JP2003244187A - On-vehicle gateway device and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To appropriately secure driving safety and security. <P>SOLUTION: When receiving information from an information system LAN 6, an on-vehicle gateway device 10 identifies a transmission source of the received information and contents of the information, and determines whether or not authentication is necessary concerning the information received from the information system LAN 6 according to an identification result. When it is determined that the authentication concerning the information is necessary, the on-vehicle gateway device 10 authenticates the information. When it is determined that the authentication concerning the information is not necessary, or the authentication result is correct, the on-vehicle gateway device 10 permits the transmission of the information to a control system LAN 1. On the other hand, when it is determined that the authentication result is not correct, the on-vehicle gateway device 10 prohibits the transmission of the information to the control system LAN 1. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention is capable of receiving information from an information system LAN, and receives the received information from a control system LAN.
The present invention relates to a vehicle-mounted gateway device that is configured to be capable of transmitting data to a computer and a computer program executed by the vehicle-mounted gateway device.

[0002]

As an in-vehicle LAN (Local Area Network) mounted on a vehicle, for example, an original operation of the vehicle such as an engine ECU (Electronic Control Unit), a brake ECU, a door lock ECU and an air conditioner ECU is performed. Control system LA to which the controlling device is connected
N and, for example, a navigation device, ETC (Electronic
Toll Collection) An information system LAN to which devices that control the operations of various applications such as an on-vehicle device and a multi-display are connected.

By the way, the control system LAN has conventionally been completed (closed) by the control system LAN itself because of the fact that information relating to traveling safety is transferred. With the development of Intelligent Transport System, applications for transferring information between a control LAN and an information LAN are being put to practical use.
As an example, as an application for transferring information from the control LAN to the information LAN, there is an emergency call (Mayday) and the like, while the information LAN to the control LAN are used.
An application that transfers information to a mobile phone is navigation cooperative control.

However, from the information system LAN to the control system L
The configuration that permits the transfer of information to the AN without limitation has the following problems.

That is, for example, when a device having a function of communicating with the outside (for example, a navigation device to which a mobile phone is connected, an ETC vehicle-mounted device) is connected to the information system LAN, the device speeds up from the outside for some reason. Receives the vehicle speed control command for controlling the
The control system LAN provides vehicle speed control information for N to control the vehicle speed.
And the control LAN is connected to the information LAN.
If the vehicle speed control information is received from the control system LAN, the control system LAN may control the vehicle speed based on the vehicle speed control information. If this happens, the control system LAN will control the vehicle speed against the driver's intention, and as a result, there is a problem that the safety of traveling is impaired.

Further, for example, when a device having a function of communicating with the outside is connected to the information LAN, the device requests a door lock state from the outside for some reason due to some reason. Upon receiving the command, the information system LAN transmits door lock state request information for requesting the door lock state to the control system LAN. Along with this, the control system LAN transmits the door lock state request information from the information system LAN. When received, the control LAN sends the door lock status information indicating the door lock status to the information LAN.
May be sent to. Then, the control system LAN
Since the locked state of the door is leaked to the outside, as a result, there is a problem that security is impaired, such that the locked state of the door may be known to the outside and stolen.

Considering the background that the communication protocol of the information LAN is unified among the vehicle manufacturers in recent years into a general-purpose communication protocol used on the Internet, in particular, from the information LAN to the control LAN. It is assumed that the amount of information transferred will increase, and the problems described above will likely occur.

The present invention has been made in view of the above circumstances, and an object thereof is from an information system LAN to a control system LA.
An object of the present invention is to provide an in-vehicle gateway device and a computer program capable of appropriately ensuring traveling safety and security by limiting transfer of information to N.

[0009]

According to the vehicle-mounted gateway device of the present invention, the control means is an information system LAN.
When the information is received by the information receiving unit from the information receiving unit, the sender of the received information and the content of the information are identified, and authentication is required for the information received by the information receiving unit from the information LAN according to the identification result. If it is determined that authentication is required for the information, authentication is performed for the information. When the control means determines that the information is not required to be authenticated or the authentication result is positive, the control means permits the information transmitting means to transmit the information to the control system LAN, while the authentication is performed. When it is determined that the result is negative, the information transmitting means is prohibited from transmitting the information to the control system LAN.

Therefore, by identifying the sender of the information received from the information LAN and the content of the information, the sender of the information among the information received from the information LAN can improve the driving safety and security. If the device cannot transmit information that may be impaired, or if the content of the information is not likely to impair driving safety or security, the information is not authenticated. , From the information LAN to the control LAN. Further, when the information transmission source is a device that can transmit information that may impair traveling safety or security, or when the content of the information is content that may impair traveling safety or security The information is authenticated and is transferred from the information LAN to the control LAN only when the authentication result is positive. On the other hand, when the authentication result is negative, the information is transferred from the information LAN. It is not transferred to the control system LAN. In this way, it is possible to prevent the information from being transferred from the information system LAN to the control system LAN, which may impair the safety and security of the travel, and thereby the safety and security of the travel. Can be properly secured.

According to the on-vehicle gateway device according to the second aspect, the control means is configured to discriminate the source of the information by discriminating whether or not it is the OEM device.
The EM device is generally a device that cannot transmit information that may impair traveling safety and security,
That is, since it is a highly reliable device, it is possible to easily determine whether or not the information needs to be authenticated by determining whether or not the transmission source of the information is an OEM device.

According to the on-vehicle gateway device of the third aspect, the control means is configured to identify the source of information by discriminating whether or not the device has a communication function with the outside. A device that does not have a communication function with the outside
Generally, a device that cannot transmit information that may impair traveling safety and security, that is, a device that is highly reliable, and therefore a source of information has a communication function with the outside. By determining whether it is a device,
It can be easily determined whether or not the information requires authentication.

According to the computer program of the fourth aspect, when the computer program is installed in the vehicle-mounted gateway device, a procedure for identifying the transmission source and the content of the information received from the information LAN, and the identification result. And a procedure for determining whether or not the information received from the information LAN is required to be authenticated, and a procedure for performing authentication for the information when it is determined that the information is required to be authenticated. When the authentication is determined not to be necessary for the information, or when the authentication result is determined to be positive, the procedure for allowing the information to be transmitted to the control LAN and the authentication result are When it is determined that the information is denied, a procedure for prohibiting the transmission of the information to the control LAN is executed. , It is possible to obtain the same effects as those described in claim 1 described above. That is, it is possible to prevent information that may impair traveling safety and security from being transferred from the information system LAN to the control system LAN, and thus to appropriately ensure traveling safety and security. Can be secured.

[0014]

BEST MODE FOR CARRYING OUT THE INVENTION An embodiment of the present invention will be described below with reference to the drawings. First, in FIG. 1, a control system LAN (Local Area Network) 1 includes, for example, an engine ECU (Electronic Control Unit) 2 and a brake E.
The CU 3, the door lock ECU 4, the air conditioner ECU 5, and the like are connected to devices that control the original operation of the vehicle. These engine ECU 2 and brake ECU
3, the door lock ECU 4 and the air conditioner ECU 5,
Each has a unique address. It should be noted that the power train system devices such as the engine ECU 2 and the brake ECU 3 are connected to the power train system LAN, and the body system devices such as the door lock ECU 4 and the air conditioner ECU 5 are connected to the body system LAN. Powertrain LAN and body LA
N is collectively referred to as a control system LAN 1.

On the other hand, the information LAN 6 includes, for example, a navigation device 7 and an ETC (Electronic Toll Collection).
Devices for controlling the operations of various applications such as the vehicle-mounted device 8 and the multi-display 9 are connected and configured. Unique addresses are also given to the navigation device 7, the ETC vehicle-mounted device 8 and the multi-display 9.

The on-vehicle gateway device 10 is a control system LA.
A control system L interposed between N1 and the information system LAN6 and having an interface function with the control system LAN1.
AN interface section (hereinafter referred to as control system LANIF section, information transmitting means in the present invention) 11, information system LAN
6, an information system LAN interface section having an interface function with the 6 (hereinafter referred to as an information system LANIF section,
Information receiving means) 12 in the present invention, these control system LAN
A CPU (Central Processing Unit) 13 (control means in the present invention) for controlling the overall operation of the IF unit 11 and the information system LAN IF unit 12 and a memory 14 in which a correspondence table referred to by the CPU 13 is stored. There is.

Now, the correspondence table stored in the memory 14 will be described in detail with reference to FIG. The memory 14 refers to devices connected to the information system LAN 6 as “OEM devices having no communication function with the outside”, “OEM devices having communication function with the outside”, and “Non-OEM devices” (non-OEM devices). It is classified into three types, and the correspondence regarding the information transmission source and the handling method of the information according to the content of the information is stored. In this case, the OEM device has been installed in the vehicle from the stage of commercialization of the vehicle, has been approved by the vehicle manufacturer, and transmits information that may impair driving safety and security. It is a highly reliable device that cannot be achieved.

Here, "FREE" means an information system LAN
6 indicates that the information received from 6 is permitted to be transferred to the control system LAN 1 without requiring authentication. In addition, "PIN (Personal
Identification Number) "requires authentication by an authentication method called PIN for the information received from the information LAN 6 and transfers the received information to the control LAN 1 when the authentication result is positive. On the other hand, when the authentication result is negative, it is prohibited to transfer the received information to the control system LAN 1.

[PIN + MAC (Message Authen
"tication Code)" refers to an authentication method called a PIN and MAC for information received from the information system LAN 6.
When the authentication result is positive, the fact that the received information is transferred to the control system LAN1 is permitted, while the authentication result is negative. At a certain time, the received information is transmitted to the control system LAN
1 indicates that transfer to 1 is prohibited. further,
“NEVER” indicates that transfer of information received from the information system LAN 6 to the control system LAN 1 is unconditionally prohibited.

Next, the operation of the above configuration will be described with reference to FIG.
Also, description will be made with reference to FIG. In the following explanation,
It is assumed that information is transferred from the information LAN 6 to the control LAN 1 in the form of a packet. Well, CPU1
3 executes the control program (a computer program in the present invention) to perform the following processing.

That is, the CPU 13 uses the information system LAN 6
When a packet is received by the information system LANIF unit 12 from any of the devices connected to the device (“YES” in step S1), the information stored in the received packet corresponds to the source address. The part is extracted and decoded to acquire the information transmission source (step S2).

Next, the CPU 13 acquires the content of the information from the information stored in the received packet (step S3). Then, the CPU 13 refers to the correspondence table stored in the memory 14 (step S
4) Identify the sender of the acquired information and the handling method corresponding to the content of the information.

Here, the handling method of the CPU 13 is "FR
If it is "EE"("YE" in step S5)
S ”), the received packet is protocol-converted without authenticating the information stored in the packet received by the information system LANIF unit 12 (step S6). Then, the CPU 13 permits transmission of the protocol-converted packet to the control LAN 1 (step S7), and transmits the packet to the control LAN 1 (step S8). Specifically, referring to FIG. 2, it corresponds to a case where the information transmission source is, for example, “an OEM device having no communication function with the outside” and the information content is, for example, “engine ECU control”. .

In addition, the CPU 13 handles "PI
When it is N ”(“ YES ”in step S9),
The information stored in the packet received by the information system LANIF unit 12 is authenticated by an authentication method called PIN (step S10). Specifically, FIG.
The case where the information transmission source is, for example, “OEM device having a communication function with the outside” and the information content is, for example, “electronic meter control” corresponds to the above.

Next, the CPU 13 determines whether the authentication result is correct or not (step S11). When the authentication result is correct ("YES" in step S11), the packet received by the information system LANIF unit 12 is checked. Protocol conversion (step 6). Then, the CPU 13 permits transmission of the protocol-converted packet to the control LAN 1 (step S7), and transmits the packet to the control LAN 1 (step S8). On the other hand, CPU1
If the authentication result is NO, step 3
1 (“NO”), prohibiting that the packet received by the information LANIF unit 12 is transmitted to the control LAN 1 (step S12), and does not transmit the packet to the control LAN 1.

In addition, the handling method of the CPU 13 is "PIN
+ MAC ”(“ YE ”in step S13)
S ”), the information stored in the packet received by the information system LANIF unit 12 is subjected to double authentication by an authentication method called PIN and an authentication method called MAC (step S14). Specifically, referring to FIG. 2, it corresponds to a case where the information transmission source is, for example, a “non-OEM device” and the information content is, for example, a “door ECU control”.

Next, the CPU 13 determines whether the authentication result is correct or not (step S15), and when the authentication result is correct ("YES" in step S15), the packet received by the information system LANIF unit 12 is checked. Protocol conversion is performed (step S6). Then, the CPU 13
The transmission of the protocol-converted packet to the control LAN 1 is permitted (step S7), and the packet is transmitted to the control LAN 1 (step S8). On the other hand, CPU
If the authentication result is negative (13), (13)
If “NO” in 15), the fact that the packet received by the information system LANIF unit 12 is transmitted to the control system LAN1 is prohibited (step S12), and the packet is not transmitted to the control system LAN1.

Furthermore, the handling method of the CPU 13 is "NE
VER ”(“ N ”in step S13)
O ”), unconditionally prohibiting the packet received by the information system LANIF unit 12 from being transmitted to the control system LAN 1 (step S12), and does not transmit the packet to the control system LAN 1. Specifically, referring to FIG. 2, the information transmission source is, for example, a “non-OEM device”, and
This corresponds to the case where the information content is, for example, "engine ECU control".

In this way, the CPU 13 makes the information system L
When the packet is received from the AN 6, the source of the information and the content of the information are identified, and by referring to the correspondence table, it is determined whether or not the received packet is transmitted to the control system LAN 1.

Next, OSI (Open System Interconnect)
ion) reference model will be described with reference to FIG.
The control system LAN 1 is defined from the physical layer to the data link layer, while the information system LAN 6 is defined from the physical layer to the transport layer. However, there is no commonality between them, and in such circumstances Therefore, the vehicle-mounted gateway device 10 functions as an application gateway device that identifies the data (content of information) stored in the application layer.

Further, comparing the transfer rate of the control system LAN1 with the transfer rate of the information system LAN6, the control system LAN1
In general, the maximum transfer speed is about 1 Mbit / s, and the transfer speed of the information system LAN 6 is, for example, about 100 Mbit / s. In other words, the transfer speed of the information system LAN 6 is much higher than the transfer speed of the control system LAN 1. For this reason, even if the data stored in the application layer is identified as described above, the entire system However, the present invention focuses on this point.

According to this embodiment as described above,
In the in-vehicle gateway device 10, when information is received from the information system LAN 6, the sender of the received information and the content of the information are identified, and the information system LA is determined according to the identification result.
Determining whether or not authentication is required for the information received from N6, determining that authentication is required for that information, performing authentication for that information, and determining that authentication is not required for that information, or When it is determined that the authentication result is positive, the fact that the information is transmitted to the control system LAN1 is permitted. On the other hand, when it is determined that the authentication result is negative, the fact that the information is transmitted to the control system LAN1 is prohibited. With this configuration, it is possible to prevent the information LAN 6 from transferring to the control system LAN 1 information that may impair the safety and security of the driving, thereby ensuring the driving safety and Security can be properly secured.

The present invention is not limited to the above-mentioned embodiments, but can be modified or expanded as follows. The information transmission source is 3 as "OEM device without communication function with outside", "OEM device with communication function with outside" and "non-OEM device (non-OEM device)".
The configuration is not limited to the mode in which the classification is performed, and the configuration may be performed in another mode. The computer program executed by the vehicle-mounted gateway device may be downloaded from the outside as needed.

[Brief description of drawings]

FIG. 1 is a functional block diagram showing an embodiment of the present invention.

FIG. 2 is a diagram showing a correspondence table

FIG. 3 Flow chart

FIG. 4 is a diagram schematically showing an OSI reference model.

[Explanation of symbols]

In the drawing, 1 is a control system LAN, 6 is an information system LAN, 10 is an in-vehicle gateway device, 11 is a control system LANIF unit (information transmitting means), 12 is an information system LANIF unit (information receiving means), and 13 is a CPU (control). Means).

Claims (4)

[Claims] 1. An in-vehicle gateway apparatus comprising: an information receiving unit capable of receiving information from an information system LAN; and an information transmitting unit capable of transmitting the information received by the information receiving unit to a control system LAN. The source of the information received by the information receiving means and the content of the information are identified, and it is determined whether or not the information received by the information receiving means requires authentication according to the identification result, and the information When it is determined that authentication is required, the information is authenticated, and when it is determined that authentication is not required for the information, or when the authentication result is determined to be positive, the information is changed to the information described above. When the transmission means permits the transmission to the control system LAN, and when it is determined that the authentication result is negative, the information is transmitted from the information transmission means to the control system LAN. Vehicle gateway apparatus characterized by comprising a control means for inhibiting the effect to. 2. The in-vehicle gateway device according to claim 1, wherein the control unit discriminates and identifies the transmission source of the information as to whether it is an OEM device or not. 3. The vehicle-mounted gateway device according to claim 2, wherein the control unit discriminates and identifies the information transmission source based on whether or not the device has a communication function with the outside. Gateway device. 4. A procedure for causing an in-vehicle gateway device to identify a source of information received from an information system LAN and the content of the information, and authentication is required for the information received from the information system LAN according to the identification result. If it is determined that authentication is required for the information, and if it is determined that authentication is not required for the information,
Or when it is determined that the authentication result is positive,
To execute a procedure for permitting the information to be transmitted to the control LAN and a procedure for prohibiting the information from being transmitted to the control LAN when the authentication result is determined to be negative. Computer program.