Vehicle control system, vehicle control method, and program

Abstract

An integrated ECU (100) serving as a vehicle control system included in a vehicle comprises an application execution unit (190) that executes an application program, an environment state determination unit (114) that determines whether or not the application execution unit (190) is abnormal, a first resource providing unit (110) that provides resources to be used for controlling a vehicle (V), and a first access control unit (111) that, in a case where a request for resources is received from the application program, prohibits the first resource providing unit (110) from providing resources to the application program when the environment state determination unit (114) determines that the application execution unit (190) is abnormal (a), or permits the first resource providing unit (110) to provide resources to the application program when the environment state determination unit (114) determines that the application execution unit (190) is not abnormal (b).

Description

[Technical field]

[0001] The present disclosure relates to a vehicle control system for controlling a vehicle. [Background technology]

[0002] Conventionally, devices or programs have been proposed that prohibit an application program (hereinafter, also referred to as an application) from accessing resources without limit (for example, see Patent Document 1).

[0003] This device acquires an application via a network, verifies whether the signature of the acquired application is valid, and if the signature is valid, judges the application to be application A. Application A is an application created based on certain rules. Then, based on the result of the judgment of the application, the device prohibits the application from accessing predetermined resources. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 5961164 Summary of the Invention [Problem to be solved by the invention]

[0005] However, when the device of Patent Document 1 is applied to a vehicle, there is a problem in that the vehicle may not be appropriately controlled.

[0006] Therefore, the present disclosure provides a vehicle control system that can appropriately control a vehicle. [Means for solving the problem]

[0007] A vehicle control system according to one embodiment of the present disclosure is a vehicle control system provided in a vehicle, and includes an application execution unit that executes an application program, an environmental state determination unit that determines whether the application execution unit is abnormal, a resource provision unit that provides resources used to control the vehicle, and a first access control unit that, when a request for the resources is received from the application program, (a) when the environmental state determination unit determines that the application execution unit is abnormal, prohibits the resource provision unit from providing the resources to the application program, and (b) when the environmental state determination unit determines that the application execution unit is not abnormal, allows the resource provision unit to provide the resources to the application program.

[0008] These comprehensive or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, or may be realized as any combination of a system, a method, an integrated circuit, a computer program, and a recording medium. Effect of the Invention

[0009] The vehicle control system of the present disclosure can appropriately control the vehicle. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of an in-vehicle system according to an embodiment. [Diagram 2] FIG. 2 is a block diagram showing an example of a functional configuration of a vehicle control system that is an integrated ECU according to the embodiment. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a functional configuration of each of the application executing unit and the first resource providing unit according to the embodiment. [Figure 4] FIG. 4 is a sequence diagram illustrating a processing operation between the application executing unit and the first resource providing unit according to the embodiment. [Diagram 5]FIG. 5 is a flowchart showing a processing operation of the application executing unit in the embodiment. [Figure 6] FIG. 6 is a flowchart showing a processing operation of the first resource providing unit in the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] (Findings on which this disclosure is based) Currently, mobility services such as MaaS (Mobility as a Service) are being proposed. Vehicles used in these mobility services (i.e., connected cars) are required to have many functions to achieve data security, safety, seamless services, software or hardware updates, efficiency, comfort, etc. In order to equip vehicles with these many functions, it is being considered to simplify the systems within the vehicle by using an integrated ECU that integrates all or some of the many ECUs into one, rather than distributing many ECUs throughout the vehicle.

[0012] The integrated ECU has at least an environment for executing application programs (also called 3rd Party apps) of mobility service providers, and functions related to vehicle control required for providing mobility services. For example, the functions related to vehicle control include a function for driving the vehicle to a destination, a function for opening and closing the trunk of the vehicle, a function for opening and closing the windows of the vehicle, etc.

[0013] In the device of the above-mentioned Patent Document 1, the type of the application program is determined based on the signature of the application program, and the access to resources by the application program is controlled based on the result of the type determination. However, even if such control is applied to the integrated ECU, if the environment in which the application program is executed is compromised by an external attack, there is a possibility that the vehicle may be controlled inappropriately.

[0014] In order to solve such a problem, a vehicle control system according to an embodiment of the present disclosure is a vehicle control system provided in a vehicle, and includes an application execution unit that executes an application program, an environmental state determination unit that determines whether the application execution unit is abnormal, a resource provision unit that provides resources used to control the vehicle, and a first access control unit that, when a request for the resources is received from the application program, (a) prohibits the resource provision unit from providing the resources to the application program when the environmental state determination unit determines that the application execution unit is abnormal, and (b) permits the resource provision from the resource provision unit to the application program when the environmental state determination unit determines that the application execution unit is not abnormal. For example, the resource provision unit may include the first access control unit. Also, for example, the resource may be at least one of information, functions, and hardware resources used to control the vehicle.

[0015] As a result, when it is determined that the application execution unit, which is the execution environment for executing an application program, is abnormal, the resource provider prohibits the provision of resources to the application program. For example, when the application execution unit is compromised by an external attack, the application execution unit is determined to be abnormal. Therefore, since the provision of resources to the application program of such a compromised application execution unit is prohibited, it is possible to prevent the application program from inappropriately controlling the vehicle using the resources. As a result, it is possible to appropriately control the vehicle.

[0016] In addition, the application execution unit may include a second access control unit that checks the authority of the application program and, depending on the result of the authority check, may permit, withhold, or prohibit a request for the resource by the application program.

[0017] This makes it possible to suspend or prohibit a request for resources by an application program when the application program does not have the authority to use the resources used to control the vehicle, thereby preventing a malicious third party, who is neither the car manufacturer nor the car dealer nor the vehicle user, from downloading an application program into the vehicle control system and inappropriately controlling the vehicle.

[0018] In addition, when the application execution unit is unable to provide the resources requested by the application program, the second access control unit may notify the first access control unit of the request for resources by the application program, and when the application execution unit is able to provide the resources, the second access control unit may notify the first access control unit of the request for resources by the application program.

[0019] This allows the first access control unit to be notified of a resource request only when the application execution unit is unable to provide the resource, thereby preventing the first access control unit from being notified of a resource request even when the application execution unit is able to provide the resource. As a result, unnecessary notifications of resource requests can be prevented, reducing the processing load.

[0020] In addition, the vehicle control system may further include an authority determination unit that determines whether the application program or the app execution unit has the authority to use the resource, and when the first access control unit receives a request for the resource from the application program, the first access control unit may allow the resource provision unit to the application program when the environmental state determination unit determines that the app execution unit is not abnormal and the authority determination unit determines that the application program or the app execution unit has the authority.

[0021] This makes it possible to prohibit the provision of resources to an application program when the application program or the application execution unit does not have the appropriate authority, thereby further preventing a malicious third party from downloading an application program to the vehicle control system and inappropriately controlling the vehicle.

[0022] In addition, the vehicle control system may further include a resource state determination unit that determines whether the resource is in a state where it can be provided, and when the first access control unit receives a request for the resource from the application program, if the environmental state determination unit determines that the application execution unit is not abnormal and if the resource state determination unit determines that the resource is in a state where it can be provided, then it may allow the resource provision unit to provide the resource to the application program.

[0023] As a result, when a resource is in a state where it can be provided, provision of the resource to the application program is permitted. Therefore, when a resource is in a state where it cannot be provided, for example, contention for use of the resource can be suppressed. Alternatively, control of a vehicle by an application program using the resource can be suppressed from being performed at an inappropriate timing. For example, if the resource is a function for opening and closing the trunk or doors of a vehicle, it can be suppressed that the trunk or doors are opened by control using the resource by an application program while the vehicle is running.

[0024] The vehicle control system may further include a plurality of the resource providing units, each of which includes the first access control unit.

[0025] This makes it possible to appropriately manage the provision of resources to application programs for each resource.

[0026] The first access control unit may be included in a component that is less likely to be attacked than the application execution unit, among a plurality of components constituting the vehicle control system.

[0027] This makes it possible to reduce the possibility that the first access control unit will be attacked, and to appropriately control the provision of resources to application programs.

[0028] In addition, the vehicle control system may further include a communication relay unit that relays communication between the application execution unit and the first access control unit, and the environmental state determination unit may be included in the communication relay unit.

[0029] As a result, for example, if the communication relay unit is a hypervisor, the possibility of the environmental state determination unit in the hypervisor being attacked can be reduced, and it can be appropriately determined whether or not the application execution unit is abnormal.

[0030] These comprehensive or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, or may be realized as any combination of the system, method, integrated circuit, computer program, or recording medium.

[0031] Hereinafter, the embodiment will be specifically described with reference to the drawings.

[0032] In addition, the embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, arrangement and connection forms of components, steps, and order of steps shown in the following embodiments are examples and are not intended to limit the present disclosure. In addition, among the components in the following embodiments, components that are not described in an independent claim showing the highest concept are described as optional components. In addition, each figure is a schematic diagram and is not necessarily illustrated strictly. In addition, in each figure, the same components are given the same reference numerals.

[0033] (Embodiment) FIG. 1 is a diagram showing an example of the configuration of an in-vehicle system according to the present embodiment.

[0034] The in-vehicle system 10 in this embodiment is a system mounted on a vehicle V, and includes a TCU 11, a cockpit domain controller 12, an integrated ECU 100, zone ECUs 13a to 13c, sensors 14a to 14c, and actuators 15a to 15c. These components may be connected to each other via a communication path such as a CAN (Controller Area Network) bus.

[0035] The TCU (Telematics Control Unit) 11 is a communication module that can be connected to a communication network such as the Internet. That is, the TCU 11 communicates with the outside. For example, the TCU 11 downloads an application program from a third party that is neither a car manufacturer nor a car dealer, nor a user of the vehicle V, via the communication network. The application program is also called an app, application, or app. The TCU 11 then outputs the application to the integrated ECU 100.

[0036] The cockpit domain controller 12 is, for example, an in-vehicle infotainment (IVI) It integrates and controls the digital cluster, the head-up display, and the digital cluster. The digital cluster is a unit panel that brings together various meters necessary for driving.

[0037] An integrated ECU (Electronic Control Unit) 100 controls the zone ECUs 13a to 13c. In this embodiment, the integrated ECU 100 is an example of a vehicle control system provided in the vehicle V.

[0038] The zone ECU 13a controls the actuator 15a in response to the sensing result of the sensor 14a and an instruction from the integrated ECU 100 to drive a mechanism in the area of ​​the vehicle V that is assigned to the zone ECU 13a. The mechanism may be the front or rear wheels of the vehicle V, or a mechanism for opening and closing a window, a door, or a trunk.

[0039] Similarly, the zone ECU 13b controls the actuator 15b in response to the sensing result of the sensor 14b and an instruction from the integrated ECU 100 to drive a mechanism in the area of ​​the vehicle V assigned to the zone ECU 13b. The mechanism may be the front or rear wheels of the vehicle V, or a mechanism for opening and closing a window, a door, or a trunk.

[0040] Similarly, the zone ECU 13c controls the actuator 15c in response to the sensing result of the sensor 14c and an instruction from the integrated ECU 100 to drive a mechanism in the area of ​​the vehicle V assigned to the zone ECU 13c. The mechanism may be the front or rear wheels of the vehicle V, or a mechanism for opening and closing a window, a door, or a trunk.

[0041] FIG. 2 is a block diagram showing an example of a functional configuration of a vehicle control system that is the integrated ECU 100 in this embodiment.

[0042] The integrated ECU 100 is configured as a SoC (System on a Chip) and is a system that performs overall control of the vehicle V, such as at least one of the driving of the vehicle V, the body of the vehicle V, and data handled by the vehicle V. Such an integrated ECU 100 includes a first resource providing unit 110, a second resource providing unit 120, a third resource providing unit 130, a fourth resource providing unit 140, a fifth resource providing unit 150, and an application executing unit 190. Note that each of these resource providing units and the application executing unit 190 is realized by the execution of a software program by the integrated ECU 100. Also, the integrated ECU 100 may include one CPU (Central Processing Unit) or multiple CPUs.

[0043] The first resource providing unit 110, the second resource providing unit 120, and the third resource providing unit 130 are configured as virtual machines (also called VMs) and control the vehicle V.

[0044] The first resource providing unit 110 uses a vehicle database as a resource to control the driving route of the vehicle V, and further provides the vehicle database. The vehicle database is also referred to as a vehicle DB hereinafter. The first resource providing unit 110 may have a vehicle database. In addition, the vehicle database may be, for example, personal information of the user of the vehicle V, information indicating the driving operation history of the user, or the driving history of the vehicle V.

[0045] The second resource providing unit 120 uses the driving control function as a resource to control the drive mechanism of the vehicle V, and further provides the driving control function. The driving control function includes, for example, a function to drive the vehicle V, a function to stop the vehicle V, a function to turn the vehicle V right or left, and the like.

[0046] The third resource providing unit 130 uses a body control function of the vehicle V as a resource to control the body of the vehicle V, and further provides the body control function. The body control function is, for example, a function to open and close the windows, trunk, or doors of the vehicle V.

[0047] The fourth resource providing unit 140 is a hypervisor used to realize a virtual machine, and provides hardware resources as resources. The hardware resources are also referred to as HW resources hereinafter. An example of the HW resources is a CPU resource or a memory resource, which may be referred to as a processing resource.

[0048] The fifth resource providing unit 150 is a secure monitor or a secure operating system (OS), and uses a hardware security module (HSM) as a resource to control the vehicle V. Furthermore, the fifth resource providing unit 150 provides the HSM.

[0049] In this manner, each resource providing unit in the present embodiment provides resources used for controlling the vehicle V. In addition, the resources in the present embodiment are at least one of information, functions, and hardware resources used for controlling the vehicle V.

[0050] The application execution unit 190 is configured as a virtual machine that executes an application downloaded via the TCU 11. The application execution unit 190 is an environment in which an application is installed and executed, and is also called an application execution environment or an execution environment. For example, an application is executed by the application execution unit 190 to display an image or video on a display in the vehicle V, or to output sound, voice, or music from a speaker in the vehicle V.

[0051] FIG. 3 is a block diagram showing an example of the functional configuration of the application executing unit 190 and the first resource providing unit 110. As shown in FIG.

[0052] The application executing unit 190 includes a second access control unit 191 , an application identifying unit 192 , an application authority determining unit 193 , a second provision processing unit 194 , a connection unit 195 , and an execution processing unit 196 .

[0053] The application identification unit 192 identifies an application downloaded via the TCU 11, and notifies the application authority determination unit 193 of the identification result. For example, the application identification unit 192 identifies the application by extracting identification information of the application from the application. Then, the application identification unit 192 outputs the identification information to the application authority determination unit 193.

[0054] The application authority determination unit 193 determines whether or not the application has authority based on the application identification result by the application identification unit 192. For example, the application authority determination unit 193 refers to a data table that indicates the authority associated with each of the identification information of each application, and checks the authority associated in the data table with the identification information output from the application identification unit 192. By this check, it is determined whether or not the application has authority.

[0055] The rights include, for example, execution rights, rights to use resources within the environment, and rights to use resources outside the environment. Execution rights are rights to execute an application in the application execution unit 190. In addition, rights to use resources within the environment are rights to allow an application to use resources within the execution environment that are resources that can be provided within the application execution unit 190. In addition, rights to use resources outside the environment are rights to allow an application to use resources outside the execution environment that are resources that can be provided outside the application execution unit 190.

[0056] When the application authority determining unit 193 determines that the application has execution authority, the execution processing unit 196 executes the application.

[0057] The second providing processing unit 194 provides the above-mentioned resources in the execution environment to the application in accordance with the control of the second access control unit 191. The resources in the execution environment may be, for example, a function for displaying an image or video, or a function for outputting sound, voice, or music.

[0058] The second access control unit 191 checks the authority of the application based on the judgment by the application authority judgment unit 193, and permits or prohibits the application from requesting a resource according to the result of the authority confirmation. Specifically, when the application has the authority to use the resource within the environment, the second access control unit 191 permits the application to request the resource within the execution environment. At this time, the second access control unit 191 causes the second providing processing unit 194 to provide the resource within the execution environment to the application. Also, when the application has the authority to use the resource outside the environment, the second access control unit 191 permits the application to request the resource outside the execution environment. At this time, the second access control unit 191 notifies the first access control unit 111 of the first resource providing unit 110 of the request for the resource outside the execution environment by the application via the connection unit 195. In other words, when the application execution unit 190 cannot provide the resource requested by the application program, the second access control unit 191 notifies the first access control unit 111 of the resource request by the application. On the other hand, if the application execution unit 190 can provide the resource, the second access control unit 191 does not notify the first access control unit 111 of the resource request made by the application.

[0059] The connection unit 195 connects to the first access control unit 111 of the first resource providing unit 110. For example, the connection unit 195 connects to the first access control unit 111 when a request for a resource outside the execution environment by an application is permitted by the second access control unit 191. As a result, the second access control unit 191 notifies the first access control unit 111 of the first resource providing unit 110 of the request for a resource outside the execution environment by the application.

[0060] Note that communication between the connection unit 195 and the first access control unit 111 of the first resource providing unit 110 is performed via a hypervisor which is the fourth resource providing unit 140. This hypervisor can be said to be a communication relay unit. In other words, the integrated ECU 100 in this embodiment includes a communication relay unit which relays communication between the application executing unit 190 and the first access control unit 111.

[0061] The first resource providing unit 110 includes a first access control unit 111, an environment identification unit 112, an environment authority determining unit 113, an environment state determining unit 114, a resource state determining unit 115, and a first providing processing unit 116. Each of the second resource providing unit 120, the third resource providing unit 130, the fourth resource providing unit 140, and the fifth resource providing unit 150 may also include a functional configuration similar to that of the first resource providing unit 110.

[0062] When a request for a resource outside the execution environment by an application is notified to the first access control unit 111, the environment identification unit 112 identifies the application and the application execution unit 190 that are the request source of the resource outside the execution environment. In the present embodiment, the integrated ECU 100 includes one application execution unit 190, but the integrated ECU 100 may include a plurality of application execution units 190. For example, the request for the resource outside the execution environment includes identification information of the application and the application execution unit 190. The environment identification unit 112 extracts two pieces of identification information included in the request to identify the application and the application execution unit 190. Then, the environment identification unit 112 outputs the two extracted pieces of identification information to the environment authority determination unit 113.

[0063] The environmental authority determination unit 113 determines whether or not each of the identified application and application execution unit 190 has resource utilization authority for resources outside the execution environment, i.e., authority to utilize resources outside the environment. For example, the environmental authority determination unit 113 refers to a data table that indicates the identification information of each application in association with the authority, and indicates the identification information of each application execution unit in association with the authority. Then, the environmental authority determination unit 113 checks the authority that is associated in the data table with each of the two pieces of identification information output from the application identification unit 192. Through this check, it is determined whether or not the application and application execution unit 190 have the authority.

[0064] Such an environmental authority determining unit 113 is an example of an authority determining unit that determines whether or not an application or application execution unit 190 has authority to use a resource.

[0065] Environmental state determination unit 114 determines whether application execution unit 190 identified by environment identification unit 112 is abnormal. That is, environmental state determination unit 114 determines whether application execution unit 190 has been attacked and compromised through communication with the outside via TCU 11. If application execution unit 190 is compromised, environmental state determination unit 114 determines that application execution unit 190 is abnormal, and if application execution unit 190 is not compromised, determines that application execution unit 190 is not abnormal.

[0066] For example, the environmental state determination unit 114 may determine whether the application execution unit 190 is compromised by detecting the behavior of the application execution unit 190. Furthermore, the environmental state determination unit 114 may determine whether the application execution unit 190 is compromised by a pattern matching method. For example, the environmental state determination unit 114 may determine that the application execution unit 190 is compromised when the pattern of the application execution unit 190 matches a preregistered compromise pattern. Furthermore, the environmental state determination unit 114 may determine that the application execution unit 190 is not compromised if the application execution unit 190 is defended even if it is under attack. For example, the environmental state determination unit 114 monitors communication of the application execution unit 190, and determines that the application execution unit 190 is under attack when the communication is unexpected. However, if the application execution unit 190 under attack is not compromised as a result of the above-mentioned behavior detection, the environmental state determination unit 114 determines that the application execution unit 190 is defended against the attack.

[0067] The resource state determination unit 115 determines whether or not the resource outside the execution environment required by the application is in a state in which it can be provided. For example, if the resource outside the execution environment is not in a conflict state and the use of the resource outside the execution environment does not pose a problem for the current state of the vehicle V, the resource state determination unit 115 determines that the resource outside the execution environment is in a state in which it can be provided. The resource outside the execution environment is not in a conflict state when other components than the application execution unit 190 included in the vehicle V do not use the resource outside the execution environment. The use of the resource outside the execution environment does not pose a problem for the current state of the vehicle V when, for example, the resource outside the execution environment, which is a function for opening the trunk or door, is used when the vehicle V is currently stopped, not when the vehicle V is currently running. Conversely, when the trunk or door is opened by using the resource outside the execution environment when the vehicle V is currently running, this is a problem for the state of the vehicle V. The resource state determination unit 115 refers to, for example, a data table indicating each of a plurality of resources outside the execution environment and the state of the vehicle V required when the resource outside the execution environment is used. Then, the resource state determination unit 115 searches for the state of the vehicle V associated in the data table with the resource outside the execution environment required by the application. The resource state determination unit 115 identifies the current state of the vehicle V, and if the identified current state of the vehicle V is equal to the searched state of the vehicle V, it determines that the use of the resource outside the execution environment is not a problem for the current state of the vehicle V.

[0068] The first provision processing unit 116 provides resources outside the execution environment used for controlling the vehicle V in accordance with the control of the first access control unit 111.

[0069] When a request for a resource outside the execution environment by an application is notified to first access control unit 111, first access control unit 111 determines whether or not to allow first provision processing unit 116 to provide the resource outside the execution environment to the application. That is, when a request for a resource outside the execution environment is received from an application and environmental state determination unit 114 determines that application execution unit 190 is abnormal, first access control unit 111 prohibits first provision processing unit 116 from providing the resource outside the execution environment to the application. Furthermore, in the above-mentioned case, when environmental state determination unit 114 determines that application execution unit 190 is not abnormal, first access control unit 111 permits first provision processing unit 116 to provide the resource outside the execution environment to the application.

[0070] For example, if the application execution unit 190 is compromised by an external attack, the application execution unit 190 is determined to be abnormal. Therefore, since the provision of resources outside the execution environment to an application of such a compromised application execution unit 190 is prohibited, it is possible to prevent the application from inappropriately controlling the vehicle V using the resources outside the execution environment. As a result, it is possible to appropriately control the vehicle V. Specifically, by providing a vehicle database to an application executed by the compromised application execution unit 190, it is possible to prevent the vehicle V from traveling along an inappropriate traveling route.

[0071] Furthermore, the first access control unit 111 also determines whether or not to provide the resource outside the execution environment, depending on the result of the authority determination by the environment authority determination unit 113 and the result of the determination by the resource state determination unit 115 of the state of the resource outside the execution environment.

[0072] In other words, when first access control unit 111 receives a request for a resource outside the execution environment from an application, and when environment state determination unit 114 determines that application execution unit 190 is not abnormal and environment authority determination unit 113 determines that the application or application execution unit 190 has authority, first access control unit 111 permits first provision processing unit 116 to provide the resource outside the execution environment to the application program. Note that this authority is the authority to use resources outside the environment described above.

[0073] This makes it possible to prohibit the provision of resources to an application when the application or the application execution unit 190 does not have the appropriate authority. As a result, it is possible to further prevent a malicious third party from downloading an application program to the integrated ECU 100 and inappropriately controlling the vehicle V.

[0074] Furthermore, when the first access control unit 111 receives a request for resources outside the execution environment from an application, and the environment state determination unit 114 determines that the application execution unit 190 is not abnormal, and the resource state determination unit 115 determines that the resources outside the execution environment are in a state in which they can be provided, the first access control unit 111 permits the first provision processing unit 116 to provide the resources outside the execution environment to the application.

[0075] This makes it possible to prevent, for example, contention in the use of the resource outside the execution environment from occurring when the resource outside the execution environment is permitted to be provided when the resource outside the execution environment is in an unavailable state. Alternatively, it is possible to prevent the control of the vehicle V by an application using the resource outside the execution environment from being performed at an inappropriate timing. For example, it is possible to prevent the trunk from being opened by the control by an application using the resource outside the execution environment while the vehicle V is traveling.

[0076] As described above, each of the second resource providing unit 120, the third resource providing unit 130, the fourth resource providing unit 140, and the fifth resource providing unit 150 may have the same functional configuration as the first resource providing unit 110. In this case, the integrated ECU 100 includes a plurality of resource providing units, each of which includes a first access control unit 111.

[0077] FIG. 4 is a sequence diagram showing the processing operation between the application executing unit 190 and the first resource providing unit 110. As shown in FIG.

[0078] First, application authority determination section 193 of application execution section 190 determines that the application identified by application identification section 192 has execution authority (step S1). Then, execution processing section 196 executes the application (step S2).

[0079] Next, the second access control unit 191 receives a resource request from the application (step S3). If the second access control unit 191 determines that the application execution unit 190 cannot provide the requested resource (step S4), the second access control unit 191 notifies the first resource provision unit 110 of the resource request via the connection unit 195 (step S5). That is, the requested resource is a resource outside the execution environment. In addition, in step S5, the second access control unit 191 notifies the first resource provision unit 110 of the request for the resource outside the execution environment after confirming in advance that the application authority determination unit 193 has determined that the application has the authority to use the resource outside the environment.

[0080] When the request for the resource outside the execution environment is notified to first access control unit 111, environment identification unit 112 of first resource providing unit 110 identifies the requesting application and application execution unit 190. Then, environment authority determination unit 113 determines that the identified application and application execution unit 190 each have authority to use the resource outside the environment (step S6).

[0081] Next, the environment state determining unit 114 determines that the application executing unit 190 is not abnormal (step S7), and the resource state determining unit 115 determines that the requested resource outside the execution environment can be provided (step S8).

[0082] Next, the first access control unit 111 permits the provision of resources outside the execution environment to the application according to the determination results of steps S6, S7, and S8 (step S9). Then, the first provision processing unit 116 provides the resources outside the execution environment to the application of the application execution unit 190 according to the permission for resource provision by the first access control unit 111 (step S10). Then, the application performs processing using the provided resources outside the execution environment (step S11). That is, the application drives the vehicle V, and opens and closes the doors, trunk, or windows of the vehicle V.

[0083] FIG. 5 is a flowchart showing the processing operation of the application executing unit 190.

[0084] First, the application identification unit 192 of the application execution unit 190 identifies an application acquired by the application execution unit 190 via the TCU 11 (step S21). Then, the application authority determination unit 193 determines whether the identified application has authority (step S22). The authority is, for example, execution authority, authority to use resources within the environment, and authority to use resources outside the environment. If it is determined that the application has authority (Yes in step S22), the execution processing unit 196 executes the application (step S23).

[0085] Then, the second access control unit 191 judges whether or not a resource request has been received from the application (step S24). If it is judged that the resource request has not been received (No in step S24), the execution processing unit 196 continues to execute the application. On the other hand, if it is judged that the resource request has been received (Yes in step S24), the second access control unit 191 judges whether or not the requested resource can be provided by the application execution unit 190 (step S25). That is, the second access control unit 191 judges whether the requested resource is a resource within the execution environment or a resource outside the execution environment. Here, if the second access control unit 191 judges that the resource can be provided by the application execution unit 190 (Yes in step S25), it notifies the second provision processing unit 194 of the application execution unit 190 of the resource request (step S26). As a result, the second provision processing unit 194 provides the resource within the execution environment, which is the requested resource, to the application of the execution processing unit 196.

[0086] On the other hand, if the second access control unit 191 determines that the application executing unit 190 cannot provide the resource (No in step S25), it notifies the first resource providing unit 110 of a resource request (step S27). As a result, the first resource providing unit 110 determines whether or not to provide the resource outside the execution environment, which is the requested resource, and provides the resource outside the execution environment to the application if the provision is permitted.

[0087] Then, the second access control unit 191 judges whether or not a resource within the execution environment or a resource outside the execution environment has been provided (step S28). If it is judged that the resource has been provided (Yes in step S28), the second access control unit 191 causes the execution processing unit 196 to execute processing by an application that uses the provided resource (step S29).

[0088] Furthermore, if it is determined in step S22 that the application does not have execution authority (No in step S22), or if it is determined in step S28 that the provision of resources has not been accepted (No in step S28), the application execution unit 190 ends the processing related to the application.

[0089] FIG. 6 is a flowchart showing the processing operation of the first resource providing unit 110.

[0090] First, the first access control unit 111 of the first resource providing unit 110 judges whether or not a request for a resource outside the execution environment has been notified from the application (step S41). If it is judged that no such notification has been received (No in step S41), the first access control unit 111 repeats the process of step S41. On the other hand, if the first access control unit 111 judges that the notification has been received (Yes in step S41), the environment identification unit 112 identifies the application and application execution unit 190 that have requested the resource outside the execution environment. Furthermore, the environment authority judgment unit 113 judges whether or not the identified application and application execution unit 190 have authority to use the resource outside the environment (step S42).

[0091] Here, when it is determined that the application and the application execution unit 190 have the authority to use the resource outside the environment (Yes in step S42), the environment state determination unit 114 determines whether or not the application execution unit 190 is abnormal (step S43). When it is determined that the application execution unit 190 is not abnormal (No in step S43), the resource state determination unit 115 determines whether or not the requested resource outside the execution environment is in a state in which it can be provided (step S44). When it is determined that the resource outside the execution environment is not in a state in which it can be provided (No in step S44), the first access control unit 111 notifies the application execution unit 190 of waiting, holding, or busy (step S45). On the other hand, when it is determined that the resource outside the execution environment is in a state in which it can be provided (Yes in step S44), the first access control unit 111 causes the first provision processing unit 116 to provide the resource outside the execution environment to the application of the application execution unit 190 (step S46).

[0092] Furthermore, in step S42, if the environmental authority determination unit 113 determines that at least one of the application and the application execution unit 190 does not have the authority to use resources outside the environment (No in step S42), the first resource provision unit 110 ends the process related to resource provision. In addition, in step S43, if the environmental state determination unit 114 determines that the application execution unit 190 is abnormal (Yes in step S43), the first resource provision unit 110 also ends the process related to resource provision. Note that, in step S42, if the environmental authority determination unit 113 determines that at least one of the application and the application execution unit 190 does not have the authority to use resources outside the environment (No in step S42), the first access control unit 111 may notify the application execution unit 190 of standby, hold, or Busy, as in step S45. In this case, the first resource provision unit 110 repeatedly executes the process of step S42 until at least one of the application and the application execution unit 190 has the authority to use resources outside the environment.

[0093] [Effects, etc.] As described above, in the integrated ECU 100 in this embodiment, when it is determined that the application executing unit 190, which is an execution environment for executing an application, is abnormal, the first resource providing unit 110 is prohibited from providing the resource to the application. For example, when the application executing unit 190 is compromised due to an external attack, the application executing unit 190 is determined to be abnormal. Therefore, since the provision of the resource to the application of such a compromised application executing unit 190 is prohibited, it is possible to prevent the application from inappropriately controlling the vehicle V by using the resource. As a result, it is possible to appropriately control the vehicle V.

[0094] In addition, the second access control unit 191 checks the authority of the application, and permits or prohibits the application from requesting resources according to the result of the authority check. This makes it possible to prohibit the application from requesting resources when the application does not have the authority to use resources used to control the vehicle V. As a result, it is possible to prevent a malicious third party, who is neither a car manufacturer nor a car dealer, nor a user of the vehicle V, from downloading an application to the integrated ECU 100 and inappropriately controlling the vehicle V.

[0095] Furthermore, when application execution unit 190 is unable to provide the resources requested by the application, second access control unit 191 notifies first access control unit 111 of the resource request made by the application. Furthermore, when application execution unit 190 is able to provide the resources, second access control unit 191 does not notify first access control unit 111 of the resource request made by the application. As a result, the resource request is notified to first access control unit 111 only when application execution unit 190 is unable to provide the resources, and therefore it is possible to prevent the first access control unit 111 from being bothered to notify the resource request even when application execution unit 190 is able to provide the resources. As a result, unnecessary notifications of resource requests are suppressed and the processing load can be reduced.

[0096] Furthermore, when the first access control unit 111 receives a resource request from an application, if it is determined that the application execution unit 190 is not abnormal and if it is determined that the application or the application execution unit 190 has authority, the first access control unit 111 permits the first resource provision unit 110 to provide the resource to the application. In this way, if the application or the application execution unit 190 does not have appropriate authority, it is possible to prohibit the provision of resources to the application. As a result, it is possible to further prevent a malicious third party or the like from downloading an application to the integrated ECU 100 and inappropriately controlling the vehicle V.

[0097] Furthermore, when the first access control unit 111 receives a resource request from an application, and when it is determined that the application execution unit 190 is not abnormal and that the resource is in a state where it can be provided, the first access control unit 111 permits the provision of the resource from the first resource providing unit 110 to the application. As a result, when the resource is in a state where it can be provided, the provision of the resource to the application is permitted. Therefore, when the resource is in a state where it cannot be provided, it is possible to suppress, for example, a contention in the use of the resource that occurs when the provision of the resource is permitted. Alternatively, it is possible to suppress the control of the vehicle V by the application using the resource from being performed at an inappropriate timing. For example, it is possible to suppress the trunk from being opened by the control by the application using the resource while the vehicle V is running.

[0098] Moreover, the integrated ECU 100 includes a first resource providing unit 110 to a fifth resource providing unit 150, each of which includes a first access control unit 111. This makes it possible to appropriately manage the provision of each resource to an application for each resource.

[0099] (Modification) Although the vehicle control system such as the integrated ECU of the present disclosure has been described based on the above embodiment, the present disclosure is not limited to the embodiment. As long as it does not deviate from the spirit of the present disclosure, various modifications conceivable by a person skilled in the art to the above embodiment may also be included in the present disclosure.

[0100] For example, in the above embodiment, the first access control unit 111 is included in the first resource providing unit 110, but may be included in another component constituting the integrated ECU 100. For example, the first access control unit 111 may be included in a component that is less likely to be attacked than the application executing unit 190, among the multiple components constituting the integrated ECU 100. For example, an external application is downloaded to the TCU 11, and the application is installed and executed in the application executing unit 190. Therefore, the closer a component is to the TCU 11 or the application executing unit 190 in terms of a communication path, the more likely it is to be attacked from the outside. Therefore, the first access control unit 111 may be included in a component that is farther away from the TCU 11 or the application executing unit 190 in terms of a communication path. For example, when the third resource providing unit 130 communicates with the application executing unit 190 via the first resource providing unit 110 and the second resource providing unit 120, the first access control unit 111 may be included in the third resource providing unit 130. Furthermore, the fourth resource providing unit 140 or the fifth resource providing unit 150 has stronger authority and a higher security level than the first resource providing unit 110, the second resource providing unit 120, and the third resource providing unit 130. Therefore, the fourth resource providing unit 140 or the fifth resource providing unit 150 may include the first access control unit 111. This makes it possible to reduce the possibility that the first access control unit 111 will be attacked from the outside, and to appropriately control the provision of resources to applications.

[0101] In the above embodiment, the environmental state determination unit 114 may be included in the first resource provision unit 110, but may be included in other components constituting the integrated ECU 100. For example, the environmental state determination unit 114 may be included in the fourth resource provision unit 140, which is a hypervisor that relays communication between the application execution unit 190 and the first access control unit 111. This hypervisor is also called a communication relay unit or a communication phase. Since the hypervisor has stronger authority and a higher security level than each virtual machine, it is possible to reduce the possibility that the environmental state determination unit 114 in the hypervisor is attacked from the outside, and it is possible to appropriately determine whether or not the application execution unit 190 is abnormal.

[0102] In the above embodiment, the first access control unit 111 is included in each of the first resource providing unit 110 to the fifth resource providing unit 150, but the first access control unit 111 common to these resource providing units may be included in the fifth resource providing unit 150. In this case, the first resource providing unit 110 to the fourth resource providing unit 140 are not provided with the first access control unit 111, and the first resource providing unit 110 to the fourth resource providing unit 140 communicate with the common first access control unit 111 included in the fifth resource providing unit 150. As a result, since the fifth resource providing unit 150 is a secure monitor, it is possible to improve security for the first access control unit 111.

[0103] In the above embodiment, environmental state determination unit 114 determines whether application execution unit 190 is abnormal. However, it may determine whether not only application execution unit 190 but also at least one of second resource provision unit 120 to fifth resource provision unit 150 is abnormal. For example, first access control unit 111 may prohibit the provision of a resource when application execution unit 190 is determined not to be abnormal but at least one of second resource provision unit 120 to fifth resource provision unit 150 is determined to be abnormal. Furthermore, instead of determining whether application execution unit 190 and each of second resource provision unit 120 to fifth resource provision unit 150 are abnormal, environmental state determination unit 114 may specify the degree of compromise of each as a numerical value. For example, first access control unit 111 may prohibit the provision of a resource when an integrated value of the degree of compromise of each of application execution unit 190 and second resource provision unit 120 to fifth resource provision unit 150 is equal to or greater than a threshold value.

[0104] In the above embodiment, the first access control unit 111 permits or prohibits the provision of resources based on the respective judgment results of the environmental authority judgment unit 113, the environmental state judgment unit 114, and the resource state judgment unit 115. However, the first access control unit 111 may also permit or prohibit the provision of resources based on the settings of the user of the vehicle V. For example, the vehicle database, which is a resource, may include personal information of the user. The user sets setting information indicating whether or not the application can use the personal information in the in-vehicle system 10. Then, the first access control unit 111 reads out the setting information, and when the setting information indicates, for example, that the use of the personal information is not permitted, the first access control unit 111 prohibits the provision of resources regardless of the judgment result of the environmental authority judgment unit 113 or the like. Alternatively, the first access control unit 111 may inquire of the user as to whether or not the provision of personal information may be permitted. In this case, too, when the first access control unit 111 receives, for example, a response indicating that the use of the personal information is not permitted as a response to the inquiry to the user, the first access control unit 111 prohibits the provision of resources regardless of the judgment result of the environmental authority judgment unit 113 or the like.

[0105] In the above embodiment, when resource state determination unit 115 determines that a resource is in a contention state, first access control unit 111 notifies the application of standby or busy. However, if the priority of another application competing for the resource is lower than the priority of the application of application execution unit 190, first access control unit 111 may permit the provision of the resource to the application of application execution unit 190. In this case, first access control unit 111 may obtain the priority from each of the other competing application and the application of application execution unit 190, and compare the priorities. Furthermore, first access control unit 111 may refer to a data table indicating the priority of each of a plurality of applications. First access control unit 111 refers to the data table to obtain the priority from each of the other competing application and the application of application execution unit 190, and compares the priorities.

[0106] Furthermore, the application execution unit 190 in the above embodiment may be an execution environment dedicated to third-party applications. In this case, the integrated ECU 100 may further include an application execution unit that is an execution environment dedicated to native applications. The application execution unit is hereinafter referred to as a native application execution unit. The native application is a genuine application of the car manufacturer or car dealer of the vehicle V. The native application execution unit may cooperate with the first access control unit 111 and may receive a request from the second access control unit 191.

[0107] In the above embodiment, the application executing unit 190, the first resource providing unit 110, the second resource providing unit 120, and the third resource providing unit 130 are each a virtual machine, but may be a physical machine. In this case, the physical machine may be a CPU. In this case, the integrated ECU 100 includes a plurality of CPUs corresponding to the application executing unit 190, the first resource providing unit 110, the second resource providing unit 120, and the third resource providing unit 130. In addition, the physical machine may be a core included in a CPU. In this case, the CPU includes a plurality of cores corresponding to the first resource providing unit 110, the second resource providing unit 120, and the third resource providing unit 130.

[0108] Also, in the above embodiment, first access control unit 111 permits or prohibits the provision of resources based on the respective determination results of environmental authority determination unit 113, environmental state determination unit 114, and resource state determination unit 115. However, first access control unit 111 may permit or prohibit the provision of resources based on at least one of the determination results of environmental authority determination unit 113, environmental state determination unit 114, and resource state determination unit 115. Furthermore, in the above embodiment, environmental authority determination unit 113 determines the authority of each of the applications and app execution unit 190, but may determine the authority of at least one of the applications and app execution unit 190.

[0109] In at least one of the above embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU (Central Processing Unit) or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory. Here, the software for realizing the image decoding device of each of the above embodiments is a program such as the following.

[0110] That is, this program causes the computer to execute each step of the flowcharts shown in FIGS.

[0111] The following cases are also included in this disclosure:

[0112] (1) The at least one device is specifically a computer system consisting of a microprocessor, a ROM (Read Only Memory), a RAM (Random Access Memory), a hard disk unit, a display unit, a keyboard, a mouse, etc. A computer program is stored in the RAM or the hard disk unit. The at least one device achieves its functions by the microprocessor operating in accordance with the computer program. Here, the computer program is composed of a combination of multiple instruction codes that indicate commands for a computer to achieve a specified function.

[0113] (2) Some or all of the components constituting at least one of the above devices may be composed of one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on one chip, and specifically, is a computer system including a microprocessor, ROM, RAM, etc. A computer program is stored in the RAM. The system LSI achieves its functions by the microprocessor operating in accordance with the computer program.

[0114] (3) A part or all of the components constituting at least one of the above devices may be composed of an IC card or a standalone module that is detachable from the device. The IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunction LSI. The IC card or module achieves its functions by the microprocessor operating according to a computer program. This IC card or module may be tamper-resistant.

[0115] (4) The present disclosure may be embodied as any of the methods described above, a computer program for implementing these methods by a computer, or a digital signal comprising a computer program.

[0116] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD (Compact Disc)-ROM, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Also, the present disclosure may be a digital signal recorded on such a recording medium.

[0117] The present disclosure may also involve transmitting a computer program or a digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0118] Furthermore, the program or digital signal may be recorded on a recording medium and transferred, or the program or digital signal may be transferred via a network or the like, so that the program or digital signal may be implemented by another independent computer system. [Industrial Applicability]

[0119] The vehicle control system of the present disclosure can be applied to, for example, an integrated ECU mounted on a vehicle. [Explanation of symbols]

[0120] 10 In-vehicle systems 11 TCU 12 Cockpit Domain Controller 13a~13c Zone ECU 14a~14c Sensor 15a~15c Actuator 100 Integrated ECU (Vehicle Control System) 110 1st Resource Provision Department 111 First access control unit 112 Environmental Identification Division 113 Environmental Authority Determination Division 114 Environmental condition determination unit 115 Resource Status Determination Unit 116 First Provision Processing Unit 120 2nd Resource Provision Department 130 3rd Resource Provision Department 140 4th Resource Provision Department 150 5th Resource Provision Department 190 Application execution unit 191 Second access control section 192 Application Identification Unit 193 Application authority decision unit 194 Second Provision Processing Unit 195 Connection 196 Execution Processing Unit V Vehicle

Claims

1. A vehicle control system provided in a vehicle, an application execution unit that executes an application program; an environmental state determination unit that determines whether the application execution unit is abnormal; a resource providing unit that provides resources used for controlling the vehicle; a resource status determination unit that determines whether a resource required by the application program is in a state in which it can be provided; a first access control unit that, when a request for the resource is received from the application program, (a) prohibits the resource providing unit from providing the resource to the application program when the environmental state determination unit determines that the application execution unit is abnormal, and (b) allows the resource providing unit to provide the resource to the application program when the environmental state determination unit determines that the application execution unit is not abnormal; the application execution unit includes a second access control unit that receives a resource request from the application program and determines whether the resource can be provided by the application execution unit; The second access control unit is notifying the first access control unit of a result of the determination made by the application execution unit as to whether the resource is to be provided; The first access control unit is determining whether or not to provide the resource to the application program based on an identification result of the application program that requested the resource and the application execution unit, a determination result of the environment state determination unit, and a determination result of the resource state determination unit; Vehicle control system.

2. The second access control unit, verifying the authority of the application program, and allowing, withholding, or prohibiting the application program from requesting the resource depending on the result of the authority verification; The vehicle control system of claim 1 .

3. the resource providing unit includes the first access control unit; The vehicle control system according to claim 2 .

4. The second access control unit is notifying the first access control unit of a request for the resource by the application program when the application execution unit is unable to provide the resource requested by the application program; if the application execution unit is capable of providing the resource, the first access control unit is not notified of the request for the resource by the application program.

4. A vehicle control system according to claim 2 or 3.

5. The vehicle control system further comprises: an authority determination unit that determines whether the application program or the application execution unit has authority to use the resource; The first access control unit is when the application execution unit determines that an abnormality does not exist when a request for the resource is received from the application program, and when the authority determination unit determines that the application program or the application execution unit has the authority, permits the resource provision unit to provide the resource to the application program. The vehicle control system according to any one of claims 1 to 4.

6. The first access control unit, when the application execution unit determines that an abnormality does not exist when a request for the resource is received from the application program, and when the resource state determination unit determines that the resource is in a state in which the resource can be provided, permitting the resource provision unit to provide the resource to the application program; A vehicle control system according to any one of claims 1 to 5.

7. The vehicle control system includes: a plurality of the resource providing units each including the first access control unit; A vehicle control system according to any one of claims 1 to 6.

8. the first access control unit is included in a component that is less likely to be attacked than the application execution unit, among a plurality of components constituting the vehicle control system; A vehicle control system according to any one of claims 1 to 7.

9. The vehicle control system further comprises: a communication relay unit that relays communication between the application execution unit and the first access control unit, The environmental state determination unit is included in the communication relay unit. A vehicle control system according to any one of claims 1 to 8.

10. The resource is at least one of information, functions, and hardware resources used to control the vehicle. A vehicle control system according to any one of claims 1 to 9.

11. A vehicle control method performed by a computer provided in a vehicle, comprising: a first step of determining whether an application execution unit that executes an application program is abnormal; a second step of determining whether resources required by the application program are available; a third step of accepting a resource request from the application program and determining whether the resource can be provided by the application execution unit; a fourth step of notifying a first access control unit of a result of the determination made by the application execution unit as to whether the resource is to be provided; a fifth step in which, when the first access control unit receives from the application program a request for a resource that is outside the application execution unit and is used for controlling the vehicle, (a) when it is determined that the application execution unit is abnormal, the first access control unit prohibits provision of the resource to the application program, and (b) when it is determined that the application execution unit is not abnormal, the first access control unit permits provision of the resource to the application program; and a sixth step of providing the resource to the application program if provision of the resource is permitted; In the fifth step, determining whether or not to provide the resource to the application program based on a result of identifying the application program that requested the resource and the application execution unit, a result of the determination in the second step, and a result of the determination in the third step; A vehicle control method.

12. A vehicle control method according to claim 11, program.

Images