Vehicle-mounted communication system, relay device, and relay method

Abstract

To improve security in an on-vehicle network.SOLUTION: An on-vehicle communication system includes a plurality of on-vehicle devices, and a relay device, and a first on-vehicle device transmits, to a relay device, a frame addressed to a second on-vehicle device for transmitting / receiving information to / from the second on-vehicle device, and the relay device determines whether to relay the frame to the second on-vehicle device on the basis of the comparison result between a required safety level which is the level of safety required for communication between the first on-vehicle device and the second on-vehicle device, and the system safety level based at least on the functional safety level regarding the safety of the vehicle possessed by the first on-vehicle device and the second on-vehicle device.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an in-vehicle communication system, a relay device, and a relay method. [Background technology]

[0002] Technologies that enable flexible changes to the configuration of an in-vehicle network have been developed. For example, Patent Document 1 (International Publication No. 2020 / 145334) discloses the following technology. That is, a vehicle control device controls a plurality of repeaters based on a control scenario that associates the state of a vehicle in which a vehicle network consisting of a plurality of repeaters is constructed and the control contents to be set for each of the plurality of repeaters. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2020 / 145334 [Patent Document 2] International Publication No. 2020 / 179123 Summary of the Invention [Problem to be solved by the invention]

[0004] There is a need for a technology that can improve security in an in-vehicle network beyond the technologies of Patent Documents 1 and 2.

[0005] The present disclosure has been made to solve the above-mentioned problems, and has as its object to provide an in-vehicle communication system, a relay device, and a relay method that can improve security in an in-vehicle network. [Means for solving the problem]

[0006] The in-vehicle communication system disclosed herein comprises a plurality of in-vehicle devices and a relay device, wherein a first in-vehicle device transmits a frame addressed to a second in-vehicle device to the relay device for transmitting and receiving information between the first in-vehicle device and the second in-vehicle device, and the relay device determines whether or not to relay the frame to the second in-vehicle device based on a comparison result between a required safety level, which is the level of safety required for communication between the first in-vehicle device and the second in-vehicle device, and a system safety level, which is based at least on a functional safety level related to vehicle safety that the first in-vehicle device and the second in-vehicle device each have.

[0007] The relay device disclosed herein is a relay device used in an in-vehicle communication system equipped with a plurality of in-vehicle devices, and is equipped with a setting unit that sets whether or not to relay frames for transmitting and receiving information between the in-vehicle devices based on the results of a comparison between a required safety level, which is the level of safety required for communication between the in-vehicle devices, and a system safety level, which is based at least on a functional safety level related to vehicle safety possessed by each of the in-vehicle devices, and a relay unit that performs relay processing of the frames in accordance with the contents of the setting made by the setting unit.

[0008] The relay method disclosed herein is a relay method in a relay device used in an in-vehicle communication system equipped with a plurality of in-vehicle devices, and includes a step of setting whether or not to relay frames for transmitting and receiving information between the in-vehicle devices based on a comparison result between a required safety level, which is the level of safety required for communication between the in-vehicle devices, and a system safety level, which is based at least on a functional safety level related to vehicle safety possessed by each of the in-vehicle devices, and a step of performing relay processing of the frames in accordance with the set content.

[0009] The present disclosure may be realized not only as a relay device having such a characteristic processing unit, but also as a semiconductor integrated circuit that realizes part or all of the relay device, or as a program for causing a computer to execute processing steps in the relay device, or as a semiconductor integrated circuit that realizes part or all of an in-vehicle communication system including a relay device, or as a relay method in which the processing in the in-vehicle communication system is steps, or as a program for causing a computer to execute processing steps in the in-vehicle communication system. Effect of the Invention

[0010] According to the present disclosure, it is possible to improve security in an in-vehicle network. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram showing a configuration of an in-vehicle communication system according to an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram illustrating a configuration of a relay device according to an embodiment of the present disclosure. [Diagram 3] FIG. 3 is a diagram illustrating an example of a system management list stored in the storage unit of the relay device according to the embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating an example of a service management list stored in the storage unit of the relay device according to the embodiment of the present disclosure. [Diagram 5] FIG. 5 is a diagram illustrating an example of the system management list after being updated by the update unit in the relay device according to the embodiment of the present disclosure. [Figure 6] FIG. 6 is a diagram illustrating an example of the service management list after being updated by the update unit in the relay device according to the embodiment of the present disclosure. [Figure 7] FIG. 7 is a flowchart defining an example of an operation procedure when a relay device according to an embodiment of the present disclosure performs relay processing. [Figure 8]FIG. 8 is a diagram illustrating an example of a communication sequence in the in-vehicle communication system according to the embodiment of the present disclosure. [Figure 9] FIG. 9 is a diagram showing another example of a communication sequence in the in-vehicle communication system according to the embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] First, the contents of the embodiments of the present disclosure will be listed and described.

[0013] (1) An in-vehicle communication system according to an embodiment of the present disclosure includes a plurality of in-vehicle devices and a relay device, wherein a first in-vehicle device transmits a frame addressed to a second in-vehicle device to the relay device for transmitting and receiving information between the first in-vehicle device and the second in-vehicle device, and the relay device determines whether or not to relay the frame to the second in-vehicle device based on a comparison result between a required safety level, which is a level of safety required for communication between the first in-vehicle device and the second in-vehicle device, and a system safety level, which is based at least on a functional safety level related to vehicle safety that the first in-vehicle device and the second in-vehicle device each have.

[0014] In this way, by using a configuration that determines whether or not to relay a frame based on a comparison result between a required safety level for communication between on-board devices and a system safety level based on the functional safety level of each on-board device, it is possible to determine whether or not to relay a frame taking into consideration the required safety level of communication between on-board devices, so that, for example, when the required safety level of communication between on-board devices is high, frame exchange between on-board devices can be prevented, thereby improving security in the on-board network.

[0015] (2) Preferably, the relay device determines whether or not to relay the frame to the second in-vehicle device based on a comparison result between the required safety level and the system safety level which is further based on data for a safety mechanism provided in the frame.

[0016] With this configuration, it is possible to more appropriately determine whether or not a frame can be relayed between in-vehicle devices by using the safety mechanism data attached to the frame in addition to the functional safety level of the in-vehicle device.

[0017] (3) Preferably, the relay device includes a memory unit that stores a system management list indicating the correspondence between the pairs of in-vehicle devices and the system safety levels, the in-vehicle devices notify the relay device of their own functional safety levels, and the relay device updates the system management list in the memory unit based on the functional safety levels notified from the in-vehicle devices.

[0018] With this configuration, the system safety level indicated in the system management list in the memory unit can be updated when the functional safety level of the on-board device is changed. Therefore, even if the functional safety level is changed by updating the software of the on-board device, for example, it is possible to more appropriately determine whether or not to relay a frame between on-board devices based on the system safety level that reflects the changed functional safety level.

[0019] (4) Preferably, the relay device includes a memory unit that stores a service management list indicating the correspondence between the type of information transmitted and received between the in-vehicle devices and the required safety level, the in-vehicle device notifies the relay device of the required safety level required for communication between itself and the other in-vehicle device, and the relay device updates the service management list in the memory unit based on the required safety level notified by the in-vehicle device.

[0020] With this configuration, even when a new type of information is being sent and received between in-vehicle devices, the determination of whether or not to relay a frame between the in-vehicle devices can be made appropriately based on the required safety level notified by the in-vehicle devices.

[0021] (5) Preferably, the first vehicle-mounted device transmits the frame containing a message conforming to SOME / IP (Scalable service-Oriented Middleware over IP) to the relay device, and the relay device determines whether to relay the frame to the second vehicle-mounted device based on a comparison result between the required security level corresponding to a service ID included in the message and the system security level.

[0022] With this configuration, it is possible to appropriately determine whether or not a frame containing a message conforming to SOME / IP can be relayed between vehicle-mounted devices.

[0023] (6) Preferably, when the relay device decides not to relay the frame to the second in-vehicle device, it notifies the first in-vehicle device of the conditions necessary to relay the frame to the second in-vehicle device.

[0024] With this configuration, when it is decided not to relay a frame between the in-vehicle devices taking into account the required security level of communication between the in-vehicle devices, the second in-vehicle device can be prompted to retransmit a frame that can be relayed by the relay device.

[0025] (7) A relay device according to an embodiment of the present disclosure is a relay device used in an in-vehicle communication system having a plurality of in-vehicle devices, and includes a setting unit that sets whether or not to relay frames for transmitting and receiving information between the in-vehicle devices based on a comparison result between a required safety level, which is a level of safety required for communication between the in-vehicle devices, and a system safety level, which is based at least on a functional safety level related to vehicle safety possessed by each of the in-vehicle devices, and a relay unit that performs relay processing of the frames in accordance with the contents of the setting by the setting unit.

[0026] In this way, the configuration for setting whether or not to relay a frame based on the result of comparing the required safety level for communication between on-board devices with the system safety level based on the functional safety level of each on-board device makes it possible to set whether or not to relay a frame taking into consideration the level of the required safety level for communication between on-board devices, so that, for example, when the required safety level for communication between on-board devices is high, it is possible to prevent frame exchange between on-board devices, thereby improving security in the on-board network.

[0027] (8) A relay method according to an embodiment of the present disclosure is a relay method in a relay device used in an in-vehicle communication system having a plurality of in-vehicle devices, and includes a step of setting whether or not to relay frames for transmitting and receiving information between the in-vehicle devices based on a comparison result between a required safety level, which is a level of safety required for communication between the in-vehicle devices, and a system safety level, which is based at least on a functional safety level related to vehicle safety possessed by each of the in-vehicle devices, and a step of performing relay processing of the frames in accordance with the set content.

[0028] In this way, by using a method for setting whether or not to relay a frame based on a comparison result between a required safety level for communication between on-board devices and a system safety level based on the functional safety level of each on-board device, it is possible to set whether or not to relay a frame taking into consideration the required safety level for communication between on-board devices, so that, for example, when the required safety level for communication between on-board devices is high, it is possible to prevent frame exchange between on-board devices, thereby improving security in the on-board network.

[0029] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and the description thereof will not be repeated. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0030] [Configuration and basic operation] 1 is a diagram showing a configuration of an in-vehicle communication system according to an embodiment of the present disclosure. Referring to FIG. 1, the in-vehicle communication system 301 includes a relay device 101 and a plurality of in-vehicle ECUs 111. For example, the in-vehicle communication system 301 includes in-vehicle ECUs 111A and 111B as the in-vehicle ECUs 111. The in-vehicle communication system 301 may include two in-vehicle ECUs 111, or may include three or more in-vehicle ECUs 111. The in-vehicle ECU 111 is an example of an in-vehicle device. The in-vehicle communication system 301 is mounted on a vehicle 1.

[0031] The relay device 101 is used in the in-vehicle communication system 301. The relay device 101 is connected to each in-vehicle ECU 111 via a cable 2. The cable 2 is, for example, a cable that complies with the Ethernet (registered trademark) standard. The relay device 101 and the in-vehicle ECU 111 configure an in-vehicle network.

[0032] The in-vehicle ECU 111 is, for example, an electric power steering (EPS), a brake control device, an accelerator control device, a steering control device, a driving assistance device that issues instructions to various devices in a driving assistance system (Advanced Driver-Assistance System (ADAS)), a sensor, etc.

[0033] The relay device 101 is capable of communicating with the in-vehicle ECU 111. The relay device 101 performs a relay process of relaying information exchanged between a plurality of in-vehicle ECUs 111 connected to different cables 2, for example.

[0034] For example, the in-vehicle ECU 111 periodically generates an LLDP frame that is a frame conforming to the Link Layer Discovery Protocol (LLDP), and transmits the generated LLDP frame to the relay device 101 with its own MAC address and its own IP address included therein.

[0035] The relay device 101 receives an LLDP frame from the in-vehicle ECU 111, and acquires various information such as the MAC address and IP address of the in-vehicle ECU 111 connected to itself from the received LLDP frame. In the following, it is assumed that the MAC address of the in-vehicle ECU 111A is "MAC_A" and the MAC address of the in-vehicle ECU 111B is "MAC_B".

[0036] (SOME / IP) In the in-vehicle communication system 301, messages are transmitted and received according to, for example, SOME / IP, which is an application layer protocol of the Ethernet protocol group. More specifically, the in-vehicle ECU 111 can store a message in which various information is stored in one or more frames, and transmit the frames to another in-vehicle ECU 111 via the relay device 101 according to SOME / IP.

[0037] Hereinafter, the in-vehicle ECU 111 that provides a service according to SOME / IP is also referred to as a "server." The in-vehicle ECU 111 that receives the service is also referred to as a "client." The in-vehicle ECU 111 may function only as a server, may function only as a client, or may function as either a server or a client depending on the content of the service. In the following, as an example, the in-vehicle ECU 111A is the server and the in-vehicle ECU 111B is the client.

[0038] For example, when the in-vehicle ECU 111B, which is a client, wishes to receive a service, it generates a service search message including a service ID corresponding to the service. The in-vehicle ECU 111B transmits a frame F1 in which the generated service search message is stored to the relay device 101. The relay device 101 multicasts the frame F1 received from the in-vehicle ECU 111B to other in-vehicle ECUs such as the in-vehicle ECU 111A.

[0039] Among the in-vehicle ECUs 111 that have received the service search message, an in-vehicle ECU 111 capable of providing a service corresponding to the service ID attached to the service search message, for example, the in-vehicle ECU 111A, generates a service provision notification message including a service ID corresponding to the service as a server. The in-vehicle ECU 111A transmits a frame F2 in which the generated service provision notification message is stored to the relay device 101. The relay device 101 transmits the frame F2 received from the in-vehicle ECU 111A to the in-vehicle ECU 111B that is the source of the frame F1. This allows a communication connection to be established between the in-vehicle ECU 111A and the in-vehicle ECU 111B.

[0040] When the in-vehicle ECU 111B, which has established a communication connection with the in-vehicle ECU 111A, requests the in-vehicle ECU 111A to provide a periodic service, the in-vehicle ECU 111B generates a service subscription request message including a service ID corresponding to the service. The in-vehicle ECU 111B transmits a frame F3 in which the generated service subscription request message is stored to the relay device 101. The relay device 101 transmits the frame F3 received from the in-vehicle ECU 111B to the in-vehicle ECU 111A.

[0041] When the in-vehicle ECU 111A receives the service subscription request message, it determines whether or not to permit provision of the service based on the ID of the in-vehicle ECU 111B and the like included in the received service subscription request message. If the in-vehicle ECU 111A determines to permit provision of the service, it generates a service subscription permission message including a service ID corresponding to the service. The in-vehicle ECU 111A transmits a frame F4 in which the generated service subscription permission message is stored to the relay device 101. The relay device 101 transmits the frame F4 received from the in-vehicle ECU 111A to the in-vehicle ECU 111B.

[0042] Then, the in-vehicle ECU 111A periodically generates a service provision message including information to be provided as a service and a service ID corresponding to the service, and transmits a frame F5 in which the generated service provision message is stored to the relay device 101. The relay device 101 transmits the frame F5 received from the in-vehicle ECU 111A to the in-vehicle ECU 111B. As an example, the in-vehicle ECU 111A, which is a sensor, transmits a service provision message including sensor information related to the running state of the vehicle 1 or the surrounding state to the in-vehicle ECU 111B, which is a driving assistance device. The in-vehicle ECU 111B acquires the sensor information provided as a service from the received service provision message, generates various control information related to the driving of the vehicle 1 using the sensor information, and transmits the generated various control information to a brake control device, a steering control device, etc.

[0043] The service discovery message, the service provision notification message, the service subscription request message, the service subscription permission message, and the service provision message are examples of messages conforming to SOME / IP. The frames F1, F2, F3, F4, and F5 are examples of frames for transmitting and receiving information between a server and a client.

[0044] The in-vehicle ECU 111 is assigned a functional safety level of "A", "B", "C" or "D" depending on the function of the in-vehicle ECU 111. A function assigned "D" requires the highest level of safety measures, and a function assigned "A" requires the lowest level of safety measures. In other words, the functional safety levels of the in-vehicle ECU 111 are "D", "C", "B", and "A" in that order.

[0045] As an example, the functional safety level is the Automotive Safety Integrity Level (ASIL) defined by ISO26262.

[0046] The in-vehicle ECU 111 may have a plurality of functions. In this case, the in-vehicle ECU 111 has a plurality of functional safety levels for each function.

[0047] <Challenges> In the in-vehicle communication system 301, when the configuration of the in-vehicle network is changed, an in-vehicle ECU 111 that only performed communications requiring a low safety level before the change may start communicating with an in-vehicle ECU 111 that only performed communications requiring a high safety level before the change.

[0048] Specifically, as an example, the functional safety level of a certain in-vehicle ECU 111 may be changed from "B" to "D" by updating software of the in-vehicle ECU 111 based on update data from an OTA (Over The Air) server external to the vehicle 1. In this case, new communication may be started between the in-vehicle ECU 111 and another in-vehicle ECU 111 whose functional safety level is "D."

[0049] As another example, a new in-vehicle ECU 111 may be added to the in-vehicle network. Communication may be newly started between the new in-vehicle ECU 111 and an existing in-vehicle ECU 111 that has only performed communication with a high required safety level.

[0050] When the in-vehicle ECU 111, which has conventionally only performed communication requiring a low safety level, starts communication requiring a high safety level, concerns have been raised from the viewpoint of security.

[0051] Therefore, the in-vehicle communication system 301 and relay device 101 of the present disclosure solve such problems by using the following configuration and operation.

[0052] <Relay device> Fig. 2 is a diagram showing a configuration of a relay device according to an embodiment of the present disclosure. Referring to Fig. 2, relay device 101 includes communication ports 15A, 15B, and 15C, relay unit 11, setting unit 21, update unit 31, notification unit 41, and storage unit 51. Hereinafter, each of communication ports 15A, 15B, and 15C is also referred to as communication port 15. Note that relay device 101 may include two communication ports 15, or may include four or more communication ports 15.

[0053] The relay unit 11 is realized by, for example, a switch IC (Integrated Circuit). The setting unit 21, the update unit 31, and the notification unit 41 are realized by, for example, a processor such as a CPU (Central Processing Unit) and a DSP (Digital Signal Processor). The storage unit 51 is, for example, a non-volatile memory.

[0054] The communication port 15 is, for example, a terminal to which the cable 2 can be connected. The communication port 15 may be a terminal of an integrated circuit. The communication port 15A is connected to the in-vehicle ECU 111A via the cable 2. The communication port 15B is connected to the in-vehicle ECU 111B via the cable 2.

[0055] The relay unit 11 is capable of relaying a frame received from an in-vehicle ECU 111 to another in-vehicle ECU 111. That is, the relay unit 11 is capable of receiving a frame transmitted from an in-vehicle ECU 111 via a communication port 15 corresponding to the in-vehicle ECU 111, and performing relay processing on the received frame.

[0056] For example, the storage unit 51 stores an address table indicating the correspondence between the port number of the communication port 15 and the MAC (Media Access Control) address of the in-vehicle ECU 111 connected to the communication port 15 via the cable 2. The relay unit 11 uses the address table in the storage unit 51 to perform relay processing.

[0057] (System Administration List) 3 is a diagram illustrating an example of a system management list stored in a storage unit in a relay device according to an embodiment of the present disclosure. Referring to FIG. 3, the storage unit 51 stores a system management list Lsy indicating a correspondence between a pair of in-vehicle ECUs 111 and a system safety level. More specifically, the system management list Lsy indicates a correspondence between a system ID of a communication system including two in-vehicle ECUs 111 as components and a system safety level of the communication system. The system safety levels of the communication system are "D", "C", "B" and "A" in order of increasing, similar to the functional safety levels of the in-vehicle ECUs 111.

[0058] The system safety level of the communication system is set based at least on the functional safety levels of the two in-vehicle ECUs 111 that are components of the communication system. For example, the system safety level of the communication system is set further based on data for a safety mechanism that is added to a frame transmitted and received between the in-vehicle ECUs 111 that are components of the communication system.

[0059] More specifically, the in-vehicle ECU 111A has an ECC (Error Correction Code) and the like as a safety mechanism, and the functional safety level of the in-vehicle ECU 111A is "B." The in-vehicle ECU 111B has an ECC and the like as a safety mechanism, and the functional safety level of the in-vehicle ECU 111B is "C." The system safety level of the communication system with the system ID "S001" is set to "B" based on the functional safety levels of the in-vehicle ECUs 111A and 111B, which are components of the communication system.

[0060] In addition, the system safety level of the communication system with the system ID "S002" is set to "C" based on the functional safety levels of the vehicle-mounted ECUs 111A and 111B, which are components of the communication system, and a CRC (Cyclic Redundancy Check) that is added as data for a safety mechanism to frames transmitted and received between the vehicle-mounted ECUs 111A and 111B.

[0061] (Service Management List) 4 is a diagram showing an example of a service management list stored in a storage unit in a relay device according to an embodiment of the present disclosure. Referring to FIG. 4, the storage unit 51 stores a service management list Lse indicating a correspondence relationship between the type of information transmitted and received between the in-vehicle ECUs 111 and a required safety level, which is a level of safety required for communication between the in-vehicle ECUs 111. More specifically, the service management list Lse indicates a correspondence relationship between a service ID of a service conforming to SOME / IP and a required safety level required for communication between the in-vehicle ECUs 111 to perform the service. The required safety levels are in the order of increasing from "D", "C", "B" and "A", similar to the functional safety level of the in-vehicle ECU 111.

[0062] For example, the required safety level corresponding to a service with a service ID of "2001" is "D", so the highest level of safety measures is required for communication between in-vehicle ECUs 111 to perform this service.

[0063] For example, the system management list Lsy and the service management list Lse are created by the manufacturer of the vehicle 1 and stored in the memory unit 51 when the vehicle 1 is shipped.

[0064] (System Administration List Update) The in-vehicle ECU 111 notifies the relay device 101 of its own functional safety level. More specifically, the in-vehicle ECU 111 transmits to the relay device 101, for example, the above-mentioned LLDP frame including level information L1 indicating its own current functional safety level.

[0065] For example, software of the in-vehicle ECU 111A is updated based on update data from an OTA server, and thereby the functional safety level of the in-vehicle ECU 111A is changed from "B" to "C." The in-vehicle ECU 111A transmits an LLDP frame including level information L1 indicating its own functional safety level after the update to the relay device 101.

[0066] Also, for example, an in-vehicle ECU 111C that is a new in-vehicle ECU 111 is added to the in-vehicle network. More specifically, the in-vehicle ECU 111C is connected to the communication port 15C in the relay device 101 via the cable 2 by an operation of a user of the vehicle 1. The in-vehicle ECU 111C transmits an LLDP frame including its own MAC address, its own IP address, and level information L1 indicating its own current functional safety level to the relay device 101. In the following, it is assumed that the MAC address of the in-vehicle ECU 111C is "MAC_C".

[0067] When the relay unit 11 receives an LLDP frame from the in-vehicle ECU 111 via the corresponding communication port 15 , the relay unit 11 obtains level information L 1 from the received LLDP frame and outputs it to the update unit 31 .

[0068] The update unit 31 updates the system management list Lsy in the storage unit 51 based on the functional safety level notified from the in-vehicle ECU 111. More specifically, the update unit 31 receives level information L1 from the relay unit 11, and updates the system management list Lsy in the storage unit 51 based on the received level information L1.

[0069] FIG. 5 is a diagram illustrating an example of the system management list after being updated by the update unit in the relay device according to the embodiment of the present disclosure.

[0070] 5, when the update unit 31 receives the level information L1 from the in-vehicle ECU 111A via the relay unit 11, the update unit 31 changes the functional safety level of the in-vehicle ECU 111A in the system management list Lsy of the storage unit 51 from "B" to "C." In addition, the update unit 31 changes the system safety level of the communication system having the system ID "S001" from "B" to "C" in accordance with the change in the functional safety level of the in-vehicle ECU 111A. In addition, the update unit 31 changes the system safety level of the communication system having the system ID "S002" from "C" to "D" in accordance with the change in the functional safety level of the in-vehicle ECU 111A.

[0071] In addition, when the update unit 31 receives level information L1 from the in-vehicle ECU 111C via the relay unit 11, it adds "S103", which is the system ID of a new communication system that includes the in-vehicle ECUs 111A, 111C as components, to the system management list Lsy in the memory unit 51, and sets the system safety level of the communication system to, for example, "B", based on the functional safety levels of the in-vehicle ECUs 111A, 111C.

[0072] (Service Management List Update) The in-vehicle ECU 111 notifies the relay device 101 of a required safety level required for communication between itself and the other in-vehicle ECU 111. More specifically, the in-vehicle ECU 111 transmits to the relay device 101, for example, a frame F1 in which a service search message is stored, including level information L2 indicating a required safety level required for communication to perform a service indicated by a service ID included in the service search message.

[0073] For example, the in-vehicle ECU 111B transmits to the relay device 101 a frame F1 containing a service search message including "3001" as the service ID, together with level information L2 indicating that the required safety level required for communication to perform the service indicated by the service ID is "D."

[0074] When the relay unit 11 receives the frame F1 from the in-vehicle ECU 111 via the corresponding communication port 15, the relay unit 11 obtains the level information L2 from the received frame F1 and outputs it to the update unit 31.

[0075] The update unit 31 updates the service management list Lse in the storage unit 51 based on the required safety level notified from the in-vehicle ECU 111. More specifically, the update unit 31 receives level information L2 from the relay unit 11, and updates the service management list Lse in the storage unit 51 based on the received level information L2.

[0076] FIG. 6 is a diagram illustrating an example of the service management list after being updated by the update unit in the relay device according to the embodiment of the present disclosure.

[0077] 6, when the update unit 31 receives the level information L2 from the in-vehicle ECU 111 via the relay unit 11, the update unit 31 adds the service ID "3001" to the service management list Lse in the storage unit 51. Then, based on the level information L2, the update unit 31 sets the required safety level corresponding to the service indicated by "3001" to "D."

[0078] (Settings process) The setting unit 21 performs setting as to whether or not the relay unit 11 is to relay, based on the result of comparison between the required security level and the system security level.

[0079] For example, when the relay unit 11 receives a frame F1 in which a service search message is stored from the in-vehicle ECU 111B via the communication port 15B, the relay unit 11 acquires the service search message from the received frame F1 and outputs the message to the setting unit 21. Then, the relay unit 11 multicasts the frame F1 via the multiple communication ports 15.

[0080] The setting unit 21 receives a service search message from the relay unit 11 and acquires a service ID from the received service search message. The setting unit 21 performs a setting relating to whether or not the relay unit 11 can relay the message, using the acquired service ID.

[0081] More specifically, the setting unit 21 acquires a required security level corresponding to the acquired service ID from the service management list Lse in the storage unit 51. Then, based on the system management list Lsy in the storage unit 51, the setting unit 21 sets relay processing conditions to permit relaying of a frame containing a message including the service ID and transmitted and received in a communication system having a system security level equal to or higher than the acquired required security level, while not permitting relaying of a frame containing a message including the service ID and transmitted and received in a communication system having a system security level lower than the acquired required security level.

[0082] As an example, when the service ID acquired from the service search message is "2001", the setting unit 21 acquires, from the service management list Lse in the storage unit 51, the required security level "D" corresponding to "2001".

[0083] Then, based on the system management list Lsy in the memory unit 51, the setting unit 21 sets relay processing conditions to permit relaying of frames containing a message including "2001" as a service ID that are transmitted and received in a communication system having a system security level of "D" or higher, while not permitting relaying of frames containing a message including "2001" as a service ID that are transmitted and received in a communication system having a system security level of less than "D".

[0084] In other words, the setting unit 21 sets the relay processing conditions to permit relaying of a frame containing a message including "2001" as the service ID that is sent and received in a communication system having a system ID of "S002", while not permitting relaying of a frame containing a message including "2001" as the service ID that is sent and received in a communication system having a system ID of "S001" or "S103".

[0085] For example, the relay unit 11 includes an ACL (Access Control List).

[0086] The setting unit 21 sets in the ACL in the relay unit 11 a relay processing condition that, when a frame containing a message including "2001" as the service ID is received, the destination MAC address of the frame is "MAC_A" or "MAC_B", the source MAC address of the frame is "MAC_A" or "MAC_B", and the frame contains a CRC, the frame will be relayed, but the frame will not be relayed if the above conditions are not met.

[0087] (Relay processing of frames F2, F3, F4, and F5) The relay unit 11 determines whether or not to relay the frames F2, F3, F4, and F5 based on the result of comparison between the required security level and the system security level in the setting unit 21. That is, the relay unit 11 performs relay processing of the frames F2, F3, F4, and F5 in accordance with the contents of the setting by the setting unit 21.

[0088] More specifically, for example, the relay unit 11 receives a frame F2 from the in-vehicle ECU 111A via the communication port 15A, in which a service provision notification message including "2001" as the service ID is stored, the destination MAC address is "MAC_B", the source MAC address is "MAC_A", and a CRC is included. In this case, the relay unit 11 performs relay processing of the received frame F2 since the received frame F2 satisfies the relay processing condition. Specifically, the relay unit 11 transmits the frame F2 to the in-vehicle ECU 111B via the communication port 15B.

[0089] Next, for example, the relay unit 11 receives frame F3 from the in-vehicle ECU 111B via the communication port 15B, in which a service subscription request message including "2001" as the service ID is stored, the destination MAC address is "MAC_A", the source MAC address is "MAC_B", and a CRC is included. In this case, the relay unit 11 performs relay processing of the received frame F3 since the received frame F3 satisfies the relay processing condition. Specifically, the relay unit 11 transmits the frame F3 to the in-vehicle ECU 111A via the communication port 15A.

[0090] Alternatively, the relay unit 11 receives a frame F3 from the in-vehicle ECU 111B via the communication port 15B, in which a service subscription request message including "2001" as the service ID is stored, the destination MAC address is "MAC_A", the source MAC address is "MAC_B", and the CRC is not included. In this case, the relay unit 11 does not perform relay processing of the received frame F3 because the received frame F3 does not satisfy the relay processing condition.

[0091] Also, for example, the relay unit 11 receives a frame F2, which contains a service provision notification message including "2001" as the service ID, a destination MAC address of "MAC_C", a source MAC address of "MAC_A", and a CRC, from the in-vehicle ECU 111A via the communication port 15. In this case, the relay unit 11 does not perform relay processing of the received frame F2 because the received frame F2 does not satisfy the relay processing condition.

[0092] Similarly, for frames F4 and F5, if the received frame satisfies the relay processing conditions, the relay unit 11 transmits the frame to the destination vehicle-mounted ECU 111 via the corresponding communication port 15, but if the received frame does not satisfy the relay processing conditions, the relay unit 11 does not perform relay processing of the frame F2.

[0093] For example, the relay unit 11 outputs to the notification unit 41 a frame that does not satisfy the relay processing condition.

[0094] When relay unit 11 has determined not to relay the frame, notification unit 41 notifies source in-vehicle ECU 111 of the conditions required for relaying the frame to destination in-vehicle ECU 111.

[0095] More specifically, the notification unit 41 receives frame F3 from the relay unit 11, which contains a service subscription request message including "2001" as the service ID, has a destination MAC address of "MAC_A", a source MAC address of "MAC_B", and does not include a CRC.

[0096] The notification unit 41 refers to the system management list Lsy and the service management list Lse in the memory unit 51 and recognizes that the system security level of the communication system becomes "D" because the frame F3 contains a CRC, and that the system security level is equal to or higher than the required security level.

[0097] Then, the notification unit 41 generates relay condition information indicating that a CRC should be included in the frame F3 as a necessary condition for relaying the frame F3 to the in-vehicle ECU 111A, generates a frame for the in-vehicle ECU 111B including the generated relay condition information, and transmits the generated frame to the in-vehicle ECU 111B via the relay unit 11 and the communication port 15B.

[0098] The in-vehicle ECU 111B receives the frame from the relay device 101, and acquires relay condition information from the received frame. For example, the in-vehicle ECU 111B retransmits frame F3 with a CRC included therein, in accordance with the acquired relay condition information.

[0099] [Operation flow] Each device in the in-vehicle communication system according to the embodiment of the present disclosure includes a computer including a memory, and a processor such as a CPU in the computer reads out from the memory a program including some or all of the steps of the following sequence and executes it. Each of the programs for the multiple devices can be installed from the outside. Each of the programs for the multiple devices is distributed in a state stored in a recording medium or via a communication line.

[0100] FIG. 7 is a flowchart defining an example of an operation procedure when a relay device according to an embodiment of the present disclosure performs relay processing.

[0101] 7, first, the relay device 101 sets a relay processing condition. More specifically, the relay device 101 acquires a service search message from the frame F1 received from the in-vehicle ECU 111B via the communication port 15B. The relay device 101 acquires a service ID from the service search message, and acquires a required safety level corresponding to the service ID from the service management list Lse in the storage unit 51. Then, based on the system management list Lsy in the storage unit 51, the setting unit 21 sets a relay processing condition to permit relaying of a frame in which a message including the service ID is stored and which is transmitted and received in a communication system having a system safety level equal to or higher than the acquired required safety level, while not permitting relaying of a frame in which a message including the service ID is stored and which is transmitted and received in a communication system having a system safety level lower than the acquired required safety level (step S102).

[0102] Next, the relay device 101 waits for frames F2, F3, F4, and F5 (NO in step S104), and when it receives frame F2, for example, from the in-vehicle ECU 111A via the communication port 15A (YES in step S104), it determines whether the received frame F2 satisfies the relay processing conditions (step S106).

[0103] If the received frame F2 satisfies the relay processing condition, the relay device 101 performs relay processing of the frame F2 (step S108).

[0104] Next, the relay device 101 waits for new frames F2, F3, F4, and F5 (NO in step S104).

[0105] On the other hand, if the received frame F2 does not satisfy the relay processing condition, the relay device 101 generates relay condition information, generates a frame including the generated relay condition information, and transmits the frame to the in-vehicle ECU 111A (step S110).

[0106] Next, the relay device 101 discards the frame F2 (step S112).

[0107] Next, the relay device 101 waits for new frames F2, F3, F4, and F5 (NO in step S104).

[0108] 8 is a diagram showing an example of a communication sequence in the in-vehicle communication system according to the embodiment of the present disclosure, in which the in-vehicle ECU 111A, which is a server, and the in-vehicle ECU 111B, which is a client, transmit and receive frames via the relay device 101.

[0109] Referring to FIG. 8, first, software of the in-vehicle ECU 111A is updated based on update data from the OTA server, thereby changing the functional safety level of the in-vehicle ECU 111A (step S202).

[0110] Next, the in-vehicle ECU 111A includes level information L1 indicating its own current functional safety level in the LLDP frame and transmits the LLDP frame to the relay device 101 (step S204).

[0111] Furthermore, the in-vehicle ECU 111B includes level information L1 indicating its own current functional safety level in the LLDP frame and transmits it to the relay device 101 (step S206).

[0112] Next, the relay device 101 updates the system management list Lsy in the storage unit 51 based on the level information L1 received from each of the in-vehicle ECUs 111A and 111B (step S208).

[0113] Next, the in-vehicle ECU 111B transmits the frame F1 in which the service search message is stored to the relay device 101 (step S210).

[0114] Next, the relay device 101 acquires a service ID from the service search message stored in the received frame F1, and acquires a required security level corresponding to the service ID from the service management list Lse in the storage unit 51. Then, the relay device 101 sets relay processing conditions based on the acquired required security level and the system management list Lsy in the storage unit 51 (step S212).

[0115] Next, the relay device 101 transmits the frame F1 in which the service search message is stored to the in-vehicle ECU 111A. Specifically, the relay device 101 multicasts the frame F1 (step S214).

[0116] Next, the in-vehicle ECU 111A transmits the frame F2 in which the service provision notification message is stored to the relay device 101 (step S216).

[0117] Next, since the received frame F2 satisfies the set relay processing condition, the relay device 101 performs relay processing of the frame F2. Specifically, the relay device 101 transmits the frame F2 in which the service provision notification message is stored to the in-vehicle ECU 111B (step S218).

[0118] Next, the in-vehicle ECU 111B transmits the frame F3 in which the service subscription request message is stored to the relay device 101 (step S220).

[0119] Next, since frame F3 does not satisfy the relay processing conditions, for example because frame F3 does not contain a CRC, relay device 101 transmits a frame including relay condition information to in-vehicle ECU 111B instead of performing relay processing of frame F3 (step S222).

[0120] Next, the relay device 101 discards the frame F3 (step S224).

[0121] Next, the in-vehicle ECU 111B transmits to the relay device 101 a frame F3 including a CRC and in which a service subscription request message is stored, in accordance with the relay condition information acquired from the frame received from the relay device 101 (step S226).

[0122] Next, since the received frame F3 includes a CRC and satisfies the relay processing condition, the relay device 101 performs relay processing of the frame F3. Specifically, the relay device 101 transmits the frame F3 in which the service subscription request message is stored to the in-vehicle ECU 111A (step S228).

[0123] Next, the in-vehicle ECU 111A transmits the frame F4 in which the service subscription permission message is stored to the relay device 101 (step S230).

[0124] Next, since the received frame F4 satisfies the set relay processing condition, the relay device 101 performs relay processing of the frame F4. Specifically, the relay device 101 transmits the frame F4 in which the service subscription permission message is stored to the in-vehicle ECU 111B (step S232).

[0125] Next, the in-vehicle ECU 111A transmits the frame F5 in which the service provision message is stored to the relay device 101 (step S234).

[0126] Next, since the received frame F5 satisfies the set relay processing condition, the relay device 101 performs relay processing of the frame F5. Specifically, the relay device 101 transmits the frame F5 in which the service provision message is stored to the in-vehicle ECU 111B (step S236).

[0127] 9 is a diagram showing another example of a communication sequence in the in-vehicle communication system according to the embodiment of the present disclosure, in which the in-vehicle ECU 111A, which is a server, and the in-vehicle ECU 111C, which is a client, transmit and receive frames via the relay device 101.

[0128] Referring to FIG. 9, first, a new in-vehicle ECU 111C is added to the in-vehicle network (step S302).

[0129] Next, the in-vehicle ECU 111A includes level information L1 indicating its own current functional safety level in the LLDP frame and transmits the same to the relay device 101 (step S304).

[0130] Furthermore, the in-vehicle ECU 111C transmits the LLDP frame including level information L1 indicating its own current functional safety level to the relay device 101 (step S306).

[0131] Next, the relay device 101 updates the system management list Lsy in the storage unit 51 based on the level information L1 received from each of the in-vehicle ECUs 111A and 111C (step S308).

[0132] Next, the in-vehicle ECU 111C transmits the frame F1 in which the service search message is stored to the relay device 101 (step S310).

[0133] Next, the relay device 101 acquires a service ID from the service search message stored in the received frame F1, and acquires a required security level corresponding to the service ID from the service management list Lse in the storage unit 51. Then, the relay device 101 sets relay processing conditions based on the acquired required security level and the system management list Lsy in the storage unit 51 (step S312).

[0134] Next, the relay device 101 transmits the frame F1 in which the service search message is stored to the in-vehicle ECU 111A. Specifically, the relay device 101 multicasts the frame F1 (step S314).

[0135] Next, the in-vehicle ECU 111A transmits the frame F2 in which the service provision notification message is stored to the relay device 101 (step S316).

[0136] Next, the relay device 101 discards the frame F3 because the destination MAC address of the frame F3 is "MAC_C", for example, and therefore the frame F3 does not satisfy the relay processing condition (step S318).

[0137] In addition to discarding the frame F3 in step S316, the relay device 101 may be configured to decompose the system safety level of the communication system whose system ID is "S103." More specifically, the relay device 101 generates relay condition information indicating that a failure detection mechanism should be added, and transmits a frame including the generated relay condition information to the in-vehicle ECU 111C.

[0138] The in-vehicle ECU 111C adds a fault detection mechanism in accordance with the relay condition information acquired from the frame received from the relay device 101. This increases the system safety level of the communication system with the system ID "S103", so that the frames F2, F3, F4, and F5 transmitted and received between the in-vehicle ECU 111A and the in-vehicle ECU 111C satisfy the relay processing condition, and the relay device 101 can perform relay processing of the frames F2, F3, F4, and F5.

[0139] In the in-vehicle communication system 301 according to the embodiment of the present disclosure, the storage unit 51 in the relay device 101 is configured to store a system management list Lsy indicating a correspondence between a pair of in-vehicle ECUs 111 and a system safety level set further based on data for a safety mechanism added to a frame transmitted and received between the in-vehicle ECUs 111, but the present invention is not limited to this. The storage unit 51 may be configured to store a system management list Lsy indicating a correspondence between a pair of in-vehicle ECUs 111 and a system safety level set only based on the functional safety levels possessed by each of the two in-vehicle ECUs 111. In this case, the relay device 101 determines whether or not to relay the frame based on a comparison result between the required safety level and a system safety level based only on the functional safety levels possessed by each of the two in-vehicle ECUs 111.

[0140] In addition, in the in-vehicle communication system 301 according to the embodiment of the present disclosure, the in-vehicle ECU 111 is configured to include the level information L1 in the LLDP frame and transmit the LLDP frame to the relay device 101, but this is not limited to the above. The in-vehicle ECU 111 may be configured not to notify the relay device 101 of its own functional safety level. In other words, the in-vehicle ECU 111 may be configured not to include the level information L1 in the LLDP frame. In this case, the update unit 31 in the relay device 101 may be configured not to update the system management list Lsy in the storage unit 51.

[0141] Furthermore, the in-vehicle ECU 111 may be configured to include the level information L1 in a frame conforming to a protocol other than LLDP instead of the LLDP frame and transmit the frame to the relay device 101. For example, the in-vehicle ECU 111 may be configured to include the level information L1 in a frame conforming to SNMP (Simple Network Management Protocol) and transmit the frame to the relay device 101.

[0142] In addition, in the in-vehicle communication system 301 according to the embodiment of the present disclosure, the in-vehicle ECU 111 is configured to include the level information L2 in the frame F1 in which the service search message is stored and transmit the frame F1 to the relay device 101, but this is not limited thereto. The in-vehicle ECU 111 may be configured not to notify the relay device 101 of a required safety level required for communication between the in-vehicle ECU 111 and the other in-vehicle ECU 111. That is, the in-vehicle ECU 111 may be configured not to include the level information L2 in the frame F1. In this case, the update unit 31 in the relay device 101 may be configured not to update the service management list Lse in the storage unit 51.

[0143] Alternatively, the in-vehicle ECU 111 may be configured to include the level information L2 in a frame other than the frame F1 and transmit the frame to the relay device 101, instead of the frame F1 in which the service search message is stored.

[0144] In addition, in the in-vehicle communication system 301 according to the embodiment of the present disclosure, the relay device 101 is configured to receive frames F2, F3, F4, and F5 in which messages conforming to SOME / IP are stored, and determine whether or not to relay the frames F2, F3, F4, and F5 based on a comparison result between a required safety level corresponding to a service ID included in the message and a system safety level, but this is not limited thereto. The relay device 101 may be configured to receive frames other than the frames in which messages conforming to SOME / IP are stored, and determine whether or not to relay the received frames.

[0145] In addition, in the in-vehicle communication system 301 according to the embodiment of the present disclosure, when the relay device 101 determines not to relay a frame, the relay device 101 notifies the source in-vehicle ECU 111 of the conditions required for relaying the frame to the destination in-vehicle ECU 111, but this is not limited to the above. The relay device 101 may be configured not to notify the source in-vehicle ECU 111 of the conditions. In other words, the relay device 101 may not be provided with the notification unit 41.

[0146] In addition, in the relay device 101 according to the embodiment of the present disclosure, the setting unit 21 is configured to obtain a service ID from a service search message stored in the frame F1 received by the relay unit 11 and set relay processing conditions using the obtained service ID, but this is not limited to this. The setting unit 21 may be configured to set relay processing conditions in advance using each service ID in the service management list Lse.

[0147] In addition, in the relay device 101 according to the embodiment of the present disclosure, the relay unit 11 is configured to relay frames according to the settings made by the setting unit 21, but this is not limiting. For example, the setting unit 21 may be configured to determine whether or not to relay a frame every time the relay unit 11 receives the frame. Specifically, the following configuration may be used.

[0148] That is, when relay unit 11 receives a frame from in-vehicle ECU 111, relay unit 11 outputs the received frame to setting unit 21 and suspends relaying of the frame until receiving an instruction from setting unit 21.

[0149] The setting unit 21 decides whether or not to relay the frame based on the comparison result between the required security level and the system security level. Specifically, the setting unit 21 receives a frame from the relay unit 11, acquires a service ID from a message stored in the received frame, and acquires a required security level corresponding to the acquired service ID from the service management list Lse in the storage unit 51. The setting unit 21 also acquires a system security level of the communication system indicated by the destination MAC address and source MAC address of the frame from the system management list Lsy in the storage unit 51. The setting unit 21 then compares the acquired required security level with the acquired system security level, and when the system security level is equal to or higher than the required security level, outputs a relay instruction to the relay unit 11 indicating that the frame should be relayed, while when the system security level is lower than the required security level, outputs a discard instruction to the relay unit 11 indicating that the frame should be discarded.

[0150] The relay unit 11 relays the frame based on the result of the determination by the setting unit 21. Specifically, when a relay instruction is received from the setting unit 21, the relay unit 11 relays the frame that has been put on hold for relaying to the destination in-vehicle ECU 111. On the other hand, when a discard instruction is received from the setting unit 21, the relay unit 11 discards the frame that has been put on hold for relaying without relaying it.

[0151] The above-described embodiments should be considered as illustrative and not restrictive in all respects. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0152] The above description includes the following additional features. [Appendix 1] A plurality of on-board devices; A relay device. the first in-vehicle device transmits to the relay device a frame addressed to the second in-vehicle device for transmitting and receiving information between the first in-vehicle device and the second in-vehicle device; the relay device determines whether or not to relay the frame to the second in-vehicle device based on a comparison result between a required safety level, which is a level of safety required for communication between the first in-vehicle device and the second in-vehicle device, and a system safety level, which is based at least on a functional safety level related to vehicle safety possessed by each of the first in-vehicle device and the second in-vehicle device; The relay device performs a setting as to whether or not relaying is possible based on the result of the comparison, and relays the frame in accordance with the setting.

[0153] [Appendix 2] A communication method in an in-vehicle communication system including a plurality of in-vehicle devices and a relay device, comprising: a step of transmitting a frame addressed to the second in-vehicle device to the relay device, the frame being used for transmitting and receiving information between the first in-vehicle device and the second in-vehicle device; A communication method comprising: the relay device determining whether or not to relay the frame to the second in-vehicle device based on a comparison result between a required safety level, which is the level of safety required for communication between the first in-vehicle device and the second in-vehicle device, and a system safety level, which is based at least on a functional safety level related to vehicle safety possessed by each of the first in-vehicle device and the second in-vehicle device. [Explanation of symbols]

[0154] 1 vehicle 2 Cable 11 Relay Section 15, 15A, 15B, 15C communication ports 21 Setting section 31 Update section 41 Notification Department 51 Storage section 101 Repeater 111,111A,111B Automotive ECU 301 In-vehicle communication system Lsy System Management List Lse service management list

Claims

1. A plurality of on-board devices; A relay device. the first in-vehicle device transmits to the relay device a frame addressed to the second in-vehicle device for transmitting and receiving information between the first in-vehicle device and the second in-vehicle device; the relay device determines whether or not to relay the frame to the second in-vehicle device based on a comparison result between a required safety level, which is a level of safety required for communication between the first in-vehicle device and the second in-vehicle device, and a system safety level, which is based at least on a functional safety level related to vehicle safety that the first in-vehicle device and the second in-vehicle device each have; An in-vehicle communication system in which the relay device acquires type information from the frame indicating the type of information being transmitted and received between the first in-vehicle device and the second in-vehicle device, and determines whether or not to relay the frame to the second in-vehicle device based on a comparison result between the required safety level corresponding to the acquired type information and the system safety level.

2. 2. The in-vehicle communication system according to claim 1, wherein the relay device determines whether or not to relay the frame to the second in-vehicle device based on a comparison result between the required safety level and the system safety level which is further based on data for a safety mechanism provided in the frame.

3. the relay device includes a storage unit configured to store a system management list indicating a correspondence relationship between the pair of the in-vehicle devices and the system safety level, the in-vehicle device notifies the relay device of its own functional safety level; The in-vehicle communication system according to claim 1 , wherein the relay device updates the system management list in the storage unit based on the functional safety level notified from the in-vehicle device.

4. the relay device includes a storage unit configured to store a service management list indicating a correspondence between a type of information transmitted and received between the vehicle-mounted devices and the required safety level; the in-vehicle device notifies the relay device of the required safety level required for communication between the in-vehicle device and the other in-vehicle device; The in-vehicle communication system according to claim 1 , wherein the relay device updates the service management list in the storage unit based on the required safety level notified from the in-vehicle device.

5. The first in-vehicle device transmits the frame in which a message conforming to SOME / IP (Scalable service-oriented middleware E over IP) is stored to the relay device; 5. The in-vehicle communication system according to claim 1, wherein the relay device determines whether or not to relay the frame to the second in-vehicle device based on a comparison result between the required safety level corresponding to the service ID included in the message and the system safety level.

6. 6. The in-vehicle communication system according to claim 1, wherein when the relay device decides not to relay the frame to the second in-vehicle device, the relay device notifies the first in-vehicle device of the conditions necessary to relay the frame to the second in-vehicle device.

7. A relay device used in an in-vehicle communication system having a plurality of in-vehicle devices, a setting unit that sets whether or not to relay frames for transmitting and receiving information between the in-vehicle devices based on a comparison result between a required safety level, which is a safety level required for communication between the in-vehicle devices, and a system safety level based at least on a functional safety level related to vehicle safety of each of the in-vehicle devices; a relay unit that performs relay processing of the frame in accordance with the contents of the setting by the setting unit. the setting unit performs a setting regarding whether or not to relay the frame based on a comparison result between the required safety level corresponding to each type information indicating a type of information transmitted and received between the in-vehicle devices and the system safety level, and The relay unit performs relay processing of the frame in accordance with the type information included in the frame and the contents of the setting by the setting unit.

8. A relay method in a relay device used in an in-vehicle communication system having a plurality of in-vehicle devices, comprising: setting whether or not to relay frames for transmitting and receiving information between the in-vehicle devices based on a comparison result between a required safety level, which is a safety level required for communication between the in-vehicle devices, and a system safety level based at least on a functional safety level related to vehicle safety possessed by each of the in-vehicle devices; and performing relay processing of the frame in accordance with the set contents, In the step of setting whether or not to relay the frame, a setting as to whether or not to relay the frame is performed based on a comparison result between the required safety level corresponding to each type information indicating a type of information transmitted and received between the in-vehicle devices and the system safety level, In the step of relaying the frame, relay processing of the frame is performed in accordance with the type information included in the frame and a setting regarding whether or not the frame can be relayed.

Images