In-vehicle system, monitoring method, and monitoring program

Abstract

An in-vehicle system mounted in a vehicle comprises a transmission data selection unit that transmits a plurality of pieces of data being monitored, and a monitoring unit that monitors the plurality of pieces of data being monitored received from the transmission data selection unit. The transmission data selection unit transmits the plurality of pieces of data being monitored and log information to the monitoring unit in a time division manner.

Description

In-vehicle system, monitoring method and monitoring program

[0001] This application claims priority from Japanese Patent Application No. 2024-113734, filed on July 17, 2024, the disclosure of which is incorporated herein by reference in its entirety.

[0002] Patent Document 1 (JP 2020-17826 A) discloses the following technology: A sorting device that transfers packets received from a network to a user and a security device that detects attack packets includes a duplication unit that copies packets received from the network, and a compression unit that compresses the payload of the copied packets and transfers them to the security device.

[0003] JP 2020-17826 A International Publication No. 2018 / 105321 JP 2019-101895 A Japanese Patent Application Laid-Open No. 2020-17826 International Publication No. 2022 / 049894 Japanese Patent Application Laid-Open No. 2020-14089

[0004] The in-vehicle system of the present disclosure is an in-vehicle system mounted on a vehicle, and includes a transmission data selection unit that transmits multiple pieces of monitoring target data, and a monitoring unit that monitors the multiple pieces of monitoring target data received from the transmission data selection unit, and the transmission data selection unit transmits the multiple pieces of monitoring target data and log information to the monitoring unit in a time-division manner.

[0005] One aspect of the present disclosure can be realized not only as an in-vehicle system including such a characteristic processing unit, but also as a semiconductor integrated circuit that realizes part or all of the in-vehicle system.

[0006] FIG. 1 is a diagram illustrating an example of the configuration of a communication system according to a first embodiment of the present disclosure. FIG. 2 is a diagram illustrating an example of the configuration of an in-vehicle system according to the first embodiment of the present disclosure. FIG. 3 is a diagram illustrating an example of the configuration of an in-vehicle relay device according to the first embodiment of the present disclosure. FIG. 4 is a diagram illustrating an example of a transmission process by the in-vehicle relay device according to the first embodiment of the present disclosure. FIG. 5 is a diagram illustrating another example of a transmission process by the in-vehicle relay device according to the first embodiment of the present disclosure. FIG. 6 is a diagram illustrating another example of a transmission process by the in-vehicle relay device according to the first embodiment of the present disclosure. FIG. 7 is a diagram illustrating an example of the configuration of a monitoring device according to the first embodiment of the present disclosure. FIG. 8 is a flowchart defining an example of an operation procedure when the in-vehicle relay device according to the first embodiment of the present disclosure performs relay processing. FIG. 9 is a flowchart defining an example of an operation procedure when the in-vehicle relay device according to the first embodiment of the present disclosure performs transmission processing. FIG. 10 is a flowchart defining another example of an operation procedure when the in-vehicle relay device according to the first embodiment of the present disclosure performs transmission processing. Fig. 11 is a flowchart defining another example of an operational procedure when an in-vehicle relay device according to the first embodiment of the present disclosure performs a transmission process. Fig. 12 is a flowchart defining an example of an operational procedure when a monitoring device according to the first embodiment of the present disclosure performs a process of monitoring monitoring target data. Fig. 13 is a diagram illustrating an example of the configuration of an in-vehicle system according to a second embodiment of the present disclosure. Fig. 14 is a diagram illustrating an example of the configuration of an in-vehicle relay device according to a third embodiment of the present disclosure. Fig. 15 is a diagram illustrating an example of the configuration of an in-vehicle system according to a fourth embodiment of the present disclosure. Fig. 16 is a diagram illustrating an example of the configuration of an in-vehicle relay device according to the fourth embodiment of the present disclosure.

[0007] Conventionally, techniques have been developed to reduce the amount of data transmitted to a monitoring device that detects anomalies in a network.

[0008] [Problem to be Solved by the Present Disclosure] In vehicles with limited communication bandwidth, there is a demand for technology that can analyze log information while monitoring multiple monitored data in order to detect abnormalities in the in-vehicle network.

[0009] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide an in-vehicle system, a monitoring method, and a monitoring program that are capable of analyzing log information while monitoring multiple monitored data in a vehicle with limited communication bandwidth.

[0010] Effect of the Present Disclosure According to the present disclosure, in a vehicle with a limited communication band, it is possible to analyze log information while monitoring multiple pieces of monitoring target data.

[0011] [Description of Embodiments of the Present Disclosure] First, the contents of the embodiments of the present disclosure will be listed and described. (1) An in-vehicle system according to an embodiment of the present disclosure is an in-vehicle system mounted on a vehicle, and includes a transmission data selection unit that transmits a plurality of pieces of monitoring target data, and a monitoring unit that monitors the plurality of pieces of monitoring target data received from the transmission data selection unit, and the transmission data selection unit transmits the plurality of pieces of monitoring target data and log information to the monitoring unit in a time-division manner.

[0012] In this way, by selectively transmitting multiple pieces of monitoring target data and log information to the monitoring unit, the data transmission bandwidth from the transmission data selection unit to the monitoring unit can be reduced. Therefore, in a vehicle with a limited communication bandwidth, it is possible to monitor multiple pieces of monitoring target data while analyzing log information.

[0013] (2) In the above (1), each of the plurality of monitored data transmitted by the transmission data selection unit may be data to be transferred, and the log information may include the results of monitoring the monitored data before being transferred to the monitoring unit.

[0014] With this configuration, the monitoring target data can be monitored in more detail using the monitoring results of the monitoring target data before transfer.

[0015] (3) In (1) or (2) above, the in-vehicle system may be provided with an in-vehicle relay device that receives the plurality of monitored data, copies each of the monitored data, and transmits the copied plurality of monitored data to the monitoring unit, and the in-vehicle relay device may include the transmission data selection unit and monitor the plurality of monitored data to create the log information.

[0016] With this configuration, for example, the monitoring target data transmitted from each in-vehicle device in an in-vehicle system can be collectively monitored and log information can be created, so that the monitoring target data can be monitored in more detail using the log information. Furthermore, since the monitoring target data is transmitted in duplicate to the monitoring unit, delays in relaying the monitoring target data can be prevented.

[0017] (4) In the above (2) or (3), when the monitoring unit detects an abnormality in at least one of the plurality of monitored data, the monitoring unit may analyze the cause of the abnormality based on the log information transmitted from the transmission data selection unit.

[0018] With this configuration, the cause of an abnormality in the monitored data can be determined using the log information.

[0019] (5) In any one of (1) to (4) above, the monitoring unit may switch a monitoring method for the monitoring target data depending on the type of the monitoring target data transmitted from the transmission data selection unit.

[0020] With this configuration, the monitoring target data can be monitored in accordance with an appropriate monitoring method according to the monitoring target data, thereby enabling more accurate monitoring.

[0021] (6) In any of (1) to (5) above, the transmission data selection unit may determine whether to transmit the log information based on the amount of memory used to store the log information before transmission to the monitoring unit.

[0022] With this configuration, it is possible to transmit the log information while allocating memory capacity for storing the log information.

[0023] (7) In any of (1) to (6) above, the transmission data selection unit may continuously transmit the log information using a portion of the bandwidth used to transmit each of the plurality of monitored data from the transmission data selection unit to the monitoring unit, and may transmit each of the monitored data using a portion or all of the remaining bandwidth.

[0024] With this configuration, for example, the number of pieces of log information sent to the monitoring unit per unit time increases, making it possible to perform a more detailed analysis of the log information.

[0025] (8) In any of (1) to (7) above, each of the plurality of monitored data transmitted by the transmission data selection unit may be data to be transferred, and the transmission data selection unit may change the content of the log information to be transmitted to the monitoring unit based on at least one of the state of the vehicle, the results of monitoring the monitored data before being transferred to the monitoring unit, and the results of analysis of the log information in the monitoring unit.

[0026] With this configuration, for example, the monitoring unit can select log information including the content to be analyzed and transmit it from the transmission data selection unit to the monitoring unit.

[0027] (9) In any one of (1) to (8) above, the log information may include information indicating the state of the vehicle.

[0028] With this configuration, it is possible to monitor the monitoring target data in more detail using information indicating the state of the vehicle.

[0029] (10) A monitoring method according to an embodiment of the present disclosure includes a step of transmitting multiple pieces of monitored data and a step of monitoring the received multiple pieces of monitored data, and in the step of transmitting the monitored data, the multiple pieces of monitored data and log information are transmitted in a time-division manner.

[0030] In this way, by selectively transmitting multiple pieces of monitoring target data and log information, the data transmission bandwidth from the source to the destination can be reduced, making it possible to analyze log information while monitoring multiple pieces of monitoring target data in vehicles with limited communication bandwidth.

[0031] (11) A monitoring program according to an embodiment of the present disclosure is a monitoring program used in an in-vehicle system installed in a vehicle, and is a program for causing a computer to function as a transmission data selection unit that transmits multiple pieces of monitoring target data and a monitoring unit that monitors the multiple pieces of monitoring target data received from the transmission data selection unit, and the transmission data selection unit transmits the multiple pieces of monitoring target data and log information to the monitoring unit in a time-division manner.

[0032] In this way, by selectively transmitting multiple pieces of monitoring target data and log information to the monitoring unit, the data transmission bandwidth from the transmission data selection unit to the monitoring unit can be reduced. Therefore, in a vehicle with a limited communication bandwidth, it is possible to monitor multiple pieces of monitoring target data while analyzing log information.

[0033] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0034] <First embodiment> [Communication system] Fig. 1 is a diagram illustrating an example of the configuration of a communication system according to a first embodiment of the present disclosure. Referring to Fig. 1, a communication system 501 includes a management server 171 and one or more in-vehicle systems 301. The in-vehicle system 301 is mounted on a vehicle 1. The management server 171 is provided outside the vehicle 1. The management server 171 is used, for example, by a business operator or an individual that manages the operation of the vehicle 1.

[0035] [In-Vehicle System] Fig. 2 is a diagram showing an example of the configuration of an in-vehicle system according to the first embodiment of the present disclosure. Referring to Fig. 2, the in-vehicle system 301 includes an in-vehicle relay device 101, a monitoring device 121, and a plurality of in-vehicle devices 202. The in-vehicle system 301 is mounted on a vehicle 1. The in-vehicle relay device 101 is an example of a transmission data selection unit. The monitoring device 121 is an example of a monitoring unit.

[0036] The in-vehicle devices 202 include an in-vehicle ECU (Electronic Control Unit), a sensor, a navigation device, a human-machine interface, a camera, etc. The in-vehicle ECUs include an automatic driving ECU, an engine ECU, a steering control ECU, a brake control ECU, and a TCU (Telematics Communication Unit).

[0037] The in-vehicle relay device 101, the monitoring device 121, and the plurality of in-vehicle devices 202 form an in-vehicle network 401. The plurality of in-vehicle devices 202 are connected to the in-vehicle relay device 101 via a CAN bus 51 that conforms to the CAN (Controller Area Network) standard, for example.

[0038] 2, the in-vehicle system 301 includes in-vehicle devices 202A, 202B, 202C, 202D, 202E, and 202F that are in-vehicle devices 202. Also, in the example shown in Fig. 2, CAN buses 51A, 51B, and 51C are provided as the CAN bus 51.

[0039] The on-board devices 202A and 202B are connected to the on-board relay device 101 via a CAN bus 51A. The on-board devices 202C and 202D are connected to the on-board relay device 101 via a CAN bus 51B. The on-board devices 202E and 202F are connected to the on-board relay device 101 via a CAN bus 51C.

[0040] For example, each in-vehicle device 202 transmits a CAN frame to other in-vehicle devices 202 or in-vehicle relay device 101, the CAN frame including various information described below, such as information to assist the automatic driving performed by vehicle 1 and information used for entertainment, and a CAN-ID (Identifier) ​​indicating the type of data, etc.

[0041] The vehicle relay device 101 and each vehicle device 202 communicate with each other to provide various services in the vehicle 1 .

[0042] Specifically, the in-vehicle network 401 provides an anti-theft service that prevents theft of vehicle 1 while vehicle 1 is parked or stopped, a deviation prevention service that prevents vehicle 1 from leaving its lane while traveling on a highway, and an autonomous driving service that switches the driving state of vehicle 1 from manual driving to autonomous driving.

[0043] The in-vehicle system 301 is not limited to a configuration in which three CAN buses 51 are provided, but may be a configuration in which one, two, or four or more CAN buses 51 are provided.

[0044] The vehicle-mounted relay device 101 is, for example, a gateway device, and performs a relay process for relaying data transmitted and received between devices connected to the vehicle-mounted relay device 101.

[0045] The monitoring device 121 has an IDS (Intrusion Detection System) function and performs a detection process K1 to detect an abnormality in the in-vehicle network 401 .

[0046] The monitoring device 121 is connected to the vehicle-mounted relay device 101 via an Ethernet (registered trademark) cable 52 .

[0047] Between the vehicle-mounted relay device 101 and the monitoring device 121, information is exchanged using Ethernet frames.

[0048] More specifically, the vehicle-mounted relay device 101 transmits to the monitoring device 121 an Ethernet frame including monitoring target data, which is data to be monitored by the monitoring device 121 .

[0049] The monitoring device 121 performs the detection process K1 by monitoring the monitoring target data included in the Ethernet frame received from the in-vehicle relay device 101. For example, the monitoring device 121 performs a process of detecting fraudulent data in the in-vehicle network 401 as the detection process K1.

[0050] For example, the monitoring target data transmitted by the vehicle-mounted relay device 101 is data to be transferred.

[0051] More specifically, for example, the vehicle-mounted relay device 101 receives and copies the monitoring target data, and then transmits the copied monitoring target data to the monitoring device 121.

[0052] Specifically, for example, when the in-vehicle relay device 101 receives a CAN frame including data to be monitored from a certain in-vehicle device 202, the in-vehicle relay device 101 transmits the CAN frame to the destination in-vehicle device 202 and also copies the CAN frame. Then, the in-vehicle relay device 101 changes the format of the copied CAN frame to an Ethernet frame format and transmits the copied CAN frame to the monitoring device 121.

[0053] [On-Vehicle Relay Device] Fig. 3 is a diagram illustrating an example of the configuration of an on-vehicle relay device according to the first embodiment of the present disclosure. Referring to Fig. 3, the on-vehicle relay device 101 includes communication ports 11 and 12, a relay unit 13, a simple IDS processing unit 14, a control unit 15, multiple limiters 16, a selection unit 17, and a storage unit 18. Some or all of the relay unit 13, the simple IDS processing unit 14, the control unit 15, the limiters 16, and the selection unit 17 are realized, for example, by a processing circuit including one or more processors. The storage unit 18 is, for example, a non-volatile memory included in the processing circuit.

[0054] The communication port 11 is a connector that can be connected to the CAN bus 51. In the example shown in Fig. 3, the vehicle-mounted relay device 101 includes communication ports 11A, 11B, and 11C that are the communication ports 11.

[0055] The communication port 11A is connected to a plurality of on-vehicle devices 202, such as on-vehicle devices 202A and 202B, via a CAN bus 51A. The communication port 11B is connected to a plurality of on-vehicle devices 202, such as on-vehicle devices 202C and 202D, via a CAN bus 51B. The communication port 11C is connected to a plurality of on-vehicle devices 202, such as on-vehicle devices 202E and 202F, via a CAN bus 51C.

[0056] The communication port 12 is a connector to which an Ethernet cable 52 can be connected. The communication port 12 is connected to a monitoring device 121 via the Ethernet cable 52.

[0057] (Relay Unit) The relay unit 13 receives a CAN frame transmitted from a certain in-vehicle device 202. Then, the relay unit 13 checks whether the received CAN frame is a CAN frame that should be received by its own in-vehicle relay device 101.

[0058] The storage unit 18 stores, for example, a reception list indicating the CAN-IDs included in the CAN frames that should be received by the vehicle-mounted relay device 101. The reception list is registered in the storage unit 18 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0059] When the relay unit 13 receives a CAN frame, it refers to the reception list in the storage unit 18 to check whether the CAN-ID included in the CAN frame is registered in the reception list.

[0060] For example, if the CAN-ID included in a received CAN frame is not registered in the reception list, the relay unit 13 discards the CAN frame.

[0061] For example, storage unit 18 stores a routing table indicating the correspondence between CAN-IDs, CAN buses 51 to which in-vehicle devices 202 that are the senders of CAN frames are connected (hereinafter also referred to as "source buses"), and CAN buses 51 to which in-vehicle devices 202 that are the destinations of CAN frames are connected (hereinafter also referred to as "destination buses"). The routing table is registered in storage unit 18 by the manufacturer of vehicle 1, for example, when vehicle 1 is shipped.

[0062] For example, when the CAN-ID included in a CAN frame received from the in-vehicle device 202 is registered in the reception list, the relay unit 13 identifies the destination bus corresponding to the CAN-ID by referring to the routing table in the storage unit 18. Then, the relay unit 13 outputs the received CAN frame to the identified destination bus.

[0063] Furthermore, if the CAN-ID included in the CAN frame received from the in-vehicle device 202 is registered in the reception list, the relay unit 13 outputs ID information indicating the CAN-ID to the simple IDS processing unit 14 .

[0064] In the following description, the CAN frames received from the in-vehicle equipment 202 connected to the CAN bus 51A, the CAN frames received from the in-vehicle equipment 202 connected to the CAN bus 51B, and the CAN frames received from the in-vehicle equipment 202 connected to the CAN bus 51C will also be referred to as CAN frame Fa, CAN frame Fb, and CAN frame Fc, respectively.

[0065] 3, the vehicle-mounted relay device 101 includes limiters 16A, 16B, 16C, and 16D that are the limiter 16. Each of the limiters 16A, 16B, 16C, and 16D includes a buffer (not shown).

[0066] The limiters 16A, 16B, and 16C are provided corresponding to the communication ports 11A, 11B, and 11C, respectively.

[0067] The CAN frames Fa, Fb, and Fc are duplicated in the in-vehicle relay device 101. More specifically, the CAN frame Fa received at the communication port 11A is output to the limiter 16A and the relay unit 13. The CAN frame Fb received at the communication port 11B is output to the limiter 16B and the relay unit 13. The CAN frame Fc received at the communication port 11C is output to the limiter 16C and the relay unit 13.

[0068] (Simple IDS Processing Unit) The simple IDS processing unit 14 has an IDS function and performs a detection process K2 to detect an abnormality in the communication load (hereinafter also referred to as "bus load") on the source bus of the CAN frame. The processing load of the detection process K2 is smaller than the processing load of the detection process K1 by the monitoring device 121.

[0069] For example, the simple IDS processing unit 14 calculates an estimated value of the bus load when various services are provided in the in-vehicle network 401 .

[0070] More specifically, the simple IDS processing unit 14 calculates the estimated value of the bus load every time the calculation period F for the estimated value of the bus load has elapsed since the in-vehicle relay device 101 of its own has been started up.

[0071] Specifically, for example, during calculation period F, each time simple IDS processing unit 14 receives ID information from relay unit 13, simple IDS processing unit 14 refers to the routing table in storage unit 18 to identify the source bus corresponding to the CAN-ID indicated by the ID information. Then, each time calculation period F elapses, simple IDS processing unit 14 counts the number of times that simple IDS processing unit 14 received ID information corresponding to the source bus from relay unit 13 during calculation period F, and calculates the count value as an estimate of the bus load.

[0072] For example, when the simple IDS processing unit 14 calculates an estimated bus load, it creates load information indicating the calculation result, the calculation time, and the destination bus corresponding to the calculation result as log information.The simple IDS processing unit 14 then stores the created load information in the memory unit 18 and also in the buffer of the limiter 16D.

[0073] Furthermore, for example, the simple IDS processing unit 14 has the function of a host-type IDS. Specifically, the simple IDS processing unit 14 monitors events occurring inside a host such as a processor of the on-board relay device 101, and creates event information indicating the monitoring results as log information. The simple IDS processing unit 14 then stores the created event information in the storage unit 18 and also in the buffer of the limiter 16D.

[0074] [Description of the Problem] For example, when the in-vehicle relay device 101 simultaneously transmits multiple pieces of monitoring target data to the monitoring device 121, it is necessary to increase the bandwidth used between the in-vehicle relay device 101 and the monitoring device 121. In this case, the cost of the in-vehicle relay device 101 increases.

[0075] Furthermore, when the simple IDS processing unit 14 is provided in the vehicle-mounted relay device 101, the monitoring device 121 may change the type of monitored data to be transmitted by the vehicle-mounted relay device 101 based on the detection results of the simple IDS processing unit 14. In this case, the vehicle-mounted relay device 101 needs to transmit the detection results of the simple IDS processing unit 14 to the monitoring device 121 as log information.

[0076] When the in-vehicle repeater 101 simultaneously transmits multiple pieces of monitoring target data and log information to the monitoring device 121, it is necessary to further increase the bandwidth used between the in-vehicle repeater 101 and the monitoring device 121, or to provide multiple transmission lines such as Ethernet cables 52 connecting the in-vehicle repeater 101 and the monitoring device 121. In this case, the cost of the in-vehicle repeater 101 will further increase.

[0077] Therefore, the in-vehicle system 301 according to the embodiment of the present disclosure solves the above problem by the following configuration and operation.

[0078] [On-Vehicle Relay Device] (Transmission of Monitoring Target Data and Log Information) Referring back to FIG. 3, the on-vehicle relay device 101 transmits a plurality of monitoring target data and log information to the monitoring device 121 in a time-division manner.

[0079] For example, the above multiple monitored data include various information contained in CAN frame Fa (hereinafter also referred to as "monitored data A"), various information contained in CAN frame Fb (hereinafter also referred to as "monitored data B"), and various information contained in CAN frame Fc (hereinafter also referred to as "monitored data C").

[0080] For example, the log information includes monitoring result information indicating the results of monitoring the monitoring target data before being transferred to the monitoring device 121 and vehicle information indicating the state of the vehicle 1.

[0081] In this embodiment, for example, the monitoring result information is load information indicating the result of the detection process K2 by the simple IDS processing unit 14. The vehicle information is information indicating the measurement results of a certain in-vehicle device 202, etc.

[0082] The control unit 15 controls the timing of starting transmission of each of the monitoring target data A, the monitoring target data B, the monitoring target data C, and the log information.

[0083] 4 is a diagram for explaining an example of a transmission process by the vehicle-mounted relay device according to the first embodiment of the present disclosure. In FIG. 4 and FIGS. 5 and 6 described below, monitoring target data A, monitoring target data B, monitoring target data C, and log information are indicated as “data A,” “data B,” “data C,” and “log,” respectively.

[0084] 4, for example, the vehicle-mounted relay device 101 transmits monitoring target data A, monitoring target data B, monitoring target data C, and log information to the monitoring device 121 according to a predetermined schedule.

[0085] In the example shown in FIG. 4, the vehicle-mounted relay device 101 repeatedly performs a process of transmitting monitoring target data A, monitoring target data B, monitoring target data C, and log information to the monitoring device 121 in this order.

[0086] Specifically, the selector 17 transmits one or more Ethernet frames including monitoring target data A to the monitoring device 121 during the period from time t1 to time t2 and the period from time t5 to time t6.

[0087] Furthermore, the selector 17 transmits one or more Ethernet frames including monitoring target data B to the monitoring device 121 during the period from time t2 to time t3 and the period from time t6 to time t7.

[0088] Furthermore, the selector 17 transmits one or more Ethernet frames including the monitoring target data C to the monitoring device 121 during the period from time t3 to time t4 and the period from time t7 to time t8.

[0089] Furthermore, the selector 17 transmits one or more Ethernet frames including log information to the monitoring device 121 during the period from time t4 to time t5 and the period from time t8 to time t9.

[0090] For example, the storage unit 18 stores schedule information indicating the timings at which to start transmitting each of monitoring target data A, monitoring target data B, monitoring target data C, and log information.

[0091] 4, in the period from time t1 to time t9, the transmission start timings Ta of monitoring target data A are time t1 and time t5, the transmission start timings Tb of monitoring target data B are time t2 and time t6, and the transmission start timings Tc of monitoring target data C are time t3 and time t7. Furthermore, in the period from time t1 to time t9, the transmission start timings Td of log information are time t4 and time t8.

[0092] For example, the control unit 15 manages the transmission start timing using a timer. When the transmission start timing Ta for the monitoring target data A indicated by the schedule information in the storage unit 18 arrives, the control unit 15 outputs a transmission request notification S1 indicating a request for transmission of the monitoring target data A to the selection unit 17.

[0093] When the selector 17 receives a transmission request notification S1 from the controller 15, it retrieves one or more CAN frames Fa from the buffer of the limiter 16A. Then, the selector 17 transmits one or more Ethernet frames that store the monitoring target data A in the retrieved CAN frames Fa to the monitoring device 121. For example, the selector 17 transmits Ethernet frames that further include a switching notification to the monitoring device 121 at time t1 and time t5. The switching notification is a notification that the data included in the Ethernet frame has been switched.

[0094] When the transmission start timing Tb of the monitoring target data B indicated by the schedule information in the memory unit 18 arrives, the control unit 15 outputs a transmission request notification S2 indicating a request to transmit the monitoring target data B to the selection unit 17.

[0095] When the selector 17 receives a transmission request notification S2 from the controller 15, it retrieves one or more CAN frames Fb from the buffer of the limiter 16B. Then, the selector 17 transmits one or more Ethernet frames that store the monitoring target data B in the retrieved CAN frames Fb to the monitoring device 121. For example, the selector 17 transmits Ethernet frames that further include a switching notification to the monitoring device 121 at times t2 and t6.

[0096] When the transmission start timing Tc of the monitoring target data C indicated by the schedule information in the memory unit 18 arrives, the control unit 15 outputs a transmission request notification S3 indicating a request to transmit the monitoring target data C to the selection unit 17.

[0097] When the selector 17 receives a transmission request notification S3 from the controller 15, it retrieves one or more CAN frames Fc from the buffer of the limiter 16C. Then, the selector 17 transmits one or more Ethernet frames that store the monitoring target data C in the retrieved CAN frames Fc to the monitoring device 121. For example, the selector 17 transmits Ethernet frames that further include a switching notification to the monitoring device 121 at times t3 and t7.

[0098] When the log information transmission start timing Td arrives, the control unit 15 outputs a transmission request notification S4 to the selection unit 17, which indicates a request to transmit the log information.

[0099] When the selector 17 receives the transmission request notification S4 from the controller 15, it retrieves the log information from the buffer of the limiter 16D. Then, the selector 17 creates one or more Ethernet frames including the retrieved log information and transmits them to the monitoring device 121. For example, the selector 17 transmits Ethernet frames that further include a switching notification to the monitoring device 121 at times t4 and t8.

[0100] In the following description, the Ethernet frame containing monitored data A, the Ethernet frame containing monitored data B, the Ethernet frame containing monitored data C, and the Ethernet frame containing log information will also be referred to as Ethernet frame F11, Ethernet frame F12, Ethernet frame F13, and Ethernet frame F14, respectively.

[0101] Furthermore, the control unit 15 maintains the traffic volume N of Ethernet frames containing the monitoring target data or log information, which are transmitted by the selection unit 17, below a reference value.

[0102] More specifically, the control unit 15 maintains the traffic volume N of Ethernet frame F11, the traffic volume N of Ethernet frame F12, the traffic volume N of Ethernet frame F13, and the traffic volume N of Ethernet frame F14 below the reference value P1, the reference value P2, the reference value P3, and the reference value P4, respectively.

[0103] For example, the reference values ​​P1, P2, P3, and P4 are the same value. Specifically, for example, the reference values ​​P1, P2, P3, and P4 are one-fourth of the maximum value of the traffic volume (hereinafter also referred to as "maximum traffic volume M") in the Ethernet cable 52 connecting the vehicle-mounted relay device 101 and the monitoring device 121. The maximum traffic volume M is the bandwidth used when it is assumed that the vehicle-mounted relay device 101 simultaneously transmits monitoring target data A, monitoring target data B, monitoring target data C, and log information to the monitoring device 121.

[0104] The reference values ​​P1, P2, P3, and P4 may be different from one another, or some of the reference values ​​P1, P2, P3, and P4 may be the same as other reference values.

[0105] For example, the control unit 15 notifies the limiters 16A, 16B, 16C, and 16D of the reference values ​​P1, P2, P3, and P4, respectively.

[0106] The limiters 16A, 16B, 16C, and 16D limit the number of CAN frames Fa, the number of CAN frames Fb, the number of CAN frames Fc, and the number of pieces of log information to be output to the selector 17, respectively.

[0107] More specifically, for example, limiter 16A limits the number of CAN frames Fa per unit time to be output to selector 17 to equal to or less than reference value P1 notified by control unit 15. Limiter 16B limits the number of CAN frames Fb per unit time to be output to selector 17 to equal to or less than reference value P2 notified by control unit 15. Limiter 16C limits the number of CAN frames Fc per unit time to be output to selector 17 to equal to or less than reference value P3 notified by control unit 15. Limiter 16D limits the number of pieces of log information per unit time to be output to selector 17 to equal to or less than reference value P4 notified by control unit 15.

[0108] Example 2 FIG. 5 is a diagram for explaining another example of the transmission process by the vehicle-mounted relay device according to the first embodiment of the present disclosure.

[0109] Referring to Figure 5, for example, the vehicle relay device 101 decides to transmit log information based on the memory usage (hereinafter also referred to as "memory usage E") for storing log information before transmission to the monitoring device 121.

[0110] Specifically, for example, the memory usage amount E is the ratio of the data amount of log information held by the storage unit 18 to the storage capacity of the storage unit 18 in the vehicle-mounted relay device 101 .

[0111] For example, the control unit 15 checks the memory usage amount E every time the timing for starting transmission of each of the monitoring target data A, the monitoring target data B, and the monitoring target data C arrives.

[0112] Then, the control unit 15 compares the confirmed memory usage E with a predetermined threshold value Th1. In this embodiment, the threshold value Th1 is, for example, 70%.

[0113] If the memory usage amount E is equal to or greater than the threshold value Th1, the control unit 15 determines to transmit the log information to the monitoring device 121 with priority over the monitoring target data.

[0114] Then, the control unit 15 outputs to the selection unit 17 a transmission request notification S4 requesting transmission of the log information.

[0115] On the other hand, if the memory usage E is less than the threshold value Th1, the control unit 15 decides to transmit the monitored data indicated by the schedule information in the memory unit 18 to the monitoring device 121 at the transmission start timing corresponding to the memory usage E.

[0116] 5, the memory usage E at time t1 and the memory usage E at time t5 are 0% and 50%, respectively. In this case, the vehicle-mounted relay device 101 transmits the monitoring target data A to the monitoring device 121 at each of time t1 and time t5, similar to Example 1 shown in FIG.

[0117] On the other hand, the memory usage E at time t7 is 75%. In this case, at time t7, the in-vehicle relay device 101 transmits log information to the monitoring device 121 instead of the monitoring target data C indicated by the schedule information in the memory unit 18. Then, the in-vehicle relay device 101 deletes the transmitted log information stored in the memory unit 18.

[0118] At time t8, the vehicle-mounted relay device 101 transmits monitoring target data C to the monitoring device 121 instead of the transmitted log information.

[0119] Example 3 FIG. 6 is a diagram for explaining another example of the transmission process by the vehicle-mounted relay device according to the first embodiment of the present disclosure.

[0120] 6, for example, the in-vehicle relay device 101 continuously transmits log information using a portion of the bandwidth W used to transmit monitoring target data from the in-vehicle relay device 101 to the monitoring device 121, and transmits each monitoring target data using a portion or all of the remaining bandwidth W. The bandwidth W is, for example, smaller than the maximum traffic volume M. Specifically, for example, the bandwidth W is smaller than one-third of the maximum traffic volume M. Below, an example will be described in which the in-vehicle relay device 101 transmits each monitoring target data using the entire remaining bandwidth W.

[0121] In the example shown in Figure 6, the transmission start timing Ta of monitoring target data A is time t1, time t4, etc. The transmission start timing Tb of monitoring target data B is time t2, time t5, etc. The transmission start timing Tc of monitoring target data C is time t3, time t6, etc. The transmission start timing Td of log information is the transmission start timing of each monitoring target data.

[0122] When the transmission start timing Ta for the monitoring target data A arrives, the control unit 15 outputs a transmission request notification S11 to the selection unit 17, requesting the transmission of the monitoring target data A and log information.

[0123] When the selector 17 receives a transmission request notification S11 from the controller 15, it extracts one or more CAN frames Fa and one or more pieces of log information from the buffer of the limiter 16A and the buffer of the limiter 16D, respectively. Then, the selector 17 transmits one or more Ethernet frames that store the monitoring target data A in the extracted CAN frame Fa to the monitoring device 121. The selector 17 also creates one or more Ethernet frames that include the extracted log information and transmits them to the monitoring device 121.

[0124] When the transmission start timing Tb of the monitoring target data B arrives, the control unit 15 outputs a transmission request notification S12 to the selection unit 17, requesting the transmission of the monitoring target data B and log information.

[0125] When the selector 17 receives a transmission request notification S12 from the controller 15, it extracts one or more CAN frames Fb and one or more pieces of log information from the buffer of the limiter 16B and the buffer of the limiter 16D, respectively. Then, the selector 17 transmits one or more Ethernet frames that store the monitoring target data B in the extracted CAN frame Fb to the monitoring device 121. The selector 17 also creates one or more Ethernet frames that include the extracted log information and transmits them to the monitoring device 121.

[0126] When the transmission start timing Tc of the monitoring target data C arrives, the control unit 15 outputs a transmission request notification S13 to the selection unit 17, requesting transmission of the monitoring target data C and log information.

[0127] When the selector 17 receives a transmission request notification S13 from the controller 15, it extracts one or more CAN frames Fc and one or more pieces of log information from the buffer of the limiter 16C and the buffer of the limiter 16D, respectively. Then, the selector 17 transmits one or more Ethernet frames that store the monitoring target data C in the extracted CAN frame Fc to the monitoring device 121. The selector 17 also creates one or more Ethernet frames that include the extracted log information and transmits them to the monitoring device 121.

[0128] Furthermore, the control unit 15 maintains the traffic volume N11 of Ethernet frames containing monitoring target data below the reference value P11, and maintains the traffic volume N12 of Ethernet frames containing log information below the reference value P12.

[0129] In this embodiment, for example, the reference values ​​P11 and P12 are 70% of the bandwidth W and 30% of the bandwidth W, respectively.

[0130] The control unit 15 notifies the limiters 16A, 16B, and 16C of the reference value P11, and notifies the limiter 16D of the reference value P12.

[0131] The limiter 16A limits the number of CAN frames Fa per unit time to be output to the selection unit 17 to equal to or less than the reference value P11 notified by the control unit 15. The limiter 16B limits the number of CAN frames Fb per unit time to be output to the selection unit 17 to equal to or less than the reference value P11 notified by the control unit 15. The limiter 16C limits the number of CAN frames Fc per unit time to be output to the selection unit 17 to equal to or less than the reference value P11 notified by the control unit 15. The limiter 16D limits the number of pieces of log information per unit time to be output to the selection unit 17 to equal to or less than the reference value P12 notified by the control unit 15.

[0132] [Monitoring Device] Fig. 7 is a diagram illustrating an example of the configuration of a monitoring device according to the first embodiment of the present disclosure. Referring to Fig. 7, the monitoring device 121 includes a communication port 21, an in-vehicle communication unit 22, an external communication unit 23, a processing unit 24, and a storage unit 25. The processing unit 24 includes a data monitoring unit 31 and a status monitoring unit 32. Some or all of the in-vehicle communication unit 22, the external communication unit 23, and the processing unit 24 are realized, for example, by a processing circuit including one or more processors. The storage unit 25 is, for example, a non-volatile memory included in the processing circuit.

[0133] The communication port 21 is a connector to which an Ethernet cable 52 can be connected. The communication port 21 is connected to the vehicle relay device 101 via the Ethernet cable 52.

[0134] When the in-vehicle communication unit 22 receives an Ethernet frame (hereinafter also referred to as a "monitoring frame") containing data to be monitored from the in-vehicle relay device 101, it attaches a timestamp indicating the time the monitoring frame was received to the received monitoring frame and outputs it to the data monitoring unit 31.

[0135] Furthermore, when the in-vehicle communication unit 22 receives an Ethernet frame including log information from the in-vehicle relay device 101, the in-vehicle communication unit 22 acquires the log information from the received Ethernet frame. Then, the in-vehicle communication unit 22 stores the acquired log information in the storage unit 25.

[0136] (Monitoring of Monitoring Target Data) The data monitoring unit 31 monitors the monitoring target data by executing a monitoring program. The monitoring program is an example of a configuration that provides a monitoring method.

[0137] For example, the storage unit 25 stores, for each type of monitoring target data, a monitoring program corresponding to that type of monitoring target data.

[0138] For example, the data monitoring unit 31 performs a switching process to switch the monitoring method of the monitoring target data depending on the type of monitoring target data transmitted from the vehicle-mounted relay device 101. For example, the data monitoring unit 31 changes the monitoring method by switching the monitoring program depending on the type of monitoring target data.

[0139] More specifically, when the data monitoring unit 31 receives a monitoring frame from the in-vehicle communication unit 22, it checks whether or not a switching notification is included in the monitoring frame.

[0140] If the monitoring frame received from the in-vehicle communication unit 22 does not include a switching notification, the data monitoring unit 31 does not perform the switching process and stores the monitoring frame in the storage unit 25 .

[0141] On the other hand, when a switching notification is included in a monitoring frame received from the in-vehicle communication unit 22, the data monitoring unit 31 performs a switching process and stores the monitoring frame in the storage unit 25. In the following description, the monitoring frame including the switching notification previously confirmed by the data monitoring unit 31 and the monitoring frame including the switching notification currently confirmed by the data monitoring unit 31 are also referred to as monitoring frame Fk1 and monitoring frame Fk2, respectively.

[0142] For example, the data monitoring unit 31 acquires from the storage unit 25 one or more monitoring frames received by the in-vehicle communication unit 22 during the period from the reception time indicated by the timestamp attached to the monitoring frame Fk1 to the reception time indicated by the timestamp attached to the monitoring frame received from the in-vehicle communication unit 22 immediately before the monitoring frame Fk2. Then, the data monitoring unit 31 switches the monitoring program to be executed in the detection process K1 to a monitoring program corresponding to the type of monitoring target data included in the acquired monitoring frame.

[0143] The data monitoring unit 31 executes the monitoring program after the switchover to determine whether the monitoring target data included in each monitoring frame acquired from the storage unit 25 is invalid data.

[0144] In the monitoring device 121, instead of the storage unit 25 storing the monitoring programs corresponding to each monitoring method, the processing unit 24 may have a logic circuit corresponding to each monitoring method. Specifically, for example, the processing unit 24 may have a logic circuit corresponding to each monitoring method realized by a hardware circuit using an FPGA (Field Programmable Gate Array). In this case, the processing unit 24 changes the monitoring method by switching the logic circuit depending on the monitoring target data transmitted from the in-vehicle relay device 101.

[0145] 3. In other words, time synchronization may be performed between the monitoring device 121 and the in-vehicle relay device 101, and the timing for starting transmission of each of the monitoring target data A, the monitoring target data B, the monitoring target data C, and the log information may be shared. In this case, the in-vehicle relay device 101 does not transmit an Ethernet frame including a switching notification to the monitoring device 121.

[0146] (Analysis of Cause of Abnormality) For example, when the data monitoring unit 31 detects an abnormality in at least one of the multiple pieces of monitoring target data transmitted in a time-division manner from the vehicle-mounted relay device 101, the data monitoring unit 31 analyzes the cause of the abnormality based on the log information transmitted from the vehicle-mounted relay device 101. Below, an example will be described in which the data monitoring unit 31 analyzes the cause of the abnormality when it detects an abnormality in one piece of monitoring target data.

[0147] More specifically, for example, when the data monitoring unit 31 detects an abnormality in certain monitoring target data, the data monitoring unit 31 acquires one or more pieces of log information from the storage unit 25. Then, the data monitoring unit 31 analyzes the cause of the abnormality based on the acquired one or more pieces of log information.

[0148] For example, the storage unit 25 stores a log analysis program for analyzing log information. The data monitoring unit 31 executes the log analysis program to analyze the log information, thereby analyzing the cause of an abnormality in the monitored data.

[0149] For example, when the data monitoring unit 31 analyzes the cause of an abnormality in the monitored data, it stores the analysis result in the storage unit 25. Furthermore, when the data monitoring unit 31 analyzes the cause of the abnormality in the monitored data, it creates abnormality detection information including type information indicating the type of the monitored data and the analysis result. The data monitoring unit 31 then outputs the abnormality detection information to the extra-vehicle communication unit 23. Furthermore, when the analysis result of the log information satisfies a predetermined condition, the data monitoring unit 31 transmits a change request notification R1 to the in-vehicle relay device 101 via the in-vehicle communication unit 22, requesting a change to the log information to be transmitted by the in-vehicle relay device 101, and indicating the type of changed log information to be transmitted by the in-vehicle relay device 101.

[0150] (Transmission of Abnormality Detection Information) Referring again to FIGS. 1 and 7, the monitoring device 121 and the management server 171 transmit and receive information via an external network 151 such as the Internet.

[0151] For example, the monitoring device 121 transmits abnormality detection information to the management server 171. More specifically, in the monitoring device 121, the exterior communication unit 23 communicates with the management server 171 via the external network 151 by wirelessly communicating with a device such as a wireless base station device (not shown) in accordance with a communication method such as Wi-Fi (registered trademark), LTE (Long Term Evolution) (registered trademark), or 5G.

[0152] The external communication unit 23 is not limited to a configuration that communicates with the management server 171 via a wireless base station device and the external network 151, but may be configured to communicate with the management server 171 via a wired line. Furthermore, the external communication unit 23 may be configured to communicate with the management server 171 further via another in-vehicle device.

[0153] When the exterior communication unit 23 receives the abnormality detection information from the data monitoring unit 31, the exterior communication unit 23 creates an IP packet including the abnormality detection information, the IP packet including the IP address of its own monitoring device 121 and the IP address of the management server 171 as the source address and the destination IP address, respectively. Then, the exterior communication unit 23 transmits the created IP packet to the management server 171 via the wireless base station device and the external network 151.

[0154] (Status Monitoring Unit) For example, in the monitoring device 121, the status monitoring unit 32 monitors the status of the vehicle 1. More specifically, the status monitoring unit 32 monitors the status of the exterior or interior of the vehicle 1 when the vehicle 1 is traveling on a highway, the status of the exterior or interior of the vehicle 1 when the vehicle 1 is parked, the status of the exterior or interior of the vehicle 1 when the vehicle 1 is traveling under high temperature conditions, and the like.

[0155] (a1) When the vehicle 1 is traveling on a highway, for example, the monitoring device 121 communicates with a navigation device (not shown). The navigation device transmits location information indicating the location of the vehicle 1 to the monitoring device 121, for example, periodically or irregularly.

[0156] In the monitoring device 121, the in-vehicle communication unit 22 outputs the received position information to the state monitoring unit 32 every time it receives position information from the navigation device.

[0157] For example, the storage unit 25 stores map information for an area including the location indicated by the location information transmitted from the navigation device.

[0158] When the state monitoring unit 32 receives the position information from the in-vehicle communication unit 22, it uses the position information and the map information stored in the memory unit 25 to determine whether the vehicle 1 is traveling on a highway.

[0159] The monitoring device 121 may be configured to communicate with a sensor that detects that the vehicle 1 has passed through an entrance gate of an ETC (Electronic Toll Collection System) instead of a navigation device. In this case, the sensor transmits the detection result to the monitoring device 121. In the monitoring device 121, when the state monitoring unit 32 receives the detection result from the sensor via the in-vehicle communication unit 22, it determines that the vehicle 1 is traveling on a highway.

[0160] For example, when the state monitoring unit 32 determines that the vehicle 1 is traveling on a highway, it monitors the state outside the vehicle 1 and outputs vehicle state information C11 indicating the monitoring results to the data monitoring unit 31.

[0161] More specifically, for example, the monitoring device 121 communicates with a LiDAR (Light Detection and Ranging) (not shown). The LiDAR measures the distance L between the vehicle 1 and another vehicle 1 (hereinafter also referred to as a “forward vehicle”) located ahead of the vehicle 1, for example, periodically or irregularly, and transmits forward vehicle information indicating the measurement results to the monitoring device 121.

[0162] In the monitoring device 121, when the in-vehicle communication unit 22 receives forward vehicle information from the LiDAR, it outputs the received forward vehicle information to the status monitoring unit 32.

[0163] After determining that the vehicle 1 is traveling on a highway, the state monitoring unit 32 checks whether the distance L indicated by the forward vehicle information received from the in-vehicle communication unit 22 is equal to or less than the threshold value Th2.

[0164] The state monitoring unit 32 outputs vehicle state information C1 indicating the state outside the vehicle 1 to the data monitoring unit 31. Specifically, for example, when the distance L is equal to or less than the threshold value Th2, the state monitoring unit 32 outputs information indicating that the distance L is equal to or less than the threshold value Th2 to the data monitoring unit 31 as vehicle state information C11.

[0165] On the other hand, when the distance L is greater than the threshold value Th2, the state monitoring unit 32 does not output the vehicle state information C1 to the data monitoring unit 31.

[0166] The LiDAR may be configured to measure the direction of the vehicle ahead instead of the distance L. In this case, when the status monitoring unit 32 receives the vehicle ahead information from the LiDAR via the in-vehicle communication unit 22 after determining that the vehicle 1 is traveling on a highway, the status monitoring unit 32 outputs the received vehicle ahead information to the data monitoring unit 31 as vehicle status information C1.

[0167] Furthermore, the LiDAR may be configured to detect another vehicle 1 (hereinafter also referred to as a "rear vehicle") located behind the vehicle 1 instead of the distance L, and transmit information indicating the detection result to the monitoring device 121. In this case, in the monitoring device 121, if the information received from the LiDAR via the in-vehicle communication unit 22 after determining that the vehicle 1 is traveling on a highway indicates that a rear vehicle has been detected, the status monitoring unit 32 outputs information indicating the presence of a rear vehicle to the data monitoring unit 31 as vehicle status information C11.

[0168] Furthermore, instead of LiDAR, the monitoring device 121 may be configured to communicate with a camera that captures images of the surroundings of the vehicle 1 while the vehicle 1 is traveling, etc. In this case, the camera transmits image information indicating images of the roads surrounding the vehicle 1 to the monitoring device 121, for example, periodically or irregularly.

[0169] In the monitoring device 121, the status monitoring unit 32 determines whether the vehicle 1 has deviated from the lane in which the vehicle 1 is traveling, after determining that the vehicle 1 is traveling on a highway, by using image information received from the camera via the in-vehicle communication unit 22. When the status monitoring unit 32 determines that the vehicle 1 has deviated from the lane, the status monitoring unit 32 outputs information indicating that the vehicle 1 has deviated from the lane to the data monitoring unit 31 as vehicle status information C11.

[0170] Also, for example, when the status monitoring unit 32 determines that the vehicle 1 is traveling on a highway, it monitors the status inside the vehicle 1 and outputs vehicle status information C12 indicating the monitoring results to the data monitoring unit 31.

[0171] More specifically, for example, the monitoring device 121 communicates with an engine sensor that measures the rotation speed of an engine (hereinafter also referred to as "engine rotation speed") mounted on the vehicle 1. The engine sensor measures the engine rotation speed, for example, periodically or irregularly, and transmits rotation speed information indicating the measurement result to the monitoring device 121.

[0172] In the monitoring device 121, when the status monitoring unit 32 determines that the vehicle 1 is traveling on a highway and then receives rotation speed information from the engine sensor via the in-vehicle communication unit 22, it checks whether the engine rotation speed indicated by the received rotation speed information is greater than or equal to the threshold value Th3.

[0173] When the engine speed is equal to or greater than the threshold value Th3, the state monitoring unit 32 outputs information indicating that the engine speed is equal to or greater than the threshold value Th3 to the data monitoring unit 31 as vehicle state information C12.

[0174] On the other hand, when the engine rotation speed is less than the threshold value Th3, the state monitoring unit 32 does not output the vehicle state information C12 to the data monitoring unit 31.

[0175] Note that instead of or in addition to the engine sensor, the monitoring device 121 may be configured to communicate with a brake sensor that detects the state of the brakes of the vehicle 1. The brake sensor measures the brake pressure, for example, periodically or irregularly, and transmits brake information indicating the measurement results to the monitoring device 121.

[0176] In the monitoring device 121, the state monitoring unit 32 determines that the vehicle 1 is traveling on a highway, and then checks whether the brake pressure indicated by the brake information received from the brake sensor via the in-vehicle communication unit 22 is equal to or greater than a threshold value Th4. If the brake pressure is equal to or greater than the threshold value Th4, the state monitoring unit 32 outputs information indicating that the brake pressure is equal to or greater than the threshold value Th4 to the data monitoring unit 31 as vehicle state information C12.

[0177] (a2) When vehicle 1 is parked In the monitoring device 121, the status monitoring unit 32 determines whether vehicle 1 is located in a parking lot using the location information received from the navigation device via the in-vehicle communication unit 22 and the map information stored in the memory unit 25.

[0178] For example, when the status monitoring unit 32 determines that the vehicle 1 is located in a parking lot, it monitors the status outside the vehicle 1 and outputs vehicle status information C21 indicating the monitoring results to the data monitoring unit 31.

[0179] More specifically, for example, when the monitoring device 121 communicates with a camera that captures images of the surroundings of the vehicle 1 , the in-vehicle communication unit 22 outputs image information received from the camera to the status monitoring unit 32 .

[0180] For example, after determining that the vehicle 1 is located in a parking lot, the status monitoring unit 32 checks whether or not an obstacle is included in the image G shown by the image information received from the in-vehicle communication unit 22 .

[0181] If an obstacle is included in the image G, the state monitoring unit 32 outputs information indicating that an obstacle exists around the vehicle 1 to the data monitoring unit 31 as vehicle state information C21.

[0182] Also, for example, when the status monitoring unit 32 determines that the vehicle 1 is located in a parking lot, it monitors the status inside the vehicle 1 and outputs vehicle status information C22 indicating the monitoring results to the data monitoring unit 31.

[0183] For example, the monitoring device 121 communicates with a parking assistance ECU that performs parking assistance processing to assist in parking the vehicle 1. For example, upon completing the parking assistance processing, the parking assistance ECU transmits parking assistance information indicating the result of the parking assistance processing to the monitoring device 121.

[0184] In the monitoring device 121, when the status monitoring unit 32 determines that the vehicle 1 is located in a parking lot and then receives parking assistance information from the parking assistance ECU via the in-vehicle communication unit 22, it outputs the received parking assistance information to the data monitoring unit 31 as vehicle status information C22.

[0185] (a3) When the vehicle 1 is traveling under high temperature conditions: For example, the monitoring device 121 transmits the location information received from the navigation device to the management server 171 .

[0186] When the management server 171 receives the location information from the monitoring device 121, it acquires temperature information indicating the current temperature at the location of the vehicle 1 indicated by the received location information. Then, the management server 171 transmits the acquired temperature information to the monitoring device 121.

[0187] In the monitoring device 121 , when the exterior communication unit 23 receives the temperature information from the management server 171 , it outputs the received temperature information to the state monitoring unit 32 .

[0188] When the state monitoring unit 32 receives the temperature information from the exterior communication unit 23, it checks whether the temperature indicated by the temperature information is equal to or higher than a threshold value Th5.

[0189] Then, when the temperature indicated by the temperature information received from the exterior communication unit 23 is equal to or higher than the threshold value Th5, the status monitoring unit 32 outputs information indicating that the temperature is high to the data monitoring unit 31 as vehicle status information C31 indicating the condition outside the vehicle 1.

[0190] On the other hand, when the temperature indicated by the temperature information received from the exterior communication unit 23 is lower than the threshold value Th5, the state monitoring unit 32 does not output the vehicle state information C31 to the data monitoring unit 31.

[0191] The management server 171 may be configured to transmit to the monitoring device 121, instead of air temperature information, road surface temperature information indicating the road surface temperature at the position of the vehicle 1 indicated by the position information received from the monitoring device 121. In this case, the status monitoring unit 32 in the monitoring device 121 checks whether the road surface temperature indicated by the road surface temperature information received from the management server 171 via the exterior communication unit 23 is equal to or higher than the threshold value Th6. If the road surface temperature is equal to or higher than the threshold value Th6, the status monitoring unit 32 outputs information indicating that the road surface temperature is high to the data monitoring unit 31 as vehicle status information C31.

[0192] Furthermore, the status monitoring unit 32 may be configured to monitor the usage status of the air conditioner installed in the vehicle 1 instead of the air temperature at the location of the vehicle 1. In this case, for example, when the operating time of the air conditioner is equal to or longer than a predetermined time, the status monitoring unit 32 outputs information indicating that the operating time of the air conditioner is long to the data monitoring unit 31 as vehicle status information C31.

[0193] For example, the monitoring device 121 communicates with a temperature sensor that measures the temperature of an engine mounted on the vehicle 1. The temperature sensor measures the temperature of the engine, for example, periodically or irregularly, and transmits temperature information indicating the measurement result to the monitoring device 121.

[0194] In the monitoring device 121, when the state monitoring unit 32 receives temperature information from the temperature sensor via the in-vehicle communication unit 22, it checks whether the engine temperature indicated by the received temperature information is equal to or higher than the threshold value Th7.

[0195] Then, when the engine temperature is equal to or higher than the threshold value Th7, the status monitoring unit 32 outputs information indicating that the temperature is high to the data monitoring unit 31 as vehicle status information C32 indicating the status inside the vehicle 1.

[0196] On the other hand, when the engine temperature is lower than the threshold value Th7, the state monitoring unit 32 does not output the vehicle state information C32 to the data monitoring unit 31.

[0197] Instead of or in addition to the temperature sensor, the monitoring device 121 may be configured to communicate with a fan sensor that measures the rotation speed of a cooling fan mounted on the vehicle 1. The fan sensor measures the rotation speed of the cooling fan, for example, periodically or irregularly, and transmits fan information indicating the measurement results to the monitoring device 121.

[0198] In the monitoring device 121, the state monitoring unit 32 checks whether the rotation speed of the cooling fan indicated by the fan information received from the fan sensor via the in-vehicle communication unit 22 is equal to or greater than a threshold value Th8. If the rotation speed is equal to or greater than the threshold value Th8, the state monitoring unit 32 outputs information indicating that the rotation speed of the cooling fan is equal to or greater than the threshold value Th8 to the data monitoring unit 31 as vehicle state information C32.

[0199] Furthermore, instead of or in addition to the temperature sensor, the monitoring device 121 may be configured to communicate with a battery sensor that measures the output voltage of a battery mounted on the vehicle 1. The battery sensor measures the output voltage of the battery, for example, periodically or irregularly, and transmits battery information indicating the measurement results to the monitoring device 121.

[0200] In the monitoring device 121, the state monitoring unit 32 checks whether the battery output voltage indicated by the battery information received from the battery sensor via the in-vehicle communication unit 22 is equal to or greater than a threshold value Th9. If the output voltage is equal to or greater than the threshold value Th9, the state monitoring unit 32 outputs information indicating that the battery output voltage is equal to or greater than the threshold value Th9 to the data monitoring unit 31 as vehicle state information C32.

[0201] (Changing the contents of log information) When the data monitoring unit 31 receives vehicle state information C11, vehicle state information C12, vehicle state information C21, vehicle state information C22, vehicle state information C31 or vehicle state information C32 from the state monitoring unit 32, it includes a change request notification indicating a request to change the contents of the log information in the vehicle state information and transmits the same to the in-vehicle relay device 101 via the in-vehicle communication unit 22.

[0202] Referring again to Figure 3, for example, in the vehicle relay device 101, the control unit 15 changes the content of the log information to be sent to the monitoring device 121 based on at least one of the state of the vehicle 1, the detection result of the simple IDS processing unit 14, and the analysis result of the log information by the monitoring device 121.

[0203] (b1) When vehicle state information C11, C12 is received For example, when the control unit 15 receives the vehicle state information C11 or C12 from the monitoring device 121, the control unit 15 determines to transmit vehicle information, specifically, driving information related to the driving of the vehicle 1, as log information to the monitoring device 121. The driving information indicates the distance to the vehicle ahead, the direction of the vehicle ahead, the relative speed between the vehicle ahead and the vehicle 1, the vehicle speed of the vehicle 1, and the engine speed, etc. For example, the driving information is stored in a buffer of the limiter 16D.

[0204] When the log information transmission start timing Td arrives, the control unit 15 outputs to the selection unit 17 a transmission request notification S11 requesting that the driving information be transmitted as log information.

[0205] When the selector 17 receives a transmission request notification S11 from the controller 15, it extracts the driving information from the buffer of the limiter 16D. Then, the selector 17 creates one or more Ethernet frames including the extracted driving information and transmits them to the monitoring device 121.

[0206] (b2) When vehicle state information C21, C22 is received For example, when the control unit 15 receives vehicle state information C21 or vehicle state information C22 from the monitoring device 121, the control unit 15 decides to transmit vehicle information, specifically vehicle parking information related to the parking of the vehicle 1, as log information to the monitoring device 121. The vehicle parking information indicates the detection results of a sensor that detects the parking of the vehicle 1, images captured by a camera, and the detection results of a sensor that detects obstacles around the vehicle 1. For example, the vehicle parking information is stored in a buffer of the limiter 16D.

[0207] When the log information transmission start timing Td arrives, the control unit 15 outputs to the selection unit 17 a transmission request notification S12 requesting that the vehicle parking information be transmitted as log information.

[0208] When the selection unit 17 receives the transmission request notification S12 from the control unit 15, it extracts the vehicle parking information from the buffer of the limiter 16D. Then, the selection unit 17 creates one or more Ethernet frames including the extracted vehicle parking information and transmits them to the monitoring device 121.

[0209] (b3) When vehicle state information C31, C32 is received For example, when the control unit 15 receives the vehicle state information C31 or C32 from the monitoring device 121, the control unit 15 determines to transmit vehicle information, specifically, device information related to specific devices mounted on the vehicle 1, as log information to the monitoring device 121. The device information indicates the operating state of the cooling fan, the operating state of the engine, the temperature of the battery, the charging state of the battery, etc. For example, the device information is stored in a buffer of the limiter 16D.

[0210] When the log information transmission start timing Td arrives, the control unit 15 outputs to the selection unit 17 a transmission request notification S13 requesting that the device information be transmitted as log information.

[0211] When the selector 17 receives a transmission request notification S13 from the controller 15, it extracts the device information from the buffer of the limiter 16D. Then, the selector 17 creates one or more Ethernet frames including the extracted device information and transmits them to the monitoring device 121.

[0212] (b4) Detection Results of Detection Process K2 For example, the simple IDS processing unit 14 compares the calculation result of the estimated value of the bus load when various services such as theft prevention service and deviation prevention service are provided in the in-vehicle network 401 with a predetermined threshold value Th10. If the calculation result of the estimated value of the bus load is equal to or greater than the threshold value Th10, the simple IDS processing unit 14 determines that the bus load is abnormal. In this case, the simple IDS processing unit 14 outputs traffic abnormality information to the control unit 15 indicating that the bus load is abnormal and the CAN bus 51 corresponding to the bus load.

[0213] When the control unit 15 receives the traffic abnormality information from the simple IDS processing unit 14, it decides to transmit the load information on the bus load of the CAN bus 51 indicated by the traffic abnormality information to the monitoring device 121 as log information.

[0214] Also, for example, when the simple IDS processing unit 14 detects an abnormality in the operation of a host such as a processor of the vehicle-mounted relay device 101 as an event, it outputs host abnormality information to the control unit 15 indicating that the abnormality has been detected and the host in question.

[0215] When the control unit 15 receives the host abnormality information from the simple IDS processing unit 14, it decides to transmit the event information corresponding to the host indicated by the host abnormality information to the monitoring device 121 as log information.

[0216] (b5) Analysis result of log information When the control unit 15 receives a change request notification R1 from the monitoring device 121, the control unit 15 decides to transmit the type of log information indicated in the change request notification R1 to the monitoring device 121. Then, when the transmission start timing Td for the log information arrives, the control unit 15 outputs a transmission request notification S4 requesting the transmission of the type of log information to the selection unit 17.

[0217] [Operation Flow] Next, the operation flow of the in-vehicle system 301 according to the first embodiment of the present disclosure will be described with reference to the drawings.

[0218] FIG. 8 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the first embodiment of the present disclosure performs relay processing.

[0219] 8, first, the in-vehicle relay device 101 waits for reception of a CAN frame including monitoring target data from the in-vehicle device 202 or for the calculation period F to elapse (NO in step ST101 and NO in step ST105).

[0220] Then, when the in-vehicle relay device 101 receives a CAN frame from the in-vehicle device 202 (YES in step ST101), it copies the received CAN frame (step ST102).

[0221] Next, the vehicle-mounted relay device 101 performs relay processing of the received CAN frame (step ST103).

[0222] Next, the vehicle-mounted relay device 101 stores the copied CAN frame in the buffer of the limiter 16 corresponding to the CAN frame (step ST104).

[0223] Then, vehicle-mounted relay device 101 receives CAN frames, copies the CAN frames, performs relay processing, and stores the CAN frames (steps ST101 to ST104) until calculation period F has elapsed (NO in step ST105).

[0224] Next, when the calculation period F has elapsed (YES in step ST105), the in-vehicle relay device 101 performs the detection process K2. For example, as described above, the in-vehicle relay device 101 calculates an estimated value of the bus load on the source bus of the CAN frame (step ST106).

[0225] Next, the vehicle relay device 101 stores load information indicating the estimated value of the calculated bus load as log information in the memory unit 18 and the buffer of the limiter 16D (step ST107), and waits for the reception of a new CAN frame or the passage of the calculation period F (NO in step ST101 and NO in step ST105).

[0226] 9 is a flowchart illustrating an example of an operation procedure when the in-vehicle relay device 101 according to the first embodiment of the present disclosure performs a transmission process. FIG. 9 illustrates an operation when the in-vehicle relay device 101 performs Example 1 of the transmission process shown in FIG.

[0227] Referring to FIG. 9, first, the vehicle-mounted relay device 101 waits for the arrival of the transmission start timing indicated by the schedule information in the storage unit 18 (NO in step ST201).

[0228] Then, when the transmission start timing arrives (YES in step ST201), the vehicle relay device 101 transmits one or more Ethernet frames containing the monitored data or log information corresponding to that transmission start timing to the monitoring device 121 (step ST202), and waits for the arrival of the next transmission start timing (NO in step ST201).

[0229] 10 is a flowchart illustrating another example of an operation procedure when the in-vehicle relay device 101 performs a transmission process according to the first embodiment of the present disclosure. The flowchart illustrates the operation when the in-vehicle relay device 101 performs the transmission process example 2 shown in FIG. 5 .

[0230] Referring to FIG. 10, first, the vehicle-mounted relay device 101 waits for the arrival of the transmission start timing indicated by the schedule information in the storage unit 18 (NO in step ST301).

[0231] When the transmission start timing arrives (YES in step ST301), the vehicle-mounted relay device 101 checks whether the memory usage amount E is equal to or greater than the threshold value Th1 (step ST302).

[0232] Next, if the memory usage E is less than the threshold value Th1 (NO in step ST302), the vehicle relay device 101 transmits one or more Ethernet frames containing the monitored data or log information corresponding to the transmission start timing that has arrived to the monitoring device 121 (step ST303), and waits for the arrival of the next transmission start timing (NO in step ST301).

[0233] On the other hand, if the memory usage E is equal to or greater than the threshold value Th1 (YES in step ST302), the vehicle relay device 101 checks whether the transmission start timing that has arrived is the transmission start timing for the data to be monitored (step ST304).

[0234] Then, if the received transmission start timing is the transmission start timing of the monitored data (YES in step ST304), the vehicle relay device 101 suspends the transmission of the monitored data (step ST305) and transmits one or more Ethernet frames containing log information (step ST306).

[0235] Next, the vehicle relay device 101 transmits one or more Ethernet frames containing the monitored data whose transmission has been suspended to the monitoring device 121 at the original transmission start timing of the log information (step ST307), and waits for the arrival of the next transmission start timing (NO in step ST301).

[0236] On the other hand, if the received transmission start timing is not the timing to transmit monitored data, i.e., the timing to start transmitting log information (NO in step ST304), the vehicle relay device 101 transmits one or more Ethernet frames containing log information (step ST308) and waits for the arrival of the next transmission start timing (NO in step ST301).

[0237] 11 is a flowchart illustrating another example of an operation procedure when the in-vehicle relay device 101 performs a transmission process according to the first embodiment of the present disclosure. The flowchart illustrates the operation when the in-vehicle relay device 101 performs the transmission process example 3 shown in FIG. 6 .

[0238] Referring to FIG. 11, first, the vehicle-mounted relay device 101 waits for the arrival of the transmission start timing indicated by the schedule information in the storage unit 18 (NO in step ST401).

[0239] Then, when the transmission start timing arrives (YES in step ST401), the vehicle relay device 101 transmits one or more Ethernet frames containing the monitored data corresponding to the transmission start timing and one or more Ethernet frames containing log information to the monitoring device 121 (step ST402), and waits for the arrival of the next transmission start timing (NO in step ST401).

[0240] FIG. 12 is a flowchart illustrating an example of an operation procedure when the monitoring device according to the first embodiment of the present disclosure performs a process of monitoring monitoring target data.

[0241] 12, first, monitoring device 121 waits for reception of an Ethernet frame from vehicle-mounted relay device 101 (NO in step ST501).

[0242] When the monitoring device 121 receives an Ethernet frame from the vehicle-mounted relay device 101 (YES in step ST501), the monitoring device 121 checks whether or not the Ethernet frame contains data to be monitored (step ST502).

[0243] Next, when the received Ethernet frame contains monitoring target data (YES in step ST502), monitoring apparatus 121 checks whether the Ethernet frame contains a switching notification (step ST503).

[0244] If the received Ethernet frame contains a switching notification (YES in step ST503), the monitoring device 121 performs a switching process to switch the monitoring method for the monitored data. For example, as described above, the monitoring device 121 switches the monitoring method by switching the monitoring program (step ST504).

[0245] Next, the monitoring device 121 executes the switched monitoring program to monitor the monitoring target data (step ST505).

[0246] Next, when the monitoring device 121 detects an abnormality in the monitored data (YES in step ST506), the monitoring device 121 analyzes the cause of the abnormality. For example, as described above, the monitoring device 121 analyzes the cause of the abnormality by analyzing the log information transmitted from the vehicle-mounted relay device 101 (step ST507).

[0247] Next, the monitoring device 121 transmits abnormality detection information, including the type of monitored data in which the abnormality was detected and the analysis results of the log information, to the management server 171 via the external network 151 (step ST508), and waits to receive a new Ethernet frame from the vehicle relay device 101 (NO in step ST501).

[0248] On the other hand, if the received Ethernet frame does not contain the data to be monitored, i.e., the Ethernet frame contains log information (NO in step ST502), the monitoring device 121 stores the log information in the memory unit 25 (step ST509) and waits to receive a new Ethernet frame from the vehicle relay device 101 (NO in step ST501).

[0249] In addition, if the Ethernet frame received from the vehicle-mounted relay device 101 does not include a switching notification (NO in step ST503), the monitoring device 121 waits to receive a new Ethernet frame from the vehicle-mounted relay device 101 (NO in step ST501).

[0250] Furthermore, if the monitoring device 121 does not detect any abnormality in the monitoring target data (NO in step ST506), it waits for reception of a new Ethernet frame from the vehicle-mounted relay device 101 (NO in step ST501).

[0251] In the vehicle-mounted relay device 101 according to the first embodiment of the present disclosure, the log information transmitted by the selection unit 17 to the monitoring device 121 includes at least one of the load information indicating the detection result of the simple IDS processing unit 14 and the vehicle information, but is not limited to this. The log information may include information other than the load information and the vehicle information.

[0252] In addition, in the in-vehicle system 301 according to the first embodiment of the present disclosure, the in-vehicle relay device 101 is configured to perform a transmission process of transmitting a plurality of monitoring target data and log information to the monitoring device 121 in a time-division manner, but this is not limited to this. A device other than the in-vehicle relay device 101 in the in-vehicle network 401 may be configured to perform the transmission process.

[0253] Furthermore, in the in-vehicle system 301 according to the first embodiment of the present disclosure, the in-vehicle relay device 101 is configured to create the log information, but this is not limited to this. A device other than the in-vehicle relay device 101 in the in-vehicle network 401 may be configured to create the log information. In this case, the in-vehicle relay device 101 acquires the log information created by the other device and stores it in the buffer of the limiter 16D.

[0254] Furthermore, in the in-vehicle system 301 according to the first embodiment of the present disclosure, the monitoring device 121 is configured to analyze the cause of the abnormality using log information when it detects an abnormality in at least one of the plurality of monitoring target data, but this is not limited thereto. The monitoring device 121 may also be configured not to analyze the cause of the abnormality.

[0255] Furthermore, in the in-vehicle system 301 according to the first embodiment of the present disclosure, the monitoring device 121 is configured to switch the monitoring method for the monitoring target data depending on the type of monitoring target data transmitted from the in-vehicle relay device 101, but this is not limited to this. The monitoring device 121 may also be configured not to switch the monitoring method. In this case, for example, the monitoring device 121 monitors each type of monitoring target data by executing a monitoring program corresponding to one monitoring method.

[0256] Furthermore, in the in-vehicle system 301 according to the first embodiment of the present disclosure, the in-vehicle relay device 101 is configured to change the content of the log information to be transmitted to the monitoring device 121 based on at least one of the state of the vehicle 1, the detection result of the simple IDS processing unit 14, and the analysis result of the log information by the monitoring device 121, but this is not limited to this. The in-vehicle relay device 101 may be configured to transmit the same log information to the monitoring device 121 regardless of these pieces of information.

[0257] Next, other embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference numerals and their description will not be repeated.

[0258] <Second embodiment> In the above-described first embodiment of the present disclosure, in the in-vehicle system 301, the in-vehicle device 202 is connected to the in-vehicle relay device 101 via the CAN bus 51. In contrast, in the second embodiment of the present disclosure, the in-vehicle device 202 is connected to the in-vehicle relay device 101 via a transmission line that complies with a communication standard different from CAN. Other than the contents described below, the second embodiment is the same as the in-vehicle system 301 according to the first embodiment.

[0259] 13 is a diagram illustrating an example of the configuration of an in-vehicle system according to the second embodiment of the present disclosure. Referring to FIG. 13, the in-vehicle system 302 includes in-vehicle devices 202A, 202B, and 202C.

[0260] Each of the in-vehicle devices 202 is connected to the in-vehicle relay device 101 via an Ethernet cable 52 .

[0261] The vehicle-mounted relay device 101 includes communication ports 12A, 12B, 12C, and 12D, which are the communication port 12. The communication port 12A, the communication port 12B, the communication port 12C, and the communication port 12D are connected to the vehicle-mounted device 202A, the vehicle-mounted device 202B, the vehicle-mounted device 202C, and the monitoring device 121 via the Ethernet cable 52, respectively.

[0262] In the in-vehicle network 401, the in-vehicle devices 202 may be connected to the in-vehicle relay device 101 via a bus that complies with a communication standard such as CAN FD (CAN with Flexible Data Rate), FlexRay (registered trademark), MOST (Media Oriented System Transport) (registered trademark), LIN (Local Interconnect Network), and CXPI (Clock Extension Peripheral Interface), without being limited to the Ethernet cable 52.

[0263] Each in-vehicle device 202 transmits an Ethernet frame including various information such as monitoring target data to the in-vehicle relay device 101. In the following description, the Ethernet frame received from the in-vehicle device 202A, the Ethernet frame received from the in-vehicle device 202B, and the Ethernet frame received from the in-vehicle device 202C will also be referred to as Ethernet frame F1, Ethernet frame F2, and Ethernet frame F3, respectively.

[0264] The Ethernet frames F1, F2, and F3 are duplicated in the vehicle-mounted repeater 101. More specifically, the Ethernet frame F1 received at the communication port 11A is output to the limiter 16A and the repeater unit 13. The Ethernet frame F2 received at the communication port 11B is output to the limiter 16B and the repeater unit 13. The Ethernet frame F3 received at the communication port 11C is output to the limiter 16C and the repeater unit 13.

[0265] 3 , when the selector 17 in the on-board relay device 101 receives the transmission request notification S1 from the control unit 15, the selector 17 extracts one or more Ethernet frames F1 from the buffer of the limiter 16A. Then, the selector 17 transmits the extracted Ethernet frames F1 to the monitoring device 121.

[0266] Furthermore, when the selector 17 receives a transmission request notification S2 from the controller 15, it extracts one or more Ethernet frames F2 from the buffer of the limiter 16B. Then, the selector 17 transmits the extracted Ethernet frames F2 to the monitoring device 121.

[0267] Furthermore, when the selector 17 receives a transmission request notification S3 from the controller 15, it extracts one or more Ethernet frames F3 from the buffer of the limiter 16C. Then, the selector 17 transmits the extracted Ethernet frames F3 to the monitoring device 121.

[0268] Furthermore, when the selector 17 receives a transmission request notification S4 from the controller 15, it extracts one or more pieces of log information from the buffer of the limiter 16D. Then, the selector 17 creates an Ethernet frame including the extracted log information and transmits it to the monitoring device 121.

[0269] <Third embodiment> In the first embodiment of the present disclosure described above, the monitoring device 121 and the in-vehicle relay device 101 are separate devices. In contrast, in the third embodiment of the present disclosure, the monitoring device 121 is included in the in-vehicle relay device 101. Contents other than those described below are the same as those of the in-vehicle system 301 according to the first embodiment.

[0270] 14 is a diagram illustrating an example of the configuration of an in-vehicle relay device according to a third embodiment of the present disclosure. Referring to FIG. 14, in comparison with the in-vehicle relay device 101 illustrated in FIG. 3, the in-vehicle relay device 102 further includes a monitoring processing unit 19. The monitoring processing unit 19 includes a data monitoring unit 31 and a status monitoring unit 32. The relay unit 13, the simple IDS processing unit 14, the control unit 15, the limiter 16, the selection unit 17, and some or all of the monitoring processing unit 19 are realized, for example, by a processing circuit including one or more processors. The storage unit 18 is, for example, a non-volatile memory included in the processing circuit.

[0271] When the selector 17 retrieves one or more CAN frames Fa from the buffer of the limiter 16A, it outputs the monitoring target data A in the retrieved CAN frames Fa to the monitoring processor 19 .

[0272] Furthermore, when the selector 17 retrieves one or more CAN frames Fb from the buffer of the limiter 16B, it outputs the monitoring target data B in the retrieved CAN frame Fb to the monitoring processor 19 .

[0273] Furthermore, when the selector 17 retrieves one or more CAN frames Fc from the buffer of the limiter 16C, it outputs the monitoring target data C in the retrieved CAN frame Fc to the monitoring processor 19 .

[0274] Furthermore, when the selector 17 retrieves one or more pieces of log information from the buffer of the limiter 16D, it outputs the retrieved log information to the monitoring processor 19 .

[0275] <Fourth embodiment> In the first embodiment of the present disclosure described above, the monitoring device 121 is provided in the in-vehicle system 301. In contrast, in the fourth embodiment of the present disclosure, the monitoring device 121 is included in the management server 171 outside the vehicle 1. The fourth embodiment is similar to the communication system 501 according to the first embodiment except for the contents described below.

[0276] Fig. 15 is a diagram illustrating an example of the configuration of an in-vehicle system according to a fourth embodiment of the present disclosure. Referring to Fig. 15, an in-vehicle system 303 does not include the monitoring device 121, and includes an in-vehicle relay device 103 instead of the in-vehicle relay device 101, as compared to the in-vehicle relay device 101 illustrated in Fig. 3. The in-vehicle relay device 103 does not include the communication port 12.

[0277] 15, the in-vehicle device 202A is a TCU, and in the following description, the in-vehicle device 202A will also be referred to as a TCU 202A.

[0278] 1 and 15, TCU 202A communicates with management server 171 via external network 151 by using a wireless base station device (not shown), for example.

[0279] More specifically, when the TCU 202A receives a CAN frame including various information from the in-vehicle relay device 101, the TCU 202A transmits the various information to the management server 171 via the wireless base station device and the external network 151.

[0280] 16 is a diagram illustrating an example of the configuration of an in-vehicle relay device according to a fourth embodiment of the present disclosure. Referring to FIG. 16, in the in-vehicle relay device 103, the selector 17 retrieves one or more CAN frames Fa from the buffer of the limiter 16A, and transmits one or more Ethernet frames storing the monitoring target data A in the retrieved CAN frames Fa to the management server 171 via the relay unit 13 and the TCU 202A.

[0281] In addition, when the selection unit 17 retrieves one or more CAN frames Fb from the buffer of the limiter 16B, it transmits one or more Ethernet frames storing the monitored data B in the retrieved CAN frames Fb to the management server 171 via the relay unit 13 and the TCU 202A.

[0282] In addition, when the selection unit 17 retrieves one or more CAN frames Fc from the buffer of the limiter 16C, it transmits one or more Ethernet frames storing the monitored data C in the retrieved CAN frames Fc to the management server 171 via the relay unit 13 and the TCU 202A.

[0283] Furthermore, when the selector 17 retrieves one or more pieces of log information from the buffer of the limiter 16D, it creates one or more Ethernet frames including the retrieved log information and transmits them to the management server 171 via the relay unit 13 and the TCU 202A.

[0284] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0285] Each process (each function) in the above-described embodiments is realized by a processing circuit including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each process. The one or more processors may execute each process according to the program read from the one or more memories, or according to a logic circuit designed in advance to execute each process. The processor may be various processors suitable for computer control, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA, and an ASIC (Application Specific Integrated Circuit). The physically separated processors may cooperate with each other to execute the processes. For example, the processors installed in the physically separated computers may cooperate with each other via a network such as a local area network (LAN), a wide area network (WAN), or the Internet to execute the processes. The program may be installed in the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a compact disc read-only memory (CD-ROM), a digital versatile disc read-only memory (DVD-ROM), or a semiconductor memory, and installed in the memory from the recording medium.

[0286] The above description includes the following additional features: [Supplementary Note 1] An in-vehicle system mounted on a vehicle, comprising: a transmission data selection unit that transmits a plurality of pieces of monitoring target data; and a monitoring unit that monitors the plurality of pieces of monitoring target data received from the transmission data selection unit, wherein the transmission data selection unit transmits the plurality of pieces of monitoring target data and log information to the monitoring unit in a time-division manner, and when the monitoring unit detects an abnormality in at least one of the plurality of pieces of monitoring target data, the monitoring unit analyzes a cause of the abnormality based on the log information transmitted from the transmission data selection unit, and the monitoring unit transmits information indicating an analysis result of the cause of the abnormality to an external device outside the vehicle.

[0287] 1 Vehicle 11, 11A, 11B, 11C, 12, 12A, 12B, 12C, 12D, 21 Communication port 13 Relay unit 14 Simple IDS processing unit 15 Control unit 16, 16A, 16B, 16C, 16D Limiter 17 Selection unit 18, 25 Memory unit 19 Monitoring processing unit 22 In-vehicle communication unit 23 Out-vehicle communication unit 24 Processing unit 31 Data monitoring unit 32 Status monitoring unit 51, 51A, 51B, 51C CAN bus 52 Ethernet cable 101, 102, 103 In-vehicle relay device 121 Monitoring device 151 External network 171 Management server 202, 202A, 202B, 202C, 202D, 202E, 202F In-vehicle equipment 301, 302, 303 In-vehicle system 401 In-vehicle network 501 Communication system

Claims

1. An in-vehicle system mounted on a vehicle, comprising: a transmission data selection unit that transmits multiple pieces of monitoring target data; and a monitoring unit that monitors the multiple pieces of monitoring target data received from the transmission data selection unit, wherein the transmission data selection unit transmits the multiple pieces of monitoring target data and log information to the monitoring unit in a time-division manner.

2. The in-vehicle system of claim 1, wherein each of the plurality of monitoring target data transmitted by the transmission data selection unit is data to be transferred, and the log information includes the results of monitoring the monitoring target data before being transferred to the monitoring unit.

3. The in-vehicle system is an in-vehicle system as described in claim 1 or claim 2, which includes an in-vehicle relay device that receives the plurality of monitored data, copies each of the monitored data, and transmits the copied plurality of monitored data to the monitoring unit, and the in-vehicle relay device includes the transmission data selection unit, monitors the plurality of monitored data, and creates the log information.

4. An in-vehicle system as described in claim 2 or claim 3, wherein when the monitoring unit detects an abnormality in at least one of the plurality of monitored data, the monitoring unit analyzes the cause of the abnormality based on the log information transmitted from the transmission data selection unit.

5. An in-vehicle system according to any one of claims 1 to 4, wherein the monitoring unit switches the monitoring method for the monitoring target data depending on the type of the monitoring target data transmitted from the transmission data selection unit.

6. An in-vehicle system according to any one of claims 1 to 5, wherein the transmission data selection unit determines whether to transmit the log information based on the amount of memory used to store the log information before transmission to the monitoring unit.

7. An in-vehicle system as described in any one of claims 1 to 6, wherein the transmission data selection unit continuously transmits the log information using a portion of the bandwidth used to transmit each of the plurality of monitoring target data from the transmission data selection unit to the monitoring unit, and transmits each of the monitoring target data using a portion or all of the remaining bandwidth.

8. An in-vehicle system as described in any one of claims 1 to 7, wherein each of the plurality of monitored data transmitted by the transmission data selection unit is data to be transferred, and the transmission data selection unit changes the content of the log information to be transmitted to the monitoring unit based on at least one of the state of the vehicle, the results of monitoring the monitored data before being transferred to the monitoring unit, and the results of analysis of the log information in the monitoring unit.

9. The in-vehicle system according to any one of claims 1 to 8, wherein the log information includes information indicating the state of the vehicle.

10. A monitoring method in an in-vehicle system installed in a vehicle, comprising: a step of transmitting a plurality of pieces of monitoring target data; and a step of monitoring the received plurality of pieces of monitoring target data, wherein in the step of transmitting the monitoring target data, the plurality of pieces of monitoring target data and log information are transmitted in a time-division manner.

11. A monitoring program used in an in-vehicle system installed in a vehicle, the monitoring program causing a computer to function as: a transmission data selection unit that transmits multiple pieces of monitoring target data; and a monitoring unit that monitors the multiple pieces of monitoring target data received from the transmission data selection unit, wherein the transmission data selection unit transmits the multiple pieces of monitoring target data and log information to the monitoring unit in a time-division manner.

Images