Vehicle control system and communication processing method

Abstract

To maintain high responsiveness of vehicle control while instantaneously detecting and appropriately defending illegal communication from attackers on a vehicle control system.SOLUTION: A vehicle control system includes: two control device groups respectively constituting two different communication networks; a communication management device communicably connected to the two control device groups; and a routing device that routes communication between the two communication networks. When a message is received from one of the control devices, the communication management device performs authentication processing for the one of the control devices, and includes a communication address of one control device as a transmission source address in a relay message for relaying the message received from the one control device to a control device of the other of the control device groups. The control device of the other of the control device groups performs communication with the one control device by using the communication address of the one control device included in the relay message without interposition of the communication management device.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a vehicle control system and a communication processing method executed by the vehicle control system. [Background technology]

[0002] In recent years, research and development has been carried out to improve the safety of control in vehicles. Patent Document 1 describes an unauthorized frame detection device that detects unauthorized frame transmissions in an in-vehicle network system that employs service-oriented communication and prevents the establishment of unauthorized communication. This device detects unauthorized frame transmissions based on the relationship between the ports that physically connect the server and the client. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2021 / 002010 Summary of the Invention [Problem to be solved by the invention]

[0004] Incidentally, in technology relating to the safety of vehicle control, it is an issue to simultaneously achieve high defense against attacks on vehicle control and high responsiveness of vehicle control. In order to solve the above problems, the present application aims to quickly detect and defend against unauthorized communications from attackers against a vehicle control system while maintaining high responsiveness of vehicle control, thereby further improving traffic safety and contributing to the development of a sustainable transportation system. [Means for solving the problem]

[0005] One aspect of the present invention is a vehicle control system comprising two control device groups each constituting two different communication networks mounted on a vehicle, a communication management device communicatively connected to each of the control devices of the two control device groups, and a routing device that routes communication between the two communication networks, wherein the communication management device, upon receiving a message from any of the control devices, performs an authentication process for the any of the control devices, and when the authenticity of any of the control devices has been authenticated, transmits a relay message for relaying a message received from one of the control devices which is a control device of one of the control device groups to a control device of the other of the control device groups, the relay message including the communication address of the one of the control devices as a source address, and the control device of the other of the control device groups uses the communication address of the one of the control devices included in the relay message to start communication with the one of the control devices via the routing device without going through the communication management device. when the communication management device can authenticate the authenticity of either of the control devices, it identifies the communication address of the other control device, which is a control device of the other control device group with which the one control device, which is a control device of one of the control device groups that sent the message, should communicate, based on device information for each of the control devices of the two control device groups, and sends a reply message to the one control device, which includes the communication address of the identified other control device as a source address, and the one control device uses the communication address of the other control device included in the reply message to start communication with the other control device via the routing device without going through the communication management device. A vehicle control system. According to another aspect of the present invention, A vehicle control system comprising: two control device groups constituting two different communication networks mounted on a vehicle; a communication management device communicatively connected to each of the control devices of the two control device groups; and a routing device that routes communication between the two communication networks, wherein the communication management device, upon receiving a message from any of the control devices, performs authentication processing for the one of the control devices, and, upon being able to authenticate the authenticity of the one of the control devices, transmits a relay message for relaying a message received from one of the control devices, which is a control device of one of the control device groups, to a control device of the other of the control device groups, the relay message including the communication address of the one of the control devices as a source address, and the control device of the other of the control device groups uses the communication address of the one of the control devices included in the relay message to start communication with the one of the control devices via the routing device without going through the communication management device, and the vehicle control system comprises two processing devices that perform processing independently of each other, and the two processing devices are each connected to a different one of the two communication networks. . According to another aspect of the present invention, one of the two control device groups includes a control device that performs control related to motion control of the vehicle and does not include a control device that communicates with the outside of the vehicle, and the other of the two control device groups includes a control device that communicates with the outside of the vehicle and does not include a control device that performs control related to motion control of the vehicle. Books According to another aspect of the invention, the two processing devices are a physical machine and a virtual machine, respectively, implemented in a processor included in the communication management device. According to another aspect of the present invention, the communication between the control devices of the two control device groups and the communication management device is Service Oriented Middle WarE Over IP (SOME / IP) communication, which includes sending a search notification, which is a notification that one of the services, which are predetermined functional units, is being searched for, and / or sending a provision notification, which is a notification that the searched service is available. Another aspect of the present invention is a communication processing method executed by a vehicle control system including two control device groups each constituting two different communication networks mounted on a vehicle, a communication management device communicatively connected to each of the control devices of the two control device groups, and a routing device that routes communication between the two communication networks, the method including: an authentication processing step in which, when the communication management device receives a message from one of the control devices, the communication management device performs an authentication process for the one of the control devices; a relay transmission step in which, when the authenticity of the one of the control devices can be authenticated, the communication management device transmits a relay message for relaying a message received from one of the control devices, which is a control device of one of the control device groups, to a control device of the other of the control device groups, the relay message including the communication address of the one of the control devices as a source address; and a first direct communication step in which the control device of the other of the control device groups communicates with the one of the control devices via the routing device without going through the communication management device, using the communication address of the one of the control devices included in the relay message; when the authenticity of one of the control devices can be authenticated, the communication management device performs an identification step in which the communication address of the other control device, which is a control device of the other control device group with which the one control device, which is a control device of one control device group that sent the message, should communicate, based on device information for each of the control devices of the two control device groups; a reply transmission step in which the communication management device transmits a reply message to the one control device, the reply message including the communication address of the identified other control device as a source address; and a second direct communication step in which the one control device uses the communication address of the other control device included in the reply message to communicate with the other control device via the routing device without going through the communication management device. The communication processing method includes the steps of: According to another aspect of the present invention, A communication processing method executed by a vehicle control system including two control device groups constituting two different communication networks mounted on a vehicle, a communication management device communicatively connected to each of the control devices of the two control device groups, and a routing device that routes communication between the two communication networks, the vehicle control system including two processing devices that perform processing independently of each other, the two processing devices being each connected to a different one of the two communication networks, When the legitimacy of one of the control devices can be authenticated, the communication management device performs an identification step in which the communication address of the other control device, which is a control device of the other control device group with which the one control device, which is a control device of one of the control device groups that sent the message, should communicate, based on device information for each of the control devices of the two control device groups; a reply sending step in which the communication management device sends to the one control device a reply message containing the identified communication address of the other control device as a source address; and a second direct communication step in which the one control device uses the communication address of the other control device contained in the reply message to communicate with the other control device via the routing device without going through the communication management device. Effect of the Invention

[0006] According to the present invention, it is possible to quickly detect and defend against unauthorized communications from an attacker against a vehicle control system, while maintaining high responsiveness of vehicle control. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a diagram showing a configuration of a vehicle control system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a sequence diagram showing a first example of a communication procedure in the vehicle control system. [Diagram 3] FIG. 3 is a sequence diagram showing a second example of a communication procedure in the vehicle control system. [Figure 4] FIG. 4 is a sequence diagram showing a third example of a communication procedure in the vehicle control system. [Diagram 5] FIG. 5 is a sequence diagram showing a fourth example of a communication procedure in the vehicle control system. [Figure 6] FIG. 6 is a sequence diagram showing a fifth example of a communication procedure in the vehicle control system. [Figure 7] FIG. 7 is a sequence diagram showing a sixth example of a communication procedure in the vehicle control system. [Figure 8] FIG. 8 is a sequence diagram showing a seventh example of a communication procedure in the vehicle control system. [Figure 9] FIG. 9 is a sequence diagram showing an eighth example of a communication procedure in the vehicle control system. [Figure 10] FIG. 10 is an explanatory diagram for explaining SOME / IP communication. [Figure 11] FIG. 11 is an explanatory diagram for explaining the SOME / IP communication protocol. [Figure 12] FIG. 12 is an explanatory diagram for explaining the SOME / IP communication protocol. [Figure 13] FIG. 13 is a diagram showing an example of the configuration of a communication packet used in SOME / IP communication. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. [1. Vehicle control system configuration] Fig. 1 is a diagram showing a configuration of a vehicle control system 1 according to an embodiment of the present invention. The vehicle control system 1 is mounted on a vehicle 2 and controls the operation of the vehicle 2. The vehicle 2 may be any vehicle driven by an internal combustion engine and / or a motor. In this embodiment, the vehicle 2 is, for example, an electric vehicle driven by a drive motor (both not shown) powered by an on-board battery.

[0009] The vehicle control system 1 includes a first control device group 3, a second control device group 4, and a communication management device 5. In this embodiment, the first control device group 3 does not include a control device that communicates with the outside of the vehicle 2, but includes a control device that performs control related to motion control of the vehicle 2. In this embodiment, the first control device group 3 includes, as control devices that perform control related to motion control of the vehicle 2, a drive ECU (Electronic Control Unit) 6a, a steering ECU 6b, a battery ECU 6c, and an ADAS (Advanced Driver-Assistance System)-ECU 6d.

[0010] The drive ECU 6a controls the operation of a drive motor that drives the vehicle 2, and the steering ECU 6b controls the steering, deceleration, acceleration, and other operations of the vehicle 2 based on the operation of the steering wheel, brake, accelerator, and other steering operations of the vehicle 2. The battery ECU 6c detects the remaining charge of the in-vehicle battery and controls the power supply operation to the drive motor. In addition, the ADAS-ECU 6d controls the driver assistance operations such as the cruise operation and lane keeping operation of the vehicle 2. Hereinafter, the drive ECU 6a, steering ECU 6b, battery ECU 6c, and ADAS-ECU 6d included in the first control device group 3 will be collectively referred to as ECU 6.

[0011] The second control device group 4 does not include a control device that performs control related to motion control of the vehicle 2, but includes a control device that communicates with the outside of the vehicle 2. In this embodiment, the second control device group 4 includes a TCU (Telematics Control Unit) 7a and an IVI (In-Vehicle Infotainment)-ECU 7b as control devices that communicate with the outside of the vehicle 2. The TCU 7a is a wireless communication device for communicating directly with devices outside the vehicle 2 or indirectly via an external communication network. The IVI-ECU 7b receives radio and television broadcast waves and / or GPS waves, and displays images and videos to the occupants of the vehicle 2 on an in-vehicle display device, speaker, etc. (both not shown), and / or provides information such as route guidance.

[0012] The second control device group 4 also includes, for example, a DMC-ECU7c that controls the operation of a DMC (Driver Monitoring Camera) (not shown) provided in the passenger compartment of the vehicle 2. Hereinafter, the TCU7a, IVI-ECU7b, and DMC-ECU7c included in the second control device group 4 will also be collectively referred to as ECU7.

[0013] In this embodiment, the first control device group 3 and the second control device group 4 include four and three control devices, respectively, but each needs to have at least one control device. Each of the ECU 6 and the ECU 7 includes a computer and performs predetermined control operations and communication with other in-vehicle devices.

[0014] The vehicle control system 1 also includes a routing device 8. The routing device 8 has a hub function for connecting the control devices so that they can communicate with each other, and a routing function for routing communications across multiple communication networks constituted by those control devices.

[0015] Each ECU 6 of the first control device group 3 and a first processing device 26 provided in a communication management device 5 described later are connected to a routing device 8 to form a first communication network 9. Each ECU 7 of the second control device group 4 and a second processing device 27 provided in a communication management device 5 described later are connected to the routing device 8 to form a second communication network 10.

[0016] In the communication management device 5, the first processing device 26 and the second processing device 27 work together to manage communication between ECU 6, which is a control device of the first control device group 3 that constitutes the first communication network 9, and ECU 7, which is a control device of the second control device group 4 that constitutes the second communication network 10.

[0017] In this embodiment, the ECU 6, the ECU 7, the first processing device 26, and the second processing device 27 perform communication in accordance with the TCP / IP protocol in accordance with the Ethernet (registered trademark) communication standard. The first communication network 9 and the second communication network 10 are different VLANs (Virtual Local-Area-Networks). The routing device 8 is, for example, an L3 switch. The routing device 8 may be built into the communication management device 5.

[0018] In this embodiment, the ECU 6, the ECU 7, the first processing device 26, and the second processing device 27 communicate in accordance with, for example, the Service Oriented Middle Ware Over IP (SOME / IP) standard defined in AUTOSAR (Automotive Open System Architecture).

[0019] [2. Explanation of SOME / IP communication] Here, an overview of the conventional SOME / IP communication will be given. Figures 10, 11, 12, and 13 are diagrams for explaining SOME / IP communication. SOME / IP communication is used to establish communication between any one of a plurality of devices 41 that requests the provision of a service and any other device 41 that can provide the service, among a plurality of devices 41 that are connected to a hub 40 and form a communication network, as shown in Figure 10, to realize the transfer of the service.

[0020] Here, a service refers to each of the functions and processes obtained by subdividing various operations (e.g., acquiring and providing sensor data from a sensor such as a camera, controlling a motor or actuator, and providing status information) that are realized by each device 41 executing an application program. Also, a device that receives the provision of a service (specifically, the provision of data related to the service) is called a client device, and a device that provides the service is called a server device. In Fig. 10, any one of the multiple devices 41 can be a client device, and any other one of the devices 41 can be a server device.

[0021] Each device 41 transmits various messages (SOME / IP messages) defined in SOME / IP using IP packets defined by Ethernet. In particular, communication for searching for devices on a network that provide services is called SOME / IP-SD (Service Discovery). SOME / IP-SD communication includes the following messages: FindService message, OfferService message, SubscribeEventGroup message, Event message, and FieldNotification message, which will be described later.

[0022] Fig. 13 is a diagram showing an example of the configuration of the head part of a communication packet used in SOME / IP-SD communication. In detail, Fig. 13 shows the head part of a communication packet following the MAC header (18 bytes) at the head of an Ethernet (registered trademark) frame.

[0023] A communication packet includes an IP header, a UDP header, and a message (SOME / IP message) defined in SOME / IP communication. In SOME / IP-SD communication, a SOME / IP message may include a SOME / IP header and a SOME / IP-SD header. The SOME / IP-SD header includes an Entries Array and an Options Array.

[0024] Since the IP header, UDP header, SOME / IP header, and SOME / IP-SD header are well known, in order to simplify the explanation and make it easier to understand, the fields that make up these headers will not be explained one by one, but only the parts that are relevant to the characteristic operation of the vehicle control system 1 in this embodiment will be briefly explained.

[0025] The SourceAddress field of the IP header and the SourcePort of the UDP header indicate the IP address and communication port number of the device that sent the communication packet, respectively. The DestinationAddress field of the IP header and the DestinationPort of the UDP header indicate the IP address and communication port number of the device that sent the communication packet (receiving device), respectively. Here, the IP address is a local IP address in the LAN (including VLAN) to which the corresponding device is connected.

[0026] The source device can specify the IP address of a specific destination device in the DestinationAddress field and send the communication packet by unicast, or it can specify a predefined IP address (multicast address) indicating a range of multiple destination devices and send the communication packet by multicast to those multiple destination devices.

[0027] The ServiceID field of the SOME / IP header is set with a service ID that identifies the service provided to the client device from the server device that transmits and receives this packet. The ClientID field is set with a device ID that identifies the client device that receives the service. The SessionID field is set with a session ID that indicates that the communication of this packet is part of a communication session for providing the service identified by the service ID in the ServiceID field to the device identified by the device ID in the ClientID field.

[0028] In the case of SOME / IP-SD communication, the ServiceID field and MethodID field of the SOME / IP header store OxFFFF and 0x8100, respectively, as special values ​​indicating that the communication is SOME / IP-SD communication.

[0029] In addition, in the case of sending SOME / IP-SD messages (e.g., FindService, OfferService, SubscribeEventGroup, and SubscribeEventGroupAck messages), a fixed value of x0000 is set in the ClientID field. In the case of sending SOME / IP messages other than SOME / IP-SD messages (e.g., Event, FieldNotification, Request, and Response messages), a device ID that identifies the client device that receives the service is set in the ClientID field. In the SessionID field, a session ID that distinguishes messages sent from the same device from other messages is set.

[0030] Additionally, the IPv4 Address field and PortNumber field in the SOME / IP-SD header indicate the IP address and communication port number, respectively, that are the source address of the SOME / IP-SD message. Note that when the IP packet carrying the SOME / IP message is communicated using IPv6 instead of IPv4, the IPv4 Address field is replaced with an IPv6 Address field. Hereinafter, the source address indicated in the IPv4 Address field or IPv6 Address field is referred to as the Endpoint address.

[0031] 11 and 12 are sequence diagrams showing an outline of a communication protocol (SOME / IP communication protocol) in SOME / IP communication. For ease of understanding, an example will be described in which device A 41a, which is one of the devices 41 shown in FIG. 10, serves as a client device, and device B 41b, which is one of the devices 41, serves as a server device.

[0032] In the example of FIG. 11, after device A 41a recognizes device B 41b as a server device capable of providing a desired service, it continues communication by requesting device B 41b to provide the service.

[0033] 11, first, device A 41a multicasts a FindService message to search for a server device that can provide a desired service within the communication network (S600). As a result, device A 41a becomes a client device. The FindService message is received by all devices 41 including device B 41b. In the FindService message, a ServiceID for identifying the service desired by device A 41a is set in the ServiceID field of the SOME / IP-SD header.

[0034] Upon receiving the FindService message, the B device 41b determines that it can provide the requested service, and transmits an OfferService message to the A device 41a to notify that it can provide the service (S602). As a result, the B device 41b becomes a server device.

[0035] By receiving the OfferService message sent from the B device 41b, the A device 41a recognizes the B device 41b as a server device that can provide the desired service, and communication is established between the A device 41a as a client device and the B device 41b as a server device for the transfer of the above-mentioned service.

[0036] Next, the A device 41a that has received the OfferService message sent from the B device 41b sends a SubscribeEventGroup message to the B device 41b requesting the provision of a service (S604). In response to receiving the SubscribeEventGroup message from the A device 41a, the B device 41b sends a SubscribeEventGroupAck message as an acknowledgement to the A device 41a (S606).

[0037] Thereafter, device B 41b transmits data on the requested service to device A 41a as an Event message or FieldNotification message at a predetermined timing (S608, S610). Here, the Event message is a message used to transmit data when some event occurs, such as when a transmission timing at a predetermined time interval arrives or when a value of a predetermined data item is changed or updated. Also, the FieldNotification message is a message used to notify information that specifies data transmission conditions, etc. (for example, transfer rate information of camera images, etc.) when the information is changed.

[0038] Fig. 12 is a sequence diagram showing another example of the SOME / IP communication protocol. In the example of Fig. 12, after recognizing device B 41b as a server device capable of providing a desired service, device A 41a transmits a service provision request to device B 41b at the timing when the service provision is required, and device B 41b provides the service in response to each provision request. In Fig. 12, the same processes as those in Fig. 11 are indicated by the same reference numerals as those in Fig. 11, and the above description of Fig. 11 is used.

[0039] In Fig. 12, after the FindService message and OfferService message are exchanged between the A device 41a and the B device 41b similar to those in Fig. 11, the A device 41a transmits a Request message, which is a service provision request, to the B device 41b (S612). Then, in response to receiving the Request message from the A device 41a, the B device 41b transmits data of the requested service in a Response message to the A device 41a (S614). After that, the A device 41a and the B device 41b repeatedly exchange the Request message and the Response message at the timing when the A device 41a requests the provision of a service (S616, S618).

[0040] 11 and 12, a communication session is started by sending a FindService message from device A 41a as a client device requesting a service, but a communication session may be started by sending an OfferService message from device B 41b as a server device without sending a FindService message. In this case, device B 41b first multicasts an OfferService message indicating that it can provide a specific service within the communication network. Among the devices 41 that receive this OfferService message, device A 41a that requires the provision of that service becomes a client device by sending a SubscribeEventGroup message or a Request message to device B 41b.

[0041] [3.Communication management device] When the communication management device 5 receives a message from a control device (either the ECU 6 or the ECU 7) of either the first control device group 3 or the second control device group 4, the communication management device 5 performs authentication processing for that control device.

[0042] Furthermore, when the communication management device 5 is able to authenticate the authenticity of the control device that sent the message in the authentication process, it generates and transmits a relay message for relaying a message (e.g., an OfferService message) received from one control device (e.g., ECU 6) that is a control device of one control device group to a control device (e.g., ECU 7) of the other control device group. At that time, the communication management device 5 includes the communication address of the one control device as the source address in the relay message. As a result, a control device of the other control device group can use the communication address of one of the control devices contained in the relay message to communicate with the one of the control devices via the routing device 8 without going through the communication management device 5.

[0043] Furthermore, when the communication management device 5 is able to authenticate the authenticity of the control device that sent the message in the authentication process, it identifies the communication address of the other control device (e.g., ECU 7) that is a control device of the other control device group with which the one control device (e.g., ECU 6) that is a control device of one control device group that sent the message (e.g., FindService message) should communicate, based on service information 24 (described later), which is device information for each control device.Then, it transmits a reply message (e.g., OfferService message) including the communication address of the identified other control device as a sender address to the one control device on behalf of the other control device. This allows one control device to use the communication address of the other control device contained in the reply message to initiate communication with the other control device via the routing device 8 without going through the communication management device 5.

[0044] [3.1 Configuration of communication management device] The configuration of the communication management device 5 will be described. In the following, the communication addresses set in the SourceAddress field and DestinationAddress field of the IP header of an IP packet carrying a message are referred to as the "source address of the IP packet" and the "destination address of the IP packet", respectively. Also, in this specification, the communication address set in the IPv4 Address field (or IPv6 Address field) in the SOME / IP-SD header of each SOME / IP-SD message, including the FindService message, OfferService message, SubscribeEventGroup message, and SubscribeEventGroupAck message, is referred to as the "source address of the message" or "Endpoint address". In this way, the source address of the IP packet and the source address contained in the message are described separately.

[0045] Referring to FIG. 1, the communication management device 5 includes a processor 20, a memory 21, a first communication device 22a, and a second communication device 22b. The first communication device 22a and the second communication device 22b are wired communication devices for communication between a first processing device 26 and a second processing device 27, which will be described later, respectively. The first communication device 22a and the second communication device 22b are each connected to a routing device 8. The first processing device 26 and the second processing device 27 perform communication in accordance with the SOME / IP communication standard via the routing device 8 by the first communication device 22a and the second communication device 22b. As described above, the first processing device 26 constitutes a first communication network 9 together with each ECU 6 of the first control device group 3, and the second processing device 27 constitutes a second communication network 10 together with each ECU 7 of the second control device group 4.

[0046] The memory 21 is configured, for example, by a volatile and / or non-volatile semiconductor memory and / or a hard disk device, etc. In the memory 21, identification information 23 and service information 24 are stored.

[0047] In the identification information 23, a list of communication addresses (IP addresses in this embodiment; the same applies below) of the authorized ECU 6 and ECU 7 is stored as an authorized address list. In addition, in the service information 24, a list of service IDs (available service IDs) of services that the ECU 6 and ECU 7 can provide is stored in association with the communication addresses of the ECU 6 and ECU 7. The service information 24 corresponds to device information on each of the control devices of the two control device groups in this disclosure. The service information 24 also includes information on whether each of the ECU 6 and ECU 7 is a device that provides a service in response to receiving a SubscribeEventGroup message (i.e., a service provided by an Event message and / or a FieldNotification message as shown in FIG. 11) or a device that provides a service in response to receiving a Request message (i.e., a service provided by a Response message as shown in FIG. 12).

[0048] The processor 20 is, for example, a computer equipped with a CPU etc. The processor 20 may have a configuration including a ROM in which a program is written, a RAM for temporarily storing data etc. The processor 20 includes a first processing device 26 and a second processing device 27 as functional elements or functional units.

[0049] The first processing device 26 and the second processing device 27 perform processing independently of each other and cooperate with each other to manage communication between the ECU 6 of the first control device group 3 that constitutes the first communication network 9 and the ECU 7 of the second control device group 4 that constitutes the second communication network 10.

[0050] The first processing device 26 is realized as a so-called physical machine, for example, by the processor 20, which is a computer, executing a first program 25a including an OS (operating system) stored in the memory 21. Also, for example, the second processing device 27 is realized as a so-called virtual machine, by the processor 20, which is a computer, executing a second program 25b including an OS stored in the memory 21. This allows the first processing device 26 and the second processing device 27 to operate as independent computers.

[0051] Specifically, the first processing device 26 is realized on the hardware of the processor 20 in the processor 20 and starts operating as a result of the processor 20 executing the first program 25a. At that time, the processor 20 executes an OS included in the first program 25a, and a virtual machine platform provided by the OS is formed in the processor 20.

[0052] Thereafter, the processor 20 executes the second program 25b on the virtual machine platform, thereby realizing a second processing device 27 as a virtual machine.

[0053] That is, the OS provided by the first program 25a is a so-called host OS, and the OS provided by the second program 25b is a so-called guest OS that runs on a virtual machine platform provided by the host OS.

[0054] The first program 25a and the second program 25b can be stored in any computer-readable storage medium.

[0055] The first processing device 26 includes, as functional elements or functional units, a first authentication section 30 and a first communication control section 31. These functional elements are realized by the processor 20 executing the above-mentioned first program 25a.

[0056] Moreover, the second processing device 27 includes, as functional elements or functional units, a second authentication part 32 and a second communication control part 33. These functional elements are realized by the processor 20 executing the above-mentioned second program 25b.

[0057] The first processing device 26 and the second processing device of the communication management device 5 cooperate with each other to perform authentication processing for a control device (e.g., any of ECU 6 or ECU 7) of the first control device group 3 and the second control device group 4 when a message is received from that control device.

[0058] Furthermore, when the authenticity of the control device is authenticated in the authentication process, the first processing device 26 and the second processing device cooperate with each other to generate and transmit a relay message for relaying a message received from one control device, which is a control device of one control device group, to a control device of the other control device group. At that time, the first processing device 26 includes the communication address of the one control device as a source address in the relay message.

[0059] Furthermore, when the authenticity of the control device is authenticated in the authentication process, the first processing device 26 and the second processing device cooperate with each other to identify the communication address of the other control device, which is a control device of the other control device group with which the one control device that is a control device of one control device group that has transmitted a message (for example, a FindService message) should communicate, based on the service information 24, which is device information about each control device. Then, a reply message (for example, an OfferService message) including the communication address of the identified other control device as a source address is transmitted to the one control device on behalf of the other control device.

[0060] [3.2 Operation of the communication management device] Next, the operation of the first authentication unit 30 and the first communication control unit 31 of the first processing device 26, and the operation of the second authentication unit 32 and the second communication control unit 33 of the second processing device 27 will be explained with reference to sequence diagrams shown in Figures 2, 3, 4, 5, 6, 7, 8, and 9, which show eight examples of communication procedures in the vehicle control system 1.

[0061] [3.2.1 First example of communication procedure] Fig. 2 is a first example of SOME / IP communication. The SOME / IP communication shown in Fig. 2 is triggered by any ECU 6 in the first control device group 3 multicasting a FindService message seeking a specific service, and the ECU 6 identifies any ECU 7 in the second control device group 4 that provides the specific service and transmits a Request message to the ECU 7, and receives the service provided by the ECU 7 via a Response message.

[0062] 2, first, any ECU 6 of the first control device group 3 requests the vehicle 2 to provide a service (requested service) necessary for some control related to motion control, and transmits, via multicast within the first communication network 9, a FindService message for searching for a server device capable of providing the requested service (S100). Hereinafter, the ECU 6 that transmitted the FindService message is referred to as a client ECU 6.

[0063] The first authentication unit 30 of the first processing device 26 that has received the FindService message from the client ECU 6 executes a first authentication process for the client ECU 6 (S102). The first authentication unit 30 performs the first authentication process by determining whether or not the sender address of the message included in the received FindService message is included in the authorized address list of the identification information 23 stored in the memory 21. If the first authentication unit 30 cannot authenticate the legitimacy of the client ECU 6 in the first authentication process, it ends the process shown in FIG. 2 (not shown in FIG. 2).

[0064] Next, the first communication control unit 31 of the first processing device 26 identifies an ECU 7 capable of providing the requested service requested by the client ECU 6 (S104). Specifically, the first communication control unit 31 acquires the service ID of the requested service from the Service ID of the FindService message. Then, the first communication control unit 31 refers to the service information 24 stored in the memory 21 and identifies the communication address of the ECU 7 including the acquired service ID as a service ID that can be provided. Furthermore, the first communication control unit 31 recognizes from the service information 24 that the identified ECU 7 is a device that provides a service in response to receiving a Request message for the requested service (S106). Hereinafter, an ECU 7 capable of providing a requested service is referred to as a server ECU 7.

[0065] Next, in response to the above recognition regarding the service provision by the server ECU 7, the first communication control unit 31, acting on behalf of the identified server ECU 7, generates an OfferService message setting the communication address of the server ECU 7 as an Endpoint address (S108), and returns the generated OfferService message to the client ECU 6 (S110). The client ECU 6 that has received the OfferService message acquires the communication address of the server ECU 7, which is the communication partner, from the Endpoint address of the received OfferService message (S112).

[0066] Next, the client ECU 6 uses the acquired communication address of the server ECU 7 as the destination address of the IP packet and transmits a Request message to the server ECU 7 via the routing device 8, without passing through the first processing device 26 and the second processing device 27 of the communication management device 5 (S114). The server ECU 7 that has received the Request message acquires the communication address of the client ECU 6, which is the communication partner, from the source address of the IP packet of the received Request message (S116).

[0067] Next, the server ECU7 uses the communication address of the client ECU6 acquired above as the destination address of the IP packet and sends a Response message to the client ECU7 via the routing device 8 without going through the first processing device 26 and the second processing device 27 of the communication management device 5 (S118).

[0068] Thereafter, the client ECU 6 and the server ECU 7 use each other's communication addresses obtained in steps S112 and S116, respectively, to repeatedly exchange Request messages and Response messages directly via the routing device 8, without going through the communication management device 5, in accordance with conventional technology (S120, S122).

[0069] 2, the client ECU 6 and the server ECU 7 correspond to "one control device" and "another control device with which the one control device should communicate" in the present disclosure, respectively. The FindService message transmitted in step S100 and the OfferService message transmitted in step S110 correspond to "a message received from one control device" and "a reply message to the message received from the one control device" in the present disclosure, respectively.

[0070] 2, step S102 corresponds to an authentication process step in this disclosure, step S104 corresponds to a determination step, steps S108 and S110 correspond to a reply sending step, and steps S114, S118, S120, and S122 correspond to a second direct communication step.

[0071] [3.2.2 Second example of communication procedure] Fig. 3 is a second example of SOME / IP communication. The SOME / IP communication shown in Fig. 3 is triggered by any ECU 6 in the first control device group 3 multicasting a FindService message in search of a specific service, and the ECU 6 receives a service provided by any ECU 7 in the second control device group 4 that provides the specific service through an Event message and / or a FieldNotification message.

[0072] In addition, in FIG. 3, the same processing steps as those shown in FIG. 2 are indicated by the same reference numerals as those shown in FIG. 2, and the above description of FIG. 2 is incorporated herein.

[0073] 3, the first communication control unit 31 of the first processing device 26 identifies the server ECU 7 capable of providing the requested service in step S104, and then recognizes that the identified server ECU 7 is a device that provides the service in response to receiving a SubscribeEventGroup message (also abbreviated as "Subscribe" or "Subscribe message" in the attached drawings) regarding the requested service (S150). Then, in response to the above recognition regarding the service provision by the server ECU 7, the first communication control unit 31 transmits an OfferService message in which the communication address of the first processing device 26 itself is set as the Endpoint address to the client ECU 6 according to the conventional technology (S152).

[0074] The client ECU 6 that has received this OfferService message transmits a SubscribeEventGroup message in which the communication address of the client ECU 6 itself is set as the Endpoint address to the first processing device 26 that is the sender of the OfferService message, according to the conventional technology (S154).

[0075] In response to receiving the SubscribeEventGroup message, the first communication control unit 31 of the first processing device 26 generates a SubscribeEventGroup message on behalf of the client ECU 6 that sent the message, with the communication address of the client ECU 6 set as the Endpoint address (S156), and transmits the generated SubscribeEventGroup message to the server ECU 7 identified in step S104 (S158).

[0076] The server ECU 7 receives the SubscribeEventGroup message, and acquires the communication address of the client ECU 6 that is the communication partner of the service provision from the Endpoint address of the received SubscribeEventGroup message (S160). The server ECU 7 transmits a SubscribeEventGroupAck message (also abbreviated as "SubscriveAck" in the attached drawings) to the first processing device 26 as an acknowledgement response to the SubscribeEventGroup message transmitted in step S158 (S162).

[0077] The first communication control unit 31 of the first processing device 26 receives the SubscribeEventGroupAck message transmitted in step S162. In response to receiving the SubscribeEventGroupAck message, the first communication control unit 31 transmits a SubscribeEventGroupAck message in which the communication address of the first processing device 26 itself is set as the Endpoint address to the client ECU 6 according to the conventional technology (S164). This SubscribeEventGroupAck message is a response message to the SubscribeEventGroup message transmitted by the client ECU 6 in step S154.

[0078] Thereafter, the server ECU 7 can use the communication address of the client ECU 6 acquired in step S160 to send a message directly to the client ECU 6 via the routing device 8, without going through the first processing device 26 and the second processing device 27 of the communication management device 5. Therefore, thereafter, the server ECU 7 transmits data on the provided service to the client ECU 6 at a predetermined timing by an Event message and / or a Field Notification message, without going through the communication management device 5, and the client ECU 6 receives these messages (S166, S168).

[0079] 3, the client ECU 6 and the SubscribeEventGroup message transmitted in step S154 correspond to "one control device" and "a message received from one control device" in this disclosure, respectively. Also, the SubscribeEventGroup message transmitted in step S158 corresponds to "a relay message for relaying a message received from one control device to a control device of the other control device group" in this disclosure.

[0080] Also, in FIG. 3, steps S156 and S158 correspond to the relay transmission step in this disclosure, and steps S166 and S168 correspond to the first direct communication step.

[0081] [3.2.3 Third example of communication procedure] Fig. 4 is a third example of SOME / IP communication. The SOME / IP communication shown in Fig. 4 is triggered by multicasting an OfferService message from any ECU 6 in the first control device group 3 indicating that it can provide a specific service, and the ECU 6 receives a Request message from any ECU 7 in the second control device group 4 that requires the specific service, and provides the service to the ECU 7 by a Request message.

[0082] 4, first, any ECU 6 of the first control device group 3 multicasts an OfferService message indicating that a specific service can be provided within the first communication network 9 (S200). Hereinafter, the specific service will be referred to as a "provided service," and the ECU 6 that has transmitted the OfferService message will be referred to as a "server ECU 6."

[0083] The first authentication unit 30 of the first processing device 26 that has received the OfferService message from the server ECU 6 executes a first authentication process for the server ECU 6 (S202). When the first authentication unit 30 cannot authenticate the authenticity of the server ECU 6 in the first authentication process, it ends the process shown in Fig. 4 (not shown in Fig. 4).

[0084] Next, the first communication control unit 31 recognizes from the service information 24 that the server ECU 6 is a device that provides the service in response to receiving a Request message regarding the above-mentioned provided service (S204).

[0085] In response to the above recognition regarding the service provision of the server ECU 6, the first communication control unit 31, on behalf of the server ECU 6 that sent the OfferService message in step S200, generates an OfferService message with the communication address of the server ECU 6 set as the Endpoint address (S206), and multicasts the generated OfferService message to each ECU 7 in the second communication network 10 (S208).

[0086] The OfferService message multicast in step S208 is received by each ECU 7. Among the ECUs 7 in the second communication network 10, any ECU 7 that requires the service indicated by the service ID in the OfferService message (hereinafter, referred to as a client ECU 7) obtains the communication address of the server ECU 6, which is the communication partner, from the Endpoint address of the OfferService message (S210).

[0087] The client ECU 7 transmits a Request message to the server ECU 6 using the acquired communication address of the server ECU 6 as a destination address of the IP packet (S212). This Request message is received by the server ECU 6 via the routing device 8 without passing through the first processing device 26 and the second processing device 27 of the communication management device 5.

[0088] The server ECU 6 that has received the Request message acquires the communication address of the client ECU 7, which is the communication partner, from the source address of the IP packet of the received Request message (S214). The server ECU 6 uses the acquired communication address of the client ECU 7 as the destination address of the IP packet, and transmits a Response message to the client ECU 7 via the routing device 8 without passing through the first processing device 26 and the second processing device 27 of the communication management device 5 (S216).

[0089] Thereafter, the client ECU 7 and the server ECU 6 use each other's communication addresses obtained in steps S210 and S214, respectively, to repeatedly exchange Request messages and Response messages directly via the routing device 8, without going through the communication management device 5, in accordance with conventional technology (S218, S220).

[0090] 4, the OfferService message transmitted in step S200 received by the server ECU 6 and the first processing device 26 corresponds to "one control device" and "message received from one control device" in the present disclosure, respectively. Also, the OfferService message transmitted in step S208 corresponds to "a relay message for relaying a message received from one control device to a control device of the other control device group based on the message received from the one control device" in the present disclosure.

[0091] Also, in FIG. 4, step S202 corresponds to an authentication processing step in this disclosure, steps S206 and S208 correspond to relay transmission steps, and steps S212, S216, S218, and S220 correspond to a first direct communication step.

[0092] [3.2.4 Fourth Example of Communication Procedure] Fig. 5 is a fourth example of SOME / IP communication. The SOME / IP communication shown in Fig. 5 is started by being triggered by any ECU 6 of the first control device group 3 multicasting an OfferService message indicating that it is capable of providing a specific service, and the ECU 6 provides the service to any ECU 7 of the second control device group 4 that requires the specific service by using an Event message and / or a FieldNotification message.

[0093] In addition, in FIG. 5, the same processing steps as those shown in FIG. 4 are indicated by the same reference numerals as those shown in FIG. 4, and the above description of FIG. 4 is incorporated herein.

[0094] In the example shown in FIG. 5, the first communication control unit 31 of the first processing device 26 executes a first authentication process for the server ECU 6 in step S202, and then recognizes from the service information 24 that the server ECU 6 is a device that provides a service in response to receiving a SubscribeEventGroup message regarding the provided service (S250).

[0095] Then, in response to the above recognition regarding the service provision of the server ECU 6, the first communication control unit 31 multicasts an OfferService message in which the communication address of the first processing device 26 is set as the Endpoint address to each ECU 7 in the second communication network 10 in accordance with conventional technology (S252).

[0096] The OfferService message multicast in step S252 is received by each ECU 7. Among the ECUs 7 in the second communication network 10, any ECU 7 that requires the service indicated by the service ID in the OfferService message (hereinafter, referred to as a client ECU 7) transmits a SubscribeEventGroup message in which the communication address of the client ECU 7 itself is set as an Endpoint to the first processing device 26 that is the sender of the OfferService message, according to the conventional technology (S254).

[0097] In response to receiving the SubscribeEventGroup message, the first communication control unit 31 of the first processing device 26 generates a SubscribeEventGroup message on behalf of the client ECU 7, which is the sender of the SubscribeEventGroup message, with the communication address of the client ECU 7 set as the Endpoint address (S256), and transmits the generated SubscribeEventGroup message to the server ECU 6, which is the sender of the OfferService message in step S200 (S258).

[0098] The server ECU 6 receives the SubscribeEventGroup message and acquires the communication address of the client ECU 7, which is the communication partner for providing the service, from the Endpoint address of the received SubscribeEventGroup message (S260). The server ECU 6 transmits a SubscribeEventGroupAck message, which is an acknowledgement response to the SubscribeEventGroup message transmitted in step S258, to the first processing device 26, which is the source of the message (S262), according to the conventional technology.

[0099] The first communication control unit 31 of the first processing device 26 receives the SubscribeEventGroupAck message transmitted in step S262. In response to receiving the SubscribeEventGroupAck message, the first communication control unit 31 transmits a SubscribeEventGroupAck message in which the communication address of the first processing device 26 itself is set as the Endpoint address to the client ECU 7 according to the conventional technology (S264). This SubscribeEventGroupAck message is a response message to the SubscribeEventGroup message transmitted by the client ECU 7 in step S254.

[0100] Thereafter, the server ECU 6 can use the communication address of the client ECU 7 acquired in step S260 to send a message directly to the client ECU 7 via the routing device 8, without going through the first processing device 26 and the second processing device 27 of the communication management device 5. Therefore, thereafter, the server ECU 6 continuously sends data on the provided service to the client ECU 7 at predetermined timings by using an Event message and / or a Field Notification message, without going through the communication management device 5, and the client ECU 7 receives these messages (S266, S268).

[0101] In the example shown in FIG. 5, the client ECU 7, the SubscribeEventGroup message sent in step S254, and the SubscribeEventGroup message sent in step S258 correspond to "one of the control devices," "a message received from one of the control devices," and "a relay message for relaying a message received from one of the control devices to a control device of the other control device group" in this disclosure, respectively.

[0102] Also, in FIG. 5, steps S256 and S258 correspond to the relay transmission step in this disclosure, and steps S266 and S268 correspond to the first direct communication step.

[0103] [3.2.5 Fifth Example of Communication Procedure] Fig. 6 is a fifth example of SOME / IP communication. The SOME / IP communication shown in Fig. 6 is triggered by any ECU 7 in the second control device group 4 multicasting a FindService message seeking a specific service, and the ECU 7 identifies any ECU 6 in the first control device group 3 that provides the specific service and transmits a Request message to the ECU 7, and receives the service provided by the ECU 6 via a Request message.

[0104] 6, first, any ECU 6 of the second control device group 4 requests the provision of a specific service (requested service) necessary for a control operation, and transmits, via multicast within the second communication network 10, a FindService message for searching for a server device capable of providing the requested service (S300). The second processing device 27 within the second communication network 10 receives the multicast FindService message. Hereinafter, the ECU 7 that transmitted the multicast FindService message is referred to as a client ECU 7.

[0105] The second authentication unit 32 of the second processing device 27 that has received the FindService message from the client ECU 7 executes a second authentication process for the client ECU 7 (S302). The second authentication unit 32 performs the second authentication process by determining whether or not the sender address of the message included in the received FindService message is included in the authorized address list of the identification information 23 stored in the memory 21. If the second authentication unit 32 is unable to authenticate the authenticity of the client ECU 7 in the second authentication process, it ends the process shown in FIG. 6 (not shown in FIG. 6).

[0106] Next, the second communication control unit 33 of the second processing device 27 transfers the FindService message from the client ECU 7 to the first processing device 26 (S304).

[0107] The first communication control unit 31 of the first processing device 26 identifies an ECU 6 capable of providing the requested service requested by the client ECU 7 based on the transferred FindService message (S306). Specifically, the first communication control unit 31 acquires the service ID of the requested service from the Service ID of the FindService message. Then, the first communication control unit 31 refers to the service information 24 stored in the memory 21 and identifies the communication address of the ECU 6 including the acquired service ID as a service ID that can be provided. Furthermore, the first communication control unit 31 recognizes from the service information 24 that the identified ECU 6 is a device that provides a service in response to receiving a Request message for the requested service (S308). Hereinafter, an ECU 6 capable of providing a requested service requested by the client ECU 7 is referred to as a server ECU 6.

[0108] Next, in response to the above recognition regarding the service provision by the server ECU 6, the first communication control unit 31, acting on behalf of the identified server ECU 6, generates an OfferService message in which the communication address of the server ECU 6 is set as an Endpoint address (S310), and returns the generated OfferService message to the client ECU 7 (S312). The client ECU 7 that has received the OfferService message acquires the communication address of the server ECU 6, which is the communication partner, from the Endpoint address of the received OfferService message (S314).

[0109] Next, the client ECU 7 uses the acquired communication address of the server ECU 6 as the destination address of the IP packet and transmits a Request message to the server ECU 7 via the routing device 8, without going through the first processing device 26 and the second processing device 27 of the communication management device 5 (S316). The server ECU 6 that has received the Request message acquires the communication address of the client ECU 7, which is the communication partner, from the source address of the IP packet of the received Request message (S318).

[0110] Next, the server ECU 6 uses the communication address of the client ECU 7 acquired above as the destination address of the IP packet and sends a Response message to the client ECU 7 via the routing device 8 without going through the first processing device 26 and the second processing device 27 of the communication management device 5 (S320).

[0111] Thereafter, the client ECU 7 and the server ECU 6 use each other's communication addresses obtained in steps S314 and S318, respectively, to repeatedly exchange Request messages and Response messages directly via the routing device 8, without going through the communication management device 5, in accordance with conventional technology (S322, S324).

[0112] 6, the client ECU 7 and the server ECU 6 correspond to "one control device" and "another control device with which the one control device should communicate" in the present disclosure, respectively. The FindService message transmitted in step S300 and the OfferService message transmitted in step S312 correspond to "a message received from one control device" and "a reply message to the message received from the one control device" in the present disclosure, respectively.

[0113] 6, step S302 corresponds to an authentication process step in this disclosure, step S306 corresponds to a determination step, steps S310 and S312 correspond to a reply sending step, and steps S316, S320, S322, and S324 correspond to a second direct communication step.

[0114] [3.2.6 Sixth Example of Communication Procedure] Fig. 7 is a sixth example of SOME / IP communication. The SOME / IP communication shown in Fig. 7 is triggered by any ECU 7 in the second control device group 4 multicasting a FindService message in search of a specific service, and the ECU 7 receives a service provided by any ECU 6 in the first control device group 3 that provides the specific service through an Event message and / or a FieldNotification message.

[0115] 7, the same processing steps as those shown in FIG. 6 are denoted by the same reference numerals as those in FIG. 6, and the above description of FIG. 6 is incorporated herein.

[0116] 7, the first communication control unit 31 of the first processing device 26 identifies the server ECU 6 capable of providing the requested service in step S306, and then recognizes from the service information 24 that the server ECU 6 is a device that provides the service in response to receiving a SubscribeEventGroup message regarding the requested service (S350). Then, in response to the above recognition regarding the service provision by the server ECU 6, the first communication control unit 31 transmits an OfferService message in which the communication address of the first processing device 26 itself is set as the Endpoint address to the client ECU 7 according to the conventional technology (S352).

[0117] The client ECU 7 that has received this OfferService message transmits a SubscribeEventGroup message in which the communication address of the client ECU 7 itself is set as the Endpoint address to the first processing device 26 that is the sender of the OfferService message, according to the conventional technique (S354).

[0118] In response to receiving the SubscribeEventGroup message, the first communication control unit 31 of the first processing device 26 generates a SubscribeEventGroup message on behalf of the client ECU 7 that sent the message, setting the communication address of the client ECU 7 as the Endpoint address (S356), and transmits the generated SubscribeEventGroup message to the server ECU 6 identified in step S306 (S358).

[0119] The server ECU 6 receives the SubscribeEventGroup message and acquires the communication address of the client ECU 7, which is the communication partner for providing the service, from the Endpoint address of the received SubscribeEventGroup message (S360). The server ECU 6 transmits a SubscribeEventGroupAck message to the first processing device 26 as an acknowledgement response to the SubscribeEventGroup message transmitted in step S358 (S362).

[0120] The first communication control unit 31 of the first processing device 26 receives the SubscribeEventGroupAck message transmitted in step S362. In response to receiving the SubscribeEventGroupAck message, the first communication control unit 31 transmits a SubscribeEventGroupAck message in which the communication address of the first processing device 26 itself is set as the Endpoint address to the client ECU 7 according to the conventional technology (S364). This SubscribeEventGroupAck message is a response message to the SubscribeEventGroup message transmitted by the client ECU 7 in step S354.

[0121] Thereafter, the server ECU 7 can use the communication address of the client ECU 7 acquired in step S360 to send a message directly to the client ECU 7 via the routing device 8, without going through the first processing device 26 and the second processing device 27 of the communication management device 5. Therefore, thereafter, the server ECU 6 continuously sends data on the provided services to the client ECU 7 at predetermined timings by using Event messages and / or Field Notification messages, without going through the communication management device 5, and the client ECU 7 receives these messages (S366, S368).

[0122] 7, the client ECU 7 and the SubscribeEventGroup message transmitted in step S354 correspond to "one control device" and "a message received from one control device" in this disclosure, respectively. Also, the SubscribeEventGroup message transmitted in step S358 corresponds to "a relay message for relaying a message received from one control device to a control device of the other control device group" in this disclosure.

[0123] In addition, in FIG. 7, steps S356 and S358 correspond to the relay transmission step in this disclosure, and steps S366 and S368 correspond to the first direct communication step.

[0124] [3.2.7 Seventh Example of Communication Procedure] Fig. 8 is a seventh example of SOME / IP communication. The SOME / IP communication shown in Fig. 8 is triggered by multicasting an OfferService message from any ECU 7 in the second control device group 4 indicating that it can provide a specific service, and the ECU 7 receives a Request message from any ECU 6 in the first control device group 3 that requires the specific service, and provides the service to the ECU 6 by a Request message.

[0125] 8, first, any ECU 7 of the second control device group 4 multicasts an OfferService message indicating that a specific service can be provided within the second communication network 10 (S400). Hereinafter, the specific service will be referred to as a "provided service," and the ECU 7 that has transmitted the OfferService message will be referred to as a "server ECU 7."

[0126] The second authentication unit 32 of the second processing device 27 that has received the OfferService message from the server ECU 7 executes a second authentication process for the server ECU 7 (S402). When the second authentication unit 32 cannot authenticate the authenticity of the server ECU 7 in the second authentication process, it ends the process shown in FIG. 8 (not shown).

[0127] Next, the second communication control unit 33 of the second processing device 27 transfers the OfferService message from the server ECU 7 to the first processing device 26 (S404).

[0128] The first processing device 26 receives the OfferService message, and the first communication control unit 31 of the first processing device 26 recognizes from the service information 24 that the server ECU 7 is a device that provides a service in response to receiving a Request message regarding the above-mentioned offered service (S406).

[0129] Next, in response to the above recognition regarding the service provision of the server ECU 7, the first communication control unit 31 generates an OfferService message on behalf of the server ECU 7 that sent the OfferService message in step S400, setting the communication address of the server ECU 7 as the Endpoint address (S408), and multicasts the generated OfferService message to each ECU 6 in the first communication network 9 (S410).

[0130] The OfferService message multicast in step S410 is received by each ECU 6. Among the ECUs 6 in the first communication network 9, any ECU 6 that requires the service indicated by the service ID in the OfferService message (hereinafter, referred to as a client ECU 6) obtains the communication address of the server ECU 7, which is the communication partner, from the Endpoint address of the OfferService message (S412).

[0131] The client ECU 6 transmits a Request message to the server ECU 7 using the acquired communication address of the server ECU 7 (S414). This Request message is received by the server ECU 6 via the routing device 8 without passing through the first processing device 26 and the second processing device 27 of the communication management device 5.

[0132] The server ECU 7 that has received the Request message acquires the communication address of the client ECU 6, which is the communication partner, from the source address of the IP packet of the received Request message (S416). The server ECU 7 uses the acquired communication address of the client ECU 6 to transmit a Response message to the client ECU 6 via the routing device 8 without passing through the first processing device 26 and the second processing device 27 of the communication management device 5 (S418).

[0133] Thereafter, the client ECU 6 and the server ECU 7 use each other's communication addresses obtained in steps S412 and S416, respectively, to repeatedly exchange Request messages and Response messages directly via the routing device 8, without going through the communication management device 5, in accordance with conventional technology (S420, S422).

[0134] 8, the OfferService message transmitted in step S400 received by the server ECU 7 and the first processing device 26 corresponds to "one control device" and "message received from one control device" in the present disclosure, respectively. Also, the OfferService message transmitted in step S410 corresponds to "a relay message for relaying a message received from one control device to a control device of the other control device group based on the message received from the one control device" in the present disclosure.

[0135] Also, in FIG. 8, step S402 corresponds to an authentication processing step in this disclosure, steps S408 and S410 correspond to relay transmission steps, and steps S414, S418, S420, and S422 correspond to a first direct communication step.

[0136] [3.2.8 Example 8 of communication procedure] Fig. 9 is an eighth example of SOME / IP communication. The SOME / IP communication shown in Fig. 9 is started by being triggered by any ECU 7 of the second control device group 4 multicasting an OfferService message indicating that it is capable of providing a specific service, and the ECU 7 provides the service to any ECU 6 of the first control device group 3 that requires the specific service by using an Event message and / or a FieldNotification message.

[0137] In addition, in FIG. 9, the same processing steps as those shown in FIG. 8 are denoted by the same reference numerals as those shown in FIG. 8, and the above description of FIG. 8 is incorporated herein.

[0138] In the example shown in Figure 9, the first communication control unit 31 of the first processing device 26, which receives the OfferService message transferred by the second communication control unit 33 of the second processing device 27 in step S404, recognizes from the service information 24 that the server ECU 7 is a device that provides a service in response to receiving a SubscribeEventGroup message regarding the provided service (S450).

[0139] Then, in response to the above recognition regarding the service provision of the server ECU 7, the first communication control unit 31 multicasts an OfferService message in which the communication address of the first processing device 26 is set as the Endpoint address to each ECU 6 in the first communication network 9 in accordance with conventional technology (S452).

[0140] The OfferService message multicast in step S452 is received by each ECU 6. Among the ECUs 6 in the first communication network 9, any ECU 6 that requires the service indicated by the service ID in the OfferService message (hereinafter, referred to as a client ECU 6) transmits a SubscribeEventGroup message in which the communication address of the client ECU 6 itself is set as an Endpoint to the first processing device 26 that is the sender of the OfferService message, according to the conventional technology (S454).

[0141] In response to receiving the SubscribeEventGroup message sent in step S454, the first communication control unit 31 of the first processing device 26 generates a SubscribeEventGroup message on behalf of the client ECU 6 that sent the message, setting the communication address of the client ECU 6 as the Endpoint address (S456), and sends the generated SubscribeEventGroup message to the server ECU 7 that sent the OfferService message in step S400 (S458).

[0142] The server ECU 7 receives the SubscribeEventGroup message and acquires the communication address of the client ECU 6, which is the communication partner for providing the service, from the Endpoint address of the received SubscribeEventGroup message (S460). The server ECU 6 transmits a SubscribeEventGroupAck message, which is an acknowledgement response to the SubscribeEventGroup message transmitted in step S458, to the first processing device 26 (S462).

[0143] In response to receiving the SubscribeEventGroupAck message, the first communication control unit 31 of the first processing device 26 transmits a SubscribeEventGroupAck message in which the communication address of the first processing device 26 itself is set as the Endpoint address to the client ECU 6 according to the conventional technique (S464). This SubscribeEventGroupAck message is a response message to the SubscribeEventGroup message transmitted by the client ECU 6 in step S454.

[0144] Thereafter, the server ECU 7 can use the communication address of the client ECU 6 acquired in step S460 to send a message directly to the client ECU 6 via the routing device 8, without going through the first processing device 26 and the second processing device 27 of the communication management device 5. Therefore, thereafter, the server ECU 7 continuously sends data on the provided services to the client ECU 6 at predetermined timings by using Event messages and / or Field Notification messages, without going through the communication management device 5, and the client ECU 6 receives these messages (S466, S468).

[0145] In the example shown in FIG. 9, the client ECU 6, the SubscribeEventGroup message sent in step S454, and the SubscribeEventGroup message sent in step S458 correspond to "one of the control devices," "a message received from one of the control devices," and "a relay message for relaying a message received from one of the control devices to a control device of the other control device group" in this disclosure, respectively.

[0146] Also, in FIG. 9, steps S456 and S458 correspond to the relay transmission step in this disclosure, and steps S466 and S468 correspond to the first direct communication step.

[0147] In the vehicle control system 1 having the above configuration, the first authentication unit 30 and the second authentication unit 32 respectively execute a first authentication process for the ECU 6 and a second authentication process for the ECU 7. As a result, even if an attacker replaces either the ECU 6 or the ECU 7 with an unauthorized control device, the vehicle control system 1 can quickly detect this and prevent unauthorized communication related to control from being performed.

[0148] In addition to the above, in the vehicle control system 1, after the first authentication process or the second authentication process is performed, the communication addresses of one or both of the ECU6 or ECU7, which is one control device, and the ECU7 or ECU6, which is the other control device with which the one control device should communicate, are notified to the control device that is the communication partner via a message transmitted by the communication management device 5. Therefore, after the first authentication process or the second authentication process is performed, the ECU6 or ECU7, which is one control device, and the ECU7 or ECU6, which is the other control device, can communicate directly via the routing device 8 without going through the communication management device 5. As a result, the vehicle control system 1 can maintain high responsiveness of vehicle control while appropriately defending against unauthorized communication from an attacker.

[0149] [4. Other embodiments] In the above embodiment, the IP addresses in the SourceAddress field and DestinationAddress field of the IP header are used as the communication addresses of the source and destination of the IP packet, but in addition to this, the port numbers in the SourcePort field and DestinationPort field of the UDP header may be used.Furthermore, in the above embodiment, the IP address in the IPv4 Address field (or IPv6 Address field) of the SOME / IP-SD header is used as the Endpoint address of the SOME / IP communication message, but in addition to this, the port number in the PortNumber field of the SOME / IP-SD header may be used.

[0150] The present invention is not limited to the configurations of the above-described embodiments, and can be embodied in various forms without departing from the spirit and scope of the present invention.

[0151] [5. Configuration supported by the above embodiment] The above-described embodiment supports the following configurations.

[0152] (Configuration 1) A vehicle control system comprising two control device groups each constituting two different communication networks mounted on a vehicle, a communication management device communicatively connected to each of the control devices of the two control device groups, and a routing device that routes communication between the two communication networks, wherein when the communication management device receives a message from any of the control devices, it performs an authentication process for any of the control devices, and when the legitimacy of any of the control devices has been authenticated, it sends a relay message for relaying a message received from one of the control devices which is a control device of one of the control device groups to a control device of the other of the control device groups, the relay message including the communication address of the one of the control devices as a source address, and the control device of the other of the control device groups starts communication with the one of the control devices via the routing device without going through the communication management device, using the communication address of the one of the control devices included in the relay message. According to the vehicle control system of configuration 1, unauthorized communications from an attacker to the vehicle control system are quickly detected and defended against through authentication processing, and after the authentication processing, two control devices belonging to different communication networks can communicate directly without going through a communication management device by notifying the sender address through a relay message, thereby maintaining high responsiveness of vehicle control.

[0153] (Configuration 2) When the communication management device is able to authenticate the legitimacy of one of the control devices, it identifies the communication address of the other control device, which is a control device of the other control device group with which the one control device, which is a control device of one of the control device groups that sent the message, should communicate, based on device information for each of the control devices of the two control device groups, and sends a reply message to the one control device, which includes the communication address of the identified other control device as a source address, and the one control device uses the communication address of the other control device included in the reply message to start communication with the other control device via the routing device without going through the communication management device, in the vehicle control system described in configuration 1. According to the vehicle control system of configuration 2, unauthorized communications from an attacker to the vehicle control system are quickly detected and defended against through authentication processing, and after the authentication processing, the communication address of the communication partner of one of the control devices is notified to the other control device through a reply message, so that two control devices belonging to different communication networks can communicate directly without going through a communication management device, thereby maintaining high responsiveness of vehicle control.

[0154] (Configuration 3) A vehicle control system described in configuration 1 or 2, wherein one of the two control device groups includes a control device that performs control related to the motion control of the vehicle and does not include a control device that communicates with the outside of the vehicle, and the other of the two control device groups includes a control device that communicates with the outside of the vehicle and does not include a control device that performs control related to the motion control of the vehicle. According to the vehicle control system of configuration 3, the control device group that communicates with the outside of the vehicle and is susceptible to attacks from outside the vehicle is connected to a communication network different from the communication network to which the control device group related to the vehicle motion control belongs, and a communication management device connected to these two communication networks authenticates the validity of the control device that is about to start communication. As a result, the vehicle control system of configuration 3 can more appropriately defend the vehicle motion control against external attacks and further improve the safety of the vehicle control.

[0155] (Configuration 4) A vehicle control system described in any of configurations 1 to 3, wherein the communication management device has two processing devices that perform processing independently of each other, and the two processing devices are each connected to different one of the two communication networks. According to the vehicle control system of configuration 4, two independent processing devices respectively connected to two communication networks cooperate to perform authentication operations in the communication management device and generate relay messages or reply messages. Therefore, the vehicle control system of configuration 4 makes it difficult for an attacker to spoof the operation of the communication management device, thereby further improving the safety of vehicle control.

[0156] (Configuration 5) The vehicle control system according to configuration 4, wherein the two processing devices are a physical machine and a virtual machine, respectively, realized in a processor provided in the communication management device. According to the vehicle control system of configuration 5, two processing devices that perform processing independently of each other are realized in a single processor provided in the communication management device, thereby improving the safety of vehicle control without complicating the hardware configuration of the communication management device.

[0157] (Configuration 6) A vehicle control system described in any of configurations 1 to 5, wherein the communication between the control devices of the two control device groups and the communication management device is Service Oriented Middle WarE Over IP (SOME / IP) communication, including the transmission of a search notification that one of the services, which is a predetermined functional unit, is being searched for, and / or the transmission of a provision notification that the searched service is available. According to the vehicle control system of configuration 6, in SOME / IP communication that can efficiently realize complex coordinated operations of multiple control devices, it is possible to quickly detect and appropriately defend against unauthorized communications from attackers while maintaining high responsiveness of vehicle control.

[0158] (Configuration 7) A communication processing method executed by a vehicle control system including two control device groups each constituting two different communication networks mounted on a vehicle, a communication management device communicatively connected to each of the control devices of the two control device groups, and a routing device that routes communication between the two communication networks, the communication processing method including: an authentication processing step in which, when the communication management device receives a message from any of the control devices, the communication management device performs an authentication process for the any of the control devices; a relay transmission step in which, when the legitimacy of any of the control devices can be authenticated, the communication management device transmits a relay message for relaying a message received from one of the control devices, which is a control device of one of the control device groups, to a control device of the other of the control device groups, the relay message including the communication address of the one of the control devices as a source address; and a first direct communication step in which the control device of the other of the control device groups communicates with the one of the control devices via the routing device without going through the communication management device, using the communication address of the one of the control devices included in the relay message. According to the communication processing method of configuration 7, unauthorized communications from an attacker to the vehicle control system are quickly detected and defended against through authentication processing, and after the authentication processing, two control devices belonging to different communication networks can communicate directly without going through a communication management device by notifying the sender address through a relay message, thereby maintaining high responsiveness of vehicle control.

[0159] (Configuration 8) A communication processing method as described in configuration 7, comprising: an identification step in which, when the legitimacy of one of the control devices can be authenticated, the communication management device identifies the communication address of the other control device, which is a control device of the other control device group with which the one control device, which is a control device of one of the control device groups that sent a message, should communicate, based on device information for each of the two control device groups; a reply sending step in which the communication management device sends to the one of the control devices a reply message including the communication address of the identified other control device as a source address; and a second direct communication step in which the one of the control devices uses the communication address of the other control device included in the reply message to communicate with the other control device via the routing device without going through the communication management device. According to the communication processing method of configuration 8, unauthorized communications from an attacker to the vehicle control system are quickly detected and defended against through authentication processing, and after the authentication processing, the communication address of the communication partner of one of the control devices is notified to the other of the control devices through a reply message, so that two control devices belonging to different communication networks can communicate directly without going through a communication management device, thereby maintaining high responsiveness of vehicle control. [Explanation of symbols]

[0160] 1...vehicle control system, 2...vehicle, 3...first control device group, 4...second control device group, 5...communication management device, 6, 7...ECU, 6a...drive ECU, 6b...steering ECU, 6c...battery ECU, 6d...ADAS-ECU, 7a...TCU, 7b...IVI-ECU, 7c...DMC-ECU, 8...routing device, 9...first communication network, 10...second communication network, 11...third communication network, 20...processor, 21...memory, 22a...first communication device, 22b...second communication device, 23...identification information, 24...service information, 25a...first program, 25b...second program, 26...first processing device, 27...second processing device, 30...first authentication unit, 31...first communication control unit, 32...second authentication unit, 33...second communication control unit, 40...hub, 41...device, 41a...device A, 41b...device B.

Claims

1. A vehicle control system including two control device groups constituting two different communication networks mounted on a vehicle, a communication management device communicatively connected to each of the control devices of the two control device groups, and a routing device that routes communication between the two communication networks, The communication management device includes: When a message is received from any one of the control devices, an authentication process is performed for the one of the control devices; When the authenticity of any of the control devices is authenticated, a relay message is sent to relay a message received from one of the control devices, which is a control device of one of the control device groups, to a control device of the other of the control device groups, the relay message including the communication address of the one of the control devices as a source address; a control device of the other control device group uses the communication address of the one control device included in the relay message to start communication with the one control device via the routing device without going through the communication management device; The communication management device includes: When the authenticity of any of the control devices is authenticated, Identifying a communication address of a control device of the other control device group with which the one control device, which is a control device of one control device group that has transmitted a message, should communicate, based on device information about the respective control devices of the two control device groups; Transmitting a reply message including the communication address of the identified other control device as a source address to the one control device; the one control device uses the communication address of the other control device contained in the reply message to start communication with the other control device via the routing device without going through the communication management device; Vehicle control system.

2. A vehicle control system including two control device groups constituting two different communication networks mounted on a vehicle, a communication management device communicatively connected to each of the control devices of the two control device groups, and a routing device that routes communication between the two communication networks, The communication management device includes: When a message is received from any one of the control devices, an authentication process is performed for the one of the control devices; When the authenticity of any of the control devices is authenticated, a relay message is sent to relay a message received from one of the control devices, which is a control device of one of the control device groups, to a control device of the other of the control device groups, the relay message including the communication address of the one of the control devices as a source address; a control device of the other control device group uses the communication address of the one control device included in the relay message to start communication with the one control device via the routing device without going through the communication management device; Two processing devices are provided for performing processing independently of each other, the two processing devices are each connected to a different one of the two communication networks; Vehicle control system.

3. One of the two control device groups includes a control device that performs control related to motion control of the vehicle, and does not include a control device that communicates with the outside of the vehicle; the other of the two control device groups includes a control device that communicates with the outside of the vehicle, and does not include a control device that performs control related to motion control of the vehicle; 3. A vehicle control system according to claim 1 or 2.

4. The two processing devices are a physical machine and a virtual machine, respectively, implemented in a processor included in the communication management device. The vehicle control system according to claim 2 .

5. The communication between the control devices of the two control device groups and the communication management device is Service Oriented Middle WarE Over IP (SOME / IP) communication, including the transmission of a search notification that is a notification that one of the services, which is a predetermined functional unit, is being searched for, and / or the transmission of a provision notification that is a notification that the searched service can be provided. A vehicle control system according to any one of claims 1 to 4.

6. A communication processing method executed by a vehicle control system including two control device groups constituting two different communication networks mounted on a vehicle, a communication management device communicatively connected to each of the control devices of the two control device groups, and a routing device that routes communication between the two communication networks, an authentication processing step in which, when the communication management device receives a message from any one of the control devices, the communication management device performs an authentication process for the any one of the control devices; a relay transmission step in which, when the authenticity of any of the control devices can be authenticated, the communication management device transmits a relay message for relaying a message received from one of the control devices, which is a control device of one of the control device groups, to a control device of the other of the control device groups, the relay message including the communication address of the one of the control devices as a source address; a first direct communication step in which a control device of the other control device group communicates with the one control device via the routing device without going through the communication management device, by using the communication address of the one control device included in the relay message; a step of, when the authenticity of any one of the control devices can be authenticated, the communication management device specifies a communication address of a control device of the other control device group with which the one control device, which is a control device of one control device group that has transmitted a message, should communicate, based on device information about the control devices of the two control device groups; A reply transmission step in which the communication management device transmits a reply message including the communication address of the identified other control device as a source address to the one control device; A second direct communication step in which the one control device communicates with the other control device via the routing device without going through the communication management device, using the communication address of the other control device included in the reply message; A communication processing method comprising the steps of:

7. A communication processing method executed by a vehicle control system including two control device groups constituting two different communication networks mounted on a vehicle, a communication management device communicatively connected to each of the control devices of the two control device groups, and a routing device that routes communication between the two communication networks, The vehicle control system includes two processing devices that perform processing independently of each other; the two processing devices are connected to different communication networks of the two communication networks, an authentication processing step in which, when the communication management device receives a message from any one of the control devices, the communication management device performs an authentication process for the any one of the control devices; a relay transmission step in which, when the authenticity of any of the control devices can be authenticated, the communication management device transmits a relay message for relaying a message received from one of the control devices, which is a control device of one of the control device groups, to a control device of the other of the control device groups, the relay message including the communication address of the one of the control devices as a source address; a first direct communication step in which a control device of the other control device group communicates with the one control device via the routing device without going through the communication management device, by using the communication address of the one control device included in the relay message; A communication processing method comprising the steps of:

Images