Control device, method, storage medium and vehicle

Abstract

The present disclosure relates to a control device, a method, a storage medium and a vehicle. A control device for controlling the operation of multiple applications includes: a first acquisition unit that acquires messages sent from the applications and messages received by the applications; a storage unit that stores priorities that set a priority order for processing messages related to the multiple applications; and an arbitration unit that arbitrates the order of encryption processing of the messages acquired by the first acquisition unit based on the priorities stored in the storage unit.

Description

Technical Field

[0001] The present disclosure relates to a control device and the like mounted on a vehicle. Background Art

[0002] Japanese Unexamined Patent Application Publication No. 2011-078090 (JP 2011-078090 A) discloses a control device having execution environments of a plurality of programs (applications), which is provided in a communication terminal having connection resources for connecting to an access point of a communication network. In the control device described in JP 2011-078090 A, in a communication terminal having a plurality of program execution environments (virtual machines), permission or prohibition of connection requests from programs is appropriately controlled based on a security policy set in accordance with the execution environments. Therefore, wasteful use of system resources due to unnecessary switching and communication between execution environments is suppressed. Summary of the invention

[0003] However, in the control device described in JP2011-078090A, the processing of messages requested from each program is performed in the order in which the requests are received. Therefore, for example, when a message requires cryptographic processing (encryption / decryption), if hardware resources are insufficient, an application program that limits the message processing time (such as the transmission delay allowable time) may not be able to meet performance requirements.

[0004] The present disclosure has been made in view of the above-mentioned problems, and an object of the present disclosure is to provide a control device or the like that can suppress an application program having a time constraint from failing to satisfy performance requirements.

[0005] In order to solve the above-mentioned problem, a scheme of the disclosed technology is a control device, which controls the operation of multiple applications, and the control device includes: a first acquisition unit, which acquires messages sent from the application and messages received by the application; a storage unit, which stores a priority level for setting a priority order for processing messages related to multiple applications at least; and an arbitration unit, which arbitrates the order of encryption processing of the messages acquired by the first acquisition unit based on the priority level stored in the storage unit.

[0006] According to the control device of the present disclosure, since the order of encryption processing of messages is arbitrated based on a predetermined priority, it is possible to suppress a time-limited application from failing to meet performance requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Features, advantages, and technical and industrial significance of exemplary embodiments of the present invention will be described below with reference to the accompanying drawings, in which like reference numerals represent like elements, and in which:

[0008] Figure 1 is a block diagram showing a schematic configuration of a virtualization system including a control device according to an embodiment of the present disclosure;

[0009] Figure 2 is a flow chart of a virtualization mechanism process performed by the virtualization mechanism;

[0010] Figure 3 is a flow chart of a virtual machine process performed by the virtual machine;

[0011] Figure 4 is a flowchart of a BSW communication process according to a first process example executed by a virtual machine;

[0012] Figure 5A is a flowchart of an arbitration process according to a first process example performed by a control device;

[0013] Figure 5B is a flowchart of an arbitration process according to a first process example performed by a control device;

[0014] Fig. 6A is a diagram showing an example of priorities stored in a control device;

[0015] Figure 6B is a diagram showing an example of priorities stored in a control device;

[0016] Figure 7 is a diagram showing an example of messages of respective applications registered in a hardware security module (HSM) based on arbitration processing according to a first processing example;

[0017] Figure 8 is a flowchart of a basic software (BSW) communication process according to a second process example executed by a virtual machine;

[0018] Fig.9A is a flowchart of an arbitration process according to a second process example performed by a control device;

[0019] Fig. 9B is a flowchart of an arbitration process according to a second process example performed by a control device; and

[0020] Fig.10 : is a diagram showing an example of messages of respective applications registered in the HSM based on the arbitration process according to the second processing example. DETAILED DESCRIPTION

[0021] In a structure where multiple electronic control units (ECUs) are merged and integrated into a high-performance processor using virtualization technology such as a hypervisor, the control device of the present invention suppresses the inability to achieve message processing performance requirements due to the lack of safety functions provided by hardware by providing an arbitration function in a virtual environment and determining the message processing order based on a pre-given priority.

[0022] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

[0023] Example

[0024] Configuration

[0025] Figure 1 is a block diagram showing a schematic configuration of a virtualization system including a control device 21 according to an embodiment of the present disclosure. Figure 1 The virtualization system shown in FIG. 1 includes, in its configuration, an SoC 10, a virtualization mechanism 20, virtual machines 30 to 33, BSWs 41 to 43, a central G / W 50, and applications (apps) A to C. In the present embodiment, the operation will be described with reference to an example in which the virtualization system is installed on a vehicle capable of autonomous driving.

[0026] The system on chip (SoC) 10 is a high-performance processor in which a plurality of central processing units (CPUs) 1 to 4, a communication interface such as a controller area network (CAN), and a hardware security module (HSM) 11 are mounted (built-in) on the chip. The HSM 11 is hardware with tamper resistance for protecting encryption keys, and performs key storage, encryption / decryption calculations (encryption processing) using keys, key generation, random number generation, and the like.

[0027] The virtualization mechanism 20 is software running on the SoC 10, such as a virtual machine monitor, and implements multiple virtual machines 30 to 33. The virtualization mechanism 20 enables the physical resources of the SoC 10 (i.e., CPUs 1 to 4, CAN, and HSM 11) to be shared (allocated) by multiple virtual machines 30 to 33. The virtualization mechanism 20 of the present embodiment operates as a control device 21, which acquires messages (sending, receiving) from the virtual HSMs set in each virtual machine 31 to 33 (acquisition unit), acquires the state of the vehicle from a device installed on the vehicle not shown (acquisition unit), and arbitrates the order of messages (sending, receiving) registered in the HSM 11 based on the priority of the processing order set in advance (storage unit) and the state of the vehicle (arbitration unit).

[0028] Virtual machines (VMs) 30 to 33 are virtualized computers running on a virtualization mechanism 20. Each virtual machine can simulate the behavior of a computer like a single computer hardware. A basic software (BSW) 41 including an operating system (OS) and a communication function is installed on the virtual machine 31, and an application A (app A) as a control system other than a control system related to autonomous driving is installed on the BSW 41. BSW 42 is installed on the virtual machine 32, and an autonomous driving application B (app B) for autonomous driving as a control system is installed on the BSW 42. BSW 43 is installed on the virtual machine 33, and an application C (app C) related to a multimedia system is installed on the BSW 43. The virtual machine 30 is equipped with a central gateway (G / W) 50 that controls message relay. The virtual machine 30 performs sending and receiving of messages with applications A to C connected via virtual machines 31 to 33 via a network such as CAN. In addition, the virtual machines 31 to 33 in this embodiment each have a virtual HSM. The virtual HSM is a buffer that temporarily stores transmission messages that need to be encrypted by the HSM 11 in each application and received messages that need to be decrypted by the HSM 11 in each application.

[0029] Among the messages sent from applications A to C, the messages requiring high security are encrypted by the HSM 11 and then sent to the network. In addition, among the messages received by applications A to C, the encrypted messages are decrypted by the HSM 11 and then sent to the respective applications.

[0030] exist Figure 1 In the example of FIG. 1 , a configuration including four virtual machines 30 to 33 is shown. However, the configuration is not limited thereto. In addition, the number and type of applications implemented by each virtual machine 30 to 33 are not limited to those shown in the figure. For example, multiple applications may be implemented on one virtual machine, and the types of the multiple applications may be different (e.g., a control system (autonomous driving) and a multimedia system).

[0031] When a plurality of transmission messages that need to be encrypted in the HSM 11 and a plurality of received messages that need to be decrypted in the HSM 11 are requested, the control device 21 of the present disclosure preferably controls the processing order of the plurality of messages as follows.

[0032] control

[0033] Will refer to Figures 2 to 9B The control performed by various configurations of the virtualization system of the present disclosure is described.

[0034] 1 Basic Processing (common to the first processing example and the second processing example)

[0035] 1-1 Virtualization mechanism processing

[0036] Figure 2 2 is a flowchart showing the process of the virtualization mechanism processing performed by the virtualization mechanism 20. When the power of the virtualization system is turned on, Figure 2 The virtualization mechanism process shown in the figure is activated.

[0037] Step S201

[0038] The virtualization mechanism 20 starts all virtual machines 30 to 33. Therefore, the virtual machine processing ( Figure 3 ) is executed in parallel with the virtualization mechanism processing. When all virtual machines 30 to 33 are started, the processing proceeds to step S202.

[0039] Step S202

[0040] The virtualization mechanism 20 determines whether it is time to perform periodic processing (periodic processing). The period is a period for confirming whether a message is stored in the virtual HSM of the virtual machines 31 to 33, and can be set to, for example, 1 ms. When the timing of the periodic processing is reached (step S202, yes), the process proceeds to step S203, and when the timing of the periodic processing is not reached (step S202, no), the process proceeds to step S204.

[0041] Step S203

[0042] The virtualization mechanism 20 performs arbitration processing ( Figure 5A and Figure 5B ). The arbitration process will be described later. When the arbitration process is completed, the process proceeds to step S204.

[0043] Step S204

[0044] The virtualization mechanism 20 determines whether to terminate its own operation. As a case of terminating its own operation, the case where the power of the virtualization system is turned off can be used as an example. When the operation of the virtualization mechanism 20 is terminated (step S204, yes), the virtualization mechanism processing is terminated, and when the operation of the virtualization mechanism 20 is not terminated (step S204, no), the processing proceeds to step S202.

[0045] 1-2 Virtual Machine Processing

[0046] Figure 3 3 is a flowchart showing the process of virtual machine processing performed by each virtual machine 31 to 33. Figure 3The virtual machine process illustrated in FIG. 1 is started when the virtual machines 31 to 33 are started by the process of the virtualization mechanism 20. Although the virtual machine process executed by the virtual machine 31 will be described below as a representative, the same applies to the virtual machine processes executed by the virtual machines 32 and 33.

[0047] Step S301

[0048] The virtual machine 31 determines whether it is time to perform periodic processing (periodic processing). As described above, the period is a period for confirming whether a message is stored in the virtual HSM of the virtual machine 31, and can be set to, for example, 1 ms. When the timing of the periodic processing is reached (step S301, yes), the process proceeds to step S302, and when the timing of the periodic processing is not reached (step S301, no), the process proceeds to step S305.

[0049] Step S302

[0050] When the received message decrypted in the previous periodic processing is still in the HSM 11, the virtual machine 31 acquires the received message from the HSM 11. When the decrypted received message is acquired, the process proceeds to step S303.

[0051] Step S303

[0052] The virtual machine 31 performs BSW communication processing ( Figure 4 ). The BSW communication process will be described later. When the BSW communication process is completed, the process proceeds to step S304.

[0053] Step S304

[0054] The virtual machine 31 passes the decrypted received message to each application A, and executes application processing based on the received message. When the application processing is executed, the process proceeds to step S305.

[0055] Step S305

[0056] The virtual machine 31 determines whether to terminate its own operation. As a case of terminating its own operation, the case where the power of the virtualization system is turned off can be used as an example. When the operation of the virtual machine 31 is terminated (step S305, yes), the processing of the virtual machine is terminated, and when the operation of the virtual machine 31 is not terminated (step S305, no), the processing proceeds to step S301.

[0057] 2 First processing example

[0058] 2-1BSW communication processing

[0059] Figure 44 is a flowchart showing the procedure of the BSW communication processing according to the first processing example performed by the virtual machines 31 to 33 using the BSWs 41 to 43. Figure 4 The BSW communication processing of the first processing example shown in FIG. 1 is independently executed by the virtual machines 31 to 33. Although the virtual machine processing executed by the virtual machine 31 will be described below as a representative, the same applies to the virtual machine processing executed by the virtual machines 32 and 33.

[0060] Step S401

[0061] The virtual machine 31 confirms that the transmission timing at which the message can be transmitted has been reached. When the transmission timing is confirmed, the process proceeds to step S402.

[0062] Step S402

[0063] The virtual machine 31 determines whether there is a send message that needs to be encrypted requested by the application A. When there is a send message that needs to be encrypted (step S402, yes), the process proceeds to step S403, and when there is no send message that needs to be encrypted (step S402, no), the process proceeds to step S404.

[0064] Step S403

[0065] The virtual machine 31 stores the transmission message that needs to be encrypted in the virtual HSM. When the transmission message is stored in the virtual HSM, the process proceeds to step S404.

[0066] Step S404

[0067] The virtual machine 31 confirms whether the received message of the application A exists. When the confirmation of the received message is completed, the process proceeds to step S405.

[0068] Step S405

[0069] The virtual machine 31 determines whether there is an encrypted received message of the application A. When there is an encrypted received message (step S405, Yes), the process proceeds to step S406, and when there is no encrypted received message (step S405, No), the process proceeds to step S407.

[0070] Step S406

[0071] The virtual machine 31 stores the encrypted received message in the virtual HSM. When the received message is stored in the virtual HSM, the process proceeds to step S407.

[0072] Step S407

[0073] The virtual machine 31 notifies the content of the message stored in the virtual HSM (storage content) to the control device 21 of the virtualization mechanism 20. When the storage content is notified to the control device 21, the BSW communication process according to the first process example ends.

[0074] Since there is no particular restriction on the order in which the sent message and the received message are stored in the virtual HSM, the processing of the sent message in steps S401 to S403 and the processing of the received message in steps S404 to S406 may be exchanged.

[0075] 2-2 Arbitration Process

[0076] Figure 5A and Figure 5B is a flowchart showing the procedure of arbitration processing according to the first processing example executed by the control device 21 . Figure 5A Processing and Figure 5B The processing is connected by connectors X and Y. Figure 5A and Figure 5B The arbitration process of the first process example shown in FIG. 1 is performed in a predetermined cycle, such as Figure 2 As shown in step S202 of . During execution, the control device 21 obtains the stored message from each virtual HSM of the virtual machines 31 to 33 (first obtaining unit).

[0077] In this arbitration process, a sent message process (steps S501 to S507 ) and a received message process (steps S506 to S514 ) are performed on all messages stored in all virtual HSMs of the virtual machines 31 to 33 .

[0078] Step S501

[0079] The control device 21 acquires the state of the vehicle (second acquisition unit). When the state of the vehicle is acquired, the process proceeds to step S502.

[0080] Step S502

[0081] The control device 21 determines whether the vehicle is in a state of autonomous driving (during autonomous driving) based on the obtained state of the vehicle. In the case of the first state during autonomous driving (step S502, yes), the process proceeds to step S503, and in the case of not being in the second state during autonomous driving (step S502, no), the process proceeds to step S504.

[0082] Step S503

[0083] The control device 21 selects the first priority as the priority for the arbitration message. Fig. 6AAs shown, in this embodiment, the priority order of each message processing is set in the first priority. The priority order at least includes giving priority to the sent message over the received message (the priority relationship of sending and receiving), and giving priority to the message requested from the application related to autonomous driving (the first application) over the message requested from other applications (app (the second application)) (the priority relationship of each application / type). When the first priority is selected, the process proceeds to step S505.

[0084] Step S504

[0085] The control device 21 selects the second priority as the priority for arbitration of the message. Figure 6B As shown, in this embodiment, the priority order of each message processing is set in the second priority order. The priority order at least includes giving priority to the sent message over the received message (the priority relationship of sending and receiving), and giving priority to the message requested from the application of the control system other than autonomous driving (the second application) in the application related to the control system (the priority relationship of each application / type). When the second priority order is selected, the process proceeds to step S506.

[0086] Step S505

[0087] The control device 21 registers the transmission message of the application related to autonomous driving among the one or more transmission messages stored in each virtual HSM in the HSM 11. In the present embodiment, the transmission message requested by the autonomous driving application B and stored in the virtual HSM of the virtual machine 32 is registered in the HSM 11. Therefore, the transmission message of the application related to autonomous driving is registered in the HSM 11 with the highest priority. When all the transmission messages of the application related to autonomous driving are registered in the HSM 11, the process proceeds to step S506.

[0088] Step S506

[0089] Among the one or more transmission messages stored in each virtual HSM, the transmission message requested by the application related to the control system is registered in the HSM 11 by the control device 21 based on the first priority or the second priority. When based on the first priority (when autonomous driving is in progress), in the present embodiment, the control device 21 registers the transmission message requested by the control system application A and stored in the virtual HSM of the virtual machine 31 in the HSM 11. On the contrary, when based on the second priority (when autonomous driving is not in progress), in the present embodiment, the control device 21 first registers the transmission message requested by the control system application A and stored in the virtual HSM of the virtual machine 31 in the HSM 11, and then registers the transmission message requested by the autonomous driving application B and stored in the virtual HSM of the virtual machine 32 in the HSM 11. Therefore, the transmission message having the highest priority in the control system is first registered in the HSM 11. When all the transmission messages of the control system applications are registered in the HSM 11, the process proceeds to step S507.

[0090] Step S507

[0091] Among the one or more send messages stored in each virtual HSM, the send message requested by the application related to the multimedia system is registered in the HSM 11 by the control device 21 based on the first priority or the second priority. In the present embodiment, the control device 21 registers the send message requested by the multimedia system application C and stored in the virtual HSM of the virtual machine 33 in the HSM 11, regardless of whether its priority is the first priority or the second priority. Therefore, the send message of the multimedia system application that does not need to be processed preferentially is registered last in the HSM 11. When all the send messages of the multimedia system application are registered in the HSM 11, the process proceeds to step S508.

[0092] The processing of the above steps S501 to S507 is performed on all the send messages stored in all the virtual HSMs of the virtual machines 31 to 33 .

[0093] Step S508

[0094] The control device 21 acquires the state of the vehicle (second acquisition unit). When the state of the vehicle is acquired, the process proceeds to step S509.

[0095] Step S509

[0096] The control device 21 determines whether the vehicle is in a state of autonomous driving (during autonomous driving) based on the acquired state of the vehicle. In the case of being in the first state during autonomous driving (step S509, yes), the process proceeds to step S510, and in the case of not being in the second state during autonomous driving (step S509, no), the process proceeds to step S511.

[0097] Step S510

[0098] The control device 21 selects the first priority as the priority for the arbitration message. As described above, in the present embodiment, the processing order of each message is set in the first priority. The processing order includes that the received message has a lower order than the sent message, and the message of the application related to autonomous driving takes precedence over the message of other applications ( Fig. 6A ). When the first priority is selected, the process proceeds to step S512.

[0099] Step S511

[0100] The control device 21 selects the second priority as the priority for arbitration of the message. As described above, the second priority in this embodiment is set as the processing order of each message. The processing order includes the received message having a lower order than the sent message ( Figure 6B ). When the second priority level is selected, the process proceeds to step S513.

[0101] Step S512

[0102] The control device 21 registers the received message requested by the application related to the autonomous driving from among the one or more received messages stored in the respective virtual HSMs in the HSM 11. In the present embodiment, the received message requested by the autonomous driving application B and stored in the virtual HSM of the virtual machine 32 is registered in the HSM 11. Therefore, among all the received messages, the received message of the autonomous driving application is preferentially registered in the HSM 11. When all the received messages of the autonomous driving application are registered in the HSM 11, the process proceeds to step S513.

[0103] Step S513

[0104] Among the one or more received messages stored in each virtual HSM, the received message requested by the application related to the control system is registered in the HSM 11 by the control device 21 based on the first priority or the second priority. When based on the first priority (when autonomous driving is in progress), in the present embodiment, the received message requested by the control system application A and stored in the virtual HSM of the virtual machine 31 is registered in the HSM 11. On the contrary, when based on the second priority (when autonomous driving is not in progress), in the present embodiment, the received message requested by the control system application A and stored in the virtual HSM of the virtual machine 31 is first registered in the HSM 11, and the received message requested by the autonomous driving application B and stored in the virtual HSM of the virtual machine 32 is registered in the HSM 11. Therefore, the received message having the highest priority in the control system application is first registered in the HSM 11. When all the received messages of the control system application are registered in the HSM 11, the process proceeds to step S514.

[0105] Step S514

[0106] Among the one or more received messages stored in the respective virtual HSMs, the received message requested by the application related to the multimedia system is registered in the HSM 11 by the control device 21 based on the first priority or the second priority. In the present embodiment, the received message requested by the multimedia system application C and stored in the virtual HSM of the virtual machine 33 is registered in the HSM 11 regardless of whether its priority is the first priority or the second priority. Therefore, the received message of the multimedia system application that does not need to be processed with priority is registered last in the HSM 11. When all the received messages of the multimedia system application are registered in the HSM 11, the arbitration processing according to the first processing example ends.

[0107] The processing of the above steps S508 to S514 is performed on all received messages stored in all virtual HSMs of the virtual machines 31 to 33 .

[0108] According to the BSW communication processing and arbitration processing according to the first processing example, when the vehicle is being driven autonomously, the registration order of all messages in the HSM (the order of encryption processing) is arbitrated based on the first priority, and when the vehicle is not being driven autonomously, the registration order of all messages in the HSM (the order of encryption processing) is arbitrated based on the second priority. That is, while registering messages in the HSM11, it is possible to give priority to sent messages requested by various applications over received messages, and to give priority to messages requested by applications related to autonomous driving over messages requested by other applications. Therefore, it is possible to implement arbitration of the preferred order of message encryption processing, in which the state of the vehicle and the processing delay allowed by each application are comprehensively determined.

[0109] Figure 7 An example of sent messages and received messages of each application registered in the HSM 11 based on arbitration processing according to the first processing example is shown. The messages temporarily stored in each virtual HSM of the virtual machines 31 to 33 are transferred to the arbitration unit of the control device 21, and then arbitration of the processing order based on the state and priority of the vehicle is performed in the arbitration unit. Then, as a result of arbitration, when the autonomous driving of the vehicle is in progress, based on the first priority ( Figure 7 ), the messages are registered in the HSM 11 in the order of sent messages > received messages, and application B > application A > application C. On the contrary, as a result of arbitration, when the autonomous driving of the vehicle is not in progress, based on the second priority ( Figure 7 ), messages are registered in the HSM 11 in the order of sent messages > received messages, and application A > application B > application C.

[0110] 3 Second processing example

[0111] As mentioned above, the virtualization mechanism handles ( Figure 2 ) and virtual machine processing ( Figure 3 ) are executed in parallel. Therefore, there is a possibility that the periodic processing executed in each processing is delayed by at most one cycle (for example, 1 ms) according to the processing timing. Therefore, in this second processing example, when there is an application program (for example, an application program related to autonomous driving) that cannot allow processing delay, a process that can eliminate the influence of processing delay will be described.

[0112] 3-1BSW communication processing

[0113] Figure 8 4 is a flowchart showing the procedure of the BSW communication processing according to the second processing example performed by the virtual machines 31 to 33 using the BSWs 41 to 43. Figure 8The BSW communication processing of the second processing example shown is independently executed by the virtual machines 31 to 33 .

[0114] Step S801

[0115] Each of the virtual machines 31 to 33 confirms the transmission timing at which the message can be transmitted. When the transmission timing is confirmed, the process proceeds to step S802.

[0116] Step S802

[0117] Each of the virtual machines 31 to 33 determines whether there is a send message that needs to be encrypted requested by the application programs A to C. When there is a send message that needs to be encrypted (step S802, yes), the process proceeds to step S803, and when there is no send message that needs to be encrypted (step S802, no), the process proceeds to step S806.

[0118] Step S803

[0119] Virtual machines 31 to 33 determine whether the sent message that needs to be encrypted is a sent message from an autonomous driving application. In the configuration of the embodiment of the present invention, since only one application is implemented on each virtual machine, for virtual machines 31 and 33, it is always determined that the sent message that needs to be encrypted is not a sent message from an autonomous driving application, and for virtual machine 32, it is always determined that the sent message that needs to be encrypted is a sent message from an autonomous driving application B. On the contrary, when multiple different types of applications such as a control system (autonomous driving) and a multimedia system are implemented on one virtual machine, subsequent processing is allocated according to the determination in step S803. When the sent message that needs to be encrypted is a sent message from an autonomous driving application (step S803, yes), the process proceeds to step S804, and when the sent message that needs to be encrypted is not a sent message from an autonomous driving application (step S803, no), the process proceeds to step S805.

[0120] Step S804

[0121] The virtual machines 31 to 33 register the transmission message from the autonomous driving application in the HSM 11. In the configuration of the present embodiment, only the virtual machine 32 registers the transmission message directly in the HSM 11 without passing through the virtual HSM. When the transmission message is registered in the HSM 11, the process proceeds to step S806.

[0122] Step S805

[0123] Each of the virtual machines 31 to 33 stores the transmission message to be encrypted in the virtual HSM. In the configuration of this embodiment, the virtual machines 31 and 33 store the transmission message in the virtual HSM. When the transmission message is stored in the virtual HSM, the process proceeds to step S806.

[0124] Step S806

[0125] The virtual machines 31 to 33 each confirm the presence or absence of the received message of the application programs A to C. When the confirmation of the received message is completed, the process proceeds to step S807.

[0126] Step S807

[0127] Each of the virtual machines 31 to 33 determines whether there is an encrypted received message of the application programs A to C. When there is an encrypted received message (step S807, yes), the process proceeds to step S808, and when there is no encrypted received message (step S807, no), the process proceeds to step S811.

[0128] Step S808

[0129] Virtual machines 31 to 33 determine whether the encrypted received message is a received message from an autonomous driving application. In the configuration of the present embodiment, since only one application is implemented on each virtual machine, for virtual machines 31 and 33, it is always determined that the encrypted received message is not a received message of the autonomous driving application, and for virtual machine 32, it is always determined that the encrypted received message is a received message of autonomous driving application B. In contrast, when multiple different types of applications such as a control system (autonomous driving) and a multimedia system are implemented on one virtual machine, subsequent processing is allocated according to the determination of step S808. When the encrypted received message is a received message of an autonomous driving application (step S808, yes), the process proceeds to step S809, and when the encrypted received message is not a received message of an autonomous driving application (step S808, no), the process proceeds to step S810.

[0130] Step S809

[0131] The virtual machines 31 to 33 register the received message sent to the autonomous driving application in the HSM 11. In the configuration of the present embodiment, only the virtual machine 32 registers the received message directly in the HSM 11 without passing through the virtual HSM. When the received message is registered in the HSM 11, the process proceeds to step S811.

[0132] Step S810

[0133] Each of the virtual machines 31 to 33 stores the encrypted received message in the virtual HSM. In the configuration of the present embodiment, the virtual machines 31 and 33 store the received message in the virtual HSM. When the received message is stored in the virtual HSM, the process proceeds to step S811.

[0134] Step S811

[0135] The virtual machines 31 to 33 each notify the control device 21 of the virtualization mechanism 20 of the content (stored content) of the message stored in the virtual HSM. When the stored content is notified to the control device 21, the BSW communication process according to this second process example ends.

[0136] 3-2 Arbitration Process

[0137] Fig.9A and Fig. 9B : is a flowchart showing the procedure of the arbitration process according to the second process example performed by the control device 21. Fig.9A Processing and Fig. 9B The processing is connected by a connector Y. Figure 8 The execution of the BSW communication process of the second process example shown is consistent with that of Fig.9A and Fig. 9B The arbitration process of the illustrated second process example is executed in a predetermined cycle.

[0138] In this arbitration process, a sent message process (steps S901 and S902 ) and a received message process (steps S903 and S904 ) are performed on all messages stored in all virtual HSMs of the virtual machines 31 to 33 .

[0139] Step S901

[0140] Among the one or more send messages stored in each virtual HSM, the send message requested by the application related to the control system is registered in the HSM 11 by the control device 21 based on the priority. The priority applied to this processing can be the first priority or the second priority mentioned above. In the present embodiment, the control device 21 registers the send message by causing the send message stored in the virtual HSM of the virtual machine 31 through a request from the control system application A to be cut in between the send message of the autonomous driving application already registered in the HSM 11 and the received message of the autonomous driving application. Therefore, in the virtual HSM, the send message of the control system application is registered in the HSM 11 after the send message of the autonomous driving application. When all the send messages of the control system application are registered in the HSM 11, the process proceeds to step S902.

[0141] Step S902

[0142] Among the one or more send messages stored in each virtual HSM, the send message requested by the application related to the multimedia system is registered in the HSM11 by the control device 21 based on the first priority. The priority applied to this processing can be the first priority or the second priority mentioned above. In the present embodiment, the control device 21 registers the send message by causing the send message stored in the virtual HSM of the virtual machine 33 by a request from the multimedia system application C to be cut in between the send message of the autonomous driving application already registered in the HSM11 and the received message of the control system application. Therefore, the send message of the multimedia system application is registered in the HSM 11 after the send message of the control system application. When all the send messages of the multimedia system application are registered in the HSM 11, the process proceeds to step S903.

[0143] The processing of the above steps S901 and S902 is performed on all the send messages stored in all the virtual HSMs of the virtual machines 31 to 33 .

[0144] Step S903

[0145] Among the one or more received messages stored in each virtual HSM, the received message requested by the application related to the control system is registered in the HSM 11 by the control device 21 based on the priority. The priority applied to the processing may be the first priority or the second priority described above. In the present embodiment, the received message requested by the control system application A and stored in the virtual HSM of the virtual machine 31 is registered in the HSM 11 by the control device 21. Therefore, the received message of the control system application in the virtual HSM is registered after the received message of the autonomous driving application that has been registered in the HSM 11. When all the received messages of the control system application are registered in the HSM 11, the process proceeds to step S904.

[0146] Step S904

[0147] Among the one or more received messages stored in each virtual HSM, the received message requested by the application related to the multimedia system is registered in the HSM 11 by the control device 21 based on the first priority or the second priority. The priority applied to the processing may be the first priority or the second priority mentioned above. In the present embodiment, the control device 21 registers the received message stored in the virtual HSM of the virtual machine 33 by the request from the multimedia system application C after the received message of the control system application already registered in the HSM 11. Therefore, the received message of the multimedia system application that does not need to be processed with priority is registered in the HSM 11 last. When all the received messages of the multimedia system application are registered in the HSM 11, the arbitration processing according to the second processing example ends.

[0148] The processing of the above steps S903 and S904 is performed on all received messages stored in all virtual HSMs of the virtual machines 31 to 33 .

[0149] In the BSW communication processing and arbitration processing according to the second processing example, when the autonomous driving of the vehicle is in progress, the message of the autonomous driving application is registered in the HSM with the highest priority without the need for arbitration, and when the autonomous driving of the vehicle is not in progress, the registration order (order of encryption processing) of all messages in the HSM is arbitrated based on the priority. That is, the sent messages and received messages requested by the application related to autonomous driving can be registered in the HSM 11 while taking precedence over the sent messages and received messages requested by other applications. Therefore, even if there is a delay (deviation) between the periodic processing of the virtualization mechanism processing and the periodic processing of the virtual machine processing, it is possible to avoid the processing delay affecting the encryption processing of the messages of the application that cannot be allowed. In addition, the arbitration unit of the control device 21 does not need to determine whether the state of the vehicle is during autonomous driving, and the processing load of the control device 21 is reduced.

[0150] Fig.10 An example of the sent messages and received messages of each application is shown, wherein the sent messages and the received messages are registered in the HSM 11 based on the arbitration processing according to the second processing example. The message temporarily stored in the virtual HSM of the virtual machine 32 is directly registered in the HSM 11. The messages temporarily stored in the respective virtual HSMs of the virtual machines 31 and 33 are transferred to the arbitration unit of the control device 21, and then arbitration of the processing order based on the vehicle state and priority is performed in the arbitration unit. Then, as a result of the arbitration, the messages are registered in the HSM 11 in the order of sent message > received message, and application A > application C based on the priority.

[0151] Operation and Effect

[0152] As described above, in the control device according to the embodiment of the present disclosure, the order of encryption processing of the sent messages from each application and the received messages for each application is arbitrated based on the predetermined priority according to the request of the application (such as the transmission delay allowable time). At the time of arbitration, all or part of the messages from each application and the messages for each application are temporarily stored in the virtual HSM provided in each virtual machine, and the stored multiple messages are arbitrated based on the priority. This suppresses the time-constrained application from failing to meet the performance requirements.

[0153] In addition, in the control device according to the present embodiment, the priority can be changed according to the state of the vehicle. Therefore, it is possible to realize such a control in which the encryption processing of a specific application (such as an application related to autonomous driving) can be prioritized. In the present embodiment, as a priority, an example has been described in which an application related to autonomous driving is given the highest priority when autonomous driving of the vehicle is in progress. However, in addition to this, the messages to be prioritized can be changed according to the state of various vehicles. For example, when diagnostic processing (diag processing) is being performed, messages related to diagnosis can be prioritized, when plug-in charging is in progress, messages related to external charging can be prioritized, when the vehicle is parked or parked and not in use, messages required for the state can be prioritized, and in the state of performing ECU software update processing (OTA) in a wireless manner, messages required for update processing can be prioritized. This change in priority according to the priority target can be easily achieved by appropriately rewriting the content stored in the storage unit of the virtualization mechanism, and can be flexibly corresponded according to the number and type of applications implemented in the virtual machine.

[0154] In addition, according to the control device according to the present embodiment, since the HSM only needs to perform encryption processing of messages registered via the virtualization mechanism in sequence, the existing HSM can be used as it is. In addition, in the communication software implemented in the virtual machine, since the message registration destination (storage destination) is only changed from the HSM to the virtual HSM, and its control is not changed, large-scale modification is not required.

[0155] The priority of this embodiment shows an example that defines the priority relationship between sent messages and received messages, the priority relationship of each application (A, B, C), and the priority relationship of each application type (control system, multimedia system). However, in addition to this definition, priority relationships can also be defined for each virtual machine. For example, a priority relationship such as virtual machine 31>virtual machine 32>virtual machine 33 can be considered. Examples of priority setting methods include a method of giving an absolute priority relationship (application A: medium, application B: high, application C: low) and a method of giving a relative priority relationship (application B>application A, application B>application C, application A>application C), etc. as examples.

[0156] Although an embodiment of the technology of the present disclosure has been described above, in addition to the control device, the present disclosure may also be interpreted as, for example, a control method executed by a control device including a processor and a memory, a control program of the method, a computer-readable non-temporary storage medium storing the control program, or a vehicle in which the control device is installed.

[0157] The present disclosure can be used as a control device mounted on a vehicle.

Claims

1. A control device for controlling the operation of a plurality of application programs, the control device comprising: a first acquiring unit, which acquires messages sent from the plurality of applications and messages received by the plurality of applications; a storage unit storing priorities that set priorities at least for processing of the messages associated with the plurality of applications; as well as an arbitration unit configured to arbitrate, based on the priority level stored by the storage unit, an order of encryption processing of the messages acquired by the first acquisition unit; wherein the control device is installed on a vehicle, The control device further includes a second acquisition unit, which acquires the state of the vehicle. The storage unit stores, as the priorities, a first priority level that assigns the highest priority to a first application and a second priority level that assigns the highest priority to a second application other than the first application, wherein, when the state of the vehicle acquired by the second acquisition unit is the first state, the arbitration unit arbitrates the order of encryption processing of the message acquired by the first acquisition unit based on the first priority, and When the state of the vehicle acquired by the second acquisition unit is a second state other than the first state, the arbitration unit arbitrates the order of the encryption processing of the message acquired by the first acquisition unit based on the second priority level.

2. The control device according to claim 1, in, The vehicle is capable of performing autonomous driving, wherein the first application is an application related to autonomous driving, and The first state is a state in which the vehicle is performing autonomous driving.

3. The control device according to claim 1, in, The control device is installed on a vehicle capable of performing autonomous driving, and The arbitration unit performs arbitration in which a processing order of messages of an application related to autonomous driving is given the highest priority among the plurality of applications.

4. The control device according to any one of claims 1 to 3, wherein: The priority levels stored in the storage unit are set so that the messages sent from the application program take precedence over the messages received by the application program.

5. A control method executed by a computer of a control device, the control device being installed on a vehicle, the control method comprising: The step of obtaining messages sent from an application and messages received by said application; A step of obtaining the status of the vehicle; a step of storing priorities, the priorities setting a priority order at least for processing of the messages related to the plurality of the applications, wherein the priorities include a first priority for assigning the highest priority to a first application and a second priority for assigning the highest priority to a second application other than the first application; and The step of arbitrating the order of encryption processing of the acquired messages based on the priority level comprises: When the state of the vehicle is a first state, arbitrating an order of encryption processing of the acquired messages based on the first priority, and When the state of the vehicle is a second state other than the first state, the order of the encryption processing of the acquired messages is arbitrated based on the second priority level.

6. A storage medium storing a control program executed by a computer of a control device, the control device being mounted on a vehicle, the control program comprising: The step of obtaining messages sent from an application and messages received by said application; A step of obtaining the status of the vehicle; a step of storing priorities, the priorities setting a priority order at least for processing of the messages related to the plurality of the applications, wherein the priorities include a first priority for assigning the highest priority to a first application and a second priority for assigning the highest priority to a second application other than the first application; and The step of arbitrating the order of encryption processing of the acquired messages based on the priority level comprises: When the state of the vehicle is a first state, arbitrating an order of encryption processing of the acquired messages based on the first priority, and When the state of the vehicle is a second state other than the first state, the order of the encryption processing of the acquired messages is arbitrated based on the second priority level.

7. A vehicle equipped with the control device according to any one of claims 1 to 4.

Images