Techniques for protecting and refining system time

Abstract

Disclosed are techniques for protecting and accurate system time used in a system such as an automotive system. In some embodiments, a cumulative trust score of available time sources other than a real-time clock during startup is determined by adding together trust scores associated with the available time sources after initializing the system time to the time of the real-time clock during startup. The cumulative trust score is then used to determine an appropriate technique for updating the system time based on time from one of the available time sources depending on whether the cumulative trust score is greater than a maximum threshold, between a minimum threshold and the maximum threshold, or less than the minimum threshold.

Description

Technical Field

[0001] This disclosure generally relates to computing systems, and more specifically, to techniques for protecting and accurating system time in systems such as automotive systems. Background Technology

[0002] System time is the current time and date maintained by a computing system so that applications running within it can always obtain the accurate time of their operation. System time is typically based on the current time relative to Greenwich Mean Time (UTC), also known as Coordinated Universal Time. Other time zones are a few hours ahead or behind UTC. System time is measured using a system clock, which is typically implemented as a tick count since an arbitrary starting date (called an epoch). System time can also be converted to calendar time, which is more easily understood by humans.

[0003] In systems such as automotive systems, many functions may depend on having accurate system time. For example, Advanced Driver Assistance Systems (ADAS) typically perform actions such as applying emergency braking, lane keeping assist, collision avoidance, traffic sign recognition, and cruise control based on system time. Incorrect system time can delay the response of ADAS systems, thereby endangering lives. As another example, cockpit systems such as browsers, media applications, payment applications, and over-the-air (OTA) software updates may rely on digital certificates or time-frame-based payment services. Incorrect system time may cause digital certificates or licensed services in such cockpit systems to expire unexpectedly or be delayed, which could also lead to denial-of-service attacks. Therefore, it is generally undesirable for system time to deviate from legitimate UTC-based time or for system time to be compromised due to malicious attacks.

[0004] As mentioned above, there is a need in the art for more effective techniques for protecting and accurating system time, for example, in automotive systems. Summary of the Invention

[0005] One embodiment of this application describes a method for updating system time. The method includes determining a cumulative credibility score based on one or more credibility scores associated with corresponding one or more time sources. The method also includes updating the system time based on a time from one of the corresponding one or more time sources and the cumulative credibility score.

[0006] Another embodiment of this application describes a non-transitory computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform steps for updating a system time. The steps include determining a cumulative confidence score based on one or more confidence scores associated with corresponding one or more time sources. The steps also include updating the system time based on a time from one of the corresponding one or more time sources and the cumulative confidence score.

[0007] Another embodiment of this application describes a system including a memory and a processor. The memory stores an application program. The processor is coupled to the memory and, when executing the application, is configured to: determine a cumulative credibility score based on one or more credibility scores associated with corresponding one or more time sources; and update the system time based on the time from one of the corresponding one or more time sources and the cumulative credibility score.

[0008] Compared to existing technologies, at least one technical advantage of the technology disclosed herein is that it provides a reliable mechanism for updating system time and protecting system time from attacks. In this regard, the disclosed technology allows for the identification of deviations and impairments of system time based on the reliability of these time sources, and for the recovery of system time based on time from available time sources. Furthermore, time values, including default time and recovery time, which can be used during the recovery process, are stored in a secure storage device protected against attacks compared to other types of storage devices. These technical advantages represent one or more technical improvements over existing methods. Attached Figure Description

[0009] To gain a more detailed understanding of the features described above, this disclosure can be described in more detail by referring to embodiments, some of which are illustrated in the accompanying drawings. However, it should be noted that the drawings illustrate only typical embodiments and should not be construed as limiting the scope of this disclosure, which allows for other equivalent embodiments.

[0010] Figure 1 This illustrates a system configured to implement one or more aspects of various implementation schemes;

[0011] Figure 2 A more detailed description is provided for each implementation scheme. Figure 1 System-on-a-chip;

[0012] Figure 3 A flowchart illustrating the steps involved in updating the system time according to each implementation scheme;

[0013] Figure 4A more detailed description is provided for each implementation scheme. Figure 3 One of the steps in the method; and

[0014] Figure 5 A more detailed description is provided for each implementation scheme. Figure 3 Another step in the method. Detailed Implementation

[0015] In the following description, numerous specific details are set forth to provide a more thorough understanding of embodiments of the present disclosure. However, it will be apparent to those skilled in the art that embodiments of the present disclosure may be practiced without one or more of these specific details.

[0016] System Overview

[0017] Figure 1 A system 100 configured to implement one or more aspects of various embodiments is illustrated. As shown, system 100 includes an electronic control unit (ECU) 101 that communicates with multiple time sources 110, 112, and 114. In some embodiments, ECU 101 is an embedded automotive electronic system capable of controlling one or more systems or subsystems in a vehicle. Although described herein with respect to an automotive system as a reference example, the techniques disclosed herein for protecting and accurating system time are generally applicable to any system that relies on system time. Although one ECU 101 is shown for illustrative purposes, a vehicle (or other system) typically includes any number of ECUs, and these ECUs may also communicate with each other. Although described herein primarily with respect to system time maintained by individual ECUs, in alternative embodiments, a central system time may be maintained for multiple ECUs.

[0018] ECU 101 schematically includes a system-on-a-chip (SOC) 102 that communicates with an input-output controller (IOC) 106 and a secure storage device 120. SOC 102 can communicate with IOC 106 and secure storage device 120 via one or more buses, network connections, etc., as described below. Figure 2In more detail, SOC 102 may include any technically feasible hardware components, such as physical memory and one or more processors, that allow applications and / or other software to run therein. For example, in an automotive environment, applications running in SOC 102 may be associated with automotive infotainment systems, autonomous driving systems, advanced driver assistance systems (ADAS), intelligent traffic management systems, connected vehicle systems, vehicle-to-all (V2X) communication systems, cockpit systems, telemetry systems, combinations of the foregoing, or any other technically feasible automotive systems that vary over time and are provided by a host system. Although this document describes applications primarily as examples of reference, in some implementations, other types of software, such as firmware or multiple applications, may run in place of or in addition to the applications in the SOC.

[0019] As shown in the figure, SOC 102 includes a system time 104. In some implementations, the system time 104 is maintained by an application (or other software) running in SOC 102. As described, the system time 104 can be used for various purposes by different applications. For example, an application running in SOC 102 may be associated with a cockpit system and needs to determine the validity of a digital certificate or time-frame-based payment service based on the system time 104. As another example, an application may be associated with an ADAS system and perform actions such as applying emergency braking, lane assist, collision avoidance, traffic sign recognition, and cruise control based on the system time 104.

[0020] IOC 106 is a device that interfaces between an input or output device, such as a vehicle network interface device, and SOC 102. Although shown as separate from SOC 102, in alternative embodiments, SOC 102 and IOC 106 may be combined into a single hardware unit with software running therein. As shown, IOC 106 receives time from a real-time clock (RTC) 108 included therein. In alternative embodiments, RTC 108 may be located elsewhere, such as in SOC 102 instead of IOC 106, and in some embodiments, the ECU may include more than one RTC. In some embodiments, RTC 108 is a battery-powered time source that continues to maintain time when mains power is off or unavailable. (See below for further details.) Figure 3In more detail, the time maintained by RTC 108 can be shared with SOC 102 via inter-process communication, and said shared time can be used to initialize system time 104 during startup. In an automotive environment, "startup" refers to the starting of the vehicle, which in turn starts the ECU and the applications running therein. In other embodiments, startup can be any system that depends on system time. After startup, system time 104 can be updated to correspond to time based on a different available time source (if any) that is more reliable than RTC 108; this is also referred to herein as "restoring" system time 104. It should be noted that the availability of a new time source with a higher confidence score contributes to the speed of the restoration process.

[0021] As shown in the figure, secure storage device 120 stores a default time 122 and a recovery time 124. In some embodiments, secure storage device 120 may be a replay protected memory block (RPMB), or any other type of secure hardware and / or software storage device. Secure storage device 120 protects the data stored therein, including the default time 122 and recovery time 124, from various forms of attacks. The default time 122 is the time written by the manufacturer to secure storage device 120 and RTC 108, and this default time can be used as the default value for system time 104 when all other time sources are unavailable. In some embodiments, the default time 122 is the time of the application built to run in SOC 102. In other embodiments, the default time 122 may be any suitable time chosen by the manufacturer, such as the manufacturing time. (See below for further details.) Figure 3 In more detail, the default time 122 can be compared with the time from RTC 108 and the recovery time 124, and the maximum value among the default time 122, the time from RTC 108, and the recovery time 124 is selected during startup to initialize the system time 104. The recovery time 124 is added to the system time 104 at a predetermined frequency during the recovery process to eliminate the discrepancy between the system time 104 and the time from the time source (…). For example The time difference between the times of time sources 110, 112, or 114, as shown below. Figures 3 to 5 Let's discuss this in more detail. The recovery time of 124 defines the recovery rate during the recovery process.

[0022] Time sources 110, 112, and 114 are external time sources to ECU 101, and these time sources can be used to restore system time 104 when available. Examples of time sources include... Common NTP (Network Time Protocol), GPS (Global Positioning System), telematics time from TBM (Telematics Machine Module), radio time sources, etc. ECU 101 can communicate with time sources 110, 112, and 114 in any technically feasible manner. For example, a network interface card can be used with... Public NTP communication; the radio receiver can be used to communicate with a radio time source; ECU 101 can... For example Another ECU indirectly obtains time, etc., from a time source. Although three time sources 110, 112, and 114 are shown for illustrative purposes, a system such as ECU 101 can typically communicate with any number of time sources.

[0023] Figure 2 A more detailed description is provided for each implementation scheme. Figure 1 The SOC 102. As shown, the SOC 102 includes a processor 202 and a memory 204. An application program 206 is stored in the memory 204 and executed on the processor 202. For example, in the context of an automotive system, the application program 206 may be associated with an automotive infotainment system, an autonomous driving system, an advanced driver assistance system (ADAS), an intelligent traffic management system, a connected vehicle system, a vehicle-to-all (V2X) communication system, a cockpit system, or a telemetry system.

[0024] Although shown as a system-on-a-chip for illustrative purposes, it should be understood that SOC 102 is not required to be a system-on-a-chip and can generally include any type of computing system. This includes processor 202 to represent a single central processing unit (CPU), multiple CPUs, a single CPU with multiple processing cores, one or more graphics processing units (GPUs), field-programmable gate arrays (FPGAs), other types of processors, some combination of the foregoing, etc. In operation, processor 202 can control and coordinate the operation of other system components. Processor 202 can also receive user input from an input device such as a touchscreen.

[0025] System memory 204 of SOC 102 stores contents such as software applications and data used by processor 202. System memory 204 can be any type of memory capable of storing data and software applications, such as random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash ROM), or any suitable combination of the foregoing. In some embodiments, storage devices (not shown) may supplement or replace system memory 204. Storage devices may include any number and type of external memory accessible to processor 202. For example, but not limited to, storage devices may include secure digital cards, external flash memory, portable compressed optical disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0026] As shown below Figures 3 to 5 In more detail, the time maintained by RTC 108 is restored in system memory 204 during startup as the default system time 104. Thereafter, it can be based on an available time source other than RTC 108 ( For example The system time 104 is updated using the times of time sources 110, 112, and 114, and the confidence scores associated with said time sources, which are also referred to herein as “available time sources.” Each confidence score associated with an available time source is derived based on the attack surface of the time source. In some embodiments, risk analysis is performed for each of a plurality of potential available time sources to determine the associated confidence score, and application 206 is programmed to update system time 104 directly with the times from the available time sources, or to perform an iterative recovery technique using the times from the available time sources and recovery time 124, depending on the cumulative confidence score, which is the sum of the confidence scores associated with the available time sources. During the risk analysis of the time sources, threat analysis and risk assessment (TARA) can be performed using the Electronic Security Vehicle Intrusion Prevention Application (EVITA) model, based on… For example The hardware and software components associated with a time source, as well as the potential threats to that time source, determine the credibility score associated with it. In this context, a higher credibility score indicates that the time source has a smaller attack surface and higher credibility relative to other time sources. In some implementations, when the total number of available time sources is less than or equal to five, the credibility score can range from 0 to 65. For example, risk analyses using the TARA method and the EVITA model might be performed separately for time sources from TBM. The confidence scores were 65, 60, 30, and 20, respectively, based on public NTP, GPS, and telematics time, as well as the aforementioned radio time sources.

[0027] During runtime, not all time sources are available, so the number of available time sources is typically variable. For example, GPS may be unavailable during cloudy weather conditions, underground, or inside buildings. As another example, an NTP time source may be unavailable if the SOC 102 lacks the network connectivity required to obtain time from an NTP source. In some implementations, the SOC 102 is configured to determine the cumulative confidence score of available time sources by summing the confidence scores associated with these time sources after initializing the system time 104 to the time retrieved from the RTC 108 during startup. In these cases, SOC102(1) updates the system time 104 with the time (and date) of any available time source if the cumulative confidence score meets the maximum threshold,(2) performs an iterative recovery technique if the cumulative confidence score is between the minimum and maximum thresholds and the time difference between the system time 104 and one of the available time sources meets a first time difference threshold, or(3) performs an iterative recovery technique if the cumulative confidence score is less than the minimum threshold and the time difference between the system time 104 and one of the available time sources meets a second time difference threshold less than the first time difference threshold.

[0028] Although this document primarily discusses SOC 102, it should be noted that the functions attributed to SOC 102 can actually be performed by the application program 206 executing therein. Furthermore, it should be understood that the SOC 102 shown herein is illustrative and is subject to change and modification. For example, the number of processors 202, the number of system memories 204, and the application programs and / or other software included in the system memories 204 can be modified as needed. For example The number of firmware files. Furthermore, it can be modified as needed. Figure 1 and Figure 2 The connection topology between the various units. In some implementations, any combination of processor 202 and system memory 204 can be replaced by any type of virtual computing system, distributed computing system, or cloud computing environment. Furthermore, the functionality included in any application can be partitioned across any number of applications or other software stored and executed via any number of devices located in any number of physical locations.

[0029] System time protection and accuracy

[0030] Figure 3 A flowchart illustrating the method steps for updating system time 104 according to various implementation schemes is provided. (See reference...) Figures 1 to 2 The system describes the method steps, but those skilled in the art should understand that any system configured to implement the method steps in any order falls within the scope of this invention.

[0031] As shown in the figure, method 300 begins at step 302, where SOC 102 retrieves the time from RTC 108 during startup and sets the system time 104 to the RTC time. As described, RTC 108 is a battery-powered time source that can be shared with SOC 102 via inter-process communication by IOC 106. During the initial phase of startup, the RTC time is used as the default value for system time 104 because other time sources may still be unavailable. Although this document is described primarily with respect to RTC 108, in alternative embodiments, other types of clocks, such as software-based clocks, may also be used to initialize system time 104 during startup.

[0032] In some implementations, the RTC time may also be compared with a default time 122 and a recovery time 124 stored in secure storage 120, and the maximum of the three times may be set as the system time 104 during startup. As described, the default time 122 may be retrieved from secure storage 120 and used when no other time source is available.

[0033] After startup, the system time 104 can be updated using time from other available time sources besides RTC 108. At step 304, SOC 102 determines after startup whether there are available time sources besides RTC 108, and whether these available time sources (if any) are time-consistent. Available time sources may include... Public NTP, GPS, telematics time from TBM, radio time sources, etc., and the number of available time sources is usually not fixed. For example, GPS may be unavailable in cloudy weather conditions, underground, inside buildings, etc., and an NTP source may be unavailable if SOC 102 does not have network connectivity. Although this document mainly describes the establishment of system time 104 relative to the startup process and afterwards, in some implementations, it may then be based on available time sources ( For example (Periodically) update the system time 104.

[0034] If no other time source is available or the available time sources are not in agreement, then at step 306, SOC 102 maintains the system time as RTC time. In some implementations, time from available time sources needs to be in agreement to reach a tolerance threshold, such as a predetermined number of seconds. If the time from any available time source differs from the time from another time source by more than this threshold, one of these time sources is considered compromised. In these cases, since SOC 102 may not be able to determine which time source is compromised, it will not update the system time 104 based on any available time source.

[0035] On the other hand, if other available time sources exist and the time sources agree, then at step 308, SOC 102 determines the cumulative confidence score by summing the confidence scores associated with the available time sources. For example, assuming GPS and radio time sources are available and have confidence scores of 60 and 20 respectively, the cumulative confidence score can be calculated as follows:

[0036] CTS = (TS)GPS + (TS)Radio

[0037] CTS = 60 + 20 = 80

[0038] Where CTS is the cumulative confidence score, (TS)GPS is the confidence score associated with GPS, and (TS)Radio is the confidence score associated with the radio time source. It should be noted that RTC 108 is not considered an available time source, and its confidence score needs to be included in the calculation of the cumulative confidence score because the RTC time is only used as the default system time when no other time source is available. Once other time sources become available, the cumulative confidence score is calculated by summing the confidence scores associated with the other (available) time sources. As described, the individual confidence score for the corresponding time source at the manufacturing time can be determined by performing risk analysis for each of the multiple potentially available time sources, such as analysis using the TARA method and the EVITA model. However, since the number of available time sources is typically not fixed (…),… For example (e.g., GPS may be unavailable), so the cumulative confidence score needs to be determined at runtime in step 308.

[0039] As shown in the figure, at step 310, SOC 102 determines whether the cumulative confidence score meets the maximum threshold for the cumulative confidence score. To ensure that the system time 104 can be updated safely and reliably, the implementation uses the maximum and minimum thresholds of the cumulative confidence score to determine the appropriate method for updating the system time 104. This can be based on... For example What values ​​of accumulated trust scores are needed to trust the time source? These threshold values ​​are determined experimentally, as follows: Figures 4 to 5 Let's discuss this in more detail.

[0040] In some implementations, the maximum threshold requirement CTS >= CTS is met at step 310. Thr-max CTS Thr-max This is the maximum threshold for the cumulative confidence score. In some implementations, SOC 102 may use a maximum threshold of 80 and a minimum threshold of 60 for the cumulative confidence score. Returning to the example above, the cumulative confidence score 80 for the GPS and radio time sources will satisfy the maximum threshold 80, which indicates the maximum confidence in the GPS and radio time sources.

[0041] If SOC 102 determines that the cumulative confidence score meets the maximum threshold, then at step 312, SOC 102 updates the system time 104 with the time (and date) from any available time source. In some embodiments, in addition to updating the system time at step 312, the time of RTC 108 may also be updated with the same time from an external source used to update system time 104. Doing so allows the updated time of RTC 108 to be used during future startup.

[0042] On the other hand, if SOC 102 determines that the cumulative credibility score does not exceed the maximum threshold, then at step 314, SOC 102 determines whether the cumulative credibility score is between the minimum threshold and the maximum threshold of the cumulative credibility score. In some embodiments, determining that the cumulative credibility score is between the minimum threshold and the maximum threshold requires CTS >= CTS. Thr-min and CTS <CTS Thr-max CTS stands for Cumulative Credibility Score. Thr-min It is the minimum threshold, and CTS Thr-max This is the maximum threshold. In some implementations, SOC 102 may use a maximum threshold of 80 and a minimum threshold of 60. Any cumulative confidence score between the minimum and maximum thresholds indicates a lower confidence level in the confidence of the available time source. Any cumulative confidence score less than the minimum threshold indicates a minimum confidence level in the confidence of the available time source.

[0043] If SOC 102 determines that the cumulative confidence score is between the minimum and maximum thresholds, then at step 316, provided the first time difference threshold is met, SOC 102 performs an iterative recovery technique based on the time (and date) from one of the available time sources. Combined with Figure 4 Step 316 of method 300 is shown in more detail. As shown, at step 402, SOC 102 determines the time difference between the source time and the system time. The time difference (also known as the time increment) is always positive and can be determined by... For example The absolute value of the source time is subtracted from the system time to determine the source time (or vice versa). The time from any available time source can be used as the source time because the determination of the time from the available time sources at step 304 of method 300 is consistent, as described above. Figure 3 As described.

[0044] At step 404, SOC 102 determines whether the time difference between the source time and system time 104 is greater than a first time difference threshold. A value for the first time difference threshold is selected such that if the time difference is greater than the first time difference threshold, it is assumed that system time 104 is corrupted and needs to be restored. In some embodiments, SOC 102 may use a first time difference threshold with a value from 0 to 5 seconds. More generally, SOC 102 may use any suitable value for the first time difference threshold, and the specific value of the first time difference threshold used may be determined experimentally.

[0045] If the time difference is not greater than a first time difference threshold, then at step 406, SOC 102 does not update the system time 104. On the other hand, if the time difference is greater than the first time difference threshold, then at step 408, SOC 102 adds the recovery time 124 to the system time 104 at a predetermined frequency. In some embodiments, the recovery time 124 has a value between the aforementioned first time difference threshold and second time difference threshold, T. th1 <T recovery_time <T th2 T recovery_time It is the recovery time, T th1 It is the first time difference threshold, and T th2 This is the second time difference threshold. In some implementations, SOC 102 retrieves recovery time 124 from secure storage device 120 and adds recovery time 124 to system time 104 at a predetermined frequency until the time difference between the source time and system time 104 is eliminated. example For example, by completely reducing the time difference or reducing it to below a certain tolerance threshold. For instance, application 206 could be programmed to add recovery time 124 to system time 104 a given number of times per minute until the time difference is eliminated. Although this document is primarily described in relation to addition as an illustrative example, it should be understood that recovery time 124 can be effectively subtracted from system time 104 if the source time is later than system time 104.

[0046] Return to Figure 3 If SOC 102 determines that the cumulative confidence score is less than a minimum threshold for the cumulative confidence score, indicating a minimum confidence level for the available time sources, then at step 318, if a second time difference threshold is met, SOC 102 performs an iterative recovery technique based on the time (and date) from one of the available time sources. Figure 5 Step 316 of method 300 is shown in more detail below. As shown in the figure, at step 502, SOC 102 determines the time difference between the source time and the system time 104. (As described above...) Figure 4As described, any available time source can be used as the source time because at step 304 of method 300, it is determined that the available time sources are in temporal agreement.

[0047] At step 504, SOC 102 determines whether the time difference is greater than the second time difference threshold. Step 504 is similar to the above combination. Figure 4 The described step 404 differs in that a second time difference threshold is used instead of a first time difference threshold. In some embodiments, the second time difference threshold is smaller than the first time difference threshold because, if the cumulative confidence score is determined to be less than a minimum threshold at step 314 of method 300, the confidence of the available time sources is low, thus requiring a smaller threshold to compensate for the less confident time sources. In some embodiments, SOC 102 may use a second time difference threshold having a value in the range of 0 to 15 seconds. More generally, SOC 102 may use any suitable second time difference threshold, and a particular value of the second time difference threshold may be determined experimentally.

[0048] If the time difference is not greater than the second time difference threshold, then at step 506, SOC 102 does not update the system time. On the other hand, if the time difference is greater than the second time difference threshold, then at step 508, SOC 102 adds the recovery time 124 to the system time 104 at a predetermined frequency. Similar to the above combination... Figure 4 In some embodiments, step 406, as described, involves SOC 102 retrieving recovery time 124 from secure storage device 120 and adding recovery time 124 to system time 104 at a predetermined frequency until the time difference between the source time and system time 104 is eliminated. For example, recovery time 124 may be added to system time 104 a given number of times per minute.

[0049] In summary, techniques for protecting and refining system time used in systems such as automotive systems are disclosed. In the disclosed techniques, a cumulative confidence score for the available time sources (excluding the real-time clock) is determined by summing confidence scores associated with the available time sources after initializing the system time to the time of a real-time clock during startup. The cumulative confidence score is then used to determine a suitable technique for updating the system time based on the available time sources. If the cumulative confidence score is greater than a maximum threshold, the system time is updated with the time (and date) of any available time source. If the cumulative confidence score is between a minimum and a maximum threshold, and the time difference between the time from one of the available time sources and the system time is greater than a first time difference threshold, the system time is updated via an iterative recovery technique in which recovery time is added to the system time at a predetermined frequency until the time difference between the time from one of the available time sources and the system time is eliminated. If the cumulative confidence score is below the minimum threshold, and the time difference between the time from one of the available time sources and the system time is greater than a second time difference threshold smaller than the first time difference threshold, the system time is updated via the same iterative recovery technique, in which the recovery time is added to the system time at a predetermined frequency until the time difference between the time from one of the available time sources and the system time is eliminated.

[0050] Compared to existing technologies, at least one technical advantage of the technology disclosed herein is that it provides a reliable mechanism for updating system time and protecting system time from attacks. In this regard, depending on the reliability of these time sources, the disclosed technology allows for the identification of deviations and corruptions in system time and the recovery of system time based on time from available time sources. Furthermore, time values, including default time and recovery time, which can be used during the recovery process, are stored in a secure storage device protected against attacks compared to other types of storage devices. These technical advantages represent one or more technical improvements over existing methods.

[0051] 1. In some embodiments, a method for updating system time includes determining a cumulative credibility score based on one or more credibility scores associated with a corresponding one or more time sources; and updating the system time based on a time from one of the corresponding one or more time sources and the cumulative credibility score.

[0052] 2. The method of Clause 1, wherein updating the system time comprises: if the cumulative confidence score is greater than a first threshold, setting the system time to be equal to the time from the one of the time sources; if the cumulative confidence score is less than the first threshold but greater than a second threshold, and the time difference between the system time and the time from the one of the time sources is greater than a third threshold, performing an iterative recovery technique using the time from the one of the time sources; and if the cumulative confidence score is less than the second threshold and the time difference between the system time and the time from the one of the time sources is greater than a fourth threshold, performing the iterative recovery technique using the time from the one of the time sources.

[0053] 3. The method as described in Clause 1 or 2, wherein the fourth threshold is greater than the third threshold.

[0054] 4. The method of any one of Clauses 1 to 3, wherein performing the iterative recovery technique includes adding recovery time to the system time at a predetermined frequency.

[0055] 5. The method of any one of Clauses 1 to 4, wherein determining the cumulative confidence score comprises summing the one or more confidence scores associated with the corresponding one or more time sources.

[0056] 6. The method as described in any one of Clauses 1 to 5 further includes determining the one or more confidence scores based on risk analysis of the time source.

[0057] 7. The method of any one of Clauses 1 to 6, wherein each of the risk analyses is a threat analysis and risk assessment (TARA) performed using the Electronic Security Vehicle Intrusion Prevention Application (EVITA) model.

[0058] 8. The method of any one of Clauses 1 to 7 further includes initializing the system time to the maximum value among the time from the real-time clock, the default time, and the recovery time.

[0059] 9. The method of any one of Clauses 1 to 8 further includes determining, before updating the system time, that the times from the respective one or more time sources are within a threshold time interval from each other.

[0060] 10. The method of any one of Clauses 1 to 9, wherein the time source comprises at least one of a Network Time Protocol (NTP) time source, a Global Positioning System (GPS) time source, a Telematics time source, a radio time source, or a real-time clock time source.

[0061] 11. In some embodiments, a non-transitory computer-readable storage medium includes instructions that, when executed by a processor, cause the processor to perform a step for updating a system time, the step including determining a cumulative confidence score based on one or more confidence scores associated with a corresponding one or more time sources; and updating the system time based on a time from one of the corresponding one or more time sources and the cumulative confidence score.

[0062] 12. The computer-readable storage medium as described in Clause 11, wherein the system time is maintained by the vehicle system.

[0063] 13. The computer-readable storage medium as described in Clause 11 or 12, wherein the automotive system is one of an automotive infotainment system, an autonomous driving system, an advanced driver assistance system (ADAS), an intelligent traffic management system, a connected vehicle system, a vehicle-to-everything (V2X) communication system, a cockpit system, or a telemetry system.

[0064] 14. The computer-readable storage medium of any one of clauses 11 to 13, wherein updating the system time comprises: setting the system time to be equal to the time from the one of the time sources if the cumulative confidence score is greater than a first threshold; performing an iterative recovery technique using the time from the one of the time sources if the cumulative confidence score is less than the first threshold but greater than a second threshold, and the time difference between the system time and the time from the one of the time sources is greater than a third threshold; and performing the iterative recovery technique using the time from the one of the time sources if the cumulative confidence score is less than the second threshold and the time difference between the system time and the time from the one of the time sources is greater than a fourth threshold.

[0065] 15. The computer-readable storage medium as described in any one of clauses 11 to 14, wherein the fourth threshold is greater than the third threshold.

[0066] 16. The computer-readable storage medium of any one of Clauses 11 to 15, wherein performing the iterative recovery technique includes adding a recovery time to the system time at a predetermined frequency, and wherein the recovery time is stored in a secure storage device.

[0067] 17. The computer-readable storage medium of any one of Clauses 11 to 16, wherein determining the cumulative confidence score comprises summing the one or more confidence scores associated with the respective one or more time sources.

[0068] 18. The computer-readable storage medium as described in any one of Clauses 11 to 17, the step further comprising initializing the system time to the maximum value among a real-time clock time, a default time, and a recovery time.

[0069] 19. In some embodiments, a system includes a memory storing an application and a processor coupled to the memory, the processor being configured, when executing the application, to determine a cumulative credibility score based on one or more credibility scores associated with corresponding one or more time sources; and to update a system time based on a time from one of the corresponding one or more time sources and the cumulative credibility score. 20. The system of claim 19, wherein updating the system time comprises: setting the system time equal to the time from the one of the time sources if the cumulative credibility score is greater than a first threshold; performing an iterative recovery technique using the time from the one of the time sources if the cumulative credibility score is less than the first threshold but greater than a second threshold, and the time difference between the system time and the time from the one of the time sources is greater than a third threshold; and performing the iterative recovery technique using the time from the one of the time sources if the cumulative credibility score is less than the second threshold and the time difference between the system time and the time from the one of the time sources is greater than a fourth threshold, wherein the fourth threshold is greater than the third threshold.

[0070] Any element of any claim and / or any combination of any element described in this application falls within the intended scope of this disclosure and protection in any way.

[0071] The description of the embodiments has been presented for purposes of illustration and description. Suitable modifications and variations to the embodiments may be made in light of the above description or may be obtained from practical methods. For example, unless otherwise indicated, one or more of the described methods may be performed by suitable means and / or combinations of means. The described methods and associated actions may also be performed in parallel and / or simultaneously in various orders other than those described in this application. The described systems are exemplary in nature and may include additional elements and / or omit elements.

[0072] As used in this application, elements or steps described in the singular and beginning with the word "a" or "an" should be understood to not exclude multiple said elements or steps, unless such exclusion is stated. Furthermore, references to "an embodiment" or "an example" in this disclosure are not intended to exclude the existence of additional embodiments also incorporating the described features. The terms "first," "second," and "third," etc., are used merely as illustrative marks and are not intended to impose numerical requirements or a particular order of position on their objects.

[0073] Embodiments of this disclosure typically provide multiple circuits, electrical devices, and / or at least one controller. All references to the circuits, at least one controller, and other electrical devices, and the functions provided by each, are not intended to be limited to what is shown and described herein. While specific labels may be assigned to the various circuits, controllers, and other electrical devices disclosed, these labels are not intended to limit the scope of operation of the individual circuits, controllers, and other electrical devices. Such circuits, controllers, and other electrical devices may be combined with each other and / or separated in any way based on the desired specific type of electrical implementation.

[0074] A block is understood to be a hardware system or element thereof having at least one of the following: a processing unit executing software and a dedicated circuit structure for implementing corresponding desired signal transmission or processing functions. Therefore, part or all of a system may be implemented as software and firmware executed by a processor or programmable digital circuitry. It should be recognized that any system disclosed herein may include any number of microprocessors, integrated circuits, memory devices (…). For example The system comprises flash memory, random access memory (RAM), read-only memory (ROM), electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or other suitable variations thereof) and software that cooperates with each other to perform the operations disclosed herein. Furthermore, any system disclosed herein may utilize any one or more microprocessors to execute a computer program embodied in a non-transitory computer-readable medium programmed to perform any number of functions disclosed. Additionally, any controller provided herein includes a housing and any number of microprocessors, integrated circuits, and memory devices. For example Flash memory, random access memory (RAM), read-only memory (ROM), electrically programmable read-only memory (EPROM) and / or electrically erasable programmable read-only memory (EEPROM)).

[0075] Although various embodiments of the invention have been described, those skilled in the art will understand that many more embodiments and implementations are within the scope of the invention. Specifically, those skilled in the art will recognize the interchangeability of the various features from different embodiments. While these techniques and systems have been disclosed in the context of certain embodiments and examples, it should be understood that these techniques and systems can be extended beyond the specifically disclosed embodiments to other embodiments, and / or uses and obvious modifications thereof.

Claims

1. A method for updating system time, the method comprising: The cumulative credibility score is determined based on one or more credibility scores associated with one or more corresponding time sources; as well as The system time is updated based on the time from one of the corresponding one or more time sources and the cumulative confidence score; Updating the system time includes: If the cumulative confidence score is greater than the first threshold, the system time is set to be equal to the time from one of the time sources. If the cumulative confidence score is less than the first threshold but greater than the second threshold, and the time difference between the system time and the time from one of the time sources is greater than a third threshold, then an iterative recovery technique is performed using the time from the one of the time sources; and If the cumulative confidence score is less than the second threshold and the time difference between the system time and the time from one of the time sources is greater than the fourth threshold, then the iterative recovery technique is performed using the time from the one of the time sources.

2. The method of claim 1, wherein the fourth threshold is greater than the third threshold.

3. The method of claim 1, wherein performing the iterative recovery technique includes adding recovery time to the system time at a predetermined frequency.

4. The method of claim 1, wherein determining the cumulative confidence score comprises summing the one or more confidence scores associated with the corresponding one or more time sources.

5. The method of claim 1, further comprising determining the one or more credibility scores based on risk analysis of the time source.

6. The method of claim 5, wherein each of the risk analyses is a threat analysis and risk assessment (TARA) performed using the Electronic Security Vehicle Intrusion Prevention Application (EVITA) model.

7. The method of claim 1, further comprising initializing the system time to the maximum value among the time from the real-time clock, the default time, and the recovery time.

8. The method of claim 1, further comprising determining, before updating the system time, that the times from the respective one or more time sources are within a threshold time interval from each other.

9. The method of claim 1, wherein the time source comprises at least one of a Network Time Protocol (NTP) time source, a Global Positioning System (GPS) time source, or a real-time clock time source.

10. A non-transitory computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform a step for updating a system time, the step comprising: The cumulative credibility score is determined based on one or more credibility scores associated with one or more corresponding time sources; as well as The system time is updated based on the time from one of the corresponding one or more time sources and the cumulative confidence score; Updating the system time includes: If the cumulative confidence score is greater than the first threshold, the system time is set to be equal to the time from one of the time sources. If the cumulative confidence score is less than the first threshold but greater than the second threshold, and the time difference between the system time and the time from one of the time sources is greater than a third threshold, then an iterative recovery technique is performed using the time from the one of the time sources; and If the cumulative confidence score is less than the second threshold and the time difference between the system time and the time from one of the time sources is greater than the fourth threshold, then the iterative recovery technique is performed using the time from the one of the time sources.

11. The computer-readable storage medium of claim 10, wherein the system time is maintained by the vehicle system.

12. The computer-readable storage medium of claim 11, wherein the automotive system is one of an automotive infotainment system, an autonomous driving system, an advanced driver assistance system (ADAS), an intelligent traffic management system, a connected vehicle system, a vehicle-to-everything (V2X) communication system, a cockpit system, or a telemetry system.

13. The computer-readable storage medium of claim 10, wherein the fourth threshold is greater than the third threshold.

14. The computer-readable storage medium of claim 10, wherein performing the iterative recovery technique includes adding recovery time to the system time at a predetermined frequency, and wherein the recovery time is stored in a secure storage device.

15. The computer-readable storage medium of claim 10, wherein determining the cumulative confidence score includes summing the one or more confidence scores associated with the corresponding one or more time sources.

16. The computer-readable storage medium of claim 10, the step further comprising initializing the system time to the maximum value of a time from a real-time clock, a default time, and a recovery time.

17. A system comprising: The memory stores the application program; as well as A processor, coupled to the memory and configured to: The cumulative credibility score is determined based on one or more credibility scores associated with one or more corresponding time sources; as well as The system time is updated based on the time from one of the corresponding one or more time sources and the cumulative confidence score; Updating the system time includes: If the cumulative confidence score is greater than the first threshold, the system time is set to be equal to the time from one of the time sources. If the cumulative confidence score is less than the first threshold but greater than the second threshold, and the time difference between the system time and the time from one of the time sources is greater than a third threshold, then an iterative recovery technique is performed using the time from the one of the time sources; and If the cumulative confidence score is less than the second threshold and the time difference between the system time and the time from one of the time sources is greater than the fourth threshold, then the iterative recovery technique is performed using the time from the one of the time sources.

18. The system of claim 17, wherein the fourth threshold is greater than the third threshold.

Images