VEHICLE CONTROL SYSTEM AND COMMUNICATION PROCESSING METHOD

A vehicle control system includes two control device groups respectively constituting two communication networks, a communication management device communicably connected to the two control device groups, and a routing device that routes communication between the two communication networks. When a message is received from one of control devices, the communication management device performs authentication processing for the control device and includes a communication address of one control device as a transmission source address in a relay message for relaying the message received from the one control device to a control device of the other of the control device groups, and the control device of the other of the control device groups performs communication with the one control device by using the communication address of the one control device included in the relay message without interposition of the communication management device.

INCORPORATION BY REFERENCE

The present application claims priority under 35 U.S.C. § 119 to Japanese Patent Application No. 2023-057225 filed on Mar. 31, 2023. The content of the application is incorporated herein by reference in its entirety.

BACKGROUND OF THE INVENTION

Field of the Invention

The present invention relates to a vehicle control system and a communication processing method to be executed by the vehicle control system.

Description of the Related Art

In recent years, research and development for improving safety of control in a vehicle have been performed.

International Publication No. WO2021/002010 discloses an illegal frame detection device that detects illegal frame transmission in an onboard network system adopting service-oriented communication and prevents establishment of illegal communication. In this device, illegal frame transmission is detected on the basis of relation between a server and a port to which a client is physically connected.

A problem in a technique related to safety of vehicle control is to achieve both high protectiveness against attacks on vehicle control and high responsiveness of vehicle control.

To solve the above-described problem, an object of the present application is to maintain high responsiveness of vehicle control while instantaneously detecting illegal communication from attackers on a vehicle control system and protecting the vehicle control system, and eventually, contribute to development of a sustainable transportation system by further improving traffic safety.

SUMMARY OF THE INVENTION

One aspect of the present invention is a vehicle control system including two control device groups respectively constituting two different communication networks mounted on a vehicle, a communication management device communicably connected to each of control devices of the two control device groups, and a routing device that routes communication between the two communication networks, wherein when a message is received from one of the control devices, the communication management device performs authentication processing for the one of the control devices, and when validity of the one of the control devices can be authenticated, transmits a relay message for relaying a message received from one control device that is a control device of one of the control device groups to a control device of the other of the control device groups, the relay message including a communication address of the one control device as a transmission source address, and wherein the control device of the other of the control device groups performs communication with the one control device via the routing device by using the communication address of the one control device included in the relay message without interposition of the communication management device.

According to another aspect of the present invention, when validity of the one of the control devices can be authenticated, the communication management device determines a communication address of the other control device with which the one control device should perform communication on the basis of device information of the respective control devices of the two control device groups, the other control device being the control device of the other of the control device groups, and the one control device being the control device of one of the control device groups that has transmitted the message and transmits a return message including the determined communication address of the other control device as a transmission source address to the one control device, and the one control device starts communication with the other control device via the routing device by using the communication address of the other control device included in the return message without interposition of the communication management device.

According to still another aspect of the present invention, one of the two control device groups includes a control device that performs control regarding motion control of the vehicle and does not include a control device that performs communication with outside of the vehicle, and the other of the two control device groups includes a control device that performs communication with outside of the vehicle and does not include a control device that performs control regarding motion control of the vehicle.

According to yet another aspect of the present invention, the communication management device includes two processing devices that perform processing independently from each other, and the two processing devices are respectively connected to different communication networks between the two communication networks.

According to another aspect of the present invention, the two processing devices are respectively physical machine and virtual machine to be implemented in a processor provided in the communication management device.

According to still another aspect of the present invention, communication to be performed by the control devices of the two control device groups and the communication management device is Service Oriented Middle warE over IP (SOME/IP) communication including transmission of a search notification and/or transmission of a provision notification, the search notification being a notification indicating that one of services, which are predetermined functional units, is searched for, the provision notification being a notification indicating that the service that is searched for can be provided.

According to yet another aspect of the present invention is a communication processing method to be executed by a vehicle control system including two control device groups respectively constituting two different communication networks mounted on a vehicle, a communication management device communicably connected to each of the control devices of the two control device groups, and a routing device that routes communication between the two communication networks, the communication processing method including an authentication processing step of, when a message is received from one of the control devices, the communication management device performing authentication processing for the one of the control devices, a relay transmission step of, when validity of the one of the control devices can be authenticated, the communication management device transmitting a relay message for relaying a message received from one control device that is a control device of one of the control device groups to a control device of the other of the control device groups, the relay message including a communication address of the one control device as a transmission source address, and a first direct communication step of the control device of the other of the control device groups performing communication with the one control device via the routing device by using the communication address of the one control device included in the relay message without interposition of the communication management device.

According to another aspect of the present invention, the communication processing method further includes a determination step of, when validity of the one of the control devices can be authenticated, the communication management device determining a communication address of the other control device with which the one control device should perform communication on the basis of device information of the respective control devices of the two control device groups, the other control device being the control device of the other of the control device groups, and the one control device being the control device of the one of the control device groups that has transmitted the message, a return transmission step of the communication management device transmitting a return message to the one control device, the return message including the determined communication address of the other control device as a transmission source address, and a second direct communication step of the one control device performing communication with the other control device via the routing device by using the communication address of the other control device included in the return message without interposition of the communication management device.

According to the aspect of the present invention, it is possible to maintain high responsiveness of vehicle control while instantaneously detecting illegal communication from attackers on a vehicle control system and protecting the vehicle control system.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

1. Configuration of Vehicle Control System

FIG.1is a view illustrating a configuration of a vehicle control system1according to one embodiment of the present invention. The vehicle control system1is mounted on a vehicle2and controls operation of the vehicle2. The vehicle2can be an arbitrary vehicle to be driven by an internal combustion and/or a motor. In the present embodiment, the vehicle2is, for example, an electric vehicle to be driven by a drive motor to which power is fed from an in-vehicle battery (both are not illustrated).

The vehicle control system1includes a first control device group3, a second control device group4and a communication management device5. In the present embodiment, the first control device group3does not include a control device that performs communication with outside of the vehicle2and includes a control device that performs control regarding motion control of the vehicle2. In the present embodiment, the first control device group3includes a drive electronic control unit (ECU)6a, a steering ECU6b, a battery ECU6c, and an advanced driver-assistance system (ADAS)-ECU6das control devices that perform control regarding motion control of the vehicle2.

The drive ECU6acontrols operation of the drive motor that drives the vehicle2, and the steering ECU6bcontrols operation of steering, deceleration, acceleration, and the like, of the vehicle2on the basis of manipulation regarding steering manipulation of a steering wheel, a brake, an accelerator, and the like, of the vehicle2. The battery ECU6cdetects a remaining amount of charge of the in-vehicle battery and controls operation of power feeding to the drive motor. Further, the ADAS-ECU6dcontrols driver assistance operation such as cruise operation, lane keeping operation, and the like, of the vehicle2. Hereinafter, the drive ECU6a, the steering ECU6b, the battery ECU6c, and the ADAS-ECU6dincluded in the first control device group3will be collectively referred to as an ECU6.

The second control device group4does not include a control device that performs control regarding motion control of the vehicle2and includes a control device that performs communication with outside of the vehicle2. In the present embodiment, the second control device group4includes a telematics control unit (TCU)7aand an in-vehicle infotainment (IVI)-ECU7bas control devices that perform communication with outside of the vehicle2. The TCU7ais a wireless communication device (transmitter/receiver, circuit) for performing communication with devices outside the vehicle2directly or indirectly via an external communication network. The IVI-ECU7breceives radio waves of radio broadcasting or TV broadcasting, and/or receives GPS radio waves, displays an image or a video to passengers of the vehicle2using an in-vehicle display device, speaker, and the like (both are not illustrated), and/or provides information of route guide, and the like.

Further, the second control device group4includes, for example, a driver monitoring camera (DMC)-ECU7cthat controls operation of a DMC which is provided inside a vehicle interior of the vehicle2and which is not illustrated. Hereinafter, the TCU7a, the IVI-ECU7b, and the DMC-ECU7cincluded in the second control device group4will be collectively referred to as an ECU7.

While the first control device group3and the second control device group4respectively include four or three control devices in the present embodiment, the first control device group3and the second control device group4only require to respectively include at least one control device.

Each of the ECU6and the ECU7includes a computer and performs predetermined control operation and communication with other in-vehicle devices.

The vehicle control system1further includes a routing device8. The routing device8has a hub function of communicably connecting between the control devices, and a routing function of routing communication across a plurality of communication networks constituted by these control devices.

Each ECU6of the first control device group3and a first processing device26provided in a communication management device5which will be described later are connected to the routing device8to constitute a first communication network9. Further, each ECU7of the second control device group4and a second processing device27provided in the communication management device5which will be described later are connected to the routing device8to constitute a second communication network10.

In the communication management device5, the first processing device26and the second processing device27cooperate to manage communication between the ECU6that is a control device of the first control device group3constituting the first communication network9and the ECU7that is a control device of the second control device group4constituting the second communication network10.

In the present embodiment, the ECU6, the ECU7, the first processing device26, and the second processing device27perform communication conforming to TCP/IP protocol in accordance with Ethernet® communication standards. Further, the first communication network9and the second communication network10are virtual local-area-networks (VLANs) different from each other. The routing device8is, for example, an L3 switch. The routing device8may be incorporated in the communication management device5.

In the present embodiment, the ECU6, the ECU7, the first processing device26, and the second processing device27, for example, perform communication conforming to Service Oriented Middle warE over IP (SOME/IP) specified in AUTomotive Open System ARchitecture (AUTOSAR).

Here, outline of SOME/IP communication that is the related art will be described.

FIG.10,FIG.11,FIG.12, andFIG.13are views for explaining the SOME/IP communication. The SOME/IP communication is used to, for example, achieve provision and reception of a service by establishing communication between one device41that requests provision of the service and another device41that can provide the service among a plurality of devices41that are connected to a hub40to constitute a communication network as illustrated inFIG.10.

Here, the service refers to each of functions and processing obtained by segmentalizing various kinds of operation (such as, for example, acquisition and provision of sensor data from a sensor such as a camera, control of a motor and an actuator and provision of state information) to be achieved by each device41executing an application program. Further, a device that receives provision of the service (specifically, provision of data relating to the service) will be referred to as a client device, and a device that provides the service will be referred to as a server device. InFIG.10, an arbitrary one device41among the plurality of devices41can become the client device, and the other one arbitrary device41can become the server device.

Each device41transmits various kinds of messages (SOME/IP messages) specified in SOME/IP on an IP packet specified by Ethernet.

Particularly, communication for searching for a device on a network that provides a service will be referred to as SOME/IP-SD (service discovery). SOME/IP-SD communication includes communication of a FindService message, an OfferService message, a SubscribeEventGroup message, an Event message, and a FieldNotification message which will be described later.

FIG.13is a view illustrating an example of a configuration of a head portion of a communication packet to be used in the SOME/IP-SD communication. In detail,FIG.13illustrates the head portion of the communication packet to be continuous with a MAC header (18 bytes) located at the head of an Ethernet® frame.

The communication packet includes an IP header, a UDP header, and a message (SOME/IP message) specified in the SOME/IP communication. Further, in the SOME/IP-SD communication, the SOME/IP message can include a SOME/IP header and a SOME/IP-SD header. The SOME/IP-SD header includes an Entries Array and an Options Array.

The IP header, the UDP header, the SOME/IP header, and the SOME/IP-SD header are publicly known, and thus, fields constituting these headers will not be described point by point, and only portion relating to characteristic operation of the vehicle control system1according to the present embodiment will be described for confirmation to simplify description to facilitate understanding.

A SourceAddress field in the IP header and a SourcePort in the UDP header respectively indicate an IP address and a communication port number of a transmission source device in this communication packet. Further, a DestinationAddress field in the IP header and a DestinationPort in the UDP header respectively indicate an IP address and a communication port number of a transmission destination device (reception device) in this communication packet. Here, the above-described IP address is a local IP address in a LAN (including a VLAN) to which the corresponding device is connected.

The transmission source device can designate an IP address (multicast address) specified in advance which indicates a plurality of transmission destination devices in a predetermined range and transmit the communication packet to the plurality of transmission destination devices through multicast transmission as well as can designate an IP address of a specific transmission destination device in the DestinationAddress field and transmit the communication packet through unicast transmission.

In a ServiceID field of the SOME/IP header, a service ID that identifies a service to be provided from the server device that transmits/receives this packet to the client device is set. Further, in a ClientID field, a device ID that identifies the client device that is to receive provision of the service is set. In a SessionID field, a session ID indicating that communication of this packet is part of a communication session regarding provision of the service identified by the service ID in the ServiceID field, to the device identified by the device ID in the ClientID field is set.

In a case of the SOME/IP-SD communication, in the ServiceID field and a MethodID field of the SOME/IP header, 0xFFFF and 0x8100 are respectively stored as dedicated values indicating that the communication is the SOME/IP-SD communication.

Further, in the ClientID field, in a case of transmission of the SOME/IP-SD message (for example, the FindService message, the OfferService message, the SubscribeEventGroup message, and a SubscribeEventGroupAck message), a fixed value of 0x0000 is set. Further, in a case of transmission of the SOME/IP message (for example, the Event message, the FieldNotification, a Request message, and the a Response message) other than the SOME/IP-SD message, a device ID that identifies the client device that is to receive provision of the service is set in the ClientID field. In the SessionID field, a session ID that distinguishes messages transmitted from the same device from other messages is set.

Further, an IPV4 Address field and a PortNumber field of the SOME/IP-SD header respectively indicate an IP address and a communication port number, which serve as a transmission source address of the SOME/IP-SD message. Note that when an IP packet that carries the SOME/IP message is communicated not in IPV4 but in IPV6, the IPV4 Address field described above is replaced with an IPV6 Address field. Hereinafter, the transmission source address indicated in the IPV4 Address field or the IPV6 Address field will be referred to as an Endpoint address.

FIG.11andFIG.12are sequence diagrams illustrating outline of communication protocol (SOME/IP communication protocol) in SOME/IP communication. InFIG.11andFIG.12, to facilitate understanding, an example will be described where a device A41athat is one of the plurality of devices41illustrated inFIG.10becomes the client device and a device B41bthat is one of the plurality of devices41becomes the server device.

In the example inFIG.11, the device A41arecognizes the device B41bas the server device that can provide a requested service and continues communication to request the device B41bto provide the service.

InFIG.11, first, the device A41atransmits a FindService message for searching for the server device that can provide the requested service through multicast transmission within a communication network (S600). By this means, the device A41abecomes the client device. The FindService message described above is received by all the devices41including the device B41b. Note that in the FindService message, a ServiceID for identifying the service requested by the device A41ais set in the ServiceID field of the SOME/IP-SD header portion.

The device B41bthat has received the FindService message described above determines that the device B41bcan provide the requested service and transmits, to the device A41a, an OfferService message for making a notification that the device B41bcan provide the service (S602). By this means, the device B41bbecomes the server device.

By the device A41areceiving the OfferService message that has been transmitted from the device B41b, the device A41arecognizes the device B41bas the server device that can provide the requested service. By this means, communication for providing and receiving the above-described service is established between the device A41aas the client device and the device B41bas the server device.

Subsequently, the device A41athat has received the OfferService message transmitted from the device B41btransmits to the device B41b, a SubscribeEventGroup message for requesting provision of the service (S604). The device B41btransmits to the device A41a, a SubscribeEventGroupAck message that is an acknowledgement in response to reception of the SubscribeEventGroup message from the device A41a(S606).

Thereafter, the device B41btransmits data regarding the requested service to the device A41aas an Event message or a FieldNotification message at a predetermined timing (S608, S610). Here, the Event message is a message to be used to transmit data when some kind of event occurs such as when a transmission timing at predetermined time intervals has come, and when a value of a predetermined data item has changed or updated. Further, the FieldNotification message is a message to be used to make a notification of information (such as, for example, transmission rate information of a camera image) that determines data transmission conditions, and the like, when the information has been changed.

FIG.12is a sequence diagram illustrating another example of the SOME/IP communication protocol. In the example inFIG.12, the device A41arecognizes the device B41bas the server device that can provide the requested service and then transmits a request for provision of the service to the device B41bat a timing at which the device A41adesires to request provision of the service, and the device B41bprovides the service as a response every time the request for provision is received. Note that inFIG.12, processing that is the same as the processing inFIG.11will be indicated with the same reference numerals as the reference numerals inFIG.11, and the description inFIG.11described above will be employed.

InFIG.12, after the FindService message and the OfferService message are exchanged between the device A41aand the device B41bin a similar manner toFIG.11, the device A41atransmits a Request message that is a request for provision of the service to the device B41b(S612). Then, the device B41btransmits data of the requested service to the device A41aon a Response message in response to reception of the Request message from the device A41a(S614). Thereafter, provision and reception of the above-described Request message and Response message are repeated between the device A41aand the device B41bat a timing at which the device A41arequests provision of the service (S616, S618).

Here, inFIG.11andFIG.12, while a communication session is started by the device A41aas the client device that requests the service transmitting the FindService message, the communication session may be started by transmission of the OfferService message from the device B41bthat becomes the server device without the FindService message being transmitted. In this case, the device B41bfirst transmits the OfferService message indicating that the device B41bcan provide a specific service through multicast transmission within a communication network. The device A41athat requires provision of the service among the devices41that have received this OfferService message becomes the client device by transmitting a SubscribeEventGroup message or a Request message to the device B41b.

3. Communication Management Device

When the communication management device5receives a message from a control device (the ECU6or the ECU7) of one of the first control device group3and the second control device group4, the communication management device5performs authentication processing on the control device.

Further, when validity of the control device that has transmitted the above-described message can be authenticated in the above-described authentication processing, the communication management device5generates and transmits a relay message for relaying the message (for example, the OfferService message) received from one control device (for example, the ECU6) that is a control device of one of the control device groups to a control device (for example, the ECU7) of the other of the control device groups. In this event, the communication management device5includes a communication address of the one control device in the relay message as a transmission source address.

This enables the control device of the other of the control device groups to perform communication with the one control device via the routing device8by using the communication address of the one control device included in the above-described relay message without interposition of the communication management device5.

Further, when validity of the control device that has transmitted the above-described message can be authenticated in the above-described authentication processing, the communication management device5determines a communication address of the other control device (for example, the ECU7) with which the one control device (for example, the ECU6) should perform communication on the basis of service information24(which will be described later) that is device information of the respective control devices, the other control device being the control device of the other of the control device groups, and the one control device being the control device of one of the control device groups that has transmitted the message (for example, the FindService message). Then, the communication management device transmits a return message (for example, the OfferService message) including the determined communication address of the other control device as the transmission source address to the one control device on behalf of the other control device.

By this means, the one control device can start communication with the other control device via the routing device8by using the communication address of the other control device included in the above-described return message without interposition of the communication management device5.

[3.1 Configuration of Communication Management Device]

A configuration of the communication management device5will be described.

Hereinafter, communication addresses respectively set in the SourceAddress field and the DestinationAddress field in the IP header of an IP packet that carriers a message will be respectively referred to as a “transmission source address of the IP packet” and a “transmission destination address of the IP packet”. Further, in the present specification, a communication address set in the IPV4 Address field (or the IPV6 Address field) in the SOME/IP-SD header of each of the SOME/IP-SD messages including the FindService message, the OfferService message, the SubscribeEventGroup message, and the SubscribeEventGroupAck message will be referred to as a “transmission source address of the message” or an “Endpoint address”. By this means, the transmission source address of the IP packet will be described in distinction from the transmission source address included in the message.

Referring toFIG.1, the communication management device5includes a processor20, a memory21, a first communication device22aand a second communication device22b.

The first communication device22aand the second communication device22bare respectively wired communication devices (transmitters/receivers, circuits) for the first processing device26and the second processing device27which will be described later to perform communication. The first communication device22aand the second communication device22bare respectively connected to the routing device8. The first processing device26and the second processing device27perform communication conforming to the SOME/IP communication standards via the routing device8by the first communication device22aand the second communication device22b. As described above, the first processing device26constitutes the first communication network9with each ECU6of the first control device group3, and the second processing device27constitutes the second communication network10with each ECU7of the second control device group4.

The memory21is, for example, constituted with a volatile and/or non-volatile semiconductor memory, and/or a hard disk device, or the like. In the memory21, identification information23and service information24are stored.

In the identification information23, a list of communication addresses (in the present embodiment, IP addresses, the same applies below) of legitimate ECU6and ECU7is stored as a legitimate address list. Further, in the service information24, a list of service IDs (service IDs of services that can be provided) of services that can be respectively provided by the ECU6and the ECU7is stored in association with the communication addresses of the ECU6and the ECU7. The service information24corresponds to device information for the respective control devices of the two control device groups in the present disclosure. The service information24further includes information as to whether each of the ECU6and the ECU7is a device that provides a service (that is, provides a service using the Event message and/or the FieldNotification message as illustrated inFIG.11) in response to reception of the SubscribeEventGroup message or a device that provides a service (that is, provides a service using the Response message as illustrated inFIG.12) in response to reception of the Request message.

The processor20is, for example, a computer including a CPU, and the like. The processor20may include a ROM in which a program is written, a RAM for temporarily storing data, and the like. Further, the processor20includes the first processing device26and the second processing device27as functional components or functional units.

The first processing device26and the second processing device27perform processing independently from each other and cooperate with each other to manage communication between the ECU6of the first control device group3that constitutes the first communication network9and the ECU7of the second control device group4that constitutes the second communication network10.

The first processing device26is, for example, implemented as a so-called physical machine by the processor20that is a computer executing a first program25aincluding an operating system (OS) stored in the memory21. Further, for example, the second processing device27is implemented as a so-called virtual machine by the processor20that is a computer executing a second program25bincluding the OS stored in the memory21.

By this means, the first processing device26and the second processing device27can operate as computers that are independent of each other.

Specifically, the first processing device26is implemented on hardware of the processor20within the processor20and starts operation by the processor20executing the first program25a. In this event, by the processor20executing the OS included in the first program25a, a virtual machine platform provided by the OS is formed within the processor20.

Then, by the processor20executing the second program25bon the above-described virtual machine platform, the second processing device27as the virtual machine is implemented.

In other words, the OS to be provided by the first program25ais a so-called host OS, and the OS to be provided by the second program25bis a so-called quest OS that is to be executed on the virtual machine platform provided by the host OS.

Note that the first program25aand the second program25bmay be stored in a computer-readable arbitrary storage medium.

The first processing device26includes a first authentication unit30and a first communication control unit31as functional components or functional units. These functional components are implemented by the processor20executing the above-described first program25a.

Further, the second processing device27includes a second authentication unit32and a second communication control unit33as functional components or functional units. These functional components are implemented by the processor20executing the above-described second program25b.

The first processing device26and the second processing device of the communication management device5cooperate with each other to perform authentication processing for one control device (for example, one ECU6or ECU7) of the first control device group3and the second control device4when a message is received from the control device.

Further, when validity of the control device can be authenticated in the above-described authentication processing, the first processing device26and the second processing device cooperate with each other to generate and transmit a relay message for relaying the message received from one control device that is a control device of one of the control device groups to a control device of the other of the control device groups. In this event, the first processing device26includes a communication address of the one control device in the relay message as a transmission source address.

Further, when validity of the control device can be authenticated in the above-described authentication processing, the first processing device26and the second processing device cooperate with each other to determine a communication address of the other control device with which the one control device should perform communication on the basis of the service information24that is device information of the respective control devices, the other control device being the control device of the other of the control device groups, and the one control device being the control device of the one of the control device groups that has transmitted the message (for example, the FindService message). Further, the first processing device26and the second processing device transmit a return message (for example, the OfferService message) including the determined communication address of the other control device as the transmission source address to the one control device on behalf of the other control device.

[3.2 Operation of Communication Management Device]

Next, operation of the first authentication unit30and the first communication control unit31of the first processing device26, and operation of the second authentication unit32and the second communication control unit33of the second processing device27will be described with reference to the sequence diagrams illustrated inFIG.2,FIG.3,FIG.4,FIG.5,FIG.6,FIG.7,FIG.8, andFIG.9illustrating eight examples of processing procedure in the vehicle control system1.

[3.2.1 First Example of Communication Procedure]

FIG.2is a first example of SOME/IP communication. The SOME/IP communication illustrated inFIG.2is started by being triggered by one ECU6of the first control device group3transmitting a FindService message through multicast transmission to request a specific service, and the ECU6transmits a Request message while determining one ECU7of the second control device group4that provides the above-described specific service and receives provision of the service from the ECU7using a Response message.

InFIG.2, first, one ECU6of the first control device group3which requests provision of a service (requested service) necessary for performing some kind of control regarding motion control of the vehicle2, transmits the FindService message for searching for a server device that can provide the requested service through multicast transmission within the first communication network9(S100). Hereinafter, the ECU6that has transmitted the FindService message will be referred to as a client ECU6.

The first authentication unit30of the first processing device26that has received the FindService message from the client ECU6executes first authentication processing for the client ECU6(S102). The first authentication unit30performs the above-described first authentication processing by determining whether or not the transmission source address of the message included in the received FindService message is included in the legitimate address list of the identification information23stored in the memory21. Note that the first authentication unit30finishes the processing illustrated inFIG.2when validity of the client ECU6cannot be authenticated in the first authentication processing (not illustrated inFIG.2).

Subsequently, the first communication control unit31of the first processing device26determines the ECU7that can provide the service requested by the client ECU6(S104). Specifically, the first communication control unit31acquires a service ID of the requested service from the ServiceID of the FindService message. Further, the first communication control unit31determines a communication address of the ECU7including the acquired service ID as the service ID of the service that can be provided with reference to the service information24stored in the memory21. Further, the first communication control unit31recognizes from the service information24that the above-described determined ECU7is a device that provides the service regarding the requested service in response to reception of a Request message (S106). Hereinafter, the ECU7that can provide the requested service will be referred to as a server ECU7.

Then, the first communication control unit31generates an OfferService message in which the communication address of the server ECU7is set as the Endpoint address on behalf of the determined server ECU7in response to the recognition regarding provision of the service by the server ECU7(S108) and returns the generated OfferService message to the client ECU6(S110). The client ECU6that has received the above-described OfferService message acquires the communication address of the server ECU7that is a communication partner from the Endpoint address of the received OfferService message (S112).

Subsequently, the client ECU6transmits a Request message to the server ECU7via the routing device8using the acquired communication address of the server ECU7as a transmission destination address of the IP packet without interposition of the first processing device26and the second processing device27of the communication management device5(S114). The server ECU7that has received the above-described Request message acquires the communication address of the client ECU6that is a communication partner from the transmission source address of the IP packet of the received Request message (S116).

Subsequently, the server ECU7transmits a Response message to the client ECU7via the routing device8using the acquired communication address of the client ECU6as a transmission destination address of the IP packet without interposition of the first processing device26and the second processing device27of the communication management device5(S118).

Thereafter, the client ECU6and the server ECU7repeat exchange of a Request message and a Response message directly via the routing device8by respectively using the communication addresses of each other acquired in step S112and step S116in accordance with the related art without interposition of the communication management device5(S120, S122).

Here, in the example illustrated inFIG.2, the client ECU6and the server ECU7respectively correspond to “one control device” and “the other control device with which the one control device should perform communication” in the present disclosure. Further, the FindService message transmitted in step S100and the OfferService message transmitted in step S110respectively correspond to a “message received from the one control device” and a “return message in response to the message received from the one control device” in the present disclosure.

Further, inFIG.2, step S102corresponds to an authentication processing step in the present disclosure, and step S104corresponds to a determination step. Further, step S108and step S110correspond to a return transmission step, and step S114, step S118, step S120, and step S122correspond to a second direct communication step.

[3.2.2 Second Example of Communication Procedure]

FIG.3is a second example of the SOME/IP communication. The SOME/IP communication illustrated inFIG.3is started by being triggered by one ECU6of the first control device group3transmitting a FindService message through multicast transmission to request a specific service, and the ECU6receives provision of the service using an Event message and/or a FieldNotification message from one ECU7of the second control device group4that provides the above-described specific service.

Note that inFIG.3, processing step that is the same as the processing step illustrated inFIG.2will be indicated with the same reference numerals as the reference numerals illustrated inFIG.2, and description regardingFIG.2described above will be employed.

In the example illustrated inFIG.3, the first communication control unit31of the first processing device26determines the server ECU7that can provide the requested service in step S104and then recognizes that the determined server ECU7is a device that provides the service regarding the requested service in response to reception of a SubscribeEventGroup message (in the accompanying drawings, abbreviated as “Subscribe” or “Subscribe message”) (S150). Then, the first communication control unit31transmits an OfferService message in which the communication address of the first processing device26itself is set as the Endpoint address to the client ECU6in response to the above-described recognition regarding provision of the service by the server ECU7in accordance with the related art (S152).

The client ECU6that has received this OfferService message transmits the SubscribeEventGroup message in which the communication address of the client ECU6itself is set as the Endpoint address to the first processing device26that is the transmission source of the above-described OfferService message in accordance with the related art (S154).

The first communication control unit31of the first processing device26generates a SubscribeEventGroup message in which the communication address of the client ECU6is set as the Endpoint address on behalf of the client ECU6that is the transmission source in response to reception of the above-described SubscribeEventGroup message (S156) and transmits the generated SubscribeEventGroup message to the server ECU7determined in step S104(S158).

The server ECU7receives the above-described SubscribeEventGroup message and acquires the communication address of the client ECU6that becomes a communication partner to which the service is to be provided from the Endpoint address of the received SubscribeEventGroup message (S160). The server ECU7transmits a SubscribeEventGroupAck message (in the accompanying drawings, abbreviated as “SubscribeAck”) to the first processing device26as an acknowledgement in response to the SubscribeEventGroup message transmitted in step S158(step S162).

The first communication control unit31of the first processing device26receives the SubscribeEventGroupAck message transmitted in step S162. The first communication control unit31transmits a SubscribeEventGroupAck message in which the communication address of the first processing device26itself is set as the Endpoint address to the client ECU6in response to reception of the above-described SubscribeEventGroupAck message in accordance with the related art (S164). This SubscribeEventGroupAck message is a response message in response to the SubscribeEventGroup message transmitted from the client ECU6in step S154.

Thereafter, the server ECU7can directly transmit a message to the client ECU6via the routing device8by using the communication address of the client ECU6acquired in step S160without interposition of the first processing device26and the second processing device27of the communication management device5. Thus, thereafter, the server ECU7transmits data regarding the service to be provided to the client ECU6using an Event message and/or a FieldNotification message at predetermined timings without interposition of the communication management device5, and the client ECU6receives these messages (S166, S168).

The client ECU6and the SubscribeEventGroup message transmitted in step S154in the example illustrated inFIG.3respectively correspond to “one control device” and a “message received from the one control device” in the present disclosure. Further, the SubscribeEventGroup message transmitted in step S158corresponds to a “relay message for relaying the message received from the one control device to the control device of the other of the control device groups” in the present disclosure.

Further, inFIG.3, step S156and step S158correspond to a relay transmission step in the present disclosure, and step S166and step S168correspond to a first direct communication step.

[3.2.3 Third Example of Communication Procedure]

FIG.4is a third example of the SOME/IP communication. The SOME/IP communication illustrated inFIG.4is started by being triggered by one ECU6of the first control device group3transmitting an OfferService message indicating that the ECU6can provide a specific service through multicast transmission, and the ECU6receives a Request message from one ECU7of the second control device group4that requires the above-described specific service and provides the service to the ECU7using a Response message.

InFIG.4, first, one ECU6of the first control device group3transmits an OfferService message indicating that the ECU6can provide a specific service through multicast transmission within the first communication network9(S200). Hereinafter, the above-described specific service will be referred to as a service to be provided, and the ECU6that has transmitted the above-described OfferService message will be referred to as the server ECU6.

The first authentication unit30of the first processing device26that has received the OfferService message from the server ECU6executes first authentication processing for the server ECU6(S202). The first authentication unit30finishes the processing illustrated inFIG.4when validity of the server ECU6cannot be authenticated in the first authentication processing (not illustrated inFIG.4).

Then, the first communication control unit31recognizes from the service information24that the server ECU6is a device that provides the service regarding the above-described service to be provided in response to reception of a Request message (S204).

The first communication control unit31generates an OfferService message in which the communication address of the server ECU6is set as the Endpoint address on behalf of the server ECU6that has transmitted the OfferService message in step S200in response to the recognition regarding provision of the service by the server ECU6(S206) and transmits the generated OfferService message to the respective ECUs7within the second communication network10through multicast transmission (S208).

In step S208, the OfferService message transmitted through multicast transmission is received by the respective ECUs7. One ECU7that requires the service to be provided (hereinafter, referred to as the client ECU7) indicated by the service ID of the OfferService message among the ECUs7within the second communication network10acquires the communication address of the server ECU6that is a communication partner from the Endpoint address of the OfferService message (S210).

The client ECU7transmits a Request message to the server ECU6using the acquired communication address of the server ECU6as a transmission destination address of the IP packet (S212). This Request message is received by the server ECU6via the routing device8without interposition of the first processing device26and the second processing device27of the communication management device5.

The server ECU6that has received the above-described Request message acquires the communication address of the client ECU7that is a communication partner from the transmission source address of the IP packet of the received Request message (S214). The server ECU6transmits a Response message to the client ECU7via the routing device8using the acquired communication address of the client ECU7as the transmission destination address of the IP packet without interposition of the first processing device26and the second processing device27of the communication management device5(S216).

Thereafter, the client ECU7and the server ECU6repeat exchange of a Request message and a Response message directly via the routing device8by respectively using the communication addresses of each other acquired in step S210and step S214without interposition of the communication management device5in accordance with the related art (S218, S220).

Here, in the example illustrated inFIG.4, the server ECU6and the OfferService message transmitted in step S200and received by the first processing device26respectively correspond to “one control device” and a “message received from the one control device” in the present disclosure. Further, the OfferService message transmitted in step S208corresponds to a “relay message for relaying the message to the control device of the other of the control device groups on the basis of the message received from the one control device” in the present disclosure.

Further, inFIG.4, step S202corresponds to an authentication processing step in the present disclosure, step S206and step S208correspond to a relay transmission step, and step S212, step S216, step S218, and step S220correspond to a first direct communication step.

[3.2.4 Fourth Example of Communication Procedure]

FIG.5is a fourth example of the SOME/IP communication. The SOME/IP communication illustrated inFIG.5is started by being triggered by one ECU6of the first control device group3transmitting an OfferService message indicating that the ECU6can provide a specific service through multicast transmission, and the ECU6provides the service to one ECU7of the second control device group4that requires the above-described specific service using an Event message and/or a FieldNotification message.

Note that inFIG.5, processing step that is the same as the processing step illustrated inFIG.4will be indicated with the same reference numerals as the reference numerals illustrated inFIG.4, and description regardingFIG.4described above will be employed.

In the example illustrated inFIG.5, the first communication control unit31of the first processing device26executes first authentication processing for the server ECU6in step S202and then recognizes from the service information24that the server ECU6is a device that provides the service regarding the service to be provided in response to reception of a SubscribeEventGroup message (S250).

Then, the first communication control unit31transmits an OfferService message in which the communication address of the first processing device26is set as the Endpoint address to the respective ECUs7within the second communication network10through multicast transmission in response to the above-described recognition regarding provision of the service by the server ECU6in accordance with the related art (S252).

The OfferService message transmitted in step S252through multicast transmission is received by the respective ECUs7. Among the ECUs7within the second communication network10, one ECU7that requires the service to be provided (hereinafter, referred to as the client ECU7) indicated by the service ID of the OfferService message transmits a SubscribeEventGroup message in which the communication address of the client ECU7itself is set as the Endpoint to the first processing device26that is the transmission source of the above-described OfferService message in accordance with the related art (S254).

The first communication control unit31of the first processing device26generates a SubscribeEventGroup message in which the communication address of the client ECU7is set as the Endpoint address in response to reception of the above-described SubscribeEventGroup message on behalf of the client ECU7that is the transmission source of the SubscribeEventGroup message (S256) and transmits the generated SubscribeEventGroup message to the server ECU6that is the transmission source of the OfferService message in step S200(S258).

The server ECU6receives the above-described SubscribeEventGroup message and acquires the communication address of the client ECU7that becomes a communication partner to which the service is to be provided from the Endpoint address of the received SubscribeEventGroup message (S260). The server ECU6transmits a SubscribeEventGroupAck message that is an acknowledgement in response to the SubscribeEventGroup message transmitted in step S258to the first processing device26that is the transmission source of the SubscribeEventGroup message in accordance with the related art (S262).

The first communication control unit31of the first processing device26receives the SubscribeEventGroupAck message transmitted in step S262. The first communication control unit31transmits a SubscribeEventGroupAck message in which the communication address of the first processing device26itself is set as the Endpoint address to the client ECU7in response to reception of the above-described SubscribeEventGroupAck message in accordance with the related art (S264). This SubscribeEventGroupAck message is a response message in response to the SubscribeEventGroup message transmitted by the client ECU7in step S254.

Thereafter, the server ECU6can directly transmit a message to the client ECU7via the routing device8by using the communication address of the client ECU7acquired in step S260without interposition of the first processing device26and the second processing device27of the communication management device5. Thus, thereafter, the server ECU6continuously transmits data regarding the service to be provided to the client ECU7at predetermined timings using an Event message and/or a FieldNotification message without interposition of the communication management device5, and the client ECU7receives these messages (S266, S268).

In the example illustrated inFIG.5, the client ECU7, the SubscribeEventGroup message to be transmitted in step S254, and the SubscribeEventGroup message to be transmitted in step S258respectively correspond to “one control device”, a “message received from the one control device” and a “relay message for relaying the message to the control device of the other of the control device groups on the basis of the message received from the one control device” in the present disclosure.

Further, inFIG.5, step S256and step S258correspond to a relay transmission step in the present disclosure, and step S266and step S268correspond to a first direct communication step.

[3.2.5 Fifth Example of Communication Procedure]

FIG.6is a fifth example of the SOME/IP communication. The SOME/IP communication illustrated inFIG.6is started by being triggered by one ECU7of the second control device group4transmitting a FindService message through multicast transmission to request a specific service, and the ECU7transmits a Request message while determining one ECU6of the first control device group3that provides the above-described specific service and receives provision of the service from the ECU6using a Response message.

InFIG.6, first, one ECU6of the second control device group4which requests provision of a specific service (requested service) for control operation, transmits a FindService message for searching for a server device that can provide the requested service through multicast transmission within the second communication network10(S300). The second processing device27within the second communication network10receives the above-described FindService message transmitted through multicast transmission. Hereinafter, the ECU7that has transmitted the above-described FindService message through multicast transmission will be referred to as a client ECU7.

The second authentication unit32of the second processing device27that has received the FindService message from the client ECU7executes second authentication processing for the client ECU7(S302). The second authentication unit32performs the above-described second authentication processing by determining whether or not a transmission source address of the message included in the received FindService message is included in the legitimate address list of the identification information23stored in the memory21. Note that the second authentication unit32finishes the processing illustrated inFIG.6when validity of the client ECU7cannot be authenticated in the second authentication processing (not illustrated inFIG.6).

Subsequently, the second communication control unit33of the second processing device27transfers the FindService message from the client ECU7to the first processing device26(S304).

The first communication control unit31of the first processing device26determines the ECU6that can provide the requested service requested by the client ECU7on the basis of the transferred FindService message (S306). Specifically, the first communication control unit31acquires a service ID of the above-described requested service from the ServiceID of the above-described FindService message. Then, the first communication control unit31determines the communication address of the ECU6including the acquired service ID as the service ID of the service that can be provided with reference to the service information24stored in the memory21. Further, the first communication control unit31recognizes from the service information24that the above-described determined ECU6is a device that provides the service regarding the requested service in response to reception of a Request message (S308). Hereinafter, the ECU6that can provide the requested service requested by the client ECU7will be referred to as a server ECU6.

Then, the first communication control unit31generates an OfferService message in which the communication address of the server ECU6is set as the Endpoint address on behalf of the determined server ECU6in response to the above-described recognition regarding provision of the service by the server ECU6(S310) and returns the generated OfferService message to the client ECU7(S312). The client ECU7that has received the above-described OfferService message acquires the communication address of the server ECU6that is a communication partner from the Endpoint address of the received OfferService message (S314).

Subsequently, the client ECU7transmits a Request message to the server ECU7via the routing device8using the acquired communication address of the server ECU6as a transmission destination address of the IP packet without interposition of the first processing device26and the second processing device27of the communication management device5(S316). The server ECU6that has received the Request message acquires the communication address of the client ECU7that is a communication partner from the transmission source address of the IP packet of the received Request message (S318).

Subsequently, the server ECU6transmits a Response message to the client ECU7via the routing device8using the acquired communication address of the client ECU7as a transmission destination address of the IP packet without interposition of the first processing device26and the second processing device27of the communication management device5(S320).

Thereafter, the client ECU7and the server ECU6repeat exchange of a Request message and a Response message directly via the routing device8by respectively using the communication addresses of each other acquired in step S314and step S318without interposition of the communication management device5in accordance with the related art (S322, S324).

Here, in the example illustrated inFIG.6, the client ECU7and the server ECU6respectively correspond to “one control device” and “the other control device with which the one control device should perform communication” in the present disclosure. Further, the FindService message transmitted in step S300and the OfferService message transmitted in step S312respectively correspond to a “message received from the one control device” and a “return message in response to the message received from the one control device” in the present disclosure.

Further, inFIG.6, step S302corresponds to an authentication processing step in the present disclosure, and step S306corresponds to a determination step. Still further, step S310and step S312correspond to a return transmission step, and step S316, step S320, step S322, and step S324correspond to a second direct communication step.

[3.2.6 Sixth Example of Communication Procedure]

FIG.7is a sixth example of the SOME/IP communication. The SOME/IP communication illustrated inFIG.7is started by being triggered by one ECU7of the second control device group4transmitting a FindService message through multicast transmission to request a specific service, and the ECU7receives provision of the service from one ECU6of the first control device group3that provides the above-described specific service using an Event message and/or a FieldNotification message.

Note that inFIG.7, processing step that is the same as the processing step illustrated inFIG.6will be indicated with the same reference numerals as the reference numerals inFIG.6, and description regardingFIG.6described above will be employed.

In the example illustrated inFIG.7, the first communication control unit31of the first processing device26determines the server ECU6that can provide the requested service in step S306and then recognizes from the service information24that the server ECU6is a device that provides the service regarding the requested service in response to reception of a SubscribeEventGroup message (S350). Then, the first communication control unit31transmits an OfferService message in which the communication address of the first processing device26itself is set as the Endpoint address to the client ECU7in response to the above-described recognition regarding provision of the service by the server ECU6in accordance with the related art (S352).

The client ECU7that has received this OfferService message transmits a SubscribeEventGroup message in which the communication address of the client ECU7itself is set as the Endpoint address to the first processing device26that is the transmission source of the above-described OfferService message in accordance with the related art (S354).

The first communication control unit31of the first processing device26generates a SubscribeEventGroup message in which the communication address of the client ECU7is set as the Endpoint address in response to reception of the above-described SubscribeEventGroup message on behalf of the client ECU7that is the transmission source of the SubscribeEventGroup message (S356) and transmits the generated SubscribeEventGroup message to the server ECU6determined in step S306(S358).

The server ECU6receives the above-described SubscribeEventGroup message and acquires the communication address of the client ECU7that becomes the communication partner to which the service is to be provided from the Endpoint address of the received SubscribeEventGroup message (S360). The server ECU6transmits a SubscribeEventGroupAck message to the first processing device26as an acknowledgement in response to the SubscribeEventGroup message transmitted in step S358(S362).

The first communication control unit31of the first processing device26receives the SubscribeEventGroupAck message transmitted in step S362. The first communication control unit31transmits a SubscribeEventGroupAck message in which the communication address of the first processing device26itself is set as the Endpoint address to the client ECU7in response to reception of the above-described SubscribeEventGroupAck message in accordance with the related art (S364). This SubscribeEventGroupAck message is a response message in response to the SubscribeEventGroup message transmitted by the client ECU7in step S354.

Thereafter, the server ECU7can directly transmit a message to the client ECU7via the routing device8by using the communication address of the client ECU7acquired in step S360without interposition of the first processing device26and the second processing device27of the communication management device5. Thus, thereafter, the server ECU6continuously transmits data regarding the service to be provided to the client ECU7at predetermined timings using an Event message and/or a FieldNotification message without interposition of the communication management device5, and the client ECU7receives these messages (S366, S368).

The client ECU7and the SubscribeEventGroup message to be transmitted in step S354in the example illustrated inFIG.7respectively correspond to “one control device” and a “message received from the one control device” in the present disclosure. Further, the SubscribeEventGroup message to be transmitted in step S358corresponds to a “relay message for relaying the message received from the one control device to the control device of the other of the control device groups” in the present disclosure.

Further, inFIG.7, step S356and step S358correspond to a relay transmission step in the present disclosure, and step S366and step S368correspond to a first direct communication step.

[3.2.7 Seventh Example of Communication Procedure]

FIG.8is a seventh example of the SOME/IP communication. The SOME/IP communication illustrated inFIG.8is started by being triggered by one ECU7of the second control device group4transmitting an OfferService message indicating that the ECU7can provide a specific service through multicast transmission, and the ECU7receives a Request message from one ECU6of the first control device group3that requires the above-described specific service and provides the service to the ECU6using a Response message.

InFIG.8, first, one ECU7of the second control device group4transmits an OfferService message indicating that the ECU7can provide a specific service through multicast within the second communication network10(S400). Hereinafter, the above-described specific service will be referred to as a service to be provided, and the ECU7that has transmitted the above-described OfferService message will be referred to as the server ECU7.

The second authentication unit32of the second processing device27that has received the OfferService message from the server ECU7executes second authentication processing for the server ECU7(S402). The second authentication unit32finishes the processing illustrated inFIG.8when validity of the server ECU7cannot be authenticated in the second authentication processing (not illustrated).

Subsequently, the second communication control unit33of the second processing device27transfers the OfferService message from the server ECU7to the first processing device26(S404).

The first processing device26receives the above-described OfferService message, and the first communication control unit31of the first processing device26recognizes from the service information24that the server ECU7is a device that provides the service regarding the service to be provided in response to reception of a Request message (S406).

Then, the first communication control unit31generates an OfferService message in which the communication address of the server ECU7is set as the Endpoint address in response to the above-described recognition regarding provision of the service by the server ECU7on behalf of the server ECU7that has transmitted the OfferService message in step S400(S408) and transmits the generated OfferService message to the respective ECUs6within the first communication network9through multicast transmission (S410).

The OfferService message transmitted through multicast transmission in step S410is received by the respective ECUs6. One ECU6(hereinafter, referred to as the client ECU6) that requires the service to be provided indicated by the service ID of the OfferService message among the ECUs6within the first communication network9acquires the communication address of the server ECU7that is a communication partner from the Endpoint address of the OfferService message (S412).

The client ECU6transmits a Request message to the server ECU7using the acquired communication address of the server ECU7(S414). This Request message is received by the server ECU6via the routing device8without interposition of the first processing device26and the second processing device27of the communication management device5.

The server ECU7that has received the above-described Request message acquires the communication address of the client ECU6that is a communication partner from the transmission source address of the IP packet of the received Request message (S416). The server ECU7transmits a Response message to the client ECU6via the routing device8using the acquired communication address of the client ECU6without interposition of the first processing device26and the second processing device27of the communication management device5(S418).

Thereafter, the client ECU6and the server ECU7repeat exchange of a Request message and a Response message directly via the routing device8by respectively using the communication addresses of each other acquired in step S412and step S416in accordance with the related art without interposition of the communication management device5(S420, S422).

In the example illustrated inFIG.8, the server ECU7and the OfferService message transmitted in step S400and received by the first processing device26respectively correspond to “one control device” and a “message received from the one control device” in the present disclosure. Further, the OfferService message transmitted in step S410corresponds to a “relay message for relaying the message to the control device of the other of the control device groups on the basis of the message received from the one control device” in the present disclosure.

Further, inFIG.8, step S402corresponds to an authentication processing step in the present disclosure, step S408and step s410correspond to a relay transmission step, and step S414, step S418, step S420, and step S422correspond to a first direct communication step.

[3.2.8 Eighth Example of Communication Procedure]

FIG.9is an eighth example of the SOME/IP communication. The SOME/IP communication illustrated inFIG.9is started by being triggered by one ECU7of the second control device group4transmitting an OfferService message indicating that the ECU7can provide a specific service through multicast transmission, and the ECU7provides the service to one ECU6of the first control device group3that requires the above-described specific service using an Event message and/or a FieldNotification message.

Note that inFIG.9, processing step that is the same as the processing step illustrated inFIG.8will be indicated with the same reference numerals as the reference numerals illustrated inFIG.8, and description regardingFIG.8described above will be employed.

In the example illustrated inFIG.9, the first communication control unit31of the first processing device26that has received the OfferService message transferred by the second communication control unit33of the second processing device27in step S404recognizes from the service information24that the server ECU7is a device that provides the service regarding the service to be provided in response to reception of a SubscribeEventGroup message (S450).

Then, the first communication control unit31transmits an OfferService message in which the communication address of the first processing device26is set as the Endpoint address to the respective ECUs6within the first communication network9through multicast transmission in response to the above-described recognition regarding provision of the service by the server ECU7in accordance with the related art (S452).

The OfferService message transmitted through multicast transmission in step S452is received by the respective ECUs6. One ECU6(hereinafter, referred to as the client ECU6) that requires the service to be provided indicated by the service ID of the OfferService message among the ECUs6within the first communication network9transmits a SubscribeEventGroup message in which the communication address of the client ECU6itself is set as the Endpoint address to the first processing device26that is the transmission source of the above-described OfferService message in accordance with the related art (S454).

The first communication control unit31of the first processing device26generates a SubscribeEventGroup message in which the communication address of the client ECU6is set as the Endpoint address in response to reception of the SubscribeEventGroup message transmitted in step S454on behalf of the client ECU6that is the transmission source of the SubscribeEventGroup message (S456) and transmits the generated SubscribeEventGroup message to the server ECU7that is the transmission source of the OfferService message in step S400(S458).

The server ECU7receives the above-described SubscribeEventGroup message and acquires the communication address of the client ECU6that becomes the communication partner to which the service is to be provided from the Endpoint address of the received SubscribeEventGroup message (S460). The server ECU6transmits a SubscribeEventGroupAck message that is an acknowledgement in response to the SubscribeEventGroup message transmitted in step S458to the first processing device26(S462).

The first communication control unit31of the first processing device26transmits a SubscribeEventGroupAck message in which the communication address of the first processing device26itself is set as the Endpoint address to the client ECU6in response to reception of the above-described SubscribeEventGroupAck message in accordance with the related art (S464). This SubscribeEventGroupAck message is a response message in response to the SubscribeEventGroup message transmitted by the client ECU6in step S454.

Thereafter, the server ECU7can directly transmit a message to the client ECU6via the routing device8by using the communication address of the client ECU6acquired in step S460without interposition of the first processing device26and the second processing device27of the communication management device5. Thus, thereafter, the server ECU7continuously transmits data regarding the service to be provided to the client ECU6at predetermined timings using an Event message and/or a FieldNotification message without interposition of the communication management device5, and the client ECU6receives these messages (S466, S468).

In the example illustrated inFIG.9, the client ECU6, the SubscribeEventGroup message transmitted in step S454, and the SubscribeEventGroup message transmitted in step S458respectively correspond to “one control device”, a “message received from the one control device”, and a “relay message for relaying the message to the control device of the other of the control device groups on the basis of the message received from the one control device” in the present disclosure.

Further, inFIG.9, step S456and step S458correspond to a relay transmission step in the present disclosure, and step S466and step S468correspond to a first direct communication step.

In the vehicle control system1having the above-described configuration, the first authentication processing for the ECU6and the second authentication processing for the ECU7are respectively executed in the first authentication unit30and the second authentication unit32. By this means, in the vehicle control system1, for example, even in a case where an attacker replaces one ECU6or ECU7with an illegal control device, it is possible to instantaneously detect this and prevent illegal communication relating to control from being performed.

Further, in addition to the above, in the vehicle control system1, after the first authentication processing or the second authentication processing is performed, control devices that become communication partners of each other are notified of one or both of communication addresses of the ECU6or the ECU7that is one control device and the ECU7or the ECU6that is the other control device with which the one control device should perform communication through a message transmitted by the communication management device5. Thus, after the first authentication processing or the second authentication processing is performed, the ECU6or the ECU7that is one control device and the ECU7or the ECU6that is the other control device can directly perform communication via the routing device8without interposition of the communication management device5. As a result, in the vehicle control system1, it is possible to maintain high responsiveness of vehicle control while appropriately protecting the vehicle control system1from illegal communication from attackers.

4. Other Embodiments

While in the above-described embodiment, the IP addresses in the SourceAddress field and the DestinationAddress field of the IP header are used as the communication addresses of the transmission source and the transmission destination of the IP packet, in addition to this, port numbers in the SourcePort field and the DestinationPort field of the UDP header may be used. Further, while in the above-described embodiment, the IP address in the IPV4 Address field (or the IPV6 Address field) of the SOME/IP-SD header is used as the Endpoint address of the SOME-IP communication message, in addition to this, a port number in the PortNumber field of the SOME/IP-SD header may be used.

Note that the present invention is not limited to the configuration of the above-described embodiment and can be carried out in various aspects within the scope not deviating from the gist.

5. Configurations to be Supported by the Above-Described Embodiment

The above-described embodiment supports the following configurations.

A vehicle control system including two control device groups respectively constituting two different communication networks mounted on a vehicle, a communication management device communicably connected to each of control devices of the two control device groups, and a routing device that routes communication between the two communication networks, wherein when a message is received from one of the control devices, the communication management device performs authentication processing for the one of the control devices, and when validity of the one of the control devices can be authenticated, transmits a relay message for relaying a message received from one control device that is a control device of one of the control device groups to a control device of the other of the control device groups, the relay message including a communication address of the one control device as a transmission source address, and wherein the control device of the other of the control device groups starts communication with the one control device via the routing device by using the communication address of the one control device included in the relay message without interposition of the communication management device.

According to the vehicle control system of configuration 1, it is possible to instantaneously detect illegal communication from attackers on the vehicle control system through authentication processing and protect the vehicle control system and after the authentication processing, enable direct communication between two control devices belonging to different communication networks without interposition of the communication management device by a notification of a transmission source address using a relay message, so that it is possible to maintain high responsiveness of vehicle control.

The vehicle control system according to configuration 1, in which when validity of the one of the control devices can be authenticated, the communication management device determines a communication address of the other control device with which the one control device should perform communication on the basis of device information regarding the respective control devices of the two control device groups, the other control device being the control device of the other of the control device groups, and the one control device being the control device of one of the control device groups that has transmitted the message, and transmits a return message including the determined communication address of the other control device as a transmission source address to the one control device, and the one control device starts communication with the other control device via the routing device by using the communication address of the other control device included in the return message without interposition of the communication management device.

According to the vehicle control system of configuration 2, illegal communication from attackers on the vehicle control system is detected instantaneously through authentication processing, and the vehicle control system is protected, and after the authentication processing, one control device is notified of a communication address of a communication partner of the one control device using a return message, which enables direct communication between two control devices belonging to different communication networks without interposition of the communication management device, so that it is possible to maintain high responsiveness of vehicle control.

The vehicle control system according to configuration 1 or 2, in which one of the two control device groups includes a control device that performs control regarding motion control of the vehicle and does not include a control device that performs communication with outside of the vehicle, and the other of the two control device groups includes a control device that performs communication with outside of the vehicle and does not include a control device that performs control regarding motion control of the vehicle.

According to the vehicle control system of configuration 3, the control device group that performs communication with outside of the vehicle, which is susceptible to attacks from outside of the vehicle is connected to a communication network different from a communication network to which the control device group regarding motion control of the vehicle belongs, and the communication management device connected to these two communication networks authenticates validity of a control device that tries to start communication. By this means, in the vehicle control system of configuration 3, it is possible to appropriately protect motion control of the vehicle from attacks from outside and further improve safety of vehicle control.

The vehicle control system according to any one of configurations 1 to 3, in which the communication management device includes two processing devices that perform processing independently from each other, and the two processing devices are respectively connected to different communication networks between the two communication networks.

According to the vehicle control system of configuration 4, the two independent processing devices respectively connected to the two communication networks cooperate to perform authentication operation in the communication management device and generate a relay message or a return message. Thus, in the vehicle control system of configuration 4, it is possible to make it difficult for operation of the communication management device to be disguised by attacks from attackers and further improve safety of vehicle control.

The vehicle control system according to configuration 4, in which the two processing devices are respectively physical machine and virtual machine to be implemented in a processor provided in the communication management device.

According to the vehicle control system of configuration 5, two processing devices that perform processing independently from each other are implemented in one processor provided in the communication management device, so that it is possible to improve safety of vehicle control without making a hardware configuration of the communication management device complicated.

The vehicle control system according to any one of configurations 1 to 5, in which communication to be performed by the control devices of the two control device groups and the communication management device is Service Oriented Middle warE over IP (SOME/IP) communication including transmission of a search notification and/or transmission of a provision notification, the search notification being a notification indicating that one of services, which are predetermined functional units, is searched for, the provision notification being a notification indicating that the service that is searched for can be provided.

According to the vehicle control system of configuration 6, it is possible to instantaneously detect illegal communication from attackers and protect the vehicle control system and maintain high responsiveness of vehicle control in SOME/IP communication that can efficiently achieve complicated coordinated operation of a plurality of control devices.

A communication processing method to be executed by a vehicle control system including two control device groups respectively constituting two different communication networks mounted on a vehicle, a communication management device communicably connected to each of control devices of the two control device groups, and a routing device that routes communication between the two communication networks, the communication processing method including an authentication processing step of, when a message is received from one of the control devices, the communication management device performing authentication processing for the one of the control devices, a relay transmission step of, when validity of the one of the control devices can be authenticated, the communication management device transmitting a relay message for relaying a message received from one control device that is a control device of one of the control device groups to a control device of the other of the control device groups, the relay message including a communication address of the one control device as a transmission source address, and a first direct communication step of the control device of the other of the control device groups performing communication with the one control device via the routing device by using the communication address of the one control device included in the relay message without interposition of the communication management device.

According to the communication processing method of configuration 7, it is possible to instantaneously detect illegal communication from attackers on the vehicle control system through authentication processing and protect the vehicle control system, and after the authentication processing, enable direct communication between two control devices belonging to different communication networks without interposition of the communication management device by a notification of the transmission source address using the relay message, so that it is possible to maintain high responsiveness of vehicle control.

The communication processing method according to configuration 7, further including a determination step of, when validity of the one of the control devices can be authenticated, the communication management device determining a communication address of the other control device with which the one control device should perform communication on the basis of device information of the respective control devices of the two control device groups, the other control device being the control device of the other of the control device groups, the one control device being the control device of one of the control device groups that has transmitted the message, a return transmission step of the communication management device transmitting a return message to the one control device, the return message including the determined communication address of the other control device as a transmission source address, and a second direct communication step of the one control device performing communication with the other control device via the routing device by using the communication address of the other control device included in the return message without interposition of the communication management device.

According to the communication processing method of configuration 8, illegal communication from attackers on the vehicle control system is instantaneously detected through authentication processing, and the vehicle control system is protected, and after the authentication processing, one control device is notified of a communication address of a communication partner of the one control device using a return message, which enables direct communication between two control devices belonging to different communication networks without interposition of the communication management device, so that it is possible to maintain high responsiveness of vehicle control.

REFERENCE SIGNS LIST