the acquired log data or send it to a log analysis device.
FIG. 9 shows a process of continuously transmitting vehicle information of the control bus 10 in response to a request from an external device. Here, it is assumed that the next-generation in-vehicle information communication system (IVI: in-vehicle infotainment) 24 of the information bus 20 has already been authenticated. The IVI 24 is an information providing device mounted on the vehicle 1 and provides a wide range of telephone functions, navigation functions, audio functions, Internet connection / search functions, and the like. As shown in FIG. 7, four FR cameras 171, FL cameras 172, RR cameras 173, and RL cameras 174 are connected to the communication bus 17 of the Ethernet (registered trademark) standard of the control system gateway 50. Yes.
The request signal for continuously requesting vehicle information from the information bus 20 has been transmitted to the FL camera 172 of the control bus 10 in the manner illustrated in FIG. That is, the communication message created by the data server unit 75 corresponding to the communication message from the IVI 24 is transmitted to the FL camera 172 via the proxy unit 71, the first FW unit 62, and the control system gateway 50. The request signal for continuously requesting the vehicle information causes the FL camera 172 to continue sending images captured by the camera in a short cycle. The proxy unit 71 stores that the communication message for continuously requesting the vehicle information to the FL camera 172 is transmitted, and the control condition of the second FW unit 63 is controlled according to the transmission of the communication message. The communication message is changed to be permitted to pass from the bus 10 to the information bus 20. Since the security of the control system bus 10 is higher than the security of the information system bus 20, there is no possibility that the security level of the information system bus 20 is lowered by the change of the regulation condition of the second FW unit 63 at this time.
The FL camera 172 periodically generates and transmits a response signal ME1 as a response communication message including a captured image in response to a communication message for continuously requesting vehicle information. The FL camera 172 creates the response signal ME1 so that it can be transmitted by IP. The response signal ME <b> 1 transmitted from the FL camera 172 is transmitted from the control system gateway 50 to the first FW unit 62, and is allowed to pass by the first FW unit 62. The response signal ME <b> 1 that has passed through the first FW unit 62 is transmitted to the proxy unit 71 and the second FW unit 63 via the internal bus 61. The second FW unit 63 permits passage of the transmitted response signal ME1, and the response signal ME1 is transmitted to the information bus 20. The response signal ME1 is input via the information bus 20 to the IVI 24 that is the transmission source of the request signal. On the other hand, since the response signal ME1 is directly transmitted from the second FW unit 63 to the information bus 20, the proxy unit 71 does not perform processing on the response signal ME1.
As a result, the processing load on the data server unit 75 and the proxy unit 71 is prevented from increasing due to the processing of the response signal ME1 continuously transmitted from the control bus 10. Even in this case, only the response signal ME1 from the control bus 10 is permitted to be transmitted to the information bus 20. That is, the control condition for the input request signal among the control conditions of the second FW unit 63 and the control condition of the third FW unit 64 are not changed, so the control bus 10 and the information bus for the external bus 30 are not changed. Twenty security is ensured.
As described above, the communication system including the information processing apparatus according to the present embodiment has the effects listed below.
(1) Since the control bus 10 is isolated from the external bus 30 to which the Internet and information terminals are connected, and the information bus 20 to which information devices such as audio devices and navigation devices are connected, the movement of the vehicle 1 Therefore, the security of the control bus 10 through which vehicle information (control information) important for the vehicle is transferred is preferably ensured.
The processing unit 70 is connected to the control system bus 10, the information system bus 20, or the external bus 30 via the first to third FW units 62 to 64, and the control system bus 10 is connected to the information system bus 20 and the external bus. Even without being directly accessed from the bus 30, the information in the control bus 10 can be transmitted to the information bus 20 and the external bus 30 via the processing unit 70.
Accordingly, it is possible to suitably ensure the security of the control bus 10 with respect to the external bus 30 and the like while enabling communication between the control bus 10 and the information bus 20 and the external bus 30.
Further, by interposing the processing unit 70 in acquiring information from the control bus 10, the external bus 30 can acquire information in the control bus 10 by a request signal that does not conform to the protocol of the control bus 10. Also become.
The vehicle 1 is usually provided with at least three networks having different required security levels, that is, a control system bus 10, an information system bus 20, and an external bus 30. That is, in the vehicle 1, there are a control bus 10 that requires a high security level, an information bus 20 that does not require a very high security, and an external bus 30 that is difficult to ensure security. The security level that should be secured in each bus can be set appropriately.
(2) Since the request signal received from the external bus 30 or the information bus 20 is processed by the processing unit 70 without flowing directly to the control bus 10, the security of at least the control bus 10 is suitably maintained. The In the case of the vehicle 1, the processing unit 70 acquires vehicle information such as speed information and sensor information of the control bus 10 based on the received request signal, and responds to the request signal so as to include the acquired vehicle information. Create a response signal. As a result, even if a request signal from another network does not flow through the control network, information requested through the request signal is included in the response signal and transmitted to the transmission source of the request signal of the other network. .
Further, since the request signal received from the external bus 30 or the like is processed by the processing unit 70, the external bus 30 or the like does not need to adapt the request signal to the protocol of the control system bus 10. For this reason, acquisition of the vehicle information of the control system bus 10 by the external bus 30 or the information system bus 20 is also facilitated.
(3) If vehicle information is acquired from the control bus 10, the vehicle information is acquired from the control bus 10 every time a request signal is received from the external bus 30 or the like. Real-time performance can be improved.
(4) If the vehicle information is acquired from the holding unit of the data server unit 75, the control information in which the response signal responding to the request signal received from the external network or the information system network is acquired from the control system network and stored. Created based on For this reason, the time required to transmit the response signal created corresponding to the received request signal is shortened, and the response of the response signal to the request signal is improved.
(5) Since the request signal from the external bus 30 or the like can hide the transmission destination information of the control bus 10 from the external bus 30 via the proxy unit 71, the control bus 10 security can be secured higher.
Further, by causing the data server unit 75 to process the request signal, it is possible to create a response signal corresponding to the request signal without transmitting the request signal from the external bus 30 or the like to the control bus 10. Become. This also keeps the security of the control bus 10 high.
(6) Since the processing unit 70 performs processing for acquiring vehicle information only for the request signal transmitted from the authenticated external device, the vehicle information of the control bus 10 is illegally acquired by the external device that is not authenticated. Is prevented. Also by this, the security of the control system bus 10 can be kept high.
(7) Since acquisition of vehicle information based on a request signal determined to be abnormal by monitoring is prohibited, the security of the control bus 10 is also improved by this.
(8) By storing the request signal as log data in time series or statistically, it is possible to determine the presence or absence of an abnormal request signal due to an attack from the external bus 30 or the like. Thereby, management of the communication system mounted on the vehicle 1 can be suitably performed, and further security of the control bus 10 can be improved.
(9) Even if, for example, a plurality of continuous vehicle information is requested by a request signal from the external bus 30, the processing unit 70 can appropriately cope with the request. That is, the processing unit 70 can create a response signal that responds to the request signal while sequentially including a plurality of pieces of vehicle information stored in time series in the data server unit 75 as an appropriate storage unit. Moreover, you may produce the response signal containing the acquired vehicle information in the order which acquires the vehicle information which consists of short period information, divided | segmented information, etc. from the control system bus | bath 10. FIG. As a result, it is possible to satisfy a plurality of vehicle information acquisition requests while ensuring high security of the control bus 10.
(10) The communication protocol of the vehicle control system bus 10 is CAN, and the communication protocol of the external bus 30 is IP, which is different. Therefore, even if the communication protocol of the control bus 10 and the communication protocol of the external bus 30 are different by providing the protocol conversion units 511 to 514 on the control system bus 10 side from the first FW unit 62. The request signal input from the external bus 30 and processed by the processing unit 70 is converted into the communication protocol of the control bus 10. As a result, information transmission between the external bus 30 and the control bus 10 is appropriately performed.
(11) The response signal created including the control information acquired from the control bus 10 is transferred to the authenticated transmission source of the information bus 20. As a result, the processing load of the processing unit 70 can be reduced, and the vehicle information of the control bus 10 can be easily and quickly acquired by the information providing server MS as a device of the information bus 20.
In addition, the said embodiment can also be implemented with the following aspects.
In the above embodiment, the case where a plurality of ECUs are connected to the control system bus 10 and the information system bus 20 is illustrated. However, the present invention is not limited to this, and one or more ECUs may be connected. As a result, the application range of the communication system including the information processing apparatus can be expanded.
In the above embodiment, the case where the ECU is connected to the control system bus 10 or the information system bus 20 has been illustrated. However, the present invention is not limited thereto, and each bus may be a device that can communicate via a communication bus. For example, an information processing device other than the ECU may be connected. As a result, the application range of the communication system including the information processing apparatus can be expanded.
In the above embodiment, the case where the control bus 10 includes a CAN bus, a LIN bus, and an Ethernet (registered trademark) bus is illustrated. However, the present invention is not limited to this, and the control bus may include a communication standard other than the CAN bus, the LIN bus, and the Ethernet (registered trademark) bus, such as a FlexRay (registered trademark). Further, the control system bus only needs to include at least one of a CAN bus, a LIN bus, an Ethernet (registered trademark) bus, and other buses. As a result, the application range of the communication system including the information processing apparatus can be expanded.
In the above embodiment, the case where a plurality of communication buses (buses 11 to 16, 17) are provided in the control system bus 10 is illustrated. However, the present invention is not limited to this, and it is sufficient that at least one communication bus is provided in the control system bus. As a result, the application range of the communication system including the information processing apparatus can be expanded.
In the above embodiment, the case where the power train GW 51, the chassis GW 52, the safety GW 53, and the vehicle body GW 54 are provided in the control system gateway 50 is illustrated. However, the present invention is not limited thereto, and the control system gateway may be provided with at least one of the power train GW, the chassis GW, the safety GW, and the vehicle body GW. As a result, the application range of the communication system including the information processing apparatus can be expanded.
In the above embodiment, the case where the power train GW 51, the chassis GW 52, the safety GW 53, and the vehicle body GW 54 are separately provided in the control system gateway 50 is illustrated. However, the present invention is not limited to this, and the control system gateway may have a configuration in which any one of the power train GW, the chassis GW, the safety GW, and the vehicle body GW is integrated. As a result, the degree of freedom in designing the communication system including the information processing apparatus can be improved.
In the above embodiment, the case where the DMZ 60 and the control system gateway 50 are provided integrally with the central gateway 40 has been illustrated. For example, when the functions of the DMZ 60 and the control system gateway 50 are arranged in the processing device of the central gateway 40 and each bus is logically isolated by software, if any of the functions is changed, the entire central gateway 40 is changed. This involves troublesome design changes and software updates. Therefore, the DMZ and the control system gateway may be configured separately.
For example, as shown in FIG. 10, the DMZ 60 may be separated from a control system gateway 50A having a configuration in which four gateways of a power train GW, a chassis GW, a safety GW, and a vehicle body GW are combined. That is, the processing device that realizes the function of the DMZ 60 and the processing device that realizes the function of the control gateway 50A may be physically separated. In this case, only the design change and software update related to the processing apparatus in which the function is changed can be required. As a result, the degree of freedom in designing the communication system including the information processing apparatus can be improved.
Furthermore, as shown in FIG. 11, the control bus 10 may be configured to include gateways (switches) 51 </ b> A to 54 </ b> A composed of separate processing devices in each communication bus. In this case, the specification change that occurs in each communication bus can be made only by changing the design of the corresponding gateway (switch). As a result, the degree of freedom in design of the communication system including the information processing apparatus can be improved and the application range can be expanded.
In the above-described embodiment, the case where the message buffer 501 is provided in the control system gateway 50 is illustrated. However, the present invention is not limited to this, and the message buffer may not be provided in the control system gateway. Incidentally, in this case, each communication bus gateway may have a message buffer, or when vehicle information is required between the communication buses, vehicle information is sent from the target ECU each time. You may do it. As a result, the degree of freedom in design of the communication system including the information processing apparatus can be improved and the application range can be expanded.
In the above embodiment, the case where the vehicle information of the control system bus 10 is acquired from the ECU of the control system bus 10 and the case where the vehicle information is acquired from the message buffer 501 of the control system gateway 50 are illustrated. When the vehicle information is acquired from the ECU, the latest information is expected to be acquired. When the vehicle information is acquired from the message buffer 501, a quick response is expected. However, the present invention is not limited to this, and the vehicle information of the control system bus may be acquired only from the ECU of the control system bus or from only the message buffer of the control system gateway. In any case, since there is no great difference in the processing related to the acquisition of vehicle information in the processing unit, the processing unit can appropriately cope with any case.
In the above embodiment, the case where the vehicle information of the control bus 10 is acquired from the information bus 20 is illustrated. However, the present invention is not limited to this, and parameters may be set from the information bus to the ECU of the control bus. Usually, an information bus mounted on a vehicle has higher security than an external bus. In other words, since the security of the information bus is maintained at a predetermined level, transmission of setting data for setting data to the control system device of the control bus may be permitted from the information bus. Thus, even if parameters can be set from the information bus to the ECU of the control bus, the security of the control bus is usually maintained at an appropriate level. As a result, it is possible to easily manage the control system devices connected to the control system bus while maintaining the security of the control system bus with respect to the external bus.
In the above embodiment, the case where the continuous vehicle information is a camera image, that is, a so-called moving image is illustrated. However, the present invention is not limited to this, and the continuous vehicle information may be obtained by dividing large data into a plurality of pieces. Thereby, the application range of the information processing apparatus can be expanded.
In the above embodiment, the case where the log data may be analyzed by the log unit 74 or the log data may be transmitted to an external log analysis device is illustrated. In other words, the log data may be analyzed only in the log unit, or the log data may be transmitted to an external log analysis device, and both the analysis by the log unit and the log data transmission to the log analysis device are performed. May be. In any case, the presence / absence of an abnormality in the request signal is analyzed after the fact based on the log data. Thereby, the design flexibility of the information processing apparatus can be improved.
In the above embodiment, the case where the log data is analyzed by the log unit 74 or the log analysis device is illustrated. However, the present invention is not limited to this, and the log unit and the log analysis device may analyze log data in real time. Thereby, the responsiveness of the information processing apparatus to an abnormal communication message can be improved.
In the above embodiment, the case where the processing unit 70 includes the authentication unit 72, the monitoring unit 73, and the log unit 74 is illustrated. However, the configuration is not limited thereto, and a configuration in which all or a part of the authentication unit, the monitoring unit, and the log unit are omitted from the processing unit may be employed. Thereby, the design flexibility of the information processing apparatus can be improved.
In the above embodiment, the case where the authentication unit 72 authenticates the external device when starting communication with the external device or the like is illustrated. However, the present invention is not limited thereto, and when the authentication unit receives a request signal for vehicle information from an external device, the authentication unit may start the authentication process based on the received request signal. For example, an authentication process may be started in response to receiving a vehicle information request signal, and information necessary for authentication may be requested from an external device. Further, if authentication data is given to the request signal for vehicle information, an authentication process may be performed on the request signal for vehicle information. As a result, the application range of the information processing apparatus can be expanded.
In the above embodiment, the case where the proxy unit 71 updates the information related to the unauthorized transmission source of the proxy unit 71 based on the authentication result of the authentication unit 72 and the monitoring result of the monitoring unit 73 is illustrated. However, the present invention is not limited to this, and the authentication unit itself may update the information on the unauthorized transmission source of the proxy unit based on the authentication result, or the monitoring unit itself may update based on the monitoring result. Thereby, the design flexibility of the information processing apparatus can be improved.
In the above embodiment, the case where the processing unit 70 is provided with the proxy unit 71 and the data server unit 75 is illustrated. However, the present invention is not limited to this, and the proxy unit and the data server unit may be integrally configured as long as their functions are realized. Thereby, the design flexibility of the information processing apparatus can be improved.
-In above-mentioned embodiment, it illustrated about the case where the regulation conditions of the 1st-3rd FW parts 62-64 are set based on the address of a transmission source or a transmission destination. However, the present invention is not limited to this, and the regulation condition of each FW unit may be determined by the content of the communication message, not the address of the transmission source or the transmission destination, or the address of the transmission source or the transmission destination and the content of the communication message May be determined by As a result, the degree of freedom in setting communication restrictions in the firewall is improved, and unauthorized communication messages can be more appropriately prevented from entering the DMZ.
-In above-mentioned embodiment, it illustrated about the case where the DMZ60 is provided with three of the 1st-3rd FW parts 62-64. However, the present invention is not limited to this, and the firewall provided in the DMZ may be configured separately from the corresponding networks or may be integrated with the three networks as long as these functions are exhibited. Thereby, the design flexibility of the information processing apparatus can be improved.
-In above-mentioned embodiment, in DMZ60, the case where the 1st-3rd FW parts 62-64 and the process part 70 were provided separately was illustrated. However, the present invention is not limited to this, and in the DMZ, as long as the functions of the FW units and the processing units are realized, they may be configured integrally. Thereby, the design flexibility of the information processing apparatus can be improved.
In the above embodiment, the case where vehicle information is acquired from the control bus 10 has been illustrated. However, the present invention is not limited thereto, and information irrelevant to vehicle control, that is, control information other than vehicle information may be acquired from the control bus. Thereby, the application range of the information processing apparatus can be expanded.
In the above embodiment, the case where each network is a bus type network of the control system bus 10, the information system bus 20, and the external bus 30 is illustrated. However, the present invention is not limited to this, and each network may be a star network or a ring network. As a result, the application range of the communication system including the information processing apparatus can be expanded.
In the above embodiment, the case where the information bus 20 and the external bus 30 are Ethernet (registered trademark) is illustrated. However, the present invention is not limited to this, and the information bus or external bus may be a communication standard other than Ethernet (registered trademark), for example, CAN, LIN, FlexRay, or the like. As a result, the application range of the communication system including the information processing apparatus can be expanded.
In the above embodiment, the case where three buses are connected to the DMZ 60 is illustrated. However, the present invention is not limited to this, and four or more buses may be connected to the DMZ. As a result, the application range of the information processing apparatus can be expanded.
In the above embodiment, the case of securing the security of the control bus 10 is mainly exemplified, but the present invention is not limited to this, and the security of the information bus is similarly secured. Thereby, the security of the information bus of the vehicle is suitably maintained by the information processing apparatus.
-In above-mentioned embodiment, the case where the vehicle 1 was a motor vehicle was illustrated. However, the present invention is not limited to this, and the information processing apparatus may be provided in a moving body other than an automobile, such as a ship, a railway, an industrial machine, or a robot. Thereby, the application range of the communication system including the information processing apparatus can be expanded.
DESCRIPTION OF SYMBOLS 1 ... Vehicle, 10 ... Control system bus, 11-14 ... 1st-4th CAN bus, 16 ... LIN bus, 17 ... Communication bus, 20 ... Information system bus, 21 ... Communication bus, 23 ... Wireless communication part, 24 ... Next-generation in-vehicle information communication system (IVI), 30 ... External bus, 31 ... Communication bus, 32 ... Data link connector (DLC), 33 ... Wireless communication unit, 40 ... Central gateway, 41 ... Communication bus, 50, 50A ... Control system gateway, 51 ... Powertrain GW, 52 ... Chassis GW, 53 ... Safety GW, 54 ... Car body GW, 51A-54A ... Gateway, 60 ... Demilitarized zone (DMZ), 61 ... Internal bus, 62-64 ... No. 1st-3rd firewall (FW) part, 70 ... processing part, 71 ... proxy part, 72 ... authentication part, 73 ... monitoring part, 74 ... log part, 75 ... data server part, 11 113, 131, 132, 141, 142, 161 ... Electronic control unit (ECU), 171 ... FR camera, 172 ... FL camera, 173 ... RR camera, 174 ... RL camera, 211, 213, 214 ... ECU, 212 ... Ethernet switch, 501... Message buffer, 511 to 514... Protocol conversion unit, W.
Connected to a plurality of networks including a control system network connected to a control system device in a mobile body, an information system network connected to an information system device in a mobile body, and an external network connected to an external device of the mobile body An information processing apparatus for performing information processing,
A firewall connected to each of the networks, and a processing unit connected to each network via the firewall,
The firewall isolates at least the control network from other networks by allowing only communication between the network to which the firewall is connected and the processing unit,
The processing unit includes a proxy server that changes a transmission destination of the received request signal, and a data server that creates a response signal corresponding to the received request signal,
The proxy server changes the transmission destination of the received request signal to the data server according to the processing content requested by the request signal,
The data server, the control information of the control system equipment the request signal for requesting holds the holding portion in advance obtained from the control system network, the control information of the control system equipment obtained from the control system network acquiring a request signal for requesting from the holding unit for obtaining control information for requesting the received request signal from said control network based on receiving from another network by the destination is changed by the proxy server An information processing apparatus comprising: generating a response signal that includes the acquired control information and responding to the request signal; and transmitting the generated response signal to a network that transmits the request signal.
The processing unit further includes an authentication unit that authenticates a device that has transmitted the received request signal, and acquires control information required only for the request signal transmitted from the device authenticated by the authentication unit. The information processing apparatus according to claim 1 .
The processing unit further includes a monitoring unit that monitors the received request signal according to a monitoring condition,
The information according to claim 1 or 2 , wherein when the monitoring unit determines that an abnormality has occurred in the received request signal by monitoring according to the monitoring condition, the processing unit prohibits acquisition of control information. Processing equipment.
Wherein the processing unit, the information processing apparatus according to any one of claims 1 to 3, further comprising a log unit for chronologically recording the request signal thus received.
When the request by the received request signal is acquisition of a plurality of control information, the processing unit sequentially acquires a plurality of control information requested by the received request signal one by one from the control system network and acquires them. The information processing apparatus according to any one of claims 1 to 4 , wherein the response signal that responds to the request signal is repeatedly generated while sequentially including the control information.
A protocol conversion unit is provided on the control system network side of the firewall connected to the control system network, and a communication protocol of the request system processed by the processing unit is transmitted through the protocol conversion unit. The information processing apparatus according to any one of claims 1 to 5 .
Wherein the processing unit according to any one of claims 1 to 6, to create a transmission signal to be transmitted on the basis of the setting data to the device in the control system network received from the information-system network to the control system network Information processing device.
The processing unit authenticates a transmission source of the request signal received from the information network, acquires control information requested by the received request signal from the holding unit , and includes the acquired control information. The information processing apparatus according to any one of claims 1 to 7 , wherein the created response signal is transferred to the authenticated transmission source of the information network.
Connected to a plurality of networks including a control system network connected to a control system device in a mobile body, an information system network connected to an information system device in a mobile body, and an external network connected to an external device of the mobile body An information processing method in an information processing apparatus that performs information processing by
The firewall allows at least the control network to be isolated from other networks by allowing only communication between the network to which the firewall is connected and the processing unit,
The proxy server causes the data server to change the transmission destination of the received request signal according to the processing content requested by the request signal,
The said data server, the control information of the control system equipment the request signal for requesting by holding the holding portion in advance obtained from the control system network, the control information of the control system equipment obtained from the control system network acquiring a request signal for requesting from the holding unit for obtaining control information for requesting the received request signal from said control network based on receiving from another network by the destination is changed by the proxy server A response signal that responds to the request signal including the acquired control information, and transmits the generated response signal to a network that is a transmission source of the request signal. .
JP2013034611A 2013-02-25 2013-02-25 Information processing apparatus and information processing method Active JP5838983B2 (en)
JP2013034611A JP5838983B2 (en) 2013-02-25 2013-02-25 Information processing apparatus and information processing method
EP14704399.6A EP2959654B1 (en) 2013-02-25 2014-01-16 Information processing device and information processing method
US14/765,937 US9866527B2 (en) 2013-02-25 2014-01-16 Information processing device and information processing method
PCT/JP2014/000202 WO2014129107A1 (en) 2013-02-25 2014-01-16 Information processing device and information processing method
CN201480010038.5A CN105009546B (en) 2013-02-25 2014-01-16 Information processor and information processing method
JP2014165641A JP2014165641A (en) 2014-09-08
JP5838983B2 true JP5838983B2 (en) 2016-01-06
ID=50102149
JP2013034611A Active JP5838983B2 (en) 2013-02-25 2013-02-25 Information processing apparatus and information processing method
US (1) US9866527B2 (en)
EP (1) EP2959654B1 (en)
JP (1) JP5838983B2 (en)
CN (1) CN105009546B (en)
WO (1) WO2014129107A1 (en)
EP3111361B1 (en) * 2014-02-28 2018-02-28 Digital Car Services BVBA Safety measures for a network, secured network and method for securing a network.
CN104753962A (en) * 2015-04-23 2015-07-01 厦门雅迅网络股份有限公司 OBD (On-board diagnostics) safety management method and system
DE102015214505A1 (en) * 2015-07-30 2017-02-02 Robert Bosch Gmbh Method and device for exchanging data with the control electronics of a motor vehicle
EP3150460B1 (en) * 2015-09-30 2019-11-13 ALSTOM Transport Technologies Railway vehicle with unidirectional security gateway for secure diagnosis data transmission
US20170310674A1 (en) * 2016-04-26 2017-10-26 Honeywell International Inc. Approach for securing a vehicle access port
EP3554018A1 (en) * 2016-12-06 2019-10-16 Panasonic Intellectual Property Corporation of America Information processing device and information processing method
JP6490879B2 (en) * 2016-12-06 2019-03-27 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカＰａｎａｓｏｎｉｃ Ｉｎｔｅｌｌｅｃｔｕａｌ Ｐｒｏｐｅｒｔｙ Ｃｏｒｐｏｒａｔｉｏｎ ｏｆ Ａｍｅｒｉｃａ Information processing apparatus and information processing method
CN109076012A (en) * 2016-12-06 2018-12-21 松下电器（美国）知识产权公司 Information processing unit and information processing method
CN108886489A (en) * 2016-12-06 2018-11-23 松下电器（美国）知识产权公司 Information processing unit and information processing method
JP2018120503A (en) * 2017-01-27 2018-08-02 住友電気工業株式会社 On-vehicle communication system, gateway, switch apparatus, communication control method, and communication control program
JP6585113B2 (en) * 2017-03-17 2019-10-02 株式会社東芝 Data storage device
CN107682334A (en) * 2017-09-30 2018-02-09 郑州信大捷安信息技术股份有限公司 A kind of OBD interface data security protection system and data security protection method
FR3074762A1 (en) * 2017-12-08 2019-06-14 Speedinnov Terrestrial transit vehicle, system comprising such a vehicle and use of such a vehicle
JP4481519B2 (en) * 2001-03-22 2010-06-16 株式会社東芝 IO device with intelligent HMI function
KR20030046635A (en) * 2001-12-06 2003-06-18 현대자동차주식회사 Monitoring apparatus on vehicle information
CN100476649C (en) * 2006-08-16 2009-04-08 中山大学 Vehicle mounted intelligent control device and method
JP2012010022A (en) 2010-06-23 2012-01-12 Toyota Motor Corp On-vehicle communication system
CN202183042U (en) * 2011-08-16 2012-04-04 长江武汉航道工程局 Remote monitoring system for construction ship
2013-02-25 JP JP2013034611A patent/JP5838983B2/en active Active
2014-01-16 US US14/765,937 patent/US9866527B2/en active Active
2014-01-16 WO PCT/JP2014/000202 patent/WO2014129107A1/en active Application Filing
2014-01-16 EP EP14704399.6A patent/EP2959654B1/en active Active
2014-01-16 CN CN201480010038.5A patent/CN105009546B/en active IP Right Grant
JP2014165641A (en) 2014-09-08
US9866527B2 (en) 2018-01-09
EP2959654B1 (en) 2017-03-15
CN105009546A (en) 2015-10-28
WO2014129107A1 (en) 2014-08-28
EP2959654A1 (en) 2015-12-30
US20150372975A1 (en) 2015-12-24
CN105009546B (en) 2017-10-20
JP6382724B2 (en) 2018-08-29 Global car safety system
US20150066239A1 (en) 2015-03-05 Vehicle network monitoring method and apparatus
CN103580911B (en) 2017-06-20 Communication system and communication means
DE102010008816A1 (en) 2011-08-25 Method for online communication
US8050811B2 (en) 2011-11-01 Method for controlling the distribution of vehicle-related data
TWI530413B (en) 2016-04-21 Automotive neural network and the network node modules in the vehicle
WO2013080387A1 (en) 2013-06-06 Transmission message generating device and vehicle on-board transmission system
Steinbach et al. 2011 Real-time Ethernet for automotive applications: A solution for future in-car networks
Ref document number: 5838983