In-vehicle relay device, program, and information processing method

Abstract

To provide an in-vehicle relay device, a method, and a program that can suitably provide an external connection port to which an external device is connected.SOLUTION: In a vehicle, an in-vehicle relay device connected to an in-vehicle network mounted on the vehicle includes a plurality of communication units for communicating with a plurality of in-vehicle ECUs mounted on the vehicle, a processing unit that performs processing related to relaying communication between the plurality of in-vehicle ECUs, a switching unit that is communicatively connected to the processing unit and relays based on a hierarchical protocol that is lower than the relay processing by the processing unit, and an external connection port to which an external device outside the vehicle is connected. The external connection port is communicatively connected to the processing unit, and external data input from the external connection port is output to the switching unit via the processing unit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an in-vehicle relay device, a program, and an information processing method. [Background technology]

[0002] An electronic control device that is mounted on a vehicle and includes multiple microcomputers (microcomputers) and can detect abnormalities in a communication bus has been disclosed (for example, Patent Document 1). The electronic control device in Patent Document 1 is one of multiple nodes connected to the communication bus, and includes a first microcomputer and a second microcomputer that receive a transmission signal flowing through the communication bus and send a transmission signal to the communication bus, and is configured so that the transmission signal to be sent to the communication bus is sent to each microcomputer without passing through the communication bus, and each microcomputer receives the transmission signal. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2016-126716 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the electronic control device of Patent Document 1, no consideration is given to the appropriate provision of an external connection port to which an external device is connected.

[0005] The present disclosure aims to provide an in-vehicle relay device or the like that can be suitably provided with an external connection port to which an external device is connected. [Means for solving the problem]

[0006] An in-vehicle relay device according to one embodiment of the present disclosure is an in-vehicle relay device connected to an in-vehicle network mounted on a vehicle, and comprises a plurality of communication units for communicating with a plurality of in-vehicle ECUs (Electronic Control Units) mounted on the vehicle, a processing unit that performs processing related to relaying communications between the plurality of in-vehicle ECUs, a switching unit that is communicatively connected to the processing units and relays based on a hierarchical protocol lower than the relay processing by the processing units, and an external connection port to which an external device outside the vehicle is connected, the external connection port being communicatively connected to the processing units, and external data input from the external connection port being output to the switching unit via the processing units. [Effects of the Invention]

[0007] According to one aspect of the present disclosure, it is possible to provide an in-vehicle relay device or the like that is preferably provided with an external connection port to which an external device is connected. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a schematic diagram illustrating the configuration of an in-vehicle system including an in-vehicle relay device according to a first embodiment. [Figure 2] FIG. 2 is a block diagram illustrating the configuration of an in-vehicle relay device. [Figure 3] FIG. 2 is an explanatory diagram illustrating a communication format according to a hierarchical protocol in a processing unit, etc.; [Figure 4] 10 is a flowchart illustrating processing by a processing unit of an in-vehicle relay device. [Figure 5] FIG. 10 is a block diagram illustrating the configuration of an in-vehicle relay device according to a second embodiment (multi-layer separation). DETAILED DESCRIPTION OF THE INVENTION

[0009] [Description of the embodiments of the present disclosure] First, embodiments of the present disclosure will be listed and described. At least some of the embodiments described below may be combined in any desired manner.

[0010] (1) An in-vehicle relay device according to one embodiment of the present disclosure is an in-vehicle relay device connected to an in-vehicle network mounted on a vehicle, and includes a plurality of communication units for communicating with a plurality of in-vehicle ECUs mounted on the vehicle, a processing unit that performs processing related to relaying communications between the plurality of in-vehicle ECUs, a switching unit that is communicatively connected to the processing units and relays based on a hierarchical protocol that is lower than the relay processing by the processing units, and an external connection port to which an external device outside the vehicle is connected, the external connection port being communicatively connected to the processing units, and external data input from the external connection port being output to the switching unit via the processing units.

[0011] In this aspect, the in-vehicle relay device relays communication data (IP packets) transmitted and received between multiple in-vehicle ECUs connected to the in-vehicle network. The in-vehicle network is configured with communication lines using, for example, Ethernet (registered trademark), and in this case, the communication protocol used for communication between the in-vehicle ECUs is TCP / IP. The in-vehicle relay device includes, as functional units for relaying, a processing unit for performing relaying at an upper layer of the communication protocol and a switching unit for performing relaying at a layer lower than the processing unit. The processing unit may be configured with, for example, a microcomputer including a storage unit such as a ROM or RAM, and may function as a software processing unit that performs relaying at an upper layer (upper layer side control) through software processing by the microcomputer. The switching unit may be configured with, for example, an integrated circuit (IC), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA), and may function as a hardware processing unit that performs relaying at a lower layer (lower layer side control) through hardware processing by the switching unit. The in-vehicle relay device is provided with an external connection port to which an external device outside the vehicle, such as a diagnostic device or a terminal device such as a smartphone, is connected. The external device connected to the external connection port is not limited to a device that is physically installed on the outside of the vehicle body, but may include a device that is temporarily or permanently installed in the vehicle as a so-called retrofit device. Alternatively, if the external connection port has a wireless communication function, the external device may be, for example, an external server connected to the Internet, etc. The external connection port is, for example, a port (DLC port) compatible with a DLC (Data Link Connector), and the external connection port is directly connected to a microcomputer that constitutes the processing unit. The microcomputer that constitutes the processing unit may, for example, have an Ethernet PHY unit (physical layer ( In the case where the in-vehicle relay device includes a communication unit such as a transceiver (Ethernet PHY unit), the external connection port and the communication unit (Ethernet PHY unit) may be wired to communicably connect the external connection port and the processing unit. With this configuration, the external connection port and the switching unit are not directly connected, but are indirectly connected via the processing unit (microcomputer). That is, the external connection port and the processing unit (microcomputer) can be suitably connected, thereby allowing the in-vehicle relay device to be suitably provided with the external connection port. Therefore, external data output from an external device connected to the external connection port does not directly flow into the switching unit. Therefore, even if vulnerability to attacks from outside the vehicle is assumed in the relay processing at a lower layer by the switching unit, unauthorized external data (attack data) can be prevented from passing through the switching unit and flowing into the in-vehicle network.

[0012] (2) In an in-vehicle relay device according to one embodiment of the present disclosure, the communication protocol used by the switching unit for relaying is TCP / IP (Transmission Control Protocol / Internet Protocol), and the switching unit includes two or more of the communication units and functions as a Layer 2 switch that relays IP packets flowing through the in-vehicle network based on the MAC address of the in-vehicle ECU connected to the communication unit.

[0013] In this embodiment, the switching unit includes two or more communication units (Ethernet PHY units) and functions as a Layer 2 switch that relays communication data (IP packets) transmitted from each of the on-board ECUs connected to these communication units based on the destination MAC (Media Access Control) address contained in the communication data. The external connection port is not directly connected to the switching unit that functions as a Layer 2 switch, but is directly connected to a processing unit (microcomputer) that relays data in a layer higher than the switching unit. This prevents the Layer 2 (data link layer) of the external connection port from being the same as the Layer 2 (data link layer) of the switching unit. Therefore, even if there is a vulnerability in the Layer 2 (data link layer) of the switching unit, it is possible to prevent unauthorized external data (attack data) from the external connection port from passing through the switching unit and flowing into the on-board network.

[0014] (3) In an in-vehicle relay device according to one embodiment of the present disclosure, the communication protocol used by the processing unit for relaying is TCP / IP, and the processing unit functions as a Layer 3 switch that relays IP packets from the in-vehicle ECU acquired via the switching unit based on the IP address of the in-vehicle ECU.

[0015] In this embodiment, the processing unit (microcomputer) functions as a Layer 3 switch that relays IP packets from an in-vehicle ECU acquired via the switching unit based on the destination IP address included in the IP packet. Furthermore, the processing unit (microcomputer) may function as a Layer 4 switch that performs processing related to Quality of Service (QoS) or the like, processing related to ECU diagnostic communication protocols such as Unified Diagnostic Service (UDS), or security verification processing such as DoIP (Diagnostics over IP), based on the TCP (Transmission Control Protocol) port number or UDP (User Datagram Protocol) port number included in the IP packet. Because the external connection port is directly connected to the processing unit (microcomputer) configured in this manner, various types of processing corresponding to higher layers can be performed on external data output from an external device via the external connection port.

[0016] (4) In an in-vehicle relay device according to one embodiment of the present disclosure, the processing unit determines whether the external data input from the external connection port is normal or abnormal, and if it determines that the external data is normal, it transmits the external data to the in-vehicle network via the switching unit, and if it determines that the external data is abnormal, it discards the external data without outputting it to the switching unit.

[0017] In this aspect, a processing unit configured with a microcomputer or the like executes a program (program product) stored in a storage unit of the microcomputer to perform security-related processing using, for example, DoIP (Diagnostics over IP) or an IDS (Intrusion Detection System), thereby determining whether external data input from the external connection port is valid (determining whether the data is normal or abnormal). For example, by using DoIP or the like, if the processing unit determines that a large amount of external data transmitted from an external device via the external connection port is a DoS attack or the like, the processing unit determines that the external data is abnormal and discards the external data determined to be abnormal without outputting it to the switching unit. For example, by using DoIP or the like, if the processing unit determines that the external data transmitted from the external device via the external connection port is normal, the processing unit transmits (outputs) the external data to the in-vehicle network via the switching unit, thereby relaying the external data. In this way, by directly connecting the external connection port to a processing unit (microcomputer) that supports security-related processing (DoIP, etc.) at higher layers, such as Layer 4, the processing unit can efficiently determine whether the external data output from the external device via the external connection port is valid. Therefore, compared to when the external connection port is directly connected to a switching unit that handles relay processing for Layer 2 and below, a secure environment in the in-vehicle network can be ensured for external devices connected via the external connection port.

[0018] (5) In one embodiment of the in-vehicle relay device of the present disclosure, the processing unit includes a first processing unit and a second processing unit communicatively connected to the first processing unit, the switching unit is connected to the second processing unit, the second processing unit performs processing related to setting changes of the switching unit, the external connection port is connected to the first processing unit, and the external data input from the external connection port is output to the switching unit via the first processing unit and the second processing unit.

[0019] In this aspect, the processing unit (microcomputer) includes a first processing unit (first microcomputer) and a second processing unit (second microcomputer). That is, the processing unit (microcomputer) has a configuration in which the first processing unit (first microcomputer) and the second processing unit (second microcomputer) are separated into multiple layers. The first processing unit (first microcomputer) and the second processing unit (second microcomputer) are communicatively connected via, for example, SPI (Serial Peripheral Interface) or Ethernet (Ethernet PHY unit). An external connection port is connected to the first processing unit (first microcomputer), and a switching unit is connected to the second processing unit (second microcomputer). Therefore, in the direction in which external data flows from an external device connected to the external connection port, if the external device is considered to be the most upstream device, the external data flows in the following order: external device, first processing unit (first microcomputer), second processing unit (second microcomputer), and switching unit. That is, the external device (external connection port), first processing unit (first microcomputer), second processing unit (second microcomputer), and switching unit are connected in series, with the switching unit positioned furthest downstream. Furthermore, the second processing unit (second microcomputer) performs processing related to configuration changes of the switching unit and has the configuration right (SW-IC configuration right) for the switching unit. This configuration right (SW-IC configuration right) is the authority to update or change various setting parameters or values of configuration sheets, etc., stored in memory, etc., included in the switching unit. The second processing unit (second microcomputer) with this configuration right (SW-IC configuration right) changes the setting parameters, etc., of the switching unit by, for example, outputting a parameter update command to a setting change port or an API (Application Programming Interface) provided in the switching unit. With this connection configuration, the first processing unit receives and performs security processing on external data transmitted from an external device connected to the external connection port. That is, the first processing unit can temporarily terminate communication with the external device (external connection port).Thereafter, the first processing unit communicates with the second processing unit, thereby reliably protecting the second processing unit that has the right to configure the switching unit (SW-IC configuration right). That is, the first processing unit can function as a firewall against external devices connected to the external connection port, effectively defending the second processing unit and the switching unit from external attacks.

[0020] (6) A program according to one embodiment of the present disclosure is a program that causes a computer to execute processing, the program having a plurality of communication units for communicating with on-board ECUs connected to an on-board network, and performing processing related to relaying communications between the plurality of on-board ECUs, the computer being communicatively connected to a switching unit that relays based on a hierarchical protocol lower than the relay processing by the computer, and an external connection port to which an external device outside the vehicle is connected is connected, and when external data input from the external connection port is output to the switching unit, the program determines whether the external data input from the external connection port is normal or abnormal, and if it is determined that the external data is normal, transmits the external data to the on-board network via the switching unit, and if it is determined that the external data is abnormal, causes the program to execute processing to discard the external data without outputting it to the switching unit.

[0021] In this aspect, it is possible to provide a program that causes a computer to function as an in-vehicle relay device that is preferably provided with an external connection port to which an external device is connected.

[0022] (7) An information processing method according to one embodiment of the present disclosure is an information processing method that causes a computer, which has a plurality of communication units for communicating with on-board ECUs connected to an on-board network, to execute processing related to relaying communications between the plurality of on-board ECUs, wherein the computer is communicatively connected to a switching unit that relays based on a hierarchical protocol lower than the relay processing by the computer, and is connected to an external connection port to which an external device outside the vehicle is connected, and when external data input from the external connection port is output to the switching unit, the computer determines whether the external data input from the external connection port is normal or abnormal, and if it is determined that the external data is normal, the computer transmits the external data to the on-board network via the switching unit, and if it is determined that the external data is abnormal, the computer executes processing to discard the external data without outputting it to the switching unit.

[0023] In this aspect, it is possible to provide an information processing method that causes a computer to function as an in-vehicle relay device that is preferably provided with an external connection port to which an external device is connected.

[0024] [Details of the embodiments of the present disclosure] The present disclosure will be specifically described with reference to drawings showing embodiments thereof. An in-vehicle relay device 1 according to an embodiment of the present disclosure will be described below with reference to the drawings. Note that the present invention is not limited to these examples, but is defined by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0025] (Embodiment 1) Hereinafter, embodiments will be described with reference to the drawings. FIG. 1 is a schematic diagram illustrating the configuration of an in-vehicle system including an in-vehicle relay device 1 according to the first embodiment. FIG. 2 is a block diagram illustrating the configuration of the in-vehicle relay device 1. The in-vehicle system includes an in-vehicle relay device 1 and a plurality of in-vehicle ECUs 2 connected to an in-vehicle network 3. The in-vehicle relay device 1 has an external connection port 15, such as a DLC port, and is communicatively connected to an external device 4, such as a diagnostic device or a mobile terminal device such as a smartphone, connected to the external connection port 15 (DLC port). The connection between the external connection port 15 and the external device 4 is not limited to a wired connection. For example, if the external connection port 15 is configured as an external connection device with a wireless function, the in-vehicle relay device 1 will be communicatively connected to an external server connected to an external network, such as the Internet, via the external connection port 15.

[0026] The vehicle C is equipped with an in-vehicle relay device 1 and a plurality of in-vehicle ECUs 2 for controlling various in-vehicle devices. The in-vehicle ECUs 2 and the in-vehicle relay device 1 are communicatively connected by a communication line 31 (Ethernet cable) compatible with a communication protocol such as Ethernet (registered trademark). The connection between the in-vehicle relay device 1 and the in-vehicle ECUs 2 is not limited to Ethernet, and may be by a CAN bus compatible with a communication protocol such as CAN (Control Area Network (registered trademark).

[0027] The external device 4 such as a diagnostic device may correspond to a device that performs maintenance processing (maintenance processing) for the in-vehicle ECU 2, such as updating the program of the in-vehicle ECU 2. The maintenance processing is not limited to updating (reprogramming) the program for the in-vehicle ECU 2, and may include, for example, diagnostic processing, initialization processing, restart processing, etc. for the in-vehicle ECU 2. Furthermore, the maintenance processing performed by these external devices 4 may be based on a diagnostic communication protocol defined in, for example, UDS (Unified Diagnostic Services).

[0028] The in-vehicle relay device 1 acquires an update program for the in-vehicle ECU 2 to be maintained from the external device 4 (diagnosis device), or acquires information about maintenance processing such as a request signal for initialization processing to the in-vehicle ECU 2 to be maintained, and relays the acquired information about maintenance processing such as the update program or the request signal for initialization processing to the in-vehicle ECU 2 to be maintained. The in-vehicle relay device 1 may acquire a program, etc. for the in-vehicle ECU 2 connected to itself from the external device 4 (diagnosis device), output (transmit) the acquired program, etc. to the in-vehicle ECU 2 to be updated (reprogrammed), and function as a reprogramming master that performs program update processing (reprogramming processing) for the in-vehicle ECU 2.

[0029] The external device 4 (diagnostic device) is a device (diagnostic tool) used by vehicle C maintenance companies, including authorized dealers, who are responsible for maintaining vehicle C, such as performing maintenance work on the vehicle relay device 1 or the vehicle ECU 2, and is, for example, a device in which a dedicated application is installed on a general-purpose information terminal such as a personal computer, tablet PC, or smartphone, or a device that includes hardware and is configured as a dedicated information terminal.

[0030] The external device 4 (diagnosis device) communicates with the in-vehicle relay device 1 via an external connection port 15 (DLC port). As will be described in detail later, the in-vehicle relay device 1 includes a processing unit 11 configured with a microcomputer or the like and a switching unit 14 configured with an IC or the like, and the external connection port 15 is directly connected to the processing unit 11 (microcomputer). Therefore, the external connection port 15 is indirectly connected to the switching unit 14 via the processing unit 11 (microcomputer).

[0031] The switching unit 14 performs relay processing in accordance with a hierarchical protocol in the L2 layer, and is connected to the in-vehicle ECU 2 via a communication line 31 such as Ethernet that constitutes the in-vehicle network 3. As described above, the external connection port 15 is not directly connected to the switching unit 14, but is indirectly connected via the processing unit 11 (microcomputer). Therefore, the L2 layer of the external connection port 15 and the L2 layer of the switching unit 14 can be made different (different). This makes it possible to prevent external data from the external connection port 15 from slipping through the switching unit 14, even if there is a vulnerability in the L2 layer of the switching unit 14.

[0032] The in-vehicle relay device 1 includes a processing unit 11, a memory unit 12, multiple communication units 13, and a switching unit 14. The in-vehicle relay device 1 manages, for example, a system segment formed by multiple communication lines 31, such as an in-vehicle ECU 2 for a control system, an in-vehicle ECU 2 for a safety system, and an in-vehicle ECU 2 for a body system, and relays communications between the in-vehicle ECUs 2 between these segments. The in-vehicle relay device 1 may be, for example, an Ethernet switch having the functions of a Layer 2 switch and a Layer 3 switch, or may also function as a CAN gateway. The in-vehicle relay device 1 may be configured as, for example, a body ECU that controls the drive of body actuators, or as one functional unit of an integrated ECU configured by a vehicle computer, etc. Alternatively, the in-vehicle relay device 1 may be a PLB (Power LAN Box) that, in addition to relaying communications, also functions as a power distribution device that distributes and relays power output from a power storage device and supplies it to the in-vehicle ECU 2 connected to the in-vehicle relay device.

[0033] The processing unit 11 is configured with a CPU (Central Processing Unit), an MPU (Micro Processing Unit), etc. The processing unit 11 reads out and executes each program and data stored in advance in the storage unit 12, thereby performing various control processes, arithmetic processes, etc.

[0034] The storage unit 12 is configured with a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM), or a flash memory, and stores in advance a program P (program product) and data to be referenced during processing. The program P stored in the storage unit 12 may be a program P (program product) read from a recording medium M readable by the vehicle-mounted relay device 1. Alternatively, the program P may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 12. The storage unit 12 stores relay control information, which the processing unit 11 references to perform relay control, for example, in a table format (routing table).

[0035] The communication unit 13 is an input / output interface configured by, for example, an Ethernet PHY unit using an Ethernet communication protocol. The processing unit 11 may be configured as a packaged microcomputer including the storage unit 12 and a plurality of communication units 13 (two communication units 13 in this embodiment).

[0036] The switching unit 14 is configured, for example, by an integrated circuit (IC), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA). A plurality of communication units 13 (Ethernet PHY units) are connected to the switching unit 14, and the switching unit 14 may be configured as a packaged switching IC (SW-IC) including the plurality of communication units 13.

[0037] In this embodiment, the microcomputer constituting the processing unit 11 is provided with two communication units 13, one of which is connected to an external connection port 15, and the other of which is connected to a communication unit 13 provided in a switching unit 14 (SW-IC). In this embodiment, the switching unit 14 (SW-IC) is provided with three communication units 13, one of which is connected to a communication unit 13 provided in the processing unit 11 (microcomputer), and the other two communication units 13 are each connected to an in-vehicle ECU 2.

[0038] The processing unit 11 (microcomputer) and the switching unit 14 (SW-IC) are communicatively connected by a communication line 31 such as Ethernet connected to the communication unit 13 of each unit. Furthermore, an external connection port 15 (DLC port) to which an external device 4 such as a diagnostic device is connected is directly connected to the communication unit 13 of the processing unit 11 (microcomputer), but is not directly connected to the communication unit 13 of the switching unit 14 (SW-IC) but is indirectly connected via the processing unit 11 (microcomputer). This allows the L2 layer (data link layer) of the external connection port 15 (DLC port) and the L2 layer (data link layer) of the switching unit 14 (SW-IC) to be physically different (not identical), thereby preventing a direct attack on the L2 layer of the switching unit 14 (SW-IC) from the external device 4 connected to the external connection port 15.

[0039] 3 is an explanatory diagram illustrating a communication format according to a hierarchical protocol in the processing unit 11 etc. In the illustration in this embodiment, the flow of data (external data) according to a hierarchical protocol defined in the hierarchical model of OSI (Open Systems Interconnection) will be described between the processing unit 11 (microcomputer) and the switching unit 14 (SW-IC).

[0040] As described above, the processing unit 11, which is configured by a microcomputer or the like, and the switching unit 14 (SW-IC), which is configured by an integrated circuit (IC) or the like, are connected to each other via the communication unit 13, such as an Ethernet PHY unit, so as to be able to communicate via Ethernet, and are connected by the same physical layer (L1PHY). The processing unit 11 (microcomputer) and the external connection port 15, such as a DLC port, are also connected by the same physical layer (L1PHY).

[0041] External data transmitted from an external device 4, such as a diagnostic device, connected to the external connection port 15 (DLC port) is, for example, an IP packet, and contains information corresponding to each layer. That is, the external data undergoes carrier sense detection according to the physical layer (L1PHY), processing using a MAC address according to the data link layer (L2MAC), processing using an IP address according to the transport layer (L4) or network layer (L3), and processing related to DoIP or UDS at the session layer or above.

[0042] External data (IP packets) received via the external connection port 15 (DLC port) passes through an interface at the physical layer (L1PHY) by the communication unit 13 (Ethernet PHY unit) or the like, and is then subjected to processing at a higher layer such as DoIP by the processing unit 11 (microcomputer), where the MAC address is referenced according to the data link layer (L2MAC).If the security verification result by DoIP or the like is normal, the processing unit 11 (microcomputer) transmits (outputs) the external data determined to be normal to the switching unit 14 (SW-IC) from the communication unit 13 (Ethernet PHY unit) used for communication with the switching unit 14 (SW-IC).

[0043] The switching unit 14 (SW-IC) receives (acquires) external data transmitted (output) from the processing unit 11 (microcomputer), and transmits the received external data from one of the multiple communication units 13 (Ethernet PHY units) (the communication unit 13 to which the in-vehicle ECU 2 with the MAC address is connected) by referring to a MAC address table stored in RAM or the like according to the MAC address contained in the external data. In this way, the processing unit 11 (microcomputer) and the switching unit 14 (SW-IC) relay the external data (IP packets) from the external connection port 15 (DLC port), thereby performing data communication according to the original flow of normal external data.

[0044] If the security verification result of the external data by DoIP or the like is abnormal, the processing unit 11 (microcomputer) discards the external data without outputting it to the switching unit 14 (SW-IC). As illustrated in the figure in this embodiment, the L2 layer on the external connection port 15 (DLC port) side, i.e., the processing unit 11 (microcomputer) side to which the external connection port 15 is directly connected, is not the same as the L2 layer on the switching unit 14 (SW-IC) side. In other words, these L2 layers are not directly connected. As a result, even if there is some vulnerability in the L2 layer, attack data (external data determined to be abnormal) cannot pass through to the switching unit 14 (SW-IC). This connection configuration ensures a secure environment in the in-vehicle network 3 against attacks from outside the vehicle via the external connection port 15, and improves the robustness of the in-vehicle system configured with the in-vehicle network 3.

[0045] In this embodiment, the processing unit 11 (microcomputer) and the switching unit 14 (SW-IC) are connected to each other at the same physical layer (L1PHY) in Ethernet via the communication unit 13 such as an Ethernet PHY unit, but this is not limiting. An upper layer side control unit in the processing unit 11 (microcomputer) that performs L3 or L4 layer processing and a lower layer side control unit in the switching unit 14 (SW-IC) that performs L2 processing may be connected to each other so as to be able to communicate with each other via, for example, an SPI (Serial Peripheral Interface).

[0046] 4 is a flowchart illustrating the processing of the processing unit 11 of the vehicle-mounted relay device 1. The processing unit 11 of the vehicle-mounted relay device 1 steadily performs the following processing, for example, when the vehicle C is in a running state (IG switch is on) or a stopped state (IG switch is off).

[0047] The processing unit 11 of the in-vehicle relay device 1 acquires external data via the external connection port 15 (S101). The processing unit 11 of the in-vehicle relay device 1 acquires, via the external connection port 15, external data transmitted from an external device 4, such as a diagnostic device, connected to the external connection port 15. The external connection port 15 and the communication unit 13 (Ethernet PHY unit) connected to the processing unit 11 of the in-vehicle relay device 1 are connected by a communication line 31 (Ethernet) or an internal bus, and the processing unit 11 of the in-vehicle relay device 1 acquires (receives) the external data from the external connection port 15 via the communication unit 13 (Ethernet PHY unit) corresponding to Layer 1.

[0048] The processing unit 11 of the in-vehicle relay device 1 determines whether the external data input from the external connection port 15 is normal (S102). The processing unit 11 of the in-vehicle relay device 1 performs various processes in layer 2 or layer 3 hierarchical protocols, such as DoIP (Diagnostics over Internet Protocol), UDS (Unified Diagnostic Service), QoS (Quality of Service), SOME / IP (Scalable service-Oriented Middleware over IP), IDS (Intrusion Detection System), or routing process by IP address, on the external data input from the external connection port 15 without performing relay processing (layer 2 processing) according to a MAC address or the like.

[0049] When performing these Layer 3 processes, the processing unit 11 of the in-vehicle relay device 1 performs security verification processing using, for example, DoIP on the acquired external data to determine whether the external data is valid, i.e., whether the external data is normal or abnormal (attack data). For example, the processing unit 11 of the in-vehicle relay device 1 may determine that the external data is abnormal if the external data (IP packets) acquired (received) in a predetermined processing unit time is large in volume, such as when the number of packets exceeds a predetermined threshold. For example, the processing unit 11 of the in-vehicle relay device 1 may determine that the external data is normal if the number of packets of the external data (IP packets) acquired (received) in a predetermined processing unit time is equal to or less than a predetermined threshold.

[0050] If it is determined that the external data is normal (S102: YES), the processing unit 11 of the in-vehicle relay device 1 outputs the external data to the switching unit 14 (S103). If it is determined that the external data input from the external connection port 15 is normal, the processing unit 11 of the in-vehicle relay device 1 outputs the external data to the switching unit 14.

[0051] Based on a MAC (Media Access Control) address included in the external data (IP packet) output from the processing unit 11 (microcomputer), the switching unit 14 (SW-IC) outputs the external data from the communication unit 13 (Ethernet PHY unit) to which the in-vehicle ECU 2 having the MAC address is connected. As a result, the external data received from the external device 4 via the external connection port 15 is transmitted from the switching unit 14 (SW-IC) to the in-vehicle network 3 after undergoing security verification by the processing unit 11 (microcomputer).

[0052] When it is determined that the external data is abnormal (S102: NO), the processing unit 11 of the in-vehicle relay device 1 discards the external data (S104). When the processing unit 11 of the in-vehicle relay device 1 determines that the external data input from the external connection port 15 is abnormal, it discards the external data without outputting the external data to the switching unit 14. As a result, when the external data input from the external connection port 15 is abnormal, i.e., attack data, the attack data (external data determined to be abnormal) is discarded without being output (transmitted) to the in-vehicle network 3, thereby ensuring a secure environment for the in-vehicle network 3.

[0053] (Embodiment 2) 5 is a block diagram illustrating the configuration of an in-vehicle relay device 1 according to embodiment 2 (multi-layer separation). As in embodiment 1, the in-vehicle relay device 1 includes a processing unit 11 (microcomputer) and a switching unit 14 (SW-IC), and the processing unit 11 (microcomputer) is configured with two processing units 11 (microcomputers) consisting of a first processing unit 111 (first microcomputer: μC-1) and a second processing unit 112 (second microcomputer: μC-2), which are separate units.

[0054] The first processing unit 111 (first microcomputer) and the second processing unit 112 (second microcomputer) are provided with a storage unit 12 and a communication unit 13 (Ethernet PHY unit) similar to the processing unit 11 (microcomputer) of embodiment 1, and perform relay processing according to a hierarchical protocol. An external connection port 15 is connected to the first processing unit 111 (first microcomputer).

[0055] The second processing unit 112 (second microcomputer) is connected to the switching unit 14. The first processing unit 111 (first microcomputer) and the second processing unit 112 (second microcomputer) are communicatively connected via, for example, a serial peripheral interface (SPI). Alternatively, the first processing unit 111 (first microcomputer) and the second processing unit 112 (second microcomputer) may be communicatively connected via Ethernet via a communication unit 13 (Ethernet PHY unit). If the external connection port 15 (DLC port) is located upstream in the flow direction of external data output from the external device 4, the external connection port 15, the first processing unit 111 (first microcomputer), the second processing unit 112 (second microcomputer), and the switching unit 14 (SW-IC) are connected in series in that order.

[0056] The second processing unit 112 (second microcomputer) performs processing related to changing the settings of the switching unit 14, and has the right to set the settings (SW-IC setting right) for the switching unit 14. The second processing unit 112 (second microcomputer) having the right to set the settings for the switching unit 14 executes, for example, a setting change application stored in the storage unit 12, thereby outputting a parameter update command or the like to a setting change port or API (Application Programming Interface) provided in the switching unit 14, and performs processing to change the setting parameters, etc., in the switching unit 14.

[0057] With this connection configuration, the first processing unit 111 (first microcomputer) can temporarily terminate communication with the external device 4 connected to the external connection port 15. Then, the first processing unit 111 (first microcomputer) communicates with the second processing unit 112 (second microcomputer), so that the second processing unit 112, which has the right to set the switching unit 14, can be prevented from being attacked by the external device 4 connected to the external connection port 15, and even if the second processing unit 112 has vulnerability, sufficient robustness can be ensured.

[0058] The embodiments disclosed herein are to be considered in all respects as illustrative and not restrictive. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims.

[0059] Multiple claims may be combined with each other regardless of the form of reference. Multiple dependent claims may be included in the claims, depending on multiple claims. Multiple dependent claims may be included in a multiple dependent claim. If multiple dependent claims are not included in a multiple dependent claim, this does not limit the number of multiple dependent claims that are included in a multiple dependent claim. [Explanation of symbols]

[0060] C vehicle 1. Vehicle relay device 11 Processing unit (microcomputer) 12 Storage section M Recording medium P Program (Program Product) 13 Communication unit (Ethernet PHY unit) 14 Switching section (SW-IC) 15 External connection port (DLC port) 111 First processing unit (first microcomputer) 112 Second processing unit (second microcomputer) 2 In-vehicle ECU 3. In-vehicle network 31 Communication line 4 External device (diagnostic device)

Claims

1. An in-vehicle relay device connected to an in-vehicle network installed in a vehicle, Multiple communication units for communicating with multiple in-vehicle ECUs mounted on the aforementioned vehicle, A processing unit that performs processing related to relaying communication between the aforementioned plurality of in-vehicle ECUs, A switching unit which is communicatively connected to the aforementioned processing unit and relays based on a lower-level protocol than the relay processing performed by the aforementioned processing unit, The vehicle includes an external connection port to which external devices outside the vehicle are connected, The external connection port is connected to the processing unit in a manner that allows communication. External data input from the external connection port is output to the switching unit via the processing unit. Vehicle-mounted relay device.

2. The communication protocol used by the switching unit for relaying is TCP / IP. The switching unit is Including two or more of the aforementioned communication units, Based on the MAC address of the in-vehicle ECU connected to the communication unit, it functions as a Layer 2 switch that relays IP packets flowing through the in-vehicle network. The in-vehicle relay device according to claim 1.

3. The communication protocol used by the aforementioned processing unit for relaying is TCP / IP. The processing unit functions as a Layer 3 switch that relays IP packets from the in-vehicle ECU, acquired via the switching unit, based on the IP address of the in-vehicle ECU. The in-vehicle relay device according to claim 1.

4. The aforementioned processing unit, The system determines whether the external data input from the external connection port is normal or abnormal. If the external data is determined to be normal, the external data is transmitted to the in-vehicle network via the switching unit. If the external data is determined to be abnormal, the external data is discarded without being output to the switching unit. The in-vehicle relay device according to claim 1.

5. The processing unit includes a first processing unit and a second processing unit that is communicatively connected to the first processing unit. The switching unit is connected to the second processing unit. The second processing unit performs processing related to changing the settings of the switching unit, The first processing unit is connected to the external connection port, The external data input from the external connection port is output to the switching unit via the first processing unit and the second processing unit. An in-vehicle relay device according to any one of claims 1 to 2.

6. A program that causes a computer to perform processing related to relaying communication between multiple in-vehicle ECUs, which are connected to an in-vehicle network and have multiple communication units for communicating with the in-vehicle ECUs, The aforementioned computer, It is connected to a switching unit that relays based on a lower-level protocol than the relay processing performed by the aforementioned computer, and is communicatively connected to the switching unit that relays based on a lower-level protocol than the relay processing performed by the computer. An external connection port is connected to which external devices outside the vehicle are connected. When outputting external data input from the external connection port to the switching unit, the system determines whether the external data input from the external connection port is normal or abnormal. If the external data is determined to be normal, the external data is transmitted to the in-vehicle network via the switching unit. If the external data is determined to be abnormal, the external data is discarded without being output to the switching unit. A program that executes a process.

7. An information processing method comprising a plurality of communication units for communicating with an in-vehicle ECU connected to an in-vehicle network, and causing a computer to perform processing related to relaying communication between the plurality of in-vehicle ECUs, The aforementioned computer, It is connected to a switching unit that relays based on a lower-level protocol than the relay processing performed by the aforementioned computer, and is communicatively connected to the switching unit that relays based on a lower-level protocol than the relay processing performed by the computer. An external connection port is connected to which external devices outside the vehicle are connected. When outputting external data input from the external connection port to the switching unit, the system determines whether the external data input from the external connection port is normal or abnormal. If the external data is determined to be normal, the external data is transmitted to the in-vehicle network via the switching unit. If the external data is determined to be abnormal, the external data is discarded without being output to the switching unit. An information processing method that executes a process.

Images