Abnormality detection device, abnormality detection method, and abnormality detection program

Abstract

An abnormality detection device for detecting an abnormality in one or more virtual systems included in a virtualized system configured in hardware, the abnormality detection device being provided with: a measurement unit for measuring at least one of a first period and a second period during the repetition of the first period and the second period, the first period is an execution period of the virtual system, and the second period is an execution period of a virtual machine executed in the virtual system; and an abnormality detection unit that detects an abnormality in the virtual system on the basis of the first period and / or the second period measured by the measurement unit.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to an abnormality detection device, an abnormality detection method, and an abnormality detection program. This application claims priority based on Japanese Application No. 2023-094215 filed on June 7, 2023, and the entire contents of the above Japanese application are hereby incorporated by reference. BACKGROUND

[0002] A system is disclosed in Patent Literature 1 that monitors actions of an application in a virtual machine (hereinafter, also referred to as “VM”) or requests issued from the VM to a hypervisor (hereinafter, also referred to as “HV”) in a virtualization system that implements virtualization by a hypervisor (hereinafter, also referred to as “HV”), to detect an abnormality.

[0003] PRIOR ART DOCUMENTS PATENT LITERATURE Patent Literature 1: International Publication No. 2022 / 185626 Patent Literature 2: Japanese Patent Application Publication No. 2012-168755 Patent Literature 3: International Publication No. 2022 / 130743 Patent Literature 4: International Publication No. 2022 / 254521 Patent Literature 5: U.S. Patent Application Publication No. 2012 / 0324236 Patent Literature 6: International Publication No. 2019 / 237072 SUMMARY

[0004] An abnormality detection device according to an aspect of the present disclosure detects an abnormality in one or more virtual systems included in a virtualization system configured on hardware, the abnormality detection device including: a measurement unit that measures at least one of a first period and a second period in a repetition of the first period and the second period, the first period being an execution period of the virtual system, and the second period being an execution period of a virtual machine executed in the virtual system; and an abnormality detection unit that detects an abnormality in the virtual system based on at least one of the first period and the second period measured by the measurement unit. BRIEF DESCRIPTION OF DRAWINGS

[0005] Figure 1 is a block diagram showing an example of a structure of a vehicle-mounted system according to the first embodiment.

[0006] Figure 2 is a block diagram showing an example of a structure of a vehicle-mounted device according to the first embodiment.

[0007] Figure 3is a diagram for explaining a virtual environment in the in-vehicle device according to the first embodiment.

[0008] Figure 4 is a diagram for explaining an example of time management based on a virtual machine monitor.

[0009] Figure 5 is a diagram for explaining an example of measurement during execution of a virtual machine.

[0010] Figure 6 is a flowchart showing an example of measurement processing based on a measurement program in the in-vehicle device according to the first embodiment.

[0011] Figure 7 is a flowchart showing an example of anomaly detection processing based on an anomaly detection program in the in-vehicle device according to the first embodiment.

[0012] Figure 8 is a diagram showing results of simulation 1.

[0013] Figure 9 is a diagram showing results of anomaly detection in simulation 1.

[0014] Figure 10 is a diagram showing results of simulation 2.

[0015] Figure 11 is a diagram showing results of anomaly detection in simulation 2.

[0016] Figure 12 is a diagram for explaining a virtual environment in the in-vehicle device according to the second embodiment.

[0017] Figure 13 is a diagram for explaining a virtual environment in the in-vehicle device according to the third embodiment.

[0018] Figure 14 is a diagram for explaining a virtual environment in the in-vehicle device according to the fourth embodiment.

[0019] Figure 15 is a diagram for explaining a virtual environment in the in-vehicle device according to the fifth embodiment.

[0020] Figure 16 is a diagram for explaining a virtual environment in the in-vehicle device according to the sixth embodiment. DETAILED DESCRIPTION

[0021] <TECHNICAL PROBLEM TO BE SOLVED BY THE DISCLOSURE> However, in the system disclosed in Patent Literature 1, only a predetermined kind of anomaly can be detected.

[0022] <Effects of the Present Disclosure> According to the present disclosure, it is possible to detect an exception generated in a virtual machine monitor without being limited to a specific kind of exception.

[0023] <Summary of Embodiments of the Present Disclosure> Hereinafter, a summary of an embodiment of the present disclosure is listed to be described.

[0024] (1) An exception detection device according to the present embodiment detects an exception in one or a plurality of virtual systems included in a virtualization system configured on hardware, the exception detection device including: a measurement unit that measures at least one of a first period and a second period in a repetition of the first period and the second period, the first period being an execution period of the virtual system, the second period being an execution period of a virtual machine executed in the virtual system; and an exception detection unit that detects an exception in the virtual system based on at least one of the first period and the second period measured by the measurement unit. In a case where the virtual system is attacked by tampering or the like, an illegal process occurs in the virtual system, and the first period or the second period is abnormally prolonged. Thus, based on at least one of the first period and the second period, it is possible to detect an exception generated in the virtual system without being limited to a specific kind of exception.

[0025] (2) In the above (1), the measurement unit can measure the second period by recording each of a start time of a process of the virtual machine and an end time of the process of the virtual machine, and calculating a difference between the recorded end time and the start time. By recording each of the start time and the end time of the process of the virtual machine using a time stamp, it is possible to measure the second period.

[0026] (3) In the above (2), the measurement unit can measure the first period by calculating a difference between the recorded start time and the end time. Thus, by recording each of the start time and the end time of the process of the virtual machine using a time stamp, it is possible to measure the first period.

[0027] (4) In the above (2) or (3), the measurement unit can record the start time by estimating a start timing of the second period of the virtual machine and acquiring time information at the estimated start timing, and record the end time by estimating an end timing of the second period and acquiring time information at the estimated end timing. The virtual machine cannot recognize the start and end of the process. For this reason, by adopting the above structure, it is possible to record the start time and the end time of the process of the virtual machine, for example, in accordance with the virtual machine.

[0028] (5) In the above (4), the measurement unit can estimate a timing after a certain period from the recording start time as the end timing. Thus, for example, the end timing of the processing of the virtual machine can be estimated according to the virtual machine.

[0029] (6) In the above (5), the certain period can be a period shorter than the remaining time of the second period from the recording start time. It can be considered that, if the end timing cannot be accurately estimated, for example, a timing after the end of the execution period of the processing of the virtual machine can be misestimated as the end timing. With the above structure, the timing before the end of the execution period of the processing of the virtual machine can be estimated as the end timing.

[0030] (7) In any one of the above (4) to (6), the measurement unit can estimate the start timing of the second period of the next cycle based on the remaining time of the second period from the recording start time and a margin period. Thus, the start timing and the end timing of the second period can be recorded for a plurality of cycles.

[0031] (8) In any one of the above (1) to (7), the abnormality detection unit can detect the abnormality in a case where the first period deviates from a first normal range or in a case where the second period deviates from a second normal range, which is measured by the measurement unit. Thus, the abnormality generated in the virtual system can be detected without being limited to a specific kind of abnormality.

[0032] (9) In any one of the above (1) to (8), the abnormality detection unit can be included in the virtual machine. Thus, the abnormality of the virtual system can be detected while suppressing the influence of the abnormality generated in the virtual system.

[0033] (10) In any one of the above (1) to (8), the abnormality detection unit can be implemented by a processor different from a processor that executes the virtual system. Thus, the abnormality of the virtual system can be accurately detected while suppressing the influence of the abnormality generated in the virtual system.

[0034] (11) In any one of the above (1) to (8), the abnormality detection unit can be implemented by a hardware security module. Thus, the abnormality can be detected by a hardware security module (HSM) in which a security countermeasure is implemented.

[0035] (12) In any one of the above (1) to (8), the abnormality detection unit can be included in a second virtual system that is a virtual system different from a first virtual system that is the virtual system. Thus, the abnormality of the first virtual system can be detected while suppressing the influence of the abnormality generated in the first virtual system.

[0036] (13) In any one of (1) to (12) described above, the measurement section can be included in the virtual machine. Thus, the first period and the second period can be measured while suppressing the influence of the abnormality generated in the virtual system.

[0037] (14) In any one of (1) to (8) described above, the measurement section can be included in a first virtual machine that is the virtual machine, and the abnormality detection section can be included in a second virtual machine that is executed in a second virtual system that is a virtual system different from a first virtual system that is the virtual system. Thus, the first period and the second period can be measured while suppressing the influence of the abnormality generated in the virtual system.

[0038] (15) In (14) described above, the measurement section can provide information indicating the measured first period and second period to the abnormality detection section via a shared memory. Thus, the information of the measurement result of the measurement section can be handed over from the first virtual machine to the second virtual machine.

[0039] (16) An abnormality detection method according to the present embodiment detects an abnormality in one or more virtual systems included in a virtualization system constituted on hardware, the abnormality detection method including the steps of: measuring at least one of a first period and a second period in repetition of the first period and the second period, the first period being an execution period of the virtual system, the second period being an execution period of a virtual machine executed in the virtual system; and detecting an abnormality in the virtual system based on the measured at least one of the first period and the second period. Thus, based on at least one of the first period and the second period, an abnormality generated in the virtual system can be detected without being limited to a specific kind of abnormality.

[0040] (17) An abnormality detection program according to the present embodiment is for detecting an abnormality in one or more virtual systems included in a virtualization system constituted on hardware, the abnormality detection program causing a computer to execute the steps of: measuring at least one of a first period and a second period in repetition of the first period and the second period, the first period being an execution period of the virtual system, the second period being an execution period of a virtual machine executed in the virtual system; and detecting an abnormality in the virtual system based on the measured at least one of the first period and the second period. Thus, based on at least one of the first period and the second period, an abnormality generated in the virtual system can be detected without being limited to a specific kind of abnormality.

[0041] The present disclosure can be realized not only as an abnormality detection device, an abnormality detection method, and an abnormality detection program that cause a computer to execute characteristic processing, each of which has the characteristic structure described above, but also as an abnormality detection system that includes the abnormality detection device or as a semiconductor integrated circuit that includes part or all of the abnormality detection device.

[0042] <Details of Embodiments of the Present Disclosure> Details of embodiments of the present disclosure will be described below with reference to the drawings. Note that at least a part of the embodiments described below can be arbitrarily combined.

[0043] [1. First Embodiment] [1-1. Vehicle-mounted System] Figure 1 is a block diagram illustrating an example of the structure of a vehicle-mounted system according to the first embodiment. The vehicle-mounted system 10 is mounted on a vehicle.

[0044] The vehicle-mounted system 10 according to the first embodiment includes vehicle-mounted devices 100A, 100B, 100C, 100D, a relay device 20, and an external communication device 30. Note that the vehicle-mounted devices included in the vehicle-mounted system 10 are not limited to the vehicle-mounted devices 100A, 100B, 100C, and 100D, and vehicle-mounted devices not illustrated can also be included in the vehicle-mounted system 10. The vehicle-mounted system 10 is a vehicle-mounted network constituted by the vehicle-mounted devices 100A, 100B, 100C, 100D, the relay device 20, the external communication device 30, and communication cables (communication buses 40A, 40B, 40C) connecting them.

[0045] The vehicle-mounted devices 100A, 100B, 100C, and 100D are arranged at respective portions of the vehicle. The vehicle-mounted devices 100A, 100B, 100C, and 100D independently control hardware of the respective portions of the vehicle or monitor the state of the hardware of the respective portions of the vehicle. For example, the vehicle-mounted devices 100A, 100B, 100C, and 100D are ECUs (Electronic Control Units) of control systems, body systems, and information systems. Note that in the following description, the vehicle-mounted devices 100A, 100B, 100C, and 100D are collectively referred to as “vehicle-mounted devices 100”.

[0046] The relay device 20 is connected to each of the in-vehicle devices 100A, 100B, 100C, 100D via buses 40A, 40B, 40C, such as Controller Area Network (CAN) buses. Specifically, the in-vehicle devices 100A, 100B are connected to the bus 40A. The in-vehicle devices 100C, 100D are connected to the bus 40B. The external communication device 30 is connected to the bus 40C. The relay device 20 relays communication between the buses 40A, 40B, 40C.

[0047] The relay device 20 and the in-vehicle devices 100 use a specific communication protocol. The communication protocol is, for example, CAN, CAN with Flexible Data Rate (CAN FD), or Ethernet (a registered trademark).

[0048] The relay device 20 has a function as a gateway that relays communication between a plurality of in-vehicle devices 100. The in-vehicle devices 100 are capable of transmitting messages. The relay device 20 relays messages between in-vehicle devices 100 connected to different buses. For example, the relay device 20 is capable of relaying messages between the in-vehicle device 100A connected to the bus 40A and the in-vehicle device 100C connected to the bus 40B.

[0049] The relay device 20 is connected to the external communication device 30 via the bus 40C. The external communication device 30 is, for example, a wireless communication terminal that complies with 5G or 4G, such as a Telematics Control Unit (TCU). The external communication device 30 is capable of communicating with a server 50. The external communication device 30 and the relay device 20 relay communication between the server 50 and the in-vehicle devices 100.

[0050] [1-2. Structure of in-vehicle device] Figure 2 is a block diagram illustrating an example of a structure of an in-vehicle device according to the first embodiment. The in-vehicle device 100 includes a processor 101, a non-volatile memory 102, a volatile memory 103, a communication interface (I / F) 104, and a hardware security module (HSM) 105.

[0051] The volatile memory 103 is, for example, a semiconductor memory such as a Static Random Access Memory (SRAM) or a Dynamic Random Access Memory (DRAM). The non-volatile memory 102 is, for example, a flash memory or a hard disk. The non-volatile memory 102 is capable of reading and writing data.

[0052] The processor 101 is, for example, a CPU (Central Processing Unit). However, the processor 101 is not limited to the CPU. The processor 101 can also be a GPU (Graphics Processing Unit). The processor 101 is configured to be able to execute a computer program. However, the processor 101 can include, for example, an ASIC (Application Specific Integrated Circuit) in a part thereof, and can include a programmable logic device such as an FPGA (Field Programmable Gate Array) in a part thereof.

[0053] The processor 101 includes a clock (CLK) 106. The clock 106 outputs a clock signal at a certain period. The processor 101 includes, for example, a time stamp counter (TSC) not shown, and is able to stamp a time of the processor 101. The time stamped by the TSC is an internal time of the in-vehicle device 100. The internal time of the in-vehicle device 100 is, for example, an absolute time synchronized by an NTP (Network Time Protocol) server. The absolute time is, for example, JST (Japan Standard Time), and in another example, UTC (Coordinated Universal Time). Hereinafter, the internal time of the in-vehicle device 100 is also referred to as a "system time".

[0054] The communication I / F 104 is a communication interface that complies with the communication protocol for the in-vehicle network described above. The communication I / F 104 includes one communication port, and is connected to any one of the buses 40A, 40B, and 40C. Hereinafter, the buses 40A, 40B, and 40B are collectively referred to as "bus 40". The communication I / F 104 is connected to each of the in-vehicle device 100 and the relay device 20 via the bus 40. The in-vehicle device 100 is able to communicate with other in-vehicle devices 100, the relay device 20, and the external communication device 30 by the communication I / F 104. Further, the in-vehicle device 100 is able to communicate with the server 50 via the external communication device 30 by the communication I / F 104.

[0055] A hypervisor (HV) 110, an operating system (OS) 111A, 111B, and an application (APP) 112A, 112B are installed in the non-volatile memory 102. The HV 110 is executed by the processor 101, and causes the in-vehicle device 100 to function as a virtual machine. A part or all of the HV 110, the OS 111A, 111B, and the APP 112A, 112B can be loaded into the volatile memory 103 and executed.

[0056] Figure 3 is a diagram for explaining a virtualization system in the in-vehicle device according to the first embodiment. The HV 110 acts on the hardware 120 (the processor 101, the nonvolatile memory 102, the volatile memory 103, the communication I / F 104, and the like). The HV 110 is capable of emulating a virtual hardware (HW). The HV 110 is a virtual system obtained by virtualizing hardware. A virtual machine VM_1 is realized by emulating one virtual HW, and a virtual machine VM_2 is realized by emulating another virtual HW. The "virtualization system" referred to herein means the entire computer system realized by the HV 110 in the in-vehicle device 100. The virtualization system 200 is constituted on the hardware 120, and includes the HV 110, the VM_1, the OS 111A and the APP 112A executing on the OS 111A in the VM_1, the VM_2, the OS 111B and the APP 112B executing on the OS 111B in the VM_2. In the first embodiment, the virtualization system 200 includes one HV 110. However, it is not limited thereto, and the virtualization system 200 can include a plurality of HVs. Note that the number of virtual machines in one HV is set to two herein, but it is not limited thereto. For example, the number of virtual machines in one HV can be set to one or more than three. In addition, it is sufficient that at least one in-vehicle device 100 has a virtualization system based on an HV. That is, all in-vehicle devices 100 can have a virtualization system based on an HV, or only a part of the in-vehicle devices 100 can have a virtualization system based on an HV.

[0057] The OS 111A acts in the VM_1. In the VM_1, the APP 112A acts on the OS 111A. The OS 111B acts in the VM_2. In the VM_2, the APP 112B acts on the OS 111B. The APP 112A is, for example, control software of an engine. By executing the APP 112A by the processor 101, the in-vehicle device 100 is capable of controlling the engine. The APP 112B is, for example, control software of a power window. By executing the APP 112B by the processor 101, the in-vehicle device 100 is capable of controlling the power window.

[0058] The HV 110 manages the execution periods of the VM_1 and the VM_2. The execution period of the VM_1 and the execution period of the VM_2 are allocated in a time-division manner.

[0059] A part of the volatile memory 103 is used as a shared memory 103a. The shared memory 103a is a memory area that can be utilized by the VM_1 and the VM_2.

[0060] Returning to Figure 2The abnormality detection program 113 and the measurement program 114 are stored in the nonvolatile memory 102 as computer programs. Data used in the abnormality detection program 113 and the measurement program 114, for example, is stored in the nonvolatile memory 102. Note that it is sufficient that the abnormality detection program 113 and the measurement program 114 are installed in at least one of the in-vehicle devices 100. That is, the abnormality detection program 113 and the measurement program 114 can be installed in all of the in-vehicle devices 100, or the abnormality detection program 113 and the measurement program 114 can be installed in only some of the in-vehicle devices 100. For example, the abnormality detection program 113 and the measurement program 114 can be installed in the in-vehicle device 100 in which the HV 110 is installed. Either or both of the abnormality detection program 113 and the measurement program 114 can be loaded into the volatile memory 103 and executed.

[0061] The abnormality detection program 113 is a program for detecting an abnormality of the HV 110. For example, the HV 110 is sometimes subjected to an attack such as Hyperjacking, Hypercall attack, virtual machine monitor DoS (Denial of Services), VM Escape attack, cross-VM cache (side channel attack), and the like. The HV 110 subjected to such an attack performs an abnormal (illegal) process, or cannot perform a normal process. The abnormality detection program 113 is a program for detecting such an abnormality.

[0062] The measurement program 114 is a program for acquiring data used for the abnormality detection of the HV 110. Specifically, the measurement program 114 is a program for measuring during execution of the VM_1, the VM_2.

[0063] [1-3. Function of in-vehicle device] Reference Figure 3 The function of the in-vehicle device 100 will be described. The in-vehicle device 100 is an example of an "abnormality detection device".

[0064] The in-vehicle device 100 has the functions of the measurement sections 121A, 121B, the abnormality detection section 122, and the abnormality notification section 123. The functions of the abnormality detection section 122 and the abnormality notification section 123 are realized by the processor 101 executing the abnormality detection program 113. The functions of the measurement section 121A and the measurement section 121B are realized by the processor 101 executing the measurement program 114.

[0065] The abnormality detection program 113 is a program executed in the VM_1. In the VM_1, the abnormality detection program 113 acts on the OS 111A. That is, the abnormality detection section 122 and the abnormality notification section 123 are functions of the VM_1.

[0066] The measurement program 114 is a program executed in the VM_1 and the VM_2. In the VM_1, the measurement program 114 acts on the OS 111A. In the VM_2, the measurement program 114 acts on the OS 111B. That is, the measurement unit 121A is a function of the VM_1, and the measurement unit 121B is a function of the VM_2.

[0067] Figure 4 is a diagram for explaining an example of time management based on a virtual machine monitor. The execution period of the HV 110, the execution period of the VM_1, and the execution period of the VM_2 are allocated by the HV 110 in a time-division manner. Specifically, in the time schedule of the HV 110, a certain schedule period is repeated. The execution period of the HV 110, the execution period of the VM_1, and the execution period of the VM_2 are included in each schedule period.

[0068] In Figure 4 , C1, C2 indicate schedule periods. The schedule period C1 starts at time t10, and the execution period of the HV 110 is first allocated at time t10 to t11. t11 to t12 is the execution period T1 of the VM_1, t12 to t13 is the execution period of the HV 110, t13 to t14 is the execution period T2 of the VM_2, and t14 to t15 is the execution period of the HV 110. t15 to t20 is an idle period. At time t20, the schedule period C1 ends, and the next schedule period C2 starts.

[0069] Returning to Figure 3 , the measurement units 121A, 121B measure the corresponding execution periods among the execution period of the HV 110, the execution period T1 of the VM_1, and the execution period T2 of the VM_2.

[0070] In a specific example, the measurement unit 121A measures the execution period T1 of the VM_1. The measurement unit 121B measures the execution period T2 of the VM_2.

[0071] Figure 5 is a diagram for explaining an example of measurement of the execution period of the VM_2. Here, as a representative, measurement of the execution period T2 of the VM_2 is explained, but the measurement of the execution period T1 of the VM_1 is the same.

[0072] The VM_2 can measure time using a timer based on the clock 106. The timer function of this VM_2 is a function of measuring time during only the execution period of the VM_2 (hereinafter, also referred to as "local time"), and cannot measure time during the execution period of the HV and the execution period of the VM_1. The VM_2 does not recognize each execution period as a divided period, but recognizes as a continuous period. That is, the VM_2 recognizes that the end of one execution period and the start of the next execution period are continuous. Thus, the local time of the VM_2 is time in which the end of an execution period and the start of the next execution period are continuous.

[0073] The VM_2 can recognize the start timing of the first execution period of the VM_2. However, as described above, the VM_2 cannot recognize the end timing of the first execution period of the VM_2, and the start and end timings of the second and subsequent execution periods.

[0074] After the VM_2 is started, the VM_2 first starts the measurement section 121B. That is, the measurement section 121B is started earlier than the APP 112B. The measurement section 121B records the start time in the internal memory, such as the volatile memory 103, of the in-vehicle device 100 at the start timing of the first execution period of the VM_2, that is, the execution period after the VM_2 is started, further specifically, without delay from the time when the VM_2 is started. Hereinafter, the time information recorded in the internal memory is also referred to as a "stamp".

[0075] The measurement section 121B estimates the end timing of the execution period from the timing after the passage of Δt from the start timing of the execution period. The measurement section 121B sets the first timer of the VM_2 to Δt at the start timing of the execution period. Δt is a time corresponding to the length of one execution period, and specifically, is a period shorter than one execution period by a prescribed time. Δt is a period shorter than the remaining time tL described later.

[0076] The measurement section 121B acquires the remaining time tL during the execution period. The measurement section 121B estimates the timing after AM from the actual end time of the execution period, that is, the timing after the remaining time tL elapses, as the start timing of the execution period of VM_2 in the next scheduling period. After the execution period of VM_2, the next execution period of VM_2 comes after the execution period of HV 110, the idle period, the execution period of HV 110, the execution period of VM_1, and the execution period of HV 110 elapse. However, since VM_2 can recognize only the local time described above, VM_2 recognizes that the next execution period starts at the time point after tL elapses from the stamp start time (in fact, there is a slight fluctuation due to a slight error). That is, during the idle period, the execution period of HV 110, and the execution period of VM_1, the timer of VM_2 (the first timer described above and the second timer described later) stops. Thus, for VM_2, the timing after the remaining time tL and AM elapses is the timing after AM elapses from the start of the next execution period.

[0077] The measurement section 121B determines the timing after the remaining time tL elapses from the stamp start time as the actual end time of the execution period. The measurement section 121B sets the second timer of VM_2 to tL + AM estimated as the start timing of the execution period of VM_2 in the next scheduling period.

[0078] If the end timing comes, that is, the first timer expires, the measurement section 121B stamps the end time. In other words, the measurement section 121B acquires the time information at the end timing, and records the acquired time information in the internal memory.

[0079] The measurement section 121B stamps the start time at the timing after the remaining time tL and AM elapses, that is, the start timing of the execution period of VM_2 in the next scheduling period. That is, the measurement section 121B records the start time by acquiring the time information at the start timing.

[0080] AM is a margin time. Here, the time point after the remaining time tL elapses is considered as the start timing of the next execution period to stamp the start time. In this case, it can be considered that, in a case where time measurement fluctuates due to the accuracy of the timer, the start timing of the next execution period is stamped before the previous execution period ends. AM is a value for avoiding such a stamping error and reliably stamping the start time in the next execution period.

[0081] As with the above first execution period, the measurement unit 121B estimates the timing after the elapse of Δt from the start time as the end timing of the execution period, and stamps the end time in the case where the end timing comes. After that, as with the above, the start time and the end time of each execution period are repeatedly stamped.

[0082] Returning to Figure 3 , the measurement unit 121B measures the execution period (second period) T_VM2 of VM_2 based on the time stamps of the start time and the end time obtained as described above. Specifically, the measurement unit 121B measures the execution period T_VM2 of VM_2 by calculating the difference between the recorded end time and the start time. Similarly, the measurement unit 121A measures the execution period T_VM1 of VM_1 by calculating the difference between the recorded end time and the start time. The measurement of T_VM2 is performed during the execution period of VM_2. Further specifically, the measurement of T_VM2 is repeatedly performed for each execution period of VM_2. The measurement of T_VM1 is performed during the execution period of VM_1. Further specifically, the measurement of T_VM1 is repeatedly performed for each execution period of VM_1.

[0083] Further, the measurement units 121A, 121B can measure the execution period T_HV1 of HV 110. For example, the measurement unit 121B writes the recorded start time and end time together with the measured execution period of VM_2 into the shared memory 103a. That is, the measurement unit 121B writes the execution period T_VM2 of VM_2 and the start time and end time of the execution period of VM_2 into the shared memory 103a for each execution period of VM_2. The measurement unit 121A reads out the start time and end time of the execution period of VM_2 from the shared memory 103a. That is, the measurement unit 121A reads out the execution period T_VM2 of VM_2 and the start time and end time of the execution period of VM_2 from the shared memory 103a for each execution period of VM_1. Here, let the next dispatch cycle of the dispatch cycle Cl be C2, and assume that the dispatch cycle C2 is being executed. The measurement unit 121A can measure the execution period T_HV1 of HV 110 after the execution period of VM_1 in the dispatch cycle C2 and before the execution period of VM_2 in the dispatch cycle C2 by calculating the difference between the start time of the execution period of VM_2 in the dispatch cycle C2 and the end time of the execution period of VM_1 in the dispatch cycle C2. The measurement unit 121A can measure the execution period (and the idle period) T_HV2 of HV 110 after the execution period of VM_2 in the dispatch cycle Cl and before the execution period of VM_1 in the dispatch cycle C2 by calculating the difference between the start time of the execution period of VM_1 in the dispatch cycle C2 and the end time of the execution period of VM_2 in the dispatch cycle Cl.

[0084] The abnormality detection section 122 detects an abnormality in the HV 110 based on the execution period T_HV1 of the HV 110, the execution period T_VM1 of the VM 1, and the execution period T_VM2 of the VM 2 measured by the measurement sections 121A, 121B. The detection of the abnormality in the HV 110 is repeatedly performed in synchronization with the scheduling period.

[0085] Specifically, the abnormality detection section 122 determines whether the execution period T_HV1 of the HV 110 measured by the measurement sections 121A, 121B is out of the normal range R_HV1 (first normal range), and detects an abnormality in the HV 110 in a case where the execution period T_HV1 is out of the normal range R_HV1. The abnormality detection section 122 determines whether the execution period T_HV2 of the HV 110 measured by the measurement sections 121A, 121B is out of the normal range R_HV2 (first normal range), and detects an abnormality in the HV 110 in a case where the execution period T_HV2 is out of the normal range R_HV2.

[0086] The abnormality detection section 122 determines whether the execution period T_VM1 of the VM 1 measured by the measurement section 121A is out of the normal range R_VM1 (second normal range), and detects an abnormality in the HV 110 in a case where the execution period T_VM1 is out of the normal range R_VM1. The abnormality detection section 122 determines whether the execution period T_VM2 of the VM 2 measured by the measurement section 121B is out of the normal range R_VM2 (second normal range), and detects an abnormality in the HV 110 in a case where the execution period T_VM2 is out of the normal range R_VM2.

[0087] In the above example, the two virtual machines VM_1 and VM_2 are implemented on the HV 110, but three or more virtual machines can also be implemented on the HV 110. Consider an example in which three virtual machines VM_1, VM_2, and VM_3 are implemented on the HV 110. In this case, for example, the measurement unit 121A acts on the VM_1, the measurement unit 121B acts on the VM_2, and the measurement unit 121C acts on the VM_3. The measurement unit 121B writes the identification information of the VM_2, the execution period of the VM_2, and the start and end times into the shared memory 103a. The measurement unit 121C writes the identification information of the VM_3, the execution period of the VM_3, and the start and end times into the shared memory 103a. The measurement unit 121A reads out the identification information of the VM_2, the execution period of the VM_2, the start and end times, and the identification information of the VM_3, the execution period of the VM_3, and the start and end times from the shared memory 103a. The measurement unit 121A determines the execution period of the VM_2, the start and end times, and the execution period of the VM_3, the start and end times from the identification information. For example, in a case where the VM_1, the VM_2, and the VM_3 are executed in this order in one scheduling period, the measurement unit 121A measures the execution period T_HV1 of the HV 110 after the execution period of the VM_1 and before the execution period of the VM_2 by calculating the difference between the end time of the execution period of the VM_1 in one scheduling period and the start time of the execution period of the VM_2. The measurement unit 121A measures the execution period T_HV2 of the HV 110 after the execution period of the VM_2 and before the execution period of the VM_3 by calculating the difference between the end time of the execution period of the VM_2 in one scheduling period and the start time of the execution period of the VM_3. The measurement unit 121A measures the execution period (and the idle period) T_HV3 of the HV 110 after the execution period of the VM_3 in one scheduling period and before the execution period of the VM_1 in the next scheduling period by calculating the difference between the end time of the execution period of the VM_3 in one scheduling period and the start time of the execution period of the VM_1 in the next scheduling period. Even if the number of virtual machines is four or more, the execution period of the HV 110 can be measured in the same manner.

[0088] The abnormality notification unit 123 notifies of the detected abnormality in a case where the abnormality detection unit 122 detects an abnormality.

[0089] For example, the abnormality notification section 123 outputs notification data for notifying the detected abnormality. Specifically, the abnormality notification section 123 generates a notification frame for notifying the detected abnormality, and transmits the generated notification frame to the in-vehicle network. For example, a user interface device (hereinafter, also referred to as "UI device") (not shown) is connected to the in-vehicle system 10. The UI device is one of the in-vehicle devices mounted on the vehicle. The UI device is used by the driver of the vehicle. The UI device includes an input device and a display device, and can receive an input from the driver and display information provided to the driver. The UI device receives the notification frame transmitted from the in-vehicle device 100, and displays a screen for notifying the abnormality. Thereby, the driver is notified of the abnormality.

[0090] In another example, a data saving device (not shown) is connected to the in-vehicle system 10. The data saving device is one of the in-vehicle devices mounted on the vehicle. The data saving device saves data related to the abnormality detected by the abnormality detection section 122 (hereinafter, also referred to as "abnormality data"). The data saving device receives the notification frame transmitted from the in-vehicle device 100, and saves the abnormality data. Thereby, a history of the abnormality detection is saved, and, for example, a maintenance person who performs maintenance of the vehicle can refer to the history of the abnormality detection.

[0091] In still another example, the external communication device 30 transmits the notification frame to a security department outside the vehicle. The security department is an organization that performs detection, analysis, and suggestion of a countermeasure against a cyber attack. For example, a server 50 is used in the security department, and the notification frame is transmitted to the server 50. The server 50 notifies a terminal used by a person in charge of the security department of the detected abnormality on the basis of the received notification frame. Thereby, an appropriate countermeasure is taken against the detected abnormality.

[0092] [1-4. Action of in-vehicle device] Hereinafter, the action of the in-vehicle device according to the first embodiment will be described.

[0093] Figure 6 is a flowchart showing an example of the measurement processing based on the measurement program in the in-vehicle device according to the first embodiment. In the following description, VM_1 and VM_2 are collectively referred to as "VM".

[0094] If the VM is started, the initial execution period starts. The processor 101 estimates the start timing from the start of the initial execution period of the VM by Δt. If the start timing comes, the processor 101 stamps the start time tS (step S101). Thereby, the start time tS is recorded.

[0095] The processor 101 sets the timer to Δt (step S102).

[0096] The processor 101 acquires the remaining time tL during execution of the VM (step S103). The processor 101 sets tL + AM at a timer (step S104).

[0097] The processor 101 determines whether At has come, i.e., whether the timer set at At has expired (step S105). In the case where At has not come (NO in step S105), the processor 101 executes step S105 again.

[0098] In the case where At has come (YES in step S105), the processor 101 stamps the end time TE (step S106). Thereby, the end time TE is recorded.

[0099] The processor 101 measures the execution period T VM of the VM by calculating the difference TE - TS between the recorded start time TS and the end time TE (step S107). The processor 101 writes the start time TS and the end time TE together with the execution period T VM in the shared memory 103a.

[0100] The processor 101 determines whether tL + AM has come, i.e., whether the timer set at tL + AM has expired (step S108). In the case where tL + AM has not come (NO in step S108), the processor 101 executes step S108 again.

[0101] In the case where tL + AM has come (YES in step S108), the processor 101 estimates that the start timing has come, and stamps the start time TS (step S109). The processor 101 writes the recorded start time TS in the shared memory 103a.

[0102] For example, in the VM_1, the processor 101 calculates the execution period T_HV1, T_HV2 of the HV 110 (step S110). The T_HV1 is calculated as a difference between the end time of the execution period of the VM_1 in the target scheduling period and the start time of the execution period of the VM_2 in the target scheduling period. The T_HV2 is calculated as a difference between the end time of the execution period of the VM_2 in the previous scheduling period of the target scheduling period and the start time of the execution period of the VM_1 in the target scheduling period. For example, if the target scheduling period is set to C2 and the previous scheduling period of the scheduling period C2 is set to C1, the execution period T_HV1 of the HV 110 is calculated as a difference between the end time of the execution period of the VM_1 in the scheduling period C2 and the start time of the execution period of the VM_2 in the scheduling period C2. The execution period T_HV2 of the HV 110 is calculated as a difference between the end time of the execution period of the VM_2 in the scheduling period C1 and the start time of the execution period of the VM_1 in the scheduling period C2. Note that in the step S110 in the first scheduling period, the calculation of the execution period T_HV2 of the HV 110 is omitted because there is no scheduling period earlier than it. The step S110 is omitted in the measurement processing of the VM_2.

[0103] The processor 101 returns to the step S102. Thus, the steps S102 to S110 are repeated.

[0104] Figure 7 is a flowchart showing an example of the abnormality detection processing based on the abnormality detection program in the in-vehicle device according to the first embodiment.

[0105] The processor 101 reads out the T_VM1, T_VM2, T_HV1, T_HV2 from the shared memory 103a (step S201).

[0106] The processor 101 determines whether the T_VM1 is out of the normal range R_VM1 (step S202).

[0107] In a case where the T_VM1 is within the normal range R_VM1 (NO in the step S202), the processor 101 determines whether the T_VM2 is out of the normal range R_VM2 (step S203).

[0108] In a case where the T_VM2 is within the normal range R_VM2 (NO in the step S203), the processor 101 determines whether the T_HV1 is out of the normal range R_HV1 (step S204).

[0109] In a case where T_HV1 is within the normal range R_HV1 (NO in step S204), the processor 101 determines whether T_HV2 is out of the normal range R_HV2 (step S205).

[0110] In a case where T_HV2 is within the normal range R_HV2 (NO in step S205), the processor 101 returns to step S201. For example, the loop of the abnormality detection process is controlled in synchronization with the scheduling period. Specifically, the processor 101 returns to step S201 at the expiration of a timer with the same period as the scheduling period. As another example, the processor 101 can also return to step S201 in accordance with a call from the measurement program 114.

[0111] In a case where any one of T_VM1, T_VM2, T_HV1, and T_HV2 is out of the normal ranges R_VM1, R_VM2, R_HV1, and R_HV2 (YES in steps S202, S203, S204, and S205), the processor 101 detects an abnormality of the HV 110 (step S206).

[0112] The processor 101 notifies the detected abnormality (step S207). That is, for example, the processor 101 notifies the abnormality to the driver, or saves abnormality data in a data saving device, or notifies the abnormality to a security department. Thus far, the abnormality detection process ends.

[0113] Note that, in the example of Figure 7 In the example of

[0114] As a modification, the VM1, VM2 can not include the OS 111A, 111B. In a case where the VM1, VM2 include the OS 111A, 111B, as described above, the abnormality detection section 122, the abnormality notification section 123, the measurement section 121A, and the APP 112A are executed as application programs on the OS 111A, and the measurement section 121B and the APP 112B are executed as application programs on the OS 111B. On the other hand, in a case where the VM1, VM2 do not include the OS 111A, 111B, the abnormality detection section 122, the abnormality notification section 123, and the measurement section 121A are each realized as a function (interrupt processing routine) within the APP 112A, and the measurement section 121B is realized as a function (interrupt processing routine) within the APP 112B.

[0115] In a case where the VM1, VM2 do not include the OS 111A, 111B, the abnormality detection section 122, the abnormality notification section 123, and the measurement section 121A are each realized by an interrupt (signal) generated by the VM1, and the measurement section 121B is realized by an interrupt generated by the VM2. Thus, in such a configuration, after the VM_2 is started, the VM_2 only needs to send a signal for starting the measurement section 121B to the APP 112B at the very beginning. The VM_1 also similarly, after the VM_1 is started, the VM_1 only needs to send a signal for starting the measurement section 121A to the APP 112A at the very beginning. Further specifically, after the VM_1 is started, the VM_1 sends a signal for starting the measurement section 121A to the APP 112A, then the VM1 sends a signal for starting the abnormality detection section 122 to the APP 112A, and then the VM1 sends a signal for starting the abnormality notification section 123 to the APP 112A.

[0116] [1-5. Simulation of Abnormality Detection] The inventors implemented a simulation of the abnormality detection method according to the first embodiment. The simulation used MATLAB (registered trademark).

[0117] [1-4-1. Simulation 1] In the simulation, it was assumed that the execution period of the HV1, the execution period of the VM1, the execution period of the HV2, the execution period of the VM2, the execution period of the HV3, and the idle period IDL pass in this order in one scheduling period. The execution period of the HV1, the HV2, the HV3 of the HV110 was each set to 100 μs, the execution period of the VM1 of the VM_1 was set to 1000 μs, the execution period of the VM2 of the VM_2 was set to 500 μs, the idle period IDL was set to 200 μs, and the scheduling period was set to 2000 μs.

[0118] Furthermore, the start time of VM1 during the execution of VM_1 is set to 100μs after the actual start of VM1, and the end time of VM1 is set to 900μs after the actual start of VM1 (i.e., 100μs before the actual end of VM1). Similarly, the start time of VM2 during the execution of VM_2 is set to 100μs after the actual start of VM2, and the end time of VM2 is set to 400μs after the actual start of VM2 (i.e., 100μs before the actual end of VM2).

[0119] Figure 8 This is a graph showing the results of Simulation 1. In the graph, the execution periods HV1, HV2, and HV3 of HV110, which are extended due to the attack, are shown in bold lines. The start and end timestamps of VM1 (SVM1 and EVM1) and VM2 (SVM2 and EVM2) are each shown in dashed lines.

[0120] In Simulation 1, it was simulated that in 15 scheduling cycles, HV1, HV2, and HV3 were each changed from 100μs to 200μs (i.e., extended by 100μs) in cycles 6 to 10, and from cycles 11 to 15, HV1, HV2, and HV3 were each changed from 100μs to 300μs (i.e., extended by 200μs).

[0121] During cycles 6 to 10, HV1, HV2, and HV3 are each extended by 100μs, so the IDL disappears during the idle period, and the scheduling cycle ends in the middle of HV3.

[0122] During cycles 11 to 15, HV1, HV2, and HV3 are each extended by 200 μs, causing IDL and HV3 to disappear during the idle period. The scheduling cycle ends midway through VM2. As a result, the timing of VM2's end fails to be recorded.

[0123] exist Figure 8 In this process, the execution period T_VM1 is defined as the period from the start time stamp (SVM1) of VM1 to the end time stamp (EVM1) of VM2. The execution period T_VM2 is defined as the period from the start time stamp (SVM2) of VM2 to the end time stamp (EVM2) of VM2. The execution period T_HV1 is defined as the period from the end time stamp (EVM1) of VM1 to the start time stamp (SVM2) of VM2. The execution period T_HV2 is defined as the period from the end time stamp (EVM2) of VM2 to the start time stamp (SVM1) of VM1 in the next scheduling cycle.

[0124] Figure 9 is a graph showing the result of the abnormality detection in Simulation 1. In the simulation, the normal range R_HV1 is set to a range of 250 μs or more and 350 μs or less. The normal range R_HV2 is set to a range of 550 μs or more and 650 μs or less. The normal range R_VM1 is set to a range of 750 μs or more and 850 μs or less. The normal range R_VM2 is set to a range of 250 μs or more and 350 μs or less. In Figure 9 , the normal ranges R_HV1, R_HV2, R_VM1, R_VM2 are indicated as regions with hatching. Note that the normal ranges R_HV1 and R_VM2 overlap, and are indicated as one region.

[0125] In Simulation 1, from 2 ms to 8 ms after the start of the simulation, that is, from the 1st cycle to the 4th cycle, T_VM1, T_VM2, T_HV1, T_HV2 are each within the normal range.

[0126] T_VM1 falls within the normal range R_VM1 throughout the simulation.

[0127] At 10 ms from the start of the simulation, that is, the 5th cycle, T_HV2 is greater than the upper limit of the normal range R_HV2. Further, from 12 ms to 18 ms (the 6th cycle to the 9th cycle), T_HV2 is less than the lower limit of the normal range R_HV2. After 20 ms (the 11th cycle and thereafter), T_HV2 greatly exceeds the upper limit of the normal range R_HV2. The reason for this is that the stamping of the end time of VM2 failed.

[0128] From 2 ms to 10 ms, that is, from the 1st cycle to the 5th cycle, T_HV1 falls within the normal range R_HV1. From 12 ms and thereafter, that is, from the 6th cycle and thereafter, T_HV1 is greater than the upper limit of the normal range R_HV1.

[0129] From 2 ms to 20 ms, that is, from the 1st cycle to the 10th cycle, T_VM2 falls within the normal range R_VM2. After 20 ms, that is, from the 11th cycle and thereafter, T_VM2 is greatly lower than the lower limit of the normal range R_VM2. The reason for this is that the stamping of the end time of VM2 failed.

[0130] In summary, from 10 ms and thereafter, that is, from the 5th cycle and thereafter, an abnormality of the HV110 is detected.

[0131] [1-4-2. Simulation 2] Figure 10 is a graph showing the result of Simulation 2.

[0132] In Simulation 2, in the 15 scheduling periods, the interruption of HVA during the middle of VM2 from the 6th period to the 15th period occurred during the illegal execution of HV110. The length of HVA from the 6th period to the 10th period was 100 μs, and the length of HVA from the 11th period to the 15th period was 300 μs. The other conditions in Simulation 2 were the same as in Simulation 1.

[0133] From the 6th period to the 10th period, since the interruption of HVA of 100 μs occurred, the end time of HV3 was late by 100 μs, and the idle period IDL was reduced by 100 μs.

[0134] From the 11th period to the 15th period, since the interruption of HVA of 300 μs occurred, the idle period IDL and HV3 disappeared, and the scheduling period ended in the middle of VM2. As a result, the end time of VM2 failed to be stamped.

[0135] Figure 11 Fig. 7 is a graph showing the result of the abnormality detection in Simulation 2. The normal ranges R_HV1, R_HV2, R_VM1, and R_VM2 are the same as in Simulation 1.

[0136] In Simulation 2, from the 1st period to the 5th period, i.e., from 2 ms to 10 ms after the start of the simulation, T_VM1, T_VM2, T_HV1, and T_HV2 each were within the normal ranges.

[0137] T_VM1 fell within the normal range R_VM1 throughout the simulation.

[0138] T_HV1 fell within the normal range R_HV1 throughout the simulation.

[0139] From 12 ms to 20 ms (the 6th period to the 10th period), T_HV2 was smaller than the lower limit of the normal range R_HV2. After 20 ms (the 11th period and thereafter), T_HV2 greatly exceeded the upper limit of the normal range R_HV2. The reason for this is that the end time of VM2 failed to be stamped.

[0140] From 12 ms to 20 ms (the 6th period to the 10th period), T_VM2 was larger than the upper limit of the normal range R_VM2. After 20 ms (the 11th period and thereafter), T_VM2 greatly fell below the lower limit of the normal range R_VM2. The reason for this is that the end time of VM2 failed to be stamped.

[0141] In summary, from 12 ms and thereafter, i.e., from the 6th period and thereafter, an abnormality of HV110 was detected.

[0142] [2. Second Embodiment] Figure 12is a schematic diagram for explaining a virtual environment in the in-vehicle device according to the second embodiment.

[0143] In the second embodiment, the HSM 105 has each function of the abnormality detection section 122A and the abnormality notification section 123A. The VM_1 has only the function of the measurement section 121A, and does not have the functions of the abnormality detection section 122 and the abnormality notification section 123.

[0144] In the second embodiment, the measurement section 121B of the VM_2 outputs the measured T_VM2, and the output T_VM2 is input to the abnormality detection section 122A of the HSM 105. The measurement section 121A of the VM_1 outputs the measured T_VM1, T_HV1, T_HV2, and the output T_VM1, T_HV1, T_HV2 are input to the abnormality detection section 122A of the HSM 105.

[0145] The abnormality detection section 122A detects an abnormality of the HV 110 on the basis of the input T_VM1, T_VM2, T_HV1, T_HV2. The functions of the abnormality detection section 122A and the abnormality notification section 123A are the same as those of the abnormality detection section 122 and the abnormality notification section 123 in the first embodiment, and thus the explanation is omitted.

[0146] Since the abnormality detection section 122A is provided in the HSM 105, the function of the abnormality detection is not affected by an abnormality of the HV 110, and an abnormality can be accurately detected.

[0147] [3. Third Embodiment] Figure 13 is a schematic diagram for explaining a virtual environment in the in-vehicle device according to the third embodiment.

[0148] In the third embodiment, in the in-vehicle device 100A, the VM_1 has only the function of the measurement section 121A, and does not have the functions of the abnormality detection section 122 and the abnormality notification section 123. The in-vehicle device 100B has each function of the abnormality detection section 122B and the abnormality notification section 123B.

[0149] In the third embodiment, T_VM1, T_VM2, T_HV1, T_HV2 output from the measurement sections 121A and 121B of the in-vehicle device 100A are transmitted to the in-vehicle device 100B through the in-vehicle network.

[0150] The in-vehicle device 100B receives T_VM1, T_VM2, T_HV1, T_HV2, and inputs the T_VM1, T_VM2, T_HV1, T_HV2 to the abnormality detection section 122B. The abnormality detection section 122B detects an abnormality of the HV 110 on the basis of the input T_VM1, T_VM2, T_HV1, T_HV2. The functions of the abnormality detection section 122B and the abnormality notification section 123B are the same as those of the abnormality detection section 122 and the abnormality notification section 123 in the first embodiment, and thus the description is omitted.

[0151] In the third embodiment, the abnormality detection section 122B is implemented by a processor (the processor 101 of the in-vehicle device 100B) different from the processor 101 of the in-vehicle device 100A that executes the HV 110. Thereby, it is possible to accurately detect an abnormality of the HV 110 while suppressing an influence caused by an abnormality generated in the HV 110 in the in-vehicle device 100A.

[0152] [4. Fourth Embodiment] Figure 14 is a schematic view for explaining a virtual environment in the in-vehicle device according to the fourth embodiment.

[0153] In the fourth embodiment, in the in-vehicle device 100, the VM_1 has only the function of the measurement section 121A, and does not have the functions of the abnormality detection section 122 and the abnormality notification section 123. The server 50 has each function of the abnormality detection section 501 and the abnormality notification section 502.

[0154] In the fourth embodiment, the T_VM1, T_VM2, T_HV1, T_HV2 output from the measurement sections 121A and 121B of the in-vehicle device 100 are transmitted to the server 50 via the external communication device 30.

[0155] The server 50 receives the T_VM1, T_VM2, T_HV1, T_HV2, and inputs the T_VM1, T_VM2, T_HV1, T_HV2 to the abnormality detection section 501. The abnormality detection section 501 detects an abnormality of the HV 110 on the basis of the input T_VM1, T_VM2, T_HV1, T_HV2. The functions of the abnormality detection section 501 and the abnormality notification section 502 are the same as those of the abnormality detection section 122 and the abnormality notification section 123 in the first embodiment, and thus the description is omitted.

[0156] In the fourth embodiment, the abnormality detection section 501 is implemented by a processor (a processor of the server 50) different from the processor 101 of the in-vehicle device 100 that executes the HV 110. Thereby, it is possible to accurately detect an abnormality of the HV 110 while suppressing an influence caused by an abnormality generated in the HV 110 in the in-vehicle device 100.

[0157] [5. Fifth Embodiment] Figure 15 is a schematic diagram for explaining a virtual environment in the in-vehicle device according to the fifth embodiment.

[0158] The processor 101 of the in-vehicle device 100 according to the fifth embodiment is a multi-core processor including cores 101A and 101B. It can be that the processor 101 has one clock, or it can be that the cores 101A and 101B each have a clock.

[0159] The core 101A executes the HV 110A, and the core 101B executes the HV 110B. The HV 110A constitutes the VM_1 and the VM_2. The HV 110B constitutes the VM_21 and the VM_22.

[0160] The OS 111A acts in the VM_1. In the VM_1, the APP 112A acts on the OS 111A. The OS 111B acts in the VM_2. In the VM_2, the APP 112B acts on the OS 111B.

[0161] The OS 111C acts in the VM_21. In the VM_21, the APP 112C acts on the OS 111C. The OS 111D acts in the VM_22. In the VM_22, the APP 112D acts on the OS 111D.

[0162] The VM_1 has the functions of the measurement section 121A, the abnormality detection section 122, and the abnormality notification section 123. The VM_2 has the function of the measurement section 121B. The VM_21 has the function of the measurement section 121C. The VM_22 has the function of the measurement section 121D.

[0163] The functions of the measurement sections 121A and 121B are the same as those of the measurement sections 121A and 121B in the first embodiment. Note that even in the case where the cores 101A and 101B each have a clock, since the execution periods of the respective virtual machines and the execution period of the HV do not depend on the time, the measurement sections 121A and 121B can measure the execution periods of the respective virtual machines and the execution period of the HV.

[0164] The measurement section 121A measures the execution period T_VM1 of the VM_1 and the execution periods T_HV1 and T_HV2 of the HV 110A. The measurement section 121A writes the measured T_VM1, T_HV1, and T_HV2 in the shared memory 103a.

[0165] The measurement section 121B measures the execution period T_VM2 of the VM_2. The measurement section 121B writes the measured T_VM2 in the shared memory 103a.

[0166] The measurement section 121C measures the execution period of the VM_21 (hereinafter, referred to as "T_VM21"). The measurement section 121C measures the execution period of the HV110B (hereinafter, referred to as "T_HV21", "T_HV22"). The T_HV21 corresponds to the T_HV1 in the HV110A, and the T_HV22 corresponds to the T_HV2 in the HV110A.

[0167] The measurement section 121C writes the measured T_VM21, T_HV21, T_HV22 into the shared memory 103a.

[0168] The measurement section 121D measures the execution period of the VM_22 (hereinafter, referred to as "T_VM22"). The measurement section 121D writes the measured T_VM22 into the shared memory 103a.

[0169] The abnormality detection section 122 reads out the T_VM1, T_VM2, T_HV1, T_HV2, T_VM21, T_VM22, T_HV21, T_HV22 from the shared memory 103a.

[0170] The abnormality detection section 122 determines whether the T_HV21 deviates from a normal range (hereinafter, referred to as "R_HV21"). In a case where the T_HV21 deviates from the normal range R_HV21, the abnormality detection section 122 detects an abnormality in the HV110B. The abnormality detection section 122 determines whether the T_HV22 deviates from a normal range (hereinafter, referred to as "R_HV22"). In a case where the T_HV22 deviates from the normal range R_HV22, the abnormality detection section 122 detects an abnormality in the HV110B.

[0171] The abnormality detection section 122 determines whether the VM_21 deviates from a normal range (hereinafter, referred to as "R_VM21"). In a case where the execution period T_VM21 deviates from the normal range R_VM21, the abnormality detection section 122 detects an abnormality in the HV110B. The abnormality detection section 122 determines whether the VM_22 deviates from a normal range (hereinafter, referred to as "R_VM22"). In a case where the execution period T_VM22 deviates from the normal range R_VM22, the abnormality detection section 122 detects an abnormality in the HV110B.

[0172] In a case where an abnormality in the HV110A is detected, the abnormality notification section 123 notifies of the abnormality. In a case where an abnormality in the HV110B is detected, the abnormality notification section 123 notifies of the abnormality.

[0173] In the fifth embodiment, the abnormality detection section is included in the HV 110A, which is a virtual system different from the HV 110B that is the target of the abnormality detection. Thus, it is possible to accurately detect the abnormality of the HV 110B while suppressing the influence of the abnormality generated in the HV 110B.

[0174] [6. Sixth Embodiment] Figure 16 is a schematic diagram for explaining a virtual environment in the in-vehicle device according to the sixth embodiment.

[0175] In the sixth embodiment, in the in-vehicle device 100, the HV 110 has the functions of the measurement section 131, the abnormality detection section 132, and the abnormality notification section 133. The VM_1 does not have the functions of the measurement section 121A, the abnormality detection section 122, and the abnormality notification section 123. The VM_2 does not have the function of the measurement section 121B.

[0176] The measurement section 131 measures the execution period T_VM1 of the VM_1, the execution period T_VM2 of the VM_2, and the execution periods T_HV1, T_HV2 of the HV 110.

[0177] The HV 110 manages the execution periods of the VM_1, the VM_2, and the execution periods of the HV 110. That is, the HV 110 measures the execution periods of the VM_1, the VM_2, and the HV 110 by a timer. If the start time of the VM_1 comes, the HV 110 invokes the VM_1, and if the end time of the execution period of the VM_1 comes, the HV 110 switches to the execution period of the HV 110. If the start time of the VM_2 comes, the HV 110 invokes the VM_2, and if the end time of the execution period of the VM_2 comes, the HV 110 switches to the execution period of the HV 110.

[0178] In a specific example, the measurement section 131 measures T_VM1, T_VM2, T_HV1, T_HV2 using the execution period management function of the HV 110 described above. That is, the measurement section 131 measures T_VM1, T_VM2, T_HV1, T_HV2 without stamping the start time and the end time of the VM_1, the VM_2.

[0179] The functions of the abnormality detection section 132 and the abnormality notification section 133 are the same as those of the abnormality detection section 122 and the abnormality notification section 123 in the first embodiment, and thus the description is omitted.

[0180] As described above, in the sixth embodiment, since the measurement section 131 utilizes the function of the HV 110, it is not necessary to stamp the start time of the VM_1, the VM_2, and it is possible to make the processing in the measurement section 131 simple.

[0181] [7. Supplementary notes] The embodiments disclosed this time are examples in all aspects and are not restrictive. The scope of the rights of the present invention is not shown by the above-described embodiments but by the claims, including the equivalent meanings of the claims and all modifications within the scope.

[0182] Explanation of reference numerals 10 in-vehicle system; 20 relay device; 30 external communication device; 40A, 40B, 40C communication bus; 50 server; 100, 100A, 100B, 100C, 100D in-vehicle device; 101 processor; 101A, 101B core; 102 nonvolatile memory; 103 volatile memory; 103a shared memory; 104 communication interface (communication I / F); 105 hardware security module (HSM); 106 clock (CLK); 110, 110A, 110B hypervisor (HV, virtual system); 111A, 111B, 111C, 111D operating system (OS); 112A, 112B, 112C, 112D application (APP); 113 exception detection program; 114 measurement program; 120 hardware; 121A, 121B, 121C, 121D, 131 measurement section; 122, 122A, 122B, 501, 132 exception detection section; 123, 123A, 123B, 502, 133 exception notification section; 200 virtualization system; VM_1, VM_2, VM_21, VM_22 virtual machine; C1, C2 scheduling period; t10-t15, t20-t22 time; T1, T2, T_VM1, T_VM2, T_HV1, T_HV2, HV1, HV2, HV3, VM1, VM2, T_VM21, T_VM22, T_HV21, T_HV22 execution period; R_HV1, R_HV2, R_VM1, R_VM2, R_HV21, R_HV22, R_VM21, R_VM22 normal range; SVM1, EVM1, SVM2, EVM2 stamp time.

Claims

1. An anomaly detection device that detects an anomaly in one or more virtual systems included in a virtualized system configured of hardware, the anomaly detection device comprising: a measurement unit that measures at least one of a first period and a second period in a repetition of the first period and the second period, the first period being an execution period of the virtual system, the second period being an execution period of a virtual machine executed in the virtual system; and an anomaly detection unit that detects an anomaly in the virtual system based on at least one of the first period and the second period measured by the measurement unit.

2. The anomaly detection device according to claim 1, wherein the measurement unit measures the second period by recording each of a start time of processing of the virtual machine and an end time of the processing of the virtual machine, and calculating a difference between the recorded end time and the start time.

3. The anomaly detection device according to claim 2, wherein the measurement unit measures the first period by calculating a difference between the recorded start time and the end time.

4. The anomaly detection device according to claim 2 or 3, wherein the measurement unit records the start time by estimating a start timing of the second period of the virtual machine, and acquiring time information at the estimated start timing, and records the end time by estimating an end timing of the second period, and acquiring time information at the estimated end timing.

5. The anomaly detection device according to claim 4, wherein the measurement unit estimates a timing after a certain period from the recording of the start time as the end timing.

6. The anomaly detection device according to claim 5, wherein the certain period is a period shorter than an estimated remaining time of the second period from the recording of the start time.

7. The anomaly detection device according to any one of claims 4 to 6, wherein the measurement unit estimates a start timing of the second period of the next cycle based on an estimated remaining time of the second period from the recording of the start time and a margin period.

8. The anomaly detection device according to any one of claims 1 to 7, wherein the anomaly detection unit detects the anomaly in a case where the first period measured by the measurement unit deviates from a first normal range, or in a case where the second period deviates from a second normal range.

9. The anomaly detection device according to any one of claims 1 to 8, wherein the anomaly detection unit is included in the virtual machine.

10. The anomaly detection device according to any one of claims 1 to 8, wherein the anomaly detection unit is implemented by a processor different from a processor that executes the virtual system.

11. The anomaly detection device according to any one of claims 1 to 8, wherein the anomaly detection unit is implemented by a hardware security module.

12. The anomaly detection device according to any one of claims 1 to 8, wherein ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ The abnormality detection section is included in a second virtual system that is a virtual system different from the first virtual system that is the virtual system.

13. The abnormality detection apparatus according to any one of claims 1 to 12, wherein The measurement section is included in the virtual machine.

14. The abnormality detection apparatus according to any one of claims 1 to 8, wherein The measurement section is included in a first virtual machine that is the virtual machine, The abnormality detection section is included in a second virtual machine that is executed in a second virtual system that is a virtual system different from the first virtual system that is the virtual system.

15. The abnormality detection apparatus according to claim 14, wherein The measurement section provides information indicating the measured first period and second period to the abnormality detection section via a shared memory.

16. An abnormality detection method of detecting an abnormality in one or more virtual systems included in a virtualization system constituted on hardware, the abnormality detection method comprising the steps of: measuring at least one of a first period and a second period in iterations of the first period and the second period, the first period being an execution period of the virtual system, the second period being an execution period of a virtual machine executed in the virtual system; and detecting an abnormality in the virtual system based on the measured at least one of the first period and the second period.

17. An abnormality detection program for detecting an abnormality in one or more virtual systems included in a virtualization system constituted on hardware, the abnormality detection program causing a computer to execute the steps of: measuring at least one of a first period and a second period in iterations of the first period and the second period, the first period being an execution period of the virtual system, the second period being an execution period of a virtual machine executed in the virtual system; and detecting an abnormality in the virtual system based on the measured at least one of the first period and the second period. ​

Images