On-vehicle relay device, program, and information processing method

Abstract

An on-vehicle relay device is connected to an on-vehicle network mounted on a vehicle. The on-vehicle relay device includes: a plurality of communication units for communicating with a plurality of on-vehicle ECUs mounted on the vehicle; a processing unit for performing processing related to relay of communication between the plurality of on-vehicle ECUs; a switching unit that is communicably connected to the processing unit and relays on the basis of a hierarchical protocol more on the lower side than relay processing by the processing unit; and an external connection port to which an external device outside the vehicle is connected. The external connection port is communicably connected to the processing unit, and external data inputted from the external connection port is outputted to the switching unit via the processing unit.

Description

Vehicle-mounted relay device, program, and information processing method

[0001] This application claims priority to Japanese Patent Application No. 2024-016555, filed February 6, 2024, and incorporates by reference all of the contents of that application.

[0002] An electronic control device that is mounted on a vehicle and includes multiple microcomputers (mc) and can detect abnormalities in a communication bus has been disclosed (for example, Patent Document 1). The electronic control device in Patent Document 1 is one of multiple nodes connected to the communication bus, and includes a first microcomputer and a second microcomputer that receive transmission signals flowing on the communication bus and send transmission signals to the communication bus, and is configured so that the transmission signals to be sent to the communication bus are sent to each microcomputer without passing through the communication bus, and each microcomputer receives the transmission signals.

[0003] Japanese Patent Application Laid-Open No. 2016-126716

[0004] An in-vehicle relay device according to one embodiment of the present disclosure is an in-vehicle relay device connected to an in-vehicle network mounted on a vehicle, and comprises a plurality of communication units for communicating with a plurality of in-vehicle ECUs (Electronic Control Units) mounted on the vehicle, a processing unit that performs processing related to relaying communications between the plurality of in-vehicle ECUs, a switching unit that is communicatively connected to the processing unit and relays based on a hierarchical protocol lower than the relay processing by the processing unit, and an external connection port to which an external device outside the vehicle is connected, wherein the external connection port is communicatively connected to the processing unit, and external data input from the external connection port is output to the switching unit via the processing unit.

[0005] 1 is a schematic diagram illustrating the configuration of an in-vehicle system including an in-vehicle relay device according to embodiment 1. FIG. 2 is a block diagram illustrating the configuration of an in-vehicle relay device. FIG. 3 is an explanatory diagram illustrating a communication form according to a hierarchical protocol in a processing unit, etc.. FIG. 4 is a flowchart illustrating the processing of a processing unit of an in-vehicle relay device. FIG. 5 is a block diagram illustrating the configuration of an in-vehicle relay device according to embodiment 2 (multilayer separation).

[0006] [Problems to be Solved by the Present Disclosure] In the electronic control device of Patent Document 1, no consideration is given to the appropriate provision of an external connection port to which an external device is connected.

[0007] The present disclosure aims to provide an in-vehicle relay device or the like that can be suitably provided with an external connection port to which an external device is connected.

[0008] Effect of the Present Disclosure According to one aspect of the present disclosure, it is possible to provide an in-vehicle relay device or the like that is preferably provided with an external connection port to which an external device is connected.

[0009] [Description of Embodiments of the Present Disclosure] First, embodiments of the present disclosure will be listed and described. In addition, at least some of the embodiments described below may be combined in any manner.

[0010] (1) An in-vehicle relay device according to one aspect of the present disclosure is an in-vehicle relay device connected to an in-vehicle network mounted on a vehicle, and includes a plurality of communication units for communicating with a plurality of in-vehicle ECUs mounted on the vehicle, a processing unit that performs processing related to relaying communications between the plurality of in-vehicle ECUs, a switching unit that is communicatively connected to the processing unit and relays based on a hierarchical protocol that is lower than the relay processing by the processing unit, and an external connection port to which an external device outside the vehicle is connected, the external connection port being communicatively connected to the processing unit, and external data input from the external connection port being output to the switching unit via the processing unit.

[0011] In this aspect, the in-vehicle relay device relays communication data (IP packets) transmitted and received between multiple in-vehicle ECUs connected to an in-vehicle network. The in-vehicle network is configured with communication lines using, for example, Ethernet (registered trademark), and in this case, the communication protocol used for communication between the in-vehicle ECUs is TCP / IP. The in-vehicle relay device includes, as functional units for relaying, a processing unit for performing relaying at an upper layer of the communication protocol and a switching unit for performing relaying at a lower layer than the processing unit. The processing unit may be configured, for example, by a microcomputer including a storage unit such as ROM or RAM, and may function as a software processing unit that performs relaying at the upper layer (upper layer side control) through software processing by the microcomputer. The switching unit may be configured, for example, by an integrated circuit (IC), an application-specific integrated circuit (ASIC), or a field-programmable gate array (FPGA), and may function as a hardware processing unit that performs relaying at the lower layer (lower layer side control) through hardware processing by the switching unit. The in-vehicle relay device has an external connection port to which an external device outside the vehicle, such as a diagnostic device or a terminal device such as a smartphone, is connected. The external device connected to the external connection port is not limited to a device physically installed outside the vehicle body, but may also include a device temporarily or permanently installed in the vehicle as a so-called retrofit device. Alternatively, if the external connection port has a wireless communication function, the external device may be, for example, an external server connected to the Internet. The external connection port is, for example, a port (DLC port) compatible with a DLC (Data Link Connector), and the external connection port is directly connected to a microcomputer constituting the processing unit. If the microcomputer constituting the processing unit includes a communication unit such as an Ethernet PHY unit (physical layer transceiver) compatible with the physical layer of Ethernet, the external connection port and the processing unit may be communicatively connected by wiring the external connection port and the communication unit (Ethernet PHY unit).With this configuration, the external connection port and the switching unit are not directly connected, but are indirectly connected via the processing unit (microcomputer). That is, the external connection port and the processing unit (microcomputer) can be suitably connected, thereby allowing the in-vehicle relay device to suitably provide the external connection port. Therefore, external data output from an external device connected to the external connection port does not flow directly into the switching unit. Even if the relay process at a lower layer by the switching unit is assumed to be vulnerable to attacks from outside the vehicle, unauthorized external data (attack data) can be prevented from passing through the switching unit and flowing into the in-vehicle network.

[0012] (2) In one embodiment of the in-vehicle relay device of the present disclosure, the communication protocol used by the switching unit for relaying is TCP / IP (Transmission Control Protocol / Internet Protocol), and the switching unit includes two or more of the communication units and functions as a Layer 2 switch that relays IP packets flowing through the in-vehicle network based on the MAC address of the in-vehicle ECU connected to the communication unit.

[0013] In this aspect, the switching unit includes two or more communication units (Ethernet PHY units) and functions as a Layer 2 switch that relays communication data (IP packets) transmitted from each of the onboard ECUs connected to these communication units based on the destination MAC (Media Access Control) address contained in the communication data. The external connection port is not directly connected to the switching unit that functions as a Layer 2 switch, but is directly connected to a processing unit (microcomputer) that relays data in a layer higher than the switching unit. This prevents the Layer 2 (data link layer) of the external connection port from being identical to the Layer 2 (data link layer) of the switching unit. Therefore, even if there is a vulnerability in the Layer 2 (data link layer) of the switching unit, it is possible to prevent unauthorized external data (attack data) from the external connection port from passing through the switching unit and flowing to the onboard network.

[0014] (3) In an in-vehicle relay device according to one embodiment of the present disclosure, the communication protocol used by the processing unit for relaying is TCP / IP, and the processing unit functions as a Layer 3 switch that relays IP packets from the in-vehicle ECU acquired via the switching unit based on the IP address of the in-vehicle ECU.

[0015] In this aspect, the processing unit (microcomputer) functions as a Layer 3 switch that relays IP packets from the onboard ECU acquired via the switching unit based on the destination IP address included in the IP packet. Furthermore, the processing unit (microcomputer) may function as a Layer 4 switch that performs processing related to Quality of Service (QoS), ECU diagnostic communication protocols such as Unified Diagnostic Service (UDS), or security verification processing such as DoIP (Diagnostics over IP), based on the Transmission Control Protocol (TCP) port number or User Datagram Protocol (UDP) port number included in the IP packet. Because the external connection port is directly connected to the processing unit (microcomputer) configured in this manner, various processes corresponding to higher layers can be performed on external data output from an external device via the external connection port.

[0016] (4) In an in-vehicle relay device according to one aspect of the present disclosure, the processing unit determines whether the external data input from the external connection port is normal or abnormal, and if it determines that the external data is normal, it transmits the external data to the in-vehicle network via the switching unit, and if it determines that the external data is abnormal, it discards the external data without outputting it to the switching unit.

[0017] In this aspect, a processing unit configured with a microcomputer or the like executes a program (program product) stored in a storage unit of the microcomputer to perform security-related processing using, for example, DoIP (Diagnostics over IP) or an IDS (Intrusion Detection System), thereby determining whether external data input from the external connection port is valid (determining whether the data is normal or abnormal). For example, if the processing unit determines, using DoIP or the like, that a large amount of external data transmitted from an external device via the external connection port is a DoS attack or the like, the processing unit determines that the external data is abnormal and discards the external data determined to be abnormal without outputting it to the switching unit. For example, if the processing unit determines, using DoIP or the like, that the external data transmitted from the external device via the external connection port is normal, the processing unit transmits (outputs) the external data to the in-vehicle network via the switching unit, thereby relaying the external data. In this way, by directly connecting the external connection port to a processing unit (microcomputer) that supports security-related processing (e.g., DoIP) at a higher layer (layer 4 or higher), the processing unit can efficiently determine whether the external data output from the external device via the external connection port is valid. Therefore, compared to when the external connection port is directly connected to a switching unit that handles relay processing below layer 2, for example, a secure environment in the in-vehicle network can be ensured for external devices connected via the external connection port.

[0018] (5) In one aspect of the vehicle-mounted relay device of the present disclosure, the processing unit includes a first processing unit and a second processing unit communicatively connected to the first processing unit, the switching unit is connected to the second processing unit, the second processing unit performs processing related to setting changes of the switching unit, the external connection port is connected to the first processing unit, and the external data input from the external connection port is output to the switching unit via the first processing unit and the second processing unit.

[0019] In this aspect, the processing unit (microcomputer) includes a first processing unit (first microcomputer) and a second processing unit (second microcomputer). That is, the processing unit (microcomputer) is configured to be separated into multiple layers by the first processing unit (first microcomputer) and the second processing unit (second microcomputer). The first processing unit (first microcomputer) and the second processing unit (second microcomputer) are communicatively connected via, for example, SPI (Serial Peripheral Interface) or Ethernet (Ethernet PHY unit). An external connection port is connected to the first processing unit (first microcomputer), and a switching unit is connected to the second processing unit (second microcomputer). Therefore, in the direction of external data flow from an external device connected to the external connection port, if the external device is considered to be the most upstream device, the external data flows in the following order: external device, first processing unit (first microcomputer), second processing unit (second microcomputer), and switching unit. That is, the external device (external connection port), first processing unit (first microcomputer), second processing unit (second microcomputer), and switching unit are connected in series, with the switching unit being located furthest downstream. Furthermore, the second processing unit (second microcomputer) performs processing related to configuration changes of the switching unit and has the setting authority (SW-IC setting authority) for the switching unit. This setting authority (SW-IC setting authority) is the authority to update or change values ​​of various setting parameters or configuration sheets stored in memory or the like included in the switching unit. The second processing unit (second microcomputer) with this setting authority (SW-IC setting authority) changes setting parameters, etc. in the switching unit by, for example, outputting parameter update commands to a setting change port or API (Application Programming Interface) provided in the switching unit. With this connection configuration, the first processing unit receives and performs security processing on external data transmitted from an external device connected to the external connection port. In other words, the first processing unit can temporarily terminate communication with the external device (external connection port).Thereafter, the first processing unit communicates with the second processing unit, thereby reliably protecting the second processing unit that has the right to set the switching unit (SW-IC setting right). In other words, the first processing unit can function as a firewall against external devices connected to the external connection port, effectively defending against external attacks on the second processing unit and the switching unit.

[0020] (6) A program according to one aspect of the present disclosure is a program that causes a computer to execute processing, the program having a plurality of communication units for communicating with on-board ECUs connected to an on-board network, and performing processing related to relaying communications between the plurality of on-board ECUs, the computer being communicatively connected to a switching unit that relays based on a hierarchical protocol lower than the relay processing by the computer, and an external connection port to which an external device outside the vehicle is connected is connected, and when external data input from the external connection port is output to the switching unit, the program determines whether the external data input from the external connection port is normal or abnormal, and if it is determined that the external data is normal, it transmits the external data to the on-board network via the switching unit, and if it is determined that the external data is abnormal, it executes processing to discard the external data without outputting it to the switching unit.

[0021] In this aspect, it is possible to provide a program that causes a computer to function as an in-vehicle relay device that is preferably provided with an external connection port to which an external device is connected.

[0022] (7) An information processing method according to one aspect of the present disclosure is an information processing method that causes a computer to execute processing, the computer having a plurality of communication units for communicating with on-board ECUs connected to an on-board network, and performing processing related to relaying communications between the plurality of on-board ECUs, wherein the computer is communicatively connected to a switching unit that relays based on a hierarchical protocol lower than the relay processing by the computer, and an external connection port to which an external device outside the vehicle is connected is connected, and when external data input from the external connection port is output to the switching unit, the external data input from the external connection port is determined to be normal or abnormal, and if it is determined that the external data is normal, the external data is sent to the on-board network via the switching unit, and if it is determined that the external data is abnormal, the computer executes processing to discard the external data without outputting it to the switching unit.

[0023] In this aspect, it is possible to provide an information processing method that causes a computer to function as an in-vehicle relay device that is preferably provided with an external connection port to which an external device is connected.

[0024] [Details of the embodiment of the present disclosure] The present disclosure will be specifically described based on the drawings showing the embodiment. An in-vehicle relay device 1 according to the embodiment of the present disclosure will be described below with reference to the drawings. Note that the present invention is not limited to these examples, but is defined by the claims, and all modifications within the meaning and scope equivalent to the claims are intended to be included.

[0025] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. FIG. 1 is a schematic diagram illustrating the configuration of an in-vehicle system including an in-vehicle relay device 1 according to embodiment 1. FIG. 2 is a block diagram illustrating the configuration of the in-vehicle relay device 1. The in-vehicle system includes an in-vehicle relay device 1 and multiple in-vehicle ECUs 2 connected to an in-vehicle network 3. The in-vehicle relay device 1 has an external connection port 15, such as a DLC port, and is communicatively connected to an external device 4, such as a diagnostic device or a mobile terminal device such as a smartphone, connected to the external connection port 15 (DLC port). The connection between the external connection port 15 and the external device 4 is not limited to a wired connection. For example, if the external connection port 15 is configured as an external connection device with a wireless function, the in-vehicle relay device 1 is communicatively connected to an external server connected to an external network, such as the Internet, via the external connection port 15.

[0026] The vehicle C is equipped with an in-vehicle relay device 1 and a plurality of in-vehicle ECUs 2 for controlling various in-vehicle devices. The in-vehicle ECUs 2 and the in-vehicle relay device 1 are communicatively connected by a communication line 31 (Ethernet cable) compatible with a communication protocol such as Ethernet (registered trademark). The connection between the in-vehicle relay device 1 and the in-vehicle ECUs 2 is not limited to Ethernet, and may be by a CAN bus compatible with a communication protocol such as CAN (Control Area Network (registered trademark).

[0027] The external device 4, such as a diagnostic device, may correspond to a device that performs maintenance processing (maintenance processing) for the in-vehicle ECU 2, such as updating the program of the in-vehicle ECU 2. The maintenance processing is not limited to updating (reprogramming) the program of the in-vehicle ECU 2, but may also include, for example, diagnostic processing, initialization processing, restart processing, etc. for the in-vehicle ECU 2. Furthermore, the maintenance processing performed by these external devices 4 may be based on a diagnostic communication protocol defined in, for example, UDS (Unified Diagnostic Services).

[0028] The in-vehicle relay device 1 acquires, from the external device 4 (diagnosis device), an update program for the in-vehicle ECU 2 to be maintained, or acquires information related to maintenance processing such as a request signal for initialization processing to the in-vehicle ECU 2 to be maintained, and relays the acquired information related to maintenance processing such as the update program or the request signal for initialization processing to the in-vehicle ECU 2 to be maintained. The in-vehicle relay device 1 may also function as a reprogramming master that acquires, from the external device 4 (diagnosis device), a program for the in-vehicle ECU 2 connected to itself, outputs (transmits) the acquired program, etc. to the in-vehicle ECU 2 to be updated (reprogrammed), and performs program update processing (reprogramming processing) for the in-vehicle ECU 2.

[0029] The external device 4 (diagnostic device) is a device (diagnostic tool) used by vehicle C maintenance companies, including authorized dealers, who are responsible for maintaining the vehicle C, such as performing maintenance work on the vehicle relay device 1 or the vehicle ECU 2, and is, for example, a device in which a dedicated application is installed on a general-purpose information terminal such as a personal computer, tablet PC, or smartphone, or a device that includes hardware and is configured as a dedicated information terminal.

[0030] The external device 4 (diagnosis device) communicates with the vehicle-mounted relay device 1 via an external connection port 15 (DLC port). As will be described in detail later, the vehicle-mounted relay device 1 includes a processing unit 11 configured with a microcomputer or the like and a switching unit 14 configured with an IC or the like, and the external connection port 15 is directly connected to the processing unit 11 (microcomputer). Therefore, the external connection port 15 is indirectly connected to the switching unit 14 via the processing unit 11 (microcomputer).

[0031] The switching unit 14 performs relay processing in accordance with a hierarchical protocol in the L2 layer, and is connected to the in-vehicle ECU 2 via a communication line 31 such as Ethernet that constitutes the in-vehicle network 3. As described above, the external connection port 15 is not directly connected to the switching unit 14, but is indirectly connected via the processing unit 11 (microcomputer). Therefore, the L2 layer of the external connection port 15 and the L2 layer of the switching unit 14 can be made different from each other, and even if the L2 layer of the switching unit 14 has a vulnerability, it is possible to prevent external data from the external connection port 15 from slipping through the switching unit 14.

[0032] The in-vehicle relay device 1 includes a processing unit 11, a memory unit 12, multiple communication units 13, and a switching unit 14. The in-vehicle relay device 1 manages system segments formed by multiple communication lines 31, such as control system ECUs 2, safety system ECUs 2, and body system ECUs 2, and relays communications between the in-vehicle ECUs 2 between these segments. The in-vehicle relay device 1 may be, for example, an Ethernet switch having Layer 2 and Layer 3 switch functions, or may also function as a CAN gateway. The in-vehicle relay device 1 may be configured as, for example, a body ECU that controls the drive of body system actuators, or as one functional unit of an integrated ECU configured by a vehicle computer, etc. Alternatively, the in-vehicle relay device 1 may be a PLB (Power LAN Box) that, in addition to relaying communications, also functions as a power distribution device that distributes and relays power output from a power storage device and supplies it to the in-vehicle ECUs 2 connected to the in-vehicle relay device.

[0033] The processing unit 11 is configured with a CPU (Central Processing Unit), an MPU (Micro Processing Unit), etc. The processing unit 11 reads out and executes each program and data stored in advance in the storage unit 12, thereby performing various control processes, arithmetic processes, etc.

[0034] The storage unit 12 is configured with a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM), or a flash memory, and stores a program P (program product) and data to be referenced during processing in advance. The program P stored in the storage unit 12 may be a program P (program product) read from a recording medium M readable by the vehicle-mounted relay device 1. Alternatively, the program P may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 12. The storage unit 12 stores relay control information, for example in a table format (routing table), which the processing unit 11 references to perform relay control.

[0035] The communication unit 13 is an input / output interface configured by, for example, an Ethernet PHY unit using an Ethernet communication protocol. The processing unit 11 may be configured as a packaged microcomputer including the storage unit 12 and multiple communication units 13 (two communication units 13 in this embodiment).

[0036] The switching unit 14 is configured, for example, by an integrated circuit (IC), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA). A plurality of communication units 13 (Ethernet PHY units) are connected to the switching unit 14, and the switching unit 14 may be configured as a packaged switching IC (SW-IC) including the plurality of communication units 13.

[0037] In this embodiment, the microcomputer constituting the processing unit 11 is provided with two communication units 13, one of which is connected to the external connection port 15, and the other of which is connected to the communication unit 13 provided in the switching unit 14 (SW-IC). In this embodiment, the switching unit 14 (SW-IC) is provided with three communication units 13, one of which is connected to the communication unit 13 provided in the processing unit 11 (microcomputer), and the other two communication units 13 are each connected to the in-vehicle ECU 2.

[0038] The processing unit 11 (microcomputer) and the switching unit 14 (SW-IC) are communicatively connected by a communication line 31 such as Ethernet connected to the communication unit 13 of each unit. Furthermore, the external connection port 15 (DLC port) to which an external device 4 such as a diagnostic device is connected is directly connected to the communication unit 13 of the processing unit 11 (microcomputer), and is not directly connected to the communication unit 13 of the switching unit 14 (SW-IC) but is indirectly connected via the processing unit 11 (microcomputer). This allows the L2 layer (data link layer) of the external connection port 15 (DLC port) and the L2 layer (data link layer) of the switching unit 14 (SW-IC) to be physically different (not identical), thereby preventing a direct attack on the L2 layer of the switching unit 14 (SW-IC) from the external device 4 connected to the external connection port 15.

[0039] 3 is an explanatory diagram illustrating a communication format according to a hierarchical protocol in the processing unit 11, etc. In the illustration of this embodiment, the flow of data (external data) according to a hierarchical protocol defined in the hierarchical model of OSI (Open Systems Interconnection) between the processing unit 11 (microcomputer) and the switching unit 14 (SW-IC) is described.

[0040] As described above, the processing unit 11, which is configured by a microcomputer or the like, and the switching unit 14 (SW-IC), which is configured by an integrated circuit (IC) or the like, are connected to each other via the same physical layer (L1PHY) via the communication unit 13, such as an Ethernet PHY unit, so that they can communicate with each other via Ethernet. The processing unit 11 (microcomputer) and the external connection port 15, such as a DLC port, are also connected to each other via the same physical layer (L1PHY).

[0041] External data transmitted from an external device 4, such as a diagnostic device, connected to the external connection port 15 (DLC port) is, for example, an IP packet, and contains information corresponding to each layer. That is, the external data undergoes carrier sense detection according to the physical layer (L1PHY), processing using a MAC address according to the data link layer (L2MAC), processing using an IP address according to the transport layer (L4) or network layer (L3), and processing related to DoIP or UDS at the session layer or higher.

[0042] External data (IP packets) received via the external connection port 15 (DLC port) passes through an interface at the physical layer (L1PHY) by the communication unit 13 (Ethernet PHY unit) or the like, and is then referenced by the processing unit 11 (microcomputer) for a MAC address according to the data link layer (L2MAC) and processed at a higher layer such as DoIP. If the security verification result by DoIP or the like is normal, the processing unit 11 (microcomputer) transmits (outputs) the external data determined to be normal to the switching unit 14 (SW-IC) from the communication unit 13 (Ethernet PHY unit) used for communication with the switching unit 14 (SW-IC).

[0043] The switching unit 14 (SW-IC) receives (acquires) external data transmitted (output) from the processing unit 11 (microcomputer), and transmits the received external data from one of the multiple communication units 13 (Ethernet PHY units) (the communication unit 13 to which the on-board ECU 2 with the MAC address is connected) by referring to a MAC address table stored in RAM or the like according to the MAC address included in the external data. In this way, the processing unit 11 (microcomputer) and the switching unit 14 (SW-IC) relay the external data (IP packets) from the external connection port 15 (DLC port), thereby performing data communication according to the original flow of normal external data.

[0044] If the security verification result for the external data by DoIP or the like is abnormal, the processing unit 11 (microcomputer) discards the external data without outputting it to the switching unit 14 (SW-IC). As illustrated in the present embodiment, the L2 layer on the external connection port 15 (DLC port) side, i.e., the L2 layer on the processing unit 11 (microcomputer) side to which the external connection port 15 is directly connected, is not the same as the L2 layer on the switching unit 14 (SW-IC) side. In other words, these L2 layers are not directly connected. As a result, even if there is some vulnerability in the L2 layer, attack data (external data determined to be abnormal) cannot pass through to the switching unit 14 (SW-IC). This connection configuration ensures a secure environment in the in-vehicle network 3 against attacks from outside the vehicle via the external connection port 15, and improves the robustness of the in-vehicle system configured with the in-vehicle network 3.

[0045] In this embodiment, the processing unit 11 (microcomputer) and the switching unit 14 (SW-IC) are connected to each other at the same physical layer (L1PHY) of Ethernet via the communication unit 13 such as an Ethernet PHY unit, but this is not limiting. An upper layer side control unit in the processing unit 11 (microcomputer) that performs L3 or L4 layer processing and a lower layer side control unit in the switching unit 14 (SW-IC) that performs L2 processing may be connected to each other so as to be able to communicate with each other via, for example, an SPI (Serial Peripheral Interface).

[0046] 4 is a flowchart illustrating the processing of the processing unit 11 of the vehicle-mounted relay device 1. The processing unit 11 of the vehicle-mounted relay device 1 steadily performs the following processing, for example, when the vehicle C is in a running state (IG switch is on) or a stopped state (IG switch is off).

[0047] The processing unit 11 of the in-vehicle relay device 1 acquires external data via the external connection port 15 (S101). The processing unit 11 of the in-vehicle relay device 1 acquires external data transmitted from an external device 4, such as a diagnostic device, connected to the external connection port 15 via the external connection port 15. The external connection port 15 and the communication unit 13 (Ethernet PHY unit) connected to the processing unit 11 of the in-vehicle relay device 1 are connected via a communication line 31 (Ethernet) or an internal bus, and the processing unit 11 of the in-vehicle relay device 1 acquires (receives) the external data from the external connection port 15 via the communication unit 13 (Ethernet PHY unit) corresponding to Layer 1.

[0048] The processing unit 11 of the in-vehicle relay device 1 determines whether the external data input from the external connection port 15 is normal (S102). The processing unit 11 of the in-vehicle relay device 1 performs various processes using hierarchical protocols in layer 2 or layer 3, such as DoIP (Diagnostics over Internet Protocol), UDS (Unified Diagnostic Service), QoS (Quality of Service), SOME / IP (Scalable service-Oriented Middleware over IP), IDS (Intrusion Detection System), or IP address-based routing, without performing relay processes (layer 2 processes) based on MAC addresses or the like on the external data input from the external connection port 15.

[0049] When performing these Layer 3 processes, the processing unit 11 of the in-vehicle relay device 1 performs security verification processing on the acquired external data, for example, using DoIP, to determine whether the external data is valid or invalid, i.e., whether the external data is normal or abnormal (attack data). The processing unit 11 of the in-vehicle relay device 1 may determine that the external data is abnormal, for example, if the number of packets of external data (IP packets) acquired (received) in a predetermined processing unit time is large, such as exceeding a predetermined threshold, and the external data is determined to be a DoS attack or the like. The processing unit 11 of the in-vehicle relay device 1 may determine that the external data is normal, for example, if the number of packets of external data (IP packets) acquired (received) in a predetermined processing unit time is equal to or less than a predetermined threshold.

[0050] When it is determined that the external data is normal (S102: YES), the processing unit 11 of the in-vehicle relay device 1 outputs the external data to the switching unit 14 (S103). When it is determined that the external data input from the external connection port 15 is normal, the processing unit 11 of the in-vehicle relay device 1 outputs the external data to the switching unit 14.

[0051] Based on a Media Access Control (MAC) address included in the external data (IP packet) output from the processing unit 11 (microcomputer), the switching unit 14 (SW-IC) outputs the external data from the communication unit 13 (Ethernet PHY unit) to which the in-vehicle ECU 2 having the MAC address is connected. As a result, the external data received from the external device 4 via the external connection port 15 is subjected to security verification by the processing unit 11 (microcomputer) and then transmitted from the switching unit 14 (SW-IC) to the in-vehicle network 3.

[0052] When it is determined that the external data is abnormal (S102: NO), the processing unit 11 of the in-vehicle relay device 1 discards the external data (S104). When the processing unit 11 of the in-vehicle relay device 1 determines that the external data input from the external connection port 15 is abnormal, the processing unit 11 discards the external data without outputting the external data to the switching unit 14. As a result, when the external data input from the external connection port 15 is abnormal, i.e., attack data, the attack data (external data determined to be abnormal) is discarded without being output (transmitted) to the in-vehicle network 3, thereby ensuring a secure environment for the in-vehicle network 3.

[0053] 5 is a block diagram illustrating the configuration of an in-vehicle relay device 1 according to embodiment 2 (multi-layer separation). As in embodiment 1, the in-vehicle relay device 1 includes a processing unit 11 (microcomputer) and a switching unit 14 (SW-IC). The processing unit 11 (microcomputer) is configured with two separate processing units 11 (microcomputers): a first processing unit 111 (first microcomputer: μC-1) and a second processing unit 112 (second microcomputer: μC-2).

[0054] The first processing unit 111 (first microcomputer) and the second processing unit 112 (second microcomputer) are provided with a storage unit 12 and a communication unit 13 (Ethernet PHY unit) similar to the processing unit 11 (microcomputer) of embodiment 1, and perform relay processing according to a hierarchical protocol. An external connection port 15 is connected to the first processing unit 111 (first microcomputer).

[0055] The second processing unit 112 (second microcomputer) is connected to the switching unit 14. The first processing unit 111 (first microcomputer) and the second processing unit 112 (second microcomputer) are communicatively connected via, for example, a serial peripheral interface (SPI). Alternatively, the first processing unit 111 (first microcomputer) and the second processing unit 112 (second microcomputer) may be communicatively connected via Ethernet via a communication unit 13 (Ethernet PHY unit). If the external connection port 15 (DLC port) is located upstream in the flow direction of external data output from the external device 4, the external connection port 15, the first processing unit 111 (first microcomputer), the second processing unit 112 (second microcomputer), and the switching unit 14 (SW-IC) are connected in series in that order.

[0056] The second processing unit 112 (second microcomputer) performs processing related to changing the settings of the switching unit 14, and has the right to set the settings (SW-IC setting right) for the switching unit 14. The second processing unit 112 (second microcomputer) having the right to set the settings for the switching unit 14 executes, for example, a setting change application stored in the storage unit 12, thereby outputting a parameter update command or the like to a setting change port or API (Application Programming Interface) provided in the switching unit 14, and performs processing to change the setting parameters, etc., of the switching unit 14.

[0057] With this connection configuration, the first processing unit 111 (first microcomputer) can temporarily terminate communication with the external device 4 connected to the external connection port 15. Then, the first processing unit 111 (first microcomputer) communicates with the second processing unit 112 (second microcomputer), so the second processing unit 112, which has the right to set the switching unit 14, can be prevented from being attacked by the external device 4 connected to the external connection port 15, and even if the second processing unit 112 has vulnerability, sufficient robustness can be ensured.

[0058] The embodiments disclosed herein are to be considered as illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims.

[0059] Multiple claims may be combined with each other regardless of the form of reference. The claims may contain multiple dependent claims that depend on multiple claims. Multiple dependent claims may be contained that depend on multiple dependent claims. If multiple dependent claims that depend on multiple dependent claims are not contained, this does not limit the number of multiple dependent claims that depend on multiple dependent claims.

[0060] C Vehicle 1 In-vehicle relay device 11 Processing unit (microcomputer) 12 Storage unit M Recording medium P Program (program product) 13 Communication unit (Ethernet PHY unit) 14 Switching unit (SW-IC) 15 External connection port (DLC port) 111 First processing unit (first microcomputer) 112 Second processing unit (second microcomputer) 2 In-vehicle ECU 3 In-vehicle network 31 Communication line 4 External device (diagnosis device)

Claims

1. An in-vehicle relay device connected to an in-vehicle network mounted on a vehicle, comprising: a plurality of communication units for communicating with a plurality of in-vehicle ECUs mounted on the vehicle; a processing unit that performs processing related to relaying communications between the plurality of in-vehicle ECUs; a switching unit that is communicatively connected to the processing units and relays based on a hierarchical protocol that is lower than the relay processing by the processing units; and an external connection port to which an external device outside the vehicle is connected, the external connection port being communicatively connected to the processing units, and external data input from the external connection port being output to the switching unit via the processing units.

2. The in-vehicle relay device of claim 1, wherein the communication protocol used by the switching unit for relaying is TCP / IP, the switching unit includes two or more of the communication units, and functions as a Layer 2 switch that relays IP packets flowing through the in-vehicle network based on the MAC address of the in-vehicle ECU connected to the communication unit.

3. The vehicle relay device according to claim 1, wherein the communication protocol used by the processing unit for relaying is TCP / IP, and the processing unit functions as a Layer 3 switch that relays IP packets from the vehicle ECU acquired via the switching unit based on the IP address of the vehicle ECU.

4. The vehicle-mounted relay device described in claim 1, wherein the processing unit determines whether the external data input from the external connection port is normal or abnormal, and if it determines that the external data is normal, transmits the external data to the vehicle-mounted network via the switching unit, and if it determines that the external data is abnormal, discards the external data without outputting it to the switching unit.

5. An in-vehicle relay device as described in any one of claims 1 to 2, wherein the processing unit includes a first processing unit and a second processing unit communicatively connected to the first processing unit, the switching unit is connected to the second processing unit, the second processing unit performs processing related to setting changes of the switching unit, the external connection port is connected to the first processing unit, and the external data input from the external connection port is output to the switching unit via the first processing unit and the second processing unit.

6. A program that causes a computer to execute processing, the computer having multiple communication units for communicating with on-board ECUs connected to an on-board network, and performing processing related to relaying communications between the multiple on-board ECUs, wherein the computer is communicatively connected to a switching unit that relays based on a hierarchical protocol that is lower than the relay processing by the computer, and is connected to an external connection port to which an external device outside the vehicle is connected, and when external data input from the external connection port is output to the switching unit, the program determines whether the external data input from the external connection port is normal or abnormal, and if it is determined that the external data is normal, transmits the external data to the on-board network via the switching unit, and if it is determined that the external data is abnormal, discards the external data without outputting it to the switching unit.

7. An information processing method for causing a computer to execute processing related to relaying communications between a plurality of vehicle-mounted ECUs, the computer having a plurality of communication units for communicating with vehicle-mounted ECUs connected to an in-vehicle network, wherein the computer is communicatively connected to a switching unit that relays based on a hierarchical protocol lower than the relay processing by the computer, and is connected to an external connection port to which an external device outside the vehicle is connected, the computer determines whether the external data input from the external connection port is normal or abnormal when outputting external data input from the external connection port to the switching unit, and if it is determined that the external data is normal, transmits the external data to the in-vehicle network via the switching unit, and if it is determined that the external data is abnormal, discards the external data without outputting it to the switching unit.

Images