Monitoring device, monitoring system and computer program

Abstract

Monitoring device, which is a first of a plurality of monitoring devices to be attached to a means of transport (10), wherein the first monitoring device is designed to monitor an abnormal condition of a first monitoring object, wherein the monitoring device comprises: a receiver (44) designed to receive a detection result of an abnormality detected by a second monitoring device which monitors an abnormal condition of a second monitoring object which is different from the first monitoring object; and a control unit (46) designed to modify an operation to be carried out by the monitoring device according to the detection result of the abnormality detected by the second monitoring device, wherein the first monitoring device is an entry gate device (12) and the first monitoring object is an entry gate device or a network (18) outside the means of transport (10), and the second monitoring device is an electronic control unit (14, 16) and the second monitoring object is an electronic control unit or a network (20, 22) in the means of transport (10).

Description

Technical area

[0001] The present disclosure relates to a data processing technique and, more particularly, to a monitoring device, a monitoring system and a computer program. Technical background

[0002] Recently, a vehicle includes a plurality of electronic devices and a plurality of network areas (NW areas). Each of the plurality of electronic devices may have a security function. The electronic devices mounted on the vehicle may include, for example: (1) entry gate devices such as an on-board infotainment device and a telematics control unit; (2) network devices such as a gateway and an Ethernet switch ("Ethernet" is a registered trademark); and (3) electronic control devices (hereinafter referred to as "ECUs") that control end systems in the vehicle.

[0003] Patent Document 2 discloses a fraud detection rule update method that enables the updating of rules serving as the basis for detecting malicious frames in an on-board power system. In an on-board power system equipped with multiple electronic control units (ECUs) communicating via buses and fraud detection control units that determine whether messages transmitted on the buses conform to the rules based on fraud detection rules, a fraud detection rule update method is implemented by receiving updated fraud detection rules from a server external to the on-board power system, and updating the fraud detection rules in a fraud detection ECU to the updated fraud detection rules when a specified update condition is met.

[0004] Patent Document 3 discloses an anomaly handling method capable of suppressing the effects of unauthorized control of a vehicle. In an anomaly handling method applied to one or a plurality of electronic control units installed in a vehicle, an inter-vehicle communication message transmitted from a device installed in another vehicle is received as an anomaly detection message. The anomaly detection message is output when an unauthorized frame is detected in another vehicle's on-board network. An anomaly detection processing is selected from a plurality of predetermined anomaly processing processes in accordance with the received content, for example, to transition to a safe state, and the selected anomaly treatment processing is executed. BibliographyPatent literature Patent Document 1: Unexamined Japanese Patent Publication No. 2017-47835 Patent document 2: unexamined US patent publication US 2017 / 0147812 A1 Patent document 3: unexamined US patent publication US 2016 / 0 373 449 A1 Summary of the invention

[0005] The present disclosure appropriately controls operations related to the safety of a means of transportation, such as a vehicle.

[0006] A monitoring device according to one aspect of the present disclosure is one of a plurality of monitoring devices to be mounted on a vehicle. The monitoring device is configured to monitor an abnormal state of a first monitoring object. The monitoring device includes a receiver and a control unit. The receiver is configured to receive a detection result of an abnormality detected by another monitoring device that monitors an abnormal state of a second monitoring object different from the first monitoring object. The control unit is configured to change an operation to be performed by the monitoring device according to the detection result of the abnormality detected by the other monitoring device.

[0007] A monitoring device according to another aspect of the present disclosure includes a first monitoring device and a second monitoring device. The first monitoring device is to be mounted on the vehicle. The first monitoring device is configured to detect whether or not a first monitoring object is in an abnormal state and is configured to transmit an abnormality detection result to the second monitoring device that monitors a second monitoring object different from the first monitoring object. The second monitoring device is to be mounted on the vehicle. The second monitoring device is configured to receive the abnormality detection result transmitted from the first monitoring device and is configured to change an operation to be performed by the second monitoring device according to the abnormality detection result.

[0008] Any combination of the above components and expressions of the present disclosure are converted into a computer program, a recording medium that records the computer program, and a means of transportation, such as a vehicle, on which the monitoring device is mounted. The computer program, the recording medium that records the computer program, and the means of transportation, such as a vehicle, on which the monitoring device is mounted, are also usable as aspects of the present disclosure.

[0009] The present disclosure appropriately controls operations related to the safety of a means of transportation, such as a vehicle. Short description of the drawing Fig. 1 schematically illustrates a structure of a vehicle according to an exemplary embodiment. Fig. 2 is a block diagram showing a functional arrangement of a Controller Area Network monitoring ECU (CAN monitoring ECU) in Fig. 1 represents. Fig. 3 is a flowchart showing operations of the CAN monitoring ECU in Fig. 1 represents. Fig. Figure 4 shows an example of switching between operations of an on-board infotainment device in Fig. 1. Fig. Figure 5 shows an example of switching between operations of an Ethernet network monitoring ECU in Fig. 1. Fig. 6 shows an example of switching between operations of the CAN monitoring ECU in Fig. 1. Fig. 7 illustrates an example of switching between operations of an on-board infotainment device in a first example of the modifications. Fig. 8 illustrates an example of switching between operations of an on-board infotainment device in a second example of the modifications. Fig. 9 is a block diagram showing a functional arrangement of a CAN monitoring ECU in a third example of the modifications. Fig. 10 illustrates an example of switching between operations of an on-board infotainment device in the third example of the modifications. Description of an embodiment

[0010] Before describing an exemplary embodiment of the present disclosure, problems of a conventional technique will be briefly described. It is conceivable that security functions are provided to a plurality of electronic devices mounted on a vehicle. The security functions each include a monitoring function that monitors an electronic device for which the monitoring function is provided or that monitors a network. Further, when the monitoring functions detect an attack, a procedure is needed that enables the vehicle to operate safely. However, each of the electronic devices monitors a limited area. Further, the monitoring functions may detect a false attack.Therefore, if each of the monitoring devices performs an operation corresponding to an attack detected by the monitoring device, the control may be excessive with respect to conditions of the entire vehicle.

[0011] Before describing a detailed arrangement of the exemplary embodiment, an overview of an arrangement of the exemplary embodiment will be described here. In the exemplary embodiment, a plurality of monitoring devices are mounted on a vehicle. The plurality of monitoring devices monitor the states of various objects (also referred to as components of the vehicle). Each of the monitoring devices monitors a restricted area. Furthermore, there is a certain possibility that each of the monitoring devices may falsely detect an abnormality in a monitoring object, even though the monitoring object is actually normal.Therefore, if each of the monitoring devices performs an operation that thwarts an attack detected by the monitoring device and an operation that enables the vehicle to be safe (also called a “fail-safe operation”) based on a monitoring result performed by the monitoring device, the shutdown operation and the fail-safe operation may be excessive for states of the entire vehicle.

[0012] In a vehicle in the exemplary embodiment, a plurality of monitoring devices detect states of respective monitoring objects and report the states of respective monitoring objects to each other. Thus, each of the monitoring devices can access states of the vehicle that cannot be detected by itself. Therefore, each of the monitoring devices can appropriately perform data processing related to the safety of the vehicle based on states of the vehicle that cannot be detected by itself. Further, each of the monitoring devices appropriately adapts a form of data processing or appropriately switches between forms of data processing based on the states of the vehicle that it cannot detect by itself.

[0013] In the following description, normality of a monitoring object includes a state in which the monitoring object is not under attack by a device external to the monitoring object (e.g., by malicious frames). Furthermore, normality of a monitoring object includes a state in which firmware is running that is legitimate and has not been tampered with. Furthermore, abnormality of a monitoring object includes a state in which the monitoring object is under attack by a device external to the monitoring object (e.g., by malicious frames). Furthermore, abnormality of a monitoring object includes a state in which malicious or tampered firmware is running.

[0014] Fig. 1 schematically illustrates a structure of a vehicle 10 according to the exemplary embodiment. The vehicle 10 includes a network in the vehicle 10 (hereinafter referred to as "on-board network"). The on-board network includes an Ethernet network 20 and a Controller Area Network (CAN) 22. The vehicle 10 also includes a variety of monitoring devices, namely the on-board infotainment device 12, the Ethernet network monitoring electronic control unit (Ethernet network monitoring ECU) 14, and the CAN monitoring ECU 16. The monitoring devices monitor states of objects related to the vehicle 10 that have been predetermined. The monitoring objects include elements inside the vehicle 10 and elements located outside the vehicle 10 and connected to the vehicle 10 (e.g., an off-vehicle network).

[0015] The on-board infotainment device 12 is an electronic device that provides various information to a user. For example, the on-board infotainment device 12 may include a car navigation function and an audio function. The on-board infotainment device 12 is connected to the off-vehicle network 18, such as the Internet, to communicate with devices outside the vehicle 10. The on-board infotainment device 12 detects whether the off-vehicle network 18 is in an abnormal state. For example, the on-board infotainment device 12 receives a message transmitted by the off-vehicle network 18 and detects whether the message is abnormal.

[0016] The Ethernet network monitoring ECU 14 includes an interface between the Ethernet network monitoring ECU 14 and the Ethernet network 20. The Ethernet network monitoring ECU 14 monitors the Ethernet network 20 and detects whether or not the Ethernet network 20 is in an abnormal state. More specifically, when an Ethernet frame, which is a message sent through the Ethernet network 20, is abnormal, the Ethernet network monitoring ECU 14 detects an Ethernet network 20 that is in an abnormal state. The Ethernet network monitoring ECU 14 may be a relay device located in the Ethernet network 20 and having a monitoring function.

[0017] The CAN monitoring ECU 16 includes an interface between the CAN monitoring ECU 16 and the CAN 22. The CAN monitoring ECU 16 monitors the CAN 22 and detects whether or not the CAN 22 is in an abnormal state. Specifically, when a CAN frame, which is a message transmitted through the CAN 22, is abnormal, the CAN monitoring ECU 16 detects a CAN 22 that is in an abnormal state. The CAN network monitoring ECU 16 may be a relay device located in the CAN 22 and having a monitoring function.

[0018] The on-board infotainment device 12 is connected to the Ethernet network monitoring ECU 14 via the Ethernet network 20. The on-board infotainment device 12 is connected to the CAN monitoring ECU 16 via the CAN 22. Further, the on-board infotainment device 12 or a predetermined gateway (not shown) connects the Ethernet network monitoring ECU 14 to the CAN monitoring ECU 16. Each of the messages may include a command issued to another device(s).

[0019] Fig. 2 is a block diagram showing a functional arrangement of a CAN monitoring ECU 16 in Fig. 1. The CAN monitoring ECU 16 includes a frame receiver 30, a frame inhibit unit 31, a monitoring unit 32, a protocol storage part 38, a protocol transmitter 40, a monitoring result transmitter 42, a monitoring result receiver 44, and a sequence control unit 46.

[0020] In the block diagram in the description, the hardware portion of each of the blocks may consist of elements of a computer, such as a central processing unit (CPU) and memory, and mechanical devices. Furthermore, the software portion of each of the blocks may be a computer program. However, in the block diagram, each of the blocks depicted is a functional block that includes the hardware portion and the software portion that interact with each other. Those skilled in the art will understand that each of the functional blocks may exist in various forms, each including a combination of the hardware and software.

[0021] A computer program that contains modules corresponding to the blocks in Fig. 2 may be stored in a recording medium. The computer program may be loaded into the CAN monitoring ECU 16 from the recording medium. The computer program may be loaded into the CAN monitoring ECU 16 via the networks. A CPU of the CAN monitoring ECU 16 may perform functions of each of the blocks by appropriately reading and executing the computer program.

[0022] The monitoring unit 32 monitors the predetermined states of monitoring objects related to the vehicle 10. The monitoring unit 32 is also referred to as an abnormality detection unit and detects whether or not each of the monitoring objects is in an abnormal state. The monitoring unit 32 includes a network monitoring unit 34 and a host monitoring unit 36.

[0023] The frame receiver 30 receives CAN frames that devices outside the CAN monitoring ECU 16 (e.g., other ECUs such as a brake ECU) output into the CAN 22. The network monitoring unit 34 detects whether a CAN frame received by the frame receiver 30 (also referred to as a "receive frame") is abnormal or not. For example, the network monitoring unit 34 may store a blacklist showing CAN identifiers (CAN IDs) that should be blocked. If a CAN ID associated with a receive frame corresponds to one of the CAN IDs stored in the blacklist, the network monitoring unit 34 may detect an abnormality in the receive frame. Alternatively, the network monitoring unit 34 may store a whitelist showing legitimate CAN IDs. The network monitoring unit 34 may detect an abnormality in a reception frame assigned a CAN ID that does not conform to the white list.If a receive frame is an Ethernet frame, the network monitoring unit 34 determines whether the receive frame is normal or abnormal based on a Media Access Control (MAC) address associated with the receive frame.

[0024] Alternatively, the network monitoring unit 34 determines whether a received frame is abnormal based on a cycle of messages (e.g., an interval between receptions of messages each having the same CAN ID). Alternatively, the network monitoring unit 34 determines whether a received frame is abnormal based on a scatter characteristic of data shown in a message. For example, the network monitoring unit 34 determines that a received frame is abnormal if the amount of scatter of speed data shown in messages each having the same CAN ID exceeds a predetermined threshold.

[0025] If the network monitoring unit 34 determines that a received frame is abnormal, the frame blocking unit 31 performs an operation to block the received frame. For example, the frame blocking unit 31 can block a received frame transmitted over the CAN 22 by outputting an error frame corresponding to the received frame into the CAN 22. An error frame does not block a received frame transmitted over some networks (e.g., an Ethernet network). If a monitoring object is such a network, the frame blocking unit 31 can filter (remove) a received frame in which an abnormality is detected, or can perform a forwarding operation to disallow the received frame from being output to the network again.

[0026] The host monitoring unit 36 ​​uses a publicly known technique, such as a digital signature, to detect an abnormality in the CAN monitoring ECU 16. Specifically, the host monitoring unit 36 ​​checks whether legitimate firmware is stored in the CAN monitoring ECU 16. In other words, the host monitoring unit 36 ​​detects whether the firmware of the CAN monitoring ECU 16 has been tampered with. The host monitoring unit 36 ​​performs what is called secure booting. That is, when the CAN monitoring ECU 16 is activated, the host monitoring unit 36 ​​checks whether the firmware has been tampered with. Furthermore, when (or immediately before) an application is running in the CAN monitoring ECU 16, the host monitoring unit 36 ​​can check whether the application has been tampered with.

[0027] Furthermore, when the host monitoring unit 36 ​​detects an operation that does not comply with the prescribed access control, which is a function by which an operating system such as a kernel restricts certain processes and access to certain files, the host monitoring unit 36 ​​determines that the CAN monitoring ECU 16 is abnormal. For example, when firmware or an application accesses a specific file to which access is prohibited by the firmware and the application due to the prescribed access control that has been predetermined, the host monitoring unit 36 ​​may determine that the CAN monitoring ECU 16 or the firmware of the CAN monitoring ECU 16 is abnormal.

[0028] The log storage part 38 stores a monitoring log in a predetermined memory area. The monitoring log shows a result of the monitoring performed by the monitoring unit 32 (in other words, a detection result of an abnormality). For example, the log storage part 38 may store a monitoring log in a non-volatile memory in the CAN monitoring ECU 16. The monitoring log shows that the network monitoring unit 34 detects a CAN 22 (or a frame transmitted via the CAN 22) that is normal, or shows that the network monitoring unit 34 detects a CAN 22 (or a frame transmitted via the CAN 22) that is abnormal. Further, the log storage part 38 may store a monitoring log in a non-volatile memory in the CAN monitoring ECU 16.The monitoring log shows that the host monitoring unit 36 ​​detects a CAN monitoring ECU 16 (or firmware of the CAN monitoring ECU 16) that is normal, or shows that the host monitoring unit 36 ​​detects a CAN monitoring ECU 16 (or firmware of the CAN monitoring ECU 16) that is abnormal.

[0029] The log transmitter 40 transmits a monitoring log to devices external to the CAN monitoring ECU 16, indicating a result of the monitoring performed by the monitoring unit 32. For example, the log transmitter 40 may transmit monitoring logs to predetermined entry gate devices (e.g., the onboard infotainment device 12 and a telematics control unit), each of which indicates that the network monitoring unit 34 detects a CAN 22 that is normal, or indicates that the network monitoring unit 34 detects a CAN 22 that is abnormal. The entry gate devices (e.g., the onboard infotainment device 12 and a telematics control unit) may store the monitoring logs.Further, the log transmitter 40 may send to the input gate devices monitor logs each showing that the host monitor unit 36 ​​detects a CAN monitor ECU 16 that is normal or showing that the host monitor unit 36 ​​detects a CAN monitor ECU 16 that is abnormal.

[0030] The monitoring result transmitter 42 transmits a result of the monitoring performed by the monitoring unit 32 to the other monitoring devices (in the exemplary embodiment, the on-board infotainment device 12 and the Ethernet network monitoring ECU 14). The monitoring result includes data indicating that the network monitoring unit 34 detects a CAN 22 that is normal or indicating that the network monitoring unit 34 detects a CAN 22 that is abnormal. Further, the monitoring result includes data indicating that the host monitoring unit 36 ​​detects a CAN monitoring ECU 16 that is normal or indicating that the host monitoring unit 36 ​​detects a CAN monitoring ECU 16 that is abnormal.

[0031] The monitoring result receiver 44 receives a detection result of an abnormality transmitted from each of the other monitoring devices. For example, the monitoring result receiver 44 receives a monitoring result of the off-vehicle network 18 and a host monitoring result from the on-board infotainment device 12. Furthermore, the monitoring result receiver 44 receives a monitoring result of Ethernet frames and a host monitoring result from the Ethernet network monitoring ECU 14.

[0032] Based on the detection results of abnormalities detected by other monitoring devices, the sequence control unit 46 changes a safety-related process executed by the CAN monitoring ECU 16 or switches between behaviors of the vehicle 10. As described below, the sequence control unit 46 changes various types of operations. Examples 1 to 4 of the following operations to be changed are safety-related processes executed by the CAN monitoring ECU 16. Example 1 of processes to be changed: Monitoring form

[0033] The sequence control unit 46 can switch between forms of operations of the monitoring unit 32. For example, the sequence control unit 46 can switch between operations used to detect whether the CAN monitoring ECU 16 or the CAN 22 is in an abnormal state. More specifically, the sequence control unit 46 can switch between monitoring rules of the monitoring unit 32. For example, the sequence control unit 46 can switch between a rule under which an allowable range considered normal is wide and a rule under which an allowable range is narrow.

[0034] For example, a network monitoring rule under which a permissible range is wide may be a rule under which a relatively wide range of a spread width of a cycle or data is considered normal. For example, a network monitoring rule under which a permissible range is narrow may be a rule under which a relatively narrow range of a spread width of a cycle or data is considered normal. Further, for example, a host monitoring rule under which a permissible range is wide may be a rule under which a relatively small number of program elements or a relatively small number of program types are objects to be detected, which are used to detect at least one of tampering and violation of prescribed access control.For example, a host monitoring rule under which a permissible scope is narrow may be a rule under which a relatively large number of program elements or a relatively large number of program types are objects to be detected, which are used to detect at least one of tampering and violation of prescribed access control.

[0035] Furthermore, the state machine 46 can expand or narrow the scope monitored by the monitoring unit 32. For example, the state machine 46 can allow the monitoring unit 32 to detect tampering with middleware. Alternatively, the state machine 46 can allow the monitoring unit 32 to detect tampering with middleware and tampering with each of the applications. Furthermore, the state machine 46 can switch between times at which the monitoring unit 32 monitors. For example, the state machine 46 can allow the monitoring unit 32 to check whether the software has been tampered with only at a software startup time. Alternatively, the state machine 46 can allow the monitoring unit 32 to regularly check whether a plurality of software elements have been tampered with. Example 2 of operations to be changed: Form of locking a control

[0036] The sequencer 46 can switch between forms of operations of the frame locking unit 31. More specifically, a CAN frame in which an abnormality is detected can be locked with an error frame. Alternatively, a CAN frame in which an abnormality is detected can not be locked but can be recorded. Furthermore, the sequencer 46 can allow or disallow the frame locking unit 31 to filter (e.g., remove) a message (e.g., a CAN frame or an Ethernet frame) in which an abnormality is detected. Example 3 of processes to be changed: Form of recording an abnormality

[0037] The sequencer 46 can switch between forms of operations of the log storage part 38. More specifically, the sequencer 46 can allow or disallow the log storage part 38 to store audit logs in the non-volatile memory. Further, the sequencer 46 can switch between objects stored in an audit log. For example, the sequencer 46 can only allow the log storage part 38 to store a message in which an abnormality is detected. Alternatively, the sequencer 46 can allow the log storage part 38 to store a message in which an abnormality is detected, a predetermined number of messages before the message in which an abnormality is detected, and a predetermined number of messages after the message in which an abnormality is detected.The latter form is useful for detecting an indication of an occurrence of an abnormality or a trend in the occurrence of an abnormality. Example 4 of processes to be changed: Form of reporting an abnormality

[0038] The sequencer 46 can switch between modes of operation of the log transmitter 40. More specifically, the sequencer 46 can allow or disallow the log transmitter 40 to send monitoring logs to a Security Operations Center (SOC, not shown) external to the vehicle 10. Furthermore, the sequencer 46 can allow or disallow the log transmitter 40 to send monitoring logs to the other monitoring devices (on-board infotainment device 12, telematics control unit). Example 5 of operations to be changed: Form of operation of the vehicle

[0039] The sequence control unit 46 can switch between a state in which an autonomous driving function of the vehicle 10 is enabled and a state in which the autonomous driving function of the vehicle 10 is disabled. In this case, the sequence control unit 46 can send a command to an autonomous driving control device (not shown) or an ECU of a driver assistance system (DAS) (not shown) of the vehicle 10 to enable the autonomous driving function (in other words, to start the autonomous driving function). Alternatively, the sequence control unit 46 can send a command to an autonomous driving control device (not shown) or an ECU of a driver assistance system (DAS) (not shown) of the vehicle 10 to disable the autonomous driving function (in other words, to terminate the autonomous driving function).Further, the sequence control unit 46 may cooperate with the autonomous driving control device, the FAS, or other ECU(s) to switch between a state in which a fail-safe operation (e.g., an operation that terminates autonomous driving) is enabled in the vehicle 10 and a state in which the fail-safe operation is disabled in the vehicle 10.

[0040] A functional arrangement of the on-board infotainment device 12 is similar to the functional arrangement of the CAN monitoring ECU 16 ( Fig. 2). One difference is that the frame receiver 30 of the on-board infotainment device 12 receives communication frames from the off-vehicle network 18. Further, the monitoring result transmitter 42 of the on-board infotainment device 12 transmits monitoring results to the Ethernet network monitoring ECU 14 and the CAN monitoring ECU 16. Further, the monitoring result receiver 44 of the on-board infotainment device 12 receives monitoring results from the Ethernet network monitoring ECU 14 and the CAN monitoring ECU 16. Furthermore, the frame inhibition unit 31 of the on-board infotainment device 12 may filter (e.g., remove) a received frame instead of transmitting an error frame based on an address of the received frame, a cycle of the received frame, or a scattering characteristic of data of the received frame.

[0041] A functional arrangement of the Ethernet network monitoring ECU 14 is similar to the functional arrangement of the CAN monitoring ECU 16 ( Fig. 2). One difference is that the frame receiver 30 of the Ethernet network monitoring ECU 14 receives frames from the Ethernet network 20. Further, the monitoring result transmitter 42 of the Ethernet network monitoring ECU 14 transmits monitoring results to the on-board infotainment device 12 and the CAN monitoring ECU 16. Further, the monitoring result receiver 44 of the Ethernet network monitoring ECU 14 receives monitoring results from the on-board infotainment device 12 and the CAN monitoring ECU 16. Furthermore, the frame inhibition unit 31 of the Ethernet network monitoring ECU 14 may filter (e.g., remove) a received frame instead of transmitting an error frame based on an address of the received frame, a cycle of the received frame, or a scattering characteristic of data of the received frame.

[0042] Fig. 3 is a flowchart showing operations of the CAN monitoring ECU 16 in Fig. 1 represents. Fig. 3 mainly illustrates monitoring operations and safety-related operations among the operations performed by the CAN monitoring ECU 16. The other monitoring devices of the vehicle 10, that is, the on-board infotainment device 12 and the Ethernet network monitoring ECU 14, respectively perform monitoring operations and safety-related operations similar to the monitoring operations and safety-related operations performed by the CAN monitoring ECU 16.

[0043] When the frame receiver 30 receives a CAN frame from the CAN 22 (Y in S10), the network monitoring unit 34 determines whether the CAN frame received by the frame receiver 30 is normal or not (S12). If no CAN frame has been received (N in S10), S12 is skipped. At a time of host monitoring (for example, at a time when the CAN monitoring ECU 16 is enabled or at a time when a predetermined period of time has elapsed from a previous host monitoring) (Y in S14), the host monitoring unit 36 ​​checks whether firmware stored in the memory of the CAN monitoring ECU 16 is normal or not (S16). If it is not a time of host monitoring (N in S14), S16 is skipped. Network monitoring and host monitoring are performed in an arbitrary order. Furthermore, network monitoring and host monitoring can be performed simultaneously.

[0044] In response to at least one of a host monitoring result and a network monitoring result, the log storage part 38 stores a log showing the host monitoring result and the network monitoring result in a predetermined storage area (S18). In response to at least one of a host monitoring result and a network monitoring result, the log transmitter 40 transmits a log showing the host monitoring result and the network monitoring result to predetermined devices external to the CAN monitoring ECU 16 (S20). The monitoring result transmitter 42 transmits both data showing a host monitoring result and data showing a network monitoring result to the on-board infotainment device 12 and the Ethernet network monitoring ECU 14 (S22).Based on the timing of the host monitoring and the timing of the network monitoring, a host monitoring result or a network monitoring result may be transmitted. Alternatively, the monitoring result transmitter 42 may transmit monitoring results to the on-board infotainment device 12 or the Ethernet network monitoring ECU 14.

[0045] The on-board infotainment device 12 and the Ethernet network monitoring ECU 14 respectively output data indicating a result of host monitoring and data indicating a result of network monitoring. The monitoring result receiver 44 receives the data indicating a result of host monitoring and the data indicating a result of network monitoring via a communication network (Y in S24). If at least one of the data indicating a result of host monitoring and the data indicating a result of network monitoring differs from the previous data received (Y in S26), the sequence control unit 46 switches between processes related to safety and specified, or switches between behaviors of the vehicle 10 (S28).If the monitoring result receiver 44 has not received any results from the monitoring performed by the other monitoring devices (N in S24), S26 and S28 are skipped. If the monitoring results are consistent (N in S26), S28 is skipped. The CAN monitoring ECU 16 repeats the steps shown in [ ]. Fig. 3 processes shown.

[0046] A specific example of switching between operations in S28 in Fig. 3 is described. Fig. 4 illustrates an example of switching between operations of the on-board infotainment device 12. The on-board infotainment device 12 includes functional blocks corresponding to the functional blocks of the CAN monitoring ECU 16 ( Fig. 2). In the operation example (1), when the results of the host monitoring performed by a plurality of other monitoring devices are normal, the sequence control unit 46 allows the host monitoring unit 36 ​​to detect whether middleware has been tampered with in the host monitoring of the on-board infotainment device 12. On the other hand, when at least one of the results of the host monitoring performed by a plurality of other monitoring devices is abnormal, the sequence control unit 46 allows the host monitoring unit 36 ​​to detect whether middleware and each of the applications have been tampered with in the host monitoring of the on-board infotainment device 12.

[0047] Further, when the results of the network monitoring performed by a plurality of other monitoring devices are normal, the sequence control unit 46 allows the log storage part 38 in the network monitoring of the on-board infotainment device 12 to store in the non-volatile memory only a message in which an abnormality is detected. On the other hand, when at least one of the results of the network monitoring performed by a plurality of other monitoring devices is abnormal, the sequence control unit 46 allows the log storage part 38 in the network monitoring of the on-board infotainment device 12 to store in the non-volatile memory a message in which an abnormality is detected, a predetermined number of messages before the message in which an abnormality is detected, and a predetermined number of messages after the message in which an abnormality is detected.

[0048] In the operation example (2), when the results of the host monitoring performed by a plurality of other monitoring devices are normal, the sequence control unit 46 allows the host monitoring unit 36 ​​to detect whether or not firmware has been tampered with in the host monitoring of the on-board infotainment device 12 only at the time of activation of the on-board infotainment device 12. On the other hand, when at least one of the results of the host monitoring performed by a plurality of other monitoring devices is abnormal, the sequence control unit 46 allows the host monitoring unit 36, as the host monitor of the on-board infotainment device 12, to regularly detect whether or not firmware has been tampered with.

[0049] Furthermore, when the results of the network monitoring performed by a plurality of other monitoring devices are normal, the sequence control unit 46 allows the log storage part 38 to store a monitoring log about the on-board infotainment device 12 in a local storage area, and does not allow the log transmitter 40 to transmit the monitoring log about the on-board infotainment device 12 to devices outside the on-board infotainment device 12. On the other hand, when at least one of the results of the network monitoring performed by a plurality of other monitoring devices is abnormal, the sequence control unit 46 allows the log storage part 38 to store a monitoring log about the on-board infotainment device 12 in a local storage area, and allows the log transmitter 40 to transmit the monitoring log about the on-board infotainment device 12 to the security operations center.

[0050] Fig. Figure 5 shows an example of switching between operations of an Ethernet network monitoring ECU in Fig. 14. The Ethernet network monitoring ECU 14 contains function blocks that correspond to the function blocks of the CAN monitoring ECU 16 ( Fig. 2). In the operation example (1), when the results of the host monitoring performed by a plurality of other monitoring devices are normal, the sequence control unit 46 does not allow the frame locking unit 31 to perform a filtering operation such as removing a frame. On the other hand, when at least one of the results of the host monitoring performed by a plurality of other monitoring devices is abnormal, the sequence control unit 46 allows the frame locking unit 31 to permit the filtering operation.

[0051] Further, when a result of the network monitoring performed by the CAN monitoring ECU 16 is normal, the sequence control unit 46 allows at least one of the network monitoring unit 34 and the host monitoring unit 36 ​​to perform a monitoring operation based on a monitoring rule under which an allowable range is relatively wide. In other words, the sequence control unit 46 weakens a criterion used to determine whether the Ethernet network 20 is normal or not. On the other hand, when a result of the network monitoring performed by the CAN monitoring ECU 16 is abnormal, the sequence control unit 46 allows at least one of the network monitoring unit 34 and the host monitoring unit 36 ​​to perform a monitoring operation based on a monitoring rule under which an allowable range is relatively narrow.In other words, the state machine 46 tightens a criterion used to determine whether the Ethernet network 20 is normal or not.

[0052] Further, when a result of the network monitoring performed by the on-board infotainment device 12 is normal, the sequence control unit 46 allows the log storage part 38 to store a monitoring log about the Ethernet network monitoring ECU 14 in a local storage area, and does not allow the log transmitter 40 to transmit the monitoring log via the Ethernet network monitoring ECU 14 to devices outside the Ethernet network monitoring ECU 14. On the other hand, when a result of the network monitoring performed by the on-board infotainment device 12 is abnormal, the sequence control unit 46 allows the log storage part 38 to store a monitoring log about the Ethernet network monitoring ECU 14 in a local storage area, and allows the log transmitter 40 to transmit the monitoring log via the Ethernet network monitoring ECU 14 to the on-board infotainment device 12.

[0053] In operation example (2), if the results of the host monitoring performed by a plurality of other monitoring devices are normal, the sequence control unit 46 does not switch between processes and continues a monitoring process that has been performed. On the other hand, if at least one of the results of the host monitoring performed by a plurality of other monitoring devices is abnormal, the sequence control unit 46 allows the autonomous driving control device or other ECU(s) to perform a fail-safe process. The fail-safe process includes at least one of sending a command to the autonomous driving control device to terminate autonomous driving and stopping the vehicle 10.

[0054] When a result of the network monitoring performed by the CAN monitoring ECU 16 is normal, the sequence control unit 46 does not allow the frame locking unit 31 to perform a filtering operation, such as removing a frame in which an abnormality has been detected. On the other hand, when a result of the network monitoring performed by the CAN monitoring ECU 16 is abnormal, the sequence control unit 46 allows the frame locking unit 31 to perform a filtering operation.

[0055] Further, when a result of the network monitoring performed by the on-board infotainment device 12 is normal, the sequence control unit 46 allows at least one of the network monitoring unit 34 and the host monitoring unit 36 ​​to perform a monitoring operation based on a monitoring rule under which an allowable range is relatively wide. On the other hand, when a result of the network monitoring performed by the on-board infotainment device 12 is abnormal, the sequence control unit 46 allows at least one of the network monitoring unit 34 and the host monitoring unit 36 ​​to perform a monitoring operation based on a monitoring rule under which an allowable range is relatively narrow.

[0056] Fig. 6 shows an example of switching between operations of the CAN monitoring ECU in Fig. 16. In the operation example (1), when results of the host monitoring performed by a plurality of the other monitoring devices are normal, the sequence control unit 46 allows the log storage part 38 to store, in a predetermined memory area, a log of a frame in which an abnormality was detected, and does not allow the frame inhibition unit 31 to output an error frame corresponding to the frame in which the abnormality was detected. On the other hand, when at least one of the results of the host monitoring performed by a plurality of the other monitoring devices is abnormal, the sequence control unit 46 allows the log storage part 38 to store, in a predetermined memory area, a log of a frame in which an abnormality was detected, and allows the frame inhibition unit 31 to output an error frame corresponding to the frame in which the abnormality was detected.

[0057] Further, when a result of the network monitoring performed by the Ethernet network monitoring ECU 14 is normal, the sequence control unit 46 allows at least one of the network monitoring unit 34 and the host monitoring unit 36 ​​to perform a monitoring operation based on a monitoring rule under which an allowable range is relatively wide. On the other hand, when a result of the network monitoring performed by the Ethernet network monitoring ECU 14 is abnormal, the sequence control unit 46 allows at least one of the network monitoring unit 34 and the host monitoring unit 36 ​​to perform a monitoring operation based on a monitoring rule under which an allowable range is relatively narrow.

[0058] Further, when a result of the network monitoring performed by the on-board infotainment device 12 is normal, the sequence control unit 46 allows the log storage part 38 to store a monitoring log about the CAN monitoring ECU 16 in a local storage area, and does not allow the log transmitter 40 to transmit the monitoring log about the CAN monitoring ECU 16 to devices outside the CAN monitoring ECU 16. On the other hand, when a result of the network monitoring performed by the on-board infotainment device 12 is abnormal, the sequence control unit 46 allows the log storage part 38 to store a monitoring log about the CAN monitoring ECU 16 in a local storage area, and allows the log transmitter 40 to transmit the monitoring log about the CAN monitoring ECU 16 to the on-board infotainment device 12.

[0059] In operation example (2), if the results of the host monitoring performed by a plurality of other monitoring devices are normal, the sequence control unit 46 does not switch between processes and continues a monitoring process that has been performed. On the other hand, if at least one of the results of the host monitoring performed by a plurality of other monitoring devices is abnormal, the sequence control unit 46 allows the autonomous driving control device or other ECU(s) to perform a fail-safe process. The fail-safe process includes at least one of sending a command to the autonomous driving control device to terminate autonomous driving and stopping the vehicle 10.

[0060] Further, when a result of the network monitoring performed by the Ethernet network monitoring ECU 14 is normal, the sequence control unit 46 allows the log storage part 38 to store, in a predetermined memory area, a log of a frame in which an abnormality was detected, and does not allow the frame inhibition unit 31 to output an error frame corresponding to the frame in which the abnormality was detected. On the other hand, when a result of the network monitoring performed by the Ethernet network monitoring ECU 14 is abnormal, the sequence control unit 46 allows the log storage part 38 to store, in a predetermined memory area, a log of a frame in which an abnormality was detected, and allows the frame inhibition unit 31 to output an error frame corresponding to the frame in which the abnormality was detected.

[0061] Further, when a result of the network monitoring performed by the on-board infotainment device 12 is normal, the sequence control unit 46 allows at least one of the network monitoring unit 34 and the host monitoring unit 36 ​​to perform a monitoring operation based on a monitoring rule under which an allowable range is relatively wide. On the other hand, when a result of the network monitoring performed by the on-board infotainment device 12 is abnormal, the sequence control unit 46 allows at least one of the network monitoring unit 34 and the host monitoring unit 36 ​​to perform a monitoring operation based on a monitoring rule under which an allowable range is relatively narrow.

[0062] In the exemplary embodiment, the monitoring devices mounted on the vehicle 10 (e.g., the on-board infotainment device 12, the Ethernet network monitoring ECU 14, and the CAN monitoring ECU 16) cooperate with each other. Consequently, each of the monitoring devices detects states of monitoring objects not monitored by the monitoring device, and thus performs an operation related to safety and corresponding to states of the entire vehicle 10. Furthermore, behaviors of the vehicle 10 are switched so that the behavior of the vehicle 10 corresponds to states of the entire vehicle 10. Consequently, an excessive fail-safe operation is not easily performed even if one of the monitoring devices mistakenly detects an abnormality.

[0063] The present disclosure is described above according to the exemplary embodiment. Those skilled in the art will understand that the exemplary embodiment is only an example. Furthermore, in modifications of the exemplary embodiment, components or operations of the exemplary embodiment are variously combined. Furthermore, the modifications fall within the scope of the present disclosure.

[0064] A first example of the modifications is described. A plurality of types of switching modes between operations are predetermined. The sequence control unit 46 can select one of the plurality of types of switching modes between operations according to a number of abnormalities detected by a plurality of the other monitoring devices. The number of abnormalities detected by a plurality of the other monitoring devices may be a number of monitoring devices each detecting an abnormality in a same monitoring object (e.g., an interior of each of the monitoring devices and the on-board network), or may be a number of monitoring objects in each of which an abnormality is detected.The greater the number of abnormalities detected by a plurality of the other monitoring devices, the sequencer 46 may switch to a more stringent criterion used to monitor the monitoring device including the sequencer 46 in question, or it may perform an operation related to safety and corresponding to a more serious abnormality.

[0065] Fig. 7 illustrates an example of switching between operations of the on-board infotainment device 12 in the first example of the modifications. When results of the host monitoring performed by a plurality of the other monitoring devices are normal, the sequence control unit 46 allows the host monitoring unit 36 ​​to detect whether or not middleware has been tampered with in the host monitoring of the on-board infotainment device 12 at a time of activation of the on-board infotainment device 12. On the other hand, when at least one of the results of the host monitoring performed by a plurality of the other monitoring devices is abnormal, the sequence control unit 46 allows the host monitoring unit 36 ​​to detect whether or not middleware and each of the applications have been tampered with in the host monitoring of the on-board infotainment device 12 at a time of activation of the on-board infotainment device 12.

[0066] Further, when results of host monitoring performed by a plurality of other monitoring devices are abnormal, the sequence control unit 46 allows the host monitoring unit 36 ​​to detect whether each of the applications has been tampered with at the time of activation of the on-board infotainment device 12, and the sequence control unit 46 allows the host monitoring unit 36 ​​to regularly detect whether each of the applications has been tampered with. Further, when results of host monitoring performed by a plurality of other monitoring devices are abnormal, there is a strong possibility that the on-board infotainment device 12 may suffer an attack such as program tampering. Accordingly, the sequence control unit 46 increases monitoring items and monitoring times compared to usual monitoring. Therefore, an abnormality in the on-board infotainment device 12 is easily, quickly, and surely detected.

[0067] A second example of the modifications is described. There are a variety of monitoring objects. According to a number of monitoring objects in which an abnormality is detected by a variety of other monitoring devices, the sequence control unit 46 can select one of a variety of switching modes between operations. Fig. Fig. 8 illustrates an example of switching between operations of the on-board infotainment device 12 in a second example of the modifications. The first to fourth lines in Fig. 8 each show switching between operations based on a result of host monitoring or network monitoring. Switching between operations based on a result of host monitoring or network monitoring is shown in the operation example (1) in Fig. 4 and is not described again.

[0068] Based on a result of the host monitoring or a result of the network monitoring, the sequence control unit 46 switches between the above-described operations. Further, if both a result of the host monitoring and a result of the network monitoring are abnormal, the sequence control unit 46 terminates autonomous driving of the vehicle 10. If both a result of the host monitoring and a result of the network monitoring are abnormal, the sequence control unit 46 may increase monitoring objects, increase objects to be stored in a log, and terminate autonomous driving.Further, when at least one of a result of host monitoring performed by the Ethernet network monitoring ECU 14 and a result of host monitoring performed by the CAN monitoring ECU 16 is abnormal, and at least one of a result of network monitoring performed by the Ethernet network monitoring ECU 14 and a result of network monitoring performed by the CAN monitoring ECU 16 is abnormal, the sequence control unit 46 may determine that both the host monitoring and the network monitoring are abnormal.

[0069] A third example of the modifications is described. Fig. 9 corresponds to Fig. 2 is a block diagram illustrating a functional arrangement of a CAN monitoring ECU 16 in the third example of the modifications. A functional arrangement of the on-board infotainment device 12 and a functional arrangement of the Ethernet network monitoring ECU 14 are similar to the functional arrangement of the CAN monitoring ECU 16. The monitoring unit 32 can also output to the sequence control unit 46 both a result of the network monitoring performed by the network monitoring unit 34 and a result of the host monitoring performed by the host monitoring unit 36.Based on a combination of monitoring results performed by the other monitoring devices and the monitoring results performed by the CAN monitoring ECU 16, the sequence control unit 46 may switch between safety-related processes performed by the CAN monitoring ECU 16 or may switch between behaviors of the vehicle 10.

[0070] Fig. 10 illustrates an example of switching between operations of an on-board infotainment device 12 in the third example of the modifications. The operations in Fig. 10 are with reference to Fig. 4 and will not be described again. If the results of the host monitoring performed by the other monitoring devices are abnormal, and if the results of the off-vehicle network monitoring performed by the on-board infotainment device 12 are abnormal, a greater threat to safety may arise. Therefore, the sequence control unit 46 controls the host monitoring of the on-board infotainment device 12 to detect whether each of the applications has been tampered with, and to periodically detect whether the on-board infotainment device 12 has been tampered with.Similarly, when results of the on-board network monitoring performed by the other monitoring devices are abnormal, and when a result of the off-vehicle network monitoring performed by the on-board infotainment device 12 is abnormal, the sequence control unit 46 allows an abnormal message and messages before the abnormal message and messages after the abnormal message to be stored in a log, and starts allowing the log to be reported to the Security Operations Center.

[0071] A fourth example of the modifications is described. Each of the monitoring objects may be assigned an importance level in advance. The sequence control unit 46 of each of the monitoring devices may switch operations according to an importance level assigned to a monitoring object in which an abnormality has been detected. More specifically, a plurality of types of switching forms between operations are predetermined. The sequence control unit 46 may select one of the plurality of types of switching forms between operations according to an importance level of a monitoring object in which an abnormality has been detected by a plurality of the other monitoring devices. The importance level may be assigned according to types of monitoring objects (an interior of each of the monitoring devices, the on-board network, and the off-vehicle network). For example, a low importance level may be assigned to the off-vehicle network.A medium importance level may be assigned to the on-board network. A high importance level may be assigned to an interior of each of the monitoring devices. Further, the importance level may be assigned according to the number of monitoring objects in each of which an abnormality has been detected. The larger the number, the higher the importance level that can be assigned. Furthermore, different importance levels may be assigned to the same types of monitoring objects (e.g., a CAN and an Ethernet network). The higher the importance level of a monitoring object in which an abnormality has been detected, the sequencer 46 may switch to a more stringent criterion used to monitor the monitoring device including the sequencer 46 in question, or it may perform a safety-related operation corresponding to a more serious abnormality.

[0072] Another example of the modifications is described. The vehicle 10 may include other monitoring device(s) not described in the exemplary embodiment. The number of monitoring devices is not limited. For example, the vehicle 10 may include networks not described in the exemplary embodiment, such as CAN with flexible data rate (CAN FD), FlexRay, and Media Oriented Systems Transport (MOST). Further, the vehicle 10 may include monitoring devices that monitor the networks. Further, when the same type of network includes a plurality of channels (e.g., a plurality of buses), a monitoring device may be provided for each of the channels. For example, two monitoring devices, each monitoring an input port, may be provided for two off-vehicle networks. Further, two CAN monitoring ECUs may be provided for each of two CANs.

[0073] Two monitoring devices may be mounted on the vehicle 10. In a subsequent description, the on-board infotainment device 12 and the CAN monitoring ECU 16 are mounted on the vehicle 10. An example of switching between operations of the on-board infotainment device 12 is described with reference to the operation example (1) in Fig.4. When a result of host monitoring performed by the CAN monitoring ECU 16 is normal, the on-board infotainment device 12 allows detection of whether middleware has been tampered with in the host monitoring of the on-board infotainment device 12. On the other hand, when a result of host monitoring performed by the CAN monitoring ECU 16 is abnormal, the on-board infotainment device 12 allows detection of whether middleware and each of the applications have been tampered with in the host monitoring of the on-board infotainment device 12. Further, when a result of network monitoring performed by the CAN monitoring ECU 16 is normal, the on-board infotainment device 12 only allows a message in which an abnormality has been detected to be stored in the non-volatile memory in the network monitoring of the on-board infotainment device 12.On the other hand, when a result of network monitoring performed by the CAN monitoring ECU 16 is abnormal, in the network monitoring of the on-board infotainment device 12, the on-board infotainment device 12 allows a message in which an abnormality was detected, a predetermined number of messages before the message in which an abnormality was detected, and a predetermined number of messages after the message in which an abnormality was detected to be stored in the non-volatile memory.

[0074] A gateway and any ECU, such as a control ECU, may have a monitoring function described in the exemplary embodiment.

[0075] Any publicly known technique can be applied for a method by which monitoring devices report data about a monitoring result to each other. For example, a monitoring result can be reported via a network in a vehicle (e.g., a CAN, a CAN FD, an Ethernet network, MOST, and FlexRay). Alternatively, a monitoring result can be reported via a dedicated line (e.g., a cable, a CAN, and an Ethernet network).

[0076] The sequence control unit 46 not only sends a command that switches between activation and deactivation of autonomous driving according to a monitoring result, but can also send a command that switches between operations to other devices.

[0077] A monitoring result not only indicates an abnormality or a normality, but may also indicate a pending state. The pending state may include a state in which a monitoring function has not been operated. Furthermore, the pending state may include a state in which a monitoring function is performing a check. The plurality of monitoring devices of the vehicle 10 may report to each other a monitoring result indicating a pending state when a monitoring function has not been operated or when a monitoring function is performing a check.

[0078] When a monitoring result is in a pending state, the sequence control unit 46 may perform a process that is different from the process performed when a monitoring result is normal and abnormal. If at least one of all the monitoring results, for example, results of host monitoring performed by one of the monitoring devices and the other monitoring devices and results of network monitoring performed by one of the monitoring devices and the other monitoring devices, includes a pending state or an abnormality, the sequence control unit 46 of the one of the monitoring devices does not allow the autonomous driving control device or the ADAS to activate an autonomous driving function.Further, when one of the monitoring devices reports a monitoring result showing a pending state to the state machine 46, the state machine 46 does not allow the frame locking unit 31 to perform an operation that locks frames until the monitoring device that reported a monitoring result showing a pending state to the state machine 46 reports a monitoring result showing an abnormality, that is, until an abnormality is determined.

[0079] Furthermore, a monitoring result not only shows an abnormality and a normality, but may also show an intermediate state. Alternatively, a monitoring result not only shows an abnormality, a normality, and a pending state, but may also show an intermediate state. It is difficult for the monitoring function to determine whether the intermediate state is normal or abnormal. For example, if a message has a value that is within a normal range, but the value of the message is close to a threshold based on which an abnormality is determined, the network monitoring unit 34 may determine that the message is in an intermediate state, or may determine that a network monitoring result is in an intermediate state.Similarly, when a value regarding a state of one of the monitoring devices is within a normal range, but the value is close to a threshold based on which an abnormality is determined, the host monitoring unit 36 ​​of one of the monitoring devices may determine that a result of the host monitoring is in an intermediate state. When a monitoring result is an intermediate state, the sequence control unit 46 may perform a process that is different from a process performed when a monitoring result is normal, abnormal, or in a pending state.

[0080] In the exemplary embodiment, the present disclosure is described as security measures in a network in a vehicle. However, the present disclosure is not only applicable to security measures in a network in a vehicle. Vehicles are one example of a means of transportation. The present disclosure is not only applicable to vehicles but also to means of transportation such as construction equipment, agricultural equipment, ships, railways, and aircraft.

[0081] Techniques disclosed in the exemplary embodiment and examples of modifications of the exemplary embodiment may be characterized by the following points. [Point 1]

[0082] A monitoring device is one of a plurality of monitoring devices to be mounted on a vehicle. The monitoring device is configured to monitor an abnormal condition of a first monitoring object. The monitoring device includes a receiver and a control unit. The receiver is configured to receive a detection result of an abnormality detected by another monitoring device that monitors an abnormal condition of a second monitoring object different from the first monitoring object. The control unit is configured to change an operation to be performed by the monitoring device according to the detection result of the abnormality detected by the other monitoring device.

[0083] The monitoring device controls forms of safety-related operations or behavior of the means of transport more appropriately according to states of various components belonging to the means of transport that are not monitored by the monitoring device itself. [Point 2]

[0084] The monitoring device described in point 1 can be an entrance gate device. The first monitoring object can be an entrance gate device or a network external to the vehicle. The other monitoring device can be an electronic control unit. The second monitoring object can be an electronic control unit or a network within the vehicle.

[0085] The monitoring device controls forms of safety-related operations or behavior of the means of transport more appropriately according to states of various components belonging to the means of transport that are not monitored by the monitoring device itself. [Point 3]

[0086] The monitoring device described in item 2 may further include a detection unit configured to detect whether the first monitoring object is in an abnormal state. The control unit may change the detection process to be performed by the detection unit.

[0087] The monitoring device adapts a form of monitoring operation appropriately according to states of various components belonging to the means of transport. [Point 4]

[0088] The monitoring device described in item 2 or 3 may further include a storage section configured to store a log indicating a detection result of an abnormality of the first monitoring object. The control unit may change a storage operation to be performed by the storage section.

[0089] The monitoring device adapts a form of storage of the log appropriately according to states of various components belonging to the means of transport. [Point 5]

[0090] The monitoring device described in item 1 may be a first electronic monitoring control unit that monitors a first network in the vehicle. The first monitoring object may be the first electronic monitoring control unit or the first network. The other monitoring device may be a second electronic monitoring control unit that monitors a second network that is different from the first network and is located in the vehicle. The second monitoring object may be the second electronic monitoring control unit or the second network.

[0091] The monitoring device controls forms of safety-related operations or behavior of the means of transport more appropriately according to states of various components belonging to the means of transport that are not monitored by the monitoring device itself. [Point 6]

[0092] In the monitoring device described in item 5, one of the first network and the second network may be an Ethernet network, and the other may be a Controller Area Network (CAN).

[0093] The monitoring device controls forms of safety-related operations or behavior of the vehicle more appropriately according to states of the Ethernet network and the CAN located in the vehicle. [Point 7]

[0094] The monitoring device described in item 5 or 6 may further include a detection unit configured to detect whether the first monitoring object is in an abnormal state. The control unit may change the detection process to be performed by the detection unit.

[0095] The monitoring device controls monitoring operations performed by the monitoring device more appropriately according to states of various components belonging to the means of transport that are not monitored by the monitoring device itself. [Point 8]

[0096] The monitoring device described in any of items 5 to 7 may further include a frame receiver and a blocking unit. The frame receiver is configured to receive a message sent from a device external to the monitoring device. A blocking unit is configured to block the message. The control unit may modify a blocking operation to be performed by the blocking unit.

[0097] The monitoring device adapts a form of message filtering or a form of blocking appropriately according to states of various components belonging to the means of transport. [Point 9]

[0098] The monitoring device described in any of items 5 to 8 may further include a storage section configured to store a log indicating a detection result of an abnormality of the first monitoring object. The control unit may change a storage operation to be performed by the storage section.

[0099] The monitoring device adapts a form of storage of the log appropriately according to states of various components belonging to the means of transport. [Point 10]

[0100] The monitoring device described in any of items 5 to 9 may further include a reporting part configured to report a report indicating a detection result of an abnormality of the first monitoring object to a device external to the monitoring device. The control unit may change a reporting process to be performed by the reporting part.

[0101] The monitoring device adapts a form of reporting of the protocol appropriately according to states of various components belonging to the means of transport. [Point 11]

[0102] In the monitoring device described in any of items 5 to 10, the control unit may change an operation related to an autonomous driving function of the vehicle.

[0103] The monitoring device controls the autonomous driving function of the vehicle appropriately according to states of various components belonging to the vehicle. [Point 12]

[0104] A monitoring system includes a first monitoring device and a second monitoring device. The first monitoring device is to be mounted on the vehicle. The first monitoring device is configured to detect whether or not a first monitoring object is in an abnormal state and is configured to transmit an abnormality detection result to the second monitoring device that monitors a second monitoring object that is different from the first monitoring object. The second monitoring device is to be mounted on the vehicle. The second monitoring device is configured to receive the abnormality detection result transmitted from the first monitoring device and is configured to change an operation to be performed by the second monitoring device according to the abnormality detection result.

[0105] The monitoring system controls forms of safety-related operations or behavior of the means of transport more appropriately according to the states of various components belonging to the means of transport that are not monitored by any of the monitoring devices. [Point 13]

[0106] A computer program causes a monitoring device to perform a method. The monitoring device is one of a plurality of monitoring devices mounted on the vehicle. The monitoring device is configured to monitor an abnormal condition of a first monitoring object. The method includes: receiving a detection result of an abnormality detected by another monitoring device that monitors an abnormal condition of a second monitoring object different from the first monitoring object; and changing an operation to be performed by the monitoring device according to the detection result of the abnormality detected by the other monitoring device.

[0107] The computer program causes the monitoring device to control forms of safety-related operations or behavior of the means of transport more appropriately according to the states of various components belonging to the means of transport that are not monitored by the monitoring device itself.

[0108] Any combination of the exemplary embodiment and the example(s) of modifications described above is also usable as exemplary embodiments of the present disclosure. Any new exemplary embodiment created by such a combination takes advantage of the exemplary embodiment and the example(s) of modifications combined to create the new exemplary embodiment. Those skilled in the art will appreciate that functions intended to be performed by components described in the appended claims are performed by each of the components shown in the exemplary embodiment and the example(s) of modifications. Alternatively, the functions are performed by the components that cooperate with each other. Industrial applicability

[0109] The present disclosure relates to a data processing technique and is particularly useful for a monitoring device, a monitoring system and a computer program. Reference symbols in the drawing 10 Vehicle (means of transport) 12 On-board infotainment device 14 Ethernet network monitoring ECU 16 CAN monitoring ECU 18 External vehicle network 20 Ethernet network 22 CAN 30 frame receiver 31 Frame locking unit 32 monitoring unit 34 Network monitoring unit 36 Host Monitoring Unit 38 Protocol storage part 40 protocol transmitters 42 monitoring result transmitters 44 monitoring result recipients 46 Sequence control unit

Claims

[1] A monitoring device which is a first of a plurality of monitoring devices to be mounted on a means of transport (10), the first monitoring device being designed to monitor an abnormal condition of a first monitoring object, the monitoring device comprising: a receiver (44) configured to receive a detection result of an abnormality detected by a second monitoring device that monitors an abnormal state of a second monitoring object different from the first monitoring object; and a control unit (46) configured to change an operation to be performed by the monitoring device according to the detection result of the abnormality detected by the second monitoring device, wherein the first monitoring device is an entrance gate device (12) and the first monitoring object is an entrance gate device or a network (18) outside the means of transport (10), and the second monitoring device is an electronic control unit (14, 16) and the second monitoring object is an electronic control unit or a network (20, 22) in the means of transport (10). [2] Monitoring device according to claim 1, further comprising a detection unit (32) configured to detect whether or not the first monitoring object is in an abnormal state, wherein the control unit (46) changes a detection process to be performed by the detection unit (32). [3] Monitoring device according to claim 1 or 2, further comprising a storage part (38) configured to store a log showing a detection result of an abnormality of the first monitoring object, wherein the control unit (46) changes a storage operation to be performed by the storage part (38). [4] Monitoring system comprising: a first monitoring device to be attached to a means of transport (10), designed to detect whether a first monitoring object is in an abnormal state or not, and designed to send a detection result of an abnormality to a second monitoring device that monitors a second monitoring object that is different from the first monitoring object; and the second monitoring device to be attached to the means of transport (10); designed to receive the detection result of the abnormality sent by the first monitoring device, and designed to change an operation to be performed by the second monitoring device according to the detection result of the abnormality, wherein the second monitoring device is an entrance gate device (12) and the second monitoring object is an entrance gate device or a network (18) outside the means of transport, and the first monitoring device is an electronic control unit (14, 16) and the first monitoring object is an electronic control unit or a network (20, 22) in the means of transport (10). [5] A computer program for causing a first monitoring device to carry out a method, wherein the monitoring device is one of a plurality of monitoring devices mounted on the means of transport (10), and the monitoring device is designed to monitor an abnormal condition of a first monitoring object, the method comprising: receiving a detection result of an abnormality detected by a second monitoring device that monitors an abnormal state of a second monitoring object different from the first monitoring object; and changing an operation to be performed by the first monitoring device according to the detection result of the abnormality detected by the second monitoring device, wherein the first monitoring device is an entrance gate device (12) and the first monitoring object is an entrance gate device or a network (18) outside the means of transport, and the second monitoring device is an electronic control unit (14, 16) and the second monitoring object is an electronic control unit or a network (20, 22) in the means of transport (10).

Images