Verification device, verification method, and verification program

Abstract

To more appropriately perform preliminary verification of functions in a vehicle onboard device capable of executing a plurality of functions.SOLUTION: Provided is a verification device for performing preliminary verification of functions in a vehicle onboard device capable of executing a plurality of functions. The verification device comprises: a resource calculation unit for calculating the resource usable for preliminary verification of the plurality of functions; a required time calculation unit for calculating a required time when preliminary verification of the plurality of functions is performed using the resource; a selection unit which, when a scheduled completion time of preliminary verification based on the required time exceeds a time at which preliminary verification of the plurality of functions should complete, selects a function to be preliminarily verified from among the plurality of functions on the basis of the priority of each function; and a verification unit for performing preliminary verification of the function selected by the selection unit.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to a verification device, a verification method, and a verification program. [Background technology]

[0002] Conventionally, a technology for detecting malware has been developed. For example, Patent Document 1 (Publication No. 2023-24084) describes the following information processing program. That is, the information processing program generates a plurality of malware detection sandboxes in which the remaining artifacts that are left unconcealed are different among a plurality of artifacts that are traces that the operating environment is in a sandbox, executes software in each of the plurality of malware detection sandboxes, acquires an operation log indicating the operation performed by executing the software from each of the plurality of malware detection sandboxes, and causes a computer to execute a process of determining whether the software is malware or not based on a comparison result of the operation logs acquired from each of the plurality of malware detection sandboxes. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Publication No. 2023-24084 [Patent Document 2] Publication 2019-125243 [Patent Document 3] Publication No. 2017-129893 Summary of the Invention [Problem to be solved by the invention]

[0004] There is a need for a technology that goes beyond the technologies described in Patent Documents 1 to 3 and enables more appropriate advance verification of functions in an in-vehicle device capable of executing multiple functions.

[0005] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a verification device, a verification method, and a verification program that are capable of more appropriately performing pre-verification of functions in an in-vehicle device capable of executing multiple functions. [Means for solving the problem]

[0006] The verification device disclosed herein is a verification device that performs pre-verification of multiple functions in an in-vehicle device capable of executing the functions, and includes a resource calculation unit that calculates resources available for pre-verification of the multiple functions, a required time calculation unit that calculates the time required to perform pre-verification of the multiple functions using the resources calculated by the resource calculation unit, a selection unit that selects one of the multiple functions to be subject to pre-verification based on the priority of each of the functions when the estimated completion time of the pre-verification based on the required time calculated by the required time calculation unit exceeds the time at which the pre-verification of the multiple functions should be completed, and a verification unit that performs pre-verification of the function selected by the selection unit.

[0007] One aspect of the present disclosure can be realized not only as a verification device having such a characteristic processing unit, but also as a semiconductor integrated circuit that realizes part or all of the verification device, or as an in-vehicle system that includes the verification device. Effect of the Invention

[0008] According to the present disclosure, it is possible to more appropriately perform advance verification of functions in an in-vehicle device capable of executing multiple functions. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing a configuration of an in-vehicle system according to an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram illustrating a configuration of an in-vehicle ECU according to an embodiment of the present disclosure. [Diagram 3] FIG. 3 is a diagram illustrating an example of a function table stored in a storage unit in an in-vehicle ECU according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating an example of a result of prediction of a running state by a determination unit in an in-vehicle ECU according to an embodiment of the present disclosure. [Diagram 5] FIG. 5 is a flowchart defining an example of an operation procedure when the in-vehicle ECU according to the embodiment of the present disclosure performs a pre-verification of a function. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] First, the contents of the embodiments of the present disclosure will be listed and described.

[0011] (1) A verification device according to an embodiment of the present disclosure is a verification device that performs pre-verification of multiple functions in an in-vehicle device capable of executing the functions, and includes a resource calculation unit that calculates resources available for pre-verification of the multiple functions, a required time calculation unit that calculates a required time for performing pre-verification of the multiple functions using the resources calculated by the resource calculation unit, a selection unit that selects a function from the multiple functions to be subject to pre-verification based on the priority of each function when a planned completion time of the pre-verification based on the required time calculated by the required time calculation unit exceeds the time at which the pre-verification of the multiple functions should be completed, and a verification unit that performs pre-verification of the function selected by the selection unit.

[0012] With this configuration, when the scheduled completion time of the pre-verification of multiple functions is not in time for the time when the pre-verification should be completed, the functions to be verified can be selected based on the priority, so that the pre-verification of functions that are highly necessary can be prioritized using limited resources. Therefore, the pre-verification of functions can be more appropriately performed in an in-vehicle device capable of executing multiple functions.

[0013] (2) In the above (1), a function to be executed by the in-vehicle device may be associated with each driving state of the vehicle in which the in-vehicle device is installed, and the selection unit may determine the priority of each of the functions according to the driving state of the vehicle.

[0014] With this configuration, it is possible to perform advance verification of each function according to the priority according to the running state of the vehicle.

[0015] (3) In the above (2), the selection unit may determine the priority of each of the functions according to a grace period until the function corresponding to a running state of the vehicle is executed.

[0016] With this configuration, pre-verification of functions with a shorter grace period until execution can be performed preferentially, so that, for example, pre-verification of the function can be completed by the time the function is to be executed according to the vehicle's driving state.

[0017] (4) In the above (3), the selection unit may determine the priority according to a transition order of the vehicle's driving state starting from a start timing of advance verification.

[0018] With this configuration, it is possible to perform advance verification of each function according to the priority order based on the transition order of the vehicle's driving state.

[0019] (5) In any one of (1) to (4) above, the selection unit may determine the priority of the function according to a reliability of application software corresponding to the function.

[0020] With this configuration, it is possible to prioritize advance verification of application software that is less reliable and may be malware, for example.

[0021] (6) In the above (5), the selection unit may determine the priority of the function depending on whether or not a distribution source device of application software corresponding to the function has been authenticated.

[0022] With this configuration, for example, it is possible to give priority to pre-verification of application software downloaded from an unauthenticated distribution source device.

[0023] (7) In the above (5) or (6), the selection unit may determine the priority of the function depending on a communication line used to acquire application software corresponding to the function.

[0024] With this configuration, for example, it is possible to give priority to pre-verification of application software downloaded using a communication line with low security.

[0025] (8) In any one of (1) to (7) above, the selection unit may determine the priority of the functions according to the necessity of executing the functions in accordance with laws and regulations.

[0026] With this configuration, it is possible to give priority to the advance verification of functions that are highly required to be executed in compliance with regulations.

[0027] (9) In any of (1) to (8) above, a function to be executed by the in-vehicle device may be associated with each driving state of a vehicle in which the in-vehicle device is installed, and the verification unit may perform pre-verification of the function by executing the function by simulating the driving state corresponding to the function.

[0028] With such a configuration, for example, pre-verification can be performed in a virtual verification environment isolated from the execution environment of the application software, thereby preventing the application software from affecting other software if the application software is malware.

[0029] (10) In any one of (1) to (9) above, application software corresponding to at least one of the plurality of functions may be downloaded after the in-vehicle device is mounted in a vehicle.

[0030] With this configuration, for example, application software downloaded for function expansion can be verified in advance before the application software is executed.

[0031] (11) A verification method according to an embodiment of the present disclosure is a verification method in a verification device that performs pre-verification of multiple functions in an in-vehicle device capable of executing the functions, and includes the steps of calculating resources available for pre-verification of the multiple functions, calculating a required time for performing pre-verification of the multiple functions using the calculated resources, and if a scheduled completion time of the pre-verification based on the calculated required time exceeds a time at which the pre-verification of the multiple functions should be completed, selecting one of the multiple functions to be subject to pre-verification based on a priority of each of the functions, and performing pre-verification of the selected function.

[0032] With this method, when the scheduled completion time of the pre-verification of multiple functions is not in time for the time when the pre-verification should be completed, the functions to be verified can be selected based on the priority, so that the pre-verification of functions that are highly necessary can be prioritized using limited resources. Therefore, the pre-verification of functions can be more appropriately performed in an in-vehicle device capable of executing multiple functions.

[0033] (12) A verification program according to an embodiment of the present disclosure is a verification program used in a verification device that performs pre-verification of multiple functions in an in-vehicle device capable of executing the functions, and causes a computer to function as: a resource calculation unit that calculates resources available for pre-verification of the multiple functions; a required time calculation unit that calculates the time required to perform pre-verification of the multiple functions using the resources calculated by the resource calculation unit; a selection unit that selects one of the multiple functions to be subject to pre-verification based on the priority of each function if the estimated completion time of the pre-verification based on the required time calculated by the required time calculation unit exceeds the time at which the pre-verification of the multiple functions should be completed; and a verification unit that performs pre-verification of the function selected by the selection unit.

[0034] With this configuration, when the scheduled completion time of the pre-verification of multiple functions is not in time for the time when the pre-verification should be completed, the functions to be verified can be selected based on the priority, so that the pre-verification of functions that are highly necessary can be prioritized using limited resources. Therefore, the pre-verification of functions can be more appropriately performed in an in-vehicle device capable of executing multiple functions.

[0035] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and the description thereof will not be repeated. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0036] [Configuration and basic operation] Fig. 1 is a diagram showing a configuration of an in-vehicle system according to an embodiment of the present disclosure. Referring to Fig. 1, an in-vehicle system 201 includes a plurality of in-vehicle ECUs (Electronic Control Units) 101, an external vehicle communication device 121, and a relay device 151. The in-vehicle system 201 is mounted on a vehicle 1. The in-vehicle system 201 may include one in-vehicle ECU 101. The in-vehicle ECU 101 is an example of a verification device.

[0037] The on-vehicle ECU 101, the external communication device 121, and the relay device 151 configure an on-vehicle network. More specifically, the on-vehicle ECU 101 and the external communication device 121 are connected to the relay device 151 via a transmission line 10. The on-vehicle system 201 may be configured such that the relay device 151 is connected one-to-one to the on-vehicle ECU 101 and the external communication device 121 via the transmission line 10 as shown in FIG. 1, or may be configured such that the relay device 151 is connected one-to-multiple to the on-vehicle ECU 101 and the external communication device 121 via a bus-type transmission line 10. The transmission line 10 is, for example, a cable conforming to standards such as CAN (Controller Area Network) (registered trademark), FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), Ethernet (registered trademark), and LIN (Local Interconnect Network).

[0038] The relay device 151 is capable of communicating with the in-vehicle ECU 101 and the external communication device 121. The relay device 151 performs a relay process of relaying information exchanged between the in-vehicle ECUs 101 and information exchanged between the in-vehicle ECU 101 and the external communication device 121, for example.

[0039] The exterior communication device 121 communicates with devices outside the vehicle 1. For example, the exterior communication device 121 is a TCU (Telematics Communication Unit) and communicates with an Over The Air (OTA) server outside the vehicle 1.

[0040] The in-vehicle ECU 101 can execute a plurality of functions. For example, the in-vehicle ECU 101 can execute functions such as automatic door unlocking, warning when the door is opened or closed, a camera DMS (Driver Monitoring System), and a biosensor DMS. Application software corresponding to these functions is stored in the memory of the in-vehicle ECU 101. For example, the in-vehicle ECU 101 is an in-vehicle device that is retrofitted to the in-vehicle system 201 in order to expand the functions of the in-vehicle system 201.

[0041] The in-vehicle ECU 101 downloads application software corresponding to a new function, for example, in accordance with an operation by a user of the vehicle 1. For example, the in-vehicle ECU 101 downloads the application software from an OTA server. Note that the in-vehicle ECU 101 may download the application software via a wired connection from a dedicated device in a facility where maintenance of the vehicle 1 is performed.

[0042] [assignment] In recent years, as the vehicle 1 becomes more multifunctional, the opportunities for the in-vehicle ECU 101 to download application software from devices outside the vehicle 1 are increasing.

[0043] If the application software downloaded by the in-vehicle ECU 101 has been tampered with, the in-vehicle ECU 101 may execute unauthorized functions or may be remotely controlled from outside the vehicle 1.

[0044] As a measure against tampering with downloaded application software, it is possible to use techniques for detecting malware, such as those described in Patent Documents 1 to 3. However, it is not easy for the in-vehicle ECU 101 to verify multiple pieces of application software using limited resources.

[0045] Therefore, there is a need for a technology that can more appropriately perform advance verification of functions in the in-vehicle ECU 101 that can execute a plurality of functions. Therefore, the in-vehicle ECU 101 according to the embodiment of the present disclosure solves the above problems by being configured as follows.

[0046] <In-vehicle ECU101> FIG. 2 is a diagram showing a configuration of an in-vehicle ECU according to an embodiment of the present disclosure. Referring to FIG. 2, the in-vehicle ECU 101 includes a communication unit 11, an application acquisition unit 12, a determination unit 13, a verification unit 14, an execution unit 15, and a storage unit 16. The determination unit 13 is an example of a resource calculation unit, an example of a required time calculation unit, and an example of a selection unit. A part or all of the communication unit 11, the application acquisition unit 12, the determination unit 13, the verification unit 14, and the execution unit 15 are realized, for example, by a processing circuit including one or more processors. The storage unit 16 is, for example, a non-volatile memory included in the processing circuit.

[0047] 3 is a diagram showing an example of a function table stored in a storage unit in an in-vehicle ECU according to an embodiment of the present disclosure. With reference to FIG. 3, for example, functions executed by the in-vehicle ECU 101 are associated with each running state of the vehicle 1 in which the in-vehicle ECU 101 is mounted. More specifically, the storage unit 16 stores a function table T1 indicating a correspondence relationship between the running state of the vehicle 1, the functions executed by the in-vehicle ECU 101, and a verified flag indicating whether the function has been verified. In addition, the storage unit 16 stores application software corresponding to the functions of the in-vehicle ECU 101.

[0048] 2 again, the communication unit 11 communicates with the other in-vehicle ECUs 101 and the external communication device 121 via the relay device 151. More specifically, the communication unit 11 transmits and receives messages including various information to and from the other in-vehicle ECUs 101 and the external communication device 121 via the relay device 151.

[0049] The application acquisition unit 12 downloads application software corresponding to a new function, for example, in accordance with an operation of the user of the vehicle 1. For example, the application acquisition unit 12 receives application software from an OTA server outside the vehicle 1 via the exterior communication device 121, the relay device 151, and the communication unit 11, and stores the received application software in the storage unit 16. Also, for example, the application acquisition unit 12 receives application software via a wired connection from a dedicated device in a facility where maintenance is performed on the vehicle 1, and stores the received application software in memory.

[0050] When the application acquisition unit 12 stores the new application software in the storage unit 16, the application acquisition unit 12 updates the function table T1 in the storage unit 16. More specifically, the application acquisition unit 12 adds the functions executed by the new application software and the driving states corresponding to the functions to the function table T1 in association with each other.

[0051] The determination unit 13 calculates free resources that are resources that can be used for pre-verification of a plurality of functions. More specifically, when a plurality of application software whose verified flags are off is stored in the storage unit 16, for example, by the application acquisition unit 12 storing the plurality of application software in the storage unit 16, the determination unit 13 calculates a grace rate that is a value obtained by subtracting the current CPU usage rate from a predetermined allowable value of the CPU usage rate as free resources that can be used for pre-verification of the plurality of application software.

[0052] Then, the determination unit 13 calculates the time required for performing pre-verification of a plurality of functions using the calculated free resources. More specifically, the determination unit 13 calculates the verification required time Rt when the pre-verification of a plurality of application software newly stored in the storage unit 16 by the application acquisition unit 12 is performed using the calculated free resources.

[0053] For example, a verification completion time limit Lc, which is the time by which advance verification of a plurality of application software received by the application acquisition unit 12 should be completed, is determined in advance based on the reception time of the plurality of application software.

[0054] The determination unit 13 calculates a scheduled completion time of the pre-verification based on the calculated required verification time Rt, and compares the calculated scheduled completion time with the verification completion deadline Lc.

[0055] If the estimated completion time does not exceed the verification completion deadline Lc, the determination unit 13 selects all of the multiple application software received by the application acquisition unit 12 as application software to be verified. The determination unit 13 outputs verification information indicating the selected application software to be verified to the verification unit 14.

[0056] On the other hand, when the estimated completion time of the pre-verification based on the calculated verification required time Rt exceeds the verification completion deadline Lc, the determination unit 13 selects a function to be a target of pre-verification from among the multiple functions based on the priority of each function. More specifically, when the calculated estimated completion time is later than the verification completion deadline Lc, the determination unit 13 selects some of the multiple application software received by the application acquisition unit 12 as application software to be verified based on the priority of each function. The determination unit 13 outputs verification information indicating the selected application software to be verified to the verification unit 14.

[0057] For example, when the scheduled completion time exceeds the verification completion deadline Lc, the determination unit 13 calculates additional resources required to complete the pre-verification of the multiple application software received by the application acquisition unit 12 by the verification completion deadline Lc. When the additional resources can be used for pre-verification in addition to the existing free resources by stopping or degenerating application software that can be executed with no problem even if it is delayed and application software with low execution priority, among the verified application software, the determination unit 13 secures the additional resources. Then, the determination unit 13 selects all of the multiple application software received by the application acquisition unit 12 as application software to be verified.

[0058] The verification unit 14 performs pre-verification of the function selected by the determination unit 13. For example, application software corresponding to at least one of the multiple functions to be pre-verified by the verification unit 14 is downloaded by the application acquisition unit 12 after the in-vehicle ECU 101 is mounted on the vehicle 1. That is, the verification unit 14 performs pre-verification of multiple application software including the application software downloaded by the application acquisition unit 12 after the in-vehicle ECU 101 is mounted on the vehicle 1. More specifically, the verification unit 14 receives verification information from the determination unit 13, and performs pre-verification of the application software indicated by the verification information received from the determination unit 13, one by one.

[0059] For example, the verification unit 14 performs advance verification of a function by simulating a driving state corresponding to the function to be verified and executing the function.

[0060] More specifically, the storage unit 16 stores therein, for each driving state, a simulated signal that simulates a signal received from another in-vehicle ECU 101.

[0061] The verification unit 14 refers to the function table T1 in the storage unit 16 to identify a driving state corresponding to the function to be verified, and obtains a simulated signal corresponding to the identified driving state from the storage unit 16. The verification unit 14 provides the simulated signal obtained from the storage unit 16 to the application software corresponding to the function to be verified in a sandbox, which is a verification environment isolated from the execution environment of the application software.

[0062] If the operation of the application software is normal when a simulated signal is provided to the application software, the verification unit 14 determines that the application software is normal. If the verification unit 14 determines that the application software is normal, it outputs execution permission for the application software to the execution unit 15.

[0063] On the other hand, if the operation of the application software is abnormal when the simulation signal is given to the application software, the verification unit 14 determines that the application software is malware. The verification unit 14 erases the application software determined to be malware from the storage unit 16.

[0064] The execution unit 15 executes application software corresponding to the functions of the in-vehicle ECU 101. More specifically, the execution unit 15 obtains, from the storage unit 16, application software that has been permitted to be executed by the verification unit 14, and executes the obtained application software.

[0065] More specifically, the execution unit 15 determines the driving state of the vehicle 1 based on the driving speed, current position, engine operation state, etc. of the vehicle 1. Then, the execution unit 15 refers to the function table T1 in the storage unit 16, identifies a function corresponding to the determined driving state, and executes application software corresponding to the identified function.

[0066] The following describes in detail how the determining unit 13 selects application software to be verified when the scheduled completion time of advance verification exceeds the verification completion deadline Lc.

[0067] (Example 1 of selecting the verification target) The judgment unit 13 determines the priority of each function according to the reliability of the application software corresponding to the function, and selects the function to be verified based on the determined priority.

[0068] For example, the determination unit 13 determines the priority of a function depending on whether or not a distribution source device of application software corresponding to the function has been authenticated. More specifically, when the OTA server that distributes the application software received by the application acquisition unit 12 is an authenticated server, the determination unit 13 assigns the application software a priority score value Sa1 that is the priority score value Sa. On the other hand, when the OTA server that distributes the application software received by the application acquisition unit 12 is an unauthenticated server, the determination unit 13 assigns the application software a priority score value Sa2 that is a priority score value Sa higher than the priority score value Sa1.

[0069] Also, for example, the determination unit 13 determines the priority of a function according to the communication line used to acquire application software corresponding to the function. More specifically, when the application software received by the application acquisition unit 12 is application software received from a dedicated device via wired communication, the determination unit 13 assigns a priority score value Sb1, which is the priority score value Sb, to the application software. On the other hand, when the application software received by the application acquisition unit 12 is application software received from an OTA server via wireless communication, the determination unit 13 assigns a priority score value Sb2, which is a priority score value Sb higher than the priority score value Sb1, to the application software.

[0070] Also, for example, the determination unit 13 determines the priority of a function according to the necessity of executing the function in accordance with regulations. More specifically, when the application software received by the application acquisition unit 12 is not application software whose execution is mandatory in accordance with regulations, the determination unit 13 assigns the application software a priority score value Sc1 that is a priority score value Sc. On the other hand, when the application software received by the application acquisition unit 12 is application software whose execution is mandatory in accordance with regulations, the determination unit 13 assigns the application software a priority score value Sc2 that is a priority score value Sc higher than the priority score value Sc1.

[0071] The determination unit 13 calculates the sum of the priority score values ​​Sa, Sb, and Sc assigned to each of the multiple application software received by the application acquisition unit 12, and sets the priority of each application software in descending order of the sum. The determination unit 13 selects, according to the set priority, some of the multiple application software that can complete pre-verification within the verification completion deadline Lc as application software to be verified.

[0072] The determination unit 13 may be configured not to assign some of the priority scores Sa, Sb, and Sc to the application software.

[0073] Furthermore, the determination unit 13 may be configured to assign a priority score value according to a user setting to each application software, in addition to the priority score values ​​Sa, Sb, and Sc.

[0074] (Example 2 of selecting the verification target) The determination unit 13 determines the priority of each function according to the running state of the vehicle 1, and selects a function to be verified based on the determined priority. For example, the determination unit 13 determines the priority of each function according to a grace period until the function corresponding to the running state of the vehicle 1 is executed.

[0075] More specifically, the determination unit 13 predicts a transition in the driving state of the vehicle 1 based on information regarding the automatic driving of the vehicle 1, information regarding driving assistance for the vehicle 1, information regarding the navigation system of the vehicle 1, and the like.

[0076] 4 is a diagram illustrating an example of a prediction result of a driving state by a determination unit in an in-vehicle ECU according to an embodiment of the present disclosure. In the example illustrated in FIG. 4, it is assumed that the vehicle 1 is parked at a start timing ts at which the verification unit 14 starts advance verification in response to reception of application software by the application acquisition unit 12.

[0077] 4, for example, the determination unit 13 predicts that the running state of the vehicle 1 will transition from parked to running at time t1 after the start timing ts, transition from running to stopped at time t2 after time t1, and transition from stopped to running at time t3 after time t2. For example, the determination unit 13 determines that the grace time until a function corresponding to while running is longer than the grace time until a function corresponding to while parked is executed, and that the grace time until a function corresponding to while stopped is longer than the grace time until a function corresponding to while running is executed.

[0078] For example, the determination unit 13 determines the priority according to the transition order of the traveling state of the vehicle 1 starting from the start timing ts of the pre-verification.

[0079] More specifically, the judgment unit 13 refers to the function table T1 in the memory unit 16 to identify a function corresponding to the driving state, which is parked, at the start timing ts, and assigns a priority score value Sd1, which is the priority score value Sd, to the application software corresponding to the identified function.

[0080] In addition, the judgment unit 13 refers to the function table T1 in the memory unit 16 to identify a function corresponding to the next driving state while parked, which is driving, and assigns a priority score value Sd2, which is a priority score value Sd lower than the priority score value Sd1, to the application software corresponding to the identified function.

[0081] In addition, the judgment unit 13 refers to the function table T1 in the memory unit 16 to identify a function corresponding to the next driving state while driving, which is being stopped, and assigns a priority score value Sd3, which is a priority score value Sd lower than the priority score value Sd2, to the application software corresponding to the identified function.

[0082] The determination unit 13 sets a priority order for each of the multiple application software in descending order of the priority score value Sd assigned to each of the multiple application software received by the application acquisition unit 12. The determination unit 13 selects, according to the set priority order, some of the multiple application software that can complete pre-verification within the verification completion deadline Lc, as application software to be verified.

[0083] The determination unit 13 may perform one of the above-mentioned "Verification Target Selection Example 1" and "Verification Target Selection Example 2", or may perform both. When performing both "Verification Target Selection Example 1" and "Verification Target Selection Example 2", the determination unit 13 assigns priority score values ​​Sa, Sb, Sc, and Sd to the multiple application software received by the application acquisition unit 12, respectively, and sets the priority order of each application software in descending order of the sum of the priority score values ​​Sa, Sb, Sc, and Sd.

[0084] (Variations in the selection of the verification target) If the verification completion deadline Lc is not determined in advance, the determination unit 13 sets the verification completion deadline Lc based on the predicted transition of the traveling state of the vehicle 1.

[0085] More specifically, the judgment unit 13 sets the time t1 at which the driving state of vehicle 1 transitions from parked to driving as the verification completion deadline Lc1, which is the verification completion deadline Lc, sets the time t2 at which the driving state of vehicle 1 transitions from driving to stopped as the verification completion deadline Lc2, which is the verification completion deadline Lc, and sets the time t3 at which the driving state of vehicle 1 transitions from stopped to driving as the verification completion deadline Lc3, which is the verification completion deadline Lc.

[0086] In addition, the judgment unit 13 refers to the function table T1 in the memory unit 16 and calculates the verification required time Rta, which is the verification required time Rt when pre-verification of application software corresponding to parking among the multiple application software newly stored in the memory unit 16 by the application acquisition unit 12 is performed using the calculated free resources.

[0087] In addition, the judgment unit 13 refers to the function table T1 in the memory unit 16 and calculates a verification required time Rtb, which is the verification required time Rt when pre-verification of application software that corresponds to the time during driving among the multiple application software newly stored in the memory unit 16 by the application acquisition unit 12 is performed using the calculated free resources.

[0088] In addition, the judgment unit 13 refers to the function table T1 in the memory unit 16 and calculates a verification required time Rtc, which is the verification required time Rt when pre-verification of application software corresponding to the vehicle being stopped among the multiple application software newly stored in the memory unit 16 by the application acquisition unit 12 is performed using the calculated free resources.

[0089] The determination unit 13 calculates an estimated completion time of the pre-verification of application software corresponding to while parked based on the calculated verification required time Rta, and compares the calculated estimated completion time with the verification completion deadline Lc1. If the calculated estimated completion time exceeds the verification completion deadline Lc1, the determination unit 13 selects, based on the above-mentioned priority score value, some of the application software corresponding to while parked received by the application acquisition unit 12 as application software to be verified.

[0090] Furthermore, the determination unit 13 calculates an estimated completion time of the pre-verification of application software corresponding to while driving based on the calculated verification required time Rtb, and compares the calculated estimated completion time with the verification completion deadline Lc2. If the calculated estimated completion time exceeds the verification completion deadline Lc2, the determination unit 13 selects, based on the above-mentioned priority score value, some of the multiple application software corresponding to while driving received by the application acquisition unit 12 as application software to be verified.

[0091] Furthermore, the determination unit 13 calculates an estimated completion time of the advance verification of application software corresponding to the vehicle being stopped based on the calculated verification required time Rtc, and compares the calculated estimated completion time with the verification completion deadline Lc3. If the calculated estimated completion time exceeds the verification completion deadline Lc3, the determination unit 13 selects, based on the above-mentioned priority score value, some of the multiple application software corresponding to the vehicle being stopped received by the application acquisition unit 12 as application software to be verified.

[0092] [Operation flow] 5 is a flowchart showing an example of an operation procedure when the in-vehicle ECU according to the embodiment of the present disclosure performs a function pre-verification. The in-vehicle ECU 101 executes the process of the flowchart shown in FIG. 5 every time the in-vehicle ECU 101 downloads one or more pieces of application software.

[0093] 5, first, the in-vehicle ECU 101 calculates free resources available for the advance verification of a plurality of functions. More specifically, the in-vehicle ECU 101 calculates a grace rate, which is a value obtained by subtracting a current CPU utilization rate from a predetermined allowable value of the CPU utilization rate, as free resources available for the advance verification of a plurality of application software corresponding to the plurality of functions (step S11).

[0094] Next, the in-vehicle ECU 101 calculates a required verification time Rt when the advance verification of the plurality of application software is performed using the calculated free resources (step S12).

[0095] Next, the in-vehicle ECU 101 calculates a scheduled completion time of the pre-verification based on the calculated required verification time Rt (step S13).

[0096] Next, the in-vehicle ECU 101 compares the calculated scheduled completion time with the verification completion deadline Lc (step S14).

[0097] Next, if the scheduled completion time does not exceed the verification completion deadline Lc (YES in step S15), the in-vehicle ECU 101 selects all of the plurality of application software as application software to be verified (step S16).

[0098] On the other hand, if the scheduled completion time exceeds the verification completion deadline Lc (NO in step S15), the in-vehicle ECU 101 selects some of the multiple application software received by the application acquisition unit 12 as application software to be verified based on the priority of each function (step S17).

[0099] Next, the in-vehicle ECU 101 performs a pre-verification of the selected application software (step S18).

[0100] In the in-vehicle ECU 101 according to the embodiment of the present disclosure, the determination unit 13 is configured to secure additional resources in addition to existing free resources when the scheduled completion time exceeds the verification completion deadline Lc, but this is not limited thereto. The determination unit 13 may be configured not to secure additional resources.

[0101] In addition, in the in-vehicle ECU 101 according to the embodiment of the present disclosure, the determination unit 13 is configured to determine the priority of each function according to the grace period until the function corresponding to the driving state of the vehicle 1 is executed, but this is not limited to this. The determination unit 13 may be configured to determine the priority of a function according to the driving state corresponding to the function, regardless of the grace period.

[0102] In addition, in the in-vehicle ECU 101 according to the embodiment of the present disclosure, the determination unit 13 is configured to determine the priority according to the transition order of the driving state of the vehicle 1 starting from the pre-verification start timing ts, but this is not limited to the above. The determination unit 13 may be configured to determine the priority of a function according to the driving state corresponding to the function, regardless of the transition order of the driving state of the vehicle 1.

[0103] In addition, in the in-vehicle ECU 101 according to the embodiment of the present disclosure, the verification unit 14 is configured to perform advance verification of a function by simulating a driving state corresponding to the function to be verified and executing the function, but this is not limited to this. The verification unit 14 may be configured to perform advance verification of a function by executing application software to be verified in an execution environment of the application software.

[0104] Furthermore, in the in-vehicle ECU 101 according to the embodiment of the present disclosure, the verification unit 14 is configured to perform advance verification of a plurality of application software including application software downloaded by the application acquisition unit 12 after the in-vehicle ECU 101 is mounted on the vehicle 1, but this is not limited to the above. The verification unit 14 may be configured to perform advance verification of a plurality of application software stored in the storage unit 16 before the in-vehicle ECU 101 is mounted on the vehicle 1, instead of a plurality of application software downloaded by the application acquisition unit 12 after the in-vehicle ECU 101 is mounted on the vehicle 1.

[0105] In addition, in the in-vehicle system 201 according to the embodiment of the present disclosure, the in-vehicle ECU 101 is configured to perform advance verification of functions in the in-vehicle ECU 101, but this is not limited thereto. The in-vehicle ECU 101 may be configured to perform advance verification of functions in other in-vehicle ECUs 101 as a verification device. Also, a device different from the in-vehicle ECU 101 may be configured to perform advance verification of functions in the in-vehicle ECU 101 as a verification device.

[0106] The above-described embodiments should be considered as illustrative and not restrictive in all respects. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0107] Each process (each function) of the above-mentioned embodiment is realized by a processing circuit (circuitry) including one or more processors. The above-mentioned processing circuit may be composed of an integrated circuit or the like in which one or more memories, various analog circuits, and various digital circuits are combined in addition to the above-mentioned one or more processors. The above-mentioned one or more memories store programs (instructions) that cause the above-mentioned one or more processors to execute each of the above-mentioned processes. The above-mentioned one or more processors may execute each of the above-mentioned processes according to the programs read from the above-mentioned one or more memories, or may execute each of the above-mentioned processes according to a logic circuit designed in advance to execute each of the above-mentioned processes. The above-mentioned processors may be various processors suitable for computer control, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit). The above-mentioned physically separated processors may execute each of the above-mentioned processes in cooperation with each other. For example, the processors mounted on each of a plurality of physically separated computers may cooperate with each other via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, etc. The program may be installed in the memory from an external server device or the like via the network, or may be distributed in a state stored in a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and installed in the memory from the recording medium.

[0108] The above description includes the following additional features. [Appendix 1] A verification device that performs advance verification of a plurality of functions in an in-vehicle device capable of executing the functions, a resource calculation unit that calculates resources available for advance verification of the plurality of functions; a required time calculation unit that calculates a required time when the advance verification of the plurality of functions is performed using the resources calculated by the resource calculation unit; a selection unit that selects the function to be a target of pre-verification from among the plurality of functions based on a priority of each of the functions when a scheduled completion time of the pre-verification based on the required time calculated by the required time calculation unit exceeds a time at which the pre-verification of the plurality of functions should be completed; a verification unit that performs a pre-verification of the function selected by the selection unit, The selection unit sets a time for completing the advance verification of the plurality of functions based on a prediction result of a transition of a vehicle's running state.

[0109] [Appendix 2] A verification device that performs advance verification of a plurality of functions in an in-vehicle device capable of executing the functions, A processing circuit is provided, The processing circuitry includes: Calculating resources available for pre-verification of the plurality of functions; Calculating a required time for performing a pre-verification of the plurality of functions using the calculated resources; if a scheduled completion time of the pre-verification based on the calculated required time exceeds a time at which the pre-verification of the plurality of functions should be completed, selecting the function to be a target of the pre-verification from among the plurality of functions based on a priority of each of the functions; A verification device performs a pre-verification of the selected function. [Explanation of symbols]

[0110] 1 vehicle 10 Transmission Lines 11 Communications Department 12 App Acquisition Department 13 Judgment section 14 Verification Department 15 Executive Department 16 Memory section 101 Automotive ECU 121 External communication device 151 Relay Device 201 In-vehicle systems T1 Feature Table

Claims

1. A verification device that performs advance verification of a plurality of functions in an in-vehicle device capable of executing the functions, a resource calculation unit that calculates resources available for advance verification of the plurality of functions; a required time calculation unit that calculates a required time when the advance verification of the plurality of functions is performed using the resources calculated by the resource calculation unit; a selection unit that selects the function to be a target of pre-verification from among the plurality of functions based on a priority of each of the functions when a scheduled completion time of the pre-verification based on the required time calculated by the required time calculation unit exceeds a time at which the pre-verification of the plurality of functions should be completed; a verification unit that performs a pre-verification of the function selected by the selection unit.

2. A function to be executed by the in-vehicle device is associated with each driving state of a vehicle in which the in-vehicle device is installed, The verification device according to claim 1 , wherein the selection unit determines the priority of each of the functions depending on a running state of the vehicle.

3. The verification device according to claim 2 , wherein the selection unit determines the priority of each of the functions according to a grace period until the function corresponding to the running state of the vehicle is executed.

4. The verification device according to claim 3 , wherein the selection unit determines the priority according to a transition order of the vehicle's traveling state from a start timing of the advance verification.

5. The verification device according to claim 1 , wherein the selection unit determines the priority of the function depending on a reliability of application software corresponding to the function.

6. The verification device according to claim 5 , wherein the selection unit determines the priority of the function depending on whether or not a distributor of application software corresponding to the function has been authenticated.

7. The verification device according to claim 5 , wherein the selection unit determines the priority of the function depending on a communication line used to acquire application software corresponding to the function.

8. The verification device according to claim 1 , wherein the selection unit determines the priority of the functions according to a necessity for execution of the functions in accordance with a law.

9. A function to be executed by the in-vehicle device is associated with each driving state of a vehicle in which the in-vehicle device is installed, The verification device according to claim 1 , wherein the verification unit performs advance verification of the function by simulating a driving state corresponding to the function and executing the function.

10. 5. The verification device according to claim 1, wherein application software corresponding to at least one of the plurality of functions is downloaded after the in-vehicle device is mounted on a vehicle.

11. A verification method for a verification device that performs advance verification of a plurality of functions of an in-vehicle device capable of executing the functions, comprising: calculating resources available for pre-verification of the plurality of functions; calculating a required time when performing advance verification of the plurality of functions using the calculated resources; selecting, from the plurality of functions, a function to be a target of pre-verification based on a priority of each of the functions, when a scheduled completion time of the pre-verification based on the calculated required time exceeds a time to complete the pre-verification of the plurality of functions; and performing a pre-verification of the selected function.

12. A verification program used in a verification device that performs advance verification of a plurality of functions in an in-vehicle device capable of executing the functions, comprising: Computer, a resource calculation unit that calculates resources available for advance verification of the plurality of functions; a required time calculation unit that calculates a required time when the advance verification of the plurality of functions is performed using the resources calculated by the resource calculation unit; a selection unit that selects the function to be a target of pre-verification from among the plurality of functions based on a priority of each of the functions when a scheduled completion time of the pre-verification based on the required time calculated by the required time calculation unit exceeds a time at which the pre-verification of the plurality of functions should be completed; a verification unit that performs a pre-verification of the function selected by the selection unit; A verification program to ensure that the system functions as a

Images