Vehicle information processing device

Abstract

To detect falsification of an application.SOLUTION: An unprotected region 13B of a storage 13 stores a monitoring application P1. The protected region 13A of the storage 13 stores a duplicated application P2, duplication of the monitoring application P1 when the same is stored in the unprotected region 13B. A CPU 11: stores reproduction of a source code included in the monitoring application P1 in a RAM 15 as first data on the basis of an execution signal of the monitoring application P1; executes the monitoring application P1 on the basis of the first data; stores reproduction of a source code included in the duplicated monitoring application P2 in the RAM 15 as second data on the basis of the execution signal; and stops execution of the monitoring application P1 when discrepancy is detected as a result of comparing the first data with the second data during the execution of the monitoring application P1.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing device for a vehicle. [Background technology]

[0002] The information processing device disclosed in Patent Document 1 includes a memory. The memory includes a protected area. Access to the protected area is restricted. The protected area is protected from unauthorized access. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2023-047265 A Summary of the Invention [Problem to be solved by the invention]

[0004] Even if access to memory is restricted as in Patent Document 1, there is still a risk that an application stored in the memory may be tampered with if the memory is accessed illegally from outside. If an application is tampered with, the application may execute inappropriate processing. To prevent such a situation, a technology is required to detect tampering when an application is tampered with. [Means for solving the problem]

[0005] An information processing device for a vehicle for solving the above problems includes an execution unit, a first storage unit storing an application executable by the execution unit, and a second storage unit temporarily storing data generated when the execution unit executes the application, the first storage unit having a protected area in which specific access authority is required for writing and a non-protected area in which the specific access authority is not required for writing, the non-protected area storing a monitoring application to be monitored, the protected area storing a copied application obtained by copying the monitoring application at the time it was stored in the non-protected area, and when the execution unit acquires an execution signal for the monitoring application, The method includes: based on an execution signal, storing a copy of source code included in the monitoring application stored in the unprotected area as first data in the second storage unit, and executing the monitoring application based on the first data stored in the second storage unit; based on the execution signal, storing a copy of source code included in the copied application stored in the protected area as second data in the second storage unit; comparing the first data and the second data stored in the second storage unit during execution of the monitoring application; and stopping execution of the monitoring application if an inconsistency is detected between the first data and the second data. Effect of the Invention

[0006] The above technical concept makes it possible to detect tampering with monitoring applications. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a schematic diagram of a vehicle. [Diagram 2] FIG. 2 is a flowchart showing the procedure of the monitoring process. [Diagram 3] FIG. 3 is a diagram showing a schematic diagram of the processes in steps S100 and S110. [Figure 4] FIG. 4 is a diagram showing a schematic diagram of the process of step S210. [Diagram 5] FIG. 5 is a diagram showing a schematic diagram of the process of step S220. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, an embodiment of an information processing device for a vehicle will be described with reference to the drawings. <Overall vehicle configuration> As shown in FIG. 1, the vehicle 100 includes a general control device 10 and a plurality of specific control devices 90. The general control device 10 is a control device that controls the entire vehicle 100 in a general manner. Each specific control device 90 is a control device that controls a specific one of the plurality of in-vehicle devices 92. Note that FIG. 1 shows three of the plurality of in-vehicle devices 92 as representatives. One of the plurality of in-vehicle devices 92 is an engine that serves as a driving source for the vehicle 100. One of the plurality of in-vehicle devices 92 is a brake device that applies a braking force to the vehicle 100. One of the plurality of in-vehicle devices 92 is a steering device that adjusts the steering angle of the vehicle 100. One of the plurality of in-vehicle devices 92 is a touch panel display. The display is located in the cabin of the vehicle 100. There are many other in-vehicle devices 92. The general control device 10 and the plurality of specific control devices 90 can communicate with each other via an external bus 95.

[0009] The vehicle 100 includes a plurality of information acquisition devices 61. FIG. 1 shows one of the plurality of information acquisition devices 61 as a representative. The information acquisition devices 61 include devices that detect the running state of the vehicle 100. An example of this type of information acquisition device 61 is a vehicle speed sensor that detects the running speed of the vehicle 100. The information acquisition devices 61 include devices that detect peripheral information or position information of the vehicle 100. An example of this type of information acquisition device 61 is a camera that captures images of the surroundings of the vehicle 100. An example of this type of information acquisition device 61 is a position receiver that receives information related to the current position coordinates of the vehicle 100 from a global positioning satellite. Each information acquisition device 61 outputs the information acquired by itself to the integrated control device 10.

[0010] The vehicle 100 is equipped with an operation switch 62. The operation switch 62 is located within the cabin of the vehicle 100. For example, the operation switch 62 is provided on a steering wheel. The operation switch 62 and the display constitute an input device. Each input device outputs information according to an operation by an occupant to the overall control device 10. The occupant can input various instructions to the overall control device 10 through each input device. An example of the various instructions is an instruction regarding the execution of an application described below.

[0011] The overall control device 10 is an information processing device for the vehicle 100. The overall control device 10 includes a CPU 11, a storage 13, a RAM 15, and a communication module 17. The CPU 11 is an execution unit. The storage 13 is an electrically rewritable non-volatile memory. The storage 13 is a first storage unit. The storage 13 prestores various programs in which processes to be executed by the CPU 11 are described, and various data required for the CPU 11 to execute the programs. An example of a program stored in the storage 13 is an application for realizing control or management of the vehicle 100. That is, the storage 13 stores a plurality of applications executable by the CPU 11. The application includes source code, which is a command statement describing the process content. In addition, a pre-assigned ID is attached to the application. The RAM 15 is a volatile memory. The RAM 15 is a second storage unit. The RAM 15 temporarily stores data generated when the CPU 11 executes the application. The communication module 17 is a communication circuit for wirelessly communicating with the outside via an external communication line network. The CPU 11, the storage 13, the RAM 15, and the communication module 17 can communicate with each other via an internal bus 19.

[0012] <Storage details> The storage 13 includes a protected area 13A, a non-protected area 13B, and another area 13C. These three storage areas are assigned to the storage 13 in advance at the time of shipping the vehicle 100. The protected area 13A is a storage area that requires a specific access authority to write to the protected area 13A. The specific access authority in this embodiment is an administrator authority. That is, the protected area 13A can be written only when an operator at a dealer or the like causes the CPU 11 to execute a process with the administrator authority. To cause the CPU 11 to execute a process with the administrator authority, the operator needs to input a specific password to the integrated control device 10 from outside the integrated control device 10. The administrator authority is an authority that allows almost all processes in the integrated control device 10, and is sometimes called a root authority. The non-protected area 13B is a storage area that does not require the specific access authority to write to the non-protected area 13B. However, the non-protected area 13B can be written to only when the CPU 11 functions as a specific function unit that is determined in advance. The specific functional unit in this embodiment is the management unit 11B described later. In this way, the non-protected area 13B is also given a predetermined access authority for writing. By giving the access authority, not only the protected area 13A but also the non-protected area 13B is prevented from unauthorized access from the outside. The protected area 13A has a higher security level than the non-protected area 13B in that a password must be input from the outside when writing. The other area 13C is a storage area in which the CPU 11 can freely write at any time. The difference in size of each storage area of ​​the storage 13 shown in FIG. 1 does not reflect the difference in the capacity actually assigned to each storage area, but is for convenience.

[0013] The non-protected area 13B stores a plurality of monitoring applications P1. In FIG. 1, one of the plurality of monitoring applications P1 is shown as a representative. The monitoring application P1 is an application that is determined as a monitoring target for tampering caused by unauthorized access from the outside. The protected area 13A stores a plurality of copied applications P2. In FIG. 1, one of the plurality of copied applications P2 is shown as a representative. The copied application P2 is a copy of the monitoring application P1 at the time of storing it in the non-protected area 13B. The protected area 13A stores a copied application P2 for each monitoring application P1 stored in the non-protected area 13B. Here, when a new application is added, for example, at a dealer, the CPU 11 performs the following addition process with administrator authority in response to an instruction from an operator. In the addition process, the CPU 11 stores the new application in the non-protected area 13B as the monitoring application P1. The CPU 11 also generates a copy of the monitoring application P1 as the copied application P2. Then, the CPU 11 stores the generated copied application P2 in the protected area 13A. By performing such an addition process, the CPU 11 stores a pair of the monitoring application P1 and the copied application P2 in the unprotected area 13B and the protected area 13A.

[0014] In this embodiment, the plurality of monitoring applications P1 stored in the non-protected area 13B are applications for controlling the movement of the vehicle 100. Specifically, one of the plurality of monitoring applications P1 is an AD (Autonomous Driving) application that realizes an autonomous driving function for causing the vehicle 100 to autonomously drive without driver operation. The plurality of monitoring applications P1 include applications for realizing the functions of an advanced driver assistance system that supports driver operations. Examples of this type of application include a so-called LKA (Lane Keeping Assist) application for maintaining a lane and a so-called ACC (Adaptive Cruise Control) application for keeping a constant inter-vehicle distance from the preceding vehicle.

[0015] <Processing content of the CPU> The CPU 11 functions as a request unit 11A that requests execution of the monitoring application P1. Further, the CPU 11 functions as a management unit 11B that executes the monitoring application P1 in response to a request from the request unit 11A and detects forgery of the monitoring application P1.

[0016] Based on the information from the information acquisition device 61 and the input device, the request unit 11A outputs an execution signal for the monitoring application P1 that needs to be executed at the current time as needed. This execution signal reflects the ID of the monitoring application P1 to be executed and the information on the required processing content. When the management unit 11B acquires the execution signal output by the request unit 11A, it starts the monitoring process. The monitoring process is a process of monitoring the presence or absence of forgery of the monitoring application P1 while executing the requested monitoring application P1. Note that after outputting the execution signal, the request unit 11A outputs an end signal when it becomes a situation where the monitoring application P1 should end. Similar to the case of outputting the execution signal, the request unit 11A outputs an end signal based on the information from the information acquisition device 61 and the input device.

[0017] As shown in FIG. 2, when the management unit 11B starts the monitoring process, it first executes the process of step S100. In step S100, the management unit 11B grasps the monitoring application P1 to be executed based on the execution signal. Then, the management unit 11B identifies the monitoring application P1 to be executed from among the multiple monitoring applications P1 stored in the non-protected area 13B. Then, the management unit 11B generates a copy of the source code included in this monitoring application P1. Then, as shown in FIG. 3, the management unit 11B stores the generated copy in the RAM 15 as the first data D1. In FIGS. 3 to 5, the other area 13C is omitted from the illustration. Note that one monitoring application P1 basically takes charge of multiple processes. In relation to this, when generating the first data D1, the management unit 11B generates a copy of the source code of the necessary part corresponding to the currently required process grasped from the execution signal. As shown in FIG. 2, after storing the first data D1 in the RAM 15, the management section 11B advances the process to step S110.

[0018] In step S110, the management unit 11B performs the same process as in step S100 on the duplicated application P2 stored in the protection area 13A. That is, the management unit 11B grasps the duplicated application P2 paired with the monitoring application P1 to be executed based on the execution signal. Then, the management unit 11B identifies this duplicated application P2 from among the duplicated applications P2 stored in the protection area 13A. Then, the management unit 11B generates a duplicate of the source code included in the identified duplicated application P2 as the second data D2. At this time, the management unit 11B generates the second data D2 on the source code of the necessary part corresponding to the currently required process grasped from the execution signal, similar to the process of step S100. Then, as shown in FIG. 3, the management unit 11B stores the generated second data D2 in the RAM 15. As shown in FIG. 2, when the management unit 11B stores the second data D2 in the RAM 15, the process proceeds to step S120. The following can be said about the first data D1 generated in step S100 and the second data D2 generated in step S110: The first data D1 and the second data D2 generated based on the same execution signal are copies of the same portion of source code in the paired monitoring application P1 and duplicated application P2.

[0019] In step S120, the management unit 11B starts the execution of the monitoring application P1 to be executed. When executing the monitoring application P1, the management unit 11B refers to the first data D1 stored in the RAM 15 in step S100. That is, the management unit 11B executes the monitoring application P1 based on the first data D1. During the execution of the monitoring application P1, the management unit 11B repeatedly outputs a control signal corresponding to the execution of the monitoring application P1 to be executed to each required in-vehicle device 92. Specifically, the management unit 11B generates a control signal for each in-vehicle device 92 to be operated according to the description content of the first data D1 stored in the RAM 15 in step S100. Then, the management unit 11B transmits the generated control signal to the specific control device 90 that controls each in-vehicle device 92. This is substantially equivalent to outputting a control signal to each in-vehicle device 92. The management unit 11B repeats the output of the control signal to each specific control device 90 in a predetermined first period. When the management section 11B starts the execution of the monitoring application P1, the process proceeds to step S130.

[0020] In step S130, the management unit 11B compares the first data D1 and the second data D2 stored in the RAM 15. At this time, the management unit 11B compares all of the first data D1 with all of the second data D2. Then, the management unit 11B determines whether or not the first data D1 and the second data D2 completely match. If the first data D1 and the second data D2 completely match (step S130: YES), the management unit 11B advances the process to step S140.

[0021] In step S140, the management unit 11B judges whether or not an end signal has been acquired from the request unit 11A. When the management unit 11B has acquired an end signal (step S140: YES), the management unit 11B stops the execution of the monitoring application P1 in step S150 and then terminates the series of processes of the monitoring process. At this time, the management unit 11B deletes the first data D1 and the second data D2 stored in the RAM 15. On the other hand, when the management unit 11B has not acquired an end signal (step S140: NO), the management unit 11B returns to the process of step S130. Then, the management unit 11B executes the process of step S130 again. When the determination of step S130 is YES and the determination of step S140 continues to be NO, the management unit 11B repeats the processes of step S130 and step S140. At this time, the cycle in which the management unit 11B repeats the process of step S130 is set to a second cycle. The second cycle is predetermined to be shorter than the above-mentioned first cycle.

[0022] Now, in step S130, if the management section 11B detects a mismatch between the first data D1 and the second data D2 (step S130: NO), the process proceeds to step S200.

[0023] In step S200, the management unit 11B stops the execution of the monitoring application P1. The management unit 11B also stores the comparison result obtained in step S130 in the other area 13C of the storage 13. Furthermore, the management unit 11B notifies via the display that the execution of the monitoring application P1 will be stopped in relation to the detection of tampering. After this, the management unit 11B advances the process to step S210.

[0024] In step S210, the management unit 11B deletes the monitoring application P1 that was targeted for execution in step S120 from among the multiple monitoring applications P1 stored in the unprotected area 13B of the storage 13, as shown in Fig. 4. The management unit 11B also deletes the first data D1 and the second data D2 stored in the RAM 15. Thereafter, as shown in Fig. 2, the management unit 11B advances the process to step S220.

[0025] In step S220, the management unit 11B stores a new monitoring application P1 in the non-protected area 13B of the storage 13, replacing the monitoring application P1 deleted in step S210. Specifically, the management unit 11B generates a copy of the copied application P2 identified in step S110 among the multiple copied applications P2 stored in the protected area 13A of the storage 13. That is, the management unit 11B generates a copy of the copied application P2 that was paired with the monitoring application P1 that was the execution target in step S120. Then, as shown in FIG. 5, the management unit 11B stores the generated copy in the non-protected area 13B as a new monitoring application P1X. Furthermore, the management unit 11B performs various settings, such as setting a flag, so that the new monitoring application P1X can be read and processed when an execution signal is acquired from the next time onwards. Then, the management unit 11B ends a series of processes of the monitoring process. Thereafter, the management unit 11B enables the settings made in step S220, for example by restarting the overall control device 10. Note that, for convenience, in Fig. 5, the new monitoring application is indicated as "P1X" to distinguish it from the monitoring application P1 shown in Fig. 4, but the new monitoring application P1X is the same as the monitoring application P1 before the tampering.

[0026] Here, in the above monitoring process, after the process of step S120, the determination of S130 for the first time may become NO and the process may proceed to step S200. In this case, the management unit 11B is set to proceed with the process as follows for a series of processes from step S120 to step S200. That is, after starting the execution of the monitoring application P1 in step S120, the management unit 11B promptly proceeds with the process from step S130 to step S200 before the first control signal is output. Then, the management unit 11B stops the execution of the monitoring application P1 in step S200 before the first control signal is output.

[0027] <Operation of the embodiment> Now, it is assumed that the management unit 11B has acquired an execution signal targeted at a certain specific monitoring application P1. Then, it is assumed that the management unit 11B has started a monitoring process. Then, the management unit 11B executes the specific monitoring application P1 (step S120) and compares the first data D1 with the second data D2 (step S130). Then, when the management unit 11B detects a mismatch between the first data D1 and the second data D2 (step S130: NO), it stops the execution of the specific monitoring application P1 (step S200) and deletes the specific monitoring application P1 (step S210). Then, the management unit 11B stores a new monitoring application P1X obtained by duplicating the duplicated application P2 in the unprotected area 13B of the storage 13 (step S220). Then, the management unit 11B ends the monitoring process. When the management unit 11B subsequently acquires an execution signal targeting the specific monitoring application P1 again, it performs the monitoring process again with the new monitoring application P1X generated in the previous monitoring process as the execution target.

[0028] <Effects of the embodiment> (1) The protected area 13A of the storage 13 has a higher security level than the non-protected area 13B in that it requires the above-mentioned specific access authority. Therefore, the possibility that the duplicated application P2 stored in the protected area 13A is tampered with due to unauthorized access from the outside is low. Now, the monitoring application P1 and the duplicated application P2 are the same. Therefore, the first data D1 and the second data D2 generated based on the same execution signal in the monitoring process should also have the same contents. Then, if an inconsistent portion between the first data D1 and the second data D2 is detected during the execution of the monitoring application P1, it is highly likely that the following has occurred. That is, it is highly likely that the monitoring application P1 was tampered with in the non-protected area 13B at a stage before the execution of the monitoring application P1, and the first data D1 generated from the monitoring application P1 had an inconsistent portion with the second data D2. In this embodiment, such tampering of the monitoring application P1 in the non-protected area 13B can be detected along with the execution of the monitoring application P1.

[0029] (2) As described above, the possibility that the copied application P2 stored in the protected area 13A is tampered with is low. Therefore, even if the monitoring application P1 stored in the unprotected area 13B is tampered with, the copied application P2 stored in the protected area 13A is likely to maintain the contents of the monitoring application P1 before the tampering.

[0030] Therefore, in this embodiment, when a mismatch is detected between the first data D1 and the second data D2 during execution of the monitoring application P1, a copy of the copied application P2 is generated as a new monitoring application P1X, thereby restoring the monitoring application P1 to its pre-tampered state.

[0031] (3) As for tampering with the monitoring application P1, in addition to tampering with the monitoring application P1 stored in the non-protected area 13B, tampering with the first data D1 temporarily stored in the RAM 15 during the monitoring process may also be considered. In this regard, in this embodiment, the first data D1 and the second data D2 are repeatedly compared during the execution of the monitoring application P1. If a mismatch between the first data D1 and the second data D2 is detected during this repetition, tampering with the first data D1 or the second data D2 is suspected. That is, in this embodiment, even if tampering is performed on the first data D1 or the second data D2 during the execution of the monitoring application P1, these tamperings can be detected. Moreover, in this embodiment, the comparison between the first data D1 and the second data D2 is repeated in a second period that is shorter than the first period, which is the output period of the control signal. Therefore, even if the first data D1 referred to by the management unit 11B during the execution of the monitoring application P1 is tampered with, the tampering can be detected before the output timing of the control signal and the execution of the monitoring application P1 can be stopped. Therefore, it is possible to prevent a control signal with an incorrect content from being output due to the first data D1 being tampered with.

[0032] As described above, the second data D2 stored in the RAM 15 may be tampered with. If the second data D2 is tampered with, it becomes impossible to appropriately detect the tampering by comparing the first data D1 with the second data D2. In this embodiment, when a mismatch is detected between the first data D1 and the second data D2, the execution of the monitoring application P1 is stopped at that point. Therefore, the execution of the monitoring application P1 is not continued in a situation where the tampering cannot be detected.

[0033] (4) In this embodiment, when the first data D1 and the second data D2 are compared, all of the first data D1 and all of the second data D2 are compared, which makes it possible to reliably detect each of the above-mentioned tamperings.

[0034] (5) In this embodiment, one of the multiple monitoring applications P1 is an AD application. If this AD application is tampered with, the traveling of the vehicle 100 cannot be appropriately controlled while the AD application is being executed. In this regard, if the AD application is executed through the monitoring process of this embodiment, it is possible to prevent inappropriate control of the vehicle 100 due to tampering. While the AD application is being executed, the traveling of the vehicle 100 is entirely entrusted to the AD application. Therefore, it is particularly important to prevent inappropriate control when executing the AD application.

[0035] <Example of change> The above embodiment can be modified as follows: The above embodiment and the following modifications can be combined with each other to the extent that no technical contradiction occurs.

[0036] The method of defining the access authority for the protected area 13A and the unprotected area 13B is not limited to the example of the above embodiment. As long as the condition that writing to the unprotected area 13B is possible without the need for a specific access authority set in the protected area 13A is satisfied, the method of defining the access authority can be changed as appropriate. Furthermore, it is sufficient that the security level of the protected area 13A is higher than that of the unprotected area 13B due to such access authority.

[0037] The monitoring application P1 is not limited to an application that controls the movement of the vehicle 100. For example, the monitoring application P1 may be an application that controls a navigation system or an application that provides entertainment to the passengers.

[0038] In the process of step S130, it is not necessary to compare all of the first data D1 with all of the second data D2. In other words, in the process of step S130, a part of the first data D1 may be compared with a part of the second data D2. Even in this case, it is sufficient to compare corresponding parts of the first data D1 and the second data D2.

[0039] The second cycle, which is the cycle for repeating the process of step S130, may be longer than the first cycle. It is not essential to periodically compare the first data D1 with the second data D2. The content of the monitoring process may be changed so that the comparison between the first data D1 and the second data D2 is performed at random timing while the monitoring application P1 is being executed. It is sufficient to compare the first data D1 with the second data D2 one or more times while the monitoring application P1 is being executed.

[0040] When an inconsistency is detected between the first data D1 and the second data D2, it is not necessary to generate a new monitoring application P1X by duplicating the duplicated application P2. When an inconsistency is detected between the first data D1 and the second data D2, it is sufficient to simply stop the running monitoring application P1.

[0041] The overall configuration of the vehicle 100 is not limited to the example of the above embodiment. For example, a motor may be used as an in-vehicle device instead of or in addition to the engine. [Explanation of symbols]

[0042] 10...General control device 11...CPU 13. Storage 13A…Protection area 13B…Unprotected area 15…RAM 92…In-vehicle device 100…Vehicle

Claims

1. The executive department, a first storage unit storing an application executable by the execution unit; a second storage unit that temporarily stores data generated when the execution unit executes an application, the first storage unit has a protected area in which a specific access authority is required for writing, and a non-protected area in which the specific access authority is not required for writing, the unprotected area stores a monitoring application to be monitored; the protected area stores a duplicated application obtained by duplicating the monitoring application at the time when the monitoring application was stored in the unprotected area; The execution unit is When an execution signal of the monitoring application is obtained, storing a copy of source code included in the monitoring application stored in the unprotected area as first data in the second storage unit based on the execution signal, and executing the monitoring application based on the first data stored in the second storage unit; storing, in the second storage unit, a copy of source code included in the copied application stored in the protected area as second data, based on the execution signal; comparing the first data and the second data stored in the second storage unit during execution of the monitoring application; and stopping execution of the monitoring application when an inconsistency is detected between the first data and the second data. An information processing device for a vehicle.

2. The execution unit is When a mismatch is detected between the first data and the second data, deleting the monitoring application already stored in the unprotected area; storing a copy of the copied application stored in the protected area as a new monitoring application in the unprotected area; The vehicle information processing device according to claim 1 .

3. The execution unit is During execution of the monitoring application, repeatedly outputting a control signal corresponding to execution of the monitoring application to an in-vehicle device in a predetermined first period; Repeating the comparison of the first data and the second data for a second period that is predetermined to be shorter than the first period. The vehicle information processing device according to claim 2 .

4. The execution unit is When comparing the first data and the second data, all of the first data is compared with all of the second data. The vehicle information processing device according to claim 3 .

5. The monitoring application is an AD application that causes a vehicle equipped with the vehicle information processing device to autonomously drive without the driver's operation. The vehicle information processing device according to claim 4.

Images