Monitoring apparatus, monitoring method, and program

1. A monitoring apparatus which monitors an operation of a master control device,

the master control device being communicatively coupled to a first slave control device via a first network and to a second slave control device via a second network, the master control device providing output data to the first slave control device based on input data received from the second slave control device,

the monitoring apparatus being communicatively coupled to the first network and the second network, the monitoring apparatus comprising:

a storage which stores determination data indicating a correspondence relationship between the input data and the output data; and

at least one of a processor or a circuit configured to obtain the input data and the output data, and

the at least one of the processor or the circuit further configured to determine a presence or an absence of an anomaly in the operation of the master control device, by determining whether the input data and the output data correspond to the determination data, wherein

the at least one of the processor or the circuit is further configured to obtain information that indicates a presence or an absence of an anomaly in at least one of the first slave control device or the second slave control device from an information transmitter provided separately from the first network and the second network, and

the at least one of the processor or the circuit is further configured to determine, based on the information that indicates the presence or the absence of the anomaly in at least one of the first slave control device or the second slave control device obtained from the information transmitter, whether data resulting from processing the output data corresponds to the determination data stored in the storage, the output data being provided by the master control device to the first slave control device based on the input data received from the second slave control device.

2. The monitoring apparatus according to claim 1 , wherein

the determination data indicates at least one of a relationship in which the input data and the output data are identical or a relationship in which the output data is identical to a result of arithmetic processing applied to the input data by the master control device.

3. The monitoring apparatus according to claim 1 , wherein

the first network and the second network are bus networks.

4. The monitoring apparatus according to claim 1 , wherein

the master control device is a gateway.

5. The monitoring apparatus according to claim 1 , further comprising:

a communication circuit configured to transmit control information to an external interface via a third network different than the first network and the second network in response to the presence of the anomaly in the operation of the master control device being determined by the at least one of the processor or the circuit.

6. The monitoring apparatus according to claim 5 , wherein

the control information transmitted to the external interface announces or requests termination of a system, the system including the monitoring apparatus.

7. The monitoring apparatus according to claim 6 , wherein

the communication circuit is configured to transmit the control information to the external interface without involving the master control device.

8. The monitoring apparatus according to claim 7 , wherein

the system, including the monitoring apparatus, is an in-vehicle network system, and

each of the first slave control device and the second slave control device control an operation of a vehicle, the vehicle including the in-vehicle network system.

9. The monitoring apparatus according to claim 8 , wherein

the external interface and the third network are external to the vehicle.

10. The monitoring apparatus according to claim 1 , further comprising:

a communication circuit configured to transmit control information to the master control device in response to the absence of the anomaly in the operation of the master control device being determined by the at least one of the processor or the circuit.

11. The monitoring apparatus according to claim 10 , wherein

the control information transmitted to the master control device announces that a system is configured to continue to operate, the system including the monitoring apparatus.

12. The monitoring apparatus according to claim 1 , wherein

the first network includes a plurality of the first slave control device,

the second network includes a plurality of the second slave control device,

the first network does not connect the master control device to the plurality of the first slave control device on a one-to-one basis, and

the second network does not connect the master control device to the plurality of the second slave control device on a one-to-one basis.

13. The monitoring apparatus according to claim 1 , wherein

the determination data stored in the storage indicates a plurality of correspondence relationships between the input data and the output data, the plurality of correspondence relationships including both without applying arithmetic processing to the input data and with applying arithmetic processing to the input data.

14. A monitoring apparatus which monitors an operation of a master control device,

the master control device being communicatively coupled to a first slave control device via a first network and to a second slave control device via a second network, the master control device providing output data to the first slave control device based on input data received from the second slave control device,

the monitoring apparatus being included in the first slave control device, the monitoring apparatus comprising:

a storage which stores determination data on the output data; and

at least one of a processor or a circuit configured to:

obtain the output data; and

determine a presence or an absence of an anomaly in the operation of the master control device, by determining whether the output data corresponds to the determination data, wherein

the at least one of the processor or the circuit is further configured to obtain information that indicates a presence or an absence of an anomaly in at least one of the first slave control device or the second slave control device from an information transmitter provided separately from the first network and the second network, and

the at least one of the processor or the circuit is further configured to determine, based on the information that indicates the presence or the absence of the anomaly in at least one of the first slave control device or the second slave control device obtained from the information transmitter, whether data resulting from processing the output data corresponds to the determination data stored in the storage, the output data being provided by the master control device to the first slave control device based on the input data received from the second slave control device.

15. The monitoring apparatus according to claim 14 , wherein

the determination data indicates at least one of an amount of change in the output data, an output cycle at which the master control device provides the output data, or data on the first slave control device including the monitoring apparatus.

16. A monitoring method for monitoring an operation of a master control device,

the master control device being communicatively coupled to a first slave control device via a first network and to a second slave control device via a second network, the master control device providing output data to the first slave control device based on input data received from the second slave control device,

the monitoring method comprising:

obtaining, by at least one of a processor or a circuit, the input data and the output data; and

determining, by the at least one of the processor or the circuit, a presence or an absence of an anomaly in the operation of the master control device, by determining whether the input data and the output data correspond to determination data, the determination data indicating a correspondence relationship between the input data and the output data;

obtaining, by the at least one of the processor or the circuit, information that indicates a presence or an absence of an anomaly in at least one of the first slave control device or the second slave control device from an information transmitter provided separately from the first network and the second network; and

further determining, by the at least one of the processor or the circuit, based on the information that indicates the presence or the absence of the anomaly in at least one of the first slave control device or the second slave control device obtained from the information transmitter, whether data resulting from processing the output data corresponds to the determination data, the output data being provided by master control device to the first slave control device based on the input data received from the second slave control device.

17. A non-transitory computer-readable recording medium for a computer, the non-transitory computer-readable recording medium including a computer program for causing the computer to execute the monitoring method according to claim 16 .

18. A monitoring method for monitoring an operation of a master control device,

the master control device being communicatively coupled to a first slave control device via a first network and to a second slave control device via a second network, the master control device providing output data to the first slave control device based on input data received from the second slave control device,

the monitoring method comprising:

obtaining, by at least one of a processor or a circuit, the output data;

determining, by the at least one of the processor or the circuit, a presence or an absence of an anomaly in the operation of the master control device, by determining whether the output data corresponds to determination data on the output data;

obtaining, by the at least one of the processor or the circuit, information that indicates a presence or an absence of an anomaly in at least one of the first slave control device or the second slave control device from an information transmitter provided separately from the first network and the second network; and

further determining, by the at least one of the processor or the circuit, based on the information that indicates the presence or the absence of the anomaly in at least one of the first slave control device or the second slave control device obtained from the information transmitter, whether data resulting from processing the output data corresponds to the determination data, the output data being provided by master control device to the first slave control device based on the input data received from the second slave control device.

19. A non-transitory computer-readable recording medium for use in a computer, the non-transitory computer-readable recording medium including a computer program for causing the computer to execute the monitoring method according to claim 18 .