An access restriction device as well as an on-board communication system and a method for communication restriction, which prevent outside leakage of information caused by unauthorized access of malicious programs to an in-car network. The communication between the in-car network of the vehicle and an external device is performed by a security controller. The security controller can perform addition or update of a program involving processing for transmission and reception of the information. The security controller performs processing for restricting access to information of the in-car network performed by program execution according to an access authorization level of each program and an access permission level of each type of information. The security controller restricts the transmission depending on the access authorization level of each program and the access permission level of each type of information in case of transmitting the information to the in-car network by the program execution.