Electronic control unit

Abstract

In an electronic control unit where a hypervisor manages multiple virtual machines, the cause of an access error is estimated. [Solution] An electronic control unit on which multiple virtual machines managed by a hypervisor operate includes a resource storage unit, an error detection unit, and a cause estimation unit. The storage unit stores resource management information representing the resources that each of the multiple virtual machines is permitted to access. The error detection unit detects access errors representing unauthorized access to resources for each of the multiple virtual machines based on the resource management information. The cause estimation unit estimates the cause of a specific access error based on whether or not the specific access error is reproducible, when a predetermined number of specific access errors, which are access errors related to the same virtual machine, are detected within a predetermined time and number that have been set in advance.

Description

[Technical Field]

[0001] The present invention relates to an electronic control device in which a plurality of virtual machines can operate. [Background Art]

[0002] Along with the increase in advanced and multi-functional vehicle control, control systems in which electronic control devices such as ECUs (Electronic Control Units) are connected via an in-vehicle network have become widespread. However, an increase in the number of mounted electronic control devices leads to an increase in space required for installing the electronic control devices and an increase in cost. To solve these problems, the automotive industry has developed a configuration (integrated ECU) in which the functions of multiple electronic control devices are implemented in a single electronic control device.

[0003] In the case shown in FIG. 1, functions A to C provided by three ECUs 100 (100A to 100C) are implemented by a single integrated ECU 110. Each ECU 100 includes hardware (HW) and has a platform (PF_A, PF_B, PF_C) mounted thereon. A corresponding application operates on each platform. In contrast, the integrated ECU 110 includes hardware resources (HW) and has a plurality of virtual machines 111 (111A to 111C) mounted thereon. Each virtual machine 111 includes a platform (PF_A, PF_B, PF_C), and an application operates on the platform. Here, the virtual machines 111A to 111C provide functions A to C, respectively. With this configuration, the space for installing the electronic control device is reduced as a whole, and the cost is also reduced.

[0004] Note that a technique has been proposed for suppressing access to resources by an abnormal virtual machine in an electronic control device including a plurality of virtual machines, a hypervisor that manages the operation of the plurality of virtual machines, and resources accessed by the plurality of virtual machines (for example, Patent Document 1). [Prior Art Literature] [Patent Documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2024-115749 [Overview of the project] [Problems that the invention aims to solve]

[0006] As mentioned above, electronic control units are known to be used by hypervisors to manage multiple virtual machines. However, while conventional technologies can detect access errors such as unauthorized or inappropriate access, they do not identify the cause of the access error, nor do they automatically address the identified access error. Therefore, when an access error occurs, technicians must analyze the access error data to identify the cause for each electronic control unit and take appropriate action.

[0007] One aspect of the present invention is to provide a function for estimating the cause of an access error in an electronic control unit in which a hypervisor manages multiple virtual machines. [Means for solving the problem]

[0008] An electronic control device according to one aspect of the present invention is configured in which a plurality of virtual machines managed by a hypervisor are in operation, and comprises: a storage unit that stores resource management information representing resources accessed by the plurality of virtual machines and resources that each of the plurality of virtual machines is permitted to access; an error detection unit that detects access errors representing unauthorized access to resources for each of the plurality of virtual machines based on the resource management information; and a cause estimation unit that estimates the cause of a specific access error based on whether or not the specific access error is reproducible, when a predetermined number of specific access errors, which are access errors related to the same virtual machine, are detected within the predetermined time, with a predetermined time and a predetermined number set in advance.

[0009] With this configuration, the cause of an access error can be estimated based on whether or not there is continuity and reproducibility of the access errors related to each virtual machine. In other words, when an access error occurs, its cause can be estimated.

[0010] In the electronic control device configured as described above, the error detection unit may detect the operation information of the currently running program when it detects an access error. In this case, the cause estimation unit determines that the error is reproducible if the program operation information detected for each of the specific access errors is the same as that of the other access errors, and determines that the error is not reproducible if the program operation information detected for each of the specific access errors is not the same as that of the other access errors.

[0011] In the electronic control device configured as described above, the error detection unit may detect the access destination when it detects an access error. In this case, the cause estimation unit may determine that the error is reproducible if the detected access destinations for each of the specific access errors are the same, and that it is not reproducible if the detected access destinations for each of the specific access errors include access destinations that are not the same.

[0012] In the electronic control unit configured as described above, the cause estimation unit may estimate that the software of the virtual machine corresponding to a specific access error has been tampered with when it determines that the specific access error is not reproducible. It is thought that malicious third-party software attempts to gain unauthorized access to various resources within the electronic control unit. Therefore, continuous and non-reproducible access errors are thought to be caused by the operation of a virtual machine on which malicious third-party software is installed.

[0013] The electronic control unit configured above may further include an error handling unit that controls the degraded operation of the plurality of virtual machines. In this case, when the cause estimation unit estimates that the software has been tampered with, the error handling unit may stop the virtual machine corresponding to the specific access error. A virtual machine with malicious third-party software installed can pose a significant risk to the electronic control unit. Therefore, it is important to mitigate such risks by stopping virtual machines that may have malicious third-party software installed.

[0014] In the electronic control unit with the above configuration, the cause estimation unit may estimate that the software of the virtual machine corresponding to the specific access error contains a defect when it determines that the specific access error is reproducible. The software defect is caused by a miswritten code at a specific location in the program executed by the virtual machine. The same access error occurs each time this miswritten code is executed. Therefore, continuous and reproducible access errors are considered to be caused by a software defect. [Effects of the Invention]

[0015] According to the above-described embodiment, in an electronic control unit where a hypervisor manages multiple virtual machines, the cause of an access error can be estimated. [Brief explanation of the drawing]

[0016] [Figure 1] This figure shows an example of an integrated ECU with multiple functions implemented. [Figure 2] This figure shows an example of an electronic control device according to an embodiment of the present invention. [Figure 3] This figure shows an example of resource management information. [Figure 4] This figure shows an example of an error log database. [Figure 5] This flowchart shows an example of a process for estimating the cause of a resource access error. [Figure 6]It is a diagram for explaining a specific example of a procedure for estimating the cause of a resource access error. Mode for Carrying Out the Invention

[0017] Figure 2 shows an example of an electronic control unit according to an embodiment of the present invention. The electronic control unit (ECU) 1 according to an embodiment of the present invention is, for example, an on-vehicle ECU mounted on an automobile. In this case, the electronic control unit 1 controls the operation of the automobile in accordance with a driver's instruction.

[0018] The electronic control unit 1 has a hardware resource (HW) 2. The hardware resource 2 includes at least a processor and a memory. The processor is, for example, a CPU or a microprocessor. The memory is a semiconductor memory, and includes a ROM (Read Only Memory) area and a RAM (Random Access Memory) area. A program executed by the processor can be stored in the ROM area. The RAM area can be used as a work area for the processor. The hardware resource 2 may also include devices other than the memory and the processor.

[0019] The electronic control unit 1 can operate a plurality of virtual machines 3 (3A to 3N). The virtual machines 3 are implemented using the hardware resource 2. That is, the predetermined hardware resource 2 is allocated to each virtual machine 3 in advance. Specifically, a predetermined ROM area and a predetermined RAM area are allocated to each virtual machine 3. Processor resources are allocated to each virtual machine 3 by, for example, a time division multiplexing scheme.

[0020] The virtual machine 3 includes platforms (PF_A to PF_N) and applications (Apps A to N). The platform is a software infrastructure provided between the applications and the hardware resources 2. When the electronic control device 1 is an on-vehicle ECU, the platform may be, for example, AUTOSAR. The application is a software program implemented for each function. In FIG. 2, the virtual machine 3A provides a function A using the application A, the virtual machine 3B provides a function B using the application B, and the virtual machine 3N provides a function N using the application N. When the electronic control device 1 is an on-vehicle ECU, for example, a motor control application, a battery control application, an air conditioner control application, and the like may be implemented.

[0021] A hypervisor (HV) 4 is a control program that controls the execution of the virtual machines 3. Accordingly, the hypervisor 4 manages the hardware resources 2 allocated to each of the virtual machines 3. At this time, the hypervisor 4 may operate the plurality of virtual machines 3 by a time division multiplexing scheme. The hypervisor 4 also has a function of detecting a resource access error caused by the virtual machine 3. The resource access error is detected when the virtual machine 3 accesses a hardware resource that is not allocated to the virtual machine.

[0022] The electronic control unit 1 includes a storage unit 11 for storing various types of information. The information stored in the storage unit 11 includes resource management information. As shown in Figure 3, the resource management information represents the resources that each virtual machine 3 is permitted to access. In other words, the resource management information represents the resources that each virtual machine 3 can access. For example, in the example shown in Figure 3, virtual machine 3A can access addresses A to B in the ROM area, addresses a to b in the RAM area, and device D1, while virtual machine 3B can access addresses C to D in the ROM area, addresses c to d in the RAM area, and device D2. The resource management information is created in advance based on the design specifications of the electronic control unit 1. The storage unit 11 is configured using hardware resources 2.

[0023] The electronic control unit 1 configured as described above has a function to estimate (or determine) the cause (or reason) of a resource access error when it is detected. The electronic control unit 1 may also have a function to execute processing to deal with the error when a resource access error is detected. To realize these functions, the electronic control unit 1 includes an error detection unit 12, a cause estimation unit 13, and an error handling unit 14.

[0024] The error detection unit 12, the cause estimation unit 13, and the error handling unit 14 are implemented, for example, by software or hardware. In this case, the error detection unit 12, the cause estimation unit 13, and the error handling unit 14 are provided, for example, as part of the functionality of the hypervisor 4.

[0025] The error detection unit 12 detects resource access errors by referring to resource management information stored in the storage unit 11. Specifically, for each of the multiple virtual machines 3 (3A to 3N), the error detection unit 12 detects resource access errors that represent unauthorized access to resources based on the resource management information.

[0026] For example, if virtual machine 3A attempts to access an area of ​​the ROM region other than addresses A to B, a resource access error related to virtual machine 3A will be detected. Alternatively, if virtual machine 3B attempts to access an area of ​​the RAM region other than addresses c to d, a resource access error related to virtual machine 3B will be detected.

[0027] The error detection unit 12 may create an error log for the resource access errors it detects. The database for the error log (hereinafter referred to as the error log DB) records error information representing the resource access errors detected by the error detection unit 12 in chronological order.

[0028] Figure 4 shows an example of an error log database. The error log database records error information including time information, the source virtual machine, the accessed hardware resource, and program counters. Note that other information not shown may also be registered in the error log database.

[0029] The time information represents the time when the resource access error was detected. Alternatively, the time information may represent the elapsed time from a predetermined time until the resource access error was detected, or the elapsed time from the time the resource access error occurred until the present. The electronic control unit 1 is assumed to be equipped with a clock and / or timer. The accessing virtual machine represents the virtual machine 3 that performed the unauthorized access. The accessed hardware resource represents the hardware resource that was accessed without authorization. The program counter represents the value of the program counter at the time the resource access error was detected for the application program executed by the virtual machine 3 that performed the unauthorized access. The program counter is one of the registers in the processor of the electronic control unit 1 and stores the address (memory address) of the next instruction to be executed. Therefore, the program counter value recorded as error information effectively indicates which part of the application program the virtual machine 3 was executing when the resource access error occurred. The program counter value is an example of information representing the operation information of a program being executed in a virtual machine.

[0030] The cause estimation unit 13 estimates the cause of resource access errors detected by the error detection unit 12 for each virtual machine 3. In this case, the cause estimation unit 13 estimates the cause of resource access errors that satisfy predetermined conditions for each virtual machine 3. For example, the cause estimation unit 13 may estimate the cause of resource access errors detected for each virtual machine 3 within a predetermined time period.

[0031] Here, a situation in which one virtual machine 3 accesses the resources of another virtual machine 3 (i.e., a resource access error) will not occur when the electronic control unit 1 is functioning normally. In other words, such a situation occurs due to one of the following causes and is considered to be common in any integrated ECU (hypervisor environment). Cause A: Malicious third-party software is installed as a virtual machine. Cause B: Software malfunction of the virtual machine Cause C: Impact of hardware failure

[0032] <Cause A> Malicious third-party software is tampered with. For example, malicious third-party software may be installed with the intent to misuse or steal a product. In this case, the software accesses the hardware resources accessible by any virtual machine, allowing the malicious third party to gain some benefit from misusing the product or to steal the product itself. Malicious third-party software may also be installed with the intent to disable a product. In this case, the product's image may be damaged, and the malicious third party may demand a ransom.

[0033] Malicious third-party software is likely to attempt unauthorized access to various resources through a variety of means. Therefore, the characteristics of cause A are as follows: (1) Resource access errors frequently occur originating from a specific virtual machine (i.e., a virtual machine with malicious third-party software implemented). (2) Malicious third-party software accesses various resources, resulting in resource access errors related to accessing various resources.

[0034] Therefore, when the following situation is detected, it is presumed that the cause of the resource access error is "Cause A: Malicious third-party software." (1) Resource access errors repeatedly occur, originating from the same virtual machine. (2) The access destination for resource access errors is undefined. (3) A predetermined number of resource access errors occur within a predetermined time. (4) The resource access error is not reproducible (it behaves differently from the previous resource access error). Furthermore, in the estimation related to Cause A, it is necessary to detect a predetermined number of resource access errors. Therefore, if fewer than the predetermined number of resource access errors are detected, it is difficult to distinguish it as "Cause C: Impact of hardware failure."

[0035] <Cause B> Access to other virtual machines may occur due to a "bug" in the application program running on virtual machine 3. However, since the electronic control unit 1 undergoes various evaluations and tests before shipment, it is rare for the application program to contain multiple "bugs." In other words, resource access errors related to software defects are errors with a specific pattern caused by a specific "bug," and are unlikely to occur for various resources.

[0036] Therefore, when the following situation is detected, it is presumed that the cause of the resource access error is "Cause B: Software malfunction". (1) Resource access errors repeatedly occur, originating from the same virtual machine. (2) The access destination for resource access errors is constant. (3) It is unknown whether a predetermined number of resource access errors will occur within the predetermined time. (4) The resource access error is reproducible (it behaves the same as the previous resource access error). Furthermore, even in the estimation related to cause B, it is necessary to detect a predetermined number of resource access errors. Therefore, if fewer than the predetermined number of resource access errors are detected, it is difficult to distinguish it as "cause C: hardware failure."

[0037] <Cause C> Hardware failure refers to the failure of hardware (mainly ROM, RAM, and CPU) necessary for the software to operate. Hardware failure also includes initial failure, random failure, and wear-out failure (component lifespan). However, each hardware component constituting the electronic control unit 1 generally has a component lifespan that satisfies the product warranty period of the electronic control unit 1. Initial failure is a failure that occurs within a short period after the product is shipped, but its behavior is substantially the same as that of a random failure. Therefore, in the following description, hardware failure refers to random failure. A random failure includes, for example, a state in which one or more bits of memory cannot correctly hold information.

[0038] It is unclear when, in which virtual machine, and for which resource a hardware failure will occur. Therefore, if the cause of the resource access error does not fall under either cause A or cause B, the cause of the resource access error will be considered to be "cause C: hardware failure".

[0039] The cause estimation unit 13 needs to determine whether a predetermined number of resource access errors will occur within a predetermined time when estimating the cause of a resource access error. Therefore, the "continuous occurrence determination time (predetermined time)" and the "number of error handling implementation determinations (predetermined number)" are set in advance.

[0040] The consecutive occurrence determination time is the time required to determine whether resource access errors related to a particular virtual machine are considered to have occurred "consecutively." For example, if the time between the detection of a resource access error originating from a certain virtual machine and the detection of the next resource access error originating from the same virtual machine is shorter than the consecutive occurrence determination time, then resource access errors originating from that virtual machine are considered to have occurred "consecutively." The consecutive occurrence determination time is not particularly limited, but is set considering factors such as the probability of random failure of HV components used by the electronic control unit, and is typically expected to be between several tens and several hundreds of hours.

[0041] The error handling action count is a threshold number of resource access errors related to a virtual machine within a consecutive occurrence detection period that determines how many times that virtual machine should be considered a virtual machine that requires error handling. The error handling action count can be set to any value of 2 or more. For example, if the error handling action count is 2, when resource access errors related to the same virtual machine occur two or more times within the consecutive occurrence detection period, it is determined that resource access errors related to that virtual machine have occurred consecutively and that error handling should be performed on that virtual machine.

[0042] Figure 5 is a flowchart showing an example of the process for estimating the cause of a resource access error. This flowchart is executed when a new resource access error is detected by the error detection unit 12. The resource management information described above is stored in the storage unit 11. Furthermore, it is assumed that error information related to resource access errors previously detected by the error detection unit 12 is recorded in the error log DB.

[0043] In S1, the cause estimation unit 13 obtains error information related to the new resource access error from the error detection unit 12. The error information includes the time, the source virtual machine, the accessed hardware resource, and the program counter, as explained with reference to Figure 4. The time represents the time when the new resource access error was detected. The source virtual machine represents the virtual machine that performed the access related to the new resource access error. The accessed hardware resource represents the hardware resource that was accessed related to the new resource access error. The program counter represents the value of the program counter at the time the resource access error was detected for the application program executed by the virtual machine 3 that performed the access related to the new resource access error.

[0044] In S2, the cause estimation unit 13 determines whether a predetermined number of specific access errors, which are resource access errors related to the same access source (same virtual machine), have occurred within a predetermined time period. Specifically, the cause estimation unit 13 extracts error information from the error log DB that is caused by access from the same virtual machine as the access source of the new resource access error. Next, the cause estimation unit 13 counts the number of resource access errors recorded in the error information extracted from the error log DB within a time range that goes back a predetermined time from the detection time of the new resource access error. The "predetermined time" is the continuous occurrence determination time mentioned above and is set in advance. If the number of counted resource access errors is greater than or equal to the predetermined number, the cause estimation unit 13 determines that resource access errors are occurring continuously. The "predetermined number" is the number of times error handling actions have been determined mentioned above and is set in advance.

[0045] If the result in S2 is "Yes", then in S3, the cause estimation unit 13 determines whether resource access errors related to the same access source are reproducible. For example, if the program counter value related to the new resource access error matches the program counter value in the error information extracted in S2, the specific access error is determined to be reproducible. That is, for each access error of the specific access error, if the program operation information is the same for each other, it is determined to be reproducible. Alternatively, if the accessed hardware resource related to the new resource access error matches the accessed hardware resource in the error information extracted in S2, it may also be determined that the specific access error is reproducible. That is, for each access error of the specific access error, if the accessed destination is the same for each other, it may be determined to be reproducible.

[0046] Then, the cause estimation unit 13 estimates the cause of the resource access error according to the determination results of S2 to S3. Specifically, if a predetermined number of resource access errors related to a certain virtual machine occur within a predetermined time, but these resource access errors are not reproducible, the cause estimation unit 13 estimates in S4 that the cause of the resource access errors related to the virtual machine is "Cause A: Malicious third-party software". In other words, it is estimated that the virtual machine may have been taken over by a malicious third party.

[0047] If a predetermined number of resource access errors related to a particular virtual machine occur within a predetermined time, and these resource access errors are reproducible, the cause estimation unit 13 estimates in S5 that the cause of the resource access errors related to that virtual machine is "Cause B: Software malfunction". However, if a predetermined number of resource access errors related to a particular virtual machine do not occur within a predetermined time, the cause estimation unit 13 estimates in S6 that the cause of the resource access errors related to that virtual machine is "Cause C: Hardware failure".

[0048] When the cause of a resource access error related to a virtual machine is estimated to be "Cause A: Malicious third-party software," the error handling unit 14 stops the virtual machine in S7. In other words, it stops the virtual machine that may have been taken over by a malicious third party, while other virtual machines continue to operate in a degraded state.

[0049] In S8, error information about the new resource access error is added to the error log DB. The processing in S8 is performed, for example, by the error detection unit 12. In this case, the error detection unit 12 may record the error information about the new resource access error in the error log DB before S1 to S7.

[0050] Furthermore, the electronic control unit 1 does not necessarily have to execute the process in S7. That is, the electronic control unit 1 may simply estimate the cause when it detects a new resource access error. However, when a virtual machine may be hijacked by a malicious third party, it is unclear what impact that virtual machine will have. For this reason, it is preferable to stop the virtual machine when it may be hijacked by a malicious third party.

[0051] Here, we will explain a specific example of the procedure for estimating the cause of a detected resource access error. In the following description, it is assumed that when the error detection unit 12 detects a resource access error, the error information of that resource access error (time, source virtual machine, target hardware resource, and program counter) is recorded in the error log DB. It is also assumed that the pre-configured continuous occurrence judgment time and the number of error handling execution judgments are "100 hours" and "2 times," respectively.

[0052] In the case shown in Figure 6A, when a new resource access error is detected, the error log DB contains error information related to the two previously detected resource access errors. Furthermore, the source virtual machine for the new resource access error is virtual machine 3A. In this case, a record (i.e., record 2) where the source virtual machine is virtual machine 3A is extracted from the error log DB.

[0053] First, in S2 of Figure 5, it is determined whether a predetermined number of resource access errors occurred within a predetermined time. The time of detection of the new resource access error is 08:01 on January 15, 2025, and the time recorded in Record 2 is 08:00 on January 15, 2025. The difference between these two times is shorter than the time for determining consecutive occurrences. Furthermore, the new resource access error is the second error counted from the resource access error recorded in Record 2. Therefore, it is determined that a predetermined number of resource access errors related to virtual machine 3A occurred within a predetermined time.

[0054] Next, the reproducibility of the resource access error is determined in S3 of Figure 5. The hardware resource accessed in the new resource access error is different from the hardware resource accessed in Record 2. Also, the program counter value at the time of detection of the new resource access error is different from the program counter value recorded in Record 2. Therefore, it is determined that the resource access error related to virtual machine 3A is not reproducible.

[0055] In this case, the cause estimation unit 13 estimates that the cause of the new resource access error is "Cause A: Malicious third-party software." In this case, the cause estimation unit 13 outputs alert information indicating the cause of the resource access error. The error handling unit 14 also stops virtual machine 3A, which is the virtual machine that is the source of the new resource access error.

[0056] In the case shown in Figure 6B, when a new resource access error is detected, the error log DB contains error information related to the three previously detected resource access errors. Furthermore, the source virtual machine for the new resource access error is virtual machine 3B. In this case, a record (i.e., record 1) where the source virtual machine is virtual machine 3B is extracted from the error log DB.

[0057] First, in S2 of Figure 5, it is determined whether a predetermined number of resource access errors occurred within a predetermined time. The time of detection of the new resource access error is 18:30 on January 16, 2025, and the time recorded in Record 1 is 07:00 on January 15, 2025. The difference between these two times is shorter than the time for determining consecutive occurrences. Furthermore, the new resource access error is the second error counted from the resource access error recorded in Record 1. Therefore, it is determined that a predetermined number of resource access errors related to virtual machine 3B occurred within the predetermined time.

[0058] Next, in S3 of Figure 5, the reproducibility of the resource access error is determined. The hardware resource accessed in the new resource access error is the same as the hardware resource accessed in Record 1. Also, the program counter value at the time of detection of the new resource access error is the same as the program counter value recorded in Record 1. Therefore, it is determined that the resource access error related to virtual machine 3B is reproducible. In this case, the cause estimation unit 13 estimates that the cause of the new resource access error is "Cause B: Software malfunction". The cause estimation unit 13 then outputs alert information indicating the cause of the resource access error.

[0059] Thus, the electronic control unit 1 according to the embodiment of the present invention can estimate the cause of a resource access error based on the continuity and reproducibility of the resource access error. Furthermore, the electronic control unit 1 stops the target virtual machine when it is estimated that the resource access error is caused by malicious third-party software. Therefore, the impact of a virtual machine that may be hijacked by a malicious third party can be avoided or mitigated.

[0060] <Other Embodiments> In the embodiments described above, the error detection unit 12, the cause estimation unit 13, and the error handling unit 14 are implemented by software as part of the functions of the hypervisor 4, but the present invention is not limited to this configuration. That is, at least a portion of the functions of the error detection unit 12, the cause estimation unit 13, and the error handling unit 14 may be implemented by hardware resources 2. For example, the hardware resources 2 may include rewritable circuits such as FPGAs (Field Programmable Gate Arrays), and some or all of the functions of the error detection unit 12, the cause estimation unit 13, and the error handling unit 14 may be implemented by such rewritable circuits.

[0061] Furthermore, in the embodiment described above, the target virtual machine is stopped when the cause of the resource access error is "Cause A: Malicious third-party software," but the present invention is not limited to this configuration. For example, the electronic control unit 1 may stop the target virtual machine when the cause of the resource access error is "Cause B: Software malfunction." However, the risk of Cause B is considered to be smaller than that of Cause A. Therefore, when it is presumed that the cause of the resource access error is "Cause B," the system may first stop access from the target virtual machine to the hardware resource 2, and then stop the target virtual machine if further resource access errors occur. When it is presumed that the cause of the resource access error is "Cause B," the system may perform cause estimation and error handling for each resource (ROM, RAM, CPU, etc.). In this case, the continuous occurrence determination time and the number of error handling execution determinations described above may be set for each resource (ROM, RAM, CPU, etc.). [Explanation of Symbols]

[0062] 1. Electronic Control Unit (ECU) 2 Hardware Resources 3 (3A~3N) Virtual Machines 4 Hypervisor 11 Preservation Department 12 Error detection unit 13 Cause estimation part 14 Error Handling Section

Claims

1. An electronic control unit on which multiple virtual machines managed by a hypervisor operate, The resources accessed by the aforementioned multiple virtual machines, A storage unit that stores resource management information representing the resources that each of the aforementioned multiple virtual machines is permitted to access, For each of the aforementioned multiple virtual machines, an error detection unit detects an access error representing unauthorized access to a resource based on the resource management information, A predetermined time and number are set in advance, and when a predetermined number of specific access errors, which are access errors related to the same virtual machine, are detected within the predetermined time, a cause estimation unit estimates the cause of the specific access error based on whether or not the specific access error is reproducible. An electronic control device equipped with the following features.

2. When the error detection unit detects an access error, it detects the operation information of the running program. The aforementioned cause estimation unit is, If the program operation information detected for each of the aforementioned specific access errors is the same for all of them, then it is determined that the error is reproducible. If the operational information of the program detected for each of the aforementioned specific access errors is not the same, it is determined that the error is not reproducible. The electronic control device according to claim 1.

3. The error detection unit, upon detecting an access error, detects the access destination. The aforementioned cause estimation unit is, If the detected access destinations for each of the aforementioned specific access errors are the same, then it is determined that the error is reproducible. If, for each of the aforementioned specific access errors, the detected access destinations include access destinations that are not the same for each other, it is determined that the error is not reproducible. The electronic control device according to claim 1.

4. When the cause estimation unit determines that the specific access error is not reproducible, it estimates that the software of the virtual machine corresponding to the specific access error has been tampered with. The electronic control device according to claim 1.

5. The system further includes an error handling unit that controls the degraded operation of the plurality of virtual machines, When the cause estimation unit estimates that the software has been tampered with, the error handling unit stops the virtual machine corresponding to the specific access error. The electronic control device according to feature 4.

6. When the cause estimation unit determines that the specific access error is reproducible, it estimates that the software of the virtual machine corresponding to the specific access error contains a defect. The electronic control device according to claim 1.

Images