Information processing apparatus, information processing method, and program

Abstract

To provide an information processing apparatus capable of suppressing a temporary increase in processing load.SOLUTION: The information processor 100 includes VM1 to 3 each having the communication controller 10, and the communication controller 10 includes the storage unit 14 that stores the routing table 14d, the determination processing unit 15 that determines the priority of each of the plurality of update target routing tables, the routing table generation unit 16 that generates the update request message for one or more VMs having the plurality of update target routing tables, and the communication unit 13 that transmits the update request message to one or more VMs. A routing table generation part 16 and a communication part 13 generate and transmit an update request message so that a second update target routing table having priority lower than that of a first update target routing table is updated after the first update target routing table.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device mounted on a vehicle. [Background technology]

[0002] Conventionally, a vehicle electronic control device mounted on a vehicle has been proposed as an example of an information processing device (see, for example, Patent Document 1). The vehicle electronic control device is one of a plurality of ECUs (Electronic Control Units) and a gateway connected to an in-vehicle network. For example, when an application program (hereinafter also referred to as an app) in an ECU uses a service, the app requests the service from another ECU. The other ECU then responds to the ECU that requested the service. Furthermore, when a new service is added, a communication path between the ECU that uses the service and the ECU that provides the service is reflected in a routing table in the gateway so that the new service can be executed. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 7043736 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the vehicle electronic control device of Patent Document 1 has a problem in that the processing load may temporarily increase.

[0005] Therefore, the present disclosure provides an information processing device that can suppress a temporary increase in processing load. [Means for solving the problem]

[0006] An information processing device according to one embodiment of the present disclosure is an information processing device mounted on a vehicle, and includes a plurality of virtual machines, each having a communication control unit. The communication control unit includes: a memory unit that stores routing tables for controlling communication paths between a plurality of application programs executed on the plurality of virtual machines; a determination processing unit that determines the priority of each of a plurality of routing tables to be updated among the routing tables held by each of the plurality of virtual machines; a routing table generation unit that generates an update request message to request one or more virtual machines that have the plurality of routing tables to update the plurality of routing tables to be updated; and a communication unit that transmits the update request message to the one or more virtual machines. The routing table generation unit and the communication unit generate and transmit the update request message so that a second routing table to be updated among the plurality of routing tables to be updated, the second routing table having a lower priority than a first routing table to be updated, is updated after the first routing table to be updated.

[0007] These comprehensive or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM, or may be realized as any combination of the system, the method, the integrated circuit, the computer program, and the recording medium. The recording medium may also be a non-transitory recording medium. [Effects of the Invention]

[0008] The information processing device of the present disclosure can suppress a temporary increase in processing load.

[0009] Further advantages and effects of one aspect of the present disclosure will become apparent from the specification and drawings. Such advantages and / or effects are provided by some of the embodiments and configurations described in the specification and drawings, but not all of the configurations are necessarily required. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a conceptual diagram showing an overview of an in-vehicle system. [Figure 2] FIG. 2 is a block diagram showing an outline of the in-vehicle system. [Figure 3] FIG. 3 is a diagram illustrating an example of a configuration of an information processing device according to an embodiment. [Figure 4] FIG. 4 is a block diagram illustrating an example of the configuration of a communication control unit according to the embodiment. [Figure 5] FIG. 5 is a diagram illustrating an example of a manifest according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of a routing table according to the embodiment. [Figure 7] FIG. 7 is a diagram showing an example of a priority list according to the embodiment. [Figure 8] FIG. 8 is a diagram illustrating an example of an application placement list according to the embodiment. [Figure 9] FIG. 9 is a flowchart showing an example of the processing operation of the information processing device according to the embodiment. [Figure 10] FIG. 10 is a flowchart showing another example of the processing operation of the information processing device according to the embodiment. [Figure 11] FIG. 11 is a diagram illustrating an example of the configuration of two information processing devices according to the first modification of the embodiment. [Figure 12] FIG. 12 is a diagram illustrating an example of a manifesto according to the first modification of the embodiment. [Figure 13] FIG. 13 is a diagram showing an example of a global arrangement list held by the global communication control unit according to the first modification of the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] (Findings that formed the basis of this disclosure) The present inventors have found that the following problems occur with the vehicle electronic control device of Patent Document 1 described in the "Background Art" section.

[0012] For example, in a software-defined vehicle (SDV) or a battery electric vehicle (BEV), multiple virtual machines are installed on a virtualization platform of an ECU, and multiple applications within the virtual machines or ECUs are expected to work together to provide services. Here, let's assume that multiple virtual machines are installed in the vehicle electronic control device of Patent Document 1, and a new application is installed in the vehicle electronic control device. That is, a new service is added to the vehicle electronic control device. In such a case, in the vehicle electronic control device of Patent Document 1, multiple routing tables may be updated at once to enable collaboration (i.e., communication) between the new application and multiple other existing applications. Updating multiple routing tables at once temporarily increases the processing load. Furthermore, after a vehicle is released to the market, new applications are installed frequently, and installed applications are updated frequently. Therefore, the processing load may temporarily increase each time a new application is installed or an application is updated.

[0013] In order to solve the above problem, an information processing device according to a first aspect of the present disclosure is an information processing device mounted on a vehicle, the information processing device including a plurality of virtual machines each having a communication control unit, the communication control unit including: a storage unit that stores routing tables for controlling communication paths between a plurality of application programs executed on the plurality of virtual machines; a determination processing unit that determines the priority of each of a plurality of update-target routing tables among the routing tables held by each of the plurality of virtual machines; a routing table generation unit that generates an update request message to request one or more virtual machines that hold the plurality of update-target routing tables to update the plurality of update-target routing tables; and a communication unit that transmits the update request message to the one or more virtual machines, the routing table generation unit and the communication unit generating and transmitting the update request message such that a second update-target routing table among the plurality of update-target routing tables, the second update-target routing table having a lower priority than a first update-target routing table, is updated after the first update-target routing table. Note that the information processing device is, for example, an ECU.

[0014] As a result, of the multiple routing tables to be updated, the first routing table to be updated, which has a higher priority, is updated first, and then the second routing table to be updated, which has a lower priority. Therefore, it is possible to prevent multiple routing tables to be updated at the same time or all at once. As a result, it is possible to suppress a temporary increase in the processing load required to update the multiple routing tables to be updated. Furthermore, because the first routing table to be updated, which has a higher priority, can be updated quickly, it is possible to suppress the temporary increase in the processing load while reducing the possibility of problems occurring in communication between multiple application programs in the information processing device.

[0015] In the information processing device according to a second aspect, the communication control unit may further include a routing table update unit that, upon receiving the update request message transmitted from the communication unit, updates at least one of the first update target routing table and the second update target routing table stored in the storage unit included in the communication control unit in accordance with the update request message. Note that the second aspect may be dependent on the first aspect.

[0016] As a result, when an update request message is received, the routing table to be updated can be appropriately updated in accordance with the update request message.

[0017] In the information processing device according to a third aspect, the routing table update unit may perform authentication on the update request message to confirm the validity of the update request message, and then update at least one of the first update-target routing table and the second update-target routing table. Note that the third aspect may be dependent on the second aspect.

[0018] This makes it possible to suppress updates to the routing table due to unauthorized update request messages, thereby improving security performance.

[0019] In addition, in the information processing device according to a fourth aspect, the determination processing unit may further determine whether a processing load of the information processing device is equal to or greater than a threshold, and if the processing load is equal to or greater than the threshold, determine the priority of each of the plurality of routing tables to be updated. Note that the fourth aspect may be subordinate to any one of the first to third aspects.

[0020] This makes it possible to prevent a further increase in the processing load caused by simultaneously updating multiple routing tables to be updated when the processing load of the information processing device is high. Furthermore, when the processing load is less than the threshold, priority is not determined, so that, for example, multiple routing tables to be updated can be simultaneously updated, enabling rapid control of communications between multiple application programs.

[0021] In addition, in the information processing device according to a fifth aspect, the determination processing unit may further (a) acquire the processing load from a virtualization platform included in the information processing device, or (b) estimate the processing load based on a running state of the vehicle. Note that the fifth aspect may be dependent on the fourth aspect.

[0022] This allows accurate processing loads to be acquired from the virtualization platform. Alternatively, if the vehicle is in autonomous driving mode, it can be estimated that the processing load is high, and if the vehicle is parked, it can be estimated that the processing load is low. As a result, even if accurate processing loads cannot be acquired, appropriate processing loads can be estimated.

[0023] In addition, in the information processing device according to a sixth aspect, when a first application program is changed in the information processing device, the determination processing unit may further identify a plurality of second application programs that are permitted to communicate with the first application program, as indicated in a manifest of the first application program, and determine the priority of each of a plurality of routing tables corresponding to the plurality of second application programs, among the routing tables held by each of the plurality of virtual machines, as the priority of each of the plurality of routing tables to be updated, and the time when the first application program is changed in the information processing device may be (a) when a new application program is installed in the information processing device as the first application program, or (b) when an existing application program held by the information processing device is updated to the first application program. Note that the sixth aspect may be dependent on any one of the first to fifth aspects. Note that the first application program is also referred to as a new application, and the second application program is also referred to as a communication-permitted application.

[0024] As a result, when a first application program is installed on an information processing device, or when an installed first application program is updated, multiple routing tables required for communication by the first application program are treated as multiple routing tables to be updated in accordance with the manifest of the installed or updated first application program.The priority of each of the multiple routing tables to be updated is then determined.As a result, it is possible to appropriately select the required routing table to be updated, and to determine the priority of the routing table to be updated.

[0025] In addition, in the information processing device according to a seventh aspect, the routing table update unit may (a) update the first update-target routing table at the timing when the update request message transmitted from the communication unit is received, when the first update-target routing table is stored in the storage unit provided in the communication control unit together with the routing table update unit, and (b) update the second update-target routing table at a predetermined timing, when the second update-target routing table is stored in the storage unit provided in the communication control unit together with the routing table update unit. Note that the seventh aspect may be dependent on the second aspect or any one of the third to sixth aspects dependent on the second aspect.

[0026] This allows the first routing table to be updated quickly, which has a higher priority, while the second routing table to be updated, which has a lower priority, can be updated at a predetermined timing that is later than the first routing table to be updated.

[0027] In the information processing device according to an eighth aspect, the predetermined timing may be (a) a timing when a processing load of the information processing device becomes less than a threshold, (b) a timing when an ignition switch of the vehicle is switched from off to on, or (c) a timing when a predetermined operation by a user is accepted. Note that the eighth aspect may be dependent on the seventh aspect.

[0028] This allows the second routing table to be updated at an appropriate time, since the second routing table has a lower priority.

[0029] In addition, the information processing device according to a ninth aspect may further include a global communication control unit corresponding to the plurality of virtual machines, and when a third application program that is one of the plurality of second application programs is not present in the information processing device, the global communication control unit may identify another information processing device different from the information processing device that has the third application program, and transmit the update request message to the other information processing device. Note that the ninth aspect may be dependent on the sixth aspect, or the seventh or eighth aspect that is dependent on the sixth aspect.

[0030] For example, a communication control unit attempts to send an update request message to a virtual machine having a third application program and a routing table to be updated corresponding to the third application program. However, the communication control unit may be unable to send the update request message because it does not know the location of the virtual machine. However, in the ninth aspect, the global communication control unit identifies another information processing device as the location of the virtual machine, and can therefore appropriately send the update request message. As a result, routing tables can be updated between multiple information processing devices. In other words, the communication control units of each of multiple virtual machines included in an information processing device can appropriately send the update request message even if they do not know the locations of virtual machines or containers included in other information processing devices. As a result, each communication control unit does not need to maintain a list for determining their locations, and the amount of data maintained by each communication control unit can be reduced.

[0031] In addition, in the information processing device according to a tenth aspect, when the global communication control unit receives the update request message from a global communication control unit of another information processing device, the global communication control unit may transmit the update request message to the communication control unit of a virtual machine, among the plurality of virtual machines, that has a third application program corresponding to the update request message. Note that the tenth aspect may be dependent on the ninth aspect.

[0032] As a result, even when an update request message is received from another information processing device, the routing table to be updated can be updated in accordance with the update request message.

[0033] In addition, in the information processing device according to an eleventh aspect, the storage unit may further store a plurality of priority lists, and the determination processing unit may select a priority list from the plurality of priority lists according to the state of the vehicle, and determine the priority of each of the plurality of routing tables to be updated using the selected priority list, and each of the plurality of priority lists may indicate the priority of the routing table held by each of the plurality of virtual machines. Note that the eleventh aspect may be subordinate to any one of the first to tenth aspects.

[0034] This allows the priority of each of the multiple routing tables to be updated to be determined appropriately according to the state of the vehicle.

[0035] In addition, in the information processing device according to a twelfth aspect, when the routing table update unit receives the update request message transmitted from the communication unit, if a message indicating that an application program has been changed in the information processing device has been received within a predetermined period after receiving the update request message, the routing table update unit may update at least one of the first update-target routing table and the second update-target routing table. Note that the twelfth aspect may be dependent on the second aspect or any one of the third to eleventh aspects which are dependent on the second aspect.

[0036] As a result, a message indicating that a change has been made to an application program on an information processing device is treated as a notification message. This notification message is a message that notifies in advance that an update request message will be sent. If an update request message is received within a predetermined period of time from the time the notification message is accepted, the update-target routing table is updated in accordance with the update request message. This makes it possible to prevent an unauthorized update request message from being received and the update-target routing table from being updated in accordance with the unauthorized update request message, even when no change has been made to an application program on the information processing device.

[0037] Furthermore, an information processing method according to a first aspect of the present disclosure is an information processing method performed by an information processing device equipped with a plurality of virtual machines and mounted on a vehicle, the information processing method comprising: determining the priority of each of a plurality of update target routing tables among the routing tables held by each of the plurality of virtual machines; generating an update request message to request one or more virtual machines having the plurality of update target routing tables to update the plurality of update target routing tables; and transmitting the update request message to the one or more virtual machines; and generating and transmitting the update request message so that a second update target routing table among the plurality of update target routing tables, which has a lower priority than a first update target routing table, is updated after the first update target routing table.

[0038] This makes it possible to achieve the same effects as the information processing device according to the first aspect.

[0039] Hereinafter, the embodiments will be specifically described with reference to the drawings.

[0040] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, component placement and connection configurations, steps, and step order shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not described in the independent claims that represent the highest concepts are described as optional components. Furthermore, each drawing is a schematic diagram and is not necessarily an exact illustration. Furthermore, the same components are designated by the same reference numerals in each drawing.

[0041] (Embodiment) First, an outline of the in-vehicle system will be described with reference to Fig. 1 and Fig. 2. The in-vehicle system is an example of a system equipped with an information processing device according to the present embodiment. Fig. 1 is a conceptual diagram showing an outline of the in-vehicle system. Fig. 2 is a block diagram showing an outline of the in-vehicle system.

[0042] As shown in FIG. 1, the in-vehicle system 900 is applied to an automatic driving system mounted on a vehicle V, such as an automobile, for controlling driving operations such as acceleration / deceleration, steering, and braking of the vehicle V so that they are performed automatically by an ADAS (Advanced Driver Assistance System).

[0043] The in-vehicle system 900 can communicate with the monitoring server 800 via an external network Nt such as the Internet. The in-vehicle system 900 monitors whether or not a security abnormality has occurred in the in-vehicle system 900, and notifies the monitoring server 800 of the monitoring result via the external network Nt.

[0044] The monitoring server 800 is installed in, for example, a security monitoring center. Upon receiving a notification from the in-vehicle system 900, the monitoring server 800 grasps the occurrence status of security abnormalities in each vehicle V and provides advice on how to deal with the security abnormalities.

[0045] In the example of FIG. 1, the in-vehicle system 900 communicates with the monitoring server 800, but it is not necessary for the in-vehicle system 900 to communicate with the monitoring server 800.

[0046] As shown in FIG. 2, the in-vehicle system 900 includes an integrated ECU 910, a zone ECU 912, a steering ECU 914, a brake ECU 916, a zone ECU 918, a front camera ECU 920, and a rear camera ECU 922.

[0047] The integrated ECU 910 is communicably connected to the zone ECU 912 via a CAN (Controller Area Network) 924. The zone ECU 912, the steering ECU 914, and the brake ECU 916 are communicably connected to one another via a CAN 926.

[0048] The integrated ECU 910 is also communicatively connected to the zone ECU 918 via an Ethernet (registered trademark) 928. The zone ECU 918, the front camera ECU 920, and the rear camera ECU 922 are also communicatively connected to one another via an Ethernet 930. The zone ECU 918 may be communicatively connected to other ECUs via a CAN, not limited to the Ethernet. Furthermore, the integrated ECU 910 may be communicatively connected to the monitoring server 800 (see FIG. 1) via an external network Nt, for example.

[0049] The integrated ECU 910 performs the following functions: (a) communication control for sending and receiving messages via the external network Nt, the CAN 924, and the Ethernet 928; (b) vehicle control for instructing the zone ECU 912 and the zone ECU 918 to control the vehicle V via the CAN 924 and the Ethernet 928; and (c) video output to the infotainment system and the instrument panel. The integrated ECU 910 may also monitor the in-vehicle system 900 for the occurrence of a security anomaly (e.g., unauthorized access) and notify the monitoring server 800 of the monitoring results. The integrated ECU 910 has the functions of conventional individual ECUs. In other words, the integrated ECU 910 integrates the functions of multiple conventional ECUs into one.

[0050] The zone ECU 912 mediates messages sent and received between the integrated ECU 910 and the steering ECU 914 and brake ECU 916 .

[0051] The steering ECU 914 controls steering by a steering wheel mounted on the vehicle V.

[0052] The brake ECU 916 controls the operation of the brakes mounted on the vehicle V.

[0053] In addition to the steering ECU 914 and the brake ECU 916, the in-vehicle system 900 may use ECUs that control the engine, body, etc. of the vehicle V to perform various controls of the vehicle V, such as running, turning, and stopping.

[0054] The zone ECU 918 mediates messages sent and received between the integrated ECU 910 and the front camera ECU 920 and rear camera ECU 922 .

[0055] The front camera ECU 920 acquires an image of the front of the vehicle V captured by a front camera mounted on the front of the vehicle V.

[0056] The rear camera ECU 922 acquires a rear image of the vehicle V captured by a rear camera mounted on the rear of the vehicle V.

[0057] The information processing device in this embodiment is, for example, the integrated ECU 910, but may be another ECU.

[0058] FIG. 3 is a diagram illustrating an example of the configuration of an information processing device according to the present embodiment.

[0059] The information processing device 100 in this embodiment is a device mounted on a vehicle V, and includes a plurality of VMs (Virtual Machines), each having a communication control unit 10. The communication control unit is also called an SCL, a Security COMM Lib, or a Security Communication Library. Specifically, as shown in FIG. 3 , the information processing device 100 includes a VM1 having the communication control unit 10, a VM2 having the communication control unit 10, and a VM3 having the communication control unit 10. The information processing device 100 further includes a virtualization platform 40 and hardware 50.

[0060] The VM1 includes a container L11, a container L12, and a guest OS (Operating System) 20, along with the communication control unit 10. The container L11 and the container L12 are also called software areas, and are areas in which, for example, applications are stored. In the example of FIG. 3, the container L11 stores a newly installed application (hereinafter referred to as a new application) a0, and the container L12 stores a first application a1. The communication control unit 10 of the VM1 controls communication between the container L11 and the container L12 and communication between the VM1 and other VMs. Specifically, each communication control unit 10 includes a transmission processing unit 11 and a reception processing unit 12. The transmission processing unit 11 of the VM1 receives data such as a message from an application stored in the container L11 or the container L12 and transmits the data to a destination application. The reception processing unit 12 of the VM1 receives data such as a message from a source application and transmits the data to an application stored in the container L11 or the container L12.

[0061] Like VM1, VM2 includes a communication control unit 10, a container L21, a container L22, and a guest OS 20. The container L21 and the container L22 are each also called a software area, and are areas in which, for example, applications are stored. In the example of FIG. 3, the container L22 stores a second application a2. The communication control unit 10 of VM2 controls communication between the container L21 and the container L22 and communication between VM2 and other VMs. The transmission processing unit 11 of VM2 receives data such as messages from applications stored in the container L21 or the container L22 and transmits the data to destination applications. The reception processing unit 12 of VM2 receives data such as messages from source applications and transmits the data to applications stored in the container L21 or the container L22.

[0062] Like VM1, VM3 includes a communication control unit 10, a container L31, a container L32, and a guest OS 20. The container L31 and the container L32 are each also referred to as a software area, and are areas in which, for example, applications are stored. In the example of FIG. 3 , the container L32 stores a third application a3. The communication control unit 10 of VM3 controls communication between the container L31 and the container L32 and communication between VM3 and other VMs. The transmission processing unit 11 of VM3 receives data such as messages from applications stored in the container L31 or the container L32 and transmits the data to destination applications. The reception processing unit 12 of VM3 receives data such as messages from source applications and transmits the data to applications stored in the container L31 or the container L32.

[0063] The virtualization platform 40 is also called a hypervisor, and is a software program that runs on the hardware 50 to realize virtualization. That is, the virtualization platform 40 realizes the VM1, VM2, and VM3.

[0064] The hardware 50 is configured as, for example, a SoC (System on a Chip).

[0065] Here, new application a0 is installed in VM1 of the information processing device 100 and stored in container L11 of VM1. Then, new application a0 has authority to cooperate with (i.e., authority to communicate with) first application a1, second application a2, and third application a3. Such authority is indicated in the manifest of new application a0. Based on this manifest, the communication control units 10 of VM1, VM2, and VM3 update their own routing tables. Then, new application a0 communicates with first application a1, second application a2, and third application a3 in accordance with these routing tables.

[0066] For example, when new application a0 sends data to first application a1, it sends the data to the transmission processing unit 11 of VM1. As a result, within VM1, the data is sent from the transmission processing unit 11 to the first application a1 of container L12 via the communication service 22 in the guest OS 20 and the reception processing unit 12 according to the routing table of VM1.

[0067] Furthermore, when new application a0 sends data to second application a2, it sends the data to transmission processing unit 11 of VM1. As a result, the data is sent from transmission processing unit 11 of VM1 to second application a2 in container L22 of VM2 according to the routing tables of VM1 and VM2, via communication service 21 in guest OS 20 of VM1, virtualization platform 40, communication service 22 in guest OS 20 of VM2, and reception processing unit 12 of VM2.

[0068] Furthermore, when new application a0 sends data to third application a3, it sends the data to transmission processing unit 11 of VM1. As a result, the data is sent from transmission processing unit 11 of VM1 to third application a3 in container L32 of VM3 according to the respective routing tables of VM1 and VM3, via communication service 23 in guest OS 20 of VM1, virtualization platform 40, communication service 23 in guest OS 20 of VM3, and reception processing unit 12 of VM3.

[0069] FIG. 4 is a block diagram showing an example of the configuration of the communication control unit 10 provided in each of the VMs 1 to 3. As shown in FIG.

[0070] The communication control unit 10 includes a communication unit 13 , a storage unit 14 , a determination processing unit 15 , a routing table generation unit 16 , and a routing table update unit 17 .

[0071] The communication unit 13 includes a transmission processing unit 11 and a reception processing unit 12 shown in FIG. 3. The storage unit 14 is a recording medium storing a priority list 14b, an application placement list 14c, and a routing table 14d. The routing table 14d is a table for controlling communication paths between multiple applications executed in three VMs (VM1 to VM3). For example, when a new application a0 is installed by the guest OS 20 of VM1, multiple routing tables 14d are updated to control communication paths between the new application a0 and multiple other applications. That is, among the routing tables 14d possessed by each of VMs (VM1 to VM3), multiple routing tables 14d required for controlling the communication paths are updated as routing tables to be updated. The priority list 14b and the application placement list 14c will be described later. The storage unit 14 may be a hard disk drive, a random access memory (RAM), a read-only memory (ROM), or a semiconductor memory. The storage unit 14 may be volatile or nonvolatile.

[0072] The determination processing unit 15 determines the priority of each of the routing tables to be updated among the routing tables 14d held by each of the VMs 1 to 3. At this time, the determination processing unit 15 determines the priority of each of the routing tables to be updated by referring to the application placement list 14c and the priority list 14b described above.

[0073] The routing table generation unit 16 generates an update request message for requesting one or more VMs having the plurality of routing tables to update the plurality of routing tables to be updated. The update request message indicates, for example, the difference between the routing table to be updated after the update and the routing table to be updated before the update. The transmission processing unit 11 of the communication unit 13 transmits the update request message to the one or more VMs.

[0074] Here, routing table generation unit 16 and transmission processing unit 11 in this embodiment generate and transmit an update request message so that the second routing table to be updated, which has a lower priority than the first routing table to be updated, among the multiple routing tables to be updated, is updated after the first routing table to be updated. Note that the first routing table to be updated and the second routing table to be updated are routing table 14d included in the multiple routing tables to be updated. The priority of the first routing table to be updated determined by determination processing unit 15 is higher than the priority of the second routing table to be updated determined by determination processing unit 15.

[0075] When the routing table update unit 17 receives an update request message from the transmission processing unit 11 via the reception processing unit 12, the routing table update unit 17 updates the update-target routing table stored in the storage unit 14 in accordance with the update request message. For example, the routing table update unit 17 of VM2 receives the update request message from the transmission processing unit 11 of VM1 via the reception processing unit 12 of VM2. Then, the routing table update unit 17 of VM2 updates the update-target routing table stored in the storage unit 14 of VM2 in accordance with the update request message. Note that the routing table update unit 17 may receive the update request message from the transmission processing unit 11 provided in the same VM as the routing table update unit 17. For example, the routing table update unit 17 of VM1 receives the update request message from the transmission processing unit 11 of VM1 via the reception processing unit 12 of VM1. Then, the routing table update unit 17 of VM1 updates the update-target routing table stored in the storage unit 14 of VM1 in accordance with the update request message. Note that the update-target routing table is the first update-target routing table or the second update-target routing table described above.

[0076] In this way, when routing table update unit 17 in this embodiment receives an update request message transmitted from communication unit 13, it updates at least one of the first update target routing table and the second update target routing table stored in storage unit 14 provided in communication control unit 10 in accordance with the update request message. In this way, when an update request message is received, it is possible to appropriately update the update target routing table in accordance with the update request message.

[0077] FIG. 5 is a diagram showing an example of the manifest 14a.

[0078] The manifest 14a is data associated with an application and indicates, as permissions, a list of one or more other applications that are permitted to communicate with the application. In the example of FIG. 5, the manifest 14a associated with a new application a0 indicates a first application a1, a second application a2, and a third application a3 as the one or more other applications that are permitted to communicate with the new application a0. For example, when the new application a0 is installed in VM1, the guest OS 20 of VM1 acquires the manifest 14a for the new application a0 along with the new application a0 and stores the manifest 14a in the storage unit 14 of VM1. Note that each application listed in the manifest 14a is also referred to as a communication-permitted application.

[0079] FIG. 6 is a diagram showing an example of the routing table 14d.

[0080] The routing table 14d indicates, for example, a command ID, a sender, a destination, a service type, etc., as shown in FIG. 6. The command ID is identification information for data such as a message being sent or received. The sender indicates the application that sends the data or the location of that application. The destination indicates the application that receives the data or the location of that application. The service type indicates the type of communication service of the guest OS 20 used to send or receive the data.

[0081] Specifically, the routing table 14d shown in FIG. 6 indicates the new application a0 in the container L11 of VM1 as the source and the second application a2 in the container L22 of VM2 as the destination. The routing table 14d indicates "0x000F" as the command ID and "443" as the service type. Therefore, this routing table 14d indicates that data identified by the command ID "0x000F" is transmitted from the new application a0 to the second application a2 using the communication service of the service type "443." Note that the communication service of the service type "443" may be, for example, the communication service 21 of VM1 and the communication service 22 of VM2. Furthermore, such a routing table 14d is stored in the storage unit 14 of each of VM1 and VM2. The communication control units 10 (more specifically, the communication units 13) of the VM1 and VM2 refer to the routing table 14d to control the transmission of data with the command ID "0x000F" from the new application a0 to the second application a2.

[0082] 7 is a diagram showing an example of the priority list 14b. Note that VMx-Lyy shown in FIG. 7 refers to a container identified by the symbol Lyy in a VM identified by the symbol x, where x is 1, 2, or 3, and yy is 11, 12, 21, 22, 31, or 32.

[0083] The priority list 14b is a list for determining the priority of each of a plurality of routing tables to be updated. For example, as shown in FIG. 7, the priority list 14b indicates the priority of each container for each container. Specifically, the priority list 14b indicates "1" as the priority of each of container L11 (i.e., VM1-L11) and container L12 (i.e., VM1-L12) of VM1. Furthermore, the priority list 14b indicates "1" as the priority of container L22 (i.e., VM2-L22) of VM2 and indicates "3" as the priority of container L32 (i.e., VM3-L32) of VM3. Priority "1" is higher than priority "2," which is higher than priority "3." In other words, priority "1" is a "high" priority, priority "2" is a "medium" priority, and priority "3" is a "low" priority.

[0084] The priority of such a container can also be said to be the priority of the routing table 14d corresponding to the application stored in that container.

[0085] Fig. 8 is a diagram showing an example of the application placement list 14c. Note that VMx-Lyy shown in Fig. 8 means a container identified by the symbol Lyy in a VM identified by the symbol x, similar to Fig. 7.

[0086] The application placement list 14c is a list showing, for each container, the applications placed or stored in that container. Specifically, as shown in Fig. 8, the application placement list 14c shows that a new application a0 is placed in a container L11 of VM1, and a first application a1 is placed in a container L12 of VM1. Furthermore, the application placement list 14c shows that a second application a2 is placed in a container L22 of VM2, and a third application a3 is placed in a container L32 of VM3. In other words, the application placement list 14c shows the location of each application in the information processing device 100.

[0087] 9 is a flowchart showing an example of the processing operation of the information processing device 100 according to this embodiment. Specifically, the flowchart shows an example of the processing operation when the communication control unit 10 of the VM 1 transmits an update request message.

[0088] First, when new application a0 is installed in VM1 of information processing device 100, determination processing unit 15 of VM1 identifies one or more other applications that are permitted to communicate with new application a0 as communication-permitted applications (step S11). Specifically, determination processing unit 15 refers to manifest 14a of new application a0 stored in storage unit 14, and thereby identifies first application a1, second application a2, and third application a3 as communication-permitted applications.

[0089] Next, the determination processing unit 15 identifies the processing load of the information processing device 100 (step S12). For example, the determination processing unit 15 identifies the processing load by acquiring the processing load from the virtualization platform 40 included in the information processing device 100. This makes it possible to acquire an accurate processing load from the virtualization platform 40. Alternatively, the determination processing unit 15 identifies the processing load by estimating the processing load based on the driving state of the vehicle V. This makes it possible to estimate that the processing load is high if the vehicle V is in autonomous driving, and that the processing load is low if the vehicle V is parked. As a result, it is possible to estimate an appropriate processing load even if it is not possible to acquire an accurate processing load.

[0090] Next, the determination processor 15 determines whether the processing load of the information processing device 100 is equal to or greater than a threshold (step S13). If the determination processor 15 determines that the processing load is less than the threshold (No in step S13), the routing table generator 16 of VM1 generates an update request message requesting updating of the routing tables 14d corresponding to the communication-permitted applications (step S14). For example, a first application a1, a second application a2, and a third application a3 are identified as communication-permitted applications. In this case, the routing table generator 16 generates an update request message requesting updating of the routing tables 14d of the first application a1, the second application a2, and the third application a3. Note that these routing tables 14d are routing tables to be updated. Then, the transmission processor 11 in the communication unit 13 of VM1 transmits the generated update request message to the communication units 13 of all VMs having the respective routing tables to be updated (step S15). For example, an update request message for the routing table 14d corresponding to the first application a1 is sent to the communication unit 13 (specifically, the reception processing unit 12) of VM1. An update request message for the routing table 14d corresponding to the second application a2 is sent to the communication unit 13 (specifically, the reception processing unit 12) of VM2. An update request message for the routing table 14d corresponding to the third application a3 is sent to the communication unit 13 (specifically, the reception processing unit 12) of VM3. That is, update request messages for all routing tables to be updated are sent simultaneously.

[0091] On the other hand, if the determination processing unit 15 determines in step S13 that the processing load is equal to or greater than the threshold (Yes in step S13), it determines the priority of the routing table 14d corresponding to each communication-permitted application (step S16). Note that these routing tables 14d are routing tables to be updated. That is, when the processing load is equal to or greater than the threshold, the determination processing unit 15 determines the priority of each of the multiple routing tables to be updated. At this time, the determination processing unit 15 determines the priority of each of the multiple routing tables to be updated by referring to the application placement list 14c and the priority list 14b stored in the storage unit 14.

[0092] For example, a first application a1, a second application a2, and a third application a3 are identified as communication-permitted applications. In this case, the determination processor 15 identifies containers in which the first application a1, the second application a2, and the third application a3 are respectively located. For example, by referring to the application location list 14c shown in FIG. 8, the determination processor 15 identifies container L12 of VM1 as the container in which the first application a1 is located. Furthermore, the determination processor 15 identifies container L22 of VM2 as the container in which the second application a2 is located, and identifies container L32 of VM3 as the container in which the third application a3 is located.

[0093] Next, the determination processor 15 determines the priorities of the identified containers using the priority list 14b. For example, by referring to the priority list 14b shown in FIG. 7, the determination processor 15 determines that the container L12 of VM1 has a priority of "1 (high)", the container L22 of VM2 has a priority of "1 (high)", and the container L32 of VM3 has a priority of "3 (low)". Here, the priority of a container can be said to be the priority of the routing table 14d corresponding to the application placed in that container. Furthermore, a first application a1, a second application a2, and a third application a3 are placed in the container L12 of VM1, the container L22 of VM2, and the container L32 of VM3, respectively. Therefore, in step S16, the determination processing unit 15 determines the priority of the routing table 14d corresponding to the first application a1 to be priority "1 (high)", the priority of the routing table 14d corresponding to the second application a2 to be priority "1 (high)", and the priority of the routing table 14d corresponding to the third application a3 to be priority "3 (low)".

[0094] Next, similar to step S14, the routing table generation unit 16 generates an update request message requesting an update of the routing table 14d corresponding to each communication-permitted application (step S17). For example, a first application a1, a second application a2, and a third application a3 are identified as communication-permitted applications. In this case, the routing table generation unit 16 generates an update request message requesting an update of the routing table 14d corresponding to the first application a1, an update request message requesting an update of the routing table 14d corresponding to the second application a2, and an update request message requesting an update of the routing table 14d corresponding to the third application a3. Note that these routing tables 14d are the routing tables to be updated.

[0095] Then, the transmission processing unit 11 in the communication unit 13 of VM1 transmits the generated update request message (step S18). Specifically, the transmission processing unit 11 transmits the update request message to the communication unit 13 of the VM having the first update target routing table, which is the update target routing table with priority "1 (high)" among the multiple update target routing tables. For example, the routing tables 14d corresponding to the first application a1 and the second application a2 are the update target routing tables, and the priority of these update target routing tables has been determined to be priority "1 (high)". In this case, the routing tables 14d corresponding to the first application a1 and the second application a2 are the first update target routing tables. Therefore, the transmission processing unit 11 transmits the update request message to the communication unit 13 of each of VM1 and VM2 having the first update target routing tables.

[0096] Next, the determination processing unit 15 determines whether the processing load of the information processing device 100 is less than a threshold value (step S19). If the determination processing unit 15 determines that the processing load is equal to or greater than the threshold value (No in step S19), the determination processing unit 15 repeatedly executes the process of step S19. On the other hand, if the determination processing unit 15 determines that the processing load is less than the threshold value (Yes in step S19), the transmission processing unit 11 in the communication unit 13 of VM1 transmits an update request message to the communication unit 13 of the VM having a second routing table to be updated among the multiple routing tables to be updated (step S20). Here, the second routing table to be updated has a lower priority than the first routing table to be updated. That is, the second routing table to be updated is a routing table to be updated with a priority of "2 (medium)" or a priority of "3 (low)". For example, the routing table 14d corresponding to the third application a3 is the routing table to be updated, and the priority of the routing table to be updated is determined to be "3 (low)". In this case, the routing table 14d corresponding to the third application a3 is the second routing table to be updated, and the transmission processing unit 11 therefore transmits an update request message to the communication unit 13 of the VM3 that has the second routing table to be updated.

[0097] In this way, in this embodiment, the update request message for the second routing table to be updated, which has a lower priority, is transmitted after the update request message for the first routing table to be updated, which has a higher priority.

[0098] 10 is a flowchart showing another example of the processing operation of the information processing device 100 according to the present embodiment. Specifically, the flowchart shows an example of the processing operation when the communication control unit 10 of VM2 updates the routing table 14d in response to an update request message from VM1.

[0099] For example, when the receiving processor 12 in the communication unit 13 of VM2 receives an update request message transmitted from the communication unit 13 of VM2, the receiving processor 12 authenticates the update request message (step S31). For example, the receiving processor 12 performs authentication using a digital signature. Then, the receiving processor 12 determines whether the update request message is valid or not based on the authentication (step S32). If the receiving processor 12 determines that the update request message is valid (Yes in step S32), the routing table updater 17 of VM2 updates the routing table 14d corresponding to the update request message (step S33). This routing table 14d is the first routing table or the second routing table to be updated, and is stored in the storage unit 14 of VM2. That is, the routing table updater 17 of VM2 reflects the difference indicated by the update request message in the routing table 14d stored in the storage unit 14 of VM2. As a result, the routing table 14d is updated to indicate, for example, a communication path from the new application a0 to the second application a2.

[0100] On the other hand, if the receiving processing unit 12 determines that the update request message is not valid (No in step S32), the routing table update unit 17 ends the processing for the update request message without updating the routing table 14d.

[0101] Therefore, in this embodiment, the second routing table to be updated, which has a lower priority, is updated after the first routing table to be updated, which has a higher priority. In other words, among the multiple routing tables to be updated, the first routing table to be updated, which has a higher priority, is updated, and then the second routing table to be updated, which has a lower priority, is updated. This makes it possible to prevent multiple routing tables to be updated at the same time or all at once. As a result, it is possible to suppress a temporary increase in the processing load required to update multiple routing tables to be updated. Furthermore, since the first routing table to be updated, which has a higher priority, can be updated quickly, it is possible to suppress the temporary increase in the processing load described above while suppressing the possibility of problems occurring in communication between multiple applications in the information processing device 100.

[0102] Furthermore, the routing table update unit 17 in this embodiment performs authentication on the update request message to confirm the validity of the update request message, and then updates at least one of the first routing table to be updated and the second routing table to be updated. This makes it possible to prevent updates of the routing tables using fraudulent update request messages, thereby improving security performance.

[0103] Furthermore, in this embodiment, when the processing load of the information processing device 100 is equal to or greater than a threshold, a priority is determined, and an update request message is transmitted according to the priority. Therefore, when the processing load of the information processing device 100 is high, it is possible to prevent the processing load from further increasing due to multiple routing tables to be updated simultaneously. Furthermore, when the processing load is less than the threshold, the priority is not determined, and therefore, multiple routing tables to be updated simultaneously, as in step S15 of FIG. 9, for example, and communication between multiple applications can be quickly controlled.

[0104] 9 and 10, when the first update target routing table is stored in the storage unit 14 provided in the communication control unit 10 together with the routing table update unit 17, the routing table update unit 17 updates the first update target routing table at the timing when an update request message transmitted from the communication unit 13 is received. In other words, when the routing table update unit 17 receives the update request message, it immediately updates the first update target routing table with priority "1 (high)" after authenticating the update request message. Note that the above-mentioned communication unit 13 may be the communication unit 13 provided in the same VM together with the routing table update unit 17, or may be the communication unit 13 provided in another VM.

[0105] Furthermore, when a second routing table to be updated is stored in storage unit 14, which is provided in communication control unit 10 together with routing table update unit 17, routing table update unit 17 updates the second routing table to be updated at a predetermined timing. This allows the first routing table to be updated with priority "1 (high)" to be updated quickly. On the other hand, the second routing table to be updated with priority "2 (medium)" or priority "3 (low)" to be updated at a predetermined timing that is later than the first routing table to be updated.

[0106] Specifically, the predetermined timing is the timing when the processing load becomes less than the threshold, more specifically, the timing when the processing load is determined to be less than the threshold in step S19 of Fig. 9 and the routing table update unit 17 receives an update request message. This makes it possible to update the second routing table to be updated, which has a priority of "2 (medium)" or "3 (low)", at an appropriate timing.

[0107] Here, the predetermined timing may be not only the timing when the processing load becomes less than the threshold, but also any other timing after the timing when the first update target routing table is updated. For example, the predetermined timing may be the timing when the ignition switch of the vehicle V is switched from off to on, or the timing when a predetermined operation by the user is accepted. That is, in step S19 of FIG. 9, the determination processing unit 15 may determine whether the ignition switch of the vehicle V is switched from off to on, or whether a predetermined operation by the user is accepted. This allows the second update target routing table, which has a lower priority, to be updated at an appropriate timing.

[0108] In this embodiment, when new application a0 is installed, determination processing unit 15 identifies multiple communication-permitted applications and determines the priority of each of multiple routing tables to be updated. However, determination processing unit 15 may identify multiple communication-permitted applications and determine the priority of each of multiple routing tables to be updated not only when new application a0 is installed but also when new application a0 is updated. Therefore, when new application a0 is changed in information processing device 100, determination processing unit 15 identifies multiple communication-permitted applications and determines the priority of each of multiple routing tables to be updated.

[0109] That is, in this embodiment, when a change to the new application a0 is made to the information processing device 100, the determination processing unit 15 identifies multiple communication-permitted applications that are indicated in the manifest 14a of the new application a0 and that are permitted to communicate with the new application a0. The determination processing unit 15 then determines the priority of each of the multiple routing tables 14d corresponding to the multiple communication-permitted applications among the routing tables 14d held by VM1, VM2, and VM3 as the priority of each of the multiple routing tables to be updated. The new application a0 is changed in the information processing device 100 when (a) a new application is installed in the information processing device 100 as the new application a0, or (b) an existing application held by the information processing device 100 is updated to the new application a0. The new application a0 is also referred to as a first application program, and the communication-permitted application is also referred to as a second application program. As a result, when new application a0 is installed in information processing device 100, or when the installed new application a0 is updated, multiple routing tables 14d required for communication by the new application a0 are treated as multiple routing tables to be updated in accordance with manifest 14a of the installed or updated new application a0. The priority of each of these multiple routing tables to be updated is then determined. As a result, it is possible to appropriately select the required routing tables to be updated, and to determine the priority of the routing tables to be updated.

[0110] 9 and 10, the transmission timing of the update request message for the first routing table to be updated and the transmission timing of the update request message for the second routing table to be updated are different. As a result, the second routing table to be updated is updated after the first routing table to be updated. However, the transmission timing of the update request message for the first routing table to be updated and the transmission timing of the update request message for the second routing table to be updated may be the same. In this case, when the transmitted update request message for the second routing table to be updated is received by the communication unit 13, the routing table update unit 17, which is provided in the same VM as the communication unit 13, may update the second routing table to be updated at the predetermined timing described above. As described above, the timing may be the timing when the processing load becomes less than a threshold, the timing when the ignition switch of the vehicle V is switched from off to on, or the timing when a predetermined operation by the user is received.

[0111] (Variation 1) In the above embodiment, an app in the information processing device 100 cooperates with other apps in the information processing device 100. On the other hand, in this modification, an app in the information processing device 100 can cooperate with other apps in other information processing devices 100 other than the information processing device 100. Note that the information processing device 100 and the other information processing devices 100 are each, for example, ECUs, and when distinguishing between them, the information processing device 100 is called a first ECU and the other information processing device 100 is called a second ECU.

[0112] FIG. 11 is a diagram showing an example of the configuration of two information processing devices 100 in this modified example.

[0113] One of the two information processing devices 100 is a first ECU, and the other is a second ECU. Each of the two information processing devices 100 in this modification has a configuration similar to that of the information processing device 100 shown in FIG. 3 of the above-described embodiment. In the example shown in FIG. 11, the information processing device 100 that is the second ECU has VM4 as a virtual machine, and VM4 has container L41 and container L42. Container L42 stores a fourth application a4. Note that, in the example shown in FIG. 11, only one VM (i.e., VM4) is shown in the second ECU, but the second ECU may include multiple VMs.

[0114] Furthermore, the virtualization platform 40 of each of the two information processing devices 100 includes a global communication control unit 41. The global communication control unit 41 is called a global SCL and corresponds to multiple VMs. That is, the global communication control unit 41 of the first ECU corresponds to VM1, VM2, and VM3 so as to control communications between those VMs. Similarly, the global communication control unit 41 of the second ECU corresponds to multiple VMs including VM4 so as to control communications between those VMs.

[0115] Such a global communication control unit 41 communicates with other global communication control units 41. That is, the global communication control unit 41 of the first ECU communicates with the global communication control unit 41 of the second ECU via the hardware 50 of the first ECU and the hardware 50 of the second ECU. Each global communication control unit 41 is aware of not only the locations of the apps owned by the information processing device 100 including that global communication control unit 41, but also the locations of the apps owned by the other information processing devices 100. For example, the global communication control unit 41 of the first ECU is aware of not only the locations of the new application a0, the first application a1, the second application a2, and the third application a3, but also the location of the fourth application a4. Similarly, the global communication control unit 41 of the second ECU is aware of the locations of the new application a0, the first application a1, the second application a2, and the third application a3, as well as the location of the fourth application a4.

[0116] Therefore, when new application a0, which has the authority to cooperate with fourth application a4 of the second ECU, is installed in VM1 of the first ECU, the global communication control unit 41 of the first ECU can send an update request message to VM4 in response to a request from the communication control unit 10 of VM1. In other words, the global communication control unit 41 of the first ECU can send the update request message to the communication control unit 10 of VM4 via the global communication control unit 41 of the second ECU.

[0117] Details of the information processing device 100 in this modified example are as follows.

[0118] FIG. 12 is a diagram showing an example of a manifesto 14a in this modification.

[0119] 12, the manifest 14a of the new application a0 indicates not only the first application a1, the second application a2, and the third application a3, but also the fourth application a4 as one or more applications that are permitted to communicate with the new application a0. In other words, the new application a0 has the authority to cooperate with the fourth application a4 of the second ECU.

[0120] FIG. 13 is a diagram showing an example of the global arrangement list 41a held by the global communication control unit 41. As shown in FIG.

[0121] The global placement list 41a, like the application placement list 14c, is a list indicating, for each container, the applications placed or stored in that container. Furthermore, like the application placement list 14c, the global placement list 41a not only indicates the applications in each container included in one information processing device 100, but also indicates the applications in each container included in other information processing devices 100. In other words, the global placement list 41a is a list indicating, for each container included in each of the multiple information processing devices 100, the applications placed or stored in that container. The multiple information processing devices 100 are, for example, a first ECU and a second ECU. By referencing the global placement list 41a, the global communication control unit 41 is able to grasp the locations of not only the applications included in the information processing device 100 including the global communication control unit 41, but also the applications included in the other information processing devices 100.

[0122] Here, when the new application a0 is installed in VM1, the determination processor 15 in the communication controller 10 of VM1 refers to the manifest 14a shown in FIG. 12 and determines the priority of the routing table 14d corresponding to each application (i.e., communication-permitted applications) listed in the manifest 14a. The priorities of the routing tables 14d corresponding to the first application a1, the second application a2, and the third application a3 are determined in the same manner as in the above embodiment. On the other hand, even when the determination processor 15 refers to the application placement list 14c stored in the storage unit 14 of V1, it is unable to identify the location (i.e., container) of the fourth application a4. Therefore, the determination processor 15 is unable to determine the priority of the routing table 14d corresponding to the fourth application a4.

[0123] Therefore, the determination processing unit 15 requests the global communication control unit 41 of the first ECU to perform processing related to updating the routing table 14d corresponding to the fourth application a4. Upon receiving the processing request from the determination processing unit 15, the global communication control unit 41 of the first ECU identifies the container in which the fourth application a4 is placed by referring to the global placement list 41a shown in FIG. 13. The global communication control unit 41 then determines the priority of the container. Next, the global communication control unit 41 transmits an update request message for the routing table 14d corresponding to the fourth application a4 to the global communication control unit 41 of the information processing device 100 (i.e., the second ECU) that has the container, at a timing according to the determined priority.

[0124] When the global communication control unit 41 of the second ECU receives the update request message, it identifies the VM4 having the fourth application a4 by referring to the global placement list 41a stored in the global communication control unit 41. Then, the global communication control unit 41 transmits the update request message to the communication control unit 10 of the VM4. As a result, the communication control unit 10 of the VM4 updates the routing table 14d corresponding to the fourth application a4 in response to the update request message, as in the above embodiment.

[0125] In this modification, when the first ECU does not have the fourth application a4, which is one of the multiple communication-permitted applications, the global communication control unit 41 of the first ECU identifies a second ECU, which is an ECU other than the first ECU and has the fourth application a4, and transmits an update request message to the second ECU. The fourth application a4 is also referred to as a third application program. Furthermore, when the first ECU is referred to as an information processing device 100, the second ECU is also referred to as another information processing device 100. For example, the communication control unit 10 of VM1 attempts to transmit an update request message to VM4, which has a third application program and a routing table to be updated corresponding to the third application program. However, the communication control unit 10 of VM1 is unable to transmit the update request message because it does not know the location of VM4. However, in this modification, the global communication control unit 41 of the first ECU identifies the second ECU as the location of VM4, and is therefore able to appropriately transmit the update request message. As a result, the routing tables 14d can be updated between multiple ECUs. In other words, the communication control units 10 of VMs 1 to 3 included in the first ECU can appropriately transmit update request messages even if they do not know the locations of VM 4, container L41, and container L42 included in the second ECU. As a result, each communication control unit 10 does not need to hold the application placement list 14c for knowing the locations, and the amount of data held by each communication control unit 10 can be reduced.

[0126] Furthermore, when the global communication control unit 41 of the second ECU receives an update request message from the global communication control unit 41 of the first ECU, the global communication control unit 41 transmits the update request message to the communication control unit 10 of a VM (i.e., VM4) that has a fourth application a4 corresponding to the update request message, among the multiple VMs including VM4. Note that when the second ECU is referred to as the information processing device 100, the first ECU is also referred to as another information processing device 100. In this way, when the second ECU receives an update request message from the first ECU, it can update the routing table to be updated in accordance with the update request message.

[0127] (Variation 2) In the above-described embodiment and modification 1, one priority list 14b is stored in the storage unit 14. On the other hand, in this modification, the storage unit 14 stores a plurality of priority lists 14b. The priority list 14b referenced by the determination processing unit 15 is dynamically switched.

[0128] That is, the determination processing unit 15 selects a priority list 14b corresponding to the state of the vehicle V from among the multiple priority lists 14b stored in the storage unit 14. Then, the determination processing unit 15 determines the priority of each of the multiple routing tables to be updated using the selected priority list 14b. Note that each of the multiple priority lists 14b indicates the priority of the routing table 14d held by each of the multiple VMs. The multiple priority lists 14b may include a priority list 14b for autonomous driving, a priority list 14b for normal driving, and a priority list 14b for when the vehicle is stopped. If the vehicle V is performing autonomous driving, the determination processing unit 15 selects the priority list 14b for autonomous driving; if the vehicle V is performing normal driving, the determination processing unit 15 selects the priority list 14b for normal driving; and if the vehicle V is stopped, the determination processing unit 15 selects the priority list 14b for when the vehicle is stopped. This makes it possible to appropriately determine the priority of each of the multiple routing tables to be updated according to the state of the vehicle V. The multiple priority lists 14b stored in the memory unit 13 are not limited to the priority list 14b for automatic driving, the priority list 14b for normal driving, and the priority list 14b for when the vehicle is stopped. The multiple priority lists 14b may include any priority list 14b as long as the priority list 14b corresponds to each state or each function of the vehicle V. Furthermore, the number of the multiple priority lists 14b is not limited to three, and may be any number equal to or greater than two.

[0129] In the above embodiment, the routing table 14d is updated in response to the update request message after the update request message is authenticated. In contrast, in this modification, the routing table update unit 17 updates the routing table 14d in response to the update request message based not only on the authentication of the update request message but also on a notice of the update request message. For example, when a new application a0 is installed in VM1 of the information processing device 100, the communication control unit 10 of VM1 transmits a notice message to the communication control units 10 of VMs having communication-permitted applications corresponding to the new application a0. The notice message is a message indicating that an application has been changed in the information processing device 100 and notifying in advance that an update request message will be transmitted due to the change. For example, the routing table update unit 17 in the communication control unit 10 of VM2 receives the update request message from the communication control unit 10 of VM1. At this time, if the authenticity of the update request message is confirmed by authentication and the notice message has been received in advance, the routing table update unit 17 of VM2 updates the routing table to be updated in response to the update request message. In addition, the routing table update unit 17 may update the routing table to be updated if the validity of the update request message is confirmed by authentication and the update request message is received within, for example, 10 seconds after receiving the notification message.

[0130] In this manner, when the routing table update unit 17 in this modification receives an update request message transmitted from the communication unit 13, if a message indicating that an application program has been changed in the information processing device 100 has been received within a predetermined period from the reception of the update request message, the routing table update unit 17 updates at least one of the first update target routing table and the second update target routing table. The predetermined period is, for example, 10 seconds. As a result, the message indicating that an application has been changed in the information processing device 100 is treated as a notice message. The notice message is a message that notifies in advance that an update request message will be transmitted. Then, if an update request message is received within a predetermined period from the reception of the notice message, the update target routing table is updated in accordance with the update request message. Therefore, it is possible to prevent an unauthorized update request message from being received and the update target routing table from being updated in accordance with the unauthorized update request message even when an application has not been changed in the information processing device 100.

[0131] Although the information processing device of the present disclosure has been described above based on the above-described embodiment and each modified example, the present disclosure is not limited to the above-described embodiment and each modified example. As long as it does not deviate from the spirit of the present disclosure, various modifications that a person skilled in the art may make to the above-described embodiment or each modified example, or forms constructed by combining the above-described embodiment and each modified example, may also be included in the present disclosure.

[0132] In the above-described embodiments and modifications, each component may be configured with a dedicated circuit or hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU (Central Processing Unit) or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory. Here, the program, which is software that realizes the device or system of the above-described embodiments, causes a computer to execute each step included in the flowcharts of Figures 9 and 10.

[0133] The following cases are also included in this disclosure:

[0134] (1) The above-mentioned device or system may specifically be a computer system consisting of a microprocessor, ROM (Read Only Memory), RAM (Random Access Memory), a hard disk unit, a display unit, a keyboard, a mouse, etc. A computer program is stored in the RAM or hard disk unit. The above-mentioned device or system achieves its function when the microprocessor operates in accordance with the computer program. Here, the computer program is composed of a combination of multiple instruction codes that indicate instructions to the computer to achieve a predetermined function.

[0135] (2) Some or all of the components constituting the above-mentioned device or system may be configured as a single system LSI (Large Scale Integration). A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on a single chip, and specifically, is a computer system configured including a microprocessor, ROM, RAM, etc. A computer program is stored in the RAM. The system LSI achieves its functions when the microprocessor operates in accordance with the computer program.

[0136] (3) Some or all of the components constituting the above-mentioned device or system may be configured as an IC card or a standalone module that can be attached to or detached from the device or system. The IC card or module is a computer system consisting of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunctional LSI. The IC card or module achieves its functions when the microprocessor operates in accordance with a computer program. This IC card or module may be tamper-resistant.

[0137] (4) The present disclosure may be embodied as the methods described above, a computer program for implementing these methods on a computer, or a digital signal comprising the computer program.

[0138] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD (Compact Disc)-ROM, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Alternatively, the present disclosure may be a digital signal recorded on such a recording medium.

[0139] The present disclosure may also be applied to transmitting a computer program or digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0140] Furthermore, the program or digital signal may be recorded on a recording medium and transferred, or the program or digital signal may be transferred via a network or the like, so that the program or digital signal may be implemented by another independent computer system. [Industrial Applicability]

[0141] The information processing device of the present disclosure can suppress a temporary increase in processing load, and can be applied to devices or systems mounted on vehicles, etc. [Explanation of symbols]

[0142] 1, 2, 3, 4 VM (Virtual Machine) L11, L12, L21, L22, L31, L32, L41, L42 containers 10 Communication control section 11 Transmission processing unit 12 Receiving processing section 13 Communications Department 14 Storage section 14a Manifesto 14b Priority List 14c App Deployment List 14d Routing Table 15. Judgment processing unit 16 Routing table generation unit 17 Routing table update section 20 Guest OS 21, 22, 23 Communication Services 40 Virtualization Platform 41 Global communication control section 41a Global Placement List 50 Hardware 100 Information processing device 800 Monitoring Server 900 In-Vehicle Systems 910 Integrated ECU 912, 918 Zone ECU 914 Steering ECU 916 Brake ECU 920 Front Camera ECU 922 Rear Camera ECU 924, 926 CAN 928, 930 Ethernet Nt External Network V vehicle

Claims

1. An information processing device mounted on a vehicle, A plurality of virtual machines each having a communication control unit are provided, The communication control unit a storage unit that stores a routing table for controlling communication paths between a plurality of application programs executed on the plurality of virtual machines; a determination processing unit that determines the priority of each of a plurality of routing tables to be updated among the routing tables held by each of the plurality of virtual machines; a routing table generation unit that generates an update request message for requesting one or more virtual machines having the plurality of routing tables to update the plurality of routing tables to be updated; a communication unit that transmits the update request message to the one or more virtual machines; The routing table generation unit and the communication unit generating and transmitting the update request message so that a second routing table to be updated, which has a lower priority than the first routing table to be updated, among the plurality of routing tables to be updated, is updated after the first routing table to be updated; Information processing device.

2. The communication control unit further a routing table update unit that, upon receiving the update request message transmitted from the communication unit, updates at least one of the first update target routing table and the second update target routing table, which are stored in the storage unit provided in the communication control unit, in accordance with the update request message; The information processing device according to claim 1 .

3. The routing table update unit updating at least one of the first update target routing table and the second update target routing table after verifying the validity of the update request message by authenticating the update request message; The information processing device according to claim 2 .

4. The determination processing unit further determining whether a processing load of the information processing device is equal to or greater than a threshold; If the processing load is equal to or greater than the threshold, determine the priority of each of the plurality of routing tables to be updated. The information processing device according to claim 1 .

5. The determination processing unit further (a) acquiring the processing load from a virtualization platform included in the information processing device; or (b) estimating the processing load based on a running state of the vehicle; The information processing device according to claim 4 .

6. The determination processing unit further When a change is made to a first application program in the information processing device, Identifying a plurality of second application programs that are permitted to communicate with the first application program, as indicated by the manifest of the first application program; determining a priority of each of a plurality of routing tables corresponding to the plurality of second application programs among the routing tables possessed by each of the plurality of virtual machines as a priority of each of the plurality of routing tables to be updated; When the first application program is changed in the information processing device, (a) when a new application program is installed as the first application program in the information processing device; or (b) when an existing application program included in the information processing device is updated as the first application program; The information processing device according to claim 1 .

7. The routing table update unit (a) when the first routing table to be updated is stored in the storage unit provided in the communication control unit together with the routing table update unit, updating the first update target routing table at the timing when the update request message transmitted from the communication unit is received; (b) when the second routing table to be updated is stored in the storage unit provided in the communication control unit together with the routing table update unit, updating the second routing table to be updated at a predetermined timing; The information processing device according to claim 2 .

8. The predetermined timing is (a) the timing when the processing load of the information processing device becomes less than a threshold value, (b) the timing when the ignition switch of the vehicle is switched from off to on, or (c) the timing when a predetermined operation by a user is accepted. The information processing device according to claim 7 .

9. The information processing device further comprises: a global communication control unit corresponding to the plurality of virtual machines; The global communication control unit When a third application program, which is one of the plurality of second application programs, is not present in the information processing device, identifying another information processing device different from the information processing device, the other information processing device having the third application program; transmitting the update request message to the other information processing device; The information processing device according to claim 6 .

10. The global communication control unit when receiving the update request message from a global communication control unit of another information processing device, transmitting the update request message to the communication control unit of a virtual machine having a third application program corresponding to the update request message, among the plurality of virtual machines; The information processing device according to claim 9 .

11. The storage unit further Store multiple priority lists, The determination processing unit selecting a priority list according to the state of the vehicle from the plurality of priority lists, and determining the priority of each of the plurality of routing tables to be updated using the selected priority list; each of the plurality of priority lists indicating the priority of the routing table of each of the plurality of virtual machines; The information processing device according to claim 1 .

12. The routing table update unit Upon receiving the update request message transmitted from the communication unit, if a message indicating that an application program has been changed has been received for the information processing device within a predetermined period from the reception of the update request message, at least one of the first update target routing table and the second update target routing table is updated. The information processing device according to claim 2 .

13. An information processing method performed by an information processing device equipped with a plurality of virtual machines and mounted on a vehicle, comprising: determining a priority of each of a plurality of routing tables to be updated among the routing tables for controlling communication paths between a plurality of application programs executed on the plurality of virtual machines, the routing tables being held by each of the plurality of virtual machines; generating an update request message for requesting one or more virtual machines having the plurality of routing tables to update the plurality of routing tables to be updated; sending the update request message to the one or more virtual machines; In generating and transmitting the update request message, generating and transmitting the update request message so that a second routing table to be updated, which has a lower priority than the first routing table to be updated, among the plurality of routing tables to be updated, is updated after the first routing table to be updated; Information processing methods.

14. A program for a computer of an information processing device that is equipped with a plurality of virtual machines and is mounted on a vehicle, determining a priority of each of a plurality of routing tables to be updated among the routing tables for controlling communication paths between a plurality of application programs executed on the plurality of virtual machines, the routing tables being held by each of the plurality of virtual machines; generating an update request message for requesting one or more virtual machines having the plurality of routing tables to update the plurality of routing tables to be updated; sending the update request message to the one or more virtual machines; In generating and transmitting the update request message, generating and transmitting the update request message so that a second routing table to be updated, which has a lower priority than the first routing table to be updated, among the plurality of routing tables to be updated, is updated after the first routing table to be updated; A program that causes the computer to execute the above.

Images