In-vehicle device, information processing method, and information processing program

Abstract

An in-vehicle device is provided with a processor capable of setting three or more privilege levels related to memory access, and a privilege level higher than the privilege level of an OS and an application program is set for an abnormality notification function for notifying a memory access violation to the outside of the in-vehicle device.

Description

Technical Field

[0001] The present disclosure relates to a vehicle-mounted device, an information processing method, and an information processing program.

[0002] This application claims the benefit of priority based on Japanese patent application No. 2022-94546, filed on June 10, 2022, the disclosure of which is incorporated herein in its entirety. Background Art

[0003] Japanese Patent Application Laid-Open No. 2014-137734 (Patent Document 1) discloses the following information processing device. That is, the information processing device comprises: a CPU that repeatedly executes a plurality of application programs stored in a memory; and a memory access monitoring unit that registers permission information that specifies whether to allow or prohibit access to the memory in correspondence with addresses where data of each application program is stored, wherein the information processing device comprises: a data backoff unit that, when the memory access monitoring unit detects prohibited memory access by the CPU executing the application program, backs off the data stored in the address where the CPU performs memory access in correspondence with the address from the memory to a backoff area; a permission information changing unit that changes the permission information in a manner that allows memory access to the address; and a backup unit that, after the CPU executing the application program that performs prohibited memory access performs memory access to the address, backs up the data at the address where the memory access is performed in correspondence with the address from the memory to a backup area, wherein the backup unit restores the data in the backup area to the address that is associated with the data in the backup area before the CPU next executes the application program that performs prohibited memory access.

[0004] Prior art literature

[0005] Patent Literature

[0006] Patent Document 1: Japanese Patent Application Publication No. 2014-137734 Summary of the invention

[0007] The vehicle-mounted device of the present disclosure includes a processor capable of setting three or more permission levels related to memory access, and sets the permission level higher than the permission level of the OS and application to the abnormality notification function that notifies the outside of the vehicle-mounted device of a memory access violation.

[0008] An aspect of the present disclosure can be realized not only as an in-vehicle device including such a characteristic processing unit but also as a semiconductor integrated circuit realizing a part or all of the in-vehicle device, or as a system including the in-vehicle device. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 It is a diagram showing the configuration of an in-vehicle system according to an embodiment of the present disclosure.

[0010] Figure 2 It is a diagram showing the configuration of a processor in the vehicle-mounted device according to the embodiment of the present disclosure.

[0011] Figure 3 This is a diagram showing an example of a software configuration of a processor in a local ECU and a process when a memory access violation occurs according to an embodiment of the present disclosure.

[0012] Figure 4 This is a diagram showing an example of memory mapping and MPU settings of a processor in a local ECU according to an embodiment of the present disclosure.

[0013] Figure 5 This is a diagram showing an example of a memory map and MPU settings of a processor in a comparative example of a local ECU according to an embodiment of the present disclosure.

[0014] Figure 6 This is a diagram showing an example of memory mapping and MPU settings of a processor in a local ECU according to an embodiment of the present disclosure.

[0015] Figure 7 This is a flowchart that defines an example of an operation procedure when a processor of an in-vehicle device according to an embodiment of the present disclosure detects a memory access violation.

[0016] Figure 8 This is a diagram showing an example of a sequence of processes of an abnormality notification function and an abnormality monitoring function in the vehicle-mounted system according to the embodiment of the present disclosure. DETAILED DESCRIPTION

[0017] Conventionally, a technology has been developed for detecting and responding to software access to an unauthorized memory area.

[0018] [Problems to be Solved by the Present Disclosure]

[0019] For example, when a microcomputer detects access to an unauthorized memory area during the execution of an OS (Operating System) and an application program, a memory exception is generated. If the microcomputer is not equipped with a virtual machine monitor, it is impossible to restore from the memory exception to the normal process. Therefore, if it is desired to notify the outside of the microcomputer that a memory exception has occurred, a mechanism is required to notify after the microcomputer is restarted.

[0020] The present disclosure has been made to solve the above-mentioned problems, and an object of the present disclosure is to provide an in-vehicle device, an information processing method, and an information processing program that can more easily notify a memory access violation to the outside.

[0021] [Effects of the present disclosure]

[0022] According to the present disclosure, a memory access violation can be more easily notified to the outside.

[0023] [Description of Embodiments of the Present Disclosure]

[0024] First, the contents of the embodiments of the present disclosure will be listed and described.

[0025] (1) An in-vehicle device according to an embodiment of the present disclosure includes a processor capable of setting three or more permission levels related to memory access, and an abnormality notification function for notifying an external portion of the in-vehicle device of a memory access violation is set with a permission level higher than the permission level of the OS and the application.

[0026] With such a structure, it is possible to prevent the notification function of memory access violation from being hijacked when the OS is hijacked, and to enable the notification function with a higher authority level. Therefore, it is not necessary to mount a virtual machine monitor capable of executing multiple OSes in parallel on the processor, and it is not necessary to have a mechanism for notifying memory access violation after the processor is restarted. Therefore, it is possible to more easily notify the outside of the memory access violation.

[0027] (2) In the above (1), it may be that the processor is capable of setting a first permission level, a second permission level higher than the first permission level, and a third permission level higher than the second permission level, and the first permission level is set for the application, the second permission level is set for the OS, and the third permission level is set for the exception notification function.

[0028] With such a structure, it is possible to set appropriate permission levels for each software. For example, it is possible to prevent the abnormal notification function from being hijacked if the OS is hijacked. In addition, it is possible to prevent the OS from being hijacked if the application is hijacked, thereby reducing the security of the OS.

[0029] (3) In the above (2), the processor may further set the third permission level for a boot loader.

[0030] With such a configuration, the number of permission levels can be set to three, including the setting of the boot loader, and the mechanism for setting the permission level can be simplified.

[0031] (4) In any of the above (1) to (3), it may be that after notifying the memory access violation, the exception notification function chooses whether to stop the exception notification function or restart the processor based on a judgment result of a notification destination related to the memory access violation.

[0032] With such a configuration, what kind of exception processing should be performed on the in-vehicle device that has generated a memory access violation can be determined by, for example, a device that understands the configuration of the in-vehicle system, and more appropriate exception processing can be performed.

[0033] (5) In the above (4), it may be that, when the vehicle-mounted device that notifies the memory access violation is a vehicle-mounted device of an infotainment system, the judgment result indicating the restart of the processor is provided to the vehicle-mounted device; and when the vehicle-mounted device that notifies the memory access violation is a vehicle-mounted device other than the infotainment system, the judgment result indicating the stop of the abnormal notification function is provided to the vehicle-mounted device.

[0034] With such a configuration, for example, it is possible to select restart of an in-vehicle device from the viewpoint of vehicle travel, or to select system shutdown when restarting a certain in-vehicle device will also restart other in-vehicle devices.

[0035] (6) The information processing method involved in the embodiment of the present disclosure is an information processing method in a vehicle-mounted device having a processor capable of setting three or more permission levels related to memory access, which includes: a step in which the processor sets the permission level higher than the permission level of the OS and the application to an exception notification function for notifying the outside of the vehicle-mounted device of a memory access violation; and a step in which the processor detects the memory access violation of the OS or the application and activates the exception notification function.

[0036] This method can prevent the memory access violation notification function from being hijacked when the OS is hijacked, and can enable the notification function with a higher privilege level. Therefore, it is not necessary to mount a virtual machine monitor capable of executing multiple OSes in parallel on the processor, and it is not necessary to have a mechanism for notifying the memory access violation after the processor is restarted. Therefore, it is possible to more easily notify the outside of the memory access violation.

[0037] (7) An information processing program involved in an embodiment of the present disclosure is an information processing program used in a vehicle-mounted device having a processor capable of setting three or more permission levels related to memory access, wherein the information processing program is used to enable a computer to function as a setting unit and a detection unit, the setting unit sets the permission level higher than the permission level of the OS and the application to an abnormal notification function that notifies the outside of the vehicle-mounted device of a memory access violation, and the detection unit detects the memory access violation of the OS or the application and activates the abnormal notification function.

[0038] With such a structure, it is possible to prevent the notification function of memory access violation from being hijacked when the OS is hijacked, and to enable the notification function with a higher authority level. Therefore, it is not necessary to mount a virtual machine monitor capable of executing multiple OSes in parallel on the processor, and it is not necessary to have a mechanism for notifying memory access violation after the processor is restarted. Therefore, it is possible to more easily notify the outside of the memory access violation.

[0039] The following is an explanation of the embodiments of the present disclosure using the accompanying drawings. It should be noted that the same or corresponding parts in the drawings are marked with the same reference numerals, and their description is not repeated. In addition, at least a part of the embodiments described below can be arbitrarily combined.

[0040] [Structure and Action]

[0041] Figure 1 2 is a diagram showing a configuration of an in-vehicle system according to an embodiment of the present disclosure. Figure 1 The vehicle-mounted system 301 includes an integrated ECU (Electronic Control Unit) 201 and one or more local ECUs 101 . The vehicle-mounted system 301 is mounted on the vehicle 1 .

[0042] The integrated ECU 201 and the local ECU 101A are connected via a cable 3. The integrated ECU 201 and the local ECU 101B are connected via a cable 4. The network topology of the integrated ECU 201 and the local ECU 101 may be a bus type or a star type with the integrated ECU 201 as the center.

[0043] Cables 3 and 4 are transmission lines according to standards such as CAN (Controller Area Network) (registered trademark), CAN FD (CAN with Flexible Data Rate), CAN XL, FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), Ethernet (registered trademark) and LIN (Local Interconnect Network).

[0044] For example, the local ECU 101A generates detection information based on the detection result of a detection device (not shown) connected to the local ECU 101A, and transmits a frame storing the generated detection information to the integrated ECU 201 .

[0045] The integrated ECU 201 is a central device that processes the detection information received from the local ECU 101A. The integrated ECU 201 generates control information for controlling an actuator (not shown), and sends a frame storing the generated control information to the local ECU 101B. The local ECU 101B receives the control information from the integrated ECU 201, and drives the actuator connected to itself based on the received control information.

[0046] The integrated ECU 201 has an abnormality monitoring function described later. The local ECUs 101A and 101B are examples of vehicle-mounted devices and include a processor 51. The local ECUs 101A and 101B have an abnormality notification function described later.

[0047] It should be noted that the vehicle-mounted system 301 may also be configured to include two or more integrated ECUs 201. In addition, the vehicle-mounted system 301 may also be configured to include a gateway device instead of the integrated ECU 201. In addition, the vehicle-mounted system 301 may also be configured to include one or three or more local ECUs 101.

[0048] Figure 2 1 is a diagram showing a configuration of a processor in a vehicle-mounted device according to an embodiment of the present disclosure. Figure 2 The processor 51 includes a setting unit 11, a detection unit 12, a notification unit 13, and a memory 14. The setting unit 11, the detection unit 12, and the notification unit 13 are implemented by a core of the processor 51.

[0049] The notification unit 13 has an abnormality notification function of notifying the outside of the local ECU 101 of a violation of access to the memory 14 (hereinafter also referred to as a memory access violation).

[0050] The setting unit 11 sets a higher authority level than the authority levels of the OS (Operating System) and the application program to the abnormality notification function in the MPU (Memory Protection Unit) setting described later in the memory 14 .

[0051] The detection unit 12 monitors the access to the memory 14 by each software in the processor 51. The detection unit 12 refers to the MPU setting of the memory 14, and activates the abnormality notification function of the notification unit 13 when detecting a memory access violation by the OS or the application.

[0052] For example, the processor 51 detects an attack on the in-vehicle network of the vehicle 1 as a memory access violation.

[0053] Figure 3 This is a diagram showing an example of a software configuration of a processor in a local ECU and a process when a memory access violation occurs according to an embodiment of the present disclosure. Figure 4 This is a diagram showing an example of memory mapping and MPU settings of a processor in a local ECU according to an embodiment of the present disclosure.

[0054] Reference Figure 3 and Figure 4 The processor 51 is equipped with a boot loader, a RTOS (Real Time Operating System), one or more application programs, and an abnormality notification function.

[0055] Specifically, a boot loader, an RTOS as an example of an OS, one or more application programs, and a program for an abnormality notification function are stored in the code area of ​​the memory 14. The memory 14 is also allocated a temporary data area and a peripheral function area.

[0056] The processor 51 can set three or more privilege levels related to memory access. In the processor 51, a privilege level higher than the privilege levels of the OS and the application is set for the abnormality notification function.

[0057] For example, the processor 51 can set a first permission level, a second permission level higher than the first permission level, and a third permission level higher than the second permission level for software such as a boot loader, an application, an OS, and an abnormality notification function. The first permission level is set for the application, the second permission level is set for the OS, and the third permission level is set for the abnormality notification function. In addition, for example, in the processor 51, the third permission level is also set for the boot loader.

[0058] Specifically, in the MPU (Memory Protection Unit) setting, EL (Exception Level) 2 is set for the boot loader, EL1 is set for the RTOS, EL0 is set for the application A and B, and EL2 is set for the exception notification function. EL2, EL1, and EL0 are examples of software execution permissions, i.e., permission levels, and the permission levels are ranked from high to low. In the processor 51, software is prohibited from accessing a memory area corresponding to a permission level that exceeds its own permission level.

[0059] For example, the MPU settings are stored in a microcomputer function area (not shown) of the memory 14. The processor 51 includes a program counter for each authority level.

[0060] It should be noted that the processor 51 may be capable of setting four or more authority levels. For example, the boot loader may be configured to have EL3 which is higher than EL2.

[0061] When the processor 51 is powered on or reset, the boot loader is activated to activate the RTOS, and then the RTOS activates various application programs.

[0062] The processor 51 has an MPU setting function. In the processor 51, a memory access violation is detected according to the MPU setting. The memory access violation is detected, for example, by the core of the processor 51. In the processor 51, when a memory access violation is detected, specifically, when an application program accesses a memory area of ​​another application program or an application program accesses a memory area above EL1, an exception process (hereinafter also referred to as a memory exception process) is generated. In addition, in the processor 51, when an RTOS accesses a memory area above EL2 is detected, a memory exception process is generated.

[0063] For example, as a memory exception process, an interrupt process of the previous privilege level is generated. Specifically, in the case of a memory access violation of the application, an interrupt process of EL1 is generated. In the case of a memory access violation of the RTOS, an interrupt process of EL2 is generated. And, through these interrupt processes, the exception notification function of EL2 is activated.

[0064] The abnormality notification function performs notification processing. For example, the abnormality notification function initializes itself and initializes functions of the processor 51 necessary for abnormality notification, such as Ethernet function, and transmits abnormality notification to the integrated ECU 201 .

[0065] For example, after notifying a memory access violation, the abnormality notification function selects whether to stop the abnormality notification function or to restart the processor 51 based on the determination result of the notification destination related to the memory access violation.

[0066] More specifically, for example, when the local ECU 101 notifying the memory access violation is an ECU of the infotainment system, the integrated ECU 201 provides the local ECU 101 with a determination result indicating a system restart, i.e., a restart of the processor 51. On the other hand, when the local ECU 101 notifying the memory access violation is an ECU other than the infotainment system, the integrated ECU 201 provides the local ECU 101 with a determination result indicating a system stop, i.e., a stop of the abnormality notification function. The integrated ECU 201 transmits a processing request indicating the determination result to the local ECU 101.

[0067] The abnormality notification function restarts the system by starting the boot loader or stops the system by waiting until the processor 51 is hardware reset according to the instruction from the integrated ECU 201, i.e., the processing request received from the integrated ECU 201. For example, when the system is stopped, other software remains stopped with the memory exception processing.

[0068] It should be noted that the abnormality notification function may be configured to restart or stop the system without receiving a processing request from the integrated ECU 201 .

[0069] The integrated ECU 201 is not limited to sending a processing request to the local ECU 101 , and may send an abnormality notification to a navigation device in the vehicle 1 or other device such as a server outside the vehicle 1 .

[0070] Figure 5 This is a diagram showing an example of a memory map and MPU settings of a processor in a comparative example of a local ECU according to an embodiment of the present disclosure. Figure 5 The case where the processor includes one core, one exception detection function, two RTOSs, and multiple application programs is shown.

[0071] Reference Figure 5 In the processor in the comparative example, since only two permission levels can be set, it is necessary to have a common permission level in any two of the abnormal notification function, RTOS, and application program, which sometimes causes security problems.

[0072] Specifically, in the MPU setting of mode 1, privilege levels are set for the abnormality detection function and RTOS, and non-privileged levels are set for each application. In this case, there is the possibility that even if the application is hijacked, the RTOS will not be hijacked, and on the other hand, if the RTOS is hijacked, the abnormality detection function will also be hijacked.

[0073] In the MPU setting of mode 2, the privilege level is set for the abnormal detection function, and the non-privileged level is set for the RTOS and each application. In this case, there is the following possibility: even if the RTOS is hijacked, the abnormal detection function will not be hijacked. On the other hand, if the application is hijacked, the RTOS will also be hijacked, which will cause the problem of reduced security of the RTOS.

[0074] Figure 6 This is a diagram showing an example of memory mapping and MPU settings of a processor in a local ECU according to an embodiment of the present disclosure. Figure 6 and Figure 5 Similarly, the case where the processor includes one core, one abnormality detection function, two RTOSs, and a plurality of application programs is shown.

[0075] Reference Figure 6 In the processor 51, three permission levels, EL0, EL1, and EL2, can be set. Thus, as described above, EL2, EL1, and EL0 can be set for the abnormal notification function, RTOS, and application, respectively, which can improve security. Specifically, the following state can be formed: even if the application is hijacked, the RTOS is not hijacked, and even if the RTOS is hijacked, the abnormal detection function is not hijacked.

[0076] [Flow of Action]

[0077] The vehicle-mounted device according to the embodiment of the present disclosure has a computer including a memory, and a processor in the computer reads out and executes a program including a part or all of each step of the following flowchart and sequence from the memory. The program can be installed from the outside. The program is stored in a recording medium or circulated via a communication line.

[0078] Figure 7 This is a flowchart that defines an example of an operation procedure when a processor of an in-vehicle device according to an embodiment of the present disclosure detects a memory access violation.

[0079] Reference Figure 7 First, when the processor 51 is powered on or reset (step S1), the boot loader is started at the authority level EL2 (step S2).

[0080] Next, the boot loader sets the authority levels EL1 and EL2 for the RTOS and the abnormality notification function, respectively, according to the MPU setting in the memory 14 (step S3).

[0081] Next, the boot loader starts the RTOS (step S4).

[0082] Next, the RTOS sets the authority level of EL0 for each application program according to the MPU setting in the memory 14 (step S5).

[0083] Next, the RTOS starts each application program (step S6).

[0084] Next, when a memory access violation of the RTOS or the application is detected (YES in step S7 ), an interrupt process is generated as a memory exception process (step S8 ), and the abnormality notification function is activated by the interrupt process (step S9 ).

[0085] Next, the abnormality notification function performs, as notification processing, initialization of itself, initialization of the function of the processor 51 required for abnormality notification, and transmission of abnormality notification to the integrated ECU 201 (step S10 ).

[0086] Figure 8 This is a diagram showing an example of a sequence of processes of an abnormality notification function and an abnormality monitoring function in the vehicle-mounted system according to the embodiment of the present disclosure.

[0087] Reference Figure 8 First, in the local ECU 101, the abnormality notification function is activated by detecting a memory access violation (step S11).

[0088] Next, the abnormality detection function initializes itself and the function of the processor 51 required for abnormality notification (step S12 ), and transmits the abnormality notification to the integrated ECU 201 (step S13 ).

[0089] Next, when the abnormality monitoring function in the integrated ECU 201 receives an abnormality notification from the local ECU 101 (Yes in step S14), it determines the processing to be performed by the local ECU 101. Specifically, for example, when the transmission source of the abnormality notification is an ECU of the infotainment system such as the car navigation-related ECU and the audio-related ECU, the abnormality monitoring function determines to restart the system, and when the transmission source of the abnormality notification is an ECU other than these, it determines to stop the system (step S15).

[0090] Next, the abnormality monitoring function transmits a processing request indicating the determination result to the local ECU 101 (step S16).

[0091] Next, when the abnormality notification function in the local ECU 101 receives a processing request from the integrated ECU 201 (YES in step S17), it determines the content of abnormality processing according to the processing request (step S18), and performs system restart (step S19) or system shutdown (step S20).

[0092] It should be noted that, in the vehicle-mounted device involved in the embodiment of the present disclosure, a host-type IDS is installed as described above. In more detail, intrusion detection refers to the following process: monitoring events generated in a computer system or network, and detecting signs that are considered to be accidents by analyzing the monitoring results. IDS (Intrusion Detection System) refers to software that has the function of automating the intrusion detection process. An IDS that monitors events generated inside a single host such as a microcomputer or microprocessor and notifies the detection host device is called a host-type IDS. As a type of host-type IDS, there is a function that detects access to unauthorized memory areas as software.

[0093] The above embodiments should be considered as illustrative in all aspects and not restrictive. The scope of the present invention is indicated by the claims rather than the above description, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0094] Description of Reference Numerals

[0095] 1 Vehicle

[0096] 3.4 Cable

[0097] 11. Setting section

[0098] 12 Inspection Department

[0099] 13 Notification Department

[0100] 14 Memory

[0101] 51 Processor

[0102] 101, 101A, 101B local ECU

[0103] 201 Integrated ECU

[0104] 301 In-vehicle systems.

Claims

1. A vehicle-mounted device, wherein: The vehicle-mounted device includes a processor capable of setting three or more authority levels related to memory access. The abnormality notification function for notifying the outside of the vehicle-mounted device of a memory access violation is set with the permission level higher than the permission levels of the OS (Operating System) and the application.

2. The vehicle-mounted device according to claim 1, The processor is capable of setting a first permission level, a second permission level higher than the first permission level, and a third permission level higher than the second permission level. The first permission level is set for the application, the second permission level is set for the OS, and the third permission level is set for the abnormality notification function.

3. The vehicle-mounted device according to claim 2, In the processor, the third permission level is further set for the boot loader.

4. The vehicle-mounted device according to any one of claims 1 to 3, After notifying the memory access violation, the abnormality notification function selects whether to stop the abnormality notification function or to restart the processor based on a determination result of a notification destination related to the memory access violation.

5. The vehicle-mounted device according to claim 4, In a case where the vehicle-mounted device that has been notified of the memory access violation is a vehicle-mounted device of an infotainment system, the judgment result indicating a restart of the processor is provided to the vehicle-mounted device; and in a case where the vehicle-mounted device that has been notified of the memory access violation is a vehicle-mounted device other than the vehicle-mounted device of the infotainment system, the judgment result indicating a stop of the abnormal notification function is provided to the vehicle-mounted device.

6. An information processing method in a vehicle-mounted device having a processor capable of setting three or more permission levels related to memory access, wherein: include: The processor sets the permission level higher than the permission levels of the OS and the application program to an abnormality notification function for notifying an external device of the vehicle-mounted device of a memory access violation; and The processor detects the memory access violation of the OS or the application and activates the abnormality notification function.

7. An information processing program for use in an in-vehicle device having a processor capable of setting three or more permission levels related to memory access, wherein: The information processing program is used to make the computer function as a setting unit and a detection unit. The setting unit sets the permission level higher than the permission levels of the OS and the application program to the abnormality notification function for notifying the outside of the vehicle-mounted device of a memory access violation, The detection unit detects the memory access violation of the OS or the application program and activates the abnormality notification function.

Images