A control method and system based on runtime trust state

Abstract

The application provides a control method and system based on a runtime trusted state, wherein the control method based on the runtime trusted state is applied to a vehicle, and the control method comprises the following steps: acquiring multi-dimensional running state information related to a trusted evaluation; obtaining a system state vector at a current time according to the multi-dimensional running state information; determining a current runtime trusted state through a normalization and constraint mapping function according to the system state vector; and controlling a function execution module according to the current runtime trusted state. According to the application, the current running state of the vehicle is monitored in real time, and the function execution behavior is controlled in advance according to the current runtime trusted state before an explicit security attack or an abnormal event occurs, so that active adjustment and prevention are achieved, and the overall running risk of the system is reduced.

Description

Technical Field

[0001] This invention relates to the field of automotive technology, and more specifically to a control method and system based on runtime trusted states. Background Technology

[0002] With the development of intelligent connected vehicles, in-vehicle terminals such as TBOX and IVI have gradually evolved into comprehensive computing units with complex operating environments and external communication capabilities. Existing systems detect and assess potential security risks by collecting the configuration status, process behavior, and network communication characteristics of the in-vehicle system, and execute corresponding risk response strategies after detecting abnormal events. This type of solution mainly focuses on taking defensive measures to the system after abnormal behavior or security risks are detected, such as communication blocking, process restriction, or event reporting. Its technical focus is on the detection and response to security events.

[0003] However, most solutions only log, alert, or take post-incident action after detecting an anomaly or completing an assessment. The system may continue to perform high-risk functions before the risk has been clearly determined to be an attack. Summary of the Invention

[0004] The problem solved by this invention is that existing vehicle safety solutions can only perform log recording, alarms, and post-event handling after detecting anomalies or completing assessments.

[0005] To address the above problems, this invention provides a control method based on runtime trusted state, applied to vehicle-mounted systems. The control method includes: Obtain multi-dimensional operational status information related to trustworthiness assessment; The system state vector at the current moment is obtained based on the multidimensional operating state information; The current reliable operating state is determined based on the system state vector through a normalization and constraint mapping function; Control the function execution modules based on the current trusted operating status.

[0006] Optionally, the multi-dimensional operational state information includes system-level operational state, software consistency state, communication environment stability state, and operational environment state, and obtaining the system state vector at the current moment based on the multi-dimensional operational state information includes: Where: t is the current time; S sys (t) is the system-level state factor; S soft (t) is the software consistency state factor; S net (t) represents the communication environment state factor; S env (t) represents the operating environment state factor; S dyn(t) Dynamically corrected state factor.

[0007] Optionally, determining the current operational confidence state based on the system state vector through a normalization and constraint mapping function includes: Obtain the state weight matrix and bias vector at the current moment, wherein the state weight matrix is ​​used to represent the relative importance of different state factors in the credibility assessment, and the bias vector is used to perform benchmark correction on the credibility state assessment results; The current runtime credible state is determined by fusing the system state vector, the state weight matrix, and the bias vector through normalization and constraint mapping functions.

[0008] Optionally, the formula for determining the current runtime trusted state is: ; Where Tr is the current trusted state at runtime; S(t) is the system state vector collected at time t; W is the state weight matrix; and B is the bias vector. This is the normalization and constraint mapping function.

[0009] Optionally, the state weight matrix can be adjusted according to vehicle type, terminal role, or operating phase.

[0010] Optionally, if the system is in maintenance or engineering diagnostic mode, the corresponding value in the bias vector is set to a negative bias; If the vehicle is a mass-produced vehicle that operates stably for a long period of time, then the corresponding value in the bias vector is set to a positive bias.

[0011] Optionally, after determining the current operational reliability state based on the system state vector through a normalization and constraint mapping function, the control method includes: The current reliable operating state is corrected for time continuity, and the correction formula is as follows: Tr(t) = λTr(t-1) + (1-λ)Tr (t); Where λ∈[0,1], Tr Tr(t) represents the current operational confidence state calculated in a single operation at the current time; Tr(t) represents the current operational confidence state after time continuity correction.

[0012] Optionally, controlling the function execution behavior based on the current trusted operating state includes: Perform level mapping based on the current operational trust status; If the current trusted operating state is greater than the first threshold, then the trusted state level is determined to be high, and the functional module is allowed to run; If the current trusted operating status is greater than the second threshold and less than the first threshold, then the trusted status level is determined to be medium, and some functional modules are allowed to run. If the current trusted operating status is greater than the third threshold and less than the second threshold, then the trusted status level is determined to be low, and the operation of the functional module is restricted. If the current trusted operating status is less than the third threshold, the trusted status level is determined to be restricted, and the operation of the functional module is prohibited.

[0013] Furthermore, embodiments of the present invention also provide a control system based on runtime trusted state, applied to vehicle-mounted systems, the control system comprising: The status acquisition module is used to acquire multi-dimensional operational status information related to trustworthiness assessment. The trusted state assessment module is used to obtain the system state vector at the current moment based on the multi-dimensional operating state information; and to determine the current operating trusted state based on the system state vector through a normalization and constraint mapping function. The execution adjudication module is used to control the function execution module based on the current trusted operating state.

[0014] Optionally, the control system further includes a policy mapping module, which is used to perform level mapping based on the current operational trust status.

[0015] Compared with the prior art, the technical effect achieved by adopting this technical solution is that it has all the beneficial effects of a control method based on runtime trusted state as described in any embodiment of the present invention, which will not be repeated here.

[0016] The control method based on runtime trusted state provided in this application obtains the system state vector at the current moment through multi-dimensional runtime state information related to trusted assessment, and determines the current runtime trusted state based on the system state vector. This allows for real-time monitoring of the vehicle's current runtime state, enabling proactive adjustment and prevention of functional execution behavior based on the current runtime trusted state before any clear security attack or abnormal event occurs, thereby reducing the overall system runtime risk. Attached Figure Description

[0017] Figure 1 A flowchart illustrating the control method based on runtime trusted state provided in an embodiment of this application; Figure 2 for Figure 1 The flowchart shown illustrates the process of determining the current reliable operating state in the control method. Figure 3 This is a schematic diagram of the framework of a control system based on runtime trusted state provided in an embodiment of this application.

[0018] 100. Control system; 10. Status acquisition module; 20. Trusted status assessment module; 30. Execution decision module; 40. Strategy mapping module. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] Existing vehicle-mounted systems detect and assess potential security risks by collecting data on the system's configuration status, process behavior, and network communication characteristics, and then execute corresponding risk response strategies upon detecting abnormal events. This type of solution primarily focuses on taking defensive measures after detecting abnormal behavior or security risks, such as communication blocking, process restriction, or event reporting. Its technical focus is on the detection and response to security events.

[0021] However, the aforementioned solutions do not address how to preemptively constrain the functional execution behavior of vehicle-mounted terminals based on their own operational state in the absence of clear security attacks or abnormal events, nor do they establish a unified runtime trusted state representation that can serve as a basis for system operation governance. Therefore, these technical solutions primarily address the issue of "how to discover and handle existing security risks," rather than the technical problem of "how to proactively adjust and govern the scope of functional execution when the system's trust level changes."

[0022] Furthermore, existing security assessment and compliance evaluation schemes, during the vehicle R&D, testing, or maintenance phases, evaluate the data and information security level of the entire vehicle or in-vehicle system through static or dynamic testing environments, outputting risk levels, assessment reports, or security hardening recommendations to guide subsequent rectification or maintenance decisions. They also employ fixed configurations or predefined policies to restrict application permissions, interface access, or communication behavior; however, such policies are typically fixed during system startup or deployment and lack the ability to dynamically adjust at runtime.

[0023] In addition, there is no direct constraint relationship between the existing function execution and security status. Even if the system is in a state of decreased trust, critical functions such as remote control, software updates, and cross-domain communication may still be triggered indiscriminately, increasing the overall operational risk of the system.

[0024] Therefore, embodiments of this application provide a control method and system based on runtime trusted state to solve the above problems. Detailed descriptions follow. It should be noted that the order of description of the following embodiments is not intended to limit the preferred order of the embodiments.

[0025] Please continue reading. Figure 1 , Figure 1 This is a flowchart illustrating a control method based on runtime trusted state provided in an embodiment of this application. The embodiment of this application provides a control method based on runtime trusted state, applied to vehicle systems. The specific flow of the control method is as follows: 110. Obtain multi-dimensional operational status information related to trust assessment.

[0026] In some embodiments, the multidimensional operational status information includes system-level operational status, software consistency status, communication environment stability status, and operational environment status.

[0027] The specific information types of the multidimensional operating status information can be set according to the actual application situation, and no specific restrictions are imposed here.

[0028] 120. Obtain the system state vector at the current moment based on the multidimensional operating state information.

[0029] The system state vector at the current moment, obtained from the multidimensional operational state information, includes: Where: t is the current time; S sys (t) is the system-level state factor; S soft (t) is the software consistency state factor; S net (t) represents the communication environment state factor; S env (t) represents the operating environment state factor; S dyn (t) Dynamically corrected state factor.

[0030] It should be noted that the specific settings of the system state vector can be adjusted according to the actual situation and the information obtained from the actual multi-dimensional operating state information. No specific restrictions are imposed here. In addition, it should be understood that the above is only used as an example for illustration and should not be construed as a restriction on the system state vector.

[0031] 130. Determine the current reliable operating state based on the system state vector through normalization and constraint mapping functions.

[0032] Please continue reading. Figure 2 , Figure 2 for Figure 1 The flowchart shown illustrates the process of determining the current trusted operating state in the control method; the specific process is as follows: 131. Obtain the state weight matrix and bias vector at the current moment. The state weight matrix is ​​used to represent the relative importance of different state factors in the credibility assessment, and the bias vector is used to perform benchmark correction on the credibility state assessment results.

[0033] The state weight matrix W is in diagonal form to reflect the relative importance of different state factors in the reliability assessment. ; Among them, W sys For system-level state weights; W soft W represents the software consistency state weight. net W represents the state weights of the communication environment. env Weights for the operating environment state; W dyn To dynamically adjust the state weights.

[0034] For example, the state weight matrix W can be set as follows: ; That is, the system-level state weight is 0.35; the software consistency state weight is 0.25; the communication environment state weight is 0.20; the operating environment state weight is 0.10; and the dynamic correction state weight is 0.10. The engineering implications are as follows: system-level state has the greatest impact on reliability assessment; software consistency is second; the communication and operating environments serve as auxiliary influencing factors; and the dynamic factor is used to correct for short-term fluctuations.

[0035] It should be noted that the weight values ​​corresponding to each dimension in the state weight matrix are not fixed constants. They can be configured and dynamically adjusted according to the actual vehicle type, the functional role of the vehicle terminal, and the different operating conditions of the vehicle. Specific values ​​are not limited here.

[0036] The bias vector B is used to perform baseline correction on the trusted state assessment results to reflect prior operating conditions or global policy constraints, and its form can be expressed as: ; Among them, b sys For system-level state bias; b soft For software consistency state bias; b net For communication environment state bias; b env For runtime environment state bias; b dyn To dynamically correct state bias.

[0037] In some embodiments, when the system is in maintenance or engineering diagnostic mode, a negative bias may be introduced: ; Understandably, with the introduction of negative bias, even if the system is running normally in real time, if there are restrictions on permissions, operating conditions, or resources in the current operating mode, the system will proactively lower the overall trust baseline. In this way, the system can limit, constrain, or even shut down some in-vehicle functions in advance, achieving proactive risk control without having to wait for an anomaly to occur before taking remedial measures, effectively reducing various safety hazards under restricted operating conditions.

[0038] In other embodiments, a positive stability bias mechanism can be introduced for mass-produced vehicles that have undergone long-term real-vehicle verification and stable market deployment. This mechanism broadens the tolerance range of the reliable baseline by combining the historical characteristics of the vehicle's long-term stable operation, effectively improving the vehicle system's tolerance to transient anomalies such as instantaneous signal disturbances and short-term parameter fluctuations, avoiding frequent functional limitations triggered by brief and harmless fluctuations, and balancing the accuracy of system safety judgment with the stability of continuous vehicle operation.

[0039] 132. The system state vector, state weight matrix, and bias vector are fused and calculated using normalization and constraint mapping functions to determine the current runtime credible state.

[0040] The formula for determining the current trusted state during runtime is as follows: ; Where Tr is the current trusted state at runtime; S(t) is the system state vector collected at time t; W is the state weight matrix; and B is the bias vector. This is the normalization and constraint mapping function.

[0041] In some embodiments, after determining the current operational confidence state based on the system state vector through a normalization and constraint mapping function, the control method includes: The current trusted operating state is corrected for time continuity, and the correction formula is as follows: Tr(t) = λTr(t-1) + (1-λ)Tr (t); Where λ∈[0,1], Tr Tr(t) represents the current operational confidence state calculated in a single operation at the current time; Tr(t) represents the current operational confidence state after time continuity correction.

[0042] By introducing time continuity correction to smooth the current operational reliability status acquired in real time by the system, this approach combines historical multi-frame continuous reliability status data to constrain and correct for reliability value jumps caused by instantaneous sensor noise, short-term signal disturbances, and occasional calculation deviations, thus suppressing frequent and irregular switching of reliability status indicators. This effectively prevents the system from repeatedly switching judgment levels, frequently triggering functional restrictions or safety interventions due to transient fluctuations without substantial risk, reducing unnecessary dynamic adjustments in the control system, and significantly improving the long-term stability and smoothness of the vehicle's reliability management system.

[0043] 140. Control the function execution module according to the current trusted operating status.

[0044] For example, level mapping is performed based on the current operational trust status; If the current trusted status is greater than the first threshold, the trusted status level is determined to be high, and the functional module is allowed to run. If the current trusted status is greater than the second threshold and less than the first threshold, then the trusted status level is determined to be medium, and some functional modules are allowed to run. If the current trusted status is greater than the third threshold and less than the second threshold, the trusted status level is determined to be low, and the operation of the functional module is restricted. If the current trusted status is less than the third threshold, the trusted status level is determined to be restricted, and the operation of the functional module is prohibited.

[0045] The first threshold is greater than the second threshold, the second threshold is greater than the third threshold, and the specific values ​​of the first, second and third thresholds can be set according to the actual situation, historical data, etc., without specific restrictions here.

[0046] The technical effects of this application are as follows: 1. Achieve proactive risk control, intervene and constrain risks before they evolve into their full potential, eliminating the need for remedial measures after a failure occurs, and enhancing proactive safety control.

[0047] 2. Establish a unified trust evaluation standard at the vehicle system level to centrally manage the trust status of all types of hardware and software units in the vehicle and complete integrated trust governance.

[0048] 3. The control logic operates autonomously in real time, without relying on periodic security checks or special evaluation commands to start, and is not constrained by offline detection processes.

[0049] 4. The core control logic is embedded in the underlying kernel, and upper-layer vehicle applications have no permission to modify or bypass security constraints, so the control policies cannot be circumvented by the application layer.

[0050] 5. Employing temporal continuity constraints to smooth reliable state output filters out state abrupt changes caused by short-term disturbances, prevents frequent switching of functional control strategies, and enhances the overall governance stability of the system.

[0051] Please continue reading. Figure 3 , Figure 3 This is a schematic diagram of the framework of a control system based on runtime trusted state provided in an embodiment of this application. This application also provides a control system 100 based on runtime trusted state, applied in a vehicle. The control system 100 includes: a state acquisition module 10, a trusted state evaluation module 20, and an execution decision module 30. The state acquisition module 10 is used to acquire multi-dimensional operating state information related to trusted state evaluation; the trusted state evaluation module 20 is used to obtain the system state vector at the current moment based on the multi-dimensional operating state information; and determines the current running trusted state based on the system state vector through a normalization and constraint mapping function; the execution decision module 30 is used to control the function execution module according to the current running trusted state. All modules work collaboratively at the operating system or system service layer to form a unified governance for function execution.

[0052] The control system 100 also includes a strategy mapping module 40, which is used to perform level mapping based on the current operational trust status.

[0053] The foregoing has provided a detailed description of a control method and system based on runtime trusted state provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A control method based on runtime trusted state, applied to vehicle-mounted systems, characterized in that, The control method includes: Obtain multi-dimensional operational status information related to trustworthiness assessment; The system state vector at the current moment is obtained based on the multidimensional operating state information; The current reliable operating state is determined based on the system state vector through a normalization and constraint mapping function; Control the function execution modules based on the current trusted operating status.

2. The control method according to claim 1, characterized in that, in, The multidimensional operational state information includes system-level operational state, software consistency state, communication environment stability state, and operational environment state. The process of obtaining the system state vector at the current moment based on the multidimensional operational state information includes: Where: t is the current time; S sys (t) is the system-level state factor; S soft (t) is the software consistency state factor; S net (t) represents the communication environment state factor; S env (t) represents the operating environment state factor; S dyn (t) Dynamically corrected state factor.

3. The control method according to claim 2, characterized in that, The step of determining the current operational reliability state based on the system state vector through a normalization and constraint mapping function includes: Obtain the state weight matrix and bias vector at the current moment, wherein the state weight matrix is ​​used to represent the relative importance of different state factors in the credibility assessment, and the bias vector is used to perform benchmark correction on the credibility state assessment results; The current runtime credible state is determined by fusing the system state vector, the state weight matrix, and the bias vector through normalization and constraint mapping functions.

4. The control method according to claim 3, characterized in that, The formula for determining the current trusted state at runtime is: ； Where Tr is the current trusted state at runtime; S(t) is the system state vector collected at time t; W is the state weight matrix; and B is the bias vector. This is the normalization and constraint mapping function.

5. The control method according to claim 3, characterized in that, The state weight matrix is ​​adjusted according to vehicle type, terminal role, or operational phase.

6. The control method according to claim 3, characterized in that, If the system is in maintenance or engineering diagnostic mode, the corresponding value in the bias vector is set to a negative bias. If the vehicle is a mass-produced vehicle that operates stably for a long period of time, then the corresponding value in the bias vector is set to a positive bias.

7. The control method according to any one of claims 1 to 6, characterized in that, After determining the current operational reliability state based on the system state vector using a normalization and constraint mapping function, the control method includes: The current reliable operating state is corrected for time continuity, and the correction formula is as follows: Tr(t)=λTr(t-1)+(1-λ)Tr (t); Where λ∈[0,1], Tr Tr(t) represents the current operational confidence state calculated in a single operation at the current time; Tr(t) represents the current operational confidence state after time continuity correction.

8. The control method according to any one of claims 1 to 6, characterized in that, The control of function execution behavior based on the current trusted operating state includes: Perform level mapping based on the current operational trust status; If the current trusted operating state is greater than the first threshold, then the trusted state level is determined to be high, and the functional module is allowed to run; If the current trusted operating status is greater than the second threshold and less than the first threshold, then the trusted status level is determined to be medium, and some functional modules are allowed to run. If the current trusted operating status is greater than the third threshold and less than the second threshold, then the trusted status level is determined to be low, and the operation of the functional module is restricted. If the current trusted operating status is less than the third threshold, the trusted status level is determined to be restricted, and the operation of the functional module is prohibited.

9. A control system based on runtime trusted state, characterized in that, For use in vehicles, the control system includes: The status acquisition module is used to acquire multi-dimensional operational status information related to trustworthiness assessment. The trusted state assessment module is used to obtain the system state vector at the current moment based on the multi-dimensional operating state information; and to determine the current operating trusted state based on the system state vector through a normalization and constraint mapping function. The execution adjudication module is used to control the function execution module based on the current trusted operating state.

10. The control system according to claim 9, characterized in that, The control system further includes a policy mapping module, which is used to perform level mapping based on the current operational trust status.

Images