Onboard device, service provision system, service provision method, and service provision program

Abstract

A cooperation control unit (40) is provided with an access control method determination unit (72) and an access propriety determination unit (74). The access control method determination unit determines an access control method for controlling transfer of an access request to a functional block (35) on the basis of current interface usage fee information, future predicted amount information, and an interface usage condition set in order for a servicer (SV), which provides a service to a vehicle using a service application (SA), to use a functional interface (37). The access propriety determination unit determines whether to permit the access request on the basis of the determined access control method and a request from a vehicle control system (2).

Description

In-vehicle device, service providing system, service providing method, and service providing program CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This international application claims the benefit of Japanese Patent Application No. 2023-096246, filed with the Japan Patent Office on June 12, 2023, the entire disclosure of which is incorporated herein by reference.

[0002] The present disclosure relates to an in-vehicle device that provides a service to a vehicle, a service providing system, a service providing method, and a service providing program.

[0003] Patent Literature 1 describes a sharing mobility system that includes multiple user terminals used by users who use vehicles, multiple carport devices installed in carports, and a server managed by a business that provides mobility services to users. In the sharing mobility system described in Patent Literature 1, the server calculates the expected revenue that the business can obtain from users when they use vehicles that are parked in the carport and available for use.

[0004] Japanese Patent Application Laid-Open No. 2022-77207

[0005] When a service provider provides a service to a vehicle, it may be necessary to obtain vehicle information about the vehicle from the target vehicle to which the service is being provided, or to have the target vehicle perform a specified operation or process.

[0006] In this way, when a service provider uses a vehicle by obtaining vehicle information from the vehicle or causing the vehicle to perform a specified operation or process, it is desirable to charge the service provider appropriately according to the use of the vehicle.

[0007] As a result of detailed consideration by the inventors, it was found that if the vehicle usage fee incurred by the service provider when using a vehicle changes dynamically, the monthly cost of the service provider may fluctuate and become unstable.

[0008] The present disclosure reduces fluctuations in fees incurred by service providers when they use vehicles.

[0009] One aspect of the present disclosure is an in-vehicle device that is mounted on a vehicle and connected to a plurality of electronic control devices via an in-vehicle network.

[0010] The in-vehicle device of the present disclosure includes a cooperation control unit configured to realize cooperation between a service application configured to provide a service to a vehicle and a functional block configured to execute predetermined processing in the vehicle. The functional block includes a functional interface configured to convert an access request expressed in a vehicle-independent format and transmitted from the service application into a vehicle-dependent format. The cooperation control unit is configured to forward the access request transmitted from the service application to the functional block.

[0011] The cooperation control unit includes an access control method determination unit and an access permission determination unit.

[0012] The access control method determination unit is configured to determine an access control method for controlling the transfer of access requests to the functional blocks based on current interface usage fee information, future estimated amount information, and interface usage conditions set for using the functional interface by a servicer that provides services to vehicles using a service application.The current interface usage fee information indicates a current interface usage fee that is an interface usage fee that will be incurred when the service application currently uses the functional interface.The future estimated amount information indicates a future estimated amount that is a predicted amount of interface usage fees that will be incurred when the service application uses the functional interface in the future.

[0013] The access permission determination unit is configured to determine whether to permit the access request based on the access control method determined by the access control method determination unit and a request from a vehicle control system including a plurality of electronic control units and an in-vehicle device.

[0014] The in-vehicle device of the present disclosure configured in this manner can allow a service application to use a functional interface when the current interface usage fee and future forecasted amount satisfy the interface usage conditions set by the servicer. This prevents the service application from using a functional interface when the current interface usage fee and future forecasted amount are higher than the servicer expects. Therefore, the in-vehicle device of the present disclosure can prevent fluctuations in fees incurred when the servicer uses the vehicle.

[0015] Another aspect of the present disclosure is a service providing system including a vehicle control system including a plurality of electronic control units mounted on a vehicle and connected to an in-vehicle network, the vehicle control system including a cooperation control unit configured to realize cooperation between a service application and a functional block, and a server configured to be able to communicate data with the vehicle control system. The cooperation control unit includes an access control method determination unit and an access permission determination unit.

[0016] The service providing system of the present disclosure configured in this manner is a system including the in-vehicle device of the present disclosure, and can obtain the same effects as the in-vehicle device of the present disclosure.

[0017] According to another aspect of the present disclosure, there is provided a service providing method executed by an in-vehicle device mounted in a vehicle and connected to a plurality of electronic control units via an in-vehicle network. The in-vehicle device includes a function interface and a cooperation control unit.

[0018] In the service providing method of the present disclosure, the in-vehicle device determines an access control method for controlling the transfer of an access request to a functional block based on current interface usage fee information, future forecast amount information, and interface usage conditions set for using the functional interface by a service provider that provides a service to a vehicle using a service application. The in-vehicle device also determines whether to permit the access request based on the determined access control method and a request from a vehicle control system that includes multiple electronic control units and the in-vehicle device.

[0019] The service providing method of the present disclosure is a method executed by the in-vehicle device of the present disclosure, and by executing this method, it is possible to obtain the same effects as the in-vehicle device of the present disclosure.

[0020] Another aspect of the present disclosure is a service provision program for causing a computer of an on-board device that is mounted in a vehicle and connected to multiple electronic control devices via an on-board network to function as a functional interface, a collaboration control unit, an access control method determination unit, and an accessibility determination unit.

[0021] A computer controlled by the service providing program of the present disclosure can constitute a part of the in-vehicle device of the present disclosure, and can obtain the same effects as the in-vehicle device of the present disclosure.

[0022] 1 is a block diagram showing the configuration of a service providing system. FIG. 2 is a block diagram showing the configuration of an ECU. FIG. 3 is a block diagram showing a billing procedure. FIG. 4 is a block diagram showing an information transmission path. FIG. 5 is a block diagram explaining the operation of a service providing system. FIG. 6 is a diagram showing a usage setting table. FIG. 7 is a diagram showing a method for setting forced usage. FIG. 8 is a diagram showing a first specific example for determining an access control method. FIG. 9 is a diagram showing a second specific example for determining an access control method. FIG. 10 is a block diagram explaining the operation of an access permission determination unit and an access control execution unit. FIG. 11 is a block diagram explaining the operation of an access control execution unit and an access log management unit. FIG. 12 is a sequence diagram showing a procedure for setting API usage conditions and a procedure for setting whether API usage is allowed. FIG. 13 is a sequence diagram showing a procedure for determining whether access is allowed. FIG. 14 is a sequence diagram showing a procedure for having a user set whether API usage is allowed.

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0024] As shown in FIG. 1, the service providing system 1 of this embodiment includes a vehicle control system 2 and a server 3.

[0025] The vehicle control system 2 is mounted on a vehicle and has a function of performing data communication with a server 3 via a wide area wireless communication network NW.

[0026] The server 3 has a function of performing data communication with the vehicle control system 2 via the wide area wireless communication network NW. The server 3 is provided with an app store that can be accessed via the wide area wireless communication network NW or the Internet.

[0027] A vehicle equipped with the vehicle control system 2 may have an automatic driving function in addition to a manual driving function. The vehicle may be a hybrid vehicle having an engine and an electric motor as a driving source. The vehicle is not limited to a vehicle having an automatic driving function or a hybrid vehicle, but may be a vehicle equipped with only a manual driving function, or a vehicle having only an engine or only an electric motor as a driving source. Hereinafter, a vehicle equipped with the vehicle control system 2 will be simply referred to as a vehicle.

[0028] The vehicle control system 2 includes one ECU 4, a plurality of ECUs 5, a plurality of ECUs 6, an external communication device 7, and an internal communication network 8. ECU is an abbreviation for Electronic Control Unit.

[0029] The ECU 4 controls a plurality of ECUs 5 to realize coordinated control of the entire vehicle.

[0030] An ECU 5 is provided for each domain, which is divided according to the vehicle's functions, and mainly controls the multiple ECUs 6 present within that domain. Each ECU 5 is connected to its subordinate ECUs 6 via a lower-level network (e.g., CAN) that is individually provided for each ECU 5. CAN stands for Controller Area Network. CAN is a registered trademark. Examples of domains include the powertrain, body, chassis, and cockpit.

[0031] The ECUs 6 connected to the ECU 5 belonging to the powertrain domain include, for example, an ECU 6 that controls the engine, an ECU 6 that controls the motor, and an ECU 6 that controls the battery.

[0032] The ECUs 6 connected to the ECU 5 belonging to the body domain include, for example, an ECU 6 that controls an air conditioner, an ECU 6 that controls doors, and the like.

[0033] The ECUs 6 connected to the ECU 5 belonging to the chassis domain include, for example, an ECU 6 that controls the brakes, an ECU 6 that controls the steering, and the like.

[0034] The ECUs 6 connected to the ECU 5 belonging to the cockpit domain include, for example, an ECU 6 that controls the display of meters and navigation, and an ECU 6 that controls input devices operated by vehicle occupants.

[0035] The external vehicle communication device 7 performs data communication with the server 3 via the wide area wireless communication network NW.

[0036] The in-vehicle communication network 8 includes CAN FD and Ethernet. Ethernet is a registered trademark. CAN FD stands for CAN with Flexible Data Rate. The CAN FD connects the ECU 4 to each ECU 5 and the external-vehicle communication device 7 via a bus. The Ethernet individually connects the ECU 4 to each ECU 5 and the external-vehicle communication device 7.

[0037] The ECU 4 is an electronic control device mainly composed of a microcomputer including a CPU 4a, a ROM 4b, a RAM 4c, etc. Various functions of the microcomputer are realized by the CPU 4a executing a program stored in a non-transitory tangible recording medium. In this example, the ROM 4b corresponds to the non-transitory tangible recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 4a may be configured as hardware using one or more ICs, etc. Furthermore, the number of microcomputers constituting the ECU 4 may be one or more.

[0038] The ECU 4 further includes a flash ROM 4d, which is a non-volatile memory whose stored contents are rewritable.

[0039] Like the ECU 4, the ECUs 5, 6, and exterior communication device 7 are all electronic control devices mainly configured with a microcomputer including a CPU, ROM, RAM, etc. The number of microcomputers configuring the ECUs 5, 6, and exterior communication device 7 may be one or more. The ECU 5 controls one or more ECUs 6. The ECU 4 controls one or more ECUs 5, 6, or controls the ECUs 5, 6 and exterior communication device 7 of the entire vehicle.

[0040] In the following description, the ECU 4, ECU 5, ECU 6 and the external communication device 7 will be referred to as the in-vehicle devices 4 to 7 unless otherwise specified.

[0041] The server 3 includes a control unit 11 , a communication unit 12 , and a storage unit 13 .

[0042] The control unit 11 is an electronic control device mainly composed of a microcomputer including a CPU 11a, a ROM 11b, a RAM 11c, etc. Various functions of the microcomputer are realized by the CPU 11a executing a program stored in a non-transitory tangible recording medium. In this example, the ROM 11b corresponds to the non-transitory tangible recording medium storing the program. Furthermore, the execution of this program results in the execution of a method corresponding to the program. Note that some or all of the functions executed by the CPU 11a may be configured as hardware using one or more ICs, etc. Furthermore, the number of microcomputers constituting the control unit 11 may be one or more.

[0043] The communication unit 12 performs data communication with the vehicle control system 2 via the wide area wireless communication network NW. The storage unit 13 is a storage device for storing various data.

[0044] The service providing system 1 further includes a servicer terminal device 9. The servicer terminal device 9 is a device managed by a service provider SV (hereinafter referred to as servicer SV) described later, and is, for example, a personal computer.

[0045] The servicer terminal device 9 includes a control unit 15 , a communication unit 16 , a storage unit 17 , a display unit 18 , and an operation input unit 19 .

[0046] The control unit 15 is an electronic control device mainly composed of a microcomputer including a CPU, a ROM, a RAM, and the like.

[0047] The communication unit 16 communicates data with the vehicle control system 2 and the server 3 via the wide area wireless communication network NW. The memory unit 17 is a storage device for storing various data. The display unit 18 is equipped with a display device (not shown) and displays various images on the display screen of the display device. The operation input unit 19 outputs input operation information for identifying input operations performed by the user via a keyboard and mouse (not shown).

[0048] 2, the ECU 4 includes a real-time processing unit 20 and an application processing unit 30 (hereinafter referred to as the application processing unit 30). When the ECU 4 includes multiple CPUs 4a, the real-time processing unit 20 and the application processing unit 30 may be realized by processes executed by the same CPU, or may be realized by processes executed by different CPUs.

[0049] The real-time processing unit 20 cooperates with the in-vehicle devices 5 to 7 connected via the CAN FD to execute vehicle control and other tasks that require real-time performance. The application processing unit 30 cooperates with the in-vehicle devices 5 to 7 connected via Ethernet to execute various applications (e.g., entertainment applications) that require high processing power.

[0050] The application processing unit 30 has a function of transmitting instructions based on the processing of various applications to the real-time processing unit 20. The real-time processing unit 20 has a function of transmitting information collected from the ECU or the like via the CAN FD to the application processing unit 30. As a result, the real-time processing unit 20 and the application processing unit 30 cooperate with each other to realize various functions.

[0051] The software of the vehicle control system 2 is built in accordance with AUTOSAR. AUTOSAR is an architecture for autonomous driving and is an abbreviation for Automotive Open System Architecture. AUTOSAR is a registered trademark. AUTOSAR not only provides communication between software components (hereinafter referred to as SW-C) implemented to realize various applications, but also functions related to cloud connection and security. SW-C is modularized software to realize a certain function. An application program includes one or more SW-Cs. Note that the software of the vehicle control system 2 does not necessarily have to be built in accordance with AUTOSAR.

[0052] Each of the devices belonging to the vehicle control system 2, i.e., the ECU 4, ECU 5, ECU 6, and the external-vehicle communication device 7, has a platform. The platform provides an environment for executing SW-C written in a hardware-independent format.

[0053] The platform comprises a runtime environment (hereinafter referred to as RTE) and platform software (hereinafter referred to as BSW). RTE is an interface that connects SW-Cs with each other and between SW-Cs and BSW. BSW is a layer that connects hardware and SW-Cs, and includes the OS, drivers, middleware, etc. The functions of BSW are divided into small modules, and the functions of each module are provided to SW-Cs via APIs. API stands for Application Programming Interface.

[0054] Hereinafter, the platform provided in the real-time processing unit 20 will be referred to as a first platform 21 (hereinafter referred to as a first PF 21), and the platform provided in the application processing unit 30 will be referred to as a second platform 31 (hereinafter referred to as a second PF 31).

[0055] The real-time processing unit 20 includes a control system functional block group 22 as a collection of service applications (hereinafter, referred to as service apps) that run on the first PF 21. A service app is an application that receives a request from a client, processes it, and returns the result.

[0056] The control system functional block group 22 is a group of applications that have an API that receives commands related to vehicle movement and that integrates the commands received by the API to achieve consistent vehicle control. The control system functional block group 22 outputs various commands via the in-vehicle communication network 8 to the in-vehicle devices 5 to 7 that execute the control based on the commands.

[0057] The first PF 21 includes a conversion gateway 211. The conversion gateway 211 has a function of converting a communication frame received by the real-time processing unit 20 via CAN FD into an Ethernet format and providing the frame to the application processing unit 30. The conversion gateway 211 also has a function of converting a communication frame in Ethernet format provided from the application processing unit 30 into a CAN FD format.

[0058] The application processing unit 30 includes a hypervisor 32 and executes software on a plurality of virtual machines. Note that the hypervisor 32 may be omitted.

[0059] The application processing unit 30 includes a service function block group 33 as a group of service applications that run on the second PF 31 .

[0060] The service function block group 33 is a collection of service applications. Each service application includes one or more SW-Cs. Service applications may be provided not only by the vehicle manufacturer that produced the vehicle, but also by third parties. Examples of third parties that provide service applications include data utilization companies that provide services by collecting data from vehicles.

[0061] The second PF 31 includes a control system function block group 35 , a data system function block group 36 , and an API gateway 40 .

[0062] The control system functional block group 35 is a set of programs equipped with an API for receiving requests related to vehicle control from the service system functional block group 33. The control system functional block group 35 includes an API group 37 made up of multiple APIs, and converts API access requests from the service system functional block group 33, which are expressed in a vehicle-independent format, into API access requests expressed in a vehicle-dependent format and provides them to the real-time processing unit 20. The above-mentioned "vehicle-independent format" is a format common to vehicles (i.e., a format that absorbs differences between vehicle models). The above-mentioned "vehicle-dependent format" is a format specific to the vehicle.

[0063] The APIs included in the control system functional block group 35 include motion system APIs that control the motion of the vehicle and other non-motion system APIs. An API access request accepted by a motion system API is transferred to the control system functional block group 35, and then transferred from the control system functional block group 35 to the in-vehicle devices 5 to 7 that execute control based on the request via the in-vehicle communication network 8. An API access request accepted by a non-motion system API is transferred via the in-vehicle communication network 8 to the in-vehicle devices 5 to 7 that execute control based on the request.

[0064] The data-related functional block group 36 is a set of programs equipped with an API for handling vehicle data acquired and stored via the real-time processing unit 20. The data-related functional block group 36 has a function of abstracting vehicle data expressed in a vehicle-dependent format and supplied from the real-time processing unit 20 into a vehicle-independent format and storing the abstracted data. The data-related functional block group 36 may have an API that provides a function for transmitting specified vehicle data to an ECU or the like via Ethernet. In particular, when the destination is the exterior communication device 7, the exterior communication device 7 may upload the transmitted vehicle data to the cloud.

[0065] Note that communication with the other on-board devices 5 to 7 via the control system function block group 35 is not limited to CAN FD, but may use Ethernet or other communication means. Also, communication with the other on-board devices 5 to 7 via the data system function block group 36 is not limited to Ethernet, but may use CAN FD or other communication means.

[0066] The API gateway 40 is configured using the functions of a virtual function bus (hereinafter referred to as VFB). VFB is middleware, also called a software bus, that enables communication between SW-Cs and between SW-Cs and BSWs without regard to hardware, communication protocols, etc. Communication between SW-Cs refers to access from an SW-C to an API provided by another SW-C, and communication between SW-Cs and BSW refers to access from an SW-C to an API provided by the control system function block group 35 and the data system function block group 36.

[0067] That is, the SW-C accesses various APIs via the API gateway 40 and uses the functions provided by the accessed APIs to achieve the desired functions.

[0068] When using an API, the SW-C sends an API access request. The API access request includes at least the application ID of the service application including the SW-C that is the request source, and an API-ID that is information indicating the API that is the request destination.

[0069] 3 , the server 3 is provided with an app store 14. As indicated by arrow L1, the app store 14 has a function of registering a service app SA created by a servicer SV in the app store 14 based on an application by the servicer SV that accesses the app store 14 using the servicer terminal device 9. The service app SA registered in the app store 14 is published on the website of the app store 14.

[0070] Furthermore, as indicated by an arrow L2, the application store 14 has a function of registering the API used by the service application SA in the application store 14 based on a request from the servicer SV.

[0071] When the user US accesses the website of the app store 14 and purchases the service app SA, the service app SA is installed in the ECU 4 mounted in the vehicle of the user US, as shown by the arrow L3.

[0072] As indicated by arrow L4, when the service application SA transmits an API access request to the API gateway 40, the API gateway 40 transfers the API access request to the control system functional block group 35 as indicated by arrow L5. As described above, the control system functional block group 35 converts the API access request into an API access request expressed in a vehicle-dependent format and provides it to the real-time processing unit 20.

[0073] As indicated by arrow L6, the API gateway 40 transmits to the app store 14 a statistical access log including the number of API usages taking into account the execution success status of API access requests and the amount of communication data associated with the API usage.

[0074] The app store 14 calculates the API usage fee incurred when the service app SA uses the API based on the statistical access log received from the API gateway 40, and bills the servicer SV for the API usage fee. The servicer SV pays the billed API usage fee to the app store 14, as indicated by arrow L7.

[0075] The app store 14 calculates the app usage fee for the service app SA based on the usage status of the service app SA and bills the user US for the app usage fee. The user US pays the billed app usage fee to the app store 14, as shown by arrow L8. The app store 14 transfers the app usage fee paid by the user US to the servicer SV, as shown by arrow L9.

[0076] As shown in FIG. 4, the vehicle control system 2 includes a vehicle purpose management system 51, a state recognition system 52, a vehicle equipment output management system 53, and a vehicle energy management system .

[0077] The vehicle objective management system 51 is composed of one or more ECUs 5 and 6 and has a function of creating a long-term vehicle operation plan. The long-term vehicle operation plan includes a driving plan, a cabin temperature plan, and an equipment operation application usage plan.

[0078] The driving plan is created to reflect the differences in braking and accelerating characteristics that vary depending on the vehicle and the differences in individual driving characteristics. The driving plan is, for example, a vehicle speed profile, and is represented as a two-dimensional graph with the horizontal axis representing time [s] and the vertical axis representing vehicle speed [km / h].

[0079] The cabin temperature plan is, for example, an air conditioning profile, and is represented by a two-dimensional graph with the horizontal axis representing time [s] and the vertical axis representing temperature [°C].

[0080] The device operation application usage plan is, for example, a battery charging profile, and is expressed as a two-dimensional graph with the horizontal axis representing time [s] and the vertical axis representing the charging rate [%].

[0081] The state recognition system 52 is composed of one or more ECUs 5 and 6, and has the function of generating current vehicle information, current occupant information, current surrounding information, and a vehicle CPU load profile.

[0082] The current vehicle information is, for example, the current vehicle speed of the vehicle. The current occupant information is, for example, the occupant's alertness. The current surrounding information is, for example, signs present around the vehicle. The vehicle CPU load profile is, for example, a CPU load forecast plan until the vehicle arrives at the destination.

[0083] The vehicle equipment output management system 53 is composed of one or more ECUs 5 and 6, and has the function of creating current equipment operation status information and vehicle equipment operation profiles.

[0084] The current equipment operation status information indicates, for example, whether the vehicle lights are on. The vehicle equipment operation profile is, for example, a light usage plan for using lights in tunnels and the like before arriving at the destination, and is represented by a two-dimensional graph with the horizontal axis being time [s] and the vertical axis being power [kWh].

[0085] The vehicle energy management system 54 is made up of one or more ECUs 5 and 6, and has the function of collecting current vehicle energy status information and creating a long-term energy plan.

[0086] The current vehicle energy state information is, for example, information indicating the state of charge (i.e., SOC) of an electric storage device mounted on the vehicle. SOC is an abbreviation for State Of Charge.

[0087] The long-term energy plan is, for example, a battery load profile that predicts the SOC until arrival at the destination, and is represented by a two-dimensional graph with the horizontal axis being time [s] and the vertical axis being the charging rate [%].

[0088] As shown by arrow L11, the API gateway 40 acquires various information created by the vehicle purpose management system 51, the status recognition system 52, the vehicle equipment output management system 53, and the vehicle energy management system 54, and calculates the current API usage fee and the future predicted amount of the API usage fee.

[0089] As indicated by arrows L12 and L13, the API gateway 40 notifies the application store 14 and the service application SA of the calculated current API usage fee and the estimated future amount of the API usage fee.

[0090] The app store 14 acquires current API usage fee information indicating the current API usage fee and estimated API fee information indicating the future estimated amount of the API usage fee from the API gateways 40 of multiple vehicles. The app store 14 acquires information from other systems as indicated by arrow L14. The information from other systems includes, for example, energy supply and demand information from electric power companies and rapid charger congestion information indicating the congestion status of rapid chargers.

[0091] The app store 14 calculates a future forecast amount of vehicle API usage fees using information acquired from the API gateways 40 of multiple vehicles and other systems.

[0092] As indicated by arrows L15 and L16, the app store 14 notifies the API gateway 40 and the service app SA of the calculated future estimated amount of the vehicle API usage fee.

[0093] As shown by arrow L17, the app store 14 notifies the servicer terminal device 9 of the current API usage fee and the future estimated amount of API usage fee obtained from the API gateway 40, as well as the calculated future estimated amount of vehicle API usage fee.

[0094] As indicated by arrow L18, the servicer terminal device 9 can set whether or not the service app SA will use the API, based on the current API usage fee and the predicted future amount of the API usage fee.

[0095] As shown in FIG. 5 , the app store 14 includes an API usage fee calculation unit 61 and a charge amount calculation unit 62 .

[0096] As described above, the API usage fee calculation unit 61 calculates the future expected amount of vehicle API usage fees using information acquired from the API gateways 40 of multiple vehicles and other systems.

[0097] As described above, the charge amount calculation unit 62 calculates the API usage fee incurred when the service app SA uses the API, based on the statistical access log received from the API gateway 40. As described above, the charge amount calculation unit 62 calculates the application usage fee for the service app SA based on the usage status of the service app SA.

[0098] The API gateway 40 includes a usage fee management unit 71 , an access control method determination unit 72 , a user setting unit 73 , an access permission determination unit 74 , an access control execution unit 75 , and an access log management unit 76 .

[0099] As described above, the usage fee management unit 71 calculates the current API usage fee and the future estimated amount of the API usage fee. As indicated by arrow L21, the usage fee management unit 71 notifies the app store 14 of the calculated current API usage fee and the future estimated amount of the API usage fee.

[0100] As indicated by arrow L22, the app store 14 notifies the usage fee management unit 71 of the future estimated amount of the vehicle API usage fee calculated by the API usage fee calculation unit 61.

[0101] As shown by arrow L23, the servicer terminal device 9 accesses the app store 14 based on input operations by the servicer SV via the operation input unit 19, and sets the usage conditions of the API used by the service app SA (hereinafter referred to as API usage conditions).

[0102] The app store 14 notifies the access control method determination unit 72 of the set API usage conditions, as indicated by an arrow L24.

[0103] As shown by arrow L25, the usage fee management unit 71 notifies the access control method determination unit 72 of the current API usage fee and the future estimated amount of API usage fee calculated by the usage fee management unit 71, as well as the future estimated amount of vehicle API usage fee obtained from the app store 14.

[0104] As indicated by arrow L26, the access control method determination unit 72 determines an access control method based on the above information acquired from the usage fee management unit 71 and the API usage conditions acquired from the app store 14, and instructs the determined access control method to the access permission determination unit 74. Details of the access control method determined by the access control method determination unit 72 will be described later.

[0105] As indicated by arrow L27, the user setting unit 73 sets whether or not to permit forced use of the API by the service app SA by charging the user US based on an input operation by the user US via the input device mounted on the vehicle, and notifies the set forced use permission / denial to the access permission determination unit 74. Details of the forced use permission / denial set by the user setting unit 73 will be described later.

[0106] As indicated by arrow L28, the status recognition system 52 notifies the accessibility determination unit 74 of future predicted availability information. The future predicted availability information notified by the status recognition system 52 is, for example, information indicating a future prediction of available CPU usage.

[0107] As indicated by arrow L29, the vehicle equipment output management system 53 notifies the accessibility determination unit 74 of the future predicted availability information. The future predicted availability information notified by the vehicle equipment output management system 53 is, for example, information indicating a future prediction of the amount of available communication data.

[0108] As indicated by arrow L30, the vehicle energy management system 54 notifies the accessibility determination unit 74 of future predicted availability information. The future predicted availability information notified by the vehicle energy management system 54 is, for example, information indicating a future prediction of available battery usage.

[0109] The service application SA installed in the vehicle purpose management system 51 transmits an API access request to the access permission determination unit 74, as indicated by an arrow L31.

[0110] The accessibility determination unit 74 determines whether the API corresponding to the API access request received from the service app SA can be used based on the access control method instructed by the access control method determination unit 72, the forced use possibility instructed by the user setting unit 73, and future predicted availability information obtained from the status recognition system 52, the vehicle equipment output management system 53, and the vehicle energy management system 54.

[0111] As indicated by arrows L32 and L33, the accessibility determination unit 74 notifies the service app SA and the app store 14 of the determination result of whether the API corresponding to the API access request received from the service app SA can be used (hereinafter referred to as the API availability determination result).

[0112] The app store 14 transfers the API availability determination result acquired from the accessibility determination unit 74 to the servicer terminal device 9, as indicated by an arrow L34.

[0113] When the access permission determination unit 74 permits the use of the API corresponding to the API access request received from the service app SA, it sends the permitted API access request and an API execution method instruction that instructs how to execute the API access request (hereinafter referred to as the access execution method) to the access control execution unit 75, as shown by arrow L35.

[0114] The access control execution unit 75 transfers the API access request to the control system functional block group 35 in accordance with the access execution method instructed by the API execution method instruction. As a result, as indicated by arrows L36, L37, and L38, control based on the API access request is executed in at least one of the state recognition system 52, the vehicle equipment output management system 53, and the vehicle energy management system 54. Arrow L36 indicates that one or more ECUs 5, 6 constituting the state recognition system 52 execute processing in response to the API access request. Arrow L37 indicates that one or more ECUs 5, 6 constituting the vehicle equipment output management system 53 execute processing in response to the API access request. Arrow L38 indicates that one or more ECUs 5, 6 constituting the vehicle energy management system 54 execute processing in response to the API access request.

[0115] As indicated by arrow L39, the access control execution unit 75 creates an access log indicating the results of the execution of the processing corresponding to the API access request, and notifies the access log management unit 76 of the created access log.

[0116] The access log management unit 76 transmits the access log acquired from the access control execution unit 75 to the application store 14 .

[0117] Next, a method for the servicer SV to set API usage conditions will be described.

[0118] As shown in FIG. 6, one or more usage setting items for setting API usage conditions are set in advance for each of a plurality of APIs.

[0119] The usage setting table TB1, usage setting table TB2, and usage setting table TB3 shown in FIG. 6 respectively show usage setting items and setting contents for the first API, the second API, and the third API.

[0120] The first API is, for example, an API for executing a process of sending a driving operation report to the cloud.

[0121] The second API is, for example, an API for executing a process that enables game operation in the back seat of a vehicle using multimedia.

[0122] The third API is, for example, an API for executing a process for turning on illumination in the rear seats of the vehicle.

[0123] The usage setting table TB1 indicates that the usage setting items for the first API are three: "price range [yen / time]," "estimated range duration [minutes]," and "time shift setting."

[0124] "Price range [yen / time]" indicates the price range within which API usage is permitted. The price range is expressed as the price for one use of the API.

[0125] "Expected range duration [min]" indicates the duration for which the price set in "Price range [yen / transaction]" will continue. In other words, use of the API is permitted when the price set in "Price range [yen / transaction]" continues for the duration set in "Expected range duration [min]".

[0126] The "time shift setting" is a setting for shifting the timing of API use when API use is prohibited based on the settings for "price range [yen / time]" and "estimated range duration [minutes]."

[0127] In the usage setting table TB1, the "price range [yen / time]" is set to "up to 10" and the "expected range duration [minutes]" is set to "15 minutes." In other words, if the usage price per use of the first API remains less than 10 yen for 15 minutes or more, use of the first API is permitted.

[0128] In addition, the usage setting table TB1 is configured so that the setting content of the "time shift setting" can be set to any one of "anytime," "only while driving," and "only while parked."

[0129] The usage setting table TB2 indicates that the usage setting items for the second API are three: "Price range [yen / time]," "Estimated range duration [minutes]," and "Time shift setting." In the usage setting table TB2, the "Price range [yen / time]" is set to "up to 10," and the "Estimated range duration [minutes]" is set to "15 minutes." In addition, in the usage setting table TB2, the "Time shift setting" is set to "OFF." In other words, if the use of the second API is prohibited, the timing of using the second API cannot be changed.

[0130] The usage setting table TB3 indicates that the usage setting items for the third API are three: "Price range [yen / time]", "Estimated range duration [minutes]", "Time shift setting", and "Option setting".

[0131] The "option setting" is a setting that enables the use of the API when the use of the API is prohibited based on the settings of the "price range [yen / time]" and the "estimated range duration [minutes]."

[0132] In the usage setting table TB3, the "price range [yen / time]" is set to "up to 10", the "estimated range duration [minutes]" is set to "15 minutes", and the "time shift setting" is set to "OFF".

[0133] In addition, in the usage setting table TB3, the "option setting" is set to "If there is a level that can be lowered to fall within the available range, change the control amount to that level and execute," and "If there is no level that can be lowered to fall within the available range, it cannot be used." In other words, if the settings for "price range [yen / time]" and "estimated range duration [minutes]" can be satisfied by lowering the brightness level of the illumination in the rear seat of the vehicle, use of the third API is permitted.

[0134] Next, a method for the user US to set whether or not a service application is forcibly available will be described.

[0135] 7, a setting for forced use by charging is made for each of a plurality of service applications. Forced use by charging means that even if the API usage fee exceeds the set content of "price range [yen / time]", the use of the API is permitted by charging the user US for the excess API usage fee.

[0136] The first, second, and third service apps are configured to be selectable between allowing and prohibiting forced use by charging. The first and second service apps are set to allow forced use by charging, and the third service app is set to prohibit forced use by charging.

[0137] That is, the first and second service applications can use the API by charging the user US for the amount exceeding the set content of the "price range [yen / time]." The third service application cannot use the API if the set content of the "price range [yen / time]" is exceeded.

[0138] The fourth service app is configured so that forced use of the app cannot be set by charging. This is because the only factor that can cause the API used by the fourth service app to exceed the set "price range [yen / use]" is resources borne by the user US, such as a decrease in the battery SOC. Therefore, the fourth service app is prohibited from using the API when the set "price range [yen / use]" is exceeded.

[0139] The forced usage may be permitted by the user US when the API usage fee increases due to the vehicle load. However, the forced usage setting does not apply to the case where the user US is paying for resources such as electricity charges, such as a decrease in the battery SOC.

[0140] Factors that cause API fees to fluctuate due to vehicle load include, for example, the amount of calculation required when the API is executed, the number of actuators to be operated, the number of sensors to be used, the number of systems or ECUs to be operated, the output power of the battery, and the amount of communication required by the operation API.

[0141] The charge for vehicle load is based on the amount paid by the user US in advance or afterwards for the vehicle's resources.

[0142] For example, if the vehicle is a rental car, the user US does not pay the purchase price of the vehicle itself (i.e., the user US does not purchase the resources), so the fee charged to the user based on the vehicle load will be a payment burden with a relatively high proportion borne by the user.

[0143] On the other hand, if the vehicle is a privately owned vehicle, the vehicle purchase cost must be taken into account. In other words, since the user US pays the purchase price of the vehicle itself, the fee charged to the user based on the vehicle load is a relatively low user-burdened fee. For example, a single CPU can be divided into an area where the user US bears the resource burden and an area where the OEM bears the resource burden, and the fee incurred by transferring only the vehicle load area where the OEM bears the resource burden (for example, the fee incurred by temporarily transferring the data collection area used by the OEM) is the user's burden. The OEM is the vehicle manufacturer that produced the vehicle. OEM stands for Original Equipment Manufacturer.

[0144] Next, a specific example in which the access control method determination unit 72 determines the access control method will be described.

[0145] As shown in FIG. 8, the access control method determination unit 72 acquires, from the usage fee management unit 71, first API expected amount information FA1 and second API expected amount information FA2 generated by the usage fee management unit 71.

[0146] The first API estimated amount information FA1 indicates the estimated amount of the first API usage fee for each minute from 12:00. The first API usage fee is the fee per use of the first API.

[0147] The second API estimated amount information FA2 indicates the estimated amount of the second API usage fee for each minute from 12:00. The second API usage fee is the fee per use of the second API.

[0148] In the first API estimated amount information FA1 and the second API estimated amount information FA2, the API usage fee at the current time 12:00 is 5 yen / number of times, the estimated API usage fee at 12:01 is 6 yen / number of times, the estimated API usage fee from 12:02 to 12:30 is 1 to 10 yen / number of times, the estimated API usage fee at 12:30 is 10 yen / number of times, the estimated API usage fee from 12:30 to 13:00 is 10 to 15 yen / number of times, the estimated API usage fee at 13:00 is 10 yen / number of times, the estimated API usage fee from 13:00 to 13:30 is 3 to 7 yen / number of times, and the estimated API usage fee at 13:30 is 5 yen / number of times.

[0149] In the first API estimated amount information FA1, the estimated API usage fee is 10 yen / time or more from 12:30 to 13:00 because of a large communication load. In the second API estimated amount information FA2, the estimated API usage fee is 10 yen / time or more from 12:30 to 13:00 because of a large CPU load.

[0150] Therefore, the access control method determination unit 72 permits use of the first API from 12:00 to 12:30 and from 13:00, prohibits use from 12:30 to 13:00, and permits time-shift use from 13:00. The access control method determination unit 72 also permits use of the second API from 12:00 to 12:30 and from 13:00, and prohibits use from 12:30 to 13:00.

[0151] As shown in FIG. 9, the access control method determination unit 72 acquires from the usage fee management unit 71 the third API expected amount information FA3 generated by the usage fee management unit 71 .

[0152] The third API estimated fee information FA3 indicates the estimated third API usage fee for each minute from 12:00. The third API usage fee is the fee per use of the third API.

[0153] The third API estimated amount information FA3 indicates the estimated amount of the third API usage fee for both the case where the illumination is turned on at maximum brightness and the case where the illumination is turned on at a lower brightness.

[0154] When the illumination is turned on at maximum brightness, the third API estimated amount information FA3 indicates that the API usage fee at the current time of 12:00 is 5 yen / time, the estimated API usage fee at 12:01 is 6 yen / time, the estimated API usage fee from 12:02 to 12:30 is 1 to 10 yen / time, the estimated API usage fee at 12:30 is 10 yen / time, the estimated API usage fee from 12:30 to 13:00 is 10 to 15 yen / time, the estimated API usage fee at 13:00 is 10 yen / time, the estimated API usage fee from 13:00 to 13:30 is 3 to 7 yen / time, and the estimated API usage fee at 13:30 is 5 yen / time. In the third API estimated amount information FA3, the estimated API usage fee amount from 12:30 to 13:00 is 10 yen / number of times or more because the battery load is large.

[0155] When the illumination is turned on at a dim brightness, the third API estimated amount information FA3 shows that the API usage fee at the current time of 12:00 is 2 yen / time, the estimated API usage fee at 12:01 is 3 yen / time, the estimated API usage fee from 12:02 to 12:30 is 1 to 7 yen / time, the estimated API usage fee at 12:30 is 7 yen / time, the estimated API usage fee from 12:30 to 13:00 is 9 yen / time, the estimated API usage fee at 13:00 is 7 yen / time, the estimated API usage fee from 13:00 to 13:30 is 1 to 5 yen / time, and the estimated API usage fee at 13:30 is 3 yen / time.

[0156] Therefore, for the third API, the access control method determination unit 72 permits use with maximum brightness from 12:00 to 12:30 and from 13:00 onwards, prohibits use with maximum brightness from 12:30 to 13:00 and permits use with dimmed brightness.

[0157] Next, a specific example of the processing executed by the access permission determining unit 74 and the access control executing unit 75 will be described.

[0158] As shown in Figure 10, the accessibility determination unit 74 determines whether the API corresponding to the API access request can be used based on future predicted availability information from the status recognition system 52, the vehicle equipment output management system 53, and the vehicle energy management system 54, the access method control instruction from the access control method determination unit 72, and whether forced use is possible from the user setting unit 73, and also determines the above-mentioned access execution method.

[0159] Specifically, as indicated by arrow L51, the state recognition system 52 notifies the accessibility determination unit 74 of, for example, future predicted availability information indicating a future prediction of available CPU usage.

[0160] The vehicle equipment output management system 53 notifies the accessibility determination unit 74 of, for example, future predicted availability information indicating a future prediction of the amount of available communication data, as indicated by an arrow L52.

[0161] As indicated by arrow L53, the vehicle energy management system 54 notifies the accessibility determination unit 74 of, for example, future predicted availability information indicating a future prediction of available battery usage.

[0162] As indicated by arrow L54, the access control method determination unit 72 determines an access control method based on the API usage conditions set by the servicer SV, and instructs the access permission determination unit 74 on the determined access control method.

[0163] The user setting unit 73 indicates the forced availability set by the user US to the accessibility determination unit 74 as indicated by an arrow L55.

[0164] The service application SA transmits API access requests for the first API, the second API, and the third API to the access permission determining unit 74, as indicated by an arrow L56.

[0165] When the accessibility determination unit 74 receives an API access request from the service app SA, it determines whether the API access request is accessible based on the access control method instructed by the access control method determination unit 72, whether forced use is permitted or not instructed by the user setting unit 73, and future predicted availability information notified by the status recognition system 52, the vehicle equipment output management system 53, and the vehicle energy management system 54, and also creates future prediction information regarding the accessibility of the API access request.

[0166] The accessibility determination unit 74 will allow use of the API, for example, if the estimated API usage fee does not exceed the setting of the "price range [yen / time]" for a period of time equal to or longer than the period set in the "estimated range duration [minutes]" and the CPU usage resulting from executing the API is within the available range.

[0167] For example, even if the estimated API usage fee exceeds the set "price range [yen / time]", the accessibility determination unit 74 allows use of the API if forced use is permitted and the CPU usage resulting from executing the API is within the available range.

[0168] The accessibility determination unit 74 notifies the service app SA of the accessibility determination result for the received API access request and future forecast information, as indicated by arrow L57. The future forecast information may be, for example, "API use will be disabled due to access control in X minutes," "API use will be enabled in Y minutes," or "Vehicle load will decrease in Z minutes, resulting in a reduction in API charges."

[0169] As indicated by arrow L58, when the access permission determination unit 74 permits the use of the first API, it transmits an API access request for the first API and an instruction on how to execute the first API to the access control execution unit 75. The execution method for the first API is, for example, "reserve API use by time shifting at 1:00 PM."

[0170] As indicated by arrow L59, when the access permission determination unit 74 permits use of the second API, it transmits an API access request for the second API and an instruction on how to execute the second API to the access control execution unit 75. The execution method for the second API is, for example, "If the billing amount exceeds the upper limit, the service will continue as normal with the user US bearing the billing cost."

[0171] As indicated by arrow L60, when the access permission determination unit 74 permits use of the third API, it transmits an API access request for the third API and an API execution method instruction for the third API to the access control execution unit 75. The execution method for the third API is, for example, "execute with maximum brightness as a rule, and with a lower brightness depending on the situation."

[0172] As indicated by arrow L61, for example, at 1 PM, the access control execution unit 75 transfers an API access request for the first API to the control system function block group 35. As a result, for example, at 1 PM, a process for transmitting a driving operation report to the cloud is executed. The dashed arrow L61 indicates that the API access request is not transferred until 1 PM.

[0173] As indicated by arrow L62, the access control execution unit 75 transfers the API access request for the second API to the control system functional block group 35. As a result, for example, the vehicle equipment output management system 53 executes a process that enables game operation in the rear seat of the vehicle using multimedia.

[0174] As indicated by arrow L63, the access control execution unit 75 transfers the API access request for the third API to the control system functional block group 35. As a result, for example, the vehicle equipment output management system 53 executes a process of turning on the illumination at maximum brightness in the rear seats of the vehicle.

[0175] Next, a specific example of the processing executed by the access control execution unit 75, the access log management unit 76, and the charge calculation unit 62 will be described.

[0176] As shown in FIG. 11, the access control execution unit 75 acquires an API execution method instruction from the access permission determination unit 74, and transfers an API access request based on the API execution method instruction.

[0177] Specifically, the access control execution unit 75 acquires an API execution method instruction in which the execution method for the first API is set to "reserve API use by time shifting at 1:00 PM," as indicated by arrow L71.

[0178] The access control execution unit 75 acquires an API execution method instruction for the second API, as shown by arrow L72, in which the execution method is set as "if the charge amount exceeds the upper limit, the charge will basically continue with the user US bearing the cost."

[0179] As indicated by arrow L73, at 1 PM, the access control execution unit 75 transfers the API access request of the first API to the control system function block group 35. The dashed arrow L73 indicates that the API access request of the first API is not transferred until 1 PM.

[0180] As indicated by arrow L74, the access control execution unit 75 transfers the API access request of the second API to the control system functional block group 35 immediately after receiving the API access request of the second API.

[0181] As indicated by arrow L75, the access control execution unit 75 creates an access log indicating the results of executing the processes corresponding to the first and second APIs, and notifies the created access log to the access log management unit 76. If the second API is executed at the user US's expense, the access control execution unit 75 adds information indicating this to the access log.

[0182] The access log management unit 76 transmits the access log obtained from the access control execution unit 75 to the charge amount calculation unit 62 .

[0183] The charge amount calculation unit 62 calculates the API usage fee incurred when the service app SA uses the first and second APIs and the API usage fee charged to the user US based on the access log obtained from the access log management unit 76 and the current API usage fee.

[0184] Next, as shown in FIG. 12, a procedure in which the servicer SV sets the API usage conditions and a procedure in which the user US sets whether or not the API can be forcibly used will be described.

[0185] As shown in process P1, the servicer SV accesses the app store 14 using the servicer terminal device 9 and sets API usage conditions, and the app store 14 notifies the access control method determination unit 72 of the set API usage conditions.

[0186] As shown in process P2, when the access control method determination unit 72 acquires the API usage conditions, it notifies the servicer terminal device 9 via the app store 14 of a reception result indicating that the API usage conditions have been received.

[0187] As shown in process P3, the user setting unit 73 sets whether or not to permit forced use of the API by the service application SA based on an input operation by the user US via the input device mounted on the vehicle.

[0188] Then, as shown in process P4, the user setting unit 73 notifies the user US of the acceptance result indicating that the set forced use permission / non-permission has been accepted, for example, by displaying it on the display screen of the navigation device.

[0189] Next, the procedure for determining whether or not access is permitted will be described as shown in FIG.

[0190] As shown in process P11, the usage fee management unit 71 notifies the access control method determination unit 72 of the current API usage fee and the future estimated amount of API usage fee calculated by the usage fee management unit 71, as well as the future estimated amount of vehicle API usage fee obtained from the app store 14.

[0191] As shown in process P12, the access control method determination unit 72 determines the access control method based on the above information acquired from the usage fee management unit 71 and the API usage conditions acquired from the app store 14.

[0192] The access control method determination unit 72 instructs the access permission determination unit 74 on the determined access control method, as shown in process P13.

[0193] The user setting unit 73 notifies the access permission determination unit 74 of the forced use permission that has been set, as shown in process P14.

[0194] The state recognition system 52, the vehicle equipment output management system 53, and the vehicle energy management system 54 each notify the accessibility determination unit 74 of future predicted availability information, as shown in process P15.

[0195] The service application SA transmits an API access request to the access permission determination unit 74 as shown in process P16.

[0196] The access permission determination unit 74 determines whether or not to permit access to the received API access request, and if it permits use of the API, it transmits the API access request and an API execution method instruction to the access control execution unit 75, as shown in process P17.

[0197] As shown in processes P18, P19, and P20, the accessibility determination unit 74 notifies the user US, servicer SV, and service application SA of the accessibility determination result for the API access request and future forecast information.

[0198] As shown in process P21, the access control execution unit 75 transfers the API access request based on the API execution method instruction.

[0199] As shown in process P22, the access control execution unit 75 creates an access log indicating the execution result of the API corresponding to the API access request, and notifies the access log management unit 76 of the created access log.

[0200] The access log management unit 76 transmits the access log acquired from the access control execution unit 75 to the charge amount calculation unit 62 as shown in process P23.

[0201] As shown in process P24, the charge calculation unit 62 calculates the API usage fee charged to the user US and notifies the calculated charge amount to the user US.

[0202] As shown in process P25, the charge calculation unit 62 calculates the API usage fee incurred when the service application SA uses the API, and notifies the calculated charge amount to the servicer SV.

[0203] Next, as shown in FIG. 14, a procedure for making the user US forcibly set whether or not to use the API when the user US has not yet set whether or not to use the API is described.

[0204] The sequence diagram of FIG. 14 differs from the sequence diagram of FIG. 13 in that processes P31 to P34 are executed instead of process P14.

[0205] That is, as shown in process P16, when the service app SA transmits an API access request to the access permission determination unit 74, the access permission determination unit 74 notifies the user US of a user setting confirmation as shown in process P31. The user setting confirmation is displayed, for example, on the display screen of the navigation device.

[0206] As shown in process P32, the user setting unit 73 sets whether or not to permit forced use of the API by the service application SA based on an input operation by the user US via the input device mounted on the vehicle.

[0207] Then, as shown in process P33, the user setting unit 73 notifies the user US of the acceptance result indicating that the set forced use permission / non-permission has been accepted, for example, by displaying it on the display screen of the navigation device.

[0208] Furthermore, the user setting unit 73 notifies the access permission determination unit 74 of the forced use permission that has been set, as shown in process P34.

[0209] Next, the access permission determination unit 74 determines whether or not to permit access to the received API access request, and if it permits use of the API, instructs the access control execution unit 75 on how to execute the API, as shown in process P17.

[0210] The subsequent processing is the same as that in the sequence diagram of FIG.

[0211] The ECU 4 configured as above is mounted on a vehicle and connected to a plurality of in-vehicle devices 5 to 7 via an in-vehicle communication network 8 .

[0212] The ECU 4 includes an API gateway 40. The API gateway 40 is configured to realize cooperation between a service app SA configured to provide a service to the vehicle and a control system functional block group 35 configured to execute predetermined processing in the vehicle.

[0213] The control system functional block group 35 includes an API group 37. The API group 37 is configured to convert an API access request, which is expressed in a vehicle-independent format and transmitted from the service application SA, into a vehicle-dependent format.

[0214] The API gateway 40 is configured to transfer an API access request sent from the service application SA to the control system functional block group 35 .

[0215] The API gateway 40 includes an access control method determination unit 72 and an access permission determination unit 74 .

[0216] The access control method determination unit 72 is configured to determine an access control method for controlling the transfer of API access requests to the control system function block group 35 based on current API usage fee information, estimated API amount information, and API usage conditions set by a servicer SV that provides services to vehicles using a service app SA for using the API group 37.

[0217] The current API usage fee information indicates the API usage fee (hereinafter referred to as the current API usage fee) that will be incurred when the service app SA currently uses the API group 37. The estimated API amount information indicates the estimated amount (hereinafter referred to as the future estimated amount) of the API usage fee that will be incurred when the service app SA uses the API group 37 in the future.

[0218] The access permission determination unit 74 is configured to determine whether to permit an API access request based on the access control method determined by the access control method determination unit 72 and the request (i.e., future predicted availability information) of the vehicle control system 2 including multiple on-board devices 5 to 7 and an ECU 4.

[0219] The ECU 4 can allow the service app SA to use the API group 37 when the current API usage fee and the future estimated amount satisfy the API usage conditions set by the servicer SV. This allows the ECU 4 to prevent the service app SA from using the API group 37 when the current API usage fee and the future estimated amount are higher than expected by the servicer SV. This allows the ECU 4 to prevent fluctuations in fees incurred when the servicer SV uses the vehicle.

[0220] The API gateway 40 further includes a user setting unit 73. The user setting unit 73 is configured to set a forced usage permission setting indicating whether or not to permit forced usage of the API group 37 by the service app SA by charging the user US who uses the service app SA when the current API usage fee and the future estimated amount are equal to or greater than a preset upper limit (i.e., the setting of "price range [yen / time]"). The access permission determination unit 74 is further configured to determine whether or not to permit an API access request based on the forced usage permission setting. This allows the ECU 4 to allow the user US to use the service app SA without increasing the fee incurred by the servicer SV when using the vehicle.

[0221] The API gateway 40 further includes a usage fee management unit 71. The usage fee management unit 71 is configured to acquire current vehicle information, which is current information about the vehicle, and future vehicle information, which is future information about the vehicle, based on information transmitted from the multiple on-board devices 5 to 7, and calculate a predicted API usage fee (hereinafter referred to as the individual vehicle future predicted amount) based on the current vehicle information and future vehicle information. The current vehicle information includes the current vehicle information, current occupant information, current surrounding information, current equipment operation status information, and current vehicle energy status information. The future vehicle information includes the long-term vehicle operation plan, vehicle CPU load profile, vehicle equipment operation profile, and long-term energy plan. The accessibility determination unit 74 is configured to determine an access control method by using the individual vehicle future predicted amount information, which indicates the individual vehicle future predicted amount calculated by the usage fee management unit 71, as the API predicted amount information.

[0222] This allows the ECU 4 to determine the access control method based on information that can be obtained from the vehicle.

[0223] The API gateway 40 further includes an access log management unit 76. The access log management unit 76 is configured to create an access log indicating the execution status of API access requests and to transmit the created access log to a server 3 installed outside the vehicle and including a charge calculation unit 62 configured to calculate a charge based on the access log. This allows the ECU 4 to transmit an access log related to API access requests permitted by the access permission determination unit 74 to the server 3, thereby suppressing fluctuations in fees incurred when the servicer SV uses the vehicle.

[0224] When it is determined that the API access request is permitted, the access permission determination unit 74 is configured to set at least one of the timing of executing the process corresponding to the access request and the control amount of the control object to be controlled in order to execute the process corresponding to the API access request. The timing setting in this embodiment is the time shift setting described above. The control amount of the control object in this embodiment is the brightness of the illumination.

[0225] The above-mentioned API usage conditions include a "price range [yen / trip]" and an "estimated range duration [minutes]." This allows the ECU 4 to suppress the use of the API group 37 by the service app SA during times when API usage fees fluctuate greatly, thereby further suppressing fluctuations in fees incurred when the servicer SV uses a vehicle.

[0226] The user setting unit 73 is configured to exclude service applications that use the API group 37 that use only resources for which the user US has already paid a fee from the forced use setting. This allows the ECU 4 to prevent the user US from having to pay an additional fee due to forced use even though the user US has already paid a fee.

[0227] The accessibility determination unit 74 is configured to notify at least one of the service app SA, the servicer SV, and the user US who uses the service app SA of future forecast information indicating at least one of a predicted fluctuation in the billing amount due to API access requests and a predicted usage status of the API access requests, based on the API forecast amount information and the API usage conditions. This allows the ECU 4 to encourage the service app SA, the servicer SV, and the user US to promote or suppress the use of the API group 37.

[0228] The access log management unit 76 is configured to create an access log indicating that an API access request is executed by forced use and transmit the access log to the server 3. This enables the ECU 4 to cause the server 3 to appropriately calculate the amount of money charged to the user US due to the forced use.

[0229] The charge amount calculation unit 62 is configured to vary the charge amount depending on whether the vehicle is a rental car or a private car, thereby allowing the app store 14 to appropriately charge the user US depending on the amount the user US pays in advance or after the fact for the vehicle's resources.

[0230] The accessibility determination unit 74 is configured to notify the user US of a user setting confirmation for confirming the forced use setting when the forced use setting is not set for the service app SA that has transmitted the API access request. This allows the ECU 4 to prevent the forced use setting from being used appropriately because the forced use setting is not set.

[0231] In the embodiment described above, ECU 4 corresponds to an in-vehicle device, ECU 5, ECU 6 and external communication device 7 correspond to multiple electronic control devices, in-vehicle communication network 8 corresponds to an in-vehicle network, control system function block group 35 corresponds to a function block, API gateway 40 corresponds to a collaboration control unit, and API group 37 corresponds to a function interface.

[0232] Furthermore, current API usage fee information corresponds to current interface usage fee information, predicted API amount information corresponds to future predicted amount information, and API usage conditions correspond to interface usage conditions.

[0233] Although one embodiment of the present disclosure has been described above, the present disclosure is not limited to the above embodiment and can be implemented in various modifications.

[0234] [Variation 1] In the above embodiment, the access control method determination unit 72 determines the access control method by using individual vehicle future forecast amount information as API forecast amount information. However, the server 3, which is configured to be able to communicate data with the vehicle control system 2, includes an API usage fee calculation unit 61 configured to calculate a future forecast amount of the vehicle API usage fee (hereinafter, the external future forecast amount) based on the individual vehicle future forecast amount information indicating the individual vehicle future forecast amount and future information regarding other systems. Note that the future information regarding other systems corresponds to future external system information. Therefore, the access control method determination unit 72 may be configured to acquire external future forecast amount information indicating the external future forecast amount from the server 3 and use the acquired external future forecast amount information as the above-mentioned API forecast amount information to determine the access control method. This allows the ECU 4 to determine the access control method by further using future information regarding other systems, thereby further suppressing fluctuations in fees incurred by the servicer SV when using the vehicle.

[0235] [Variation 2] In the above embodiment, an API usage fee is incurred when the service app SA transmits an API access request to the control system function block group 35 via the API gateway 40. However, an API usage fee may also be incurred when the service app SA transmits an API access request to the data system function block group 36 via the API gateway 40. For example, the service app SA may transmit an API access request requesting data reading or the like to the data system function block group 36.

[0236] The ECU 4 and the methods described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to execute one or more functions embodied in a computer program. Alternatively, the ECU 4 and the methods described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the ECU 4 and the methods described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to execute one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible recording medium. The methods for implementing the functions of each unit included in the ECU 4 do not necessarily need to include software; all of the functions may be implemented using one or more hardware components.

[0237] In the above embodiments, multiple functions of one component may be realized by multiple components, or one function of one component may be realized by multiple components. Furthermore, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Furthermore, part of the configuration of the above embodiments may be omitted. Furthermore, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0238] In addition to the ECU 4 described above, the present disclosure can also be realized in various forms, such as a system including the ECU 4 as a component, a program for causing a computer to function as the ECU 4, a non-transient physical recording medium such as a semiconductor memory on which the program is recorded, a service providing method, etc. [Technical Idea Disclosed in this Specification] [Item 1] An on-board device (4) mounted on a vehicle and connected to a plurality of electronic control units (5 to 7) via an on-board network (8), comprising: a cooperation control unit (40) configured to realize cooperation between a service application (SA) configured to provide a service to the vehicle and a function block (35) configured to execute predetermined processing in the vehicle, the function block comprising: a function interface (37) configured to convert an access request transmitted from the service application in a vehicle-independent format into a vehicle-dependent format, the cooperation control unit being configured to transfer the access request transmitted from the service application to the function block, an access control method determination unit (72) configured to determine an access control method for controlling the transfer of the access request to the functional block based on current interface usage fee information indicating a current interface usage fee, which is an interface usage fee that will be incurred when the service application currently uses the functional interface, future forecast amount information indicating a future forecast amount, which is a forecast amount of the interface usage fee that will be incurred when the service application uses the functional interface in the future, and interface usage conditions set for using the functional interface by a servicer (SV) that provides the service to the vehicle using the service application; and an access permission determination unit (74) configured to determine whether to permit the access request based on the access control method determined by the access control method determination unit and a request from a vehicle control system (2) that includes a plurality of the electronic control units and the in-vehicle device.

[0239] [Item 2] The in-vehicle device according to Item 1, wherein the cooperation control unit further includes a user setting unit (73) configured to set whether or not to permit forced use of the functional interface by the service application by charging a user (US) who uses the service application when the current interface usage fee or the future forecasted amount is equal to or greater than a preset upper limit, and the access permission determination unit is further configured to determine whether or not to permit the access request based on the whether or not to permit forced use.

[0240] [Item 3] An in-vehicle device according to item 1 or 2, wherein the cooperation control unit further comprises a usage fee management unit (71) configured to acquire current vehicle information, which is current information about the vehicle, and future vehicle information, which is future information about the vehicle, based on information transmitted from a plurality of the electronic control units, and calculate a future forecast amount per individual vehicle, which is a forecast amount of the interface usage fee, based on the current vehicle information and the future vehicle information, and the access control method determination unit is configured to determine the access control method by using individual vehicle future forecast amount information, which indicates the individual vehicle future forecast amount calculated by the usage fee management unit, as the future forecast amount information.

[0241] [Item 4] An in-vehicle device according to any one of items 1 to 3, wherein the access control method determination unit is configured to: acquire external future forecast amount information indicating the external future forecast amount from a server (3) configured to be able to communicate data with the vehicle control system; and determine the access control method by using the acquired external future forecast amount information as the future forecast amount information; and

[0242] [Item 5] The in-vehicle device according to any one of Items 1 to 4, wherein the cooperation control unit creates an access log indicating the execution status of the access request, and further comprises an access log management unit (76) configured to transmit the created access log to a server (3) installed outside the vehicle, the server (3) comprising a charge amount calculation unit (62) configured to calculate a charge amount based on the access log.

[0243] [Item 6] The in-vehicle device according to any one of Items 1 to 5, wherein the access permission determination unit is configured to, when determining that the access request is permitted, set at least one of a timing for executing a process corresponding to the access request and a control amount of a control object to be controlled in order to execute the process corresponding to the access request.

[0244] [Item 7] An in-vehicle device according to any one of items 1 to 6, wherein the interface usage conditions include a price range, which is a range of the interface usage fee within which use of the functional interface is permitted, and an expected range duration, which is an expected duration during which the interface usage fee will remain within the price range.

[0245] [Item 8] The in-vehicle device according to Item 2, wherein the user setting unit is configured to exclude the service application that uses the functional interface that uses only resources for which the user has already paid a fee from the forced availability setting.

[0246] [Item 9] An in-vehicle device according to any one of items 1 to 8, wherein the accessibility determination unit is configured to notify at least one of the service application, the servicer, and a user (US) using the service application of future forecast information indicating at least one of a forecast of fluctuations in the billing amount due to the access request and a forecast of the usage status of the access request, based on the future forecast amount information and the interface usage conditions.

[0247] [Item 10] The in-vehicle device according to Item 2, wherein the cooperation control unit further comprises an access log management unit (76) configured to create an access log indicating the execution status of the access request, and to transmit the created access log to a server (3) installed outside the vehicle, the server (3) including a charge amount calculation unit (62) configured to calculate a charge amount based on the access log, and wherein the access log management unit is configured to, when a process corresponding to the access request is executed by the forced use, create the access log with a note to that effect and transmit the access log to the server.

[0248] [Item 11] The in-vehicle device according to Item 5, wherein the charge amount calculation unit is configured to vary the charge amount depending on whether the vehicle is a rental car or a private car.

[0249] [Item 12] The in-vehicle device according to Item 2, wherein the accessibility determination unit is configured to notify the user of a user setting confirmation to confirm the setting of the forced availability of use when the forced availability of use is not set for the service application that transmitted the access request.

[0250] [Item 13] A service providing system (1) comprising: a vehicle control system (2) equipped with a plurality of electronic control devices (4-7) mounted on a vehicle and connected to an in-vehicle network (8), the vehicle control system (2) comprising a cooperation control unit (40) configured to realize cooperation between a service application (SA) configured to provide a service to the vehicle and a function block (35) configured to execute predetermined processing in the vehicle; and a server (3) configured to be able to perform data communication with the vehicle control system, the function block comprising a function interface (37) configured to convert an access request expressed in a vehicle-independent format and transmitted from the service application into a vehicle-dependent format, and the cooperation control unit configured to transfer the access request transmitted from the service application to the function block, the cooperation control unit a service providing system comprising: an access control method determination unit (72) configured to determine an access control method for controlling the transfer of the access request to the functional block based on current interface usage fee information indicating a current interface usage fee, which is an interface usage fee that will be incurred when the service application currently uses the functional interface; future forecast amount information indicating a future forecast amount, which is a forecast amount of the interface usage fee that will be incurred when the service application uses the functional interface in the future; and interface usage conditions set for using the functional interface by a servicer (SV) that provides the service to the vehicle using the service application; and an access permission determination unit (74) configured to determine whether to permit the access request based on the access control method determined by the access control method determination unit and a request from the vehicle control system.

[0251] [Item 14] A service providing method executed by an on-board device (4) mounted on a vehicle and connected to a plurality of electronic control units (5 to 7) via an on-board network (8), wherein the on-board device comprises: a functional interface (37) configured to convert an access request transmitted from a service application (SA) configured to provide a service to the vehicle and expressed in a vehicle-independent format into a vehicle-dependent format; and a cooperation control unit (40) configured to realize cooperation between the service application (SA) and a functional block (35) equipped with the functional interface and configured to execute predetermined processing in the vehicle, and configured to transfer the access request transmitted from the service application to the functional block; The in-vehicle device determines an access control method for controlling the transfer of the access request to the functional block based on current interface usage fee information indicating a current interface usage fee, which is an interface usage fee incurred when the service application currently uses the functional interface, future forecast amount information indicating a future forecast amount, which is a forecast amount of the interface usage fee that will be incurred when the service application uses the functional interface in the future, and interface usage conditions set for using the functional interface by a servicer (SV) that provides the service to the vehicle using the service application, and the in-vehicle device determines whether to allow the access request based on the determined access control method and a request from a vehicle control system (2) that includes a plurality of the electronic control units and the in-vehicle device.

[0252] [Item 15] A computer of an on-board device (4) mounted on a vehicle and connected to a plurality of electronic control devices (5 to 7) via an on-board network (8) includes: a functional interface (37) configured to convert an access request transmitted from a service application (SA) configured to provide a service to the vehicle and expressed in a vehicle-independent format into a vehicle-dependent format; a cooperation control unit (40) configured to realize cooperation between the service application and a functional block (35) equipped with the functional interface and configured to execute predetermined processing in the vehicle, and configured to transfer the access request transmitted from the service application to the functional block; an access control method determination unit (72) configured to determine an access control method for controlling transfer of the access request to the functional block based on current interface usage fee information indicating a current interface usage fee that is an interface usage fee that will be incurred as a result of the service application currently using the functional interface, future forecast amount information indicating a future forecast amount that is an expected amount of the interface usage fee that will be incurred as a result of the service application using the functional interface in the future, and interface usage conditions set for using the functional interface by a servicer (SV) that provides the service to the vehicle using the service application; A service providing program for causing the program to function as an access permission determination unit (74) configured to determine whether to permit the access request based on the access control method determined by the access control method determination unit and a request from a vehicle control system (2) including a plurality of the electronic control units and the in-vehicle device.

Claims

1. An on-board device (4) mounted on a vehicle and connected to a plurality of electronic control devices (5-7) via an on-board network (8), comprising: a cooperation control unit (40) configured to realize cooperation between a service application (SA) configured to provide a service to the vehicle and a function block (35) configured to execute a predetermined process in the vehicle, the function block comprising: a functional interface (37) configured to convert an access request expressed in a vehicle-independent format and transmitted from the service application into a vehicle-dependent format, the cooperation control unit being configured to transfer the access request transmitted from the service application to the function block, the cooperation control unit being configured to: an access control method determination unit (72) configured to determine an access control method for controlling the transfer of the access request to the functional block, based on current interface usage fee information indicating a current interface usage fee, which is an interface usage fee incurred as a result of the service application currently using the functional interface, future forecast amount information indicating a future forecast amount, which is a forecast amount of the interface usage fee, which will be incurred as a result of the service application using the functional interface in the future, and interface usage conditions set for using the functional interface by a servicer (SV) that provides the service to the vehicle using the service application; and an access permission determination unit (74) configured to determine whether to permit the access request, based on the access control method determined by the access control method determination unit and a request from a vehicle control system (2) including a plurality of the electronic control units and the in-vehicle device.

2. An in-vehicle device as described in claim 1, wherein the coordination control unit further includes a user setting unit (73) configured to set whether or not to permit forced use of the functional interface by the service application by charging a user (US) who uses the service application when the current interface usage fee or the future predicted amount is equal to or greater than a predetermined upper limit value, and the access permission determination unit is further configured to determine whether or not to permit the access request based on the forced use permission.

3. An in-vehicle device as described in claim 1 or claim 2, wherein the coordination control unit further comprises a usage fee management unit (71) configured to acquire current vehicle information, which is current information regarding the vehicle, and future vehicle information, which is future information regarding the vehicle, based on information transmitted from a plurality of the electronic control units, and calculate an individual vehicle future forecast amount, which is a forecast amount of the interface usage fee, based on the current vehicle information and the future vehicle information, and the access control method determination unit is configured to determine the access control method by using individual vehicle future forecast amount information indicating the individual vehicle future forecast amount calculated by the usage fee management unit as the future forecast amount information.

4. An in-vehicle device as described in claim 1 or 2, wherein the access control method determination unit is configured to obtain external future forecast amount information indicating the external future forecast amount from a server (3) configured to be capable of data communication with the vehicle control system, and to determine the access control method by using the obtained external future forecast amount information as the future forecast amount information, and the access control method determination unit is configured to determine the access control method by using the obtained external future forecast amount information as the future forecast amount information, and the access control method determination unit is configured to determine the access control method by using the obtained external future forecast amount information as the future forecast amount information, and the access control method determination unit is configured to determine the access control method by using the obtained external future forecast amount information as the future forecast amount information, and the access control method determination unit is configured to determine the access control method by using the obtained external future forecast amount information as the future forecast amount information, and the access control method determination unit is configured to determine the access control method by using the obtained external future forecast amount information as the future forecast amount information, and 5. An in-vehicle device as described in claim 1 or claim 2, wherein the coordination control unit creates an access log indicating the execution status of the access request, and further comprises an access log management unit (76) configured to transmit the created access log to a server (3) installed outside the vehicle and comprising a charge calculation unit (62) configured to calculate a charge based on the access log.

6. An in-vehicle device as described in claim 1 or claim 2, wherein the access permission determination unit is configured to set at least one of the timing of executing processing corresponding to the access request and the amount of control of a control object to be controlled in order to execute the processing corresponding to the access request when it is determined that the access request is permitted.

7. An in-vehicle device as described in claim 1 or 2, wherein the interface usage conditions include a price range, which is the range of the interface usage fee within which use of the functional interface is permitted, and a predicted range duration, which is the predicted time during which the interface usage fee will remain within the price range.

8. An in-vehicle device as described in claim 2, wherein the user setting unit is configured to exclude the service application that uses the functional interface that uses only resources for which the user has already paid a fee from the forced availability setting.

9. An in-vehicle device as described in claim 1 or claim 2, wherein the accessibility determination unit is configured to notify at least one of the service application, the servicer, and a user (US) using the service application of future forecast information indicating at least one of a predicted fluctuation in the billing amount due to the access request and a predicted usage status of the access request based on the future forecast amount information and the interface usage conditions.

10. An in-vehicle device as described in claim 2, wherein the coordination control unit further comprises an access log management unit (76) configured to create an access log indicating the execution status of the access request, and to transmit the created access log to a server (3) installed outside the vehicle and having a charge calculation unit (62) configured to calculate a charge based on the access log, and the access log management unit is configured to create the access log with a note to that effect when a process corresponding to the access request is executed by the forced use, and to transmit the access log to the server.

11. An in-vehicle device according to claim 5, wherein the charge amount calculation unit is configured to vary the charge amount depending on whether the vehicle is a rental car or a private car.

12. An in-vehicle device as described in claim 2, wherein the accessibility determination unit is configured to notify the user of a user setting confirmation to confirm the setting of the forced availability for the service application that sent the access request when the forced availability for the service application is not set.

13. A service providing system (1) comprising: a vehicle control system (2) equipped with a plurality of electronic control devices (4-7) mounted on a vehicle and connected to an in-vehicle network (8), the vehicle control system (2) comprising a service application (SA) configured to provide a service to the vehicle, and a cooperation control unit (40) configured to realize cooperation between a function block (35) configured to execute predetermined processing in the vehicle, and a server (3) configured to be able to perform data communication with the vehicle control system, the function block comprising: a functional interface (37) configured to convert an access request expressed in a vehicle-independent format and transmitted from the service application into a vehicle-dependent format, and the cooperation control unit configured to transfer the access request transmitted from the service application to the function block, the cooperation control unit comprising: a service providing system comprising: an access control method determination unit (72) configured to determine an access control method for controlling the transfer of the access request to the functional block, based on current interface usage fee information indicating a current interface usage fee, which is an interface usage fee incurred as a result of the service application currently using the functional interface, future forecast amount information indicating a future forecast amount, which is a forecast amount of the interface usage fee, which will be incurred as a result of the service application using the functional interface in the future, and interface usage conditions set for using the functional interface by a servicer (SV) that provides the service to the vehicle using the service application; and an access permission determination unit (74) configured to determine whether to permit the access request, based on the access control method determined by the access control method determination unit and a request from the vehicle control system.

14. A service providing method executed by an on-board device (4) mounted on a vehicle and connected to a plurality of electronic control devices (5 to 7) via an on-board network (8), the on-board device comprising: a functional interface (37) configured to convert an access request transmitted from a service application (SA) configured to provide a service to the vehicle and expressed in a vehicle-independent format into a vehicle-dependent format; and a cooperation control unit (40) configured to realize cooperation between the service application (SA) and a functional block (35) equipped with the functional interface and configured to execute a predetermined process in the vehicle, and configured to transfer the access request transmitted from the service application to the functional block; The in-vehicle device determines an access control method for controlling the transfer of the access request to the functional block based on current interface usage fee information indicating a current interface usage fee, which is an interface usage fee incurred as a result of the service application currently using the functional interface, future forecast amount information indicating a future forecast amount, which is a forecast amount of the interface usage fee that will be incurred as a result of the service application using the functional interface in the future, and interface usage conditions set for using the functional interface by a servicer (SV) that provides the service to the vehicle using the service application, and the in-vehicle device determines whether to permit the access request based on the determined access control method and a request from a vehicle control system (2) that includes a plurality of the electronic control units and the in-vehicle device.

15. A computer of an on-board device (4) mounted on a vehicle and connected to a plurality of electronic control devices (5 to 7) via an on-board network (8), comprising: a functional interface (37) configured to convert an access request transmitted from a service application (SA) configured to provide a service to the vehicle and expressed in a vehicle-independent format into a vehicle-dependent format; a cooperation control unit (40) configured to realize cooperation between the service application and a functional block (35) equipped with the functional interface and configured to execute a predetermined process in the vehicle, and configured to transfer the access request transmitted from the service application to the functional block; an access control method determination unit (72) configured to determine an access control method for controlling transfer of the access request to the functional block based on current interface usage fee information indicating a current interface usage fee, which is an interface usage fee generated as a result of the service application using the functional interface at the present time, future forecast amount information indicating a future forecast amount, which is a forecast amount of the interface usage fee generated in the future as a result of the service application using the functional interface, and interface usage conditions set for using the functional interface by a servicer (SV) that provides the service to the vehicle using the service application; A service providing program for causing the device to function as an access permission determination unit (74) configured to determine whether or not to permit the access request based on the access control method determined by the access control method determination unit and a request from a vehicle control system (2) including a plurality of the electronic control units and the in-vehicle device.