Vehicle-mounted relay device, relay method, and relay program

Abstract

To easily improve security in an in-vehicle network.SOLUTION: An in-vehicle relay device includes: a relay unit for relaying frames transmitted and received between in-vehicle devices in an in-vehicle network; a calculation unit for calculating the processing load of another in-vehicle device, on the basis of the frames to another in-vehicle device that the relay unit has received from the in-vehicle device; and a determination unit for performing a determination process to determine whether the relay unit should relay the frame to another in-vehicle device or not, on the basis of the processing load calculated by the calculation unit.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to an in-vehicle relay device, a relay method, and a relay program. [Background technology]

[0002] Conventionally, techniques have been developed to improve security in in-vehicle networks.

[0003] For example, Japanese Patent Laid-Open Publication No. 2008-252221 (Patent Document 1) discloses the following device. That is, it is a DoS attack defense device that monitors packets transmitted between a communication terminal and a server connected to the communication terminal via a network, and includes a packet receiving means for receiving the packets, and a packet transmitting means for determining whether the packets can be transmitted based on the received packets, and transmitting the packets if they can be transmitted. This device measures the packet rate, that is, the number of packets per unit time, and discards packets when a preset threshold is exceeded.

[0004] Also, JP2019-523584A (Patent Document 2) discloses the following method. That is, a network attack defense method, comprising: a step of acquiring a set of one or more statistical attributes for a protected site by collecting statistics of a set of one or more site attributes for the protected site, the set of one or more site attributes for the protected site indicating an operation mode of the protected site; a step of determining that the protected site transitions from a current operation mode to a target operation mode based at least in part on the set of one or more statistical attributes, the current operation mode having a current defense strategy, the target operation mode having a target defense strategy, and the current defense strategy being different from the target defense strategy; and a step of transitioning from the current operation mode to the target operation mode and applying the target defense strategy to the protected site in response to the determination that the protected site transitions from the current operation mode to the target operation mode. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2008-252221 A [Patent Document 2] Special Publication No. 2019-523584 Summary of the Invention [Problem to be solved by the invention]

[0006] In an in-vehicle network, the amount of packets transmitted in the in-vehicle network varies depending on the driving pattern, the functions used, etc. If the statistics of packets transmitted in the in-vehicle network are to be grasped, it is necessary to try a wide variety of situations according to driving patterns and the presence or absence of functions.

[0007] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide an in-vehicle relay device, a relay method, and a relay program that can easily improve security in an in-vehicle network. [Means for solving the problem]

[0008] The vehicle-mounted relay device of the present disclosure comprises a relay unit that relays frames transmitted and received between vehicle-mounted devices in an vehicle network, a calculation unit that calculates the processing load of the other vehicle-mounted device based on a plurality of frames addressed to the other vehicle-mounted device received from the vehicle-mounted device by the relay unit, and a judgment unit that performs a judgment process to determine whether the frame addressed to the other vehicle-mounted device should be relayed in the relay unit based on the processing load calculated by the calculation unit.

[0009] The relay method disclosed herein is a relay method in an in-vehicle relay device having a relay unit that relays frames transmitted and received between in-vehicle devices in an in-vehicle network, and includes a step of calculating the processing load of the other in-vehicle device based on a plurality of frames addressed to the other in-vehicle device received from the in-vehicle device by the relay unit, and a step of performing a judgment process to judge whether the frame addressed to the other in-vehicle device should be relayed in the relay unit based on the calculated processing load.

[0010] The relay program disclosed herein is a relay program used in an in-vehicle relay device, and is a program for causing a computer to function as a relay unit that relays frames transmitted and received between in-vehicle devices in an in-vehicle network, a calculation unit that calculates the processing load of the other in-vehicle device based on a plurality of frames addressed to the other in-vehicle device received from the in-vehicle device by the relay unit, and a judgment unit that performs a judgment process to determine whether the frame addressed to the other in-vehicle device should be relayed in the relay unit based on the processing load calculated by the calculation unit.

[0011] One aspect of the present disclosure can be realized not only as an in-vehicle relay device equipped with such a characteristic processing unit, but also as a semiconductor integrated circuit that realizes part or all of the in-vehicle relay device, or as a system that includes the in-vehicle relay device. Effect of the Invention

[0012] According to the present disclosure, security in an in-vehicle network can be easily improved. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram showing a configuration of an in-vehicle system according to an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram illustrating a configuration of an in-vehicle relay device in an in-vehicle system according to an embodiment of the present disclosure. [Diagram 3] FIG. 3 is a diagram illustrating an example of frame processing information in the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating an example of load information in the vehicle-mounted relay device according to the embodiment of the present disclosure. [Diagram 5] FIG. 5 is a diagram illustrating an example of load information in the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 6] FIG. 6 is a diagram illustrating an example of a process in which the vehicle-mounted relay device according to the embodiment of the present disclosure restricts a frame. [Figure 7] FIG. 7 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure receives a frame. [Figure 8] FIG. 8 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure updates the load information. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] First, the contents of the embodiments of the present disclosure will be listed and described. (1) An in-vehicle relay device according to an embodiment of the present disclosure includes a relay unit that relays frames transmitted and received between in-vehicle devices in an in-vehicle network, a calculation unit that calculates the processing load of the other in-vehicle devices based on a plurality of frames addressed to the other in-vehicle devices received from the in-vehicle device by the relay unit, and a judgment unit that performs a judgment process to determine whether the frames addressed to the other in-vehicle devices should be relayed in the relay unit based on the processing load calculated by the calculation unit.

[0015] In this way, by calculating the processing load of an in-vehicle device based on multiple frames addressed to the same in-vehicle device received by a relay device and using the calculation result to determine whether or not to relay a frame addressed to the in-vehicle device, it is possible to defend against attacks using frame transmission to in-vehicle devices without trying a wide variety of different situations depending on driving patterns and the presence or absence of functions, for example, in an in-vehicle network in which the amount of packets transmitted in the in-vehicle network varies depending on driving patterns and functions used, etc. Therefore, security in the in-vehicle network can be easily improved.

[0016] (2) The vehicle-mounted relay device may further include a memory unit that stores frame processing information indicating the processing load of the frame in the vehicle-mounted device for each type of frame, and the calculation unit may calculate the processing load based on each type of the plurality of frames and the frame processing information.

[0017] The load imposed on the device when processing received packets differs depending on the type of packet. Compared to a configuration that simply uses communication traffic such as the number of packets per unit time as a judgment criterion, the above configuration makes it possible to make a judgment that takes into account the difference in processing load according to the type of packet, so that, for example, when an attack is made by transmitting a small number of packets that require high processing load to a specific in-vehicle device, such an attack can be more reliably defended against.

[0018] (3) The frame processing information may further indicate a processing time required to process the frame in the in-vehicle device for each type of frame, and the calculation unit may update the processing load based on the elapsed time since the relay unit received or relayed the frame and the processing time corresponding to the frame.

[0019] With this configuration, it is possible to make an appropriate decision that further takes into consideration the difference in processing completion time according to the type of packet.

[0020] (4) The vehicle-mounted relay device may further include a memory unit that stores frame processing information indicating the processing load of the frame in the vehicle-mounted device for each vehicle-mounted device, and the calculation unit may calculate the processing load based on the processing load corresponding to the other vehicle-mounted devices in the frame processing information.

[0021] The load when the device processes received packets varies depending on the specifications of the in-vehicle device, etc. With the above-mentioned configuration, it is possible to make an appropriate judgment taking into account the difference in processing load according to the specifications of the in-vehicle device, compared to a configuration that simply uses communication traffic such as the number of packets per unit time as a judgment criterion.

[0022] (5) The frame processing information may further indicate, for each of the in-vehicle devices, a processing time required to process the frame in the in-vehicle device, and the calculation unit may update the processing load based on the elapsed time since the relay unit received or relayed the frame and the processing time corresponding to the frame.

[0023] With this configuration, it is possible to make an appropriate determination that further takes into consideration differences in processing completion time according to the specifications of the in-vehicle device, etc.

[0024] (6) The vehicle-mounted relay device may further include a memory unit that stores frame processing information indicating a threshold value of the processing load for each vehicle-mounted device, and the judgment unit may perform the judgment process based on a comparison result between the processing load calculated by the calculation unit and the threshold value corresponding to the other vehicle-mounted device in the frame processing information.

[0025] The value of the processing load that is permissible in an in-vehicle device varies depending on the specifications of the in-vehicle device, etc. With the above-described configuration, it is possible to make an appropriate determination taking into consideration the difference in the permissible value of the processing load according to the specifications of the in-vehicle device, etc.

[0026] (7) The judgment unit performs the judgment process based on a comparison result between the processing load calculated by the calculation unit and a threshold value, and the threshold value may be a value based on a measurement result of a frame transmission period in a vehicle having a specified network configuration.

[0027] With this configuration, it is possible to set a more appropriate threshold value in an in-vehicle network in which best-effort communication is performed and the bandwidth used varies depending on the vehicle's conditions.

[0028] (8) A relay method according to an embodiment of the present disclosure is a relay method in an in-vehicle relay device having a relay unit that relays frames transmitted and received between in-vehicle devices in an in-vehicle network, and includes a step of calculating a processing load of the other in-vehicle device based on a plurality of frames addressed to the other in-vehicle device received from the in-vehicle device by the relay unit, and a step of performing a judgment process of judging whether or not the frame addressed to the other in-vehicle device should be relayed in the relay unit based on the calculated processing load.

[0029] In this way, by calculating the processing load of an in-vehicle device based on multiple frames addressed to the same in-vehicle device received by a relay device and using the calculation result to determine whether or not to relay a frame addressed to the in-vehicle device, it is possible to defend against attacks using frame transmission to in-vehicle devices without trying a wide variety of different situations depending on driving patterns and the presence or absence of functions, for example, in an in-vehicle network in which the amount of packets transmitted in the in-vehicle network varies depending on driving patterns and functions used, etc. Therefore, security in the in-vehicle network can be easily improved.

[0030] (9) A relay program according to an embodiment of the present disclosure is a relay program used in an in-vehicle relay device, and is a program for causing a computer to function as a relay unit that relays frames transmitted and received between in-vehicle devices in an in-vehicle network, a calculation unit that calculates the processing load of the other in-vehicle device based on a plurality of frames addressed to the other in-vehicle device received from the in-vehicle device by the relay unit, and a judgment unit that performs a judgment process to determine whether the frame addressed to the other in-vehicle device should be relayed in the relay unit based on the processing load calculated by the calculation unit.

[0031] In this way, by calculating the processing load of an in-vehicle device based on multiple frames addressed to the same in-vehicle device received by a relay device and using the calculation result to determine whether or not to relay a frame addressed to the in-vehicle device, it is possible to defend against attacks using frame transmission to in-vehicle devices without trying a wide variety of different situations depending on driving patterns and the presence or absence of functions, for example, in an in-vehicle network in which the amount of packets transmitted in the in-vehicle network varies depending on driving patterns and functions used, etc. Therefore, security in the in-vehicle network can be easily improved.

[0032] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and the description thereof will not be repeated. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0033] [Configuration and basic operation] 1 is a diagram showing a configuration of an in-vehicle system according to an embodiment of the present disclosure. Referring to FIG 1, an in-vehicle system 301 is mounted on a vehicle, and includes an in-vehicle relay device 101 and a plurality of in-vehicle devices 202.

[0034] The in-vehicle system 301 may be configured to include a plurality of in-vehicle relay devices 101. In Fig. 1, as an example, the in-vehicle system 301 includes one in-vehicle relay device 101 and four in-vehicle ECUs (Electronic Control Units) 202.

[0035] The in-vehicle ECU 202 is an example of an in-vehicle device, and may be, for example, a TCU (Telematics Control Unit), an automatic driving ECU, an engine ECU, a sensor, a navigation device, a human-machine interface, a camera, etc. The TCU communicates with a device outside the vehicle, such as a server 401, via a wireless base station (not shown). The in-vehicle device may be a device that a user brings into the vehicle, and may be, for example, a mobile terminal such as a tablet or an electronic device such as a Universal Serial Bus (USB) memory.

[0036] The in-vehicle relay device 101 and the in-vehicle ECU 202 configure an in-vehicle network 151. The in-vehicle ECU 202 and the in-vehicle relay device 101 are examples of in-vehicle devices in the in-vehicle network 151. The network configuration, such as the type, connection relationship, and communication protocol of each in-vehicle device in the in-vehicle network 151, is, for example, fixed. Note that a new in-vehicle device or electronic device may be added to the in-vehicle network 151.

[0037] The in-vehicle relay device 101 can relay information between a plurality of in-vehicle ECUs 202 in the in-vehicle network 151. More specifically, the in-vehicle relay device 101 can perform relay processing according to Layer 2 of the OSI (Open Systems Interconnection) reference model, for example. Note that the in-vehicle relay device 101 may be configured to perform relay processing according to Layer 3, which is higher than Layer 2, in addition to Layer 2.

[0038] In the in-vehicle network 151, the in-vehicle ECU 202 is connected to the in-vehicle relay device 101 via an Ethernet (registered trademark) cable 91, for example.

[0039] The in-vehicle relay device 101 relays Ethernet frames in accordance with the Ethernet communication standard. Specifically, the in-vehicle relay device 101 relays Ethernet frames exchanged between the in-vehicle ECUs 202, for example. An IP packet is stored in the Ethernet frame.

[0040] In addition, the in-vehicle system 301 is not limited to a configuration in which Ethernet frames are relayed in accordance with the Ethernet communication standard, but may be a configuration in which data is relayed in accordance with communication standards such as CAN (Controller Area Network) (registered trademark), FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), and LIN (Local Interconnect Network).

[0041] Fig. 2 is a diagram showing a configuration of an in-vehicle relay device in an in-vehicle system according to an embodiment of the present disclosure. Referring to Fig. 2, the in-vehicle relay device 101 includes four communication ports 21, a relay unit 22, a processing unit 24, and a storage unit 25. The processing unit 24 includes a calculation unit 1 and a determination unit 2. Note that the in-vehicle relay device 101 is not limited to a configuration including four communication ports 21, and may include two, three, five or more communication ports 21.

[0042] The communication ports 21 are terminals to which, for example, an Ethernet cable 91 can be connected. The communication ports 21 may be terminals of an integrated circuit. The four communication ports 21 are connected to the in-vehicle ECU 202 via the Ethernet cables 91.

[0043] The processing unit 24 is realized by a processor such as a CPU (Central Processing Unit) and a DSP (Digital Signal Processor), etc. The relay unit 22 is realized by an L2 switch IC and a processor, etc. The storage unit 25 is, for example, a non-volatile memory.

[0044] The relay unit 22 relays frames transmitted and received between the in-vehicle ECUs 202 in the in-vehicle network 151. For example, the relay unit 22 can function as an L2 switch, and performs relay processing on Ethernet frames transmitted between the in-vehicle ECUs 202 connected to its own in-vehicle relay device 101. More specifically, when the relay unit 22 receives an Ethernet frame from a certain in-vehicle ECU 202 via a corresponding Ethernet cable 91, the relay unit 22 transmits the received Ethernet frame to a destination in-vehicle ECU 202 via the corresponding Ethernet cable 91. The relay unit 22 can function as an L3 switch, and may be configured to perform relay processing on Ethernet frames transmitted between the in-vehicle ECUs 202 connected to different in-vehicle relay devices 101.

[0045] The relay unit 22 performs the above relay process by, for example, referring to a table stored in the storage unit 25 that indicates the correspondence between destination MAC addresses and communication ports 21 .

[0046] The calculation unit 1 calculates the processing load of the other in-vehicle ECU 202 (hereinafter also referred to as the destination ECU) based on multiple frames addressed to the other in-vehicle ECU 202 received by the relay unit 22 from the in-vehicle ECU 202, i.e., calculates an estimated value of the processing load in the in-vehicle ECU 202.

[0047] The determination unit 2 performs a determination process based on the processing load calculated by the calculation unit 1 to determine whether or not a frame addressed to the other in-vehicle ECU 202 should be relayed by the relay unit 22 .

[0048] FIG. 3 is a diagram illustrating an example of frame processing information in the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0049] The storage unit 25 stores frame processing information indicating the processing load of a frame in the in-vehicle ECU 202 for each in-vehicle ECU 202 and for each type of frame. For example, the frame processing information further indicates the processing time required for processing the frame in the in-vehicle ECU 202 for each type of frame.

[0050] The storage unit 25 also stores frame processing information indicating a processing load threshold for each in-vehicle ECU 202 .

[0051] Specifically, referring to FIG. 3, the frame processing information is information indicating a correspondence relationship between an in-vehicle ECU, a processing target frame, an increased load rate, a processing time, and a threshold value of the processing load rate.

[0052] For example, when in-vehicle ECU-A processes frame No. 1, which is a frame to be processed, the processor processing load rate increases by a%, and the processing time required to complete processing of the frame is w milliseconds, and when in-vehicle ECU-A processes frame No. 2, which is a frame to be processed, the processor processing load rate increases by b%, and the processing time required to complete processing of the frame is x milliseconds. When in-vehicle ECU-B processes frame No. 1, which is a frame to be processed, the processor processing load rate increases by c%, and the processing time required to complete processing of the frame is y milliseconds, and when in-vehicle ECU-B processes frame No. 3, which is a frame to be processed, the processor processing load rate increases by d%, and the processing time required to complete processing of the frame is z milliseconds.

[0053] In addition, the judgment unit 2 judges that relaying of Ethernet frames addressed to the vehicle ECU-A should be stopped when the processing load rate of the processor of the vehicle ECU-A exceeds M%, and judges that relaying of Ethernet frames addressed to the vehicle ECU-B should be stopped when the processing load rate of the processor of the vehicle ECU-B exceeds N%.

[0054] 4 and 5 are diagrams illustrating an example of load information in the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0055] 4 and 5, storage unit 25 stores, for each in-vehicle ECU 202, load information indicating a correspondence relationship between an estimated value of a current processing load rate, a frame being processed, and a processing start time of the frame.

[0056] 4, the in-vehicle ECU-A is processing two frames No. 1, the processing start times of these two frames are t1 and t2, respectively, and the estimated value of the current processing load rate is P%. Here, the processing start time is, for example, the time when the in-vehicle relay device 101 receives the frame or the time when the in-vehicle relay device 101 transmits the frame to the destination in-vehicle ECU 202.

[0057] Furthermore, the relay unit 22 receives an Ethernet frame and notifies the processing unit 24 of information such as the destination MAC address and logical port number of the received Ethernet frame.

[0058] The processing unit 24 uses the information notified by the relay unit 22 to determine the destination, type, etc. of the Ethernet frame.

[0059] After receiving the information, if the relay unit 22 is notified by the processing unit 24 that relaying of the Ethernet frame is “permitted”, the relay unit 22 relays the Ethernet frame to the destination vehicle-mounted ECU 202, and if the relay unit 22 is notified that relaying is “prohibited”, the relay unit 22 discards the Ethernet frame without relaying it.

[0060] FIG. 6 is a diagram illustrating an example of a process in which the vehicle-mounted relay device according to the embodiment of the present disclosure restricts a frame.

[0061] The calculation unit 1 calculates the sum of the increased load rates corresponding to the plurality of frames as the processing load of the other in-vehicle ECUs 202 .

[0062] For example, the calculation unit 1 calculates the processing load rate of the other in-vehicle ECU 202 based on a plurality of frames addressed to the other in-vehicle ECU 202 received by the relay unit 22 from the in-vehicle ECU 202 and the processing load, i.e., the increased load rate, corresponding to the other in-vehicle ECU 202 in the frame processing information.

[0063] Furthermore, for example, the calculation unit 1 calculates the processing load rate of the other in-vehicle ECU 202 based on the type of each of the plurality of frames and the frame processing information.

[0064] The determination unit 2 performs a determination process based on a result of comparison between the processing load rate calculated by the calculation unit 1 and a threshold value corresponding to the other in-vehicle ECU 202 in the frame processing information.

[0065] Specifically, with reference to FIG. 6, a case will be described in which a large number of frames are sent via an in-vehicle ECU-Z which is an in-vehicle ECU 202 in order to exhaust the resources of an in-vehicle ECU-A which is an in-vehicle ECU 202.

[0066] First, frame No. 1 addressed to in-vehicle ECU-A is transmitted from in-vehicle ECU-Z to in-vehicle relay device 101. Calculation unit 1 adds a % to the processing load rate of in-vehicle ECU-A. Since the processing load rate after the addition by calculation unit 1 does not exceed M%, determination unit 2 registers the processing load rate after the addition and processing start time t1 of frame No. 1 in the load information, and notifies relay unit 22 of "permission" to relay the frame.

[0067] Next, frame No. 1 addressed to in-vehicle ECU-A is transmitted from in-vehicle ECU-Z to in-vehicle relay device 101. Calculation unit 1 adds a % to the processing load rate of in-vehicle ECU-A. The processing load rate becomes P%, which is smaller than M%. Since the processing load rate after the addition by calculation unit 1 does not exceed M%, judgment unit 2 registers the processing load rate after the addition and the processing start time t2 of frame No. 1 in the load information, and notifies relay unit 22 of "permission" to relay the frame. Figure 4 shows this state.

[0068] Next, frame No. 2 addressed to in-vehicle ECU-A is transmitted from in-vehicle ECU-Z to in-vehicle relay device 101. Calculation unit 1 adds b% to the processing load rate of in-vehicle ECU-A. The processing load rate becomes Q%, which is smaller than M%. Since the processing load rate after the addition by calculation unit 1 does not exceed M%, judgment unit 2 registers the processing load rate after the addition and processing start time t3 of frame No. 2 in the load information, and notifies relay unit 22 of "permission" to relay the frame. Figure 5 shows this state.

[0069] Next, frame No. 1 addressed to in-vehicle ECU-A is transmitted from in-vehicle ECU-Z to in-vehicle relay device 101. Calculation unit 1 adds a % to the processing load rate of in-vehicle ECU-A. The processing load rate becomes R %, which is greater than M %. Since the processing load rate after the addition by calculation unit 1 exceeds M %, judgment unit 2 notifies relay unit 22 that relaying of the frame is "prohibited." The load information remains in the state shown in FIG. 5, for example.

[0070] After that, the processing load rate decreases, and until the processing load rate after adding the increased load rate corresponding to the newly received frames falls to M% or less, the determination unit 2 prohibits relaying of frames, and the relay unit 22 discards the received frames addressed to the in-vehicle ECU-A. This makes it possible to defend against attacks in which a large number of frames are sent from the in-vehicle ECU-Z to the in-vehicle ECU-A.

[0071] For example, the threshold value used by the determination unit 2 for comparison with the processing load calculated by the calculation unit 1 may be a value based on the measurement result of the frame transmission period in a vehicle having a predetermined network configuration.

[0072] Specifically, for example, the log of the measurement results in a certain vehicle is analyzed to calculate the communication cycle for each destination vehicle-mounted ECU 202 and frame type, and the variance of the communication cycle from the design value is calculated, and if the variance is large, the threshold is set low, and if the variance is small, the threshold is set high. The log is, for example, a log obtained in another vehicle of the same model and model number.

[0073] [Operation flow] Each device in the in-vehicle system according to the embodiment of the present disclosure includes a computer including a memory, and an arithmetic processing unit such as a CPU (Central Processing Unit) in the computer reads out from the memory and executes a program including some or all of the steps in the following flowchart. Each of the programs for the multiple devices can be installed from the outside. Each of the programs for the multiple devices is distributed in a state in which it is stored in a recording medium.

[0074] FIG. 7 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure receives a frame.

[0075] Referring to FIG. 7, first, the in-vehicle relay device 101 waits for a frame from the in-vehicle ECU 202 to a destination in-vehicle ECU 202 (hereinafter also referred to as the destination ECU) (NO in step S1), and when it receives a frame (YES in step S1), it refers to the frame processing information and adds the increased load rate corresponding to the frame to the processing load rate of the destination ECU (step S2).

[0076] Next, if the processing load rate after the addition does not exceed the threshold value corresponding to the destination ECU (NO in step S3), the in-vehicle repeater 101 determines that the relay of the frame should be permitted (step S4), and registers the processing load rate after the addition and the information of the frame in the load information. The in-vehicle repeater 101 repeats the frame to the destination ECU (step S5).

[0077] On the other hand, if the processing load rate after the addition exceeds the threshold value corresponding to the destination ECU (YES in step S3), the in-vehicle relay device 101 determines that relaying of the frame should be prohibited and does not update the load information. The in-vehicle relay device 101 discards the frame (step S6).

[0078] FIG. 8 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure updates the load information.

[0079] For example, the calculation unit 1 updates the processing load of the destination ECU based on the elapsed time since the relay unit 22 received or relayed a frame and the processing time corresponding to the frame.

[0080] More specifically, the calculation unit 1 monitors the elapsed time from the processing start time of each frame, and when the corresponding processing time has elapsed from the processing start time of a frame, it subtracts the corresponding increased load rate from the processing load rate in the load information and deletes the information of that frame from the load information.

[0081] Specifically, referring to FIG. 8, first, the vehicle-mounted relay device 101 waits for the lapse of a processing time corresponding to a relayed frame from the processing start time of the frame (NO in step S11).

[0082] Next, if the corresponding processing time has elapsed since the processing start time of the relayed frame (YES in step S11), the calculation unit 1 in the vehicle-mounted relay device 101 refers to the frame processing information in the load information, subtracts the increased load rate corresponding to the frame from the processing load rate of the destination ECU, deletes the information of the frame from the load information (step S12), and waits for the elapse of the corresponding processing time from the processing start time of another relayed frame (NO in step S11).

[0083] As described above, by using not only the processing load of the most recently received frame but also the cumulative value of the processing load of previously received frames, the processing load of the destination in-vehicle ECU 202 when it is assumed that the in-vehicle ECU 202 processes the most recently received frame before relaying, the processing load of the in-vehicle ECU 202 can be predicted more accurately.

[0084] In addition, even when relaying of frames is stopped, by continuing to update the processing load rate taking into consideration the completion of processing of previously relayed frames, it is possible to appropriately determine whether to resume relaying. In addition, it is also possible to appropriately determine whether to stop relaying again after relaying is resumed.

[0085] As described above, in an in-vehicle network, the network configuration, such as the type of in-vehicle device, the connection relationships, and the communication protocols, is often fixed, and since it is easy to register frame processing information such as that shown in Figure 3 in advance, a configuration that performs frame relay control as described above in an in-vehicle network is particularly effective.

[0086] In addition, the in-vehicle relay device 101 is not limited to receiving frames transmitted via the in-vehicle ECU 202 directly connected to itself, and can also receive frames transmitted via, for example, other in-vehicle relay devices and perform various types of processing, such as the above-mentioned judgment processing.

[0087] In addition, in addition to use in a star topology that performs peer-to-peer communication like Ethernet, if the in-vehicle system 301 is equipped with a CAN (Controller Area Network) bus, the in-vehicle relay device 101 may be configured to relay frames between in-vehicle devices connected to different CAN buses and perform various processes on the frames, such as the above-mentioned judgment processing.

[0088] In addition, in the in-vehicle system according to the embodiment of the present disclosure, the in-vehicle repeater 101 is configured to use the processing load rate, but this is not limited thereto. For example, the in-vehicle repeater 101 may be configured to control frame relay using the processing load amount and a processing load amount threshold.

[0089] Also, in the in-vehicle system according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to use frame processing information in which information for each in-vehicle ECU 202 and for each frame type is registered, but this is not limited to this. The in-vehicle relay device 101 may be configured to use frame processing information in which information common to each in-vehicle ECU 202 in the in-vehicle network 151 is registered, or may be configured to use frame processing information in which information common to each frame type is registered, or may be configured to use frame processing information in which information common to each in-vehicle ECU 202 in the in-vehicle network 151 and frame type is registered.

[0090] In addition, in the in-vehicle system according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to update the processing load rate based on the elapsed time since the relay unit 22 received or relayed a frame, but this is not limited to this. For example, the in-vehicle relay device 101 may be configured to limit the number of frames registered for one in-vehicle ECU 202 in the load information to a predetermined value, delete the information of the oldest frame when a new frame is received and the predetermined value is exceeded, and subtract the corresponding increased load rate from the processing load rate.

[0091] The above-described embodiments should be considered as illustrative and not restrictive in all respects. The scope of the present invention is defined by the claims, not the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0092] The above description includes the following additional features. [Appendix 1] a relay unit that relays frames transmitted and received between in-vehicle devices in the in-vehicle network; a calculation unit that calculates a processing load of the other in-vehicle device based on the plurality of frames addressed to the other in-vehicle device received by the relay unit from the in-vehicle device; a determination unit that performs a determination process to determine whether or not the frame addressed to the other in-vehicle device should be relayed by the relay unit based on the processing load calculated by the calculation unit, The calculation unit calculates a sum of the processing loads corresponding to the plurality of frames as the processing load of the other vehicle-mounted devices. [Explanation of symbols]

[0093] 1 Calculation section 2 Judgment section 21 Communication Port 22 Relay Section 24 Processing section 25 Memory section 91 Ethernet Cable 101 Vehicle-mounted relay device 202 In-vehicle equipment 301 In-vehicle systems 401 Server

Claims

1. a relay unit that relays frames transmitted and received between in-vehicle devices in the in-vehicle network; a calculation unit that calculates a processing load of the other in-vehicle device based on the plurality of frames addressed to the other in-vehicle device received by the relay unit from the in-vehicle device; a determination unit that performs a determination process of determining whether or not the frame addressed to the other in-vehicle device should be relayed by the relay unit based on the processing load calculated by the calculation unit; a storage unit configured to store frame processing information indicating a processing load of the received frame in the in-vehicle device for each type of the frame; the calculation unit calculates the processing load based on the type of each of the plurality of frames and the frame processing information; the frame processing information indicates, as the processing load, a processing time required for processing the frame in the in-vehicle device; The calculation unit updates the processing load based on an elapsed time since the relay unit received or relayed the frame and the processing time corresponding to the frame.

2. a relay unit that relays frames transmitted and received between in-vehicle devices in the in-vehicle network; a calculation unit that calculates a processing load of the other in-vehicle device based on the plurality of frames addressed to the other in-vehicle device received by the relay unit from the in-vehicle device; a determination unit that performs a determination process of determining whether or not the frame addressed to the other in-vehicle device should be relayed by the relay unit based on the processing load calculated by the calculation unit; a storage unit configured to store frame processing information for each of the in-vehicle devices, the frame processing information indicating a processing load of the received frame in the in-vehicle device; The calculation unit calculates the processing load based on the processing load corresponding to the other in-vehicle device in the frame processing information; the frame processing information indicates, as the processing load, a processing time required for processing the frame in the in-vehicle device; The calculation unit updates the processing load based on an elapsed time since the relay unit received or relayed the frame and the processing time corresponding to the frame.

3. The frame processing information further indicates a threshold value of the processing load for each of the in-vehicle devices, An in-vehicle relay device as described in claim 1 or claim 2, wherein the judgment unit performs the judgment processing based on a comparison result between the processing load calculated by the calculation unit and the threshold value corresponding to the other in-vehicle device in the frame processing information.

4. the determination unit performs the determination process based on a comparison result between the processing load calculated by the calculation unit and a threshold value; 4. The vehicle-mounted relay device according to claim 1, wherein the threshold value is a value based on a measurement result of a frame transmission period in a vehicle having a predetermined network configuration.

5. A relay method in an in-vehicle relay device having a relay unit that relays frames transmitted and received between in-vehicle devices in an in-vehicle network, comprising: calculating a processing load of the other in-vehicle device based on the plurality of frames addressed to the other in-vehicle device received by the relay unit from the in-vehicle device; performing a determination process of determining whether or not the frame addressed to the other in-vehicle device should be relayed in the relay unit based on the calculated processing load; In the step of calculating the processing load, the processing load is calculated based on each type of the plurality of frames and frame processing information indicating a processing load of the frames received in the in-vehicle device for each type of the frames; the frame processing information indicates, as the processing load, a processing time required for processing the frame in the in-vehicle device; The relay method further includes: A relay method comprising: updating the processing load based on an elapsed time since the relay unit received or relayed the frame, and the processing time corresponding to the frame.

6. A relay method in an in-vehicle relay device having a relay unit that relays frames transmitted and received between in-vehicle devices in an in-vehicle network, comprising: calculating a processing load of the other in-vehicle device based on the plurality of frames addressed to the other in-vehicle device received by the relay unit from the in-vehicle device; performing a determination process of determining whether or not the frame addressed to the other in-vehicle device should be relayed in the relay unit based on the calculated processing load; In the step of calculating the processing load, the processing load is calculated based on the processing load corresponding to the other in-vehicle devices in frame processing information indicating a processing load of the frame received by the in-vehicle device for each of the in-vehicle devices; the frame processing information indicates, as the processing load, a processing time required for processing the frame in the in-vehicle device; The relay method further includes: A relay method comprising: updating the processing load based on an elapsed time since the relay unit received or relayed the frame, and the processing time corresponding to the frame.

7. A relay program used in an in-vehicle relay device, Computer, a relay unit that relays frames transmitted and received between in-vehicle devices in the in-vehicle network; a calculation unit that calculates a processing load of the other in-vehicle device based on the plurality of frames addressed to the other in-vehicle device received by the relay unit from the in-vehicle device; a determination unit that performs a determination process of determining whether or not the frame addressed to the other in-vehicle device should be relayed by the relay unit based on the processing load calculated by the calculation unit; It is a program to function as the vehicle-mounted relay device includes a storage unit configured to store frame processing information indicating a processing load of the received frame in the vehicle-mounted device for each type of frame; the calculation unit calculates the processing load based on the type of each of the plurality of frames and the frame processing information; the frame processing information indicates, as the processing load, a processing time required for processing the frame in the in-vehicle device; The calculation unit updates the processing load based on the elapsed time since the relay unit received or relayed the frame and the processing time corresponding to the frame.

8. A relay program used in an in-vehicle relay device, Computer, a relay unit that relays frames transmitted and received between in-vehicle devices in the in-vehicle network; a calculation unit that calculates a processing load of the other in-vehicle device based on the plurality of frames addressed to the other in-vehicle device received by the relay unit from the in-vehicle device; a determination unit that performs a determination process of determining whether or not the frame addressed to the other in-vehicle device should be relayed by the relay unit based on the processing load calculated by the calculation unit; It is a program to function as the in-vehicle relay device includes a storage unit configured to store frame processing information for each of the in-vehicle devices, the frame processing information indicating a processing load of the received frame in the in-vehicle device; The calculation unit calculates the processing load based on the processing load corresponding to the other in-vehicle device in the frame processing information; the frame processing information indicates, as the processing load, a processing time required for processing the frame in the in-vehicle device; The calculation unit updates the processing load based on the elapsed time since the relay unit received or relayed the frame and the processing time corresponding to the frame.

Images