Mitigation of manipulation in a computer system of a device, in particular a vehicle, with

Abstract

One aspect of the present disclosure relates to a computer-implemented method for mitigating manipulation in a computer system of a device, in particular a vehicle. A computer system of a first aspect includes a plurality of regions, a plurality of system resources, and a region manipulation mitigation module designed to mitigate region manipulation within each of the plurality of regions. Regions of a first aspect are logically and / or physically delimited cells in a computer system. Further, a first number of system resources of the plurality of system resources is allocated to a first region of the plurality of regions. Further, a second number of the plurality of system resources is allocated to a second region of the plurality of regions, the second number being different from the first number of the plurality of system resources. The method includes identifying, in an area manipulation mitigation module, a likelihood of manipulating a first area of the plurality of areas and / or manipulating a second area of the plurality of areas. In this case, the manipulated region is a region that has been identified to violate an allocation rule of system resources allocated to the region. The method further includes initiating a countermeasure to mitigate manipulation of the first region and / or manipulation of the second region by the region manipulation mitigation module.

Description

Technical Field

[0001] The present invention relates to techniques for mitigating manipulation in a computer system of an apparatus, in particular a vehicle. Associated aspects relate to an area maneuvering mitigation module, a computer system of an apparatus, an apparatus and a computer program. Background Art

[0002] Recently, vehicles have been increasingly networked with each other and / or with a backend located in the cloud. More precisely, a vehicle has one or more interfaces via which data are received and / or sent during operation of the vehicle, which data in turn are used to operate the vehicle. In addition, the complexity of the components of a vehicle and its software is also increasing, in particular in connection with the requirements for autonomous or semi-autonomous vehicles and "smarter mobility", which means integrating vehicles into the digital world. Cybersecurity therefore plays an increasingly important role in the development of software and hardware for modern vehicles. In addition, some of the prior art methods related to cybersecurity are problematic due to the diversity of applications, which are provided by different manufacturers and are executed on different systems in the vehicle.

[0003] In this context, some prior art approaches are based on the concept of zone separation, i.e. the concept of separating trust zones within a control device (Electronic Control Unit, ECU), thereby isolating more exposed components from less exposed components in order to reduce the attack surface.

[0004] However, some prior art methods are unable to timely identify violations of these allocations by different regions in their entirety as a result of an intrusion attempt and respond accordingly.

[0005] Therefore, it is necessary to develop new and effective technologies to solve some or all of the above problems. Summary of the invention

[0006] A first general aspect of the present disclosure relates to a computer-implemented method for mitigating manipulation in a computer system of a device, particularly a vehicle. The computer system of the first aspect includes a plurality of regions, a plurality of system resources, and a regional manipulation mitigation module, the module being designed to mitigate regional manipulation in each of the plurality of regions. The region of the first aspect is a logically and / or physically delimitable unit in a computer system. In addition, a first number of system resources from a plurality of system resources is allocated to a first region in the plurality of regions. In addition, a second number of system resources from a plurality of system resources is allocated to a second region in the plurality of regions, the second number being different from the first number of the plurality of system resources. The method includes identifying in the regional manipulation mitigation module the possibility of manipulating a first region in the plurality of regions and / or manipulating a second region in the plurality of regions. In this case, the manipulated region is a region that has been identified as violating the allocation rules of the system resources allocated to the region. The method also includes initiating countermeasures by the regional manipulation mitigation module to mitigate manipulation of the first region and / or manipulation of the second region.

[0007] A second general aspect of the present disclosure relates to a zone manipulation mitigation module of a computer system, the zone manipulation mitigation module being designed to perform the computer-implemented method according to the first general aspect.

[0008] A third general aspect of the present disclosure relates to a computer system of an apparatus, in particular a vehicle, comprising a zone manipulation mitigation module according to the second general aspect and a plurality of zones. In addition, the computer system of the third aspect comprises a plurality of system resources, which are allocated to corresponding zones in the plurality of zones.

[0009] A fourth general aspect of the present disclosure relates to an apparatus comprising the computer system according to the third general aspect.

[0010] A fifth general aspect of the disclosure also relates to a computer program comprising instructions which, when executed by a computing system, cause the computing system to perform the computer-implemented method according to the first general aspect.

[0011] The techniques of the first to fifth general aspects may have one or more of the following advantages.

[0012] On the one hand, by dividing a computer system into zones (and, for example, assigning system modules of the computer system to corresponding zones), the present technology can achieve a greater differentiation of safety requirements in a computer system (e.g., a vehicle computer) than some prior art technologies. Thus, for example, system modules that are particularly relevant to the operational safety of a device (e.g., a vehicle) (e.g., because they represent safety-critical functions of the device) can be assigned to zones that are different from system modules that are less relevant to the operational safety of the device (e.g., because they represent less safety-critical functions of the device). However, in some cases, zones with system modules that are less relevant to operational safety may be more susceptible to interference or manipulation from the outside, for example within the scope of a cyber attack. In addition, the separation of zones in a computer system can reduce the probability that a successful manipulation in one zone spreads to other zones.

[0013] Second, the techniques of the present disclosure may more effectively identify possible tampering with a computer system than some prior art techniques. In particular, a violation of the allocation rules for system resources of different zones (e.g., the zones access system resources without permission) may indicate that tampering has occurred, or, if the allocation rules for system resources of the zones are followed (e.g., the zones only access permitted system resources), no tampering has occurred.

[0014] Third, the present technology provides the possibility of timely responding to regional manipulation (e.g., due to intervention) in a computer system of a device (e.g., in a vehicle) in a centralized manner through a regional manipulation mitigation module by initiating appropriate countermeasures to mitigate regional manipulation (e.g., by changing the access rights to system resources assigned to the manipulated region, taking over the functions of the manipulated region by other regions, and / or other corresponding countermeasures, which will be described in detail below). Therefore, compared with some existing technologies, the present technology can handle possible interventions in the computer system faster and more effectively.

[0015] This disclosure uses certain terms in the following manner:

[0016] A "system module" may include a hardware unit and / or software unit that provides multiple functions for a device (e.g., a vehicle). A system module may include one or more processors, controllers, control units, (communication) interfaces, network components, software applications, software architectures, all other software and / or hardware components, parts of the above or any combination thereof, or one or more of the above implementations of a system module. System modules or parts thereof may be arranged in zones or sub-zones.

[0017] A "region" can be a logically (functionally) and / or physically (spatially) delimitable unit in a system. In other words, if two or more regions are separated from each other on a software basis (for example, they represent different logical models in one software), they are logically delimited from each other, and if two or more regions are separated from each other spatially (for example, they are located in different computing units or parts thereof), they form a physically delimitable unit. A region can include one or more system modules and / or a part and / or multiple parts of a system module and / or multiple system modules. A region can be defined, i.e. determined, by its components. All system modules or parts of system modules assigned to a region can form the region. A region can include various computing units, computing cores, controllers, control units, storage units, peripherals, (communication) interfaces, network components, software applications, software architectures, bus systems (for example, CAN bus systems in vehicles), all other software and / or hardware components, parts of the above or any combination thereof. Multiple regions can form an overall system (for example, an entire computer system). In some examples, a "region" may be divided into two or more "sub-regions" that may collectively form the region. A "sub-region" may be a logically (functionally) and / or physically (spatially) delimitable sub-unit of a region. Similar to a region, a sub-region may include one or more system modules or portions of system modules assigned to the corresponding region.

[0018] The term "system resource" may refer to any resource that ensures (at least part of) the executableness of one or more functions of a computer system of a device (e.g., a vehicle) as a whole. A "system resource" may be a software component and / or a hardware component that provides services to a system module. For example, a system resource may include one or more memories, one or more peripheral devices (e.g., peripheral devices inside and / or outside the vehicle), system resources associated with a power supply, or any combination thereof. The term "software component" (or "software") may in principle be any part of the software of a component (e.g., a control device) of the present disclosure. In particular, a software component may be a firmware component of a component of the present disclosure. "Firmware" is software that is embedded in an (electronic) component and performs basic functions there. The firmware is functionally firmly connected to the corresponding hardware of the component (so that one firmware cannot be used without another firmware). The firmware may be stored in a non-volatile memory such as a flash memory or an EEPROM. Access to system resources by a region of the present disclosure may be allowed or denied. For example, access to system resources by a region may be allowed by access rights (described in detail below). "System resources" may be allocated to a region or a sub-region, or may be independent of the regional division in a computer system, i.e., not allocated to any region or sub-region.

[0019] The term "system resources" may also mean "communication resources" (e.g., including bus systems, in particular CAN bus systems in vehicles, or parts thereof, or bus systems or parts thereof), which may, for example, include properties of a communication connection via one or more transmission paths in a computer system in the case of multipath communication (e.g., using multipath TCP), which may be described as a set of transmission parameters (e.g., by means of data rate, transmission capacity, transmission delay, transmission bandwidth, transmission reliability or any combination thereof). The corresponding communication may, for example, be carried out between modules / components inside and / or outside the vehicle via one or more radio networks (e.g., 5G, LTE mobile radio networks or WLAN networks) or via near field communication connections or Bluetooth. For example, communication resources may include communication interfaces (e.g., one or more of I2C, SPI, CAN, LIN, USB, PCIe, Bluetooth and Wi-Fi).

[0020] "Memory" may be a data storage device or a data carrier on which / in which data is stored. A computer and / or any type of peripheral device may read or write to the memory. The memory may be a semiconductor memory and / or a magnetic memory or a memory based on a technology not mentioned here. The memory may be a volatile memory and / or a non-volatile memory. The memory may include any one of DRAM, RAM, ROM, EPROM, HDD, SDD, etc. on which / in which data is stored.

[0021] A "peripheral device" may be a component that can be connected to a (central) computing unit. Such a component may require control of the computing unit and, if necessary, initialization. A component may be a "vehicle component". A peripheral device may include a part of a computer that provides functionality that the computing core itself cannot provide and can only be provided by additional hardware. For example, a peripheral device may include an analog-to-digital converter (ADC), a safety-related peripheral device, a confidentiality-related peripheral device (MPU, MMU or other), a timer or an interface such as an SPI interface (Serial Peripheral Interface) or other interfaces mentioned above.

[0022] The term "vehicle component" is to be understood as any internal component of a vehicle. A vehicle component may be an engine (e.g. an internal combustion engine, an electric motor, a hybrid engine or a fuel cell or a part of an engine, such as a turbocharger), a control device (e.g. an engine control device), a battery or other energy absorption system, a component of a drive train (e.g. a transmission), an auxiliary system (e.g. a brake assist system, a lane keeping assist system, a parking assist system), an air conditioning system, a sensor or a sensor system (e.g. a camera-based system, a lidar system, a radar system, an ultrasonic sensor system) or an electronic system for controlling functions of the interior space. A vehicle component may also be a part of the above-mentioned systems or a combination of a plurality of the above-mentioned systems (or parts thereof).

[0023] The "computer system" of the present disclosure may include a (e.g., central) vehicle computer (Vehicle Computer) (e.g., the vehicle computer may form a computer system). The computer system may include a system within the vehicle (e.g., a system module and / or vehicle component as defined above). In some cases, the computer system may also include a system outside the vehicle (e.g., a peripheral device outside the vehicle, a data cloud system, other components, or any combination thereof). In this context, a "vehicle computer" is a class of highly integrated electronic vehicle control devices characterized by much higher computing performance than a microcontroller-based ECU. The VC is designed to have at least one microprocessor and a communication interface. In addition, the vehicle computer may include one or more physical switches or virtual switches, a system-on-chip (SoC) hardware with multiple CPU cores, coprocessors, and a powerful graphics card, on which multiple virtual machines execute different operating systems, for example, with the aid of a hypervisor, and these virtual machines are connected via a virtual switch (e.g., implemented in a hypervisor). Alternatively or additionally, the VC may use a container technology based on generating containers to provide virtual resources. Complex software is usually run on the VC to perform various tasks with various requirements, especially time-critical and safety-critical functions. The VC communicates with other systems in the vehicle, in particular with vehicle components, user interfaces and other VCs or ECUs (any combination of these alternatives can also be considered). Furthermore, the VC can communicate with systems outside the vehicle, for example with cloud systems, smartphones, charging infrastructure, traffic control technology or other vehicles. Furthermore, the computer system can include a bus system, with which a variety of logical / physical communication connections can be implemented between different components of the computer system (e.g. by means of corresponding physical communication channels). A possible example of such a bus system in the automotive field is the Controller Area Network bus system (CAN bus system).

[0024] In other cases, a "computer system" may include an embedded system (e.g., an embedded system may form a computer system). An embedded system is an electronic computer integrated into a technical environment. An embedded system may perform regulating functions, control functions, monitoring functions or data processing tasks. In other examples (or additionally), a "computer system" may include one or more electronic control units (ECUs) (e.g., one or more electronic control units may form a computer system).

[0025] A "function" can be any task (or subtask) performed in the operation of a device. A function can involve the control, regulation or monitoring of a device or a part of a device (e.g., a component of a device). Additionally or alternatively, a function can involve data or signal processing in a device (e.g., a communication function). The term "function" in the field of vehicles includes control-based functions of a vehicle, such as functions of a driving or parking assistance system, functions of autonomous driving or semi-autonomous driving, functions of an entertainment system, and functions of receiving, transmitting and storing various data between different systems of a computer system (e.g., system modules and / or vehicle components) (or any combination of the above functions). Within the scope of the present disclosure, functions related to an air conditioning system and / or an electronic system for controlling functions of an interior space can also be envisioned. The corresponding "system module" can be responsible for the executability of the function, which can, for example, communicate with other corresponding systems, such as components (e.g., vehicle components), other system modules in the vehicle, or functional units outside the vehicle (as described above), or a combination thereof.

[0026] "Software architecture" can be a structured and / or hierarchical arrangement of system components and a description of the relationship between system components in a software system, where system components can be the following software parts, and the relationship between these software parts and their properties can be described by the software architecture. For example, the "AUTOSAR" (Automotive Open System Architecture) software architecture is an open and standardized software architecture for electronic control units (ECUs) in the automotive field. For example, the "AUTOSAR Classic Platform" and the "AUTOSAR Adaptive Platform" are two different software architectures.

[0027] A "regional manipulation mitigation module" (e.g., a central "regional manipulation mitigation module") can be a component that identifies possible regional manipulations and initiates countermeasures to mitigate (identified) regional manipulations (described in detail below). A regional manipulation mitigation module can be a hardware unit that can have its own memory, preconfigured hardware logic, one or more registers, and internal data connections. (For example, a register can contain or describe a storage area.) In addition, the regional manipulation mitigation module can include corresponding logical and / or physical connections to the area (e.g., including system modules). In this context, the regional manipulation mitigation module can have one or more external interfaces, such as an interface to the area, an interface to the computing core, an interface to one or more communication connections, or any combination thereof. The regional manipulation mitigation module can be part of a processor (Central Processing Unit, central processing unit, CPU). In some cases, the regional manipulation mitigation module can be integrated into a vehicle computer, or can be designed as an independent component (e.g., a component inside the vehicle or outside the vehicle) that communicates with the vehicle computer, for example (in the latter case, the computer system of the present disclosure can include a vehicle computer and a regional manipulation mitigation module). The area manipulation mitigation module can communicate with the outside world (eg, with system modules, components, other components of the computer system, or any combination thereof) via a corresponding communication protocol.

[0028] A "security module" (e.g., a central "security module") can be a component for identifying violations of allocation rules of (allocated) system resources of corresponding areas (e.g., including system modules). In addition, the security module of the present disclosure can be used to centrally collect and process the determined violations. The security module can be part of a computer system, or can be located outside the computer system and, for example, communicate with the computer system. The security module can be a hardware unit that can have its own memory, preconfigured hardware logic, one or more registers and internal data connections. (For example, a register can contain or describe a storage area.) In addition, the security module can include corresponding logical and / or physical connections to the area (e.g., including the system module). In this context, the security module can have one or more outward interfaces, such as an interface to the area, an interface to the computing core, an interface to one or more communication connections, or any combination thereof. The security module can be part of a processor (Central Processing Unit, central processing unit, CPU). In some cases, the security module can be integrated into a vehicle computer, or designed as an independent component (e.g., a component inside or outside the vehicle) that communicates with a vehicle computer, for example.

[0029] A "domain controller" may include peripherals implemented in hardware and manage, for example, access rights to memory and / or external peripherals. A domain controller may isolate different peripherals and / or protect the system's memory, wherein a domain of a domain controller may be a continuous range with the same access rights to peripherals and / or memory. For example, a domain controller may be an extended resource domain controller (XRDC), which is a hardware-implemented peripheral of the S32G274A processor. The latter is a high-performance vehicle network processor of the S32G2 series of semiconductor manufacturer NXP and is a system-on-chip (SoC) that includes a microcontroller (μC) and a microprocessor component (μP component).

[0030] A "computing core" refers to the central part of a microprocessor, wherein a plurality of computing cores may be present in a microprocessor. A computing core may perform arithmetic and / or logical operations on input data and / or information.

[0031] A "vehicle" may be any device for transporting passengers and / or cargo. A vehicle may be a motor vehicle (e.g., a passenger car or truck) or a rail vehicle. A vehicle may also be a motorized, non-motorized and / or human-powered two- or three-wheeled vehicle. However, floating and flying devices may also be vehicles. A vehicle may operate autonomously, at least partially autonomously, or with assistance. For example, a vehicle in the present disclosure may include a partially or fully autonomous robot (e.g., an industrial robot).

[0032] The expression "identifying the likelihood of" means interpreting certain events (eg, signals or lack of signals) according to predetermined rules to identify conditions in which manipulation of one or more regions may occur. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1a is a flow chart illustrating an embodiment of a computer-implemented method for mitigating manipulation in a computer system of a device, particularly a vehicle. Figure 1b is a flow chart illustrating further possible method steps according to the first aspect.

[0034] Figure 2 An exemplary embodiment of a computer system 100 of the device is schematically shown. The computer system of Fig. 1 comprises four zones 20-23 (dashed boxes), six system modules 30-35 and one zone manipulation mitigation module 10. Furthermore, two computing units 40, 41 and five interfaces 50-54 are shown in the figure.

[0035] Figure 3 An exemplary embodiment of a computer system is shown (for simplicity, without the third region 22), except that Figure 2In addition to the embodiment of the present invention, the computer system also has peripheral devices 60 , 61 , two memories 62 , 63 and a domain controller 70 . DETAILED DESCRIPTION

[0036] First, based on Figure 1a and Figure 1b Techniques for mitigating manipulation in a computer system of a device, particularly a vehicle, are described. Figure 2 and Figure 3 Two exemplary architectures of computer systems are discussed.

[0037] like Figure 1a and Figure 1b As described, a first general aspect relates to a computer-implemented method for mitigating manipulation in a computer system of a device, in particular a vehicle, such as an autonomously or semi-autonomously operating vehicle. Figure 1a and Figure 1b The boxes shown in solid lines show the method steps of the corresponding independent claims, while the boxes shown in dashed lines show the method steps of some dependent claims.

[0038] In the present technology, a computer system includes a plurality of zones 20-23, a plurality of system resources 60-63 (e.g., memory, peripheral devices inside and / or outside the vehicle, communication resources (e.g., the entire bus system or a portion thereof, see the discussion above), and a zone manipulation mitigation module 10 designed to mitigate zone manipulation in each of the plurality of zones 20-23 (a possible embodiment of such a computer system 100 is described in Figure 2 and Figure 3 ). Here, a region is a logically and / or physically delimitable unit in a computer system (as defined above). For example, one or more, two or more, three or more, four or more, five or more, six or more, ten or more, twenty or more, fifty or more, one hundred or more regions may be separated in computer system 100. Figure 2 In the non-limiting example of FIG. 4 , four regions 20 , 21 , 22 and 23 are shown.

[0039] The computer system 100 of the first aspect can be designed to provide multiple functions to a device, in particular a vehicle. In addition, the computer system 100 may also have multiple system modules 30-35 (for example, hardware and / or software units as already mentioned above), wherein the multiple system modules are configured to provide functions to the device (for example, functions for controlling, adjusting or monitoring the device as already discussed above). In the present technology, each system module of a first number of system modules 30, 31 among the multiple system modules or a portion of a system module can be assigned to a first area 20 among multiple areas 20-23. In addition, each system module of a second number of system modules 32 among the multiple system modules or a portion of a system module can be assigned to a second area 21 among the multiple areas. Figure 2 2 shows six system modules 30 to 35. Two system modules 30, 31 (a first number of system modules in this example) are assigned to the first area 20, and one system module 32 (a second number of system modules in this example) is assigned to the second area 21 (this arrangement is Figure 2 In the same manner as the two regions 20 and 21, one or more other system modules or parts thereof not assigned to any of the two regions may be assigned to corresponding other regions different from the first and second regions. Figure 2 In the example of FIG. 2 , three system modules 33 , 34 and 35 are assigned to the third area 22 .

[0040] In some cases, one or more, two or more, three or more, four or more, five or more, six or more, ten or more, twenty or more, fifty or more, one hundred or more system modules (e.g., processors or other implementations of system modules as defined above) or portions thereof (e.g., computing cores) may be arranged in one region. For example, the first region 20 may include a portion (e.g., two computing cores) of a plurality of computing cores (e.g., four computing cores) of a processor, and the second region 21 may include another portion (e.g., the remaining two computing cores) of the plurality of computing cores of the processor (not shown in the figure). For example, a first software application may be executed on a computing core of the processor assigned to the first region 20, and a second software application may be executed on at least one computing core assigned to the second region 21. In some examples, a region may include an interface, a bus system, or a portion thereof. In Figure 2 exemplarily shows a first region 20 including a first interface 50 and a second interface 51, a second region 21 including an interface 52, and a third region 22 including an interface 53. For example, the interface may include a CAN bus interface, a CAN FD bus interface, and / or a GMAC port.

[0041] In the technology of the present disclosure, a first number of system resources 60-62 (e.g., software components and / or hardware components) among a plurality of system resources 60-63 are allocated to a first area 20 among a plurality of areas. In addition, a second number of system resources 62, 63 among the plurality of system resources 60-63 are allocated to a second area 21 among the plurality of areas, the second number being different from the first number of the plurality of system resources. As already discussed above, "system resources" may provide corresponding services for system modules and may, for example, be necessary for the executable nature of one or more functions of a computer system. Here, the second number of system resources 62, 63 may be more limited than the first number of system resources 60-62. For example, the second number of system resources may include fewer system resources than the first number of system resources. Alternatively or additionally, the second area 21 may have less access rights to the same system resource or other system resources, as explained in more detail below. In Figure 2 In the non-limiting example of , two peripheral devices 60, 61 and one memory 62 (a first amount of system resources in this example) are allocated to the first zone 20 (e.g., by means of a domain controller 70, which will be described in detail below), and two memories 62, 63 (a second amount of system resources in this example) are allocated to the second zone 21. Figure 2 In the example of FIG. 1 , the same system resource, namely the memory 62, is allocated to the two regions 20 and 21, while the other system resources 60, 61 and 63 are allocated to the first region 20 and the second region 21, respectively. In some cases, the same system resource can be allocated to two or more regions. In other cases, a system resource can only be allocated to one corresponding region and cannot be allocated to other regions.

[0042] The first step of the method includes identifying 200 in the area manipulation mitigation module 10 the possibility of manipulating the first area 20 of the plurality of areas 20-23. Alternatively or additionally, the method of the first aspect includes identifying 200 in the area manipulation mitigation module 10 the possibility of manipulating the second area 21 of the plurality of areas 20-23. Here, the manipulated area is an area that has been identified to violate the allocation rules of the system resources allocated to the area. As described below, for example, the first area and / or the second area (e.g., the system modules allocated to these areas) may access unauthorized system resources due to external intervention (or in other words, intrusion from the outside) (e.g., the first area 20 may have write access to the memory 62, but the area only allows read access to the memory, which will be described in detail below).

[0043] In the technology of the present disclosure, a manipulation of the first area 20 can be identified 250 (or in other words, "detected"), for example, by a security module (see definition above) and / or by other corresponding modules (e.g., system modules) assigned to the manipulated area (not shown in the figure). Alternatively or additionally, a manipulation of the second area 21 can be identified 250. In addition, a signal indicating the manipulation of the first area 20 and / or the second area 21 can be generated 260. The signal can be generated in the security module (e.g., in the central security module) and / or in other corresponding modules (e.g., regional manipulation mitigation module 10). Here, the identification 200 of the possibility of manipulating the first area 20 and / or the second area 21 can be based on the signal indicating the manipulation of the manipulated area. In particular, the security module and / or other corresponding modules can be configured to send the generated signal. The regional manipulation mitigation module 10 itself can be configured to receive the generated signal. In addition, the signal can be processed in the regional manipulation mitigation module (e.g., interpreted based on predetermined rules) to determine whether a manipulation has occurred in the corresponding area.

[0044] Additionally or alternatively, the identification may include identifying the absence of an (expected) signal. In some cases, the above-mentioned safety module and / or other corresponding modules may be configured to send a signal to the regional maneuver mitigation module 10 according to a predetermined schedule (e.g., regularly every predetermined time interval and / or irregularly if the corresponding consecutive time intervals between the sent signals are different). In this case, the regional maneuver mitigation module 10 may interpret the absence of a signal at a pre-planned (expected) moment as a corresponding maneuver.

[0045] In the present technology, the identification of the manipulation possibility of other areas (eg, the third, fourth, fifth area, etc.) can be performed in the same manner as the first or second area.

[0046] In a next step, the present technology includes initiating 300 countermeasures by the regional manipulation mitigation module 10 to mitigate manipulation of the first region 20. Alternatively or additionally, the regional manipulation mitigation module 10 initiates countermeasures to mitigate manipulation of the second region 21. The method step "initiating" can be performed in response to identifying the possibility of manipulation of the first region 20 and / or manipulation of the second region 21. In other words, the regional manipulation mitigation module 10 can initiate countermeasures to mitigate the impact of manipulation caused by external intervention (such as a cyber attack) on the computer system. In some cases, such countermeasures may result in changes in the access rights of system resources assigned to the manipulated region, which will be explained in detail below. For example, if a region has two or more different access rights for the use of a system resource (for example, in Figure 2In the example of , the region 20 is allowed to use the memory 62 for reading, writing and executing), the number of access rights for using the system resources can be reduced as a countermeasure (for example, as a countermeasure, the region 20 is allowed to use the memory 62 only for reading), which will be described in more detail below. Here, the region manipulation mitigation module 10 can be granted access rights to the system resources allocated to the manipulated region.

[0047] In the computer system 100 of the present technology, the first area 20 of the multiple areas may be more trustworthy than the second area 21 (less trustworthy area) of the multiple areas, wherein the danger of manipulating the more trustworthy area is lower than the danger of manipulating the less trustworthy area. As already mentioned above, manipulation can include external intervention that reduces the operational safety of the device. In addition, in some cases, the third area 22 of the multiple areas may be more trustworthy than the first area 20 or equally trustworthy as the first area 20. In other cases, the third area 22 may be more trustworthy than the second area 21 or equally trustworthy as the second area 21, but less trustworthy than the first area. In other cases, the third area 22 may be less trustworthy than the second area 21 and the first area 20. In this way, other areas (such as all areas) in the multiple areas can also be graded according to their trustworthiness with each other.

[0048] The degree to which one of the multiple regions is more or less credible, i.e., the degree of credibility, can be based on the division of regions 20-23 according to security levels. The computer system of the present disclosure can have at least two security levels, but can also have more than two security levels (e.g., more than five). The degree of credibility or security level can be determined by the configuration of the corresponding region (e.g., the system modules contained in the region). For example, the degree of security or the scope of security measures for protecting the system modules of the regions 20-23, such as from manipulation (e.g., in the scope of external intervention), can determine whether the region 20-23 is more credible or less credible or what security level the region has (e.g., whether there are specific hardware- and / or software-based security measures in the system modules of the region). In addition, for example, the communication range of the system modules arranged in the corresponding region with the external system (e.g., the back end) can determine what kind of credibility the region has or what security level the region has. For example, a region that communicates mainly or only within a computer system may be more credible than a region that communicates at least partially with an external system (e.g., the back end, other devices, such as vehicles or infrastructure components).

[0049] In some examples, the regions may be divided into untrusted regions and trusted regions according to the trustworthiness of the regions. For example, two regions 20, 21 as described herein may be trusted, while a less trusted third region 22 may be, for example, untrusted (see Figure 2). A computer system 100 (e.g. a computer system of a vehicle) may, for example, be the target of a cyber attack, whereby safety-critical functions (e.g. a braking function in a vehicle) may be disabled or manipulated, such that a dangerous situation may arise. More trusted areas 20, 21 are here areas that are less likely to be manipulated than less trusted areas 22. For example, an area 22 that includes multimedia functions and has many interfaces for communicating with a back end may be a less trusted area 22, since the communication channel to the back end has a higher probability of being subject to external interference than an area 20 that primarily includes functions that require only information from inside the vehicle and / or only execute processes inside the vehicle. Furthermore, a regional manipulation mitigation module 10 that is responsible for initiating countermeasures to mitigate manipulation in different areas may be assigned to a first area 20 of a plurality of areas, or to another area 23 of a plurality of areas that is more trusted than the first area. In some cases, a regional manipulation mitigation module 10 may be assigned to the most trusted area 23 of a plurality of areas (e.g. a regional manipulation mitigation module 10 may be assigned to the most trusted fourth area 23, such as Figure 2 and Figure 3 shown).

[0050] In the present technology, the functions provided by the system modules may have different criticalities for the operational safety of the equipment. The first more critical function among the multiple functions may be provided by the system modules 30, 31 of the first area 20, while the second less critical function among the multiple functions may be provided by the system module 32 of the second area 21. In some cases, two or more system modules (e.g., all system modules) of the second area may provide corresponding functions, and the criticality of these functions may be lower than all functions provided by the system modules of the first area. Therefore, in addition to dividing the areas 20-23 according to the degree of trust (i.e., the safety level), they are also classified according to the relevance of the areas to the operational safety (e.g., by means of the safety level), that is, the criticality of the regional functions for the operational safety of the equipment. In this area 20 is more critical than area 21, wherein the manipulation of area 20 may lead to a serious dangerous situation, while the manipulation of area 21 may not lead to a serious dangerous situation or may lead to a less serious dangerous situation. For example, area 21 including multimedia functions may not be as critical as area 20 including, for example, braking functions. In the above example, the probability of a dangerous situation due to the failure of music in the interior space of the vehicle is less than the probability of a dangerous situation due to the failure of the brakes of the vehicle. Furthermore, the region 23 to which the regional maneuver mitigation module 10 is assigned may be more critical than one or more (eg, all) other regions of the plurality of regions. Figure 2In the example in , the fourth area 23 is more critical than the other three areas 20, 21 and 22. The areas can be classified in any suitable manner based on the safety level or the relevance to the operational safety of the equipment. In some examples, the classification can be performed by an automotive safety integrity level (ASIL) classification, where the classification can include five levels (QM (least critical), ASIL-A, ASIL-B, ASIL-C and ASIL-D (most critical)). For example, the relevance of a certain area to operational safety (i.e., criticality) can be derived from the severity, frequency, controllability, or any combination of the above factors of the safety hazards in the corresponding area.

[0051] In the present technology, corresponding access rights to system resources can be assigned to regions in multiple regions. In other words, a region can be denied access to system resources, or the region can be allowed to access system resources through access rights. Access rights can include allowing the region to read, write, execute access, or any combination thereof to the corresponding system resources. In some cases, one or more access rights assigned to a region can remain unchanged over time (for example, the access rights can be predefined before the computer system runs or during the operation of the computer system). In other cases, one or more access rights assigned to a region can change over time (for example, when the computer system starts, the region is allowed to read and use the system resources, while at another time, the region is allowed to read and write to use the same system resource). In one example, if a predetermined criterion is met, the region's access to the system resource can be classified as allowed. In addition, if the predetermined criterion is not met, the same region's access to the system resource can be classified as unauthorized. The predetermined criterion can be a criterion related to the contextual information of the device and / or multiple devices, for example, related to the contextual information of the vehicle (or its vehicle component) and / or the fleet. For example, contextual information for a vehicle (or its vehicle components) may include information about the operating state of the vehicle (or its vehicle components) and / or information about predetermined rules for operating the vehicle (or its vehicle components). (This definition may similarly be extended to the entire fleet.) In another example, a predetermined criterion may require that the expected number of messages sent by an area (e.g., via a CAN bus system) within a predetermined time period must be less than or equal to a predetermined value (or must be greater than or equal to a predetermined value). In another example, the predetermined criterion may include a preset order in which data is sent from an area and / or a preset range contained in a particular type of sent data (e.g., a value between a predetermined value and another predetermined value and / or a predetermined pattern contained therein). In other examples, the predetermined criterion may include one or more of the above criteria.

[0052] In some cases, the second zone may be assigned fewer access rights to the second amount of system resources than the first zone is assigned to the first amount of system resources. Figure 2 In an example of a first area 20 of the plurality of areas (which may be more trusted than a second, less trusted area 21) may be granted access rights to use the memory 62 to read and write or read, write, and execute software applications. On the other hand, the second, less trusted area 21 may be granted access rights to use the memory 62 to read while being denied access to write and / or execute software applications.

[0053] In the present technology, a violation of the rule for allocating system resources to a region may correspond to the region making unauthorized access to system resources to which the corresponding region is not assigned access rights. For example, a violation of the rule for allocating a first number of system resources among a plurality of system resources to a first region may correspond to the first region making one or more unauthorized accesses to one or more system resources to which the first region is not assigned access rights. Alternatively or additionally, a violation of the rule for allocating a second number of system resources among a plurality of system resources to a second region may correspond to the second region making one or more unauthorized accesses to one or more system resources to which the second region is not assigned access rights. For example, if a first region (e.g., a system module assigned to the region) attempts to access a system resource (e.g., a memory) in a write manner, although the first region is only allowed to access the system resource in a read manner, the rule for the system resources allocated to the first region (or another region) may be violated. In another example, if a first region (e.g., a system module assigned to the region) attempts to execute a system resource (e.g., a software application), although the first region does not have access rights to execute the system resource, the rule for the system resources allocated to the first region (or another region) may be violated.

[0054] In the disclosed techniques, initiating 300 a countermeasure to mitigate manipulation may include changing 310 access permissions to system resources assigned to the manipulated region. In some cases, the countermeasure initiated as described above may include reducing (or in other words "limiting") the number of access permissions to system resources assigned to the manipulated region. For example, if a region (e.g., Figure 2 If area 20) is a manipulated area, and before being manipulated, the area had read access, write access, and execute access rights to system resources (for example, to memory 62), then after identifying the possibility that the area has been manipulated, the access rights can be reduced to read-only access rights.

[0055] Alternatively or additionally, initiating 300 a countermeasure to mitigate manipulation may include changing 310 access rights to system resources assigned to the non-manipulated region. Here, if a possibility of manipulation in another region (i.e., the manipulated region) is identified, a countermeasure may be initiated in the non-manipulated region. For example, if Figure 2 If the first area 20 in the example is a manipulated area, and the second (unmanipulated) area 21 has two or more different access rights for using system resources (e.g., allowing area 21 to use memory 63 in read, write, and execute mode), then as a countermeasure, the number of access rights for the second unmanipulated area 21 to use the system resources may be reduced (e.g., as a countermeasure, allowing area 21 to use memory 63 only in read mode). In some cases, changing 310 the access rights for system resources assigned to the manipulated area and / or one or more (e.g., all) unmanipulated areas may include selecting a predefined configuration of access rights for these areas (as a result of identifying the possibility of manipulation in the manipulated area). For example, the predefined configuration may include access rights for a predefined number of system resources assigned to the manipulated area and / or one or more areas. In a non-limiting example, the access rights for the number of system resources may include one access right (e.g., read-only access right or execute-only access right) or two access rights (e.g., read-only access right and execute-only access right).

[0056] In other cases, the countermeasure may include blocking 320 access to system resources assigned to the manipulated region. For example, as a countermeasure, region 20 may be denied access due to the identification of the possibility of manipulation of the region. Figure 3 Alternatively or additionally, the countermeasure may include blocking 320 access to system resources allocated to non-manipulated regions (e.g., since the possibility of manipulation of region 20 is identified, non-manipulated region 21 may be denied access as a countermeasure). Figure 3 In other alternative cases, the countermeasure may include shutting down 330 the manipulated area and / or the non-manipulated area.

[0057] Alternatively or in addition to the method step "changing 310 / blocking 320 / closing 330", initiating 300 the countermeasure may include providing 340 another area and moving 345 the functionality of the manipulated area (completely or at least partially) to the (provided) other area. In some cases, the "providing 340" step may include starting a new area (e.g., a new area with one or more system modules contained in the area). Alternatively or in addition, the "providing 340" step may include using a running unmanipulated area. (The system modules assigned to the running unmanipulated area may also be running.) In addition, the functionality of one or more system modules assigned to the manipulated area may be moved to one or more corresponding system modules assigned to the new area. Alternatively or in addition, the functionality may be moved from one or more system modules assigned to the manipulated area to one or more corresponding system modules assigned to the unmanipulated area (which are running). In other words, the system modules of the new area and the system modules of the unmanipulated area introduced above may be regarded as replacement system modules for the system modules of the manipulated area, and the replacement system modules take over the functionality of the system modules (e.g., until the functionality of the manipulated area is restored). For example, Figure 2 The system module 32 of the non-operated area 21 that is in operation can take over the function of the system module 31 of the operated area 20.

[0058] In some cases, providing 340 another area and moving 345 the functionality of the manipulated area to the another area may include allocating system resources of the manipulated area (e.g., some or all of the system resources of the manipulated area) to the new area and / or the unmanipulated area. (This may occur if a possibility that an area is being manipulated is identified, which is then classified as a manipulated area.) In addition, the new area and / or the unmanipulated area may be assigned corresponding access rights to the (allocated) system resources (e.g., the same access rights may be assigned as the manipulated area before it was manipulated). Back Figure 3 In the example of, after the possibility of manipulation in the area 20 is identified, the two peripheral devices 60, 61 and / or the memory 62 (the first amount of system resources in this example) allocated to the area 20 can be allocated to the unmanipulated area 21. Alternatively or additionally, system resources can be reserved for new areas that replace the manipulated areas and / or unmanipulated areas. For example, the computer system 100 may include a certain number of reserved system resources, which are not allocated to any area at the beginning of the computer system operation and are used as described above when manipulation in a certain area is identified.

[0059] Alternatively or in addition to the above-described method step "allocating / reserving system resources", providing 340 another area and moving 345 the functionality of the manipulated area to the other area may comprise reducing the amount of system resources of an area of ​​lower importance than the manipulated area and allocating the system resources released by reducing the amount of system resources of the less important area to the new area and / or to the non-manipulated area. Thus, both or one of the alternative method steps "allocating system resources of the manipulated area" and "reducing the amount of system resources" may, for example, be used when the computer system has relatively manageable system resources, so that reserving system resources in the computer system is not possible or is undesirable due to possible side effects (e.g., a slower communication speed in the computer system).

[0060] Alternatively or in addition to the method steps “change 310 / block 320 / close 330 / provide 340”, the start 300 countermeasure in the present technology may include resetting 350 the function of the manipulated area using information related to resetting the manipulated area (or in other words, complete, i.e., non-manipulated information). Here, the relevant information may be stored in the computer system, for example, in a memory corresponding to the computer system, such as in a persistent memory. In the present technology, the information related to resetting 350 the manipulated area may include information about the firmware of the manipulated area and / or information about the firmware of one or more system modules of the manipulated area. Alternatively or in addition, the relevant information may include information about the settings of the manipulated area and / or the settings of one or more system modules of the manipulated area (e.g., settings related to the communication protocol). Alternatively or in addition to the two alternatives mentioned, the relevant information may include information about the original allocation rules of the system resources of the manipulated area (or in other words, the complete allocation rules of the system resources allocated to the manipulated area before the manipulation). Here, the original allocation rules may include the original access rights of the manipulated area to the system resources allocated to the manipulated area before the manipulation. In some cases, instead of or in addition to the above three types of related information, the related information may also include information on other parameters characterizing the manipulated area.

[0061] In some cases, the method step of "resetting 350 the manipulated area" may include requesting information related to resetting the manipulated area. For example, the relevant information may be requested by the area manipulation mitigation module 10. In one example, the information related to resetting the manipulated area may be generated (e.g., generated by a corresponding module of the computer system 100 in the form of a digital or analog signal, message, etc.). Alternatively, the information related to resetting the manipulated area may be called (e.g., called from a memory of the computer system storing the information).

[0062] In the technology of the present disclosure, resetting 350 the manipulated area may include receiving information related to resetting the manipulated area. In this context, the regional manipulation mitigation module 10 may receive relevant information (e.g., in the form of a digital or analog signal, a message, etc.). In addition, resetting 350 the manipulated area may include restoring the functionality of the manipulated area based on the relevant information. Here, restoring the functionality of the manipulated area may include restoring the original allocation rules of the system resources allocated to the manipulated area before the manipulation (e.g., the original access rights of the manipulated area to the system resources). In the present technology, step "restore" may be performed using only the regional manipulation mitigation module 10 and / or one or more other modules of the computer system. After resetting the manipulated area, the manipulated area may be used again on the computer system (e.g., to the same extent or partial extent as before the manipulation).

[0063] In some examples, resetting 350 the manipulated area may be resetting the manipulated area immediately using the relevant information described above (e.g., the manipulated area may be reset within one minute or ten seconds). In other examples, resetting 350 the manipulated area may mean resetting the manipulated area later (e.g., such resetting may be started after a predefined time interval has passed and / or after a process having a higher priority than the predefined priority is executed in the computer system). In some cases, resetting the manipulated area immediately may be excluded in a specific context (e.g., due to security standards). For example, a later reset with respect to such a context may be performed within a period of time until the next startup process.

[0064] In addition, the present technology may include shutting down a started new area and / or separating from an unoperated area after resetting the manipulated area. (In accordance with the above definition, a new area and / or an unoperated area is an area to which the functionality of the manipulated area can be moved.) In some examples, separating from an unoperated area may include deactivating the unoperated area or returning the area to its original functionality (e.g., together with the system module assigned to the area). (As described above, the original functionality refers to the functionality before the possibility of manipulation is recognized.)

[0065] Furthermore, initiating 200 countermeasures to mitigate manipulation may include sending a generated signal indicating that the first area 20 and / or the second area 21 has been manipulated (see discussion above) to an external system (e.g., a backend, other devices, such as vehicles or infrastructure components). Alternatively or additionally, the method step "initiating 200" may include generating a signal containing contextual information about the device and / or multiple devices (as described above) and sending the signal to the external system. Thus, for example, the manipulation can be notified to the external system (in a timely manner) so that corresponding safety measures can be initiated on the side of the external system. Thus, for example, an interface of the external system (e.g., one or more components contained in the external system, such as a gateway, a switch, etc.) can be deactivated and / or the allowed communication connections from the computer system to the external system can be restricted (e.g., the communication protocol used to transmit the signal is adapted accordingly).

[0066] In the present disclosure, one or more more trusted regions 20, 21 may be formed on a first computing unit 40 of a computer system, and one or more less trusted regions 22 may be formed on a second computing unit 41 of the computer system. Figure 2 An example of such a computer system 100 is shown (for example, the computer system 100 may include a vehicle computer, a system on a chip, or an embedded system, see also the definition above), which has a first computing unit 40 and a second computing unit 41. For example, the first trusted area 20 and the second trusted area 21 may be formed on the same computing unit 40, and the third untrusted area 22 may be formed on the second computing unit 41. For example, the areas 20 and 21 may be logically separated from each other on a software basis. In some examples, the third area 22 may be physically (i.e., spatially) separated from the first area 20 and / or the second area 21 by forming the third area on the second computing unit 22.

[0067] In some examples, such as Figure 3As shown, the computer system may have a domain controller 70, which includes multiple domains (these domains are not shown in this figure). The domain controller 70 may include one or more, two or more, three or more, four or more, five or more, six or more, seven or more, eight or more domains. In the first aspect of the present technology, at least a first area 20 may be assigned to a first domain in the multiple domains, and the first domain may have the same access rights to system resources as the first area. In addition, at least a second area may be assigned to a second domain in the multiple domains, and the second domain may have the same access rights to system resources as the second area, wherein the second domain is assigned less system resource access rights (as described above in conjunction with the first and second areas) compared to the first domain. In other words, in some examples, system modules and / or parts of system modules with the same access rights may be assigned to domains, or system modules and / or parts of system modules that require the same access rights to system resources may be assigned to domains to provide corresponding functions. In some examples, the domain controller may be configured to allow or deny access to system resources by system modules 70. In some examples, access rights to system resources may be assigned based on the Principle of Least Privilege (PoLP) (e.g., with the aid of domain controller 70). This means that each zone has only the access rights to system resources required to perform its tasks. In other words, each system module assigned to a zone has only the access rights to system resources required to provide the corresponding function. In some examples, trustworthiness ("security level") may be assigned to domains. For example, a first domain (e.g., domain 0) of a plurality of domains (e.g., five domains) may be assigned a lower trustworthiness than a fifth domain (e.g., domain 5).

[0068] In some examples, access rights to peripheral devices 60, 61 and / or memories 62, 63 may be assigned to the zones 20, 21 by means of the domain controller 70. For example, a domain may include logical / physical ranges having the same access rights to the memories 63 and / or peripheral devices 61, 62. In addition, in one of the multiple zones (e.g., in the first zone 20 or in another zone), a system module and / or a portion of a system module may include a first software architecture, and in another of the multiple zones (e.g., in the second zone 21 or in another zone), another system module and / or a portion of a system module may include a second software architecture. For example, in the first zone 20, the system modules 30, 31 and / or a portion of a system module may include an AUTOSAR classic software architecture, and in another zone 21, the system module 32 and / or a portion of a system module may include an AUTOSAR adaptive software architecture. For example, in the first area 20, the system modules 30, 31 and / or a portion of the system modules may be configured to execute a first operating system (e.g., Windows), while in the second area 21, the system module 32 and / or a portion of the system modules may be configured to execute a second operating system (e.g., Linux).

[0069] In the previous sections, the technology of the present disclosure has been described many times based on the corresponding methods. However, a second general aspect of the present disclosure relates to a region manipulation mitigation module 10 (see also the above definition) of a computer system 100, which is designed to perform a computer-implemented method according to the first general aspect.

[0070] The third general aspect of the present disclosure relates to a computer system 100 of a device (particularly a vehicle), the computer system comprising a zone manipulation mitigation module 10 according to the second general aspect and a plurality of zones 20-23. In addition, the computer system of the third aspect comprises a plurality of system resources 60-63, which are allocated to corresponding zones in the plurality of zones 20-23.

[0071] A fourth general aspect of the present disclosure relates to an apparatus comprising the computer system 100 according to the third general aspect.

[0072] A fifth general aspect of the present disclosure also relates to a computer program comprising instructions which, when executed by a computing system, cause the computing system to perform a computer-implemented method according to the present disclosure.

[0073] The present disclosure also relates to a computer readable medium (eg a DVD or a solid-state memory) comprising the computer program of the fifth general aspect.

[0074] The present disclosure also relates to a signal (eg an electromagnetic signal according to a wireless or wired communication protocol) encoding the computer program of the fifth general aspect.

Claims

1. A computer-implemented method for mitigating manipulation in a computer system of a device, in particular a vehicle, wherein the computer system comprises: a plurality of zones (20-23), a plurality of system resources (60-63), and a zone manipulation mitigation module (10) designed to mitigate zone manipulation in each of the plurality of zones (20-23), Wherein a region is a logically and / or physically delimitable unit in the computer system, wherein a first number of system resources (60-62) of the plurality of system resources (60-63) are allocated to a first area (20) of the plurality of areas, wherein a second number of system resources (62, 63) of the plurality of system resources (60-63) is allocated to a second area (21) of the plurality of areas, the second number being different from the first number of the plurality of system resources, and wherein the method comprises: identifying (200) in the area manipulation mitigation module (10) a likelihood that a first area (20) of the plurality of areas (20-23) is manipulated and / or a likelihood that a second area (21) of the plurality of areas (20-23) is manipulated, The manipulated region is a region that is identified as violating the allocation rules of the system resources allocated to the region; and Countermeasures are initiated (300) by the zone manipulation mitigation module (10) to mitigate manipulation of the first zone (20) and / or manipulation of the second zone (21).

2. The computer-implemented method according to claim 1, wherein the computer system is designed to provide a plurality of functions for the device, in particular for a vehicle, The computer system (100) further comprises a plurality of system modules (30-35), wherein the plurality of system modules are configured to provide functions for the device, wherein each system module or a portion of a system module of a first number of system modules (30, 31) of the plurality of system modules is allocated to a first area (20) of the plurality of areas (20-23), Each system module or a part of a system module of a second number (32) of system modules of the plurality of system modules is allocated to a second area (21) of the plurality of areas.

3. The computer-implemented method of claim 1 or 2, further comprising: Recognizing (250) a manipulation of the first area (20) and / or a manipulation of the second area (21), optionally by a security module and / or by other corresponding modules assigned to the manipulated area; as well as generating (260) a signal indicative of manipulation of the first region (20) and / or the second region (21), The possibility of detecting (200) an actuation of the first area (20) and / or the second area (21) is performed based on a signal indicating an actuation of the actuated area.

4. A computer-implemented method according to any one of claims 1 to 3, wherein a first area (20) of the plurality of areas is more trustworthy than a second area (21) of the plurality of areas which is less trustworthy, The risk of manipulating more credible areas is less than the risk of manipulating less credible areas.

5. A computer-implemented method according to claim 2 or according to claims 2 and 3 or according to claims 2 and 4, wherein the functions provided by the system modules have different criticalities for the operational safety of the device, A first more critical function among the plurality of functions is provided by the system modules (30, 31) of the first area (20), while a less critical function among the plurality of functions is provided by the system module (32) of the second area (21).

6. The computer-implemented method of any one of claims 1 to 5, wherein a region of the plurality of regions is assigned corresponding access rights to system resources, wherein the access rights to the second amount of system resources allocated to the second area are less than the access rights to the first amount of system resources allocated to the first area, Optionally, access rights to the second amount of system resources are allocated to the second area according to a principle of least privilege.

7. The method of any one of claims 1 to 6, wherein initiating (300) countermeasures to mitigate manipulation comprises one or more of: changing (310) access permissions for system resources assigned to the manipulated region and / or the unmanipulated region; blocking (320) access to system resources allocated to the manipulated region and / or the unmanipulated region; Closing (330) the manipulated region and / or the unmanipulated region; providing (340) another area and moving (345) the functionality of the manipulated area to the another area; as well as The function of the manipulated area is reset (350) using the information related to resetting the manipulated area.

8. The method according to claim 7, wherein providing (340) another area and moving (345) the functionality of the manipulated area to the other area comprises the steps of: Launching new areas and / or using operational, unmanipulated areas; Functions are moved from one or more system modules assigned to the manipulated area to one or more corresponding system modules assigned to the new area and / or the non-manipulated area.

9. The method of claim 8, wherein providing (340) another area and moving (345) the functionality of the manipulated area to the other area comprises one or more of: Allocating system resources of the manipulated area to the new area and / or the unmanipulated area; reserving system resources for the new area replacing the manipulated area and / or the unmanipulated area; as well as The amount of system resources of a region less important than the manipulated region is reduced, and the system resources released by reducing the amount of system resources of the region with less importance are allocated to the new region and / or the non-manipulated region.

10. The method according to any one of claims 7 to 9, wherein resetting (350) the manipulated area further comprises the following steps: requesting information related to resetting the manipulated area; Generate or call information related to resetting the manipulated area.

11. The method according to any one of claims 7 to 10, wherein resetting (350) the manipulated area further comprises the following steps: receiving information related to resetting the manipulated area; and The function of the manipulated area is restored based on the relevant information.

12. A region manipulation mitigation module (10) of a computer system (100), the region manipulation mitigation module being configured to perform the steps of any one of the preceding claims 1 to 11.

13. A computer system (100) for use in a device, in particular a vehicle, comprising: The area manipulation mitigation module (10) according to claim 12, Multiple regions (20-23), and A plurality of system resources (60-63) are allocated to corresponding areas among the plurality of areas (20-23).

14. An apparatus comprising the computer system (100) according to claim 13.

15. A computer program comprising instructions which, when executed by a computing system, cause the computing system to perform the computer-implemented method of any one of claims 1 to 11.

Images