JP7354180B2 - In-vehicle relay device - Google Patents

Description

The present invention relates to a device that is mounted on a vehicle and relays communication between the outside of the vehicle and the internal in-vehicle network.

Recent vehicles have been equipped with connected functions that allow communication between the outside of the vehicle and an internal in-vehicle network such as a CAN (Controller Area Network).

Vehicles equipped with connected functions may be subject to external attacks on the in-vehicle network. A plurality of ECUs (Electronic Control Units) are connected to the in-vehicle network, and each ECU controls various parts such as the engine and brakes. Therefore, if the in-vehicle network is attacked from outside and the software and control data of the ECU are tampered with, each part of the vehicle may malfunction.

Therefore, such vehicles are equipped with a gateway ECU (Electronic Control Unit) that relays communication between the outside of the vehicle and the in-vehicle network, and the gateway ECU detects attacks from the outside and protects the in-vehicle network. Contains functions to.

JP 2016-116075 Publication

However, with the development of autonomous driving technology, attacks on in-vehicle networks have become a serious problem, and strengthening security measures has become an important issue.

An object of the present invention is to provide a vehicle-mounted relay device that can strengthen security measures.

In order to achieve the above object, the in-vehicle relay device according to the present invention is an in-vehicle relay device that is installed in a vehicle and relays communication between the outside of the vehicle and the internal in-vehicle network, and is detachable from the in-vehicle network. a first device that is provided outside the vehicle and communicates with the outside of the vehicle; and a second device that is provided separately from the outside of the vehicle and is communicatively connected to the first device and communicably connected to the in-vehicle network. The first device has an attack detection function that detects an attack on the in-vehicle network, the second device has an attack determination function that determines whether the first device has been attacked, and the second device has an attack determination function that determines whether the first device has been attacked. If it is determined that the first device has been attacked, a predetermined response is taken.

According to this configuration, the in-vehicle relay device includes the first device and the second device. The first device is separated from the in-vehicle network inside the vehicle, and communication with the outside of the vehicle is performed by the first device. On the other hand, the second device is provided separately from the outside of the vehicle and is communicably connected to the in-vehicle network. The first device has an attack detection function that detects an attack on the in-vehicle network, and the second device has an attack determination function that determines whether the first device has been attacked. Further, in the second device, when the attack determination function determines that the first device has been attacked, a predetermined response is taken.

With this, as a countermeasure against attacks on the in-vehicle network from outside the vehicle, the attack detection function of the first device is used as the first layer of defense, and the attack detection function of the second device is used as the second layer of defense. Defenses are built. By building this multi-layered defense, security measures can be strengthened.

The predetermined response may be, for example, discarding the message received from the first device.

As a result, even if the first device that is attacked from the outside sends a fraudulent message to the second device, the fraudulent message will be discarded, making it possible to prevent the in-vehicle network from being attacked by fraudulent messages. , communication via the in-vehicle network can continue.

The in-vehicle relay device further includes a storage device, and the storage device stores a whitelist in which IDs (Identifiers) used for messages that can be communicated on the in-vehicle network are registered, and the first device is configured to register IDs (identifiers) used in messages that can be communicated on the in-vehicle network. When a message that does not use a registered ID is received from outside the vehicle, the attack detection function may detect the reception of the message as an attack.

The in-vehicle relay device further includes a storage device, and the first device stores information regarding the attack in the storage device in response to an attack being detected by the attack detection function, and stores information about the attack from an information management device external to the vehicle. Information stored in the storage device may be output according to the request.

Thereby, when the first device is attacked from the outside, information regarding the attack can be read to the information management device outside the vehicle. Therefore, by analyzing the information read into the information management device, it is possible to quickly identify the details of the attack on the first device, and to take countermeasures against the attack at an early stage.

The in-vehicle relay device further includes a storage device, the storage device stores software, and the first device has a tampering detection function that detects tampering with the software at startup, and the tampering detection function detects tampering. If not, it is preferable to start the software and, if the tampering detection function detects tampering with the software, stop the operation without starting the software.

This can prevent tampered software from starting. Therefore, it is possible to prevent unauthorized messages from being sent to the second device due to execution of tampered software.

If software tampering is detected and the first operation stops operating, messages will not be sent from the first device to the second device. The communication between the second device and the second device may be cut off.

As a result, even if the software of the first device is tampered with, the second device will not receive a fraudulent message from the first device, thereby preventing the in-vehicle network from being attacked by fraudulent messages.

When the attack determining means determines that the first device has been attacked, the second device transmits information that the first device has been attacked from a data communication device installed in the vehicle to a server external to the vehicle. The data communication device may be notified via the electronic control unit that the first device has been attacked, such that the first device is attacked.

This allows the server administrator or a user who can obtain information via the server to recognize the attack on the first device.

According to the present invention, security measures can be strengthened against attacks on the in-vehicle network.

1 is a diagram showing the configuration of an in-vehicle communication system 1 including an in-vehicle relay device (gateway ECU) according to an embodiment of the present invention. It is a flowchart which shows the flow of processing performed by the 1st CPU at the time of startup. 3 is a flowchart showing the flow of processing performed by the first CPU when receiving a message. 7 is a flowchart showing the flow of processing performed by the first CPU when the scan tool is connected. 12 is a flowchart showing the flow of processing performed by the second CPU after startup.

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

<In-vehicle communication system>
FIG. 1 is a diagram showing the configuration of an in-vehicle communication system 1 including a gateway ECU 3 according to an embodiment of the present invention.

The in-vehicle communication system 1 is a system for connected functions that is installed in a vehicle such as an automobile and enables communication between the outside of the vehicle and the in-vehicle network 2 inside the vehicle. The in-vehicle communication system 1 includes an in-vehicle network 2, a gateway ECU (Electronic Control Unit) 3, a TCU (Telematics Communication Unit) 4, and a DLC (Data Link Connector) 5.

The in-vehicle network 2 is, for example, a network that allows communication using a CAN (Controller Area Network) communication protocol. The in-vehicle network 2 is provided with a plurality of buses (transmission lines) 6, and each bus 6 is connected to a plurality of ECUs 7 for controlling each part of the vehicle. The ECU 7 includes a body ECU 7A that can operate even when the ignition switch of the vehicle is off, a meter ECU 7B that controls devices (for example, a multi-information display, etc.) disposed in the combination meter of the vehicle, and the like.

A TCU 4, an OBD 5, and each bus 6 are connected to the gateway ECU 3. The gateway ECU 3 has a function of relaying messages between the in-vehicle network 2 and the TCU 4 and between the in-vehicle network 2 and the OBD 5, and a function of relaying messages between each bus 6 of the in-vehicle network 2. Furthermore, the gateway ECU 3 has a security function that detects an attack on the in-vehicle network 2 from the outside and protects the in-vehicle network 2 from the attack.

The TCU 4 is a data communication device installed in the vehicle, and performs data communication with the server 8 of the service center using mobile wireless data communication etc. in order to provide various information and services to the user of the vehicle. . Services provided to users include, for example, remote services that remotely control the vehicle, such as turning on the air conditioner before getting into the vehicle. Note that in this embodiment, the TCU 4 is used as the data communication device, but instead of this, a mobile terminal such as a smartphone may be used.

The DLC 5 is a connector to which a scan tool 9 is connected in order to read failure codes and the like using OBD (On-Board Diagnostics).

<Gateway ECU>
The gateway ECU 3 includes a first CPU (Central Processing Unit) 11 and a second CPU 12. The first CPU 11 is connected to the TCU 4 and the DLC 5 and is provided separately from the in-vehicle network 2 . The second CPU 12 is separated from the TCU 4 and DLC 5 and is communicably connected to the in-vehicle network 2. Further, the first CPU 11 and the second CPU 12 are communicably connected via a communication line X.

The first CPU 11 and the second CPU 12 have built-in secure memories 13 and 14, respectively. The secure memories 13 and 14 are composed of rewritable nonvolatile memories such as flash memories and E2PROMs, for example. Furthermore, the gateway ECU 3 is equipped with an HSM (Hardware Security Module), and data such as program codes and parameter data stored in the secure memories 13 and 14 can be rewritten through secure authentication by the HSM function. can.

<1st CPU>
The first CPU 11 substantially includes an attack detection section 21, a transfer determination section 22, an attack information management section 23, and a software activation section 24 as function processing sections for security functions against external attacks. These functional processing units are realized in software through program processing, or in hardware such as logic circuits.

The attack detection unit 21 has a function as a firewall. That is, the attack detection unit 21 has an attack detection function that detects an attack on the in-vehicle network 2 from outside the vehicle, and a protection function that protects the in-vehicle network 2 and gateway ECU 3 from the attack.

The secure memory 13 stores a white list in which IDs (identifiers) used for messages that can be communicated via the in-vehicle network 2 are registered. When the first CPU 11 receives a message from the outside via the TCU 4 or OBD 5, the attack detection unit 21 checks whether an ID registered in the whitelist (hereinafter referred to as "registered ID") is used in the message. . Then, if the registered ID is used in the message, the attack detection unit 21 determines that the message is a legitimate message. In this case, a message is sent from the attack detection section 21 to the transfer determination section 22.

On the other hand, if the registered ID is not used in the message, the attack detection unit 21 detects the reception of the message as an attack on the in-vehicle network 2 from the outside. When the attack detection unit 21 detects an attack from the outside, it discards the message whose registered ID is not used as a fraudulent message, and notifies the forwarding determination unit 22 that the in-vehicle network 2 has been attacked from the outside. do.

When the transfer determination unit 22 receives a message from the attack detection unit 21, the transfer determination unit 22 transfers (relays) the message to the second CPU 12. On the other hand, when the transfer determination unit 22 receives a notification that an attack has been received from the attack detection unit 21 (hereinafter referred to as “attack notification”), the transfer determination unit 22 transfers the notification to the second CPU 12.

Additionally, when the attack detection unit 21 detects an attack on the in-vehicle network 2 from outside, the attack detection unit 21 sends the details of the attack (for example, information on the destination of the message) and the attack information to the attack information management unit 23. Attack information including the date and time of the attack is transmitted. When attack information management section 23 receives attack information from attack detection section 21 , attack information management section 23 stores the attack information in secure memory 13 . When the TCU 4 receives a request to send attack information from the server 8, the attack information management unit 23 reads the attack information from the secure memory 13 in accordance with the request, and sends the read attack information to the server 8 via the TCU 4. Send. Further, when a request to output attack information is input from the scan tool 9 connected to the DLC 5 to the first CPU 11, the attack information management unit 23 reads the attack information from the secure memory 13 in accordance with the request, and stores the read attack information. Output the information to the scan tool 9.

The software activation unit 24 detects that the ignition switch of the vehicle is turned on or that each ECU of the vehicle performs a dominant wake-up, and activates the software stored in the secure memory 13. The software startup unit 24 has a software tampering detection function, and in order to detect software tampering when starting the software, it detects the digital signature given to the software and the signature information (hash) stored in the secure memory 13. value, sum value, etc.). As a result of the confirmation, if no tampering with the software is detected, the software activation unit 24 activates the software. If software tampering is detected, the software activation unit 24 does not activate the software. If software tampering is detected, the first CPU 11 stops operating.

<Second CPU>
The second CPU 12 substantially includes an attack determination section 31, a transfer determination section 32, an attack notification section 33, and a software activation section 34 as function processing sections for security functions against attacks on the in-vehicle network 2. These functional processing units are realized in software through program processing, or in hardware such as logic circuits.

The attack determination unit 31 determines whether the first CPU 11 has received an attack on the in-vehicle network 2 from outside the vehicle.

Specifically, when the attack determination unit 31 receives a notification of an attack from the first CPU 11, it determines that the first CPU 11 has been attacked from the outside. Then, the attack determination unit 31 disconnects (blocks) communication with the first CPU 11 and notifies the attack notification unit 33 that the first CPU 11 has been attacked from the outside.

Further, the secure memory 14 stores the same white list as the white list stored in the secure memory 13. When the attack determination unit 31 receives a message from the first CPU 11 (a message relayed by the first CPU 11), it checks whether a registered ID is used in the message. Then, if the registered ID is used in the message, the attack determination unit 31 determines that the message is a legitimate message. In this case, the message is transferred from the attack determination section 31 to the transfer determination section 32. On the other hand, if the registered ID is not used in the message, the attack determination unit 31 determines that the first CPU 11 has been attacked from the outside, and discards the message as an unauthorized message. Then, the attack determination unit 31 disconnects communication with the first CPU 11 and notifies the attack notification unit 33 that the first CPU 11 has been attacked from the outside.

Further, if the first CPU 11 detects software tampering at startup, the operation of the first CPU 11 is stopped, and a state in which messages are not sent from the first CPU 11 to the second CPU 12 continues. If the attack determination unit 31 does not receive a message from the first CPU 11 for a certain period of time, it may determine that the first CPU 11 has been attacked from the outside. Then, the attack determination unit 31 may disconnect communication with the first CPU 11 and notify the attack notification unit 33 that the first CPU 11 has been attacked from the outside.

When the transfer determination unit 32 receives a message from the attack determination unit 31, the transfer determination unit 32 transfers (relays) the message to the in-vehicle network 2. The message is received by the destination ECU 7 according to the ID included in the message.

Further, when the attack determining unit 31 notifies the attack notifying unit 33 of the attack received by the first CPU 11, the attack notifying unit 33 determines whether the first CPU 11 Notify the TCU 4 that it has been attacked from the outside. Upon receiving the notification, the TCU 4 uploads to the server 8 information that the first CPU 11 (the vehicle equipped with the gateway ECU 3 including the first CPU 11) has received an external attack on the in-vehicle network 2.

The software activation unit 34 detects that the ignition switch of the vehicle is turned on or that each ECU of the vehicle is woken up as a dominant, and activates the software stored in the secure memory 14. The software startup unit 34 has a software tampering detection function, and in order to detect software tampering when the software is started, it detects the digital signature given to the software and the signature information (hash) stored in the secure memory 33. value, sum value, etc.). As a result of the confirmation, if no tampering with the software is detected, the software activation unit 34 activates the software. If software tampering is detected, the software activation unit 34 does not activate the software. If software tampering is detected, the second CPU 12 stops operating.

<Flowchart>
The processing operations of the first CPU 11 and the second CPU 12 by the security function against external attacks are as described above, but the processing operations will be described below in chronological order.

FIG. 2 is a flowchart showing the flow of processing performed by the first CPU 11 at startup.

When the first CPU 11 is activated, the first CPU 11 performs the processing shown in FIG. 2 .

In the process shown in FIG. 2, the software tampering detection function checks whether the software stored in the secure memory 13 has been tampered with (step S11).

If the software has not been tampered with (NO in step S12), the software is activated (step S13). If the software has been tampered with, the software is not activated and the operation of the first CPU 11 is stopped (step S14).

FIG. 3 is a flowchart showing the flow of processing performed by the first CPU 11 when receiving a message.

When the first CPU 11 receives a message from the outside via the TCU 4 or DLC 5, the first CPU 11 performs the processing shown in FIG. 3.

In the process shown in FIG. 3, it is determined whether a registered ID is used in the message received by the first CPU 11 (received message). If the registration ID is used in a received message, the received message is a regular message. On the other hand, if the registration ID is not used in the received message, the received message is an unauthorized message.

If the received message is a regular message (NO in step S21), the regular message is transferred from the first CPU 11 to the second CPU 12 (step S22).

If the received message is a fraudulent message (YES in step S21), the fraudulent message is discarded (step S23). Furthermore, the second CPU 12 is notified that the first CPU 11 has received an external attack on the in-vehicle network 2 (step S24). Further, attack information including the details of the attack and the date and time of the attack is stored in the secure memory 13 (step S25).

FIG. 4 is a flowchart showing the flow of processing performed by the first CPU 11 when the scan tool 9 is connected.

While the scan tool 9 is connected to the DLC 5, the first CPU 11 repeatedly performs the process shown in FIG.

In the process shown in FIG. 4, it is determined whether a request to output attack information has been input from the scan tool 9 via the DLC 5 (step S31).

If a request to output attack information has not been input (NO in step S31), the process shown in FIG. 4 is once terminated, and when a predetermined timing arrives, the process shown in FIG. 4 is restarted.

When a request to output attack information is issued from the scan tool 9 and the request is input to the first CPU 11 (YES in step S31), the attack information is read from the secure memory 13 in accordance with the request, and the readout process is performed. The attack information thus obtained is output to the scan tool 9 via the DLC 5 (step S32).

FIG. 5 is a flowchart showing the flow of processing performed by the second CPU 12 after startup.

After the second CPU 12 is activated, the process shown in FIG. 5 is repeatedly performed by the second CPU 12.

In the process shown in FIG. 5, it is determined whether communication between the first CPU 11 and the second CPU 12 is disconnected (step S41). In a situation where the communication between the first CPU 11 and the second CPU 12 is disconnected (YES in step S41), the process shown in FIG. 5 is once finished, and when a predetermined timing arrives, the process shown in FIG. 5 starts again. be done.

If the communication between the first CPU 11 and the second CPU 12 is not disconnected (NO in step S41), it is determined whether a notification of an attack has been received from the first CPU 11 (step S42).

If the second CPU 12 has received the notification of attack from the first CPU 11 (YES in step S42), it is determined that the first CPU 11 has been attacked from the outside, and communication with the first CPU 11 is cut off (step S43). The fact that the first CPU 11 has been attacked from the outside may be notified from the second CPU 12 to the TCU 4 via the body ECU 7A (step S44).

On the other hand, if the second CPU 12 has not received the attack notification from the first CPU 11 (NO in step S42), it is determined whether the second CPU 12 has received a message from the first CPU 11 (a message relayed by the first CPU 11). (Step S45).

When a message is received from the first CPU 11 (YES in step S45), it is determined whether a registered ID is used in the received message. If the registration ID is used in a received message, the received message is a regular message. On the other hand, if the registration ID is not used in the received message, the received message is an unauthorized message.

If the received message is a regular message (NO in step S46), the regular message is transferred from the second CPU 12 to the in-vehicle network 2 (step S47).

If the received message is a fraudulent message (YES in step S46), it is determined that the first CPU 11 has been attacked from the outside, and communication with the first CPU 11 is cut off (step S43). Then, the second CPU 12 may notify the TCU 4 via the body ECU 7A that the first CPU 11 has been attacked from the outside (step S44).

When the second CPU 12 has not received the message from the first CPU 11 (NO in step S45), the process shown in FIG. 5 is ended.

<Effect>
As described above, the gateway ECU 3 includes the first CPU 11 and the second CPU 12. The first CPU 11 is separated from the in-vehicle network 2 inside the vehicle, and communication with the outside of the vehicle is performed by the first CPU 11. On the other hand, the second CPU 12 is provided separately from the outside of the vehicle and is communicably connected to the in-vehicle network 2. The first CPU 11 has an attack detection function (attack detection unit 21) that detects an attack on the in-vehicle network 2, and the second CPU 12 has an attack detection function (attack detection unit 21) that determines whether the first CPU 11 has been attacked. 31). In addition, in the second CPU 12, if the attack determination function determines that the first CPU 11 has been attacked, communication with the first CPU 11 is cut off, and the information that the first CPU 11 has been attacked from the outside is sent to the TCU 4 via the body ECU 7A. Be notified.

As a countermeasure against attacks on the in-vehicle network 2 from outside the vehicle, the attack detection function of the first CPU 11 is made the first layer of defense, and the attack judgment function of the second CPU 12 and communication with the first CPU 11 by the second CPU 12 are made the first defense layer. A layered defense with two layers of defense is constructed. By building this multi-layered defense, security measures can be strengthened.

Further, when the second CPU 12 receives an unauthorized message from the first CPU 11, the unauthorized message is discarded. As a result, even if the first CPU 11 that has been attacked from the outside sends a fraudulent message to the second CPU 12, the fraudulent message is discarded, making it possible to prevent the in-vehicle network 2 from being attacked by fraudulent messages. Communication via the in-vehicle network 2 can be continued.

In response to an attack being detected by the attack detection function, the first CPU 11 stores attack information regarding the attack in the secure memory 13, and stores attack information in the secure memory 13 in accordance with a request from a server 8 or a scan tool 9 external to the vehicle. Outputs stored attack information. Thereby, when the first CPU 11 is attacked from the outside, information regarding the attack can be read to the server 8 and the scan tool 9 outside the vehicle. Therefore, by analyzing the information read out to the server 8 or the scan tool 9, the content of the attack that the first CPU 11 has received can be identified at an early stage, and countermeasures against the attack can be taken at an early stage.

In addition, the first CPU 11 has a tampering detection function that detects tampering with software at startup, and if tampering with software is not detected at startup, it starts the software, and if tampering with software is detected at startup, it starts the software. , that software stops working without starting. This can prevent tampered software from starting. Therefore, it is possible to prevent unauthorized messages from being sent to the second CPU 12 due to execution of tampered software.

If software tampering is detected and the first operation stops, the first CPU 11 will not send a message to the second CPU 12. Therefore, if no message is sent for a certain period of time, the second CPU 12 will stop the first operation. It is determined that the first CPU 11 has been attacked from the outside, and communication between the first CPU 11 and the second CPU 12 is cut off. As a result, even if the software of the first CPU 11 has been tampered with, the second CPU 12 will not receive an unauthorized message from the first CPU 11, so that the in-vehicle network 2 can be prevented from being attacked by unauthorized messages.

When the second CPU 12 determines that the first CPU 11 has been attacked, the first CPU 11 is configured so that the information that the first CPU 11 has been attacked is uploaded from the TCU 4 mounted on the vehicle to the server 8 outside the vehicle. The fact that the TCU 4 has been attacked from the outside may be notified from the second CPU 12 via the body ECU 7A. This allows the server administrator or a user who can obtain information via the server to recognize the attack on the first CPU 11.

<Modified example>
Although one embodiment of the present invention has been described above, the present invention can also be implemented in other forms.

For example, although not shown, the second CPU 12, like the first CPU 11, substantially operates a software activation unit that activates software stored in the secure memory 14 in response to the ignition switch of the vehicle being turned on. We are preparing for The software activation unit of the second CPU 12 may also have a secure boot function, similar to the software activation unit 24 of the first CPU 11. If software tampering is detected, it is preferable that the software is not activated. This can prevent unauthorized messages from being sent to the in-vehicle network 2 due to execution of tampered software.

Furthermore, in response to information that the first CPU 11 has received an attack on the in-vehicle network 2 being uploaded from the TCU 4 to the server 8, the remote service for remotely controlling the vehicle may be stopped. Thereby, malfunction of the vehicle due to attacks on the in-vehicle network 2 can be prevented. Further, in addition to the TCU 4 and the DLC 5, a dedicated communication line with the cockpit ECU or a dedicated communication line for quick charging may be connected to the first CPU 11. In this case, similar to the TCU 4 and DLC 5, information is input in parallel to the attack detection unit 21 from these dedicated communication lines.

In addition, various design changes can be made to the above-described configuration within the scope of the claims.

2: In-vehicle network 3: Gateway ECU (in-vehicle relay device)
4: TCU (data communication unit)
7A: Body ECU (electronic control unit)
8: Server (information management equipment)
9: Scan tool (information management equipment)
11: First CPU (first device)
12: Second CPU (second device)
13: Secure memory (storage device)

Claims (5)

An in-vehicle relay device that is mounted on a vehicle and relays communication between an external in-vehicle network and an internal in-vehicle network,
a first device that includes a first memory, is provided separately from the in-vehicle network, and communicates with the outside of the vehicle;
a second device incorporating a second memory, provided separately from the exterior of the vehicle, communicably connected to the first device, and communicably connected to the in-vehicle network;
The first device has an attack detection function that detects an attack on the in-vehicle network,
The second device has an attack determination function that determines whether or not the first device has been attacked, and when the attack determination function determines that the first device has been attacked, a predetermined An in-vehicle relay device that handles this. The first memory stores a white list in which IDs (Identifiers) used for messages that can be communicated on the in-vehicle network are registered,
According to claim 1, when the first device receives a message from outside the vehicle that does not use an ID registered in the whitelist, the attack detection function detects the reception of the message as an attack. In-vehicle relay device. The first device stores information regarding the attack in the first memory in response to an attack being detected by the attack detection function, and stores information regarding the attack in the first memory according to a request from an information management device external to the vehicle . 3. The in-vehicle relay device according to claim 1 or 2, which outputs information stored in one memory . The first memory stores software;
The first device has a tampering detection function that detects tampering of the software at startup, and if the tampering detection function does not detect tampering, it starts the software, and the tampering detection function detects tampering of the software. If detected, the software will stop operating without starting it, and
The in-vehicle relay device according to claim 1, wherein the second device disconnects communication with the first device if no message is sent from the first device for a certain period of time. The second device is configured to transmit an attack from a data communication device installed in the vehicle to a server external to the vehicle when the first device is determined to have been attacked by the attack determination function . Claims 1 to 4, wherein the data communication device is notified via an electronic control unit connected to the in-vehicle network that the first device has been attacked so that information about the attack is uploaded. The in-vehicle relay device according to any one of the items.

Images