Securing controller area network (CAN) messages in autonomous systems and applications

Abstract

The invention discloses securing Controller Area Network (CAN) messages in autonomous systems and applications, and specifically discloses a technique for secure transmission of CAN (Controller Area Network) messages, including receiving, using a cryptographic engine, a message from an application to be transmitted over a CAN (Controller Area Network) bus, wherein the cryptographic engine executes the secure firmware and is implemented on the on-die discrete processor. The technique further includes accessing, using the secure firmware, a key of the plurality of keys associated with the authentication process from a secure memory associated with the cryptographic engine. In addition, the techniques further include computing an authentication tag using the key and the message; and transmitting the message together with the authentication tag to the destination address through the CAN bus.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the priority of Indian Patent Application Serial No. 202341065265 filed on September 28, 2023, and titled “A REAL-TIME, SAFE, AND SECURE METHOD TO PROTECT CAN MESSAGES IN AVEHICLE”. The subject matter of this related application is incorporated into this application by reference. Background Art

[0003] CAN (Controller Area Network) messages are a popular communication protocol in the automotive and industrial sectors that facilitates real-time data exchange between Electronic Control Units (ECUs). For example, CAN messaging provides an efficient means of transmitting data and commands between different systems, modules or sensors in a vehicle. These messages include identifiers, data payloads, and additional control bits that can be efficiently transmitted over a two-wire bus (the CAN bus), enabling seamless communication across multiple ECUs in the network. In a CAN network, ECUs (Electronic Control Units) are responsible for controlling specific functions and subsystems within the vehicle. Each ECU is designed to perform specific tasks and communicate with other ECUs over the CAN bus.

[0004] The CAN bus system enables each ECU in the vehicle to communicate with all other ECUs without the need for complex dedicated wiring. Specifically, an ECU can prepare and broadcast information (e.g., sensor data) over the CAN bus (usually consisting of two wires, CAN low and CAN high). The broadcast data is accepted by all other ECUs on the CAN network, and each ECU can check the data and decide whether to receive it or ignore it. An ECU can receive input signals from sensors, process the data, and send commands to actuators to perform specific actions. ECUs also monitor certain system parameters and ensure optimal operation. ECUs can also exchange commands with other ECUs over the CAN bus. They send and receive messages to coordinate actions, share data, and synchronize operations between different systems.

[0005] ECU messaging is used for many applications including vehicle control, sensor data transmission throughout the vehicle, diagnostic and fault verticals, infotainment and communications, and body electronics. For example, CAN messaging can allow communication between ECUs responsible for controlling various vehicle systems, including but not limited to engine management, transmission, brakes, steering, power windows, central locking, lighting systems, climate control, and suspension. More specifically, an ECU can collect and communicate messages from one or more sensors, including but not limited to ignition switches, throttle position sensors, vehicle speed sensors, air temperature sensors, engine temperature sensors, crank position sensors, fuel pressure sensors, and battery voltage. The ECU can process the data collected from the sensors and send commands to one or more actuators, including but not limited to ignition circuits or spark plugs, throttle controls, injectors, O2 sensor heaters, on-board diagnostic equipment, fuel pumps, radiator fans, and alternators. Each ECU can receive one or more sensor input messages and perform specific functions associated with the actuators in response to signals received from the sensor input messages.

[0006] As the CAN bus plays a vital role in the operation of modern vehicles, it is critical to protect the security of CAN messages in the vehicle. CAN messages usually contain instructions and data to control various systems, including the engine, brakes, steering, and more. Therefore, protecting the security of CAN messages helps prevent unauthorized access, data manipulation, and message spoofing to ensure the trustworthiness and reliability of vehicle systems. It protects the vehicle and the occupants within the vehicle from potential cyber threats, thereby providing a safe and reliable driving experience.

[0007] Implementing secure CAN message communications in the automotive and industrial sectors has always been a challenging task due to the requirements of real-time or near-real-time relaying and the potential computational burden associated with adding authentication tags or encryption on CAN packets. Certain general-purpose systems are capable of providing secure communications over CAN networks, however, they typically require the use of specialized hardware and / or reconfiguration of the CAN bus (or protocol), which can be an expensive and time-consuming endeavor.

[0008] Therefore, there is a need for more efficient techniques for enhancing the security of CAN message communications without changing the CAN protocol or requiring the use of specialized hardware. Summary of the invention

[0009] Embodiments of the present disclosure relate to real-time or near real-time security solutions for protecting controller area network (CAN) messages in autonomous or semi-autonomous vehicle or machine applications. The technology described herein includes using a cryptographic engine implemented on an electronic control unit (ECU) to receive messages from an application to be transmitted on a CAN bus. The technology also includes accessing one or more keys from a secure memory associated with the cryptographic engine and calculating an authentication tag using the one or more keys. The technology also includes transmitting the message along with the authentication tag to a destination address over the CAN bus, and using the authentication tag in the destination address to confirm that the message has not changed during transmission.

[0010] Compared with previous solutions, one technical advantage of the technology disclosed in the present invention is that it can ensure the security of communications on the CAN bus network without requiring dedicated hardware or rewiring or changing the CAN bus protocol in any way. Therefore, the technology disclosed in the present invention is less resource-intensive than the secure communication methods of the prior art. Another technical advantage of the technology disclosed in the present invention is that it can prioritize and process high priority messages before low priority messages. This prioritization allows safety-critical applications to obtain a higher priority than other messages to ensure their timely and reliable transmission. Therefore, the technology disclosed in the present invention allows intelligent triaging functions to be implemented by effectively managing different message types and prioritizing between different message types. Another technical advantage of the technology disclosed in the present invention is that it can enhance security by using a dedicated security processor and associated memory for managing keys and calculating authentication tags. This dedicated processor and memory ensure strong security measures, thereby effectively protecting the CAN messaging network from potential hijacking or unauthorized access. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The present system and method for protecting controller area network (CAN) messages in autonomous or semi-autonomous systems and applications is described in detail below with reference to the accompanying drawings, wherein:

[0012] Figure 1 A computing device configured to implement one or more aspects of various embodiments is shown;

[0013] Figure 2 is a description of a manner of authenticating a CAN message according to various embodiments;

[0014] Figure 3 is a description of a system for prioritizing performance-critical workloads according to various embodiments;

[0015] Figure 4 A flow chart illustrating a method for protecting a controller area network (CAN) message according to various embodiments is shown;

[0016] Figure 5A is an illustration of an example autonomous vehicle according to some embodiments of the present disclosure;

[0017] Figure 5B According to some embodiments of the present disclosure Figure 5A Examples of autonomous vehicle camera positions and fields of view;

[0018] Figure 5C According to some embodiments of the present disclosure Figure 5A a block diagram of an example system architecture for an example autonomous vehicle;

[0019] Figure 5D A cloud-based server and Figure 5A System diagram of an example of communication between autonomous vehicles;

[0020] Figure 6 is a block diagram of an example computing device suitable for implementing some embodiments of the present disclosure; and

[0021] Figure 7 is a block diagram of an example data center suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0022] Systems and methods are disclosed that relate to real-time or near real-time security solutions for protecting controller area network (CAN) messages in autonomous or semi-autonomous systems and applications. Although the present disclosure may be related to an example autonomous or semi-autonomous vehicle or machine 500 (referred to herein alternatively as "vehicle 500", or "ego machine 500"), the example Figures 5A-5D The present disclosure may be described with respect to controller area network (CAN) messages in a protected vehicle or other machine type, but this is not intended to be limiting, and the systems and methods described herein may be used in augmented reality, virtual reality, mixed reality, robotics, safety and surveillance, autonomous or semi-autonomous machine applications, and / or any other technology area where controller area network (CAN) messages may be used.

[0023] As discussed in this article, the current state of general-purpose systems does not provide a practical solution for securing CAN message communications in vehicles without resorting to complex protocol modifications or expensive dedicated hardware. Therefore, a more streamlined and cost-effective technique is needed to enhance the security of CAN message communications without requiring changes to the existing CAN protocol or resorting to expensive dedicated hardware.

[0024] In order to improve the security of message communication in the CAN network, the technology of the present disclosure provides real-time or near real-time cryptographic authentication tags on CAN messages calculated by a hardware accelerator configured on a cryptographic engine in an embodiment. Making CAN message communication secure may also include integrating a dedicated on-die processor (on-die processor) on each electronic control unit (ECU) that is different from the microcontroller responsible for software execution and sensor input processing. The dedicated processor can be equipped with a cryptographic engine specifically designed to calculate authentication tags (also referred to herein as message authentication codes (or MACs)), thereby providing efficient and robust security measures. The dedicated discrete processor is equipped with its own boot software that starts a secure state at startup by loading a certified secure firmware. In an embodiment, the cryptographic key associated with the authentication tag is securely managed in the on-die SRAM (on-die SRAM) on each ECU that communicates with the on-die discrete processor. After entering the secure state, the cryptographic engine calculates the authentication tag by using the key from the on-die SRAM transferred to the certified secure firmware.

[0025] According to the technology of the present disclosure, an ECU that transmits a message (or a portion of a message) to a CAN bus uses an authentication process such as a message authentication code (MAC) process to calculate an authentication tag for the message (or a portion of a message). The MAC algorithm is a symmetric key cryptographic technology that provides message authentication. In order to establish a MAC process, the sender and the receiver entity share a symmetric key. It should be noted that the type of authentication process used is not limited, and many different types of authentication processes or algorithms can be used, including but not limited to HMAC (hash-based MAC), KMAC (Keccak-based MAC), CMAC (ciphertext-based MAC), etc. The cryptographic engine can calculate the authentication tag using one or more keys stored in the SRAM on the die, and transmit the authentication tag to the secure firmware during initialization or system startup.

[0026] After transmission, the message and its corresponding authentication tag are received by the designated ECU. Upon reception, the receiving ECU initiates the authentication process by feeding the received message and the shared secret key to an authentication algorithm (e.g., MAC). The authentication algorithm recalculates the authentication tag based on these inputs. The receiving ECU then compares the newly calculated authentication tag with the authentication tag received from the sending ECU to verify that they are equal. If the tags match, the receiving ECU confirms the authenticity of the message and accepts the message as coming from the intended sender. In the event that the calculated authentication tag does not match the received tag, the receiver cannot determine whether the message has been forged.

[0027] To prioritize performance-critical workloads, the secure firmware receives workloads from multiple software queues of different priority levels, such as a high priority queue and a low priority queue in the case of two software queues. Applications are responsible for assigning their respective workloads to the appropriate queues before initializing cryptographic authentication tag calculations. The secure firmware then processes the queues in a prioritized manner starting with the high priority queue and moving sequentially to the low priority queues, thereby providing efficient and timely execution of critical tasks.

[0028] To avoid low priority queue workloads blocking high priority work, the secure firmware uses a quantization technique that splits low priority messages above a certain threshold size into smaller fixed-size quantum operations or smaller message packets. The threshold size is configurable. After operating on each quantum operation (or "discrete message packet") associated with low priority work, the firmware is configured to perform a check to determine if there is a higher priority workload available for processing. If there is high priority work, the high priority work is completed before returning to the previous operation associated with the next discrete message packet associated with the low priority work. This limits the amount of time the firmware spends operating on low priority requests and avoids interference with high priority requests.

[0029] Figure 1 A computing device 100 configured to implement one or more aspects of various embodiments is shown. In at least one embodiment, the computing device 100 includes an electronic control unit (ECU) of a vehicle system, a desktop or laptop computer, a smart phone, a personal digital assistant (PDA), a tablet computer, a server, one or more virtual machines, an embedded system, a system on a chip, a computing system of an autonomous, semi-autonomous or non-autonomous machine, and / or other types of computing devices configured to receive input, process data, and be suitable for practicing one or more embodiments. It is worth noting that the computing device 100 can also be implemented similar to at least about FIG. 5A to FIG. 5D An example computing device of an autonomous or semi-autonomous machine 500 is described.

[0030] In some embodiments, computing device 100 includes at least a discrete cryptographic processor on a die 103 and associated secure memory 124. The discrete processor on a die may be separate from a main microcontroller (e.g., microcontroller or processor 102) responsible for software execution and sensor input processing. The on-die cryptographic processor 103 includes a cryptographic engine 151 and executes secure firmware 150.

[0031] The cryptographic engine 151 may include a hardware component in the on-die discrete processor 103 that is specifically designed to efficiently perform cryptographic operations. The cryptographic engine 151 provides the necessary computing power for tasks such as calculating authentication tags. The security firmware 150 may include software components that execute on the on-die discrete processor 103. The security firmware 150 may include software responsible for managing the security functions and protocols of the system. This includes tasks such as managing cryptographic keys, controlling access to sensitive resources, handling authentication processes, and ensuring the overall security of the system. While the cryptographic engine 151 provides the underlying hardware support for cryptographic operations, the security firmware utilizes this engine to perform security-related tasks.

[0032] The security firmware 150 can enhance the security features or capabilities of the computing device 100, which, as previously mentioned, can be an ECU. The security firmware 150 generally focuses on preventing unauthorized access and ensuring the integrity of data. The security firmware 150 may include cryptographic algorithms, authentication protocols, and / or other security-related functions and may be responsible for implementing security measures at the firmware level to protect the device from potential threats, attacks, and / or vulnerabilities. The security firmware 150 works in conjunction with other security components such as hardware security modules or dedicated security modules (e.g., cryptographic engine 151) to provide strong protection and enforce security policies. The security firmware 150 can interact with the cryptographic engine 151 to request cryptographic operations, provide necessary inputs (such as keys), and process the results. It is worth noting that although in Figure 1 Although shown as separate components in FIG. 1 , the security firmware 150 and the cryptographic engine 151 may have overlapping functionality and / or may be integrated into a single module.

[0033] In some implementations, the cryptographic processor 103 uses the PKCS#11 (Public Key Cryptography Standard #11) standard to provide authentication functions. PKCS#11 is a widely used cryptographic interface standard that defines a platform-independent API (application programming interface) for cryptographic hardware devices such as smart cards and hardware security modules. It provides a standardized method for accessing cryptographic functions and operations including key management, encryption, decryption, digital signatures, and secure storage. PKCS#11 is commonly used in applications such as digital certificates, secure authentication, and data protection that require secure cryptographic operations.

[0034] In some embodiments, the cryptographic processor 103 includes dedicated boot software that initiates a secure state at boot time by loading authenticated secure firmware 150. Figure 1 ). In some embodiments, the cryptographic processor 103 includes a dedicated and unmodifiable memory area (referred to herein as "boot read-only memory (ROM)") for storing initial boot code associated with the secure firmware 150. The boot ROM may contain a portion of code called a boot loader or boot boot code, which is responsible for initializing the processor, performing necessary system checks, and loading the secure firmware 150 into the secure memory 124 (particularly into the active area of ​​the on-die SRAM 151 during system startup or initialization) to facilitate its execution. Providing a dedicated boot ROM for the secure firmware 150 provides multiple benefits to the cryptographic processor 103. The boot ROM contains trusted and unchangeable code that guarantees the integrity and authenticity of the boot process. The boot ROM helps prevent unauthorized modifications to the boot code to protect the system from malicious attacks. In addition, because the boot ROM is separate from other memory areas, it provides a reliable and consistent source for the boot code. It eliminates the risk of accidental corruption or modification of the boot code. In addition, the cryptographic processor 103 can start executing the boot code immediately after power-on without the need for external storage or intervention. This makes the boot process faster and more automated. In summary, the presence of a dedicated boot ROM for loading secure firmware 150 in the cryptographic processor 103 enhances the security, reliability, and efficiency of the boot process by providing a trusted and immutable source for initial firmware execution.

[0035] In some embodiments, the cryptographic engine 151 includes a hardware accelerator to calculate cryptographic authentication tags. A hardware accelerator is a dedicated component integrated into a cryptographic processor to improve the performance and efficiency of the cryptographic processor when calculating cryptographic operations such as calculating authentication tags. These accelerators are designed to unload the computational burden of the main processing functions and provide dedicated hardware support for cryptographic algorithms. Cryptographic operations involve complex mathematical calculations that may be time-consuming and resource-intensive. Hardware accelerators are specially built components that use hardware optimization to accelerate these cryptographic calculations to achieve faster processing speeds and improve overall system performance. Hardware accelerators can be specifically customized for different cryptographic algorithms such as hashing and message authentication codes (MACs). Hardware accelerators use techniques such as pipelines, parallel processing, and dedicated circuits to efficiently perform cryptographic operations in hardware.

[0036] Hardware accelerators in cryptographic processors can significantly increase processing speed in computing authentication tags. Hardware accelerators can efficiently perform operations such as key generation, data transformation, hashing, and other cryptographic primitives required to compute authentication tags. By offloading these tasks to dedicated hardware, the overall processing time can be reduced, allowing authentication tags to be generated and verified in real time or near real time in applications such as secure communication protocols. By using hardware accelerators, cryptographic processor 103 is able to process high-volume cryptographic operations with improved efficiency and reduced power consumption.

[0037] In various implementations, the on-die secure memory 124 may include an on-die SRAM 153 and a secure non-volatile memory 154 for storing keys related to the authentication process. As described above, in some embodiments, after booting, the secure firmware 150 is loaded into the secure memory 124, and in particular, into the on-die SRAM 153. This SRAM 153 is not accessible from outside the SRAM boundary, which means that external entities or processes cannot directly access or modify the contents of this memory. The on-die SRAM may be used by the processor to store sensitive data, for management and storage of cryptographic keys loaded into the SRAM after booting, or temporary variables required during operation.

[0038] In some embodiments, the secure memory 124 also includes a non-volatile memory 154 that stores a key associated with a selected authentication process, such as a message authentication code (MAC) process. As previously described, the type of authentication process is not limited and many different types of authentication processes or algorithms can be used, including but not limited to HMAC (hash-based MAC), KMAC (Keccak-based MAC), CMAC (ciphertext-based MAC), etc. For example, the key can be stored in a secure non-volatile flash memory before initialization. It should be noted that other types of non-volatile memory including electrically erasable programmable read-only memory (EEPROM) and one-time programmable memory (OTP memory) can also be used. The trusted execution environment including the on-die SRAM 153 and the secure firmware 150 can access the non-volatile memory (e.g., flash memory) 154 storing the key.

[0039] At initialization or boot time, the key may be transferred to the on-die SRAM 153. Then, during the process of calculating the authentication tag, the key is transferred to the active area of ​​SRAM 153 being used by the secure firmware 150 for calculating the tag. In some embodiments, the key is arranged in a linear array within SRAM 153 to avoid exposure to the rest of the system on chip (SOC) and to perform fast key exchange during the cryptographic authentication tag calculation.

[0040] In at least one embodiment, computing device 100 includes, but is not limited to, an interconnect (bus) 112 connecting one or more processors 102 and 103, an input / output (I / O) device / actuator interface 104 coupled to one or more input / output (I / O) devices / actuators 108, a sensor interface 114 coupled to one or more sensors 148, a memory 116, and / or a network interface 106. In the case where computing device 100 is an ECU, computing device 100 may also include an analog-to-digital converter, a digital-to-analog converter, a power supply circuit, a diagnostic interface, and various connectors for easy integration into a vehicle wiring harness.

[0041] The processor 102 may include any suitable processor implemented as a central processing unit (CPU), a graphics processing unit (GPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), an artificial intelligence (AI) accelerator, a microcontroller, a deep learning accelerator (DLA), a parallel processing unit (PPU), a data processing unit (DPU), a vector or vision processing unit (VPU), a programmable vision accelerator (PVA), any other type of processing unit, or a combination of different processing units. In general, the processor 102 may include any technically feasible hardware unit capable of processing data and / or executing software applications.

[0042] In at least one embodiment, the I / O devices 108 include devices such as keyboards, mice, touchpads, VR / MR / AR headsets, gesture recognition systems, steering wheels, mechanical, digital or touch-sensitive buttons or input components, and / or microphones that can receive inputs and devices such as display devices, haptic devices, and / or speakers that can provide outputs. In addition, the I / O devices 108 may include devices such as touch screens, universal serial bus (USB) ports, and the like that can both receive inputs and provide outputs. The I / O devices 108 can be configured to receive various types of inputs from an end user (e.g., a designer) of the computing device 100 and also provide various types of outputs such as displayed digital images or digital videos or text to the end user of the computing device 100. In some embodiments, one or more of the I / O devices 108 are configured to couple the computing device 100 to a network 110.

[0043] In at least one embodiment, where the computing device 100 is an ECU, the I / O device 108 may include one or more different types of actuators, including but not limited to, for example, ignition circuits or spark plugs, throttle controls, fuel injectors, O2 sensor heaters, on-board diagnostics, fuel pumps, radiator fans, and alternators that communicate with the computing device 100.

[0044] In at least one embodiment, network 110 is any technically feasible type of communication network that allows data to be exchanged between computing device 100 and internal, local, remote, or external entities or devices such as web servers or other networked computing devices. For example, network 110 may include a wide area network (WAN), a local area network (LAN), a wireless network (e.g., WiFi), and / or the Internet, among others.

[0045] In one embodiment, the memory 116 includes a random access memory (RAM) module, a flash memory unit, and / or any other type of memory unit or combination thereof. The processor 102, the I / O device interface 104, and the network interface 106 may be configured to read data from and write data to the memory 116. The memory 116 may include various software programs or more generally software codes executable by the processor 102 and application data associated with the software programs. In some embodiments, the software programs may be related to the operation of the vehicle.

[0046] In some embodiments, the cryptographic processor 103 and the secure memory 124 may be part of a system on a chip (SOC). The SOC may also include Figure 1 Other components shown include memory 116 and processor 102 .

[0047] Figure 2 2 is an illustration of how CAN messages are authenticated according to various embodiments. In an in-vehicle CAN network, for example, a message 204 may need to be transmitted from a sending ECU 210 to a receiving ECU 220. Figure 1 , the message may be associated with an application for receiving sensor data (e.g., from the sensor interface 114) and in response driving one of the actuators 108 through the actuator interface 104. An authentication process 208 is performed on the message using a cryptographic key K 230 to generate an authentication tag 214. As described above, one of several different types of authentication processes may be used. The authentication process 208 is executed on a cryptographic engine 151 using the secure firmware 150 to calculate the authentication tag 214. The cryptographic engine 151 may calculate the authentication tag 214 by using one or more keys 230 stored in the on-die SRAM 153, and during the process of calculating the authentication tag 214, the keys 230 are transferred to a more active area of ​​the SRAM 153 being used by the secure firmware 150. After the authentication tag 214 is calculated, both the authentication tag 214 and the message 204 are transmitted to the receiving ECU 220.

[0048] After transmission, the receiving ECU 220 receives the message 204 and its corresponding authentication tag 214. Upon receipt, the receiving ECU 220 initiates the authentication process 226 by inputting the received message 204 and the shared key K 230 (e.g., a secret key shared between the sending ECU 210 and the receiving ECU 220) into the authentication process 226. The receiving ECU 220 then recalculates the authentication tag 224 based on these inputs. Subsequently, the comparison module 304 in the receiving ECU 220 compares the newly calculated authentication tag 224 with the authentication tag 214 received from the sending ECU 210 to verify whether they are equal. In the case of a match between the tags, the receiving ECU 220 confirms the authenticity of the message and accepts the message as coming from the intended sender. In the case where the calculated authentication tag is inconsistent with the received tag, the receiving ECU 220 cannot determine whether the message has been tampered with or whether the original message has been forged.

[0049] In some embodiments, similar to the sending ECU 210, the receiving ECU 220 uses and combines Figure 1 The similar cryptographic engine 151 and security firmware 150 discussed above calculate the authentication tag 224. In other words, both the sending ECU 210 and the receiving ECU 220 have the same mechanism to process the cryptographic keys and calculate the authentication tag.

[0050] Figure 3 is an illustration of a system 300 for prioritizing performance-critical workloads according to various embodiments. It is critical to set the correct message prioritization in a safety-critical system, and the transmission of high-priority messages over the CAN network in the vehicle system cannot be blocked by low-priority applications. Therefore, the safety firmware provides multiple software queues with different priority levels of priority to prioritize performance-critical workloads. It is worth noting that although there can be multiple queues with multiple corresponding priority levels of priority, for simplicity, Figure 3 Only the high priority queue 308 and the low priority queue 308 are shown.

[0051] The application 302 is responsible for assigning its corresponding workload (or message) to the appropriate queue with the specified priority level, for example, the low priority queue 306 or the high priority queue 308 in the case of two software queues. The application can be associated with one or more ECUs that are part of the vehicle CAN network. When the application 302 receives a specific message for which an authentication tag needs to be calculated, the application identifies the message as a low priority message (associated with the low priority queue 306) or a high priority message (associated with the high priority queue 308). Based on the priority of the message, the application 302 queues that message into the corresponding priority queue. Priority can be assigned in various ways such as determining priority based on message size or associating each ECU with a specified priority level, where any message linked to a specific ECU is automatically assigned the corresponding priority level.

[0052] In various embodiments, the applications are responsible for assigning their respective workloads to the appropriate queues prior to initiating cryptographic authentication tag calculations. After assigning messages to the appropriate queues, the security firmware 304 processes the queues in the correct priority order to dispose of the messages and calculates authentication tags for the messages accordingly. The security firmware 304 processes the queues (e.g., queues 306 and 308) in a priority manner starting with the high priority queue and moving sequentially to the lower priority queues to ensure efficient and timely execution of critical tasks. Processing of the queues includes calculating authentication tags for each message that the security firmware 304 discharges from the queues in the correct priority order.

[0053] To calculate the authentication tag, the security firmware 304 requires the keys associated with the authentication process. As described above, the keys are transferred from the non-volatile memory (e.g., flash memory) 303 to the on-die SRAM at boot time. The on-die SRAM can store the keys until the security firmware 304 needs them. When the security firmware 304 needs the keys to calculate the authentication tag, the keys are transferred from the storage in the on-die SRAM to the active area of ​​the on-die SRAM 306, where the security firmware 304 can access the keys and use them to calculate the authentication tag.

[0054] To prevent low-priority workloads from hindering high-priority tasks, the security firmware 304 can use quantization techniques. This technique can include splitting low-priority messages above a specified threshold size into smaller units called "discrete message packets," which in some embodiments can be of a fixed size. By taking this approach, the security firmware 304 can manage the processing of low-priority messages in increments or packets, thereby avoiding possible stalls for high-priority workloads. Developers of in-vehicle communication systems can customize the threshold size based on the expected latency level that is acceptable within the system. For example, if the typical message size is 64 kilobytes, the developer can configure the discrete message packet size to 16 kilobytes, allowing low-priority messages to be processed in increments of 16 kilobytes.

[0055] After operating on each discrete message packet or unit associated with low priority work, the security firmware 304 determines whether there is a high priority workload available for processing. If there is high priority work, the high priority work is completed before returning to the next message packet associated with the low priority work and continuing to process the low priority messages. This technique limits the amount of time the firmware spends on low priority requests and avoids interference with high priority requests. Figure 4 Further details are given on quantizing messages to ensure that high priority work is processed before lower priority work.

[0056] It should be understood that this arrangement and other arrangements described herein are presented as examples only. Other arrangements and elements (e.g., machines, interfaces, functions, sequences, functional groupings, etc.) may be used in addition to or in place of those shown, and some elements may be omitted entirely. In addition, many of the elements described herein are functional entities that may be implemented as discrete or distributed components or in combination with other components, and may be implemented in any suitable combination and location. The various functions performed by the entities may be implemented by hardware, firmware, and / or software. For example, various functions may be performed by a processor executing instructions stored in a memory. In some embodiments, the same Figures 5A to 5D An exemplary autonomous vehicle 500, Figure 6 The exemplary computing device 600 of Figure 7 The systems, methods, and processes described herein may be performed using similar components, features, and / or functionality to those of the exemplary data center 700 of the present invention.

[0057] Now refer to Figure 4, each block of the method 400 described herein includes a computing process that can be performed using any combination of hardware, firmware, and / or software. For example, various functions can be performed by a processor executing instructions stored in a memory. The method can also be embodied as computer usable instructions stored on a computer storage medium. The method can be provided by a stand-alone application, service, or hosted service (standalone or in combination with other hosted services), or by a plug-in for other products, to name a few. In addition, as an example, with respect to Figure 1 and Figure 3 Method 400 is described in detail with reference to a system of FIG. However, this method may be performed additionally or alternately by any system or any combination of systems including, but not limited to, those described herein. Furthermore, the operations in method 400 may be omitted, repeated, and / or performed in any order without departing from the scope of the present disclosure.

[0058] Figure 4 A flow chart of a method for prioritizing secure transmission of a controller area network (CAN) message according to various embodiments is shown. Figure 4 As shown, method 400 begins with operation 402, in which the security firmware 150 determines whether there are any messages in the high priority queue (e.g., high priority queue 308) that need to be processed. In response to operation 402 determining that there are still remaining messages in the high priority queue to be processed, in operation 404, the security firmware 150 and the cryptographic engine 151 calculate an authentication tag for the high priority message. The authentication tag (e.g., authentication tag 214, 224, etc.) can then be transmitted to a receiving ECU (e.g., receiving ECU 220) along with the corresponding message, or the authentication tag can be used to perform a verification operation at the receiving ECU.

[0059] In response to determining that there are no high priority messages remaining in the high priority queue 308, in operation 406, the security firmware 150 receives a message or quantized portion of a message packet from the low priority queue 306. Quantization of low priority work limits the amount of time that the security firmware 150 operates on low priority requests and avoids interference with high priority requests. In some embodiments, the developer of the in-vehicle communication system can customize the size of the message packet (or message quanta) based on the desired level of latency that is acceptable within the system.

[0060] In some embodiments, message packets may be pre-fetched while security firmware 150 is offloading the computation of the authentication tag for the current message packet to cryptographic engine 151. This reduces delays in the authentication process.

[0061] In operation 408, the security firmware 150 attempts to match the message packet to a corresponding key using the identifier. If an appropriate key identifier is not found, an error will result in operation 410. The security firmware 150 then returns to operation 402, where it is again determined whether a message is waiting in a high priority queue. In response to determining in operation 408 that the key identifier matches the message packet, in operation 412, the security firmware 150 determines whether the message packet is the first packet in the message.

[0062] If it is determined in operation 412 that the message packet is the first packet in the message, the corresponding authentication tag is reset to zero or erased from the corresponding memory location (e.g., a dedicated memory location on the on-die SRAM) in operation 416. Subsequently, in operation 418, the authentication tag of the message packet is calculated and the dedicated memory location on the on-die SRAM (e.g., on-die SRAM 306) updates the intermediate value of the authentication tag. It is worth noting that since the message packet represents a portion of the complete message, the authentication tag calculated in operation 418 is an intermediate value of the final authentication tag that does not yet represent the complete message.

[0063] If it is determined in operation 412 that the message packet is not the first packet in the message, then the previously calculated intermediate authentication tag for the associated message is retrieved. Subsequently, in operation 418, the authentication tag for the message packet is calculated and the previously retrieved intermediate authentication tag is updated from a dedicated memory location on the on-die SRAM (e.g., on-die SRAM 306).

[0064] In operation 420, the security firmware 150 determines whether the processed message packet is the last one in the message and whether the determination of the authentication tag of the corresponding message is complete. Referring to the example above, for example, in the case where the message packets are processed in increments of 16 kilobytes from the low priority queue, the security firmware 150 will determine, for example, whether all 64 kilobytes of the message have been received. If it is determined in operation 420 that the message is complete, the authentication tag of the complete message is determined. If the ECU corresponding to the security firmware is a sending ECU (e.g., a sending ECU 210), the message can be transmitted together with the authentication tag, or if the ECU is a receiving ECU (e.g., a receiving ECU 220), the authentication tag can be used to perform comparison and verification operations. Thereafter, the security firmware 150 can return to operation 402, where it is determined again whether there are any high priority messages in the high priority queue available for transmission.

[0065] If it is determined in operation 420 that the message is not yet complete, the security firmware 150 also returns to operation 402, where it is again determined whether there are any high priority messages in the high priority queue available for transmission. If no high priority messages exist, the security firmware 150 can continue to process and calculate the authentication tag of the incomplete low priority message in operation 406. By taking this approach, the security firmware 150 can manage the processing of low priority messages in increments or groups, thereby avoiding possible pauses in high priority workloads.

[0066] The systems and methods described herein may be used by, but are not limited to, non-autonomous vehicles or machines, semi-autonomous vehicles or machines (e.g., in one or more adaptive driver assistance systems (ADAS)), autonomous vehicles or machines, manned and unmanned robots or robotic platforms, warehouse vehicles, off-road vehicles, vehicles coupled to one or more trailers, spacecraft, boats, shuttles, emergency response vehicles, motorcycles, electric or motorized bicycles, aircraft, engineering vehicles, submarines, drones, and / or other vehicle types. In addition, the systems and methods described herein may be used for a variety of purposes, such as, but not limited to, machine control, machine motion, machine driving, synthetic data generation, model training, perception, augmented reality, virtual reality, mixed reality, robotics, safety and surveillance, simulation and digital twins, autonomous or semi-autonomous machine applications, deep learning, environmental simulation, object or actor simulation and / or digital twins, data center processing, conversational AI, light transport simulation (e.g., ray tracing, path tracing, etc.), collaborative content creation of 3D assets, cloud computing, and / or any other suitable application.

[0067] Embodiments of the present disclosure include in a variety of different systems, such as automotive systems (e.g., control systems for autonomous or semi-autonomous machines, perception systems for autonomous or semi-autonomous machines), systems implemented using robots, aviation systems, medical systems, boating systems, smart area monitoring systems, systems for performing deep learning operations, systems for performing simulation operations, systems for performing digital twin operations, systems implemented using edge devices, systems including one or more virtual machines (VMs), systems for performing synthetic data generation operations, systems implemented at least in part in a data center, systems for performing conversational AI operations, systems implementing one or more language models such as one or more large language models (LLMs), systems for performing light transport simulations, systems for performing collaborative content creation of 3D assets, systems implemented at least in part using cloud computing resources, and / or other types of systems.

[0068] Example Autonomous Vehicle

[0069] Figure 5Ais an illustration of an example autonomous vehicle 500 according to some embodiments of the present disclosure. Autonomous vehicle 500 (alternatively referred to herein as "vehicle 500") may include, but is not limited to, a passenger vehicle such as a car, a truck, a bus, an emergency vehicle, a shuttle, an electric or motorized bicycle, a motorcycle, a fire truck, a police car, an ambulance, a boat, an engineering vehicle, a submarine, a robotic vehicle, a drone, an airplane, a vehicle coupled to a trailer (a semi-tractor-trailer truck for hauling cargo), and / or other types of vehicles (e.g., unmanned and / or capable of accommodating one or more passengers). Autonomous vehicles are generally described in terms of automation levels as defined by the National Highway Traffic Safety Administration (NHTSA), a division of the U.S. Department of Transportation, and the Society of Automotive Engineers (SAE), “Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles” (Standard No. J3016-201806, issued on June 15, 2018, Standard No. J3016-201609, issued on September 30, 2016, and previous and future versions of the standard). The vehicle 500 may be capable of implementing one or more functions that are consistent with levels 3-5 of autonomous driving levels. The vehicle 500 may be capable of implementing one or more functions that are consistent with levels 3-5 of autonomous driving levels. For example, depending on the embodiment, the vehicle 500 may be capable of driver assistance (level 1), semi-automation (level 2), conditional automation (level 3), high automation (level 4), and / or full automation (level 5). The term “autonomy” as used herein may include any and / or all types of autonomy of a vehicle 500 or other machine, such as fully autonomous, highly autonomous, conditionally autonomous, partially autonomous, providing assistive autonomy, semi-autonomous, primarily autonomous, or other designations.

[0070] The vehicle 500 may include components such as a chassis, a body, wheels (e.g., 2, 4, 6, 8, 18, etc.), tires, axles, and other components of the vehicle. The vehicle 500 may include a propulsion system 550, such as an internal combustion engine, a hybrid power plant, an all-electric engine, and / or another type of propulsion system. The propulsion system 550 may be connected to a drive train of the vehicle 500, which may include a transmission, to achieve propulsion of the vehicle 500. The propulsion system 550 may be controlled in response to receiving a signal from a throttle / accelerator 552.

[0071] A steering system 554, which may include a steering wheel, may be used to steer vehicle 500 (e.g., along a desired path or route) when propulsion system 550 is operating (e.g., when the vehicle is in motion). Steering system 554 may receive signals from steering actuator 556. For fully automated (Level 5) functionality, a steering wheel may be optional.

[0072] Brake sensor system 546 may be used to operate vehicle brakes in response to receiving signals from brake actuator 548 and / or brake sensors.

[0073] May include one or more system on chip (SoC) 504 ( Figure 5C ) and / or one or more controllers 536 of one or more GPUs can provide signals (e.g., representing commands) to one or more components and / or systems of the vehicle 500. For example, the one or more controllers can send signals to operate vehicle brakes via one or more brake actuators 548, to operate the steering system 554 via one or more steering actuators 556, and to operate the propulsion system 550 via one or more throttles / accelerators 552. The one or more controllers 536 may include one or more onboard (e.g., integrated) computing devices (e.g., supercomputers) that process sensor signals and output operating commands (e.g., signals representing commands) to achieve autonomous driving and / or assist a human driver in driving the vehicle 500. The one or more controllers 536 may include a first controller 536 for autonomous driving functions, a second controller 536 for functional safety functions, a third controller 536 for artificial intelligence functions (e.g., computer vision), a fourth controller 536 for infotainment functions, a fifth controller 536 for redundancy in emergency situations, and / or other controllers. In some examples, a single controller 536 may handle two or more of the above functions, two or more controllers 536 may handle a single function, and / or any combination thereof.

[0074] The one or more controllers 536 may provide signals for controlling one or more components and / or systems of the vehicle 500 in response to sensor data (e.g., sensor input) received from one or more sensors. The sensor data may be received from, for example and without limitation, a global navigation satellite system sensor ("GNSS") 558 (e.g., a global positioning system sensor), a RADAR sensor 560, an ultrasonic sensor 562, a LiDAR sensor 564, an inertial measurement unit (IMU) sensor 566 (e.g., an accelerometer, a gyroscope, a magnetic compass, a magnetometer, etc.), a microphone 596, a stereo camera 568, a wide angle camera 570 (e.g., a fisheye camera), an infrared camera 572, a surround camera 574 (e.g., a 360 degree camera), a long-range and / or mid-range camera 598, a speed sensor 544 (e.g., for measuring the velocity of the vehicle 500), a vibration sensor 542, a steering sensor 540, a brake sensor (e.g., as part of a brake sensor system 546), and / or other sensor types. The controller(s) 536 may include one or more instances of the processing engine 122 and / or the analysis engine 124 for monitoring sensor performance based on corresponding sensor data.

[0075] One or more of the controllers 536 may receive inputs (e.g., represented by input data) from the instrument cluster 532 of the vehicle 500 and provide outputs (e.g., represented by output data, display data, etc.) via a human machine interface (HMI) display 534, an audible annunciator, a speaker, and / or via other components of the vehicle 500. These outputs may include information such as vehicle speed, velocity, time, map data (e.g., Figure 5C The HMI display 534 may include information such as a high-definition (“HD”) map 522 of the vehicle 500 , location data (e.g., the location of the vehicle 500 on the map), directions, the locations of other vehicles (e.g., an occupancy grid), information about objects and states of objects as sensed by the controller 536 , and the like. For example, the HMI display 534 may display information about the presence of one or more objects (e.g., street signs, warning signs, traffic light changes, etc.) and / or information about driving maneuvers that the vehicle has made, is making, or will make (e.g., changing lanes now, leaving 34B in two miles, etc.).

[0076] The vehicle 500 further includes a network interface 524 that can communicate via one or more networks using one or more wireless antennas 526 and / or a modem. For example, the network interface 524 may be capable of communicating via Long Term Evolution (“LTE”), Wideband Code Division Multiple Access (“WCDMA”), Universal Mobile Telecommunications System (“UMTS”), Global System for Mobile Communications (“GSM”), IMT-CDMA Multi-Carrier (“CDMA2000”), etc. The one or more wireless antennas 526 may also enable communication between objects in the environment (e.g., vehicles, mobile devices, etc.) using one or more local area networks such as Bluetooth, Bluetooth Low Energy (“LE”), Z-wave, ZigBee, etc. and / or one or more low power wide area networks (LPWANs) such as LoRaWAN, SigFox, etc.

[0077] Figure 5B For use according to some embodiments of the present disclosure Figure 5A An example of camera positions and fields of view for an example autonomous vehicle 500 is shown. The cameras and respective fields of view are an example embodiment and are not intended to be limiting. For example, additional and / or replaceable cameras may be included, and / or the cameras may be located at different locations on the vehicle 500.

[0078] The camera type for the camera may include, but is not limited to, a digital camera that may be suitable for use with components and / or systems of the vehicle 500. The camera may operate at an automotive safety integrity level (ASIL) B and / or at another ASIL. The camera type may have any image capture rate, such as 60 frames per second (fps), 120fps, 240fps, etc., depending on the embodiment. The camera may be capable of using a rolling shutter, a global shutter, another type of shutter, or a combination thereof. In some examples, the color filter array may include a red-white-white-white (RCCC) color filter array, a red-white-white-blue (RCCB) color filter array, a red-blue-green-white (RBGC) color filter array, a Foveon X3 color filter array, a Bayer sensor (RGGB) color filter array, a monochrome sensor color filter array, and / or another type of color filter array. In some embodiments, a clear pixel camera such as a camera with an RCCC, RCCB, and / or RBGC color filter array may be used in an effort to improve light sensitivity.

[0079] In some examples, one or more of the cameras can be used to perform advanced driver assistance system (ADAS) functions (e.g., as part of a redundant or fail-safe design). For example, a multi-function monocular camera can be installed to provide functions including lane departure warning, traffic sign assistance, and intelligent headlight control. One or more of the cameras (e.g., all of the cameras) can simultaneously record and provide image data (e.g., video).

[0080] One or more of the cameras may be mounted in a mounting assembly such as a custom designed (three-dimensional "3D" printed) assembly to cut off stray light and reflections from within the vehicle (e.g., reflections from the dashboard reflected in a windshield mirror) that may interfere with the camera's image data capture capabilities. With respect to the wing mirror mounting assembly, the wing mirror assembly may be custom 3D printed so that the camera mounting plate matches the shape of the wing mirror. In some examples, one or more cameras may be integrated into the wing mirror. For side view cameras, one or more cameras may also be integrated into the four pillars at each corner of the cab.

[0081] A camera (e.g., a front-facing camera) having a field of view that includes a portion of the environment in front of the vehicle 500 can be used for surround vision to help identify the forward path and obstacles, as well as assist in providing information critical to generating an occupancy grid and / or determining a preferred vehicle path with the help of one or more controllers 536 and / or control SoCs. The front-facing camera can be used to perform many of the same ADAS functions as LiDAR, including emergency braking, pedestrian detection, and collision avoidance. The front-facing camera can also be used for ADAS functions and systems, including lane departure warning ("LDW"), autonomous cruise control ("ACC"), and / or other functions such as traffic sign recognition.

[0082] A variety of cameras may be used in the front-facing configuration, including, for example, a monocular camera platform including a complementary metal oxide semiconductor ("CMOS") color imager. Another example may be a wide-angle camera 570, which may be used to sense objects (e.g., pedestrians, intersection traffic, or bicycles) entering the field of view from the periphery. Figure 5B Only one wide-angle camera is shown in the figure, but there may be any number (including zero) of wide-angle cameras 570 on the vehicle 500. In addition, any number of long-range cameras 598 (e.g., a long-view stereo camera pair) may be used for depth-based object detection, especially for objects for which a neural network has not been trained. Long-range cameras 598 may also be used for object detection and classification and basic object tracking.

[0083] One or more stereo cameras 568 may also be included in the front configuration. In at least one embodiment, one or more of the stereo cameras 568 may include an integrated control unit including an expandable processing unit that may provide a multi-core microprocessor and programmable logic ("FPGA") with an integrated controller area network ("CAN") or Ethernet interface on a single chip. Such a unit may be used to generate a 3D map of the vehicle environment, including distance estimates for all points in the image. An alternative stereo camera 568 may include a compact stereo vision sensor that may include two camera lenses (one on each side) and an image processing chip that may measure the distance from the vehicle to the target object and use the generated information (e.g., metadata) to activate autonomous emergency braking and lane departure warning functions. Other types of stereo cameras 568 may be used in addition to or alternatively to those described herein.

[0084] A camera (e.g., a side view camera) having a field of view of a portion of the environment including the sides of the vehicle 500 can be used for surround viewing, providing information used to create and update the occupancy grid and generate side impact collision warnings. Figure 5B The four surround cameras 574 shown in FIG. 5 can be placed on the vehicle 500. The surround cameras 574 can include a wide-angle camera 570, a fisheye camera, a 360-degree camera, and / or the like. For example, the four fisheye cameras can be placed in front, behind, and on the sides of the vehicle. In an alternative arrangement, the vehicle can use three surround cameras 574 (e.g., left, right, and rear), and can utilize one or more other cameras (e.g., a forward-facing camera) as a fourth surround camera.

[0085] A camera having a field of view that includes a portion of the environment behind the vehicle 500 (e.g., a rear view camera) can be used to assist with parking, surround view, rear collision warning, and creating and updating an occupancy grid. A variety of cameras can be used, including but not limited to cameras that are also suitable as front-facing cameras as described herein (e.g., long-range and / or mid-range cameras 598, stereo cameras 568, infrared cameras 572, etc.).

[0086] Figure 5C For use according to some embodiments of the present disclosure Figure 5ABlock diagram of an example system architecture of an example autonomous vehicle 500. It should be understood that this arrangement and other arrangements described herein are set forth merely as examples. Other arrangements and elements (e.g., machines, interfaces, functions, sequences, functional groupings, etc.) may be used in addition to or in place of those shown, and some elements may be omitted entirely. Further, many of the elements described herein are functional entities that may be implemented as discrete or distributed components or in combination with other components, and in any appropriate combination and location. The various functions described herein as being performed by an entity may be implemented by hardware, firmware, and / or software. For example, the various functions may be implemented by a processor executing instructions stored in a memory.

[0087] Figure 5C Each of the components, features, and systems of the vehicle 500 is illustrated as being connected via a bus 502. The bus 502 may include a controller area network (CAN) data interface (alternatively, referred to herein as a "CAN bus"). The CAN may be a network inside the vehicle 500 that assists in controlling various features and functions of the vehicle 500, such as the actuation of brakes, acceleration, braking, steering, windshield wipers, and the like. The CAN bus may be configured to have tens or even hundreds of nodes, each with its own unique identifier (e.g., a CAN ID). The CAN bus may be read to find steering wheel angle, ground speed, engine speed per minute (RPM), button position, and / or other vehicle status indicators. The CAN bus may be ASIL B compatible.

[0088] Although bus 502 is described as a CAN bus here, this is not intended to be limiting. For example, in addition to or alternatively to the CAN bus, FlexRay and / or Ethernet can be used. In addition, although bus 502 is represented by a single line, this is not intended to be limiting. For example, there can be any number of buses 502, which may include one or more CAN buses, one or more FlexRay buses, one or more Ethernet buses, and / or one or more other types of buses using different protocols. In some examples, two or more buses 502 can be used to perform different functions, and / or can be used for redundancy. For example, a first bus 502 can be used for a collision avoidance function, and a second bus 502 can be used for drive control. In any example, each bus 502 can communicate with any component of the vehicle 500, and two or more buses 502 can communicate with the same component. In some examples, each SoC 504, each controller 536, and / or each computer in the vehicle can have access to the same input data (e.g., input from a sensor of the vehicle 500), and can be connected to a common bus such as a CAN bus.

[0089] The vehicle 500 may include one or more controllers 536, such as those described herein. Figure 5A Those controllers described. Controller 536 can be used for a variety of functions. Controller 536 can be coupled to any other different components and systems of vehicle 500, and can be used for control of vehicle 500, artificial intelligence of vehicle 500, infotainment for vehicle 500, and / or the like.

[0090] The vehicle 500 may include one or more system on chip (SoC) 504. The SoC 504 may include a CPU 506, a GPU 508, a processor 510, a cache 512, an accelerator 514, a data store 516, and / or other components and features not shown. The SoC 504 may be used to control the vehicle 500 in a variety of platforms and systems. For example, one or more SoCs 504 may be combined with an HD map 522 in a system (e.g., a system of the vehicle 500), and the HD map may be downloaded from one or more servers (e.g., a server) via a network interface 524. Figure 5D one or more servers 578) to obtain map refreshes and / or updates.

[0091] CPU 506 may include a CPU cluster or CPU complex (alternatively, referred to herein as "CCPLEX"). CPU 506 may include multiple cores and / or L2 caches. For example, in some embodiments, CPU 506 may include eight cores in a coherent multiprocessor configuration. In some embodiments, CPU 506 may include four dual-core clusters, each with a dedicated L2 cache (e.g., 2MB L2 cache). CPU 506 (e.g., CCPLEX) may be configured to support simultaneous cluster operations, such that any combination of CPU 506 clusters can be active at any given time.

[0092] CPU 506 may implement power management capabilities including one or more of the following features: each hardware block may be automatically clock gated when idle to save dynamic power; each core clock may be gated when the core is not actively executing instructions due to the execution of WFI / WFE instructions; each core may be independently power gated; each core cluster may be independently clock gated when all cores are clock gated or power gated; and / or each core cluster may be independently power gated when all cores are power gated. CPU 506 may further implement an enhanced algorithm for managing power states, in which allowed power states and expected wake-up times are specified, and hardware / microcode determines the optimal power state to enter for the core, cluster, and CCPLEX. The processing core may support a simplified power state entry sequence in software, with the work being offloaded to the microcode.

[0093] The GPU 508 may include an integrated GPU (alternatively, referred to herein as an "iGPU"). The GPU 508 may be programmable and efficient for parallel workloads. In some examples, the GPU 508 may use an enhanced tensor instruction set. The GPU 508 may include one or more streaming microprocessors, each of which may include an L1 cache (e.g., an L1 cache with at least 96KB storage capacity), and two or more of these streaming microprocessors may share an L2 cache (e.g., an L2 cache with 512KB storage capacity). In some embodiments, the GPU 508 may include at least eight streaming microprocessors. The GPU 508 may use a computing application programming interface (API). In addition, the GPU 508 may use one or more parallel computing platforms and / or programming models (e.g., NVIDIA's CUDA).

[0094] In the case of automotive and embedded use cases, GPU 508 can be power optimized to achieve optimal performance. For example, GPU 508 can be manufactured on fin field effect transistors (FinFETs). However, this is not intended to be limiting, and GPU 508 can be manufactured using other semiconductor manufacturing processes. Each streaming microprocessor can merge several mixed precision processing cores divided into multiple blocks. For example and without limitation, 64 PF32 cores and 32 PF64 cores can be divided into four processing blocks. In such an example, each processing block can be allocated 16 FP32 cores, 8 FP64 cores, 16 INT32 cores, two mixed precision NVIDIA tensor cores for deep learning matrix arithmetic, L0 instruction cache, thread beam (warp) scheduler, dispatch unit and / or 64KB register file. In addition, the streaming microprocessor can include independent parallel integer and floating point data paths to provide efficient execution of workloads using a mix of computation and addressing computations. The streaming microprocessor can include independent thread scheduling capabilities to allow for finer-grained synchronization and collaboration between parallel threads. A streaming microprocessor may include a combined L1 data cache and shared memory unit to increase performance while simplifying programming.

[0095] GPU 508 can include high bandwidth memory (HBM) and / or a 16GB HBM2 memory subsystem that provides a peak memory bandwidth of approximately 900 GB / s in some examples. In some examples, synchronous graphics random access memory (SGRAM), such as fifth generation graphics double data rate synchronous random access memory (GDDR5), can be used in addition to or in lieu of HBM memory.

[0096] The GPU 508 may include unified memory technology that includes access counters to allow memory pages to be more accurately migrated to the processor that accesses them most frequently, thereby improving the efficiency of memory ranges shared between processors. In some examples, address translation service (ATS) support can be used to allow the GPU 508 to directly access the CPU 506 page table. In such an example, when the GPU 508 memory management unit (MMU) experiences a miss, an address translation request can be transmitted to the CPU 506. In response, the CPU 506 can look up the virtual-physical mapping for the address in its page table and transmit the translation back to the GPU 508. In this way, the unified memory technology can allow a single unified virtual address space to be used for the memory of both the CPU 506 and the GPU 508, thereby simplifying GPU 508 programming and porting applications to the GPU 508.

[0097] In addition, GPU 508 may include access counters that can track how often GPU 508 accesses the memory of other processors. The access counters can help ensure that memory pages are moved to the physical memory of the processor that accesses them most frequently.

[0098] SoC 504 may include any number of caches 512, including those described herein. For example, cache 512 may include an L3 cache available to both CPU 506 and GPU 508 (e.g., connected to both CPU 506 and GPU 508). Cache 512 may include a write-back cache that may track the state of a line, for example, by using a cache coherence protocol (e.g., MEI, MESI, MSI, etc.). Depending on the embodiment, the L3 cache may include 4MB or more, although smaller cache sizes may also be used.

[0099] The SoC 504 may include one or more arithmetic logic units (ALUs) that may be used to perform processing for any of a variety of tasks or operations with respect to the vehicle 500, such as processing a DNN. Additionally, the SoC 504 may include a floating point unit (FPU) or other math coprocessor or digital coprocessor type for performing mathematical operations within the system. For example, the SoC 504 may include one or more FPUs integrated as execution units within the CPU 506 and / or GPU 508.

[0100] SoC 504 may include one or more accelerators 514 (e.g., hardware accelerators, software accelerators, or combinations thereof). For example, SoC 504 may include a hardware acceleration cluster, which may include optimized hardware accelerators and / or large on-chip memory. The large on-chip memory (e.g., 4MB SRAM) may enable the hardware acceleration cluster to accelerate neural networks and other calculations. The hardware acceleration cluster may be used to supplement GPU 508 and offload some tasks of GPU 508 (e.g., free up more cycles of GPU 508 for performing other tasks). As an example, accelerator 514 may be used for targeted workloads (e.g., perception, convolutional neural networks (CNNs), etc.) that are sufficiently stable to be easily controlled for acceleration. When used herein, the term "CNN" may include all types of CNNs, including region-based or regional convolutional neural networks (RCNNs) and fast RCNNs (e.g., for object detection).

[0101] The accelerator 514 (e.g., a hardware acceleration cluster) may include a deep learning accelerator (DLA). The DLA may include one or more tensor processing units (TPUs) that may be configured to provide an additional 10 trillion operations per second for deep learning applications and reasoning. The TPU may be an accelerator configured to perform image processing functions (e.g., for CNN, RCNN, etc.) and optimized for performing image processing functions. The DLA may be further optimized for a specific set of neural network types and floating point operations and reasoning. The design of the DLA may provide higher performance per millimeter than a general-purpose GPU, and far exceeds the performance of the CPU. The TPU may perform several functions, including a single instance convolution function, support, for example, INT8, INT16, and FP16 data types for both features and weights, and post-processor functions.

[0102] The DLA can quickly and efficiently execute neural networks, particularly CNNs, on processed or unprocessed data for any of a wide variety of functions, such as, but not limited to: a CNN for object recognition and detection using data from a camera sensor; a CNN for distance estimation using data from a camera sensor; a CNN for emergency vehicle detection and identification and detection using data from a microphone; a CNN for facial recognition and vehicle owner identification using data from a camera sensor; and / or a CNN for safety and / or security-related events.

[0103] The DLA can perform any function of the GPU 508, and by using an inference accelerator, for example, the designer can target any function to either the DLA or the GPU 508. For example, the designer can focus the processing of CNNs and floating point operations on the DLA, and leave other functions to the GPU 508 and / or other accelerators 514.

[0104] The accelerator 514 (e.g., a hardware acceleration cluster) may include a programmable vision accelerator (PVA), which may be alternatively referred to herein as a computer vision accelerator. The PVA may be designed and configured to accelerate computer vision algorithms for advanced driver assistance systems (ADAS), autonomous driving, and / or augmented reality (AR) and / or virtual reality (VR) applications. The PVA may provide a balance between performance and flexibility. For example, each PVA may include, for example and without limitation, any number of reduced instruction set computer (RISC) cores, direct memory access (DMA), and / or any number of vector processors.

[0105] The RISC core can interact with an image sensor (e.g., an image sensor of any camera described herein), an image signal processor, and / or the like. Each of these RISC cores can include any number of memories. Depending on the embodiment, the RISC core can use any of a number of protocols. In some examples, the RISC core can execute a real-time operating system (RTOS). The RISC core can be implemented using one or more integrated circuit devices, application specific integrated circuits (ASICs), and / or storage devices. For example, the RISC core can include an instruction cache and / or a tightly coupled RAM.

[0106] The DMA may enable components of the PVA to access system memory independently of the CPU 506. The DMA may support any number of features used to provide optimizations for the PVA, including, but not limited to, support for multi-dimensional addressing and / or circular addressing. In some examples, the DMA may support addressing in up to six or more dimensions, which may include block width, block height, block depth, horizontal block stepping, vertical block stepping, and / or depth stepping.

[0107] The vector processor can be a programmable processor that can be designed to efficiently and flexibly perform programming for computer vision algorithms and provide signal processing capabilities. In some examples, the PVA can include a PVA core and two vector processing subsystem partitions. The PVA core can include a processor subsystem, one or more DMA engines (e.g., two DMA engines), and / or other peripherals. The vector processing subsystem can operate as the main processing engine of the PVA, and can include a vector processing unit (VPU), an instruction cache, and / or a vector memory (e.g., VMEM). The VPU core can include a digital signal processor, such as, for example, a single instruction multiple data (SIMD), a very long instruction word (VLIW) digital signal processor. The combination of SIMD and VLIW can enhance throughput and rate.

[0108] Each of the vector processors may include an instruction cache and may be coupled to a dedicated memory. As a result, in some examples, each of the vector processors may be configured to execute independently of the other vector processors. In other examples, the vector processors included in a particular PVA may be configured to employ data parallelism. For example, in some embodiments, multiple vector processors included in a single PVA may execute the same computer vision algorithm, but on different regions of an image. In other examples, the vector processors included in a particular PVA may execute different computer vision algorithms simultaneously on the same image, or even execute different algorithms on sequence images or portions of an image. Among other things, any number of PVAs may be included in a hardware acceleration cluster, and any number of vector processors may be included in each of these PVAs. In addition, the PVA may include additional error correction code (ECC) memory to enhance overall system security.

[0109] The accelerator 514 (e.g., a hardware acceleration cluster) may include an on-chip computer vision network and SRAM to provide high bandwidth, low latency SRAM for the accelerator 514. In some examples, the on-chip memory may include at least 4MB of SRAM consisting of, for example and not limited to, eight field-configurable memory blocks that can be accessed by both the PVA and the DLA. Each pair of memory blocks may include an advanced peripheral bus (APB) interface, configuration circuitry, a controller, and a multiplexer. Any type of memory may be used. The PVA and DLA may access the memory via a backbone that provides high-speed memory access to the PVA and DLA. The backbone may include an on-chip computer vision network that interconnects the PVA and DLA to the memory (e.g., using APB).

[0110] The on-chip computer vision network may include an interface that determines that both the PVA and DLA provide ready and valid signals before transmitting any control signals / addresses / data. Such an interface may provide separate phases and separate channels for transmitting control signals / addresses / data, as well as burst communication for continuous data transmission. This type of interface may comply with ISO 26262 or IEC 61508 standards, but other standards and protocols may also be used.

[0111] In some examples, SoC 504 may include a real-time ray tracing hardware accelerator such as described in U.S. Patent Application No. 16 / 101,232 filed on August 10, 2018. The real-time ray tracing hardware accelerator may be used to quickly and efficiently determine the position and range of objects (e.g., within a world model) in order to generate real-time visualization simulations for RADAR signal interpretation, for sound propagation synthesis and / or analysis, for SONAR system simulations, for general wave propagation simulations, for comparison with LiDAR data for the purpose of positioning and / or other functions, and / or for other purposes. In some embodiments, one or more tree traversal units (TTUs) may be used to perform one or more ray tracing related operations.

[0112] The accelerator 514 (e.g., a hardware accelerator cluster) has a wide range of uses in autonomous driving. The PVA can be a programmable visual accelerator that can be used for key processing stages in ADAS and autonomous vehicles. The capabilities of the PVA are a good match for algorithmic domains that require predictable processing, low power, and low latency. In other words, the PVA performs well on semi-dense or dense rule computations, and even on small data sets that require predictable runtimes with low latency and low power. Therefore, in the context of a platform for autonomous vehicles, the PVA is designed to run classic computer vision algorithms because they are efficient at object detection and integer math.

[0113] For example, according to one embodiment of the technology, PVA is used to perform computer stereo vision. In some examples, algorithms based on semi-global matching can be used, but this is not intended to be limiting. Many applications for level 3-5 autonomous driving require instant motion estimation / stereo matching (e.g., structure from motion, pedestrian recognition, lane detection, etc.). PVA can perform computer stereo vision functions on input from two monocular cameras.

[0114] In some examples, PVA can be used to perform dense optical flow. According to the process raw RADAR data (e.g., using 4D fast Fourier transform) to provide processed RADAR. In other examples, PVA is used for time-of-flight depth processing, which is for example by processing raw time-of-flight data to provide processed time-of-flight data.

[0115] DLA can be used to run any type of network to enhance control and driving safety, including, for example, a neural network that outputs a confidence measure for each object detection. Such a confidence value can be interpreted as a probability, or as providing a relative "weight" of each detection compared to other detections. This confidence value enables the system to make further decisions about which detections should be considered true positive detections rather than false positive detections. For example, the system can set a threshold for confidence and only consider detections that exceed the threshold as true positive detections. In an automatic emergency braking (AEB) system, a false positive detection will cause the vehicle to automatically perform emergency braking, which is obviously undesirable. Therefore, only the most confident detection should be considered a trigger for AEB. DLA can run a neural network for regressing confidence values. The neural network can take at least some subset of parameters as its input, such as bounding box dimensions, ground plane estimates obtained (e.g., from another subsystem), inertial measurement unit (IMU) sensor 566 output related to vehicle 500 orientation and distance, 3D position estimates of objects obtained from neural networks and / or other sensors (e.g., LiDAR sensor 564 or RADAR sensor 560), etc.

[0116] SoC 504 may include one or more data stores 516 (e.g., memory). Data store 516 may be on-chip memory of SoC 504 that may store neural networks to be executed on the GPU and / or DLA. In some examples, data store 516 may be large enough to store multiple instances of the neural network for redundancy and safety. Data store 512 may include an L2 or L3 cache 512. References to data store 516 may include references to memory associated with PVA, DLA, and / or other accelerators 514 as described herein.

[0117] SoC 504 may include one or more processors 510 (e.g., embedded processors). Processor 510 may include a boot and power management processor, which may be a dedicated processor and subsystem for handling boot power and management functions and related safety implementations. The boot and power management processor may be part of the SoC 504 boot sequence and may provide runtime power management services. The boot power and management processor may provide clock and voltage programming, auxiliary system low power state transitions, SoC 504 thermal and temperature sensor management, and / or SoC 504 power state management. Each temperature sensor may be implemented as a ring oscillator whose output frequency is proportional to the temperature, and SoC 504 may use the ring oscillator to detect the temperature of CPU 506, GPU 508, and / or accelerator 514. If it is determined that the temperature exceeds a threshold, the boot and power management processor may enter a temperature fault routine and place SoC 504 in a lower power state and / or place the vehicle 500 in a driver safety parking mode (e.g., parking the vehicle 500 safely).

[0118] Processor 510 may further include a set of embedded processors that may be used as an audio processing engine. The audio processing engine may be an audio subsystem that allows for full hardware support for multi-channel audio through multiple interfaces and a wide range of flexible audio I / O interfaces. In some examples, the audio processing engine is a dedicated processor core having a digital signal processor with dedicated RAM.

[0119] The processor 510 may further include an always-on processor engine that may provide the necessary hardware features to support low-power sensor management and wake-up use cases. The always-on processor engine may include a processor core, tightly coupled RAM, supporting peripherals (e.g., timers and interrupt controllers), various I / O controller peripherals, and routing logic.

[0120] The processor 510 may further include a safety cluster engine, which includes a dedicated processor subsystem that handles safety management of automotive applications. The safety cluster engine may include two or more processor cores, tightly coupled RAM, supporting peripherals (e.g., timers, interrupt controllers, etc.), and / or routing logic. In safety mode, the two or more cores may operate in lockstep mode and act as a single core with comparison logic to detect any differences between their operations.

[0121] Processor 510 may further include a real-time camera engine, which may include a dedicated processor subsystem for handling real-time camera management.

[0122] Processor 510 may further include a high dynamic range signal processor, which may include an image signal processor, which is a hardware engine that is part of the camera processing pipeline.

[0123] The processor 510 may include a video image compositer, which may be a processing block (e.g., implemented on a microprocessor) that implements video post-processing functions required for the video playback application to produce a final image for the player window. The video image compositer may perform lens distortion correction for the wide-angle camera 570, the surround camera 574, and / or for an in-cab surveillance camera sensor. The in-cab surveillance camera sensor is preferably monitored by a neural network running on another instance of the advanced SoC, configured to recognize in-cab events and respond accordingly. The in-cab system may perform lip reading to activate mobile phone service and place calls, dictate emails, change vehicle destinations, activate or change the vehicle's infotainment system and settings, or provide voice-activated web surfing. Certain functions are only available to the driver when the vehicle is operating in autonomous mode and are disabled in other circumstances.

[0124] The video image compositer may include enhanced temporal noise reduction for both spatial and temporal noise reduction. For example, in the case of motion in the video, the noise reduction appropriately weights the spatial information and reduces the weight of information provided by adjacent frames. In the case where an image or portion of an image does not include motion, the temporal noise reduction performed by the video image compositer may use information from previous images to reduce noise in the current image.

[0125] The video image compositor may also be configured to perform stereoscopic rectification on the input stereoscopic footage frames. The video image compositor may further be used for user interface composition when the operating system desktop is in use and the GPU 508 does not need to continuously render new surfaces. Even when the GPU 508 is powered on and active for 3D rendering, the video image compositor may be used to offload the GPU 508 to improve performance and responsiveness.

[0126] SoC 504 may further include a mobile industry processor interface (MIPI) camera serial interface for receiving video and input from a camera, a high-speed interface, and / or a video input block that may be used for camera and related pixel input functions. SoC 504 may further include an input / output controller that may be controlled by software and may be used to receive I / O signals that are not committed to a specific role.

[0127] SoC 504 may further include a wide range of peripheral interfaces to enable communication with peripherals, audio codecs, power management and / or other devices. SoC 504 may be used to process data from cameras (connected via Gigabit multimedia serial link and Ethernet), sensors (e.g., LiDAR sensor 564, RADAR sensor 560, etc., which may be connected via Ethernet), data from bus 502 (e.g., speed of vehicle 500, steering wheel position, etc.), data from GNSS sensor 558 (connected via Ethernet or CAN bus). SoC 504 may further include dedicated high-performance mass storage controllers, which may include their own DMA engines, and which may be used to free up CPU 506 from routine data management tasks.

[0128] SoC 504 can be an end-to-end platform with a flexible architecture that spans automation levels 3-5, providing a comprehensive functional safety architecture that leverages and efficiently uses computer vision and ADAS technologies to achieve diversity and redundancy, together with deep learning tools to provide a platform for a flexible and reliable driving software stack. SoC 504 can be faster, more reliable, and even more energy efficient and space efficient than conventional systems. For example, when combined with CPU 506, GPU 508, and data storage 516, accelerator 514 can provide a fast and efficient platform for level 3-5 autonomous vehicles.

[0129] The technology thus provides capabilities and functionality that cannot be achieved by conventional systems. For example, computer vision algorithms can be executed on CPUs, which can be configured using high-level programming languages ​​such as the C programming language to execute a wide variety of processing algorithms across a wide variety of visual data. However, CPUs often fail to meet the performance requirements of many computer vision applications, such as those related to, for example, execution time and power consumption. In particular, many CPUs are unable to execute complex object detection algorithms in real time, which is a requirement for in-vehicle ADAS applications and a requirement for practical Level 3-5 autonomous vehicles.

[0130] In contrast to conventional systems, by providing a CPU complex, a GPU complex, and a hardware acceleration cluster, the techniques described herein allow multiple neural networks to be executed simultaneously and / or sequentially, and the results to be combined together to achieve Level 3-5 autonomous driving functions. For example, a CNN executed on a DLA or dGPU (e.g., GPU 520) may include text and word recognition, allowing the supercomputer to read and understand traffic signs, including signs for which a neural network has not been specifically trained. The DLA may further include a neural network capable of recognizing, interpreting, and providing semantic understanding of the signs, and passing the semantic understanding to a path planning module running on the CPU complex. The DLA may also utilize metrics related to sensor performance as input to one or more neural networks.

[0131] As another example, as required for Level 3, 4, or 5 driving, multiple neural networks may be running simultaneously. For example, a warning sign consisting of "Caution: Flashing Lights Indicate Icing Conditions" along with electric lights may be interpreted by several neural networks independently or collectively. The sign itself may be recognized as a traffic sign by a deployed first neural network (e.g., a trained neural network), and the text "Flashing Lights Indicate Icing Conditions" may be interpreted by a deployed second neural network that informs the vehicle's path planning software (preferably executing on a CPU complex) that icing conditions exist when the flashing lights are detected. The flashing lights may be identified by operating a deployed third neural network over multiple frames that informs the vehicle's path planning software of the presence (or absence) of the flashing lights. All three neural networks may be running simultaneously, for example, within the DLA and / or on the GPU 508.

[0132] In some examples, a CNN for facial recognition and owner recognition can use data from the camera sensor to identify the presence of an authorized driver and / or owner of the vehicle 500. The always-on sensor processing engine can be used to unlock the vehicle and turn on the lights when the owner approaches the driver's door, and in security mode, disable the vehicle when the owner leaves the vehicle. In this way, the SoC 504 provides security against theft and / or carjacking.

[0133] In another example, a CNN for emergency vehicle detection and identification can use data from microphone 596 to detect and identify emergency vehicle sirens. In contrast to conventional systems that use general classifiers to detect sirens and manually extract features, SoC 504 uses CNN to classify environmental and urban sounds and to classify visual data. In a preferred embodiment, the CNN running on the DLA is trained to identify the relative closing rate of emergency vehicles (e.g., by using the Doppler effect). The CNN can also be trained to identify emergency vehicles specific to the local area in which the vehicle is operating, as identified by the GNSS sensor 558. Thus, for example, when operating in Europe, the CNN will seek to detect European sirens, and when in the United States, the CNN will seek to identify only North American sirens. Once an emergency vehicle is detected, with the assistance of the ultrasonic sensor 562, the control program can be used to execute emergency vehicle safety routines to slow the vehicle, drive to the side of the road, stop the vehicle, and / or idle the vehicle until the emergency vehicle passes.

[0134] The vehicle may include a CPU 518 (e.g., a discrete CPU or dCPU) that may be coupled to the SoC 504 via a high-speed interconnect (e.g., PCIe). The CPU 518 may include, for example, an X86 processor. The CPU 518 may be used to perform any of a variety of functions, including, for example, arbitrating potentially inconsistent results between ADAS sensors and the SoC 504, and / or monitoring the status and health of the controller 536 and / or the infotainment SoC 530.

[0135] The vehicle 500 may include a GPU 520 (e.g., a discrete GPU or dGPU) that may be coupled to the SoC 504 via a high-speed interconnect (e.g., NVIDIA's NVLINK). The GPU 520 may provide additional artificial intelligence functionality, for example, by executing redundant and / or different neural networks, and may be used to train and / or update the neural network based on inputs (e.g., sensor data) from sensors of the vehicle 500.

[0136] The vehicle 500 may further include a network interface 524, which may include one or more wireless antennas 526 (e.g., one or more wireless antennas for different communication protocols, such as cellular antennas, Bluetooth antennas, etc.). The network interface 524 can be used to enable wireless connections with the cloud (e.g., with a server 578 and / or other network devices), with other vehicles, and / or with computing devices (e.g., a passenger's client device) via the Internet. In order to communicate with other vehicles, a direct link can be established between the two vehicles, and / or an indirect link can be established (e.g., across a network and through the Internet). The direct link can be provided using a vehicle-to-vehicle communication link. The vehicle-to-vehicle communication link can provide the vehicle 500 with information about vehicles approaching the vehicle 500 (e.g., vehicles in front of, to the side of, and / or behind the vehicle 500). This functionality can be part of the collaborative adaptive cruise control functionality of the vehicle 500.

[0137] The network interface 524 may include a SoC that provides modulation and demodulation functions and enables the controller 536 to communicate over a wireless network. The network interface 524 may include a radio frequency front end for up-conversion from baseband to radio frequency and down-conversion from radio frequency to baseband. The frequency conversion may be performed by a known process and / or may be performed using a super-heterodyne process. In some examples, the radio frequency front end function may be provided by a separate chip. The network interface may include a wireless function for communicating via LTE, WCDMA, UMTS, GSM, CDMA2000, Bluetooth, Bluetooth LE, Wi-Fi, Z-wave, ZigBee, LoRaWAN, and / or other wireless protocols.

[0138] The vehicle 500 may further include data storage 528, which may include off-chip storage (e.g., outside the SoC 504). The data storage 528 may include one or more storage elements, including RAM, SRAM, DRAM, VRAM, flash memory, hard disk, and / or other components and / or devices that can store at least one bit of data.

[0139] The vehicle 500 may further include a GNSS sensor 558. The GNSS sensor 558 (e.g., GPS, assisted GPS sensor, differential GPS (DGPS) sensor, etc.) is used to assist in mapping, perception, occupancy grid generation, and / or path planning functions. Any number of GNSS sensors 558 may be used, including, for example and without limitation, GPS using a USB connector with an Ethernet to serial (RS-232) bridge.

[0140] The vehicle 500 may further include a RADAR sensor 560. The RADAR sensor 560 may be used by the vehicle 500 for remote vehicle detection even in darkness and / or inclement weather conditions. The RADAR functional safety level may be ASIL B. The RADAR sensor 560 may use CAN and / or bus 502 (e.g., to transmit data generated by the RADAR sensor 560) for control and access to object tracking data, accessing Ethernet in some examples to access raw data. A variety of RADAR sensor types may be used. For example and without limitation, the RADAR sensor 560 may be suitable for front, rear, and side RADAR use. In some examples, a pulse Doppler RADAR sensor is used.

[0141] The RADAR sensor 560 may include different configurations, such as long-range with a narrow field of view, short-range with a wide field of view, short-range side coverage, and the like. In some examples, the long-range RADAR may be used for adaptive cruise control functions. The long-range RADAR system may provide a wide field of view (e.g., within a range of 250m) achieved by two or more independent browsing. The RADAR sensor 560 may help distinguish between static objects and moving objects, and may be used by the ADAS system for emergency braking assistance and forward collision warnings. The long-range RADAR sensor may include a single-station multimode RADAR with multiple (e.g., six or more) fixed RADAR antennas and high-speed CAN and FlexRay interfaces. In an example with six antennas, the central four antennas may create a focused beam pattern designed to record the surroundings of the vehicle 500 at a higher rate with minimal traffic interference from adjacent lanes. The other two antennas may expand the field of view, making it possible to quickly detect vehicles entering or leaving the lane of the vehicle 500.

[0142] As an example, a medium-range RADAR system may include a range of up to 560m (front) or 80m (rear) and a field of view of up to 42 degrees (front) or 550 degrees (rear). A short-range RADAR system may include, but is not limited to, a RADAR sensor designed to be mounted on both ends of a rear bumper. When mounted on both ends of a rear bumper, such a RADAR sensor system may create two beams that continuously monitor the blind spots behind and beside the vehicle.

[0143] Short-range RADAR systems can be used in ADAS systems for blind spot detection and / or lane change assistance.

[0144] The vehicle 500 may further include ultrasonic sensors 562. The ultrasonic sensors 562, which may be placed on the front, rear, and / or sides of the vehicle 500, may be used for parking assistance and / or creating and updating occupancy grids. A variety of ultrasonic sensors 562 may be used, and different ultrasonic sensors 562 may be used for different detection ranges (e.g., 2.5 m, 4 m). The ultrasonic sensors 562 may operate at a functional safety level of ASIL B.

[0145] The vehicle 500 may include a LiDAR sensor 564. The LiDAR sensor 564 may be used for object and pedestrian detection, emergency braking, collision avoidance, and / or other functions. The LiDAR sensor 564 may be ASIL B for functional safety level. In some examples, the vehicle 500 may include multiple LiDAR sensors 564 (e.g., two, four, six, etc.) that may use Ethernet (e.g., to provide data to a Gigabit Ethernet switch).

[0146] In some examples, the LiDAR sensor 564 may be able to provide a list of objects and their distances for a 360-degree field of view. Commercially available LiDAR sensors 564 may have, for example, an advertised range of approximately 500m, an accuracy of 2cm-3cm, and support for 500Mbps Ethernet connections. In some examples, one or more non-protruding LiDAR sensors 564 may be used. In such examples, the LiDAR sensor 564 may be implemented as a small device that can be embedded in the front, back, side, and / or corner of the vehicle 500. In such an example, the LiDAR sensor 564 may provide a field of view of up to 120 degrees horizontally and 35 degrees vertically, with a range of 200m, even for low reflectivity objects. The front-mounted LiDAR sensor 564 may be configured for a horizontal field of view between 45 and 135 degrees.

[0147] In some examples, LiDAR technologies such as 3D flash LIDAR may also be used. 3D flash LiDAR uses a flash of laser as an emission source to illuminate the vehicle's surroundings up to about 200m. The flash LiDAR unit includes a receiver that records the laser pulse transmission time and the reflected light on each pixel, which in turn corresponds to the range from the vehicle to the object. Flash LiDAR can allow highly accurate and distortion-free images of the surrounding environment to be generated with each laser flash. In some examples, four flash LiDAR sensors can be deployed, one on each side of the vehicle 500. Available 3D flash LiDAR systems include solid-state 3D staring array LiDAR cameras (e.g., non-browsing LiDAR devices) with no moving parts other than fans. The flash LiDAR device can use 5 nanosecond Class I (eye-safe) laser pulses per frame, and can capture the reflected laser light in the form of a 3D range point cloud and co-registered intensity data. By using flash LiDAR, and because flash LiDAR is a solid-state device with no moving parts, the LiDAR sensor 564 may be less susceptible to motion blur, vibration, and / or shock.

[0148] The vehicle may further include an IMU sensor 566. In some examples, the IMU sensor 566 may be located at the center of the rear axle of the vehicle 500. The IMU sensor 566 may include, for example and without limitation, an accelerometer, a magnetometer, a gyroscope, a magnetic compass, and / or other sensor types. In some examples, for example, in a six-axis application, the IMU sensor 566 may include an accelerometer and a gyroscope, and in a nine-axis application, the IMU sensor 566 may include an accelerometer, a gyroscope, and a magnetometer.

[0149] In some embodiments, the IMU sensor 566 can be implemented as a miniature high-performance GPS-assisted inertial navigation system (GPS / INS) that combines a micro-electromechanical system (MEMS) inertial sensor, a high-sensitivity GPS receiver, and an advanced Kalman filter algorithm to provide estimates of position, velocity, and attitude. Thus, in some examples, the IMU sensor 566 can enable the vehicle 500 to estimate heading by directly observing and correlating velocity changes from the GPS to the IMU sensor 566 without the need for input from a magnetic sensor. In some examples, the IMU sensor 566 and the GNSS sensor 558 can be combined into a single integrated unit.

[0150] The vehicle may include microphones 596 positioned in and / or around the vehicle 500. The microphones 596 may be used for, among other things, emergency vehicle detection and identification.

[0151] The vehicle may further include any number of camera types, including a stereo camera 568, a wide angle camera 570, an infrared camera 572, a surround camera 574, a long-range and / or mid-range camera 598, and / or other camera types. These cameras may be used to capture image data around the entire periphery of the vehicle 500. The type of camera used depends on the embodiment and the requirements of the vehicle 500, and any combination of camera types may be used to provide the necessary coverage around the vehicle 500. In addition, the number of cameras may vary depending on the embodiment. For example, the vehicle may include six cameras, seven cameras, ten cameras, twelve cameras, and / or another number of cameras. As an example and not limitation, the cameras may support Gigabit Multimedia Serial Link (GMSL) and / or Gigabit Ethernet. Each of the cameras described herein may be described in detail with respect to Figure 5A and Figure 5B Described in more detail.

[0152] The vehicle 500 may further include a vibration sensor 542. The vibration sensor 542 may measure vibrations of components of the vehicle, such as an axle. For example, changes in vibration may indicate changes in the road surface. In another example, when two or more vibration sensors 542 are used, the difference between the vibrations may be used to determine friction or slip of the road surface (e.g., when there is a vibration difference between a powered drive shaft and a free-spinning shaft).

[0153] The vehicle 500 may include an ADAS system 538. In some examples, the ADAS system 538 may include a SoC. The ADAS system 538 may include autonomous / adaptive / automatic cruise control (ACC), cooperative adaptive cruise control (CACC), forward collision warning (FCW), automatic emergency braking (AEB), lane departure warning (LDW), lane keeping assist (LKA), blind spot warning (BSW), rear cross traffic warning (RCTW), collision warning system (CWS), lane centering (LC), and / or other features and functions.

[0154] The ACC system may use a RADAR sensor 560, a LiDAR sensor 564, and / or a camera. The ACC system may include a longitudinal ACC and / or a lateral ACC. The longitudinal ACC monitors and controls the distance to the vehicle immediately in front of the vehicle 500, and automatically adjusts the vehicle speed to maintain a safe distance from the vehicle in front. The lateral ACC performs distance keeping and suggests that the vehicle 500 change lanes when necessary. The lateral ACC is related to other ADAS applications such as LCA and CWS.

[0155] CACC uses information from other vehicles, which can be received from other vehicles indirectly via a wireless link or through a network connection (e.g., through the Internet) via a network interface 524 and / or a wireless antenna 526. A direct link can be provided by a vehicle-to-vehicle (V2V) communication link, while an indirect link can be an infrastructure-to-vehicle (I2V) communication link. Typically, the V2V communication concept provides information about the vehicle immediately ahead (e.g., the vehicle immediately ahead of the vehicle 500 and in the same lane as it), while the I2V communication concept provides information about traffic farther ahead. The CACC system may include either or both of the I2V and V2V information sources. Given information about the vehicle ahead of the vehicle 500, CACC can be more reliable, and it is possible to improve the smoothness of traffic flow and reduce road congestion.

[0156] The FCW system is designed to alert the driver to hazards so that the driver can take corrective action. The FCW system uses a front camera and / or RADAR sensor 560 coupled to a dedicated processor, DSP, FPGA and / or ASIC, which is electrically coupled to driver feedback such as a display, speaker and / or vibrating components. The FCW system can provide warnings in the form of, for example, sound, visual warnings, vibrations and / or rapid brake pulses.

[0157] The AEB system detects an impending front collision with another vehicle or other object and can automatically apply the brakes if the driver does not take corrective action within specified time or distance parameters. The AEB system can use a front camera and / or RADAR sensor 560 coupled to a dedicated processor, DSP, FPGA and / or ASIC. When the AEB system detects a hazard, it typically first alerts the driver to take corrective action to avoid the collision, and if the driver does not take corrective action, the AEB system can automatically apply the brakes in an effort to prevent or at least mitigate the effects of the predicted collision. The AEB system may include technologies such as dynamic brake support and / or collision approach braking.

[0158] The LDW system provides visual, audible, and / or tactile warnings, such as steering wheel or seat vibrations, to alert the driver when the vehicle 500 crosses a lane marking. When the driver indicates an intention to leave the lane, by activating a turn signal, the LDW system is not activated. The LDW system may use a front-facing camera coupled to a dedicated processor, DSP, FPGA, and / or ASIC that is electrically coupled to driver feedback such as a display, speaker, and / or vibrating component.

[0159] The LKA system is a variation of the LDW system. If the vehicle 500 begins to leave the lane, the LKA system provides steering input or braking to correct the vehicle 500.

[0160] The BSW system detects and warns the driver of vehicles in the car's blind spot. The BSW system can provide visual, audible, and / or tactile alerts to indicate that it is unsafe to merge or change lanes. The system can provide additional warnings when the driver uses a turn signal. The BSW system can use a rear-facing camera and / or RADAR sensor 560 coupled to a dedicated processor, DSP, FPGA, and / or ASIC that is electrically coupled to driver feedback such as a display, speaker, and / or vibrating component.

[0161] The RCTW system can provide visual, audible, and / or tactile notifications when an object is detected outside the range of the rear camera while the vehicle 500 is in reverse. Some RCTW systems include AEB to ensure that the vehicle brakes are applied to avoid a crash. The RCTW system can use one or more rear RADAR sensors 560 coupled to a dedicated processor, DSP, FPGA, and / or ASIC that is electrically coupled to driver feedback such as a display, speaker, and / or vibrating component.

[0162] Conventional ADAS systems may be prone to false positive results, which may annoy and distract the driver, but are typically not catastrophic because the ADAS system alerts the driver and allows the driver to decide whether the safety condition actually exists and take action accordingly. However, in the autonomous vehicle 500, in the case of conflicting results, the vehicle 500 itself must decide whether to pay attention to the results from the main computer or the auxiliary computer (e.g., the first controller 536 or the second controller 536). For example, in some embodiments, the ADAS system 538 can be a backup and / or auxiliary computer for providing perception information to the backup computer rationality module. The backup computer rationality monitor can run redundant and diverse software on hardware components to detect faults in perception and dynamic driving tasks. The output from the ADAS system 538 can be provided to the supervisory MCU. If the outputs from the main computer and the auxiliary computer conflict, the supervisory MCU must determine how to coordinate the conflict to ensure safe operation.

[0163] In some examples, the master computer can be configured to provide a confidence score to the supervisory MCU, indicating the master computer's confidence in the selected result. If the confidence score exceeds a threshold, the supervisory MCU can follow the direction of the master computer, regardless of whether the auxiliary computer provides conflicting or inconsistent results. In the case where the confidence score does not meet the threshold and the master computer and the auxiliary computer indicate different results (e.g., conflicts), the supervisory MCU can arbitrate between these computers to determine the appropriate result.

[0164] The supervisory MCU may be configured to run a neural network that is trained and configured to determine conditions under which the auxiliary computer provides a false alarm based on outputs from the primary computer and the auxiliary computer. Thus, the neural network in the supervisory MCU may learn when the output of the auxiliary computer may be trusted and when it may not. For example, when the auxiliary computer is a RADAR-based FCW system, the neural network in the supervisory MCU may learn when the FCW system is identifying a metal object that is not actually dangerous, such as a drainage grate or manhole cover that triggers an alarm. Similarly, when the auxiliary computer is a camera-based LDW system, the neural network in the supervisory MCU may learn to ignore the LDW when a cyclist or pedestrian is present and lane departure is actually the safest strategy. In an embodiment that includes a neural network running on the supervisory MCU, the supervisory MCU may include at least one of a DLA or a GPU suitable for running the neural network with associated memory. In a preferred embodiment, the supervisory MCU may include and / or be included as a component of the SoC 504.

[0165] In other examples, the ADAS system 538 may include an auxiliary computer that uses traditional computer vision rules to perform ADAS functions. In this way, the auxiliary computer can use classic computer vision rules (if-then), and the presence of a neural network in the supervisory MCU can improve reliability, safety, and performance. For example, diverse implementations and intentional non-identity make the entire system more fault-tolerant, especially for failures caused by software (or software-hardware interface) functions. For example, if there is a software vulnerability or error in the software running on the main computer and the non-identical software code running on the auxiliary computer provides the same overall result, the supervisory MCU can be more confident that the overall result is correct and that the vulnerability in the software or hardware on the main computer does not cause a substantial error.

[0166] In some examples, the output of the ADAS system 538 can be fed to the perception block of the main computer and / or the dynamic driving task block of the main computer. For example, if the ADAS system 538 indicates a forward collision warning due to an object immediately ahead, the perception block can use this information in identifying the object. In other examples, the auxiliary computer can have its own neural network that is trained and thus reduces the risk of false positives as described herein.

[0167] The vehicle 500 may further include an infotainment SoC 530 (e.g., an in-vehicle infotainment system (IVI)). Although illustrated and described as an SoC, the infotainment system may not be an SoC and may include two or more discrete components. The infotainment SoC 530 may include a combination of hardware and software that may be used to provide audio (e.g., music, personal digital assistant, navigation instructions, news, radio, etc.), video (e.g., TV, movies, streaming, etc.), phone (e.g., hands-free calling), network connectivity (e.g., LTE, Wi-Fi, etc.), and / or information services (e.g., navigation system, rear parking assistance, radio data system, vehicle-related information such as fuel level, total distance covered, brake fuel level, oil level, door open / closed, air filter information, etc.) to the vehicle 500. For example, the infotainment SoC 530 may include a radio, a disc player, a navigation system, a video player, USB and Bluetooth connectivity, an onboard computer, onboard entertainment, Wi-Fi, steering wheel audio controls, hands-free voice controls, a head-up display (HUD), an HMI display 534, a telematics device, a control panel (e.g., for controlling and / or interacting with various components, features, and / or systems), and / or other components. The infotainment SoC 530 may further be used to provide information (e.g., visual and / or auditory) to a user of the vehicle, such as information from an ADAS system 538, autonomous driving information such as planned vehicle maneuvers, trajectories, surrounding environment information (e.g., intersection information, vehicle information, road information, etc.), and / or other information.

[0168] The infotainment SoC 530 may include GPU functionality. The infotainment SoC 530 may communicate with other devices, systems, and / or components of the vehicle 500 via a bus 502 (e.g., a CAN bus, Ethernet, etc.). In some examples, the infotainment SoC 530 may be coupled to a supervisory MCU so that in the event of a failure of a main controller 536 (e.g., a main and / or backup computer of the vehicle 500), the GPU of the infotainment system may perform some self-driving functions. In such an example, the infotainment SoC 530 may place the vehicle 500 in a driver safety parking mode as described herein.

[0169] The vehicle 500 may further include an instrument cluster 532 (e.g., a digital instrument panel, an electronic instrument cluster, a digital instrument panel, etc.). The instrument cluster 532 may include a controller and / or a supercomputer (e.g., a separate controller or a supercomputer). The instrument cluster 532 may include a set of instruments, such as a speedometer, a fuel level, an oil pressure, a tachometer, an odometer, a turn indicator, a shift position indicator, a seat belt warning light, a parking brake warning light, an engine fault light, an airbag (SRS) system information, lighting controls, safety system controls, navigation information, and the like. In some examples, information may be displayed and / or shared between the infotainment SoC 530 and the instrument cluster 532. In other words, the instrument cluster 532 may be included as part of the infotainment SoC 530, or vice versa.

[0170] Figure 5D For a cloud-based server and Figure 5A 500. System 576 may include a server 578, a network 590, and a vehicle including the vehicle 500. The server 578 may include a plurality of GPUs 584(A)-584(H) (collectively referred to herein as GPUs 584), PCIe switches 582(A)-582(H) (collectively referred to herein as PCIe switches 582), and / or CPUs 580(A)-580(B) (collectively referred to herein as CPUs 580). The GPUs 584, CPUs 580, and PCIe switches may be interconnected with a high-speed interconnect and / or PCIe connection 586 such as, for example and without limitation, an NVLink interface 588 developed by NVIDIA. In some examples, the GPUs 584 are connected via NVLink and / or NVSwitch SoCs, and the GPUs 584 and PCIe switches 582 are connected via PCIe interconnects. Although eight GPUs 584, two CPUs 580, and two PCIe switches are illustrated, this is not intended to be limiting. Depending on the embodiment, each of the servers 578 may include any number of GPUs 584, CPUs 580, and / or PCIe switches. For example, each of the servers 578 may include eight, sixteen, thirty-two, and / or more GPUs 584.

[0171] Server 578 may receive image data over network 590 and from a vehicle, the image data representing images showing unexpected or changed road conditions, such as recently begun road work. Server 578 may transmit neural network 592, updated neural network 592, and / or map information 594, including information about traffic and road conditions, over network 590 and to the vehicle. Updates to map information 594 may include updates to HD map 522, such as information about construction sites, potholes, curves, flooding, or other obstacles. In some examples, neural network 592, updated neural network 592, and / or map information 594 may have been generated from new training and / or data received from any number of vehicles in the environment and / or based on experience from training performed at a data center (e.g., using server 578 and / or other servers).

[0172] Server 578 can be used to train a machine learning model (e.g., a neural network) based on training data. The training data can be generated by the vehicle, and / or can be generated in a simulation (e.g., using a game engine). In some examples, the training data is labeled (e.g., when the neural network benefits from supervised learning) and / or undergoes other preprocessing, while in other examples, the training data is not labeled and / or preprocessed (e.g., when the neural network does not require supervised learning). Training can be performed according to any one or more classes of machine learning techniques, including but not limited to the following classes: supervised training, semi-supervised training, unsupervised training, self-learning, reinforcement learning, joint learning, transfer learning, feature learning (including principal component and cluster analysis), multilinear subspace learning, manifold learning, representation learning (including alternate dictionary learning), rule-based machine learning, anomaly detection, and any variant or combination thereof. Once the machine learning model is trained, the machine learning model can be used by the vehicle (e.g., transmitted to the vehicle via network 590), and / or the machine learning model can be used by server 578 to remotely monitor the vehicle.

[0173] In some examples, server 578 can receive data from the vehicle and apply the data to the latest real-time neural network for real-time intelligent reasoning. Server 578 may include a deep learning supercomputer and / or a dedicated AI computer powered by GPU 584, such as DGX and DGX Station machines developed by NVIDIA. However, in some examples, server 578 may include a deep learning infrastructure of a data center powered only by CPUs.

[0174] The deep learning infrastructure of server 578 may be capable of rapid real-time inference, and may use this capability to assess and verify the health of the processors, software, and / or associated hardware in vehicle 500. For example, the deep learning infrastructure may receive periodic updates from vehicle 500, such as a sequence of images and / or objects located in the sequence of images that vehicle 500 has located (e.g., via computer vision and / or other machine learning object classification techniques). The deep learning infrastructure may run its own neural network to identify objects and compare them to the objects identified by vehicle 500, and if the results do not match and the infrastructure concludes that the AI ​​in vehicle 500 has failed, then server 578 may transmit a signal to vehicle 500 instructing the fail-safe computer of vehicle 500 to take control, notify passengers, and complete a safe parking maneuver.

[0175] For reasoning, the server 578 may include a GPU 584 and one or more programmable reasoning accelerators (e.g., NVIDIA's TensorRT 3). The combination of GPU-powered servers and reasoning acceleration can make real-time responses possible. In other examples, such as when performance is not so important, CPU, FPGA, and other processor-powered servers can be used for reasoning.

[0176] Example computing device

[0177] Figure 6 6 is a block diagram of an example computing device 600 suitable for implementing some embodiments of the present disclosure. The computing device 600 may include an interconnect system 602 that directly or indirectly couples the following devices: a memory 604, one or more central processing units (CPUs) 606, one or more graphics processing units (GPUs) 608, a communication interface 610, an input / output (I / O) port 612, an input / output component 614, a power supply 616, one or more presentation components 618 (e.g., a display), and one or more logic units 620. In at least one embodiment, the computing device 600 may include one or more virtual machines (VMs), and / or any of its components may include virtual components (e.g., virtual hardware components). For non-limiting examples, the one or more GPUs 608 may include one or more vGPUs, the one or more CPUs 606 may include one or more vCPUs, and / or the one or more logic units 620 may include one or more virtual logic units. Thus, computing device 600 may include discrete components (eg, a complete GPU dedicated to computing device 600 ), virtual components (eg, a portion of a GPU dedicated to computing device 600 ), or a combination thereof.

[0178] although Figure 6The various blocks of are shown as being connected via an interconnect system 602 having wires, but this is not intended to be limiting and is merely for clarity. For example, in some embodiments, a presentation component 618 such as a display device may be considered an I / O component 614 (e.g., if the display is a touch screen). As another example, CPU 606 and / or GPU 608 may include memory (e.g., memory 604 may represent a storage device in addition to the memory of GPU 608, CPU 606, and / or other components). In other words, Figure 6 The computing devices described herein are illustrative only. No distinction is made between categories such as "workstations," "servers," "laptops," "desktops," "tablets," "client devices," "mobile devices," "handheld devices," "game consoles," "electronic control units (ECUs)," "virtual reality systems," and / or other device or system types, as all are considered Figure 6 within the range of computing devices.

[0179] The interconnection system 602 may represent one or more links or buses, such as an address bus, a data bus, a control bus, or a combination thereof. The interconnection system 602 may include one or more links or bus types, such as an industry standard architecture (ISA) bus, an extended industry standard architecture (EISA) bus, a video electronics standard association (VESA) bus, a peripheral component interconnect (PCI) bus, a peripheral component interconnect express (PCIe) bus, and / or another type of bus or link. In some embodiments, there is a direct connection between components. As an example, the CPU 606 may be directly connected to the memory 604. In addition, the CPU 606 may be directly connected to the GPU 608. In the case where there is a direct or point-to-point connection between components, the interconnection system 602 may include a PCIe link to perform the connection. In these examples, the PCI bus does not need to be included in the computing device 600.

[0180] Memory 604 may include any of a variety of computer-readable media. Computer-readable media may be any available media that can be accessed by computing device 600. Computer-readable media may include volatile and nonvolatile media and removable and non-removable media. By way of example and not limitation, computer-readable media may include computer storage media and communication media.

[0181] Computer storage media may include volatile and nonvolatile media and / or removable and non-removable media implemented in any method or technology for storing information such as computer-readable instructions, data structures, program modules, and / or other data types. For example, memory 604 may store computer-readable instructions (e.g., representing programs and / or program elements, such as an operating system). Computer storage media may include, but are not limited to, RAM, ROM, EEPROM, flash memory or other storage technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by computing device 600. As used herein, computer storage media does not include the signals themselves.

[0182] Computer storage media may include computer readable instructions, data structures, program modules, and / or other data types in a modulated data signal such as a carrier wave or other transmission mechanism, and include any information delivery media. The term "modulated data signal" may refer to a signal that has one or more of its characteristics set or changed in such a way that information is encoded into the signal. By way of example and not limitation, computer storage media may include wired media such as a wired network or a direct wired connection, and wireless media such as sound, RF, infrared, and other wireless media. Any combination of the above should also be included within the scope of computer readable media.

[0183] The CPU 606 may be configured to execute at least some of the computer-readable instructions so as to control one or more components of the computing device 600 to perform one or more of the methods and / or processes described herein. Each of the CPUs 606 may include one or more cores (e.g., one, two, four, eight, twenty-eight, seventy-two, etc.) capable of simultaneously processing a large number of software threads. The CPU 606 may include any type of processor, and may include different types of processors, depending on the type of computing device 600 implemented (e.g., a processor with fewer cores for mobile devices and a processor with more cores for servers). For example, depending on the type of computing device 600, the processor may be an Advanced RISC Mechanism (ARM) processor implemented using Reduced Instruction Set Computing (RISC) or an x86 processor implemented using Complex Instruction Set Computing (CISC). The computing device 600 may also include one or more CPUs 606 in addition to one or more microprocessors or supplementary coprocessors such as math coprocessors.

[0184] In addition to or in place of the CPU 606, the GPU 608 may also be configured to execute at least some computer-readable instructions to control one or more components of the computing device 600 to perform one or more methods and / or processes described herein. One or more GPUs 608 may be integrated GPUs (e.g., with one or more CPUs 606) and / or one or more GPUs 608 may be discrete GPUs. In an embodiment, one or more GPUs 608 may be coprocessors of one or more CPUs 606. The computing device 600 may use the GPU 608 to render graphics (e.g., 3D graphics) or perform general-purpose computing. For example, the GPU 608 may be used for general-purpose computing on the GPU (GPGPU). The GPU 608 may include hundreds or thousands of cores capable of processing hundreds or thousands of software threads simultaneously. The GPU 608 may generate pixel data for outputting an image in response to a rendering command (e.g., a rendering command from the CPU 606 received via a host interface). The GPU 608 may include a graphics memory such as a display memory for storing pixel data or any other suitable data (e.g., GPGPU data). Display memory may be included as part of memory 604. GPU 608 may include two or more GPUs operating in parallel (e.g., via a link). The link may connect the GPUs directly (e.g., using NVLINK) or through a switch (e.g., using NVSwitch). When combined together, each GPU 608 may generate pixel data or GPGPU data for different portions of output or for different outputs (e.g., a first GPU for a first image and a second GPU for a second image). Each GPU may include its own memory or may share memory with other GPUs.

[0185] In addition to or in lieu of the CPU 606 and / or GPU 608, the logic unit 620 may be configured to execute at least some computer-readable instructions to control one or more components of the computing device 600 to perform one or more methods and / or processes described herein. In an embodiment, the CPU 606, the GPU 608, and / or the logic unit 620 may discretely or jointly perform any combination of methods, processes, and / or portions thereof. The one or more logic units 620 may be a part of and / or integrated into the one or more CPUs 606 and / or the one or more GPUs 608, and / or the one or more logic units 620 may be discrete components of the CPU 606 and / or the GPU 608 or otherwise external thereto. In an embodiment, the one or more logic units 620 may be a processor of the one or more CPUs 606 and / or the one or more GPUs 608.

[0186] Examples of logic unit 620 include one or more processing cores and / or components thereof, such as a data processing unit (DPU), a tensor core (TC), a tensor processing unit (TPU), a pixel vision core (PVC), a vision processing unit (VPU), a graphics processing cluster (GPC), a texture processing cluster (TPC), a streaming multiprocessor (SM), a tree traversal unit (TTU), an artificial intelligence accelerator (AIA), a deep learning accelerator (DLA), an arithmetic logic unit (ALU), an application specific integrated circuit (ASIC), a floating point unit (FPU), an input / output (I / O) element, a peripheral component interconnect (PCI) or a peripheral component interconnect express (PCIe) element, etc.

[0187] In various embodiments, one or more CPUs 606, GPUs 608, and / or logic units 620 are configured to execute one or more instances of processing engine 122 and / or analysis engine 124. Statistics 210 and 212, aggregate statistics 222, posterior probabilities 224, and / or metrics 226 generated by processing engine 122 and / or analysis engine 124 may then be used to monitor the performance of the various sensors and perform additional processing based on the performance of the sensors.

[0188] The communication interface 610 may include one or more receivers, transmitters, and / or transceivers that enable the computing device 600 to communicate with other computing devices via an electronic communication network, including wired and / or wireless communications. The communication interface 610 may include components and functions that enable communication over any of a number of different networks, such as wireless networks (e.g., Wi-Fi, Z-wave, Bluetooth, Bluetooth LE, ZigBee, etc.), wired networks (e.g., communicating over Ethernet or InfiniBand), low power wide area networks (e.g., LoRaWAN, SigFox, etc.), and / or the Internet. In one or more embodiments, the one or more logic units 620 and / or the communication interface 610 may include one or more data processing units (DPUs) for transmitting data received over the network and / or interconnect system 602 directly to one or more GPUs 608 (e.g., memory of GPUs 608).

[0189] The I / O port 612 can enable the computing device 600 to be logically coupled to other devices including I / O components 614, presentation components 618, and / or other components, some of which can be built into (e.g., integrated into) the computing device 600. Illustrative I / O components 614 include microphones, mice, keyboards, joysticks, game pads, game controllers, satellite dishes, browsers, printers, wireless devices, and the like. The I / O components 614 can provide a natural user interface (NUI) that processes air gestures, voice, or other physiological inputs generated by the user. In some instances, the input can be transmitted to an appropriate network element for further processing. The NUI can implement any combination of voice recognition, stylus recognition, facial recognition, biometric recognition, gesture recognition on and adjacent to the screen, air gestures, head and eye tracking, and touch recognition associated with the display of the computing device 600 (as described in more detail below). The computing device 600 may include a depth camera such as a stereo camera system, an infrared camera system, an RGB camera system, touch screen technology, and a combination of these for gesture detection and recognition. Additionally, computing device 600 may include an accelerometer or gyroscope to enable motion detection (e.g., as part of an inertial measurement unit (IMU)). In some examples, the output of the accelerometer or gyroscope may be used by computing device 600 to render immersive augmented reality or virtual reality.

[0190] The power supply 616 may include a hardwired power supply, a battery power supply, or a combination thereof. The power supply 616 may provide power to the computing device 600 to enable the components of the computing device 600 to operate.

[0191] The presentation component 618 may include a display (e.g., a monitor, a touch screen, a television screen, a head-up display (HUD), other display types, or a combination thereof), a speaker, and / or other presentation components. The presentation component 618 may receive data from other components (e.g., GPU 608, CPU 606, DPU, etc.) and output the data (e.g., as an image, video, sound, etc.).

[0192] Sample Data Center

[0193] Figure 7 An example data center 700 is shown, which may be used in at least one embodiment of the present disclosure. The data center 700 may include a data center infrastructure layer 710, a framework layer 720, a software layer 730, and an application layer 740.

[0194] like Figure 7As shown, the data center infrastructure layer 710 may include a resource coordinator 712, grouped computing resources 714, and node computing resources ("node CRs") 716(1)-716(N), where "N" represents any complete positive integer. In at least one embodiment, the node CRs 716(1)-716(N) may include, but are not limited to, any number of central processing units ("CPUs") or other processors (including DPUs, accelerators, field programmable gate arrays (FPGAs), graphics processors or graphics processing units (GPUs), etc.), memory devices (e.g., dynamic read-only memories), storage devices (e.g., solid-state drives or disk drives), network input / output ("NW I / O") devices, network switches, virtual machines ("VMs"), power modules and cooling modules, etc. In some embodiments, one or more of the node CRs 716(1)-716(N) may correspond to a server having one or more of the above computing resources. Furthermore, in some embodiments, nodes CR 716 ( 1 )- 716 (N) may include one or more virtual components, such as vGPU, vCPU, etc., and / or one or more of nodes CR 716 ( 1 )- 716 (N) may correspond to a virtual machine (VM).

[0195] In at least one embodiment, the computing resources 714 of the grouping can include a separate grouping (not shown) of the node CR716 contained in one or more racks, or a lot of racks (not shown) contained in the data center of each geographical location. The separate grouping of the node CR716 in the computing resources 714 of the grouping can include the computing, network, memory or storage resources that can be configured or assigned to support the grouping of one or more workloads. In at least one embodiment, several node CR716 including CPU, GPU, DPU and / or other processors can be grouped in one or more racks to provide computing resources to support one or more workloads. One or more racks can also include any number of power modules, cooling modules and / or network switches in any combination.

[0196] Resource coordinator 712 may configure or otherwise control one or more nodes CR 716(1)-716(N) and / or grouped computing resources 714. In at least one embodiment, resource coordinator 712 may include a software design infrastructure ("SDI") management entity for data center 700. Resource coordinator 712 may include hardware, software, or some combination thereof.

[0197] In at least one embodiment, Figure 7As shown, the framework layer 720 may include a job scheduler 733, a configuration manager 734, a resource manager 736, and a distributed file system 738. The framework layer 720 may include a framework that supports the software 732 of the software layer 730 and / or one or more applications 742 of the application layer 740. The software 732 or the application 742 may include web-based service software or applications, such as those provided by Amazon Web Services, Google Cloud, and Microsoft Azure. The framework layer 720 may be, but is not limited to, a free and open source software network application framework, such as Apache Spark, which may utilize the distributed file system 738 for large-scale data processing (e.g., "big data"). TM (hereinafter referred to as "Spark"). In at least one embodiment, the job scheduler 733 may include a Spark driver to facilitate scheduling of workloads supported by various layers of the data center 700. In at least one embodiment, the configuration manager 734 may be able to configure different layers, such as the software layer 730 and the framework layer 720 including Spark and a distributed file system 738 for supporting large-scale data processing. The resource manager 736 can manage cluster or group computing resources mapped to or allocated to support the distributed file system 738 and the job scheduler 733. In at least one embodiment, the cluster or group computing resources may include grouped computing resources 714 at the data center infrastructure layer 710. The resource manager 736 can coordinate with the resource coordinator 712 to manage these mapped or allocated computing resources.

[0198] In at least one embodiment, software 732 included in software layer 730 may include software used by at least a portion of node CRs 716(1)-716(N), grouped computing resources 714, and / or distributed file system 738 of framework layer 720. One or more types of software may include, but are not limited to, Internet web page search software, email virus scanning software, database software, and streaming video content software.

[0199] In at least one embodiment, one or more applications 742 included in the application layer 740 may include one or more types of applications used by at least a portion of the node CRs 716(1)-716(N), the grouped computing resources 714, and / or the distributed file system 738 of the framework layer 720. The one or more types of applications may include, but are not limited to, any number of genomics applications, cognitive computing, and machine learning applications, including training or inference software, machine learning framework software (e.g., PyTorch, TensorFlow, Caffe, etc.), and / or other machine learning applications used in conjunction with one or more embodiments.

[0200] In at least one embodiment, any of the configuration manager 734, resource manager 736, and resource coordinator 712 can implement any number and type of self-modification actions based on any number and type of data acquired in any technically feasible manner. The self-modification actions can relieve the data center operator of the data center 700 from making potentially bad configuration decisions and can avoid underutilized and / or underperforming portions of the data center.

[0201] The data center 700 may include tools, services, software, or other resources for training one or more machine learning models or using one or more machine learning models to predict or infer information according to one or more embodiments described herein. For example, a machine learning model may be trained by calculating weight parameters according to a neural network architecture using the software and computing resources described above with respect to the data center 700. In at least one embodiment, by using weight parameters calculated by one or more training techniques, the resources described above with respect to the data center 700 may be used to infer or predict information using a trained machine learning model corresponding to one or more neural networks, such as but not limited to those described herein.

[0202] In at least one embodiment, the data center 700 can use a CPU, an application-specific integrated circuit (ASIC), a GPU, an FPGA, and / or other hardware (or virtual computing resources corresponding thereto) to use the above resources to perform training and / or reasoning. In addition, one or more of the above software and / or hardware resources can be configured as a service to allow users to train or perform information reasoning, such as image recognition, speech recognition, or other artificial intelligence services.

[0203] Example network environment

[0204] A network environment suitable for implementing embodiments of the present disclosure may include one or more client devices, servers, network attached storage (NAS), other backend devices, and / or other device types. The client devices, servers, and / or other device types (e.g., each device) may be configured to communicate with the client device, server, or other device types. Figure 6 The backend device 700 may be implemented on one or more instances of the computing device 600 of the embodiment of the present invention—for example, each device may include similar components, features and / or functions of the computing device 600. In addition, in the case of implementing a backend device (e.g., a server, NAS, etc.), the backend device may be included as part of the data center 700, an example of which is described herein with respect to Figure 7 Describe in more detail.

[0205] The components of the network environment can communicate with each other through the network, which can be wired, wireless, or both. The network can include multiple networks, or a network of multiple networks. For example, the network can include one or more wide area networks (WANs), one or more local area networks (LANs), one or more public networks (such as the Internet and / or the Public Switched Telephone Network (PSTN)), and / or one or more private networks. In the case where the network includes a wireless telecommunications network, components such as base stations, communication towers, or even access points (and other components) can provide wireless connections.

[0206] Compatible network environments may include one or more peer-to-peer network environments (in which case the server may not be included in the network environment), and one or more client-server network environments (in which case one or more servers may be included in the network environment). In a peer-to-peer network environment, the functionality described herein with respect to the server may be implemented on any number of client devices.

[0207] In at least one embodiment, the network environment may include one or more cloud-based network environments, distributed computing environments, combinations thereof, and the like. A cloud-based network environment may include a framework layer, a job scheduler, a resource manager, and a distributed file system implemented on one or more servers, which may include one or more core network servers and / or edge servers. The framework layer may include a framework for supporting software at the software layer and / or one or more applications at the application layer. The software or application may include network-based service software or application programs, respectively. In an embodiment, one or more client devices may use network-based service software or application programs (e.g., by accessing the service software and / or application programs via one or more application programming interfaces (APIs)). The framework layer may be, but is not limited to, a type of free and open source software network application framework, such as a distributed file system that may be used for large-scale data processing (e.g., "big data").

[0208] A cloud-based network environment can provide cloud computing and / or cloud storage that performs any combination of the computing and / or data storage functions (or one or more portions thereof) described herein. Any of these various functions can be distributed across multiple locations from a central or core server (e.g., one or more data centers that can be distributed across states, regions, countries, the world, etc.). If the connection to a user (e.g., a client device) is relatively close to an edge server, the core server can assign at least a portion of the functionality to the edge server. A cloud-based network environment can be private (e.g., limited to a single organization), public (e.g., available to many organizations), and / or a combination thereof (e.g., a hybrid cloud environment).

[0209] The client device may include Figure 6 At least some of the components, features, and functionality of the described example computing device 600. By way of example and not limitation, the client device may be embodied as a personal computer (PC), a laptop computer, a mobile device, a smartphone, a tablet computer, a smart watch, a wearable computer, a personal digital assistant (PDA), an MP3 player, a virtual reality head mounted display, a global positioning system (GPS) or device, a video player, a camera, a surveillance device or system, a vehicle, a vessel, an aircraft, a virtual machine, a drone, a robot, a handheld communication device, a hospital device, a gaming device or system, an entertainment system, an in-vehicle computer system, an embedded system controller, a remote control, an appliance, a consumer electronic device, a workstation, an edge device, any combination of these described devices, or any other suitable device.

[0210] In summary, the technology of the present disclosure relates to a real-time security solution for protecting controller area network (CAN) messages in a vehicle. The technology described herein includes: receiving a message from an application to be transmitted over a CAN bus by a cryptographic engine implemented on an electronic control unit (ECU). The technology also includes: accessing one or more keys from a secure memory associated with the cryptographic engine and calculating an authentication tag using the one or more keys. The technology also includes: transmitting the message along with the authentication tag to a destination address over the CAN bus, wherein the authentication tag is used to confirm that a portion of the message has not changed during transmission.

[0211] In order to prioritize performance-critical workloads, the secure firmware executed on the cryptographic engine receives workloads from software queues with multiple different priority levels, such as a high priority queue and a low priority queue in the case of two software queues. The application is responsible for assigning their respective workloads to the appropriate queues before initiating the cryptographic authentication tag calculation. The secure firmware then processes the queues in a prioritized manner starting from the high priority queue and moving to the low priority queues in sequence, thereby ensuring efficient and timely execution of critical tasks. In order to avoid the workload of the low priority queue blocking the high priority work, the secure firmware adopts a quantization technique that divides low priority messages above a certain threshold size into smaller fixed-size quantum operations or smaller message packets. After operating on each discrete message packet associated with the low priority work, the firmware is configured to perform a check to determine whether there is a higher priority workload to be processed. If there is a high priority work, the high priority work is completed before returning to the previous operation associated with the next discrete message packet associated with the low priority work. This limits the amount of time the firmware spends operating on low priority requests and avoids interference with high priority requests.

[0212] Compared to previous solutions, one technical advantage of the technology disclosed in the present invention is the ability to ensure the security of communications on a CAN bus network without requiring dedicated hardware or the need to rewire or change the CAN bus protocol in any way. Therefore, the technology disclosed in the present invention takes up fewer resources than existing secure communication methods. Another technical advantage of the technology disclosed in the present invention is the ability to ensure the security of high-priority messages and transmit high-priority messages before relatively low-priority messages, which allows messages associated with safety-critical applications to be processed with priority over other messages. Therefore, the technology disclosed in the present invention is able to intelligently classify between different types of messages. Another technical advantage of the technology disclosed in the present invention is the ability to enhance security by using a dedicated security processor and associated memory for managing keys and calculating authentication tags. Such a dedicated processor and memory ensure robust security measures, thereby effectively protecting the CAN messaging network from potential hijacking or unauthorized access.

[0213] 1. According to some embodiments, a method includes: receiving a message from an application to be transmitted via a CAN (Controller Area Network) bus using a cryptographic engine, the cryptographic engine being implemented on a discrete processor on a die and executing secure firmware; using the secure firmware to access a key from a plurality of keys associated with an authentication process from a secure memory associated with the cryptographic engine; calculating an authentication tag using the key and the message; and transmitting the message together with the authentication tag to a destination address via the CAN bus.

[0214] 2. The method of clause 1, wherein the secure memory comprises on-die SRAM.

[0215] 3. The method of clauses 1-2, wherein the on-die SRAM and the on-die discrete processor are part of a system on a chip (SOC) implemented on an electronic control unit (ECU), the ECU being configured to perform specific functions within a vehicle.

[0216] 4. The method of clauses 1-3, wherein the plurality of keys associated with the authentication process are stored in a linear array in the secure memory.

[0217] 5. The method as described in clauses 1-4 further includes: accessing a high priority queue to determine whether one or more high priority messages are available for transmission; and in response to determining that the one or more high priority messages are available for transmission, accessing the messages from the high priority queue.

[0218] 6. The method described in clauses 1-5 further includes: accessing a high priority queue to determine whether one or more high priority messages are available for transmission; and, in response to determining that there are no high priority messages available in the high priority queue, accessing a low priority queue to determine whether one or more low priority messages are available for transmission; and in response to determining that one or more low priority messages are available for transmission, accessing the messages from the low priority queue.

[0219] 7. A method as described in clauses 1-6, wherein accessing the messages from the low priority queue includes: accessing the messages in discrete groups, wherein the authentication tags are calculated at least in part by separately calculating corresponding authentication tags for individual discrete groups in separate time intervals, and wherein the corresponding individual authentication tags are calculated after determining that no high priority messages are available for processing in the high priority queue.

[0220] 8. The method of clauses 1-7, wherein the cryptographic engine comprises one or more hardware accelerators for computing the authentication tag.

[0221] 9. According to some embodiments, a processor comprises: one or more processing units for performing operations including: receiving a message and a first authentication tag via a CAN (Controller Area Network) bus using a cryptographic engine; accessing a key from a plurality of keys associated with an authentication process from a memory associated with the cryptographic engine; calculating a second authentication tag using the key and the message; and authenticating the message in response to determining that the first authentication tag is equivalent to the second authentication tag.

[0222] 10. The processor of clause 9, wherein the key is accessed from an on-die memory.

[0223] 11. A processor as described in clauses 9-10, wherein the on-die memory includes SRAM and the one or more processing units include one or more on-die discrete processing units, and further wherein the SRAM and the one or more on-die discrete processing units are part of a system on a chip (SOC) implemented on an electronic control unit (ECU), the ECU being configured to perform specific functions within a vehicle.

[0224] 12. The processor of clauses 9-11, wherein the plurality of keys associated with the authentication process are stored in a linear array in the memory.

[0225] 13. The processor of clauses 9-12, wherein the one or more processing units include dedicated boot software for loading the secure firmware upon initialization.

[0226] 14. A processor as described in clauses 9-13, wherein the processor is included in at least one of the following: a control system for an autonomous or semi-autonomous machine; a perception system for an autonomous or semi-autonomous machine; a system for performing simulation operations; a system for performing digital twin operations; a system for performing light transport simulation; a system for performing 3D asset collaborative content creation; a system for performing deep learning operations; a system implemented using an edge device; a system for generating or presenting at least one of virtual reality content, augmented reality content, or mixed reality content; a system implemented using a robot; a system for performing conversational AI operations; a system implementing one or more language models; a system for generating synthetic data; a system comprising one or more virtual machines (VMs); a system implemented at least in part in a data center; or a system implemented at least in part using cloud computing resources.

[0227] 15. According to some embodiments, a system comprises: one or more processing units for performing the following operations: receiving a message associated with a transmission through a controller area network (CAN) bus using a cryptographic engine; accessing a key from a plurality of keys associated with an authentication process from a secure memory associated with the cryptographic engine; and calculating an authentication tag using the key and the message.

[0228] 16. The system of clause 15, further comprising: comparing the authentication tag to an authentication tag previously received from a sending ECU; and authenticating the message in response to determining that the authentication tag is identical to the authentication tag previously received.

[0229] 17. The system of clauses 15-16, further comprising: transmitting the message together with the authentication tag to a destination address via the CAN bus.

[0230] 18. The system of clauses 15-17, wherein the authentication process is selected from the group consisting of HMAC (Hash-based MAC), KMAC (Keccak-based MAC), and CMAC (Ciphertext-based MAC).

[0231] 19. A system as described in clauses 15-18, wherein receiving the message includes: determining whether a high priority queue contains one or more messages to be authenticated; and one of the following: when the high priority queue contains one or more messages, accessing the message from the high priority queue; or when the high priority queue does not contain one or more messages to be authenticated, accessing the message from the low priority queue.

[0232] 20. A system as described in clauses 15-19, wherein the system is included in at least one of the following: a control system for an autonomous or semi-autonomous machine; a perception system for an autonomous or semi-autonomous machine; a system for performing simulation operations; a system for performing digital twin operations; a system for performing light transport simulation; a system for performing 3D asset collaborative content creation; a system for performing deep learning operations; a system implemented using an edge device; a system for generating or presenting at least one of virtual reality content, augmented reality content, or mixed reality content; a system implemented using a robot; a system for performing conversational AI operations; a system implementing one or more language models; a system for generating synthetic data; a system comprising one or more virtual machines (VMs); a system implemented at least in part in a data center; or a system implemented at least in part using cloud computing resources.

[0233] The present disclosure may be described in the general context of machine-usable instructions or computer codes executed by a computer or other machine such as a personal digital assistant or other handheld device, including computer-executable instructions such as program modules. Typically, program modules including routines, programs, objects, components, data structures, etc. refer to codes that perform specific tasks or implement specific abstract data types. The present disclosure may be practiced in a variety of system configurations, including handheld devices, consumer electronics, general-purpose computers, more specialized computing devices, etc. The present disclosure may also be practiced in a distributed computing environment in which tasks are performed by remote processing devices linked through a communication network.

[0234] As used herein, the description of "and / or" about two or more elements should be interpreted as referring to only one element or a combination of elements. For example, "element A, element B and / or element C" may include only element A, only element B, only element C, element A and element B, element A and element C, element B and element C, or elements A, B and C. In addition, "at least one of element A or element B" may include at least one of element A, at least one of element B, or at least one of element A and at least one of element B. Further, "at least one of element A and element B" may include at least one of element A, at least one of element B, or at least one of element A and at least one of element B.

[0235] The subject matter of the present disclosure is described in detail herein to meet statutory requirements. However, the description itself is not intended to limit the scope of the present disclosure. On the contrary, the inventors have contemplated that the claimed subject matter may also be embodied in other ways to include steps different from the steps described herein in conjunction with other current or future technologies or combinations of similar steps. Moreover, although the terms "step" and / or "block" may be used herein to imply different elements of the method employed, these terms should not be interpreted as implying any particular order among or between the various steps disclosed herein, unless the order of the steps is explicitly described.

Claims

1. A method comprising: receiving a message from an application to be transmitted over a controller area network (CAN) bus using a cryptographic engine implemented on a discrete processor on the die and executing secure firmware; accessing, using the secure firmware, from a secure memory associated with the cryptographic engine, a key from a plurality of keys associated with an authentication process; calculating an authentication tag using the key and the message; as well as The message together with the authentication tag is transmitted to a destination address via the CAN bus.

2. The method of claim 1, wherein the secure memory comprises on-die SRAM.

3. The method of claim 2, wherein the on-die SRAM and the on-die discrete processor are part of a system on chip (SOC) implemented on an electronic control unit (ECU), the ECU being configured to perform a specific function within a vehicle.

4. The method of claim 1, wherein the plurality of keys associated with the authentication process are stored in a linear array in the secure memory.

5. The method of claim 1, further comprising: accessing the high priority queue to determine whether one or more high priority messages are available for transmission; as well as In response to determining that the one or more high priority messages are available for transmission, accessing the messages from the high priority queue.

6. The method of claim 1, further comprising: accessing the high priority queue to determine whether one or more high priority messages are available for transmission; In response to determining that no high priority messages are available in the high priority queue, accessing the low priority queue to determine whether one or more low priority messages are available for transmission; as well as In response to determining that one or more low priority messages are available for transmission, the messages are accessed from the low priority queue.

7. The method of claim 6, wherein accessing the message from the low priority queue comprises: Accessing the messages in discrete groups, wherein the authentication tags are calculated at least in part by separately calculating corresponding authentication tags for individual discrete groups in separate time intervals, wherein the corresponding individual authentication tags are calculated after determining that no high priority messages are available for processing in the high priority queue.

8. The method of claim 1, wherein the cryptographic engine comprises one or more hardware accelerators for computing the authentication tag.

9. A processor, comprising: One or more processing units for performing operations including: receiving a message and a first authentication tag via a controller area network (CAN) bus using a cryptographic engine; accessing, from a memory associated with the cryptographic engine, a key from a plurality of keys associated with an authentication process; calculating a second authentication tag using the key and the message; as well as In response to determining that the first authentication tag is equal to the second authentication tag, the message is authenticated.

10. The processor of claim 9, wherein the key is accessed from an on-die memory.

11. The processor of claim 10, wherein the on-die memory comprises SRAM and the one or more processing units comprise one or more on-die discrete processing units, and further wherein, The SRAM and the one or more on-die discrete processing units are part of a system on chip (SOC) implemented on an electronic control unit (ECU) configured to perform specific functions within a vehicle.

12. The processor of claim 9, wherein the plurality of keys associated with the authentication process are stored in a linear array in the memory.

13. The processor of claim 9, wherein the one or more processing units include dedicated boot software for loading the secure firmware upon initialization.

14. The processor of claim 9, wherein the processor is included in at least one of: control systems for autonomous or semi-autonomous machines; Perception systems for autonomous or semi-autonomous machines; A system for performing simulation operations; Systems for performing digital twin operations; A system for performing light transport simulations; A system for performing collaborative content creation of 3D assets; Systems for performing deep learning operations; Systems implemented using edge devices; A system for generating or presenting at least one of virtual reality content, augmented reality content, or mixed reality content; Systems implemented using robots; Systems for performing conversational AI operations; A system implementing one or more language models; Systems for generating synthetic data; A system comprising one or more virtual machines VM; A system implemented at least in part in a data center; or A system implemented at least in part using cloud computing resources.

15. A system comprising: One or more processing units for performing operations of: receiving, using a cryptographic engine, a message associated with a transmission over a controller area network (CAN) bus; accessing, from a secure memory associated with the cryptographic engine, a key from a plurality of keys associated with an authentication process; as well as An authentication tag is calculated using the secret key and the message.

16. The system of claim 15, further comprising: comparing the authentication tag to an authentication tag previously received from a sending ECU; as well as In response to determining that the authentication tag is identical to the previously received authentication tag, the message is authenticated.

17. The system of claim 15, further comprising: The message together with the authentication tag is transmitted to a destination address via the CAN bus.

18. The system of claim 15, wherein the authentication process is selected from the group consisting of a hash-based MAC (HMAC), a Keccak-based MAC (KMAC), and a ciphertext-based MAC (CMAC).

19. The system of claim 15, wherein receiving the message comprises: determining whether the high priority queue contains one or more messages to be authenticated; as well as One of the following: When the high priority queue contains one or more messages, accessing the message from the high priority queue; or When the high priority queue does not contain one or more messages to be authenticated, accessing the messages from the low priority queue.

20. The system of claim 15, wherein the system is included in at least one of: control systems for autonomous or semi-autonomous machines; Perception systems for autonomous or semi-autonomous machines; A system for performing simulation operations; Systems for performing digital twin operations; A system for performing light transport simulations; A system for performing collaborative content creation of 3D assets; Systems for performing deep learning operations; Systems implemented using edge devices; A system for generating or presenting at least one of virtual reality content, augmented reality content, or mixed reality content; Systems implemented using robots; Systems for performing conversational AI operations; A system implementing one or more language models; Systems for generating synthetic data; A system comprising one or more virtual machines VM; A system implemented at least in part in a data center; or A system implemented at least in part using cloud computing resources.

Images