Controller Level 2 layer function safety monitoring design integrated with information safety

Abstract

The invention discloses a controller Level 2 layer function safety monitoring design fused with information safety, and the design comprises the steps: dividing a complete task into a plurality of function modules, and enabling a Level 1 and a Level 2 to run in different cores; plaintext data is directly used as input in the Level1 layer, plaintext and MAC are used as input in the Level2 layer, and due to time delay caused by message authentication of the Level2 layer, asynchronism exists when the Level1 and the Level2 execute the same function program; a timing mechanism is introduced when the HSM module is used for carrying out message authentication, so that the problem of stagnation of the HSM is prevented; in addition, a shared storage area is established to store an intermediate result executed by the Level1 layer function module; and the safety state of the system is recovered when a fault occurs by recording a system log. The problem of common cause failure is solved, it can be ensured that the message comes from a correct sender and is not tampered halfway, and the time delay problem caused by stagnation of the HSM is prevented.

Description

Technical Field

[0001] The present invention relates to the technical field of controller EGAS monitoring architecture, and in particular to a controller Level 2 functional safety monitoring design integrating information security. Background Art

[0002] Failures of electronic and electrical systems include both systematic failures caused by software and hardware design errors and failures caused by random hardware failures. According to the system architecture, various safety mechanisms need to be designed to prevent and detect functional failures, and to avoid or reduce the occurrence of hazards when failures occur. This requires a strong functional safety software architecture to manage and control these safety mechanisms and reduce the overall difficulty of functional safety development. At present, EGAS is the most widely used safety architecture solution. Among them, the design of Level 1 and Level 2 is crucial.

[0003] In the current design, in order to maintain the independence of Level 1 and Level 2 and avoid common cause failure, redundant operations are often used. For example, two non-homogeneous redundant sensors are designed to realize information collection and processing, or redundant software logic is used to monitor the basic functions of Level 1. However, these designs do not take into account the asynchronous execution of Level 1 and Level 2 programs. When faced with transient electromagnetic interference, short-term power supply fluctuations, etc., these redundant designs may fail at the same time, resulting in erroneous data collection or control commands. In addition, in terms of data transmission security, usually in the design process of Level 1 and Level 2, it is not considered whether the data transmitted from other controllers is maliciously destroyed. Although some information security means can be used, such as message authentication mechanism to verify the integrity of data, directly using message authentication mechanism for input data will cause the Level 1 layer to involve authentication operations, increase time consumption, and affect real-time performance. Moreover, when performing message authentication, the HSM module may stagnate. Summary of the invention

[0004] The purpose of the present invention is to provide a controller Level 2 functional safety monitoring design integrating information security, which can solve the technical problems mentioned in the background technology.

[0005] The terms involved in the present invention are explained as follows: EGAS: The EGAS three-layer monitoring concept was jointly proposed by several German automobile OEMs, and corresponding guidance documents were formulated. This monitoring concept was initially abstracted from the engine control system. It divides the engine control system into three levels: Level 1 functional layer, Level 2 functional monitoring layer and Level 3 controller monitoring layer.

[0006] HSM: Hardware Security Module (HSM) is a computer device used to protect and manage keys and sensitive data used by strong authentication systems and provide related cryptographic operations.

[0007] MAC: Message Authentication Code (MAC) is a small piece of information generated by a specific algorithm to ensure that the message comes from the correct sender and has not been tampered with in the middle.

[0008] A controller Level 2 functional safety monitoring design integrating information security is proposed. A complete task is divided into multiple functional modules, and Level 1 and Level 2 are run in different cores. Plain text data is directly used as input in Level 1, and plain text plus MAC is used as input in Level 2. Due to the delay caused by Level 2 message authentication, Level 1 and Level 2 are asynchronous when executing the same functional program. In addition, a shared storage area is established to store the intermediate results of the execution of the Level 1 functional module to reduce the communication delay between core0 and core1. The system log is recorded to restore the system to a safe state when a failure occurs.

[0009] As a further technical solution of the present invention, the initialization of the system includes the following steps: Step 1.1: When the system is initialized, the task is divided into four functional modules, including function A, B, C and D modules; Step 1.2: Create a shared memory area and initialize blocks for each functional module for use by core0 and core1; Step 1.3: The system initializes and starts the logging mechanism at the same time. The system log records contain the status, intermediate results and key information of core0 and core1 during the execution of each functional module, providing support for status rollback.

[0010] As a further technical solution of the present invention, the core0 execution process includes: Step 2.1: Transmit the communication data from other controllers to core0 in plain text as the input signal of Level 1 layer; Step 2.2: Level 1 starts to execute the function A module in the task; Step 2.2.1: After the program execution of function A module is completed, core0 stores the intermediate results of function A module into the corresponding block of the shared memory area; Step 2.2.2: Update the system log to record the status at this moment; Step 2.3: The same as the execution steps of function A module, execute function B, C and D modules in sequence, store the intermediate results in the shared storage area after each function module is completed, and update the system log; Step 2.4: The task is completed and core0 will continue to execute the next task.

[0011] As a further technical solution of the present invention, the core1 execution process includes: Step 3.1: core1 is used for Level2 layer. First, it receives data in the form of plain text plus MAC as input of Level2 layer; Step 3.2: Then, the Level2 layer authenticates the input data with the help of the HSM module, and core1 sends a message authentication request to the HSM core through an interrupt; Step 3.3: At the same time, core1 starts the timer; Step 3.4: The HSM core responds to the interrupt according to its own status. If the HSM core has no task to process at this time, it will give feedback to core1 through the interrupt response; Step 3.5: After core1 receives the interrupt response, it sends the data to be processed to the HSM core; Step 3.6: The HSM core performs integrity check on the received data. The encryption engine inside the HSM core uses the key pre-stored in its secure storage area to calculate the plaintext data according to the CMAC / HMAC algorithm to obtain a new MAC value. Step 3.7: Verify the calculated MAC value with the received MAC value. During this process, core1 continues to detect the timer time. Step 3.8: If the timer does not exceed the threshold and the verification fails: Step 3.8.1: The HSM core sends a failure command to core1 via an interrupt; Step 3.8.2: core1 sends a serious error warning signal to the driver through a communication interface connected to the driver display device; Step 3.8.3: The system enters a safe state, and core1 guides the system into the rollback process through an interrupt; Step 3.8.4: Read the system log and roll back core0 and core1 to the previous cycle state, that is, the state after executing a complete round of functional modules; Step 3.8.5: Then, enter the fault handling mechanism and adopt the same handling method as when the difference value is abnormally large during the function execution stage, limit the power output of the motor and reduce the vehicle speed; Step 3.9: If the timer exceeds the threshold, the Level 2 layer will directly skip the message authentication, and the system will send a warning signal such as an indicator light to the driver, prompting the driver that there may be a data security issue; Step 3.10: If step 3.8 is verified successfully or step 3.9 is executed, the system log is updated and the Level 2 layer continues to execute the task backward; Step 3.11: Level 2 starts executing function A module: Step 3.11.1: After the program execution of function A module is completed, core1 reads the intermediate result of Level1 executing function A module in the shared storage area and compares it with the data of the same function processed by Level2; Step 3.11.2: If the difference between the two is large, it means there is a problem, and core1 will send an interrupt request to the relevant interrupt processing module; Step 3.11.3: The system responds to the interruption and uses the system log to roll back core0 and core1 to the previous cycle state; Step 3.11.4: Then, the fault handling mechanism is entered, and gradient limitation is performed according to the size of the difference. When the difference is small but exceeds the normal fluctuation range, the system takes a limiting response; when the difference is large, in addition to the limiting response, the system may further reduce the vehicle speed; when the difference exceeds the maximum tolerance threshold, the system will force an emergency shutdown and cut off the connection with the power system; Step 3.11.5: If the data comparison in step 3.12 is normal, the system log is updated and the Level 2 layer will continue to execute the task flow backwards; Step 3.12: The same as the execution steps of function A module, execute function B, C and D modules in sequence. When each function module is executed, the intermediate result of the corresponding function module will be obtained from the shared storage area and compared with it. According to the data difference, it is determined whether to continue to execute the task and update the system log or the system enters a safe state; Step 3.13: The task is completed and core1 will continue to execute the next task.

[0012] Beneficial effects achieved by the present invention: The present invention takes into account the asynchrony of program execution, divides a complete task into multiple functional modules, and creates a time difference between Level 1 and Level 2, so that programs with the same function are executed in different cores and at different time periods, thus solving the problem of common cause failure.

[0013] The present invention uses a message authentication mechanism for input data. The Level 1 layer does not consider authentication. The Level 2 layer uses the HSM module to perform message authentication, which can ensure that the message comes from the correct sender and has not been tampered with in the middle. At the same time, the present invention introduces a timer mechanism for message authentication. If the authentication times out, the Level 2 layer will directly skip the message authentication and send a warning signal to the driver, thereby preventing the delay problem caused by the stagnation of the HSM. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A schematic diagram of the flow chart of the controller Level 2 functional safety monitoring design integrating information security according to the present invention.

[0015] Figure 2 This is a structural block diagram of the controller Level 2 functional safety monitoring design that integrates information security according to the present invention. DETAILED DESCRIPTION

[0016] The technical solution of the present invention is described in detail below in conjunction with the specific drawings.

[0017] like Figure 1-2 As shown, the present embodiment provides a controller Level2 functional safety monitoring design that integrates information security. A complete task is divided into multiple functional modules, and Level1 and Level2 are run in different cores. Plain text data is directly used as input at the Level1 layer, and plain text plus MAC is used as input at the Level2 layer. Due to the delay caused by the Level2 layer message authentication, Level1 and Level2 are asynchronous when executing the same functional program. In addition, a shared storage area is established to store the intermediate results of the execution of the Level1 layer functional module, thereby reducing the communication delay between core0 and core1. The system log is recorded to restore the system to a safe state when a failure occurs.

[0018] In this embodiment, the initialization of the system includes the following steps: Step 1.1: When the system is initialized, the task is divided into four functional modules, including function A, B, C and D modules; Step 1.2: Create a shared memory area and initialize blocks for each functional module for use by core0 and core1; Step 1.3: The system initializes and starts the logging mechanism at the same time. The system log records contain the status, intermediate results and key information of core0 and core1 during the execution of each functional module, providing support for status rollback.

[0019] In this embodiment, the core0 execution process includes: Step 2.1: Transmit the communication data from other controllers to core0 in plain text as the input signal of Level 1 layer; Step 2.2: Level 1 starts to execute the function A module in the task; Step 2.2.1: After the program execution of function A module is completed, core0 stores the intermediate results of function A module into the corresponding block of the shared memory area; Step 2.2.2: Update the system log to record the status at this moment; Step 2.3: The same as the execution steps of function A module, execute function B, C and D modules in sequence, store the intermediate results in the shared storage area after each function module is completed, and update the system log; Step 2.4: The task is completed and core0 will continue to execute the next task.

[0020] In this embodiment, the core1 execution process includes: Step 3.1: core1 is used for Level2 layer. First, it receives data in the form of plain text plus MAC as input of Level2 layer; Step 3.2: Then, the Level2 layer authenticates the input data with the help of the HSM module, and core1 sends a message authentication request to the HSM core through an interrupt; Step 3.3: At the same time, core1 starts the timer; Step 3.4: The HSM core responds to the interrupt according to its own status. If the HSM core has no task to process at this time, it will give feedback to core1 through the interrupt response; Step 3.5: After core1 receives the interrupt response, it sends the data to be processed to the HSM core; Step 3.6: The HSM core performs integrity check on the received data. The encryption engine inside the HSM core uses the key pre-stored in its secure storage area to calculate the plaintext data according to the CMAC / HMAC algorithm to obtain a new MAC value. Step 3.7: Verify the calculated MAC value with the received MAC value. During this process, core1 continues to detect the timer time. Step 3.8: If the timer does not exceed the threshold and the verification fails: Step 3.8.1: The HSM core sends a failure command to core1 via an interrupt; Step 3.8.2: core1 sends a serious error warning signal to the driver through a communication interface connected to the driver display device; Step 3.8.3: The system enters a safe state, and core1 guides the system into the rollback process through an interrupt; Step 3.8.4: Read the system log and roll back core0 and core1 to the previous cycle state, that is, the state after executing a complete round of functional modules (such as functions A, B, C, D); Step 3.8.5: Then, enter the fault handling mechanism and adopt the same handling method as when the difference value is abnormally large during the function execution stage, limit the power output of the motor and reduce the vehicle speed; Step 3.9: If the timer exceeds the threshold, the Level 2 layer will directly skip the message authentication, and the system will send a warning signal such as an indicator light to the driver, prompting the driver that there may be a data security issue; Step 3.10: If step 3.8 is verified successfully or step 3.9 is executed, the system log is updated and the Level 2 layer continues to execute the task backward; Step 3.11: Level 2 starts executing function A module: Step 3.11.1: After the program execution of function A module is completed, core1 reads the intermediate result of Level1 executing function A module in the shared storage area and compares it with the data of the same function processed by Level2; Step 3.11.2: If the difference between the two is large, it means there is a problem, and core1 will send an interrupt request to the relevant interrupt processing module; Step 3.11.3: The system responds to the interruption and uses the system log to roll back core0 and core1 to the previous cycle state; Step 3.11.4: Then, the fault handling mechanism is entered, and gradient limitation is performed according to the size of the difference. When the difference is small but exceeds the normal fluctuation range, the system takes a limiting response, such as limiting the upper limit of the torque output to a certain threshold; when the difference is large, in addition to limiting the response (i.e. limiting the power output), the system may further reduce the vehicle speed; when the difference exceeds the maximum tolerance threshold, the system will force an emergency shutdown and cut off the connection with the power system; Step 3.11.5: If the data comparison in step 3.12 is normal, the system log is updated and the Level 2 layer will continue to execute the task flow backwards; Step 3.12: The same as the execution steps of function A module, execute function B, C and D modules in sequence. When each function module is executed, the intermediate result of the corresponding function module will be obtained from the shared storage area and compared with it. According to the data difference, it is determined whether to continue to execute the task and update the system log or the system enters a safe state; Step 3.13: The task is completed and core1 will continue to execute the next task.

[0021] The present invention divides the functions of a complete task and runs Level 1 and Level 2 in different cores, so that Level 1 and Level 2 execute programs with the same function in different cores and at different time periods, thereby solving the problem of common cause failure.

[0022] The present invention does not consider data security issues for the Level 1 layer, and uses plain text plus MAC as input in the Level 2 layer. Therefore, there is a message authentication delay in the Level 2 layer, which also creates conditions for the asynchrony of Level 1 and Level 2 program execution.

[0023] When performing message authentication at the Level 2 layer, the present invention sets a timer to prevent the delay of the Level 2 layer from increasing due to stagnation of the HSM module.

[0024] It should be noted that, in this article, the term "comprises" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0025] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A controller Level 2 functional safety monitoring design integrating information security, characterized in that: By dividing a complete task into multiple functional modules, and making Level1 and Level2 run in different cores; using plaintext data directly as input at the Level1 layer, and plaintext plus MAC as input at the Level2 layer, due to the delay caused by the message authentication at the Level2 layer, there is asynchrony between Level1 and Level2 when executing the same functional program; in addition, a shared storage area is established to store the intermediate results of the execution of the functional modules at the Level1 layer, reducing the communication delay between core0 and core1; and recording system logs to restore the system to a safe state when a failure occurs.

2. According to the controller Level 2 functional safety monitoring design integrating information security according to claim 1, it is characterized in that: The initialization of the system includes the following steps: Step 1.1: When the system is initialized, the task is divided into four functional modules, including function A, B, C and D modules; Step 1.2: Create a shared memory area and initialize blocks for each functional module for use by core0 and core1; Step 1.3: The system initializes and starts the logging mechanism at the same time. The system log records contain the status, intermediate results and key information of core0 and core1 during the execution of each functional module, providing support for status rollback.

3. According to the controller Level 2 functional safety monitoring design integrating information security according to claim 2, it is characterized in that: The core0 execution process includes: Step 2.1: Transmit the communication data from other controllers to core0 in plain text as the input signal of Level 1 layer; Step 2.2: Level 1 starts to execute the function A module in the task; Step 2.2.1: After the program execution of function A module is completed, core0 stores the intermediate results of function A module into the corresponding block of the shared memory area; Step 2.2.2: Update the system log to record the status at this moment; Step 2.3: The same as the execution steps of function A module, execute function B, C and D modules in sequence, store the intermediate results in the shared storage area after each function module is completed, and update the system log; Step 2.4: The task is completed and core0 will continue to execute the next task.

4. According to the controller Level 2 functional safety monitoring design integrating information security according to claim 3, it is characterized in that: The core1 execution process includes: Step 3.1: core1 is used for Level2 layer. First, it receives data in the form of plain text plus MAC as input of Level2 layer; Step 3.2: Then, the Level2 layer authenticates the input data with the help of the HSM module, and core1 sends a message authentication request to the HSM core through an interrupt; Step 3.3: At the same time, core1 starts the timer; Step 3.4: The HSM core responds to the interrupt according to its own status. If the HSM core has no task to process at this time, it will provide feedback to core1 through the interrupt response; Step 3.5: After core1 receives the interrupt response, it sends the data to be processed to the HSM core; Step 3.6: The HSM core performs integrity check on the received data. The encryption engine inside the HSM core uses the key pre-stored in its secure storage area to calculate the plaintext data according to the CMAC / HMAC algorithm to obtain a new MAC value. Step 3.7: Verify the calculated MAC value with the received MAC value. During this process, core1 continues to detect the timer time; Step 3.8: If the timer does not exceed the threshold and the verification fails: Step 3.8.1: The HSM core sends a failure command to core1 via an interrupt; Step 3.8.2: core1 sends a serious error warning signal to the driver through a communication interface connected to the driver display device; Step 3.8.3: The system enters a safe state, and core1 guides the system into the rollback process through an interrupt; Step 3.8.4: Read the system log and roll back core0 and core1 to the previous cycle state, that is, the state after executing a complete round of functional modules; Step 3.8.5: Then, enter the fault handling mechanism and adopt the same handling method as when the difference is abnormally large during the function execution stage, limit the power output of the motor and reduce the vehicle speed; Step 3.9: If the timer exceeds the threshold, the Level 2 layer will directly skip the message authentication and the system will send a warning signal to the driver; Step 3.10: If step 3.8 is verified successfully or step 3.9 is executed, the system log is updated and the Level 2 layer continues to execute the task backward; Step 3.11: Level 2 starts executing function A module: Step 3.11.1: After the program execution of function A module is completed, core1 reads the intermediate result of Level1 executing function A module in the shared storage area and compares it with the data of the same function processed by Level2; Step 3.11.2: If the difference between the two is large, it means there is a problem, and core1 will send an interrupt request to the relevant interrupt processing module; Step 3.11.3: The system responds to the interruption and uses the system log to roll back core0 and core1 to the previous cycle state; Step 3.11.4: Then, the fault handling mechanism is entered, and gradient limitation is performed according to the size of the difference. When the difference is small but exceeds the normal fluctuation range, the system takes a limiting response; when the difference is large, in addition to the limiting response, the system will further reduce the vehicle speed; when the difference exceeds the maximum tolerance threshold, the system will force an emergency shutdown and cut off the connection with the power system; Step 3.11.5: If the data comparison in step 3.12 is normal, the system log is updated and the Level 2 layer will continue to execute the task flow backwards; Step 3.12: The same as the execution steps of function A module, execute function B, C and D modules in sequence. When each function module is executed, the intermediate result of the corresponding function module will be obtained from the shared storage area and compared with it. According to the data difference, it is determined whether to continue to execute the task and update the system log or the system enters a safe state; Step 3.13: The task is completed and core1 will continue to execute the next task.

Images