Implementing security measures in applications

Abstract

The disclosure relates to implementing security measures in applications. An example apparatus includes a memory resource configured to store and communicate data. The apparatus may further include a security controller coupled to the memory resource, the security controller configured to receive data from the memory resource, receive latched data from the application controller, and, in response to a comparison of the data from the memory resource and the latched data from the application controller, transmit the latched data to the memory resource. It is determined whether command output from the application controller is allowed.

Description

[0001] Information about divisional applications

[0002] This application is a divisional application of the Chinese invention patent application with application number 201880080089.3, application date December 12, 2018, and invention name “Implementing security measures in applications”. Technical Field

[0003] The present disclosure relates generally to semiconductor memories and methods, and more particularly, to devices and methods related to security controllers. Background Art

[0004] In conventional motor vehicles (e.g., automobiles, cars, trucks, buses, etc.), the driver is critical to operating the vehicle's control systems. For example, the driver of a conventional motor vehicle makes decisions regarding the safe operation of the vehicle. Such decisions may include decisions related to the speed of the vehicle, the steering of the vehicle, obstacle and / or hazard identification, and obstacle and / or hazard avoidance. However, in some cases, the driver's ability to make these decisions and operate the vehicle's control systems may be limited. For example, driver injury, fatigue, concentration, and / or other factors, such as visibility (e.g., due to weather or terrain changes), may limit the driver's ability to safely operate a conventional motor vehicle and / or its control systems.

[0005] To mitigate the drawbacks caused by driver operation of conventional motor vehicles, various manufacturers have experimented with autonomous vehicles. Although autonomous vehicles can reduce the problems caused by the reduced ability of drivers to operate conventional cars, autonomous vehicles have their own drawbacks.

[0006] For example, an autonomous vehicle may rely on various sensors and / or cameras to determine the speed of the vehicle, the steering of the vehicle, obstacle and / or hazard identification, and obstacle and / or hazard avoidance. For example, data from these sensors and / or devices may be corrupted when stored in a memory or transmitted on a memory bus. The data may be corrupted by errors caused by noise, crosstalk, and / or other error sources. The host may receive commands to safely operate the autonomous vehicle and provide updates to the autonomous vehicle based on the data. If the data on which the commands are based is corrupted, the autonomous vehicle may stop operating, or in a worse case, fail to provide adequate obstacle and / or hazard identification and obstacle and / or hazard avoidance, which may result in injury or death to passengers in the autonomous vehicle. Summary of the invention

[0007] In one aspect, the present disclosure relates to a device for implementing security measures in an application, comprising: a memory resource, the memory resource being configured to: store data; and transmit the data; and a security controller, the security controller being coupled to the memory resource, wherein the security controller implements security measures in the application and is configured to: receive the data from the memory resource; receive latched data from an application controller; and determine whether to allow a command output from the application controller in response to a comparison of the data from the memory resource and the latched data from the application controller.

[0008] On the other hand, the present disclosure relates to a device for implementing security measures in an application, comprising: a memory resource, the memory resource being configured to: store data; and transmit the data; and a security controller, the security controller being coupled to the memory resource, wherein the security controller is configured to: receive the data from the memory resource; receive latched data from an application controller; and transmit a flag to the application controller in response to the security controller identifying a difference between the data from the memory resource and the latched data from the application controller.

[0009] On the other hand, the present disclosure relates to a device for implementing security measures in an application, comprising: a memory resource, the memory resource being configured to: store data; and transmit the data; and a security controller, the security controller being coupled to the memory resource, wherein the security controller is configured to: receive the data from the memory resource; receive latched data from an application controller; and in response to identifying a match between the data from the memory resource and the latched data from the application controller, allow a command to be output from the application controller.

[0010] On the other hand, the present disclosure relates to a method for implementing security measures in an application, comprising: receiving data from a memory resource; receiving latched data from an application controller; and determining whether to output a command from the application controller in response to a comparison of the data from the memory resource and the latched data from the application controller.

[0011] On the other hand, the present disclosure relates to a device for implementing security measures in an application, comprising: a memory resource, the memory resource being configured to: store data; and transmit the data; and a security controller, the security controller being coupled to the memory resource, wherein the security controller is configured to: receive the data from the memory resource; receive latched data from an application controller; and generate a response to an output from the application controller in response to a comparison of the data from the memory resource and the latched data from the application controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 is a block diagram of a system in the form of a host and a memory device according to various embodiments of the present disclosure.

[0013] Figure 2 is a flow chart associated with triple redundancy in autonomous driving applications according to various embodiments of the present disclosure.

[0014] Figure 3 is a diagram of memory output of a double-edge device according to various embodiments of the present disclosure.

[0015] Figure 4 is a flow chart of an inverter circuit including output data according to various embodiments of the present disclosure. DETAILED DESCRIPTION

[0016] The present disclosure includes devices and methods related to security controllers. An exemplary device includes a memory resource configured to store data and transmit data. The device may further include a security controller coupled to the memory resource, the security controller configured to receive data from the memory resource, receive latched data from an application controller, and determine whether to allow a command and / or multiple commands from the application controller to be output in response to a comparison of the data from the memory resource and the latched data from the application controller.

[0017] In some approaches, an autonomous vehicle may include a memory device for providing data to a controller. The data may include vehicle sensor data, such as obstacle and / or hazard information. The memory may store critical code, including firmware, software, and / or temporary calculations derived from the data.

[0018] To reduce the likelihood of an autonomous vehicle executing erroneous code, multiple entities (e.g., memory devices and / or controllers) can execute and identify the correct output, which can be referred to as redundancy. Embodiments can be implemented to provide safety measures in applications (e.g., autonomous driving applications in vehicles). For example, triple redundancy can include two entities transmitting the same code. A third entity can receive the code and identify whether one or more codes are corrupted.

[0019] In some embodiments, redundancy can enable the system to avoid failures and / or accidents in the field. For example, redundancy can ensure the correctness of data transmission between the memory device and the controller. Redundancy can also ensure the correctness of the execution of appropriate code by the controller.

[0020] For example, because the operation of a control system in an autonomous vehicle may be handled in whole or in part by control circuitry, an autonomous vehicle may be susceptible to data corruption. Data may be corrupted by noise, crosstalk, and / or other sources of error. Redundancy prevents a command, such as "activate brakes," from being sent when the command is based on corrupted data.

[0021] The figures herein follow a numbering convention in which the first digit or digits correspond to the figure number and the remaining digits identify the element or component in the figure. Similar elements or components between different figures may be identified by using similar numerals. For example, in Figure 1 114 can be used to index component "14". Figure 2 Similar elements in the drawings may be referenced as 214. It should be understood that the elements shown in the various embodiments herein may be added, exchanged and / or eliminated to provide multiple additional embodiments of the present disclosure. In addition, it should be understood that the proportions and relative scales of the elements provided in the drawings are intended to illustrate certain embodiments of the present invention and should not be considered limiting.

[0022] Figure 1 is a block diagram of a system 100 in the form of a host 110 and a control unit 112 according to various embodiments of the present disclosure. As used herein, a memory device 114, a controller 116, an application controller 117, and / or a security controller 118 may also be individually considered a "device".

[0023] like Figure 1 As shown, the device 100 includes a host 110 and a control unit 112. The control unit 112 may include memory resources (eg, a memory device 114) and a controller 116. The controller 116 may include an application controller 117 and a security controller 118.

[0024] The memory device 114 may include volatile and / or non-volatile memory configured to store instructions executable by the controller 116. For example, the memory device 114 may include flash memory (e.g., NOR), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), dynamic random access memory (DRAM), static random access memory (SRAM), and / or other suitable storage media. In some embodiments, the memory device 114 may be a double-edge device.

[0025] Device 100 can be used in autonomous driving applications. For example, control unit 112 can be located on a vehicle. Memory device 114 of control unit 112 can store autonomous vehicle data. For example, key code (e.g., firmware, specific parameters and data) for autonomous driving applications. The data can include data collected from vehicle sensors, photographic data collected from vehicle cameras, and / or combinations thereof. In some embodiments, memory device 114 can store data and transmit data. Data can be transmitted to controller 116 including application controller 117 and safety controller 118.

[0026] The application controller 117 may receive data from the memory device 114. The received data may be used by the application controller 117 to generate a command. For example, the data may contain information about the vehicle approaching a stop sign. The application controller 117 may generate a command to stop the car. Subsequently, the application may send the generated command and / or multiple commands to be executed by the vehicle.

[0027] In some embodiments, the data may be transmitted to the safety controller 118. The safety controller 118 may receive data from the memory device 114 and the application controller 117. The safety controller 118 may prevent the command and / or commands from being executed by the vehicle in response to comparing the data from the memory device 114 and the data from the application controller 117.

[0028] Figure 2 FIG. 2 is a flow chart 213 associated with triple redundancy in autonomous driving applications according to various embodiments of the present disclosure. Figure 2As shown, the memory device 214, the application controller 217, and the security controller 218 can be configured to exchange data and / or communicate. The memory device 214 can transmit data to the security controller 218 via data paths 222 and 224. The memory device 214 can transmit data to the application controller 217 via data path 220. The application controller 217 can transmit data to the security controller 218 via data path 226. The application controller 217 can communicate with the security controller 218 via communication path 230. The security controller 218 can communicate with the application controller 217 and the multiplexer 236 (e.g., MUX) via communication path 228.

[0029] In some embodiments, memory device 214 can store and transmit data. Security controller 218 can be coupled to memory device 214 via data paths 222 and 224. Security controller 218 can be configured to receive data from memory device 214. Data from memory device 214 can be received by security controller 218 as an inverted output via data path 222 and as a direct output via data path 224. The inverted output of data can be transmitted by memory device 214 on the falling edge of a clock, while the direct output of data can be transmitted by memory device 214 on the rising edge of a clock, as shown in FIG. Figure 3 Further discussed in .

[0030] The memory device 214 may transmit data to the application controller 217. The application controller 217 may be coupled to the memory device 214 via a data path 220. The application controller 217 may be configured to receive data from the memory device 214. The data from the memory device 214 may be received by the application controller 217 as a direct output via the data path 220. The direct output of data may be transmitted by the memory device 214 on the rising edge of the clock, such as Figure 3 Further discussed in .

[0031] In some embodiments, application controller 217 may latch data in response to receiving data from memory device 214. Application controller 217 may transmit the latched data to security controller 218. Application controller 217 may latch the data on the rising edge of the clock. Security controller 218 may be configured to receive the latched data from application controller 217. The latched data from application controller 217 may be received as an output by security controller 218 via data path 226. The output of the latched data may be transmitted by application controller 217 on the falling edge of the clock, as shown in FIG. Figure 3 Further discussed in .

[0032] The safety controller 218 may generate a response and / or determine whether to allow a command from the application controller 217 to be output via the data path 232 in response to a comparison of the data from the memory device 214 and the latched data from the application controller 217. The data received by the application controller 217 from the memory device 214 may be used to generate a command. The command may be associated with the data from the memory device 214 and may be output from the application controller 217 in response to the application controller 217 receiving the data from the memory device 214. For example, the data may contain information about a higher speed limit. The application controller 217 may generate a command and / or multiple commands to accelerate the speed of the vehicle to reach a higher speed limit. However, the data received by the application controller 217 and used to generate a command to accelerate the vehicle may be corrupted, which may mean that even if the speed limit has not changed and / or the speed limit is different from what the corrupted data indicates to the application controller 217, the vehicle is still accelerating when the command is executed.

[0033] In some embodiments, the safety controller 218 can prevent the vehicle from executing the command via the data path 234. The safety controller 218 can prevent the command from being executed by generating a response and / or transmitting a flag to the MUX 236 and the application controller 217 via the communication path 228. The safety controller 218 can transmit the flag in response to identifying a difference between the data from the memory device 214 and the latched data from the application controller 217. In some embodiments, the safety controller 218 can compare the inverted output and the direct output from the memory device 214 with the output from the application controller 217. If one and / or more of the data outputs are different, the safety controller 218 can transmit the flag. The data output is different (e.g., different from the direct output of the memory device 214 and the latched data from the application controller 217 matches and is opposite to the inverted output of the memory device 214) can indicate that at least one of the data outputs has been corrupted when stored and / or transmitted.

[0034] Memory device 214 and / or application controller 217 may transmit another portion of data in response to application controller 217 receiving a flag from security controller 218 via communication path 228. The flag may indicate that data output from memory device 214 and / or application controller 217 is corrupted and that the data needs to be resent.

[0035] In some embodiments, application controller 217 may output a security confirmation signal to security controller 218 via communication path 230. The security confirmation signal may be sent in response to receiving the flag from security controller 218. The confirmation signal may notify security controller 218 that application controller 217 received the flag and / or that application controller 217 and / or memory device 214 are resending data.

[0036] The safety controller 218 may remove the flag in response to receiving the safety confirmation signal from the application controller 217. In the absence of the flag and / or if no response is generated, the MUX 236 will allow the application controller 217 command to be executed by the vehicle via the data path 234.

[0037] The security controller 218 can allow the command from the application controller 217 to be executed in response to identifying a match between the data from the memory resource 214 and the latched data from the application controller 217. For example, if the direct output data from the memory device 214 and the output data from the application controller 217 match and are opposite to the inverted output data from the memory device 214, the command can be executed. Moreover, once the security controller 218 receives the inverted output data, it can be placed in the direct output data state and compared with the other output data. If the direct output data from the memory device 214 and the output data from the application controller 217 match and are opposite to the inverted output data from the memory device 214, the command can be executed.

[0038] Figure 3 is a diagram of a memory output of a dual-edge device according to various embodiments of the present disclosure. A dual-edge device is a memory device (e.g., Figure 2 214 in the memory device). Figure 3 As shown, data can be transmitted on rising edges 352 and 356 and falling edges 354 and 358 of a double edge device. For example, Data 0 at 342 can be transmitted on rising edge 352. Data 0 can be a direct output from the memory because it is transmitted on rising edge 352. Data 0' at 344 can be an inverted output because it is transmitted on falling edge 354. Inverted output means that Data 0' is the same as Data 0 but inverted (e.g., opposite). Data 1 at 346 can be transmitted on rising edge 356 as a direct output, while Data 1' at 348 can be transmitted on falling edge 358 as an inverted output of Data 1.

[0039] From a memory device (e.g., Figure 2 The direct output from the memory device 214 in FIG. 1 may be represented by Data 0 at 342 transmitted on rising edge 352. The inverted output from the memory device may be represented by Data 0′ at 344 transmitted on falling edge 354. The application controller (e.g., Figure 2The application controller 217 in FIG. 217 may latch data as represented by Data 1 at 346 latched on rising edge 356. The inverted output from the application controller may be represented by Data 1′ at 348 transmitted on falling edge 358.

[0040] From a memory device (e.g., Figure 2 354, and a memory device 214 in FIG. 350 . The memory device 214 in FIG. 350 may be a memory device 214 in FIG. 351 , and a memory device 214 in FIG. 352 may be a memory device 214 in FIG. 352 . The memory device 214 in FIG. 350 may be a memory device 214 in FIG. 351 , and a memory device 214 Figure 2 The output transmitted on the falling edge 358 of the application controller 217 can be controlled by the safety controller (e.g., Figure 2 The security controller may allow the command to be output from the application controller in response to identifying a match between the data from the memory device and the latched data from the application controller.

[0041] Memory device (e.g., Figure 2 The memory device 214 in FIG. 2 can be programmed as a dual edge device so that direct data is programmed on every other row of the memory device and reverse data is programmed adjacent to the corresponding direct data. For example, direct data can be programmed on even addresses and reverse data can be programmed on odd addresses so that direct data is transmitted on rising edge 352 and reverse data is transmitted on falling edge 354.

[0042] Figure 4 FIG. 1 is a flow chart of an inverting circuit including output data according to various embodiments of the present disclosure. Figure 4 The reverse circuit shown can be used to reverse the data pattern from the memory device 414. The data can be autonomous vehicle data. For example, the data can include photographic data collected from a vehicle camera and / or data collected from a vehicle sensor, but the data is not limited to photographic data or vehicle sensor data.

[0043] The memory device 414 can store and transmit data. The memory device 414 can be coupled to the reverse circuit 462. The memory device 414 can transmit data 460 to the reverse circuit. The data transmitted by the memory device 414 can be transmitted on the rising edge of the clock and can be directly output.

[0044] The reverse circuit 462 can receive data as a direct output from the memory device 414. The reverse circuit 462 can copy the direct output and invert the direct output mode to form an inverted output. The reverse circuit 462 can transmit the direct output 464 and the inverted output 465 from the memory device 414 to a multiplexer 469 (e.g., MUX).

[0045] MUX 469 can combine signals. MUX 469 can combine direct output 464 and reverse output 465 into one signal. MUX 469 can include clock 466. Clock 466 can be used to start the transmission of the second signal to ensure that both signals are transmitted in one signal. For example, direct output 464 can be transmitted on a rising edge (e.g., Figure 3 352 in the rising edge) is transmitted to the application controller 417 and the security controller 418 until the clock is at the falling edge (e.g., Figure 3 The falling edge 354 in starts sending the reverse output to the application controller 417 and the safety controller 418.

[0046] The combined signal 468 may be received by the application controller 417. The application controller 417 may latch the data of the combined signal 468. The data may be latched on a rising edge (e.g., Figure 3 The latched data can be transmitted to the safety controller. The latched data can be used as the falling edge of the signal (for example, Figure 3 The output sent on the falling edge 358) is transmitted.

[0047] The combined signal 468 may also be received by the security controller 418. The security controller 418 may determine whether to allow the command output from the application controller 417 in response to a comparison of the data from the memory device 414 and the latched data from the application controller 417. For example, the security controller 418 may compare the direct output and the inverted output from the memory device 414 with the inverted output from the application controller 417.

[0048] Although specific embodiments have been illustrated and described herein, it will be understood by those of ordinary skill in the art that settings calculated to achieve the same results may replace the specific embodiments shown. The present disclosure is intended to cover modifications or variations of one or more embodiments of the present disclosure. It should be understood that the above description is carried out in an illustrative manner and is not restrictive. By reading the above description, the combination of the above embodiments and other embodiments not specifically described herein will be apparent to those skilled in the art. The scope of one or more embodiments of the present disclosure includes other applications in which the above structures and methods are used. Therefore, the scope of one or more embodiments of the present disclosure should be determined with reference to the attached claims and the full scope of equivalents given by these claims.

[0049] In the foregoing detailed description, some features are grouped together in a single embodiment for the purpose of simplifying the present disclosure. The disclosed method should not be interpreted as reflecting the following intention: that is, the disclosed embodiments of the present disclosure require the use of more features than the features explicitly recited in each claim. On the contrary, as reflected in the following claims, the subject matter of the present invention lies in less than all the features of a single disclosed embodiment. Therefore, the following claims are hereby incorporated into the detailed description, wherein each claim itself serves as a separate embodiment.

Claims

1. A device for autonomous driving applications, comprising: An application controller (117, 217, 417) configured to: generating commands based on data collected from sensors of the vehicle; and transmitting said command to be executed by said vehicle; and A safety controller (118, 218, 418) configured to: receiving the command; determining whether to prevent the vehicle from executing the command based on the data; and The vehicle is prevented from executing the command.

2. The apparatus of claim 1, wherein the command activates a brake.

3. The apparatus of claim 1, wherein the data includes information regarding the vehicle's approach to a stop sign.

4. The apparatus of claim 3, wherein the command stops the vehicle.

5. The device of claim 1, wherein the data includes information about speed limits.

6. The apparatus of claim 5, wherein the command accelerates the speed of the vehicle.

7. The apparatus of claim 1, further comprising a memory device (114, 214, 414) configured to store the data.

8. The apparatus of claim 7, wherein the memory device is configured to transmit the data to the application controller.

9. The apparatus of claim 7, wherein the memory device is configured to transmit the data to the security controller.

10. The device of claim 1, wherein the sensor is a camera.

11. The apparatus of claim 10, wherein the data is photographic data.

12. The device according to claim 1, wherein the data is obstacle or hazard information.

13. A method for autonomous driving applications, comprising: generating commands at an application controller (117, 217, 417) based on data collected from sensors of the vehicle; transmitting the command at the application controller to be executed by the vehicle; receiving the command at a security controller (118, 218, 418); determining, based on the data, whether to prevent the vehicle from executing the command at the safety controller; and The vehicle is prevented from executing the command.

14. The method of claim 13, further comprising receiving the data at the application controller from a memory device (114, 214, 414).

15. The method of claim 13, further comprising using redundancy to prevent the vehicle from executing the command.

16. A device for autonomous driving applications, comprising: a memory device (114, 214, 414) configured to store data collected from sensors of the vehicle; An application controller (117, 217, 417) configured to: generating commands based on the data; and transmitting the command to be executed by the vehicle; and A safety controller (118, 218, 418) configured to: receiving the command; determining whether to prevent the vehicle from executing the command based on the data; and The vehicle is prevented from executing the command.

17. The apparatus of claim 16, wherein the memory device is configured to store critical code comprising firmware, software, or temporary calculations derived from the data.

18. The apparatus of claim 16, wherein the memory device is configured to store autonomous driving vehicle data.

19. The device according to any one of claims 16 to 18, wherein the device is a control unit.

20. The apparatus of any one of claims 16-18, wherein the apparatus is located on the vehicle.

Images