JP7031568B2 - In-vehicle network system - Google Patents

Description

The present disclosure relates to an in-vehicle network system.

The vehicle data acquisition device described in Patent Document 1 connects a vehicle network connection portion and a vehicle network while the vehicle is stopped, and disconnects the vehicle network connection portion and the vehicle network while the vehicle is running. .. As a result, the vehicle data acquisition device acquires vehicle data while the vehicle is stopped with a relatively low communication load, and suppresses an increase in the communication load during traveling with a relatively high communication load.

Japanese Unexamined Patent Publication No. 2015-101114

In recent years, with the increase in the number of control devices mounted on vehicles, it is considered insufficient to control the communication load of the in-vehicle network system, and a highly flexible in-vehicle network system that can add control devices and change the network configuration is desired. It is rare. However, if the flexibility of the vehicle-mounted network system is increased, a malicious control device can easily participate in the vehicle-mounted network system, which may reduce the safety of the vehicle-mounted network system.

The present disclosure has been made in view of the above circumstances, and an object of the present disclosure is to provide an in-vehicle network system having both flexibility and safety.

One aspect of the present disclosure is an in-vehicle network system (500) mounted on a vehicle, which includes a controller (50), a plurality of switches (51, 52, 53), and a group of control devices (11 to 13, 21 to 11). 25) and. The controller controls the in-vehicle network system according to the OpenFlow protocol. The plurality of switches are connected to the controller via the first communication line (70), and perform processing in response to an instruction from the controller. The plurality of switches are connected to each other by a second communication line (80) according to the Ethernet (registered trademark) protocol. The control device group includes a plurality of control devices, and is connected to each of the plurality of switches via a third communication line (100, 200, 300). When the power state of the vehicle is the ignition on, the controller limits the reconstruction of the communication route between the control devices more while the vehicle is running than when the vehicle is stopped.

According to the in-vehicle network system of the present disclosure, since the open flow protocol is used, it is possible to flexibly cope with the addition of a control device and the like. On the other hand, normally, the addition of the control device is performed while the ignition-on vehicle is stopped and not while the vehicle is running. Therefore, the request for reconstructing the communication route while traveling is more likely to be a request from a malicious control device than the request for reconstructing the communication route while the vehicle is stopped. Therefore, the controller imposes more restrictions on the reconstruction of the communication route while the vehicle is running than when it is stopped. As a result, the safety of the in-vehicle network system and, by extension, the safety of the vehicle can be improved. Therefore, it is possible to realize an in-vehicle network system that has both flexibility and safety.

It is a figure which shows the structure of an in-vehicle network system. It is a flowchart which shows the reconstruction process of a communication route executed by a controller. It is a figure which shows an example which accepts the addition request of a new ECU while the vehicle is stopped. It is a figure which shows an example which refuses to join a new ECU while a vehicle is running. It is a figure which shows an example which accepts the request of the communication route change from the ECU related to safety. It is a sequence diagram which shows the procedure of accepting the request of the communication route change from the ECU related to safety, and reconstructing a communication route. It is a figure which shows an example which rejects a request of a communication route change from an ECU which is not concerned with safety. It is a figure which shows an example which accepts the change request of the communication route which is not related to safety from the ECU which is not related to safety. It is a figure which shows an example which an external device requests a new subscription. It is a figure which shows the structure of the conventional in-vehicle network system.

Hereinafter, embodiments for carrying out the present disclosure will be described with reference to the drawings.
<1. Configuration>
First, the configuration of the in-vehicle network system (hereinafter, network system) 500 according to the present embodiment will be described with reference to FIG.

The network system 500 includes a controller 50, first to third switches 51 to 53, ECUs 11 to 13, and ECUs 21 to 25.
The controller 50 functions as a controller in an open flow protocol including a storage unit such as a CPU, ROM, RAM, and semiconductor memory, and I / O and the like. The controller 50 controls the network system 500 according to the OpenFlow protocol.

The first to third switches 51 to 53 include a storage unit such as a CPU, ROM, RAM, and semiconductor memory, an I / O, and the like, and function as a switch in an open flow protocol. The first to third switches 51 to 53 execute processing in response to a command from the controller 50. The controller 50 and each of the first to third switches 51 to 53 are connected by a flow control communication line 70. As a result, the OpenFlow message is transmitted and received between the controller 50 and the first to third switches 51 to 53 according to the OpenFlow protocol. In the present embodiment, the flow control communication line 70 corresponds to the first communication line.

Further, the first switch 51 and the second switch 52, the first switch 51 and the third switch 53, and the second switch 52 and the third switch 53 are connected by an Ethernet communication line 80, respectively. Has been done. The Ethernet communication line 80 is a communication line for transmitting a frame according to the Ethernet protocol. Ethernet is a registered trademark. In this embodiment, the Ethernet communication line 80 corresponds to the second communication line.

The ECUs 11 to 13 and the ECUs 21 to 25 are control devices that execute different controls such as an engine ECU, a brake ECU, an automatic operation ECU, an air conditioner ECU, an in-vehicle lamp ECU, and a meter ECU.

The ECUs 11 to 13 and the ECUs 21 to 25 include the first control device group of the ECUs 11 and 21, 22 and the second control device group of the ECUs 12, 23 and 24, and the third control of the ECUs 13 and 25 according to the mounting position in the vehicle. It is divided into a group of devices. ECUs whose mounting positions are close to each other belong to each control device group.

Further, ECUs 11 to 13 and ECUs 21 to 25 are each ranked based on their importance in functional safety. Then, the controller 50 classifies the ECUs 11 to 13 and the ECUs 21 to 25 into a domain 1 related to driving safety and a domain 2 not related to driving safety based on the assigned rank. For example, an engine ECU, a brake ECU, and an automatic driving ECU belong to domain 1. For example, the air conditioner ECU, the in-vehicle lamp ECU, and the meter ECU belong to the domain 2. In this embodiment, ECUs 11 to 13 belong to domain 1, and ECUs 21 to 25 belong to domain 2. Further, the ECUs 11 to 13 belonging to the domain 1 correspond to the first control device, and the ECUs 21 to 25 belonging to the domain 2 correspond to the second control device.

The ECUs 11, 1, 2 and 22 of the first control device group are connected to the first switch 51 by the CAN communication line 100. The CAN communication line is a communication line for transmitting a frame according to the CAN protocol. CAN is a registered trademark. The ECUs 12, 23, and 24 of the second control device group are connected to the second switch 52 by the Ethernet communication line 200. The ECUs 13 and 25 of the third control device group are connected to the third switch 53 by the Ethernet communication line 300. In this embodiment, the CAN communication line 100 and the Ethernet communication lines 200 and 300 correspond to the third communication line.

That is, the network system 500 is configured by applying the OpenFlow protocol to a network system in which an Ethernet network and a CAN network are mixed. As described above, by applying the OpenFlow protocol to the network system 500, it becomes easy to add or change the ECU to the network system 500, and it is possible to flexibly reconstruct the communication route. Further, the controller 50 can ensure the safety of the network system 500 by appropriately controlling the construction of the communication route.

On the other hand, FIG. 10 shows a network system 510 to which the OpenFlow Procol is not applied. In the network system 510, the ECUs 11, 1, 22 of the first control device group are connected to the Ethernet_ECU 151 by the CAN signal line 110. Further, the ECUs 12, 23, and 24 of the second control device group are connected to the Ethernet_ECU 152 by the Ethernet communication line 210. Further, the ECUs 13 and 25 of the third control device group are connected to the Ethernet_ECU 153 by the Ethernet communication line 310. The Ethernet_ECUs 151 to 153 are connected to each other by the Ethernet communication line 170. The Ethernet_ECUs 151 to 153 function as a relay device that relays the Ethernet frame.

There are static routing and dynamic routing as rules that can be adopted in the network system 510. In static routing, fixed addresses are assigned to all ECUs of the network system 510, fixed addresses are stored in all ECUs, and routing routes are stored in advance. In dynamic routing, each ECU collects information individually according to the Ethernet protocol to dynamically construct a network.

When static routing is adopted for the network system 510, it is difficult for a malicious ECU to participate by spoofing, so that the security of the network system 510 is increased. However, when the ECU is changed or a new ECU is added, it is necessary to rewrite the routing route or the like stored in the other ECU, which is troublesome and reduces the flexibility of the network system 510.

Further, when the dynamic routing is adopted for the network system 510, it is easy to change the ECU or add a new ECU, and the flexibility of the network system 510 is increased. However, since a malicious ECU can easily participate in the network system 510, the safety of the network system 510 is lowered. That is, unlike the network system 500, it is difficult for the network system 510 to achieve both safety and flexibility.

<2. Processing>
Next, the process of reconstructing the communication route executed by the controller 50 will be described with reference to the flowchart of FIG. The controller 50 receives power from the vehicle-mounted battery and executes the communication route reconstruction process not only when the power state is the ignition on but also when the ignition is off.

First, in S10, the controller 50 collects the state of the network system 500. Specifically, the controller 50 transmits an information acquisition open flow message to the first to third switches 51 to 53. When the first to third switches 51 to 53 acquire the information acquisition open flow message from the controller 50, the first to third switches 51 to 53 transmit the open flow message including the information according to the request to the controller 50. The controller 50 builds a communication route according to the collected network state.

Subsequently, in S20, the controller 50 waits for a request for reconstructing the communication route from the ECUs 11 to 13 and the ECUs 21 to 26.
Subsequently, in S30, the controller 50 determines whether or not there is a communication route reconstruction request from the ECUs 11 to 13 and the ECUs 21 to 26 via the first to third switches 51 to 53. If there is no reconstruction request, the process returns to S10, and if there is a reconstruction request, the process proceeds to S40.

In S40, the controller 50 determines whether or not to accept the reconstruction request. If the controller 50 accepts any reconstruction request, the malicious ECU can easily participate in the network system 500, and the safety of the network system 500 is lowered. As a result, the driving safety of the vehicle may be reduced. On the other hand, if the controller 50 rejects any restructuring request, the flexibility of the network system 500 is reduced.

Therefore, the controller 50 determines whether or not to accept the reconstruction request by using a predetermined rule in consideration of both the safety and flexibility of the network system 500. Specifically, the controller 50 recognizes the power state of the vehicle, that is, whether the ignition is off and the battery power state or the ignition is on. Then, when the power state is the ignition on, the restriction on the reconstruction of the communication route is increased while the vehicle is running than when the vehicle is stopped.

Further, for the reconstruction request from the ECUs 21 to 25 belonging to the domain 2, the restriction on the reconstruction of the communication route is increased as compared with the reconstruction request from the ECUs 11 to 13 belonging to the domain 1.

Further, in response to a request for reconstructing a communication route related to ECUs 11 to 13 belonging to domain 1, reconstruction of a communication route is performed rather than in response to a request for reconstructing a communication route not related to ECUs 11 to 13 belonging to domain 1. Increase the restrictions.

Further, the controller 50 classifies the ECUs 11 to 13 and the ECUs 21 to 25 into an ECU connected to the outside by communication and an ECU not connected to the outside by communication. The ECU connected to the outside by communication is, for example, a data communication module (that is, DCM) that communicates with an external information center. Then, for the reconstruction request from the ECU connected to the outside by communication, the restriction of reconstruction is increased more than to the reconstruction request from the ECU not connected to the outside by communication.

In addition, for the request to reconstruct the communication route related to the ECU connected by communication to the outside, the restriction of reconstruction is increased more than to the request to reconstruct the communication route not related to the ECU connected to the outside by communication. ..

Further, for a reconstruction request from an ECU that is performing communication that deviates from the communication pattern registered in advance, rather than a reconstruction request from an ECU that is performing communication that does not deviate from the communication pattern. Increase the restrictions on the reconstruction of communication routes. Normally, in the network system 500, each ECU performs a fixed communication with a fixed ECU, so that the communication pattern of each ECU is predetermined.

The communication pattern includes the correspondence between each of the ECUs 11 to 13 and the ECUs 21 to 25 and the communication amount of the communication performed by each of the ECUs 11 to 13 and the ECUs 21 to 25. Further, the communication pattern includes a correspondence relationship between each of the ECUs 11 to 13 and the ECUs 21 to 25 and an ID (that is, an identifier) of a message transmitted from each of the ECUs 11 to 13 and the ECUs 21 to 25. IDs are assigned to the messages sent and received in the network system 500 for each type of message.

For example, when the difference in the amount of communication is equal to or greater than the threshold value, the controller 50 determines that the communication patterns are divergent. Further, the controller 50 determines that the communication patterns are different when the message IDs are different.

Further, when the power state is the ignition off, that is, the battery power state, the vehicle is in an unmanned state, so that there are more restrictions on the communication rooton reconstruction request than in the case of the ignition on. A specific example of determining whether or not to accept a reconstruction request will be described later.

If it is determined in S40 that the reconstruction request is rejected, the process returns to the process of S10, and if it is determined that the reconstruction request is accepted, the process proceeds to the process of S50.
In S50, the controller 50 determines an alternative route to replace the communication route to be reconstructed.

Subsequently, in S60, the controller 50 instructs the first to third switches 51 to 53 of the alternative route determined in S50. As a result, communication between the ECUs is performed using an alternative route instead of the communication route that is the target of reconstruction. After the processing of S60 is completed, the process returns to the processing of S10.

<3. Judgment of acceptance of reconstruction request>
Next, a specific example of determining whether or not to accept the reconstruction request will be described.
FIG. 3 shows a network system 500 when the ECU 24 connected to the second switch 52 is replaced with the ECU 26 connected to the third switch 53 while the vehicle is stopped when the power supply state is the ignition on.

Normally, the replacement of the ECU and the installation of a new ECU are performed by a dealer or the like while the ignition is stopped. When the ECU is replaced or a new ECU is installed, the controller 50 is required to reconstruct the communication route so that the replaced ECU or the new ECU can communicate with another ECU.

As shown in FIG. 3, before the change from the ECU 24 to the ECU 26, the communication target of the ECU 24 is the ECU 22, and a communication route from the ECU 24 to the ECU 22 via the second switch 52 and the first switch 51 is constructed. Therefore, when the ECU 24 is changed to the ECU 26, the communication route constructed so that the ECU 26 and the ECU 22 can communicate is changed to the communication route from the ECU 26 to the ECU 22 via the third switch 53 and the first switch 51. There is a need. Therefore, the ECU 26 requests the controller 50 to reconstruct the communication route via the third switch 53.

The controller 50 permits such a rebuild request that occurs during the stoppage when the ignition is turned on, and constructs an alternative route. As a result, repairs and repairs at the dealer are not hindered.

Next, FIG. 4 shows a network system 500 when the ECU 26 is connected to the third switch 53 during traveling in the case of ignition on.
In general, it is unlikely that a new ECU will be added to the network system 500 while the vehicle is running. If a new ECU is added to the network system 500 while driving, there is a high possibility that it is being attacked by a malicious ECU.

Therefore, the controller 50 refuses to join the new ECU 26 to the network system 500 while the vehicle is running when the ignition is turned on, and refuses communication from the ECU 26 to the third switch 53 to which the new ECU 26 is connected. Instruct. The third switch 53 permits only the communication from the existing ECUs 13 and 25 according to the instruction from the controller 50, and discards the communication from the ECU 26.

FIG. 5 shows a network system 500 when a failure occurs in the Ethernet communication line 80 connecting the second switch 52 and the third switch 53. In the network system 500, the communication target of the ECU 13 is the ECU 12, and as a communication route between the ECU 13 and the ECU 12, the shortest communication route via the third switch 53 and the second switch 52 is constructed.

If a failure occurs in the Ethernet communication line 80 connecting the second switch 52 and the third switch 53, the ECU 13 and the ECU 12 cannot communicate with each other through the existing communication route. Here, the ECU 12 is a sensor ECU that controls sensors such as a camera, infrared rays, and radar, and the ECU 13 is an automatic operation ECU that operates based on sensor information. The ECU 13 cannot communicate with the ECU 12, and cannot operate when the sensor information from the ECU 12 is interrupted. If the ECU 13 becomes inoperable, the running safety of the vehicle may be impaired.

Therefore, the controller 50 accepts the request for reconstructing the communication route related to the ECU 12 belonging to the domain 1 from the ECU 13 belonging to the domain 1 regardless of whether the vehicle is running or stopped when the ignition is turned on. Then, the controller 50 determines an alternative route from the ECU 13 to the ECU 12 via the third switch 53, the first switch 51, and the second switch 52 in this order, and determines the alternative route from the first to third switches 51 to 53. Instruct to. As a result, communication between the ECU 13 and the ECU 12 is maintained.

FIG. 6 shows a processing sequence when a failure occurs in the communication path between the ECU 12 (that is, the first ECU) and the ECU 13 (that is, the second ECU) and an alternative route is constructed.
In S100, the ECU 12 transmits communication data to the second switch 52. Subsequently, in S110, the second switch 52 transmits communication data to the third switch 53. Subsequently, in S120, the third switch 53 transmits communication data to the ECU 13.

Subsequently, in S130, the ECU 13 transmits a message requesting transmission of communication data to the third switch 53. Subsequently, in S140, the third switch 53 transmits a message to the second switch 52. Subsequently, in S150, the second switch 52 transmits a message to the ECU 12.

After the processing of S150, when a failure occurs in the Ethernet communication line 80 connecting the second switch 52 and the third switch 53, the second switch 52 notifies the controller 50 of the communication path abnormality in S160. In S170, the third switch 53 notifies the controller 50 of the communication path abnormality.

In S180, the ECU 12 transmits communication data to the second switch 52. Subsequently, in S190, since the communication route has not been reconstructed yet, the second switch 52 tries to transmit the communication data to the third switch 53, but the communication data disappears due to the disconnection of the communication path.

Subsequently, in S200, since the ECU 13 does not receive the communication data even after a lapse of a predetermined time after transmitting the message requesting the transmission of the communication data, the interruption of the communication data is confirmed. Subsequently, in S210, the ECU 13 requests the controller 50 to change the communication route.

Subsequently, in S220, the controller 50 accepts the communication route change request. Subsequently, in S230, the controller 50 instructs the first switch 51 to change the communication route. In S240, the controller 50 instructs the second switch 52 to change the communication route. In S250, the controller 50 instructs the third switch 53 to change the communication route.

In S260, the ECU 12 transmits communication data to the second switch 52. Subsequently, in S270, the second switch 52 transmits communication data to the first switch 51 instead of the third switch 53 in accordance with the communication route change instruction from the controller 50. Subsequently, in S280, the first switch 51 transmits communication data to the third switch 53. Subsequently, in S290, the third switch 53 transmits communication data to the ECU 13. As a result, the communication data is transmitted from the ECU 12 to the ECU 13 by bypassing the disconnected communication path.

Next, FIG. 7 is a diagram showing a network system 500 when the ECU 25 belonging to the domain 2 requests the reconstruction of the communication route related to the ECU belonging to the domain 1.
If the request to change the communication route between the ECU 12 and the ECU 13 from the EUC 25, which is unrelated to the communication between the ECU 12 and the ECU 13, is permitted, the communication between the ECU 12 and the ECU 13 may be disturbed. Further, as shown in FIG. 5, when a failure occurs in the communication path between the ECU 12 and the ECU 13, either the ECU 12 or the ECU 13 should request the reconstruction of the communication route. When the ECU 25 requests a change in the communication route between the ECU 12 and the ECU 13 unrelated to the ECU 25, it is highly possible that the ECU 25 has been tampered with. Therefore, the controller 50 rejects the request for reconstructing the communication route between the ECU 12 and the ECU 13 from the ECU 25.

Further, if the request for constructing a new communication route with the ECU 13 from the ECU 25 is permitted, the processing of the ECU 13 may be hindered. If the processing of the ECU 13 belonging to the domain 1 is hindered during traveling, the traveling safety of the vehicle may be impaired. Therefore, the controller 50 rejects the request for constructing a new communication route from the ECU 25 to the ECU 13 while traveling, and permits the request for constructing the new communication route while the ignition is on.

That is, the controller 50 rejects the request from the ECU belonging to the domain 2 to reconstruct the communication route related to the ECU belonging to the domain 1 while traveling.
FIG. 8 shows a network system 500 when the ECU 21 belonging to the domain 2 fails. The ECU 21 is a vehicle speed sensor ECU, and the ECU 23 is an ECU having GPS information. The ECU 25 is a meter ECU, and displays the speed per hour based on the vehicle speed information of the ECU 21.

If the ECU 21 fails, the ECU 25 cannot communicate with the ECU 21 and cannot acquire vehicle speed information from the ECU 21. Therefore, the ECU 25 requests the controller 50 to change the communication route in order to acquire GPS information similar to the vehicle speed information from the ECU 23.

Here, the controller 50 accepts a request for changing a communication route not related to the ECU belonging to the domain 1 from the ECU belonging to the domain 2. Since the communication route from the ECU 25 to the ECU 23 via the third switch 53 and the second switch 52 is not related to the ECUs 11 to 13 belonging to the domain 1, the controller 50 accepts the request for changing the communication route. Then, the controller 50 constructs an alternative route and instructs the second switch 52 and the third switch 53 of the alternative route. As a result, the ECU 25 can maintain the speed display.

FIG. 9 shows a network system 500 when the external terminal 60 is connected to the third switch 53.
The external terminal 60 is a mobile communication device such as a smartphone, a notebook pad, or a notebook computer. Normally, the external terminal 60 is connected to the network system 500 and requests the construction of a communication route with the ECU belonging to the domain 2 in order to operate functions not related to driving safety such as in-vehicle audio.

When the ignition is turned on, the controller 50 accepts the request and constructs the communication route when the external terminal 60 requests the construction of the communication route with the ECU belonging to the domain 2, regardless of whether the vehicle is running or stopped. ..

On the other hand, when the external terminal 60 requests the construction of a communication route related to the ECU belonging to the domain 1, the external terminal 60 may have been tampered with. Therefore, when the ignition is turned on, the controller 50 rejects the request when the external terminal 60 requests the construction of the communication route related to the ECU belonging to the domain 1, regardless of whether the vehicle is running or stopped. .. That is, the controller 50 does not build a communication route related to the ECU belonging to the domain 1.

Further, the controller 50 rejects the request for reconstructing the communication route from the ECU connected to the outside by communication while traveling.
Further, the controller 50 rejects the request for reconstructing the communication route related to the ECU connected to the outside by communication while traveling.

Further, the controller 50 refuses to join the new ECU to the network system 500 when the power supply state is the ignition off. Further, the controller 50 refuses to join the external terminal 60 to the network system 500 when the power state is the ignition off.

<4. Effect>
According to the present embodiment described above, the following effects can be obtained.
(1) Since the network system 500 uses an open flow protocol, it can flexibly cope with the addition of an ECU or the like. On the other hand, normally, the addition of the ECU is performed while the vehicle is stopped when the ignition is on, and is not performed while the vehicle is running. Therefore, the request for reconstructing the communication route while traveling is more likely to be a request from a malicious ECU than the request for reconstructing the communication route while the vehicle is stopped. Therefore, the controller 50 limits the reconstruction of the communication route more during traveling than during stopping. As a result, the safety of the network system 500 and, by extension, the safety of the vehicle can be improved. Therefore, it is possible to realize a network system 500 that has both flexibility and safety.

(2) While driving, the controller 50 refuses to join the new ECU, and the first to third switches 51 to 53 discard the communication from the new ECU, thereby improving the safety of the network system 500. can.

(3) The request for reconstructing the communication route from the ECUs 21 to 25 belonging to the domain 2 does not hinder the running safety even if the request is not permitted. On the other hand, if the request for reconstructing the communication route from the ECU belonging to the domain 1 is not permitted, the driving safety may be hindered. Therefore, the request for reconstructing the communication route from the ECUs 21 to 25 belonging to the domain 2 is restricted more than the request for reconstructing the communication route from the ECUs 11 to 13 belonging to the domain 1. As a result, it is possible to enjoy convenience while ensuring the safety of the vehicle.

(4) If a request for reconstructing a communication route related to ECUs 11 to 13 belonging to domain 1 is received from a malicious ECU, there is a possibility that driving safety will be impaired. On the other hand, even if the request for reconstructing the communication route not related to the ECUs 11 to 13 belonging to the domain 1 is received from the malicious ECU, the traveling safety is not hindered. Therefore, the safety of the vehicle can be improved by increasing the restrictions on the request for reconstructing the communication route related to the ECUs 11 to 13 more than the request for reconstructing the communication route not related to the ECUs 11 to 13. You can enjoy the convenience while guaranteeing it.

(5) When a failure occurs in the communication route related to the ECUs 11 to 13 belonging to the domain 1, the communication route is reconstructed if the ECU 11 to 13 issues a request to reconstruct the communication route. On the other hand, when a request for reconstructing the communication route related to the ECUs 11 to 13 is issued from the ECUs 21 to 25 belonging to the domain 2, there is a possibility that the malicious ECU is requesting the reconstruction of the irrelevant communication route. be. Further, by permitting the request for reconstruction, the processing of the ECUs 11 to 13 may be hindered. Therefore, while traveling, the request from the ECUs 21 to 25 to reconstruct the communication route related to the ECUs 11 to 13 is rejected. This makes it possible to ensure the safety of the vehicle.

(6) The communication route from the external terminal 60 not related to the ECUs 11 to 13 belonging to the domain 1 is constructed, and the communication route related to the ECUs 11 to 13 from the external terminal 60 is not constructed. As a result, a non-malicious external terminal 60 can be connected to the network system 500 and used, and when a malicious external terminal 60 is connected to the network system 500, an attack from the external terminal 60 can be prevented. can. Therefore, it is possible to enjoy convenience while ensuring the safety of the vehicle.

(7) An ECU that is connected to the outside by communication has a higher risk of being attacked than an ECU that is not connected to the outside by communication. Therefore, the request for reconstructing the communication route from the ECU connected to the outside by communication is more restricted than the request to reconstruct the communication route from the ECU not connected to the outside by communication. As a result, it is possible to enjoy the convenience while ensuring the safety of the network system 500 and thus the safety of the vehicle.

(8) The request for reconstructing the communication route related to the ECU connected to the outside by communication is restricted more than the request to reconstruct the communication route not related to the ECU connected to the outside by communication. As a result, it is possible to enjoy the convenience while ensuring the safety of the network system 500 and thus the safety of the vehicle.

(9) While traveling, the safety of the vehicle can be improved by rejecting the request for reconstructing the communication route from the ECU connected to the outside by communication.
(10) While traveling, the safety of the vehicle can be improved by rejecting the request for reconstructing the communication route related to the ECU connected to the outside by communication.

(11) When the ECU performs communication deviating from the communication pattern stored in advance in the storage unit of the controller 50, it is highly possible that the ECU has been tampered with. Therefore, the request for reconstructing the communication route from the ECU is more restricted than the request for reconstructing the communication route from the ECU performing communication that does not deviate from the communication pattern. As a result, it is possible to enjoy the convenience while ensuring the safety of the network system 500 and thus the safety of the vehicle.

(12) Normally, in the network system 500, since each ECU performs a fixed communication with a fixed ECU, the communication amount does not differ significantly from the fixed communication amount. Therefore, there is a high possibility that the ECU performing communication with a communication amount deviating from the stored communication amount has been tampered with.

(13) Normally, in the network system 500, each ECU transmits a fixed message to a fixed ECU. Therefore, it is highly possible that the ECU that transmits a message different from the stored message has been tampered with.

(14) When the ignition is on, the driver or the like is in the vehicle, but when the ignition is off, the vehicle is unmanned. When a request to reconstruct the communication route is made when the vehicle is unmanned, it is malicious compared to the case where a request to reconstruct the communication route is made while the driver or the like is in the vehicle. There is a high possibility that it is an attack. Therefore, in the case of the ignition off, the convenience can be enjoyed while ensuring the safety of the network system 500 by increasing the restrictions on the request for reconstructing the communication route as compared with the case of the ignition on. ..

(15) When the ignition is turned off, the new ECU and the external terminal 60 are refused to join the network system 500. As a result, convenience can be enjoyed while ensuring the safety of the network system 500.

(Other embodiments)
Although the embodiment for carrying out the present disclosure has been described above, the present disclosure is not limited to the above-described embodiment, and can be variously modified and carried out.

(A) In the above embodiment, the network system 500 includes three first to third switches 51 to 53, but may include four or more switches. Further, each of the first to third switches 51 to 53 and the first to third control device groups may be connected by a CAN communication line or an Ethernet communication line.

(B) A plurality of functions possessed by one component in the above embodiment may be realized by a plurality of components, or one function possessed by one component may be realized by a plurality of components. .. Further, a plurality of functions possessed by the plurality of components may be realized by one component, or one function realized by the plurality of components may be realized by one component. Further, a part of the configuration of the above embodiment may be omitted. Further, at least a part of the configuration of the above embodiment may be added or replaced with the configuration of the other above embodiment.

11-13, 21-25 ... ECU, 50 ... controller, 51 ... 1st switch, 52 ... 2nd switch, 53 ... 3rd switch, 60 ... external terminal, 70 ... flow control communication line, 80 ... Ethernet communication line , 100 ... CAN communication line, 200, 300 ... Ethernet communication line, 500 ... In-vehicle network system.

Claims (16)

An in-vehicle network system (500) mounted on a vehicle.
A controller (50) that controls the in-vehicle network system according to the OpenFlow protocol, and
A plurality of switches that are connected to the controller via the first communication line (70) and execute processing in response to an instruction from the controller, and the switches that are different from each other follow the Ethernet (registered trademark) protocol. With a plurality of switches (51, 52, 53) connected by the second communication line (80),
A control device group including a plurality of control devices, which are connected to each of the plurality of switches via a third communication line (100, 200, 300) (11 to 13, 21 to 25). And, with
When the power state of the vehicle is the ignition on, the controller makes more restrictions on the reconstruction of the communication route between the control devices while the vehicle is running than when the vehicle is stopped.
In-vehicle network system. The controller
Refusing to join the new control device to the in-vehicle network system while the vehicle is running.
The in-vehicle network system according to claim 1. The controller
The control device included in the in-vehicle network system includes a first control device (11 to 13) related to the running safety of the vehicle and a second control device (21 to 25) not related to the running safety of the vehicle. Classified into
The request for reconstructing the communication route from the second control device has more restrictions on the reconstruction than the request for reconstructing the communication route from the first control device.
The vehicle-mounted network system according to claim 1 or 2. The controller
The control device included in the in-vehicle network system is classified into a first control device related to the running safety of the vehicle and a second control device not related to the running safety of the vehicle.
For the request for rebuilding the communication route related to the first control device, the limitation of rebuilding is increased as compared with the request for rebuilding the communication route not related to the first control device.
The vehicle-mounted network system according to any one of claims 1 to 3. The controller
While the vehicle is running, the request from the second control device to reconstruct the communication route related to the first control device is rejected.
The vehicle-mounted network system according to claim 3 or 4. The controller
The communication route related to the first control device from the external terminal (60) newly participating in the in-vehicle network system is not constructed.
The vehicle-mounted network system according to any one of claims 3 to 5. The controller
The control device included in the in-vehicle network system is classified into a third control device connected to the outside by communication and a fourth control device not connected to the outside by communication.
The request for reconstructing the communication route from the third control device has more restrictions on the reconstruction than the request for reconstructing the communication route from the fourth control device.
The vehicle-mounted network system according to any one of claims 1 to 6. The controller
The control device included in the in-vehicle network system is classified into a third control device connected to the outside by communication and a fourth control device not connected to the outside by communication.
For the request for rebuilding the communication route related to the third control device, the limitation of rebuilding is increased as compared with the request for rebuilding the communication route not related to the third control device.
The vehicle-mounted network system according to any one of claims 1 to 7. The controller
While the vehicle is running, the request for reconstructing the communication route from the third control device is rejected.
The vehicle-mounted network system according to claim 7. The controller
While the vehicle is running, the request for reconstructing the communication route related to the third control device is rejected.
The vehicle-mounted network system according to claim 8. A storage unit for storing each communication pattern of the control device connected to the plurality of switches is provided.
The controller
In response to a request for reconstructing a communication route from the control device that performs communication deviating from the communication pattern stored in the storage unit, the control device that does not perform communication deviating from the communication pattern More restrictions on rebuilding than on request to rebuild communication routes
The present invention according to any one of claims 1 to 10. The communication pattern includes a correspondence relationship between each of the control devices and each communication amount of the control device.
The vehicle-mounted network system according to claim 11. An identifier is assigned to each message type sent from the control device.
The communication pattern includes a correspondence between each of the control devices and an identifier of a message transmitted from each of the control devices.
The vehicle-mounted network system according to claim 11. The controller
Recognizing the power state, when the power state is the ignition off, there are more restrictions on the request for rebuilding the communication route than when the ignition is on.
The vehicle-mounted network system according to any one of claims 1 to 13. The controller
When the power state is the ignition off, the new control device and the external terminal are refused to join the in-vehicle network system.
The vehicle-mounted network system according to claim 14. The external terminal is a mobile communication device.
The vehicle-mounted network system according to claim 6 or 15.

Images