JP2004193903A - Vehicle-mounted communication system and repeating device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a vehicle mounted communication system and a repeating device that detect unauthorized access to break the connection of a communication pathway and enable another communication pathway to be secured instead. <P>SOLUTION: A communication header of received packets is verified based on an access pattern DB (S4). It is judged whether the unauthorized access has been detected or not (S5). When it is judged that the unauthorized access has been detected, the vehicle mounted communication system of a transmission source of the packets is discriminated (S6). Then, control signals for breaking the connection of the vehicle mounted communication system are sent (S7). Further, a route control table is renewed as well as sending the control signals to secure the communication pathway going through another vehicle mounted communication system (S8). <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an in-vehicle communication system and a relay device that can detect an unauthorized access from the outside and disconnect the communication path, and can secure another communication path.
[0002]
[Prior art]
2. Description of the Related Art In recent years, a system for processing various information by mounting various information devices on a vehicle has become widespread. For example, a radio receiver not only receives a broadcast wave of a radio broadcast and reproduces audio information but also displays traffic information included in the broadcast wave as character information. As a so-called car audio device, a device for reproducing an audio recording medium such as a compact disk (CD) and a mini disk (MD) is mounted. In addition, based on position information obtained from a GPS (Global Positioning System) and running state information obtained from a vehicle speed sensor and the like, navigation image data such as a road map near the current position and a route to a destination are generated. Display navigation systems are also commonly equipped. In addition to such information devices, mobile phones, television systems, and the like have been widely mounted (for example, see Patent Document 1).
[0003]
Also, an in-vehicle communication system that can connect to an external communication network such as the Internet using an in-vehicle communication device such as a mobile phone and acquire various contents such as music data and video data has been proposed. Content such as data and video data can be reproduced by the information device described above.
[0004]
[Patent Document 1]
JP-A-11-168481
[0005]
[Problems to be solved by the invention]
As described above, in a state where the information device in the vehicle (hereinafter referred to as the vehicle-mounted device) and the communication device outside the vehicle are connected by communication, an unauthorized access is made to the vehicle-mounted device from the communication device outside the vehicle, and the information is stored in the vehicle-mounted device. Personal information may leak to the outside, and communication may be disabled.
Therefore, as security measures for in-vehicle communication systems, for example, in-vehicle communication that detects the presence or absence of unauthorized access from outside the vehicle and controls the power of the in-vehicle device to disable access to the in-vehicle device when the unauthorized access is detected A system has been proposed.
[0006]
However, in the above-mentioned in-vehicle communication system, a power control function is required in addition to the function of detecting unauthorized access, and it is necessary to connect the power supply of each in-vehicle unit to a device having the power control function. There is a problem that the configuration is complicated.
[0007]
Further, when power supply control of a mobile phone or the like is performed to prevent unauthorized access, there is a problem that there is no communication path to the outside when unauthorized access is detected.
[0008]
The present invention has been made in view of such circumstances, and a plurality of in-vehicle communication devices and information devices are connected via a relay device, and the relay device has connection request information from outside the vehicle via the in-vehicle communication device. Is received, whether connection with the information device is possible or not is determined based on the connection request information, and if it is determined that the connection is not possible, by disconnecting the connection between the in-vehicle communication device and the outside-vehicle communication device, It is an object of the present invention to provide an in-vehicle communication system and a relay device that can prevent unauthorized access and increase security.
[0009]
Another object of the present invention is to set a communication path via an in-vehicle communication device different from the transmission source of the connection request information when the connection with the information device is determined to be impossible in the relay device, It is an object of the present invention to provide an in-vehicle communication system and a relay device that can prevent unauthorized access and enhance security, and can secure another communication path even when an unauthorized access is detected.
[0010]
Still another object of the present invention is to provide a storage device for storing a plurality of pieces of information relating to a connection procedure, and determining whether or not the received connection request information follows one connection procedure stored in the storage means. It is an object of the present invention to provide an in-vehicle communication system and a relay device that can prevent unauthorized access and increase security by adopting a configuration that determines whether connection to a vehicle is possible.
[0011]
Still another object of the present invention is to provide a configuration in which an in-vehicle communication device and an information device are connected to a relay device via a communication network based on the same bus standard, so that the same communication line as a communication network for connecting information devices in a vehicle is provided. It is an object of the present invention to provide an in-vehicle communication system that can be used, can prevent unauthorized access, and can enhance security.
[0012]
Still another object of the present invention is to connect a plurality of in-vehicle communication devices with a single communication interface by connecting the in-vehicle communication device and the relay device using a virtual communication network. Another object of the present invention is to provide an in-vehicle communication system capable of preventing unauthorized access and enhancing security.
[0013]
[Means for Solving the Problems]
A vehicle-mounted communication system according to a first aspect of the present invention connects a plurality of vehicle-mounted communication devices and information devices via a relay device, and the information device communicates with an external communication device via the relay device and the vehicle-mounted communication device. In the in-vehicle communication system enabled, the in-vehicle communication device receives a request for connection to the information device transmitted from the external communication device, and transmits the received connection request information to the relay device. The relay device, a means for receiving connection request information transmitted from the in-vehicle communication device, based on the received connection request information, a determination unit for determining whether to connect to the information device, When the determination unit determines that connection is not possible, a unit that transmits information to the effect that communication with the external communication device should be disconnected to the in-vehicle communication device that is the transmission source of the connection request information, If serial-vehicle communication device receives the information, characterized in that are no in order to disconnect the communication with the exterior communication device.
[0014]
According to the first invention, when a plurality of in-vehicle communication devices and information devices are connected via a relay device, and connection ball information from outside the vehicle is input to the relay device through the in-vehicle communication device, the relay device Determines whether or not to connect to the information device, and when it is determined that the connection should not be made, the communication with the outside of the vehicle by the in-vehicle communication device is disconnected. Therefore, when an unauthorized access is detected based on the input connection request information, the information device connected to the relay device is disconnected in order to disconnect the connection of the vehicle-mounted communication device serving as a communication path when the unauthorized access is detected. Unauthorized access to the server can be prevented, and a state in which communication cannot be performed due to the unauthorized access can be avoided.
[0015]
The in-vehicle communication system according to a second invention is the in-vehicle communication system according to the first invention, wherein the in-vehicle communication device different from the transmission source of the connection request information is provided when the determination unit determines that connection with the information device is not possible. It is characterized by further comprising means for setting a communication route to be passed.
[0016]
According to the second aspect, when the relay device determines that connection to the information device is not possible in response to a connection request from the outside, a communication path is set via an in-vehicle communication device different from the transmission source of the connection request information. Like that. Therefore, when an unauthorized access is detected, the connection of the in-vehicle communication device serving as a communication path is disconnected, and the communication path is switched to a communication path that does not pass through the in-vehicle communication apparatus, thereby making it impossible to perform communication due to a high load on the relay device and the communication path. The state is avoided, and the information device connected to the relay device can communicate with the external communication device without being aware of the interruption of the communication path.
[0017]
The in-vehicle communication system according to a third invention is the in-vehicle communication system according to the first invention or the second invention, wherein the relay device further includes storage means for storing a plurality of pieces of information on a connection procedure, The connection request information received via the communication device determines whether or not to follow one connection procedure stored in the storage means, thereby determining whether or not connection to the information device is possible. Features.
[0018]
According to the third aspect of the invention, it is determined whether or not connection to the information device is possible by determining whether or not the connection request information received from the outside follows a connection procedure stored in advance. Therefore, for example, a connection procedure relating to unauthorized access such as a denial of service attack (DoS attack, DoS: Denial of Service) and a port scan attack is stored in advance, and when a connection request is issued from a communication device outside the vehicle, the connection request is used. By determining whether or not the connection procedure follows a previously stored connection procedure, it is possible to determine whether or not the access is unauthorized. Further, by updating the content to be stored as needed, it is possible to cope with a new unauthorized access.
[0019]
In the in-vehicle communication system according to the fourth invention, in the in-vehicle communication system according to any of the first to third inventions, the in-vehicle communication device and the information device are connected to each other via the communication network based on the same bus standard. It is characterized by being connected to a device.
[0020]
According to the fourth aspect of the invention, by connecting the in-vehicle communication device and the information device to the relay device using a bus standard such as IEEE 1394, it becomes possible to use a common cable and reduce the number of lines. it can.
[0021]
A vehicle-mounted communication system according to a fifth invention is the vehicle-mounted communication system according to the fourth invention, wherein the communication network is a virtual communication network.
[0022]
In the fifth invention, a plurality of in-vehicle communication devices can be connected to one communication interface by using a so-called VLAN (Virtual Local Area Network).
[0023]
A relay device according to a sixth aspect of the present invention is a relay device connected to both a plurality of in-vehicle communication devices connected to an out-of-vehicle communication device and an information device communicable with the out-of-vehicle communication device via the in-vehicle communication device. A device for receiving, via the in-vehicle communication device, connection request information for the information device transmitted from the external communication device, and determining whether connection to the information device is possible based on the received connection request information Determining means, and means for transmitting, to the in-vehicle communication device which is a source of the connection request information, information indicating that communication with the external communication device should be cut off when the determining device determines that connection is impossible. It is characterized by.
[0024]
According to the sixth aspect of the present invention, when a plurality of in-vehicle communication devices and information devices are connected via a relay device, and connection ball information from outside the vehicle is input to the relay device through the in-vehicle communication device, the relay device Determines whether or not to connect to the information device, and when it is determined that the connection should not be made, the communication with the outside of the vehicle by the in-vehicle communication device is disconnected. Therefore, when an unauthorized access is detected based on the input connection request information, the information device connected to the relay device is disconnected in order to disconnect the connection of the vehicle-mounted communication device serving as a communication path when the unauthorized access is detected. Unauthorized access to the server can be prevented, and a state in which communication cannot be performed due to the unauthorized access can be avoided.
[0025]
The relay device according to a seventh aspect of the present invention is the relay device according to the sixth aspect, wherein, when the determination unit determines that connection with the information device is not possible, the relay device passes through a vehicle-mounted communication device different from the transmission source of the connection request information. It is characterized by further comprising means for setting a communication path.
[0026]
In the seventh invention, when the relay device determines that connection to the information device is not possible in response to a connection request from the outside, a communication path is set via a vehicle-mounted communication device different from the transmission source of the connection request information. Like that. Therefore, when an unauthorized access is detected, the connection of the in-vehicle communication device serving as a communication path is disconnected, and the communication path is switched to a communication path that does not pass through the in-vehicle communication apparatus, thereby making it impossible to perform communication due to a high load on the relay device and the communication path. The state is avoided, and the information device connected to the relay device can communicate with the external communication device without being aware of the interruption of the communication path.
[0027]
The relay device according to an eighth aspect of the present invention is the relay device according to the sixth or seventh aspect, further comprising a storage unit configured to store a plurality of pieces of information relating to a connection procedure, wherein the determination unit receives the information via a vehicle-mounted communication device. It is characterized in that it is determined whether or not connection to the information device is possible by determining whether or not the connection request information follows one connection procedure stored in the storage means.
[0028]
In the eighth invention, it is determined whether or not connection to the information device is possible by determining whether or not the connection request information received from the outside follows a connection procedure stored in advance. Therefore, for example, a connection procedure relating to unauthorized access such as a denial of service attack, a port scan attack or the like is stored in advance, and when a connection request is received from an external communication device, the connection procedure according to the connection request follows the stored connection procedure. By determining whether or not the access is unauthorized, it is possible to determine whether or not the access is unauthorized. Also, by updating the stored contents as needed, it is possible to deal with new unauthorized access.
[0029]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, the present invention will be specifically described with reference to the drawings showing the embodiments.
Embodiment 1 FIG.
FIG. 1 is a schematic configuration diagram of a vehicle-mounted communication system according to the present embodiment. In the figure, C denotes a vehicle such as an automobile. The vehicle C includes an audio device 16 for reproducing audio information recorded on a music recording medium such as a compact disk and a mini disk, a drive recorder 17 for recording a running history, a navigation system. Device 18 for generating video data for use, and a monitor device 19 for displaying video data and the like generated by the navigation device 18. These in-vehicle devices are connected to the gateway device 10 via the in-vehicle LAN 15. . As the in-vehicle LAN 15, a standard based on IEEE 1394, MOST (Media Oriented Systems Transport) or the like can be used.
An in-vehicle communication device such as a mobile phone 11, a DSRC device 12, and a wireless communication device 13 is connected to the gateway device 10, and the gateway device 10 can be connected to a communication network N outside the vehicle such as the Internet using the in-vehicle communication device. Like that. In addition, as an interface for connecting each in-vehicle communication device to the gateway device 10, IEEE1394, USB (Universal Serial Bus), or the like can be used.
[0030]
Various information transmitted from the communication network N outside the vehicle is received by the vehicle-mounted communication device, relayed by the gateway device 10, and transmitted to the vehicle-mounted device connected to the vehicle-mounted LAN 15. Further, when connecting from the vehicle-mounted device connected to the vehicle-mounted LAN 15 to the communication network N outside the vehicle, the gateway device 10 can dynamically select and route the optimal communication route.
The gateway device 10 according to the present embodiment has a function of detecting an unauthorized access from outside the vehicle and a function of managing a connection to the in-vehicle communication device, in addition to a dynamic path control function for the in-vehicle communication device.
[0031]
The gateway device 10 previously stores an access pattern relating to an unauthorized access such as a DoS attack or a port scan attack in a storage unit (see FIG. 2) provided therein, and detects an access request according to the access pattern as an unauthorized access.
When an unauthorized access from outside the vehicle is detected, the gateway device 10 specifies an entry route of the unauthorized access. When the gateway device 10 specifies the entry route of the unauthorized access from the mobile phone 11, the DSRC device 12, or the wireless communication device 13, the connection of the corresponding in-vehicle communication device is disconnected, and the gateway device 10 and the in-vehicle device are disconnected from the entry route. Access to the vessel.
By performing such processing, it is possible to prevent the load on the gateway device 10 and the in-vehicle LAN 15 from increasing and affecting other communications. In addition, since the gateway device 10 automatically switches the path to another external communication device by the dynamic path control function, it is possible to prevent the influence from being exerted when connecting from the vehicle-mounted device to the external communication network N. .
[0032]
FIG. 2 is a block diagram showing the internal configuration of the gateway device 10. The gateway device 10 includes a microcomputer 101 having an MPU, and a storage unit 102 such as a flash memory and a relay LSI 103 are connected to the microcomputer 101.
[0033]
The relay LSI 103 is connected to a communication interface LSI 104 on the in-vehicle LAN 15 side and a communication interface LSI 106 on the in-vehicle communication device side. That is, the in-vehicle LAN 15 is connected to the communication interface LSI 104 via the connector 105, and receives information from various on-vehicle devices connected to the in-vehicle LAN 15, sends out the information to the relay LSI 103, and inputs the information via the relay LSI 103. Sends information from outside the vehicle to the vehicle-mounted device.
At this time, the communication interface LSI 104 mainly performs processing of the physical layer and the data link layer. The relay LSI 103 checks the communication header of the network layer and the transport layer of the data to be relayed, and performs the data transfer processing and the IP address and port number replacement processing in the header.
[0034]
The communication interface LSI 106 is connected with the mobile phone 11, the DSRC device 12, and the wireless communication device 13 via connectors 107a, 107b, and 107c, respectively. The information to be transmitted to the outside of the vehicle input through the LSI 103 is transmitted to the mobile phone 11, the DSRC device 12, or the wireless communication device 13. The destination of the data follows the routing process executed by the relay LSI 103 according to the routing control table 102a created by the microcomputer 101. The communication interface LSI 106 mainly performs the processing of the physical layer and the data link layer as described above.
Note that the communication interface LSIs 104 and 106 may be provided separately as LSIs for processing the physical layer and processing for the data link layer, or may be provided integrally.
[0035]
Various control programs for performing communication control are stored in the storage unit 102, and the microcomputer 101 functions as the gateway device 10 by executing the control programs. The storage unit 102 includes a path control table 102a in which an IP address of a communication destination is stored according to a communication status of the vehicle-mounted communication device, and an access pattern database (hereinafter, referred to as an access pattern) storing an access pattern related to an unauthorized access. DBb) 102b, and a read process and a write process are appropriately performed according to an instruction from the microcomputer 101. Further, the storage unit 102 temporarily stores data generated during the arithmetic processing of the microcomputer 101, data transmitted and received through the communication interface LSIs 104 and 106, and the like.
It is desirable that the contents of the access pattern DB 102b be periodically updated via the communication network N outside the vehicle.
[0036]
The gateway device 10 verifies unauthorized access based on the received packet from outside the vehicle. Verification of unauthorized access is performed by comparing a communication header of a packet received from the outside of the vehicle received by the gateway device 10 and an access pattern to each port with the contents of the access pattern DB. Specifically, (1) whether the protocol conforms to the specification of the protocol used for access, (2) the content of the command and URL used in the protocol, and whether the length of the data is appropriate, (3) ) Unauthorized from the viewpoint of whether a predetermined access condition (for example, a combination of a source address, a destination address, a port number, etc.) is met, or (4) the number of accesses per unit time is within an allowable range. Determine whether or not access.
[0037]
It can be verified based on the communication header of the received packet whether (1) it conforms to the protocol specification and (2) whether the command used in the protocol is appropriate. Hereinafter, the HTTP protocol used in the Internet network will be described as an example.
FIG. 3 is a conceptual diagram of a packet used in the HTTP protocol. Under the use of the HTTP protocol, verification is performed in the order of an IP header, a TCP header, an HTTP header, and HTTP data. The contents of the verification include whether or not each field of the IP header in the packet falls within a correct range, whether or not the value of the entire length of the IP packet and the value of the IP header length of the IP header are consistent. In the case of violation, it is determined that there is a possibility of unauthorized access. The verification of the TCP header is the same as the verification of the IP header.
Then, it verifies whether the format of each field of the HTTP header is described as specified, or whether the format of HTTP data is described as specified.
[0038]
Regarding whether (3) a predetermined access condition is met or (4) whether the number of accesses per unit time is within an allowable range, the access pattern to each port is determined based on the contents stored in the access pattern DB 102b. Verify by comparison.
For example, the above-mentioned DoS attack is an attack in which a large amount of packets are transmitted from an intruder's computer to an attack target in a short time, and system resources of an information device to be attacked are brought down. Therefore, by extracting the destination port and the source port from the communication header of the received packet and verifying whether or not the amount of packets from one source to one destination exceeds an allowable range, unauthorized access can be performed. Can be detected.
[0039]
FIG. 4 is a flowchart illustrating a communication procedure using the in-vehicle communication system according to the present embodiment. When the in-vehicle communication device (for example, the mobile phone 11) receives a packet from a communication device outside the vehicle (step S1), the received packet is transmitted to the gateway device 10 (step S2).
[0040]
When the gateway device 10 receives the packet transmitted from the in-vehicle communication device (step S3), the microcomputer 101 of the gateway device 10 verifies the packet based on the received access pattern DB 102b (step S4). Specifically, as described above, (1) whether the protocol conforms to the specification of the protocol used for access, (2) the content of the command, the URL, etc., and the data length used in the protocol are appropriate. The packet is verified from the viewpoint of (3) whether a predetermined access condition is met or (4) the number of accesses per unit time is within an allowable range.
[0041]
Next, the microcomputer 101 determines whether or not an unauthorized access has been detected (step S5). If the unauthorized access has been detected (S5: YES), the microcomputer 101 checks the communication header of the received packet to determine whether the packet has been transmitted to the vehicle. The communication device is identified (step S6).
Then, the microcomputer 101 transmits a control signal to the in-vehicle communication device (mobile phone 11) identified in step S6 to request disconnection of communication with the external communication device (step S7). Further, the microcomputer 101 updates the route control table 102a included in the storage unit 102 (step S8), and switches to a communication route via the DSRC device 12 or the wireless communication device 13, which is another in-vehicle communication device.
[0042]
When the in-vehicle communication device (mobile phone 11) receives the control signal of the disconnection request (step S9), the in-vehicle communication device disconnects the connection with the out-of-vehicle communication device (step S10).
[0043]
In the present embodiment, the recovery process after the illegal access is detected and the communication path is disconnected is not described. However, if the reconnection is attempted after a predetermined time and no unauthorized access is detected, the connection to the in-vehicle LAN 15 is established. It may be provided.
[0044]
Further, in the present embodiment, the connection between the in-vehicle communication device and the communication network N is cut off when the unauthorized access is detected. However, when the unauthorized access is detected, the unauthorized access to the Internet provider, the roadside communication device, etc. is performed. May be notified.
[0045]
Embodiment 2 FIG.
The gateway device 10 described in the first embodiment includes the connectors 107a to 107c, assigns individual addresses to the connectors 107a to 107, and connects the mobile phone 11, the DSRC device 12, and the wireless communication device 13 to the connectors 107a to 107c. 107c. This is because, when the same address is assigned to the in-vehicle communication device of the gateway device 10, even if the connection of a certain in-vehicle communication device is disconnected, it can be accessed from another in-vehicle communication device. To 107c.
However, when a so-called virtual LAN function is used, a plurality of virtual LANs can be connected to one physical interface. In the present embodiment, an in-vehicle communication system using a virtual LAN will be described.
[0046]
FIG. 5 is a schematic configuration diagram of the in-vehicle communication system according to the present embodiment. As in the first embodiment, onboard devices such as an audio device 16, a drive recorder 17, a navigation device 18, and a monitor device 19 are connected to a gateway device 20 via an onboard LAN 15 conforming to standards such as IEEE1394 and MOST. I have.
An in-vehicle communication device such as a mobile phone 11, a DSRC device 12, and a wireless communication device 13 is connected to the gateway device 20, and the gateway device 20 can be connected to a communication network N outside the vehicle such as the Internet using the in-vehicle communication device. Like that. In this embodiment, one interface connecting each in-vehicle communication device to the gateway device 20 has three virtual LANs, and each of the virtual LANs includes the mobile phone 11, the DSRC device 12, and the wireless communication device 13, respectively. Connected.
[0047]
Various information transmitted from the communication network N outside the vehicle is received by the on-vehicle communication device, relayed by the gateway device 20, and transmitted to the on-vehicle device connected to the on-vehicle LAN 15. Further, when connecting from the vehicle-mounted device connected to the vehicle-mounted LAN 15 to the communication network N outside the vehicle, the gateway device 20 can dynamically select and route an optimal communication path.
The gateway device 20 according to the present embodiment has a function of detecting unauthorized access from outside the vehicle, as well as a function of controlling a dynamic route for the on-vehicle communication device, and a connection to the on-vehicle communication device, as described in the first embodiment. Has the function of managing
[0048]
FIG. 6 is a block diagram showing the internal configuration of the gateway device 20. The gateway device 20 includes a microcomputer 201 having an MPU, and a storage unit 202 such as a flash memory and a relay LSI 203 are connected to the microcomputer 201.
[0049]
The relay LSI 203 is connected to a communication interface LSI 204 on the vehicle-mounted LAN 15 side and a communication interface LSI 206 on the vehicle-mounted communication device side. The in-vehicle LAN 15 is connected to the communication interface LSI 204 via a connector 205. The in-vehicle LAN 15 receives information from various on-vehicle devices connected to the in-vehicle LAN 15 and sends the information to the relay LSI 203. Is transmitted to the vehicle-mounted device side.
At this time, the communication interface LSI 204 mainly performs processing of the physical layer and the data link layer. Further, the relay LSI 203 checks the communication header of the network layer and the transport layer of the data to be relayed, and performs data transfer processing and IP address and port number replacement processing in the header.
[0050]
On the other hand, the mobile phone 11, the DSRC device 12, and the wireless communication device 13 are connected to the communication interface LSI 206 via the connector 207. Three different addresses are assigned to the connector 207 to form a virtual LAN, and an in-vehicle communication device is connected to each virtual LAN. For example, the connector 207 has three addresses “190.0.0. *”, “190.0.1. *”, And “190.0.2. *”, And the mobile phone 11 has “190.0. .0.1 "," 190.0.2.1 "for the DSRC device 12, and" 190.0.2.1 "for the wireless communication device 13 to form three virtual LANs.
The information to be transmitted to the outside of the vehicle, which is input through the relay LSI 203, is transmitted to the mobile phone 11, the DSRC device 12, or the wireless communication device 13. The destination of the data follows the routing process executed by the relay LSI 203 according to the route control table 202a created by the microcomputer 201. The communication interface LSI 206 mainly performs the processing of the physical layer and the data link layer as described above.
[0051]
The storage unit 202 stores various control programs for performing communication control, and functions as the gateway device 20 when the microcomputer 201 executes the control programs. The storage unit 202 includes a route control table 202a in which an IP address of a communication destination and the like are stored in accordance with a communication state of the vehicle-mounted communication device, and an access pattern DB 202b in which an access pattern related to unauthorized access is stored. The reading process and the writing process are appropriately performed according to an instruction from the microcomputer 201. The storage unit 202 temporarily stores data generated during the arithmetic processing of the microcomputer 201, data transmitted and received through the communication interface LSIs 204 and 206, and the like.
[0052]
A packet input to the relay LSI 203 via the communication interface LSI 206 is at a network layer level, and the routing process is basically performed by the relay LSI 203. Upper-layer processing by the transport layer, such as detection of unauthorized access, dynamic path control according to the status of the in-vehicle communication device, and connection control based on the result of unauthorized access detection, is performed by the microcomputer 201.
The processing performed by the microcomputer 201 is the same as that of the first embodiment. For example, upon detection of unauthorized access, (1) whether the protocol conforms to the specification of the protocol used for access, and (2) the protocol used in the protocol Command, URL, etc., and data length are appropriate; (3) a predetermined access condition is met; and (4) the number of accesses per unit time is within an allowable range. Verify the packet from a point of view.
[0053]
【The invention's effect】
As described above in detail, in the case of the first invention and the sixth invention, a plurality of in-vehicle communication devices and information devices are connected via the relay device, and the connection essential ball information from outside the vehicle through the in-vehicle communication device. Is input to the relay device, the relay device determines whether or not to connect to the information device, and when it is determined that the connection should not be made, disconnects the communication with the outside of the vehicle by the vehicle-mounted communication device. . Therefore, when an unauthorized access is detected based on the input connection request information, the information device connected to the relay device is disconnected in order to disconnect the connection of the vehicle-mounted communication device serving as a communication path when the unauthorized access is detected. It is possible to prevent unauthorized access to the server and to avoid a state in which communication is disabled due to the unauthorized access.
[0054]
According to the second and seventh inventions, when the relay device determines that connection to the information device is not possible in response to a connection request from the outside, the communication path via the on-vehicle communication device different from the transmission source of the connection request information Is set. Therefore, when an unauthorized access is detected, the connection of the in-vehicle communication device serving as a communication path is disconnected, and the communication path is switched to a communication path that does not pass through the in-vehicle communication apparatus, thereby making it impossible to perform communication due to a high load on the relay device and the communication path. The state is avoided, and the information device connected to the relay device can communicate with the external communication device without being aware of the interruption of the communication path.
[0055]
According to the third and eighth aspects, the connection request information received from the outside determines whether or not connection to the information device is possible by determining whether or not the connection request information follows a connection procedure stored in advance. . Therefore, for example, a connection procedure relating to unauthorized access such as a denial of service attack, a port scan attack or the like is stored in advance, and when a connection request is received from an external communication device, the connection procedure according to the connection request follows the stored connection procedure. By determining whether or not the access is unauthorized, it is possible to determine whether or not the access is unauthorized. Further, by updating the content to be stored as needed, it is possible to cope with a new unauthorized access.
[0056]
In the case of the fourth aspect, by connecting the in-vehicle communication device and the information device to the relay device using a bus standard such as IEEE 1394, it becomes possible to use a common cable and to reduce the number of lines. .
[0057]
In the case of the fifth invention, the present invention has excellent effects, for example, by using a so-called VLAN, a plurality of in-vehicle communication devices can be connected to one communication interface.
[Brief description of the drawings]
FIG. 1 is a schematic configuration diagram of a vehicle-mounted communication system according to the present embodiment.
FIG. 2 is a block diagram showing an internal configuration of a gateway device.
FIG. 3 is a conceptual diagram of a packet used in the HTTP protocol.
FIG. 4 is a flowchart illustrating a communication procedure using the in-vehicle communication system according to the present embodiment.
FIG. 5 is a schematic configuration diagram of an in-vehicle communication system according to the present embodiment.
FIG. 6 is a block diagram showing an internal configuration of the gateway device.
[Explanation of symbols]
10 Gateway device
11 Mobile phone
12 DSRC device
13 Wireless communication device
15 In-vehicle LAN
16 Audio equipment
17 Drive Recorder
18 Navigation device
19 Monitor device
101 microcomputer
102 storage unit
102a routing control table
102b Access pattern database
103 Relay LSI
104,106 Communication interface LSI
105, 107a, 107b, 107c Connector
C vehicle
N communication network

Claims (8)

A plurality of in-vehicle communication devices and an information device are connected via a relay device, and the information device is in an in-vehicle communication system capable of communicating with an external communication device via the relay device and the in-vehicle communication device.
The in-vehicle communication device includes a unit that receives connection request information for the information device transmitted from the external communication device, and a unit that transmits the received connection request information to the relay device. Means for receiving connection request information transmitted from the in-vehicle communication device, determination means for determining whether or not connection to the information device is possible based on the received connection request information, and when the determination means determines that connection is not possible Means for transmitting information to the effect that communication with the out-of-vehicle communication device should be disconnected to the in-vehicle communication device that is the source of the connection request information, wherein the in-vehicle communication device receives the information when the in-vehicle communication device receives the information. An in-vehicle communication system for disconnecting communication with a device. The apparatus according to claim 1, further comprising: a unit that sets a communication path via an in-vehicle communication device different from a transmission source of the connection request information when the determination unit determines that connection with the information device is not possible. The in-vehicle communication system according to claim 1. The relay device further includes a storage unit configured to store a plurality of pieces of information relating to a connection procedure, and the determination unit determines that the connection request information received via the in-vehicle communication device follows one connection procedure stored in the storage unit. The in-vehicle communication system according to claim 1, wherein whether or not connection to the information device is determined is determined by determining whether or not the information device is connected. The in-vehicle communication system according to any one of claims 1 to 3, wherein the on-vehicle communication device and the information device are connected to the relay device via a communication network based on the same bus standard. The in-vehicle communication system according to claim 4, wherein the communication network is a virtual communication network. A plurality of in-vehicle communication devices connected to the out-of-vehicle communication device, and a relay device connected to both information devices that are capable of communicating with the out-of-vehicle communication device through the in-vehicle communication device,
Means for receiving, via the in-vehicle communication device, connection request information for the information device transmitted from the external communication device; anddetermining means for determining whether connection to the information device is possible based on the received connection request information. Means for transmitting information to the effect that communication with the external communication device should be disconnected to the in-vehicle communication device of the transmission source of the connection request information, when the determination unit determines that connection is not possible. Relay device. 7. The apparatus according to claim 6, further comprising: a unit that sets a communication path via an in-vehicle communication device different from a transmission source of the connection request information when the determination unit determines that connection to the information device is not possible. The relay device as described in the above. A storage unit that stores a plurality of pieces of information relating to a connection procedure, wherein the determination unit determines whether the connection request information received via the on-vehicle communication device complies with one connection procedure stored in the storage unit. 8. The relay device according to claim 6, wherein the relay device determines whether connection to the information device is possible or not.

Images