JP7724962B2 - relay device - Google Patents

Description

This application relates to a relay device.

In recent years, vehicles have become increasingly connected, and there are an increasing number of situations in which they connect to external servers and use services from outside the vehicle. Integrated Electronic Control Units (ECUs) have emerged that function as controllers for multiple functions, such as collecting information for autonomous driving, controlling the vehicle's driving and cruise control, and acting as the master for software updates via OTA (Over the Air). Therefore, vehicles are equipped with relay devices that relay and transfer data between the integrated ECU, other on-board ECUs, and servers.

In-vehicle networks connecting ECUs within a vehicle must achieve optimal data transfer with no data loss and guaranteed real-time performance using a fixed amount of communication resources (line speed, bandwidth, buffers, etc.). Communication resources cannot be changed unless relay devices and line cables are replaced. However, frequent replacement is not realistic for vehicles. Therefore, it is considered common for in-vehicle networks to transfer communication data with parameter values (cycle, data size, etc.) within a pre-designed range. In this context, to maintain optimal data transfer, it is necessary to prevent unexpected traffic from entering the network.

In an in-vehicle network that provides connected car services including an integrated ECU, the TCU (Telematics Control Unit), for example, can be a route for unexpected traffic to enter. Bandwidth restriction technology, which limits the amount of input and output data, is one way to prevent unexpected traffic from entering a network. Patent Document 1 discloses a method for setting the relay bandwidth as a transfer control parameter using the results of measuring the bandwidth actually relayed by a relay device.

JP 2012-244524 A

However, it is likely that communication data transferred over an in-vehicle network will be designed in advance, especially when data from multiple applications is transferred over a common line, such as between an integrated ECU and a relay device. In this case, it is easier to set transfer control parameters based on pre-design information than to dynamically collect data while the network is running and determine the transfer control parameters.

On the other hand, some vehicle applications do not always require communication, but do transfer large amounts of data when the application is running. For example, with OTA, software update data is relatively large, and when this update data is downloaded to the update master (or the ECU to be updated), it consumes a lot of bandwidth on the communication line between the relay device and the ECU to be updated.

However, if the relay device sets the maximum data volume that can be input during normal system operation, as the allowable transmission bandwidth threshold, it will not discard and will allow incoming communication data disguised as OTA data to pass through when OTA is not actually being executed. This communication data will unnecessarily consume line bandwidth, causing delays in the transmission of other communication data or even data loss, which will affect vehicle control.

Furthermore, when using connected services, vehicles use a SIM (Subscriber Identity Module) to communicate with the outside world, but the SIM's usage fee structure may be pay-as-you-go. Therefore, if data related to connected services is lost within the in-vehicle network after the vehicle receives it from the server, the server will have to send and receive the data again, resulting in increased communication charges. Furthermore, communication bandwidth will be consumed within the in-vehicle network to resend the data, resulting in the same problems as those associated with receiving fake OTA data mentioned above.

This application has been made to solve the problems described above, and aims to prevent network failures caused by the inflow of fraudulent data that was not intended to be transferred within the network.

The relay device disclosed in the present application comprises:
A system in which a plurality of terminal devices are connected, data from a plurality of applications is transferred over a common line, and data communication between the plurality of terminal devices is relayed,
a frame extraction unit that extracts , from among data of a plurality of applications received from a terminal device, specific data frames that can determine the start and end times of a specific operation of an application that transfers an increased amount of data only during a specific operation compared to during normal operation;
an application operation monitoring unit that acquires an operation state of an application having a specific data frame, whether the application is running or stopped ;
Equipped with
When the operation state of an application having a specific data frame is stopped, the allowable band for data transfer of this application is reduced compared to when the application is in operation, thereby preventing the inflow of illegal data that is not expected to be transferred within the line.

According to the relay device disclosed in the present application,
By having the relay device dynamically change the transfer control parameters when transferring communication data based on the operating status of the application running on the terminal device, it is possible to prevent network failures caused by the inflow of unauthorized data that was not intended to be transferred within the network.

1 is a conceptual diagram illustrating a configuration of a vehicle communication system according to a first embodiment. FIG. 2 is a functional configuration diagram of a relay device according to the first embodiment. 10 is a diagram showing an example of a transfer control parameter table set in a parameter setting unit in the relay device according to the first embodiment; FIG. 10 is a diagram showing an example of another transfer control parameter table set in a parameter setting unit in the relay device according to the first embodiment; FIG. 10 is a flowchart illustrating an operation of a parameter setting unit in the relay device according to the first embodiment. FIG. 2 is a diagram illustrating an example of hardware of a relay device according to the first embodiment; FIG. 2 is a diagram illustrating an example of hardware of a relay device according to the first embodiment;

A preferred embodiment of the relay device according to the present application will be described below with reference to the drawings. Note that the same reference numerals are used to designate the same contents and corresponding parts, and detailed descriptions thereof will be omitted.

Embodiment 1.
[Overall composition]
FIG. 1 shows a conceptual diagram of the configuration of a vehicle communication system according to a first embodiment. A plurality of ECUs 1 to ECUn (n is a natural number) inside a vehicle 10 are connected by wire via an in-vehicle network 11. A relay device 12 relays and transfers communication data between the devices. A TCU 13 communicates with an OTA server 20 or the like outside the vehicle 10 via wireless communication. That is, each of the ECUs 1 to ECUn inside the vehicle 10 communicates with the outside of the vehicle via the TCU 13. One of the ECUs 1 to ECUn is an integrated ECU, and communication data used by multiple applications is transferred between the integrated ECU and the relay device 12 via the same line. For example, in FIG. 1, each of the ECUs 1 to ECUn inside the vehicle is connected via Ethernet (registered trademark).

[Explanation of operation of each part]
2 shows a functional configuration diagram of relay device 12 according to this embodiment. Each component in the functional configuration diagram will be described below. In the diagram, solid arrows indicate the flow of frame data, and dashed arrows indicate the flow of control signals.

(1) Transmission/reception port 121
Each of the transmission/reception ports 121 is connected to each of the ECUs 1 to ECUn in the vehicle 10, and transmits and receives communication data (frames). The received frames are transferred to the error check unit 122. The transmission/reception port 121 also transmits frames transferred from the transmission processing unit 126 in the relay device 12 to outside the relay device 12.

(2) Error Check Unit 122
Among the received frames, error frames in which reception errors or FCS (Frame Check Sequence) errors have occurred are discarded, and frames other than the error frames are transferred to the frame extraction unit.

(3) Frame Extraction Unit 123
Of the frames transferred from the error check unit 122, a specific data frame is extracted and copied and transferred to the application operation monitoring unit 127. Alternatively, the application operation monitoring unit 127 may be notified of only information indicating the specific data frame.

Specific data frames are frames that trigger the start or end of applications (functions) that do not always generate communication, such as OTA update data downloads or diagnostics, but which transfer relatively large amounts of data when the application is running. These specific data frames are extracted by referencing the values of headers and fields that can identify the application.

The end trigger of the application that runs immediately before the application may be extracted instead of the start trigger of the application.
The frame extraction unit 123 transfers all received frames that include a specific data frame to the multiplexing unit 124 .

(4) Application operation monitoring unit 127
The relay device 12 monitors the operation status of applications in the ECUs 1 to ECUn connected to the relay device 12. Based on the information in the specific data frame received from the frame extraction unit 123, the relay device 12 updates the operation status of each application to either "stopped" or "operating" and notifies the parameter setting unit 128.

(5) Parameter setting unit 128
Based on the operation status of the application notified by the application operation monitoring unit 127, the transfer parameter table is scanned to determine transfer control parameters for the communication data of the application, and the determined transfer control parameters are set in the multiplexing unit 124 or the transmission processing unit 126. The transfer control parameters are described below as allowable bandwidth and priority, but are not limited to these. Furthermore, multiple transfer control parameters may be set simultaneously. For example, the allowable bandwidth and priority may be set simultaneously.

Figure 3 is an example of a transfer control parameter table stored in the parameter setting unit 128. In each operating state of each application, the bandwidth of the communication data transferred to realize each application is shown as the allowable bandwidth. The parameter setting unit 128 sets this allowable bandwidth as an input bandwidth limit value in the multiplexing unit 124, or as an output bandwidth limit value in the transmission processing unit 126, thereby setting the bandwidth limiting rules.

Figure 4 is another example of a transfer control parameter table. It shows the priority of the communication data transferred to realize each application in the operating state of each application. The parameter setting unit 128 sets this priority as a priority reassignment rule in the transmission processing unit 126.

The following examples are possible reasons for indicating priority. For example, a vehicle is running (moving) until an OTA software update application is started, but it is common for the vehicle to be stopped (parked) after it has started. If a video playback application that downloads video content from an external server and plays it in streaming mode is running even while the vehicle is stopped, the data from this application may be given priority for transfer, delaying the transmission of OTA-related data, and if it times out, problems such as increased communication charges due to data being sent and received again may occur. To deal with such cases, while the application is running, the priority of communication data containing specific data frames is changed to a higher priority. For example, in Ethernet, the priority of a frame can be determined by the VLAN CoS (PCP) value.

The target application in the transfer control parameter table and the transfer control parameter values corresponding to the application's operating state may be changeable by rewriting the settings of the relay device 12 (specifically, the firmware that stores the settings of the relay device 12) through a software update via vehicle OTA. In a connected car, updates to applications and functions within the vehicle 10 also change the communication data sent and received. This changed in-vehicle network design information is applied as the transfer control parameters of the relay device 12.

Next, the operation of the parameter setting unit 128 will be described with reference to the flowchart of FIG.
(a) It is determined whether or not an operation notification indicating that an application is in operation has been received from the application operation monitoring unit 127 (step S101).
(a) If a notification that an application is running is received, the transfer control parameters of the multiplexing unit 124 or the transmission processing unit 126 are changed (step S102).
(c) It is determined whether or not a notification that the application is stopped has been received from the frame extraction unit 123 (step S103).
(d) If a notification that the application is stopped is received, the transfer control parameters of the multiplexing unit 124 or the transmission processing unit 126 are changed (step S104). After that, the process returns to step S101 and waits again for a notification that the application is running.

(6) Multiplexing unit 124
The frame extraction unit 123 multiplexes the frames received and transfers them to the switching processing unit 125. Before multiplexing, the unit 125 has the function of limiting the input bandwidth. That is, in accordance with the bandwidth limiting rules notified by the parameter setting unit 128, if the bandwidth of the received frame exceeds a predetermined bandwidth, the frame is discarded.

(7) Switching Processing Unit 125
For a frame input from the multiplexing unit 124 , the port of the relay device that is the destination is determined, and the frame is transferred to the transmission processing unit 126 .

(8) Transmission Processing Unit 126
The switch transfers frames input from the switching processing unit 125 to the destination port. For this reason, it has a buffer for temporarily storing frames to be transferred. When multiple frames stored in the buffer are to be output from the same destination port, it has an output control scheduler that outputs frames with higher priority first.

It also has a priority reassignment function that changes the priority of the specific data frame mentioned above according to the priority reassignment rule notified by the parameter setting unit 128. It also has an output bandwidth limiting function that adjusts the bandwidth of the specific data frame while outputting it according to the bandwidth limiting rule notified by the parameter setting unit 128.

This type of configuration and operation of the relay device prevents network failures caused by the inflow of unauthorized data that was not intended to be transferred within the network, and enables data for applications with high execution priority to be transferred without any problems.

Finally, we will explain the hardware configuration of the relay device 12 in this embodiment.

Figures 6 and 7 are diagrams showing an example hardware configuration of the relay device 12 according to embodiment 1. The buffer of the switching processing unit 125 in the relay device 12 and the transfer control parameter table stored in the parameter setting unit 128 are realized by the storage device 200. The functions of the error check unit 122, frame extraction unit 123, multiplexing unit 124, switching processing unit 125, transmission processing unit 126, application operation monitoring unit 127, and parameter setting unit 128 are realized by processing circuits. In other words, the relay device 12 is equipped with a processing circuit for realizing the above functions. The processing circuit may be the processing circuit 100 as dedicated hardware shown in Figure 6, or the processor 101 that executes a program stored in the storage device 200 shown in Figure 7.

6 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination of these. The functions of the error check unit 122, frame extraction unit 123, multiplexing unit 124, switching processing unit 125, transmission processing unit 126, application operation monitoring unit 127, and parameter setting unit 128 may be realized by multiple processing circuits 100, or the functions of each unit may be realized together by a single processing circuit 100.

In the processor 101 shown in FIG. 7, the functions of the error check unit 122, frame extraction unit 123, multiplexing unit 124, switching processing unit 125, transmission processing unit 126, application operation monitoring unit 127, and parameter setting unit 128 are realized by software, firmware, or a combination of software and firmware. The software or firmware is written as a program and stored in the storage device 200. The processor 101 realizes the functions of each unit by reading and executing the program stored in the storage device 200. In other words, the relay device 12 includes a storage device 200 for storing a program that, when executed by the processor 101, results in the execution of the steps shown in the flowchart of FIG. 5. Furthermore, this program can also be said to cause a computer to execute the procedures or methods of the error check unit 122, frame extraction unit 123, multiplexing unit 124, switching processing unit 125, transmission processing unit 126, application operation monitoring unit 127, and parameter setting unit 128.

Here, processor 101 refers to a CPU (Central Processing Unit), processing device, arithmetic device, microprocessor, etc.

The storage device 200 may be a non-volatile or volatile semiconductor memory such as RAM (Random Access Memory), ROM (Read Only Memory), EPROM (Erasable Programmable ROM), or flash memory, or a magnetic disk such as a hard disk or flexible disk, or an optical disk such as a CD (Compact Disc) or DVD (Digital Versatile Disc).

Although not shown, the memory device 200 may include an auxiliary memory device. In addition, the processor 101 may output data such as calculation results to the memory device 200, or may store the data in the auxiliary memory device.

The functions of the error check unit 122, frame extraction unit 123, multiplexing unit 124, switching processing unit 125, transmission processing unit 126, application operation monitoring unit 127, and parameter setting unit 128 may be partially realized by dedicated hardware and partially realized by software or firmware. In this way, the processing circuit in the relay device 12 can realize the above-mentioned functions by hardware, software, firmware, or a combination of these.

Although exemplary embodiments are described herein, the various features, aspects, and functions described in the embodiments are not limited to application to a particular embodiment, but may be applied to the embodiments alone or in various combinations.
Therefore, countless variations not illustrated are contemplated within the scope of the technology disclosed in the present specification, including, for example, the modification, addition, or omission of at least one component.

10: Vehicle, 11: In-vehicle network, 12: Relay device, 13: TCU, 20: OTA server, 121: Transmitting/receiving port, 122: Error check unit, 123: Frame extraction unit, 124: Multiplexing unit, 125: Switching processing unit, 126: Transmission processing unit, 127: Application operation monitoring unit, 128: Parameter setting unit.

Claims (3)

A relay device to which a plurality of terminal devices are connected, data of a plurality of applications is transferred via a common line, and which relays data communication between the plurality of terminal devices,
a frame extraction unit that extracts , from the data of the plurality of applications received from the terminal device, specific data frames that can determine the start and end of a specific operation of an application that transfers an increased amount of data only during a specific operation compared to during normal operation;
an application operation monitoring unit that acquires an operation state of the application having the specific data frame, whether the application is running or stopped;
Equipped with
A relay device that, when the operating state of an application having the specific data frame is stopped, reduces the allowable bandwidth for data transfer of this application compared to when it is operating, thereby preventing the inflow of unauthorized data that is not intended to be transferred within the line . A relay device to which a plurality of terminal devices are connected, data of a plurality of applications is transferred via a common line, and which relays data communication between the plurality of terminal devices,
a frame extraction unit that extracts, from the data of the plurality of applications received from the terminal device, specific data frames that can determine the start and end of a specific operation of an application that transfers an increased amount of data only during a specific operation compared to during normal operation;
a multiplexing unit that multiplexes received frames including the specific data frame received from the frame extraction unit;
a switching processing unit that determines a port to be a destination for the received frame input from the multiplexing unit and transfers the frame to a transmission processing unit;
an application operation monitoring unit that acquires an operation state of an application having the specific data frame, whether the application is running or stopped;
a parameter setting unit that sets an allowable bandwidth for data transfer based on the operation status acquired by the application operation monitoring unit;
Equipped with
A relay device characterized by setting the allowable bandwidth for data transfer of an application having the specific data frame to be reduced when the application is in a stopped state compared to when the application is in operation, and discarding data frames having a bandwidth exceeding the reduced allowable bandwidth before multiplexing, or limiting them to the reduced allowable bandwidth after multiplexing and outputting them from the transmission processing unit . A relay device to which a plurality of terminal devices are connected, data of a plurality of applications is transferred via a common line, and which relays data communication between the plurality of terminal devices,
a frame extraction unit that extracts, from the data of the plurality of applications received from the terminal device, specific data frames that can determine the start and end of a specific operation of an application that transfers an increased amount of data only during a specific operation compared to during normal operation;
an application operation monitoring unit that acquires an operation state of the application having the specific data frame, whether the application is running or stopped;
a parameter setting unit that sets a change in the priority of data transfer based on the operation status acquired by the application operation monitoring unit;
Equipped with
When the operation state of an application having the specific data frame is stopped, the relay device changes the priority of data transfer for this application to zero and does not transfer data .