In-vehicle device, information processing method, and information processing program

Abstract

A vehicle-mounted device provided with a processor to which three or more authorization levels of memory access can be set, wherein the authorization level higher than the authorization level for the OS and applications is set to an abnormality notification function for notifying the outside of the vehicle-mounted device of memory access violation.

Description

Technical Field

[0001] The present disclosure relates to an in-vehicle device, an information processing method, and an information processing program. This application claims priority based on Japanese Patent Application No. 2022-94546 filed on June 10, 2022, and incorporates all of the disclosure thereof herein.

Background Art

[0002] Japanese Unexamined Patent Application Publication No. 2014-137734 (Patent Document 1) discloses the following information processing device. That is, the information processing device includes a CPU that repeatedly executes each of a plurality of applications stored in a memory, and memory access monitoring means in which permission / denial information that defines whether to permit or prohibit access to the memory is registered in association with an address where data of each application is stored. When the memory access monitoring means detects a prohibited memory access by the CPU that executes an application, data stored at the address accessed by the CPU is transferred from the memory to a backup area in association with the address by data transfer means, permission / denial information changing means changes the permission / denial information so that memory access to the address is permitted, and after the CPU that executes the application that has performed the prohibited memory access accesses the memory at the address, backup means backs up the data at the accessed address from the memory to a backup area in association with the address. The backup means restores the data in the backup area to the address associated with the data in the backup area before the CPU executes the application that has performed the prohibited memory access next.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

[0004] The in-vehicle device of this disclosure includes a processor capable of setting three or more privilege levels for memory access, wherein a privilege level higher than the privilege levels of the OS and applications is set to an abnormality notification function that notifies an external party of a memory access violation.

[0005] One aspect of this disclosure can be realized not only as an in-vehicle device equipped with such characteristic processing units, but also as a semiconductor integrated circuit that realizes part or all of the in-vehicle device, or as a system including the in-vehicle device. [Brief explanation of the drawing]

[0006] [Figure 1] Figure 1 is a diagram showing the configuration of an in-vehicle system according to an embodiment of the present disclosure. [Figure 2] Figure 2 is a diagram showing the configuration of a processor in an in-vehicle device according to an embodiment of the present disclosure. [Figure 3] Figure 3 shows an example of the processor software configuration and processing in the event of a memory access violation in an area ECU according to an embodiment of the present disclosure. [Figure 4] Figure 4 shows an example of the processor memory map and MPU settings in an area ECU according to an embodiment of the present disclosure. [Figure 5] Figure 5 shows an example of the processor memory map and MPU settings in a comparative example of the area ECU according to the embodiment of this disclosure. [Figure 6] Figure 6 shows an example of the processor memory map and MPU settings in an area ECU according to an embodiment of the present disclosure. [Figure 7] Figure 7 is a flowchart illustrating an example of the operation procedure when the processor of the in-vehicle device according to the embodiment of this disclosure detects a memory access violation. [Figure 8] Figure 8 shows an example of the processing sequence for the abnormality notification function and abnormality monitoring function in an in-vehicle system according to an embodiment of the present disclosure. [Modes for carrying out the invention]

[0007] Traditionally, technologies have been developed to detect and address unauthorized access to memory areas by software.

[0008] [Issues this disclosure aims to address] For example, a microcontroller will generate a memory exception if it detects unauthorized access to a memory area while the OS (Operating System) and applications are running. If the microcontroller does not have a hypervisor, it cannot return to normal operation after a memory exception. Therefore, if it is necessary to notify an external system that a memory exception has occurred, a mechanism is needed to restart the microcontroller before sending the notification.

[0009] This disclosure was made to solve the aforementioned problems, and its purpose is to provide an in-vehicle device, an information processing method, and an information processing program that can more easily notify external parties of memory access violations.

[0010] [Effects of this disclosure] According to this disclosure, memory access violations can be notified to external parties more easily.

[0011] [Description of Embodiments in this Disclosure] First, the embodiments of this disclosure will be listed and explained. (1) The in-vehicle device according to the embodiment of the present disclosure includes a processor capable of setting three or more privilege levels for memory access, wherein a privilege level higher than the privilege levels of the OS and application is set to an abnormality notification function that notifies the outside of the in-vehicle device of a memory access violation.

[0012] With such a configuration, in the state where the OS has been hijacked, it is possible to prevent the notification function for memory access violations from being hijacked as well, and to activate the notification function with a higher privilege level. Therefore, there is no need to install a hypervisor that can execute multiple OSs in parallel on the processor, and there is no need for a mechanism to notify memory access violations after restarting the processor. Thus, it is possible to more easily notify external parties of memory access violations.

[0013] (2) In (1) above, the processor can set a first privilege level, a second privilege level higher than the first privilege level, and a third privilege level higher than the second privilege level. The first privilege level may be set for the application, the second privilege level may be set for the OS, and the third privilege level may be set for the abnormality notification function.

[0014] With such a configuration, an appropriate privilege level can be set for each software. For example, it is possible to prevent the abnormality notification function from being hijacked when the OS is hijacked. Also, it is possible to prevent the OS from being hijacked when the application is hijacked, which would otherwise result in a decrease in the security of the OS.

[0015] (3) In (2) above, in the processor, the third privilege level may further be set for the bootloader.

[0016] With such a configuration, since the privilege level can be divided into three including the setting of the bootloader, the mechanism for setting the privilege level can be simplified.

[0017] (4) In any of (1) to (3) above, after notifying the memory access violation, the abnormality notification function may select whether to stop the abnormality notification function or restart the processor based on the determination result of the notification destination regarding the memory access violation.

[0018] With such a configuration, it is possible to determine, for example, in a device that grasps the configuration of an in-vehicle system, what kind of abnormal processing should be performed on an in-vehicle device that has experienced a memory access violation, so that more appropriate abnormal processing can be performed.

[0019] (5) In the above (4), when the in-vehicle device that notified the memory access violation is an in-vehicle infotainment device, the determination result indicating restart of the processor may be given to the in-vehicle device, and when it is other than the in-vehicle infotainment device, the determination result indicating stop of the abnormal notification function may be given to the in-vehicle device.

[0020] With such a configuration, for example, from the perspective of vehicle driving, it is possible to select restart of an in-vehicle device, or select system stop when restarting one in-vehicle device causes other in-vehicle devices to restart as well.

[0021] (6) The information processing method according to an embodiment of the present disclosure is an information processing method in an in-vehicle device including a processor capable of setting three or more authority levels related to memory access, the processor setting a higher authority level than the authority levels of the OS and the application to an abnormal notification function for notifying a memory access violation outside the in-vehicle device, and the processor detecting a memory access violation by the OS or the application and activating the abnormal notification function.

[0022] By such a method, in a state where the OS has been hijacked, it is possible to prevent the notification function of a memory access violation from being hijacked, and activate the notification function with a higher authority level. For this reason, it is not necessary to mount a hypervisor capable of executing multiple OSs in parallel on the processor, and a mechanism for notifying a memory access violation after restarting the processor becomes unnecessary. Therefore, a memory access violation can be more easily notified to the outside.

[0023] (7) The information processing program according to the embodiment of the present disclosure is an information processing program used in an in-vehicle device equipped with a processor capable of setting three or more privilege levels for memory access, and is a program for causing a computer to function as a setting unit that sets a privilege level higher than the privilege levels of the OS and the application to an abnormality notification function that notifies the outside of the in-vehicle device of a memory access violation, and a detection unit that detects the memory access violation by the OS or the application and activates the abnormality notification function.

[0024] This configuration prevents the memory access violation notification function from being compromised when the OS is compromised, allowing a higher-privilege notification function to be activated. Therefore, there is no need to install a hypervisor on the processor capable of running multiple operating systems in parallel, nor is there a need for a mechanism to restart the processor before notifying of a memory access violation. Consequently, memory access violations can be notified externally more easily.

[0025] Embodiments of this disclosure will be described below with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and their descriptions will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any way.

[0026] [Configuration and Operation] Figure 1 is a diagram showing the configuration of an in-vehicle system according to an embodiment of the present disclosure. Referring to Figure 1, the in-vehicle system 301 comprises an integrated ECU (Electronic Control Unit) 201 and one or more area ECUs 101. The in-vehicle system 301 is mounted on a vehicle 1.

[0027] The integrated ECU 201 and area ECU 101A are connected via cable 3. The integrated ECU 201 and area ECU 101B are connected via cable 4. The network topology of the integrated ECU 201 and area ECU 101 may be a bus type or a star type centered on the integrated ECU 201.

[0028] Cables 3 and 4 are transmission lines that conform to standards such as CAN (Controller Area Network) (registered trademark), CAN FD (CAN with Flexible Data Rate), CAN XL, FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), Ethernet (registered trademark), and LIN (Local Interconnect Network).

[0029] For example, Area ECU 101A generates detection information based on detection results from a detection device (not shown) connected to it, and transmits a frame containing the generated detection information to Integrated ECU 201.

[0030] The integrated ECU 201 is a central unit that processes detection information received from area ECU 101A. The integrated ECU 201 generates control information for controlling actuators (not shown) and transmits a frame containing the generated control information to area ECU 101B. Area ECU 101B receives the control information from the integrated ECU 201 and drives the actuators connected to it based on the received control information.

[0031] The integrated ECU 201 has an abnormality monitoring function, which will be described later. Area ECUs 101A and 101B are examples of in-vehicle devices and are equipped with a processor 51. Area ECUs 101A and 101B have an abnormality notification function, which will be described later.

[0032] Furthermore, the in-vehicle system 301 may be configured to include two or more integrated ECUs 201. Alternatively, the in-vehicle system 301 may be configured to include a gateway device instead of the integrated ECUs 201. Also, the in-vehicle system 301 may be configured to include one or more area ECUs 101.

[0033] Figure 2 is a diagram showing the configuration of a processor in an in-vehicle device according to an embodiment of the present disclosure. Referring to Figure 2, the processor 51 includes a setting unit 11, a detection unit 12, a notification unit 13, and a memory 14. The setting unit 11, the detection unit 12, and the notification unit 13 are implemented by the core of the processor 51.

[0034] The notification unit 13 has an abnormality notification function that notifies the area ECU 101 of an access violation to the memory 14 (hereinafter also referred to as a memory access violation).

[0035] The configuration unit 11 sets the abnormality notification function to a higher privilege level than that of the OS (Operating System) and applications in the MPU (Memory Protection Unit) settings in the memory 14, which will be described later.

[0036] The detection unit 12 monitors each software program's access to the memory 14 on the processor 51. The detection unit 12 refers to the MPU settings of the memory 14 and, if it detects a memory access violation by the OS or an application, activates the abnormality notification function of the notification unit 13.

[0037] For example, processor 51 detects an attack on the vehicle's in-vehicle network as a memory access violation.

[0038] Figure 3 shows an example of the processor software configuration and processing in the event of a memory access violation in an area ECU according to an embodiment of the present disclosure. Figure 4 shows an example of the processor memory map and MPU settings in an area ECU according to an embodiment of the present disclosure.

[0039] Referring to Figures 3 and 4, the processor 51 includes a boot loader, a Real Time Operating System (RTOS), one or more applications, and an error notification function.

[0040] Specifically, the code area of ​​memory 14 stores the boot loader, an RTOS (an example of an operating system), one or more applications, and programs for error notification functions. Memory 14 is further allocated for a temporary data area and a peripheral function area.

[0041] Processor 51 can be configured with three or more privilege levels for memory access. Processor 51 has a higher privilege level set for the anomaly notification function compared to the privilege levels of the OS and applications.

[0042] For example, the processor 51 can set a first privilege level, a second privilege level higher than the first, and a third privilege level higher than the second for software such as the boot loader, applications, the OS, and error notification functions. The first privilege level is set for applications, the second privilege level is set for the OS, and the third privilege level is set for the error notification function. Furthermore, for example, the processor 51 may also set a third privilege level for the boot loader.

[0043] Specifically, in the MPU (Memory Protection Unit) settings, EL (Exception Level) 2 is set for the boot loader, EL1 for the RTOS, EL0 for applications A and B, and EL2 for the error notification function. EL2, EL1, and EL0 are examples of privilege levels that determine the execution rights of software, with the privilege levels increasing in this order. On processor 51, software is prohibited from accessing memory areas corresponding to privilege levels exceeding its own privilege level.

[0044] For example, the MPU settings are stored in a microcontroller function area (not shown) of memory 14. The processor 51 includes program counters for each privilege level.

[0045] Furthermore, the processor 51 may be configured to have four or more privilege levels; for example, the boot loader may be configured to have an EL3 level higher than EL2.

[0046] On processor 51, when powered on or reset, the boot loader starts up and launches the RTOS, which then starts various applications.

[0047] The processor 51 has an MPU configuration function. The processor 51 detects memory access violations according to the MPU configuration. Memory access violations are detected, for example, by the core of the processor 51. When the processor 51 detects a memory access violation, specifically, when it detects an application accessing the memory area of ​​another application or an EL1 or higher memory area, it generates an exception (hereinafter also referred to as memory exception handling). The processor 51 also generates a memory exception if it detects an RTOS accessing an EL2 or higher memory area.

[0048] For example, a memory exception handling process triggers an interrupt handler at the next higher privilege level. Specifically, an EL1 interrupt handler is triggered in the case of a memory access violation by an application. An EL2 interrupt handler is triggered in the case of a memory access violation by the RTOS. These interrupt handlers then activate the EL2 error notification function.

[0049] The abnormality notification function performs notification processing. For example, the abnormality notification function initializes itself and the functions of the processor 51 necessary for abnormality notification, such as the Ethernet function, and sends an abnormality notification to the integrated ECU 201.

[0050] For example, after notifying a memory access violation, the anomaly notification function selects whether to stop the anomaly notification function or restart the processor 51 based on the determination of the recipient of the notification regarding the memory access violation.

[0051] More specifically, for example, if the area ECU 101 that notified the memory access violation is an infotainment system ECU, the integrated ECU 201 gives the area ECU 101 a decision result indicating a system restart, i.e., a restart of the processor 51. On the other hand, if the area ECU 101 that notified the memory access violation is an ECU other than an infotainment system ECU, the integrated ECU 201 gives the area ECU 101 a decision result indicating a system shutdown, i.e., a shutdown of the abnormality notification function. The integrated ECU 201 sends a processing request indicating the decision result to the area ECU 101.

[0052] The abnormality notification function, in accordance with instructions from the integrated ECU 201, i.e., processing requests received from the integrated ECU 201, performs a system restart to start the boot loader, or a system shutdown to wait until a hardware reset or similar action is performed on the processor 51. For example, in the case of a system shutdown, other software remains stopped due to memory exception handling.

[0053] Furthermore, the abnormality notification function may be configured to restart or shut down the system without receiving a processing request from the integrated ECU201.

[0054] Furthermore, the integrated ECU 201 is not limited to a configuration that sends processing requests to the area ECU 101; it may also be configured to send abnormality notifications to a navigation system or the like within the vehicle 1, or to send abnormality notifications to other devices such as a server outside the vehicle 1.

[0055] Figure 5 shows an example of the processor memory map and MPU settings in a comparative example of the area ECU according to the embodiment of the present disclosure. Figure 5 shows the processor having one core and one abnormal General This example shows a system that includes intelligent functions, two RTOSs, and multiple applications.

[0056] Referring to Figure 5, in the comparative example, the processor can only have two privilege levels set, so privilege levels must be shared among any two of the following: the anomaly notification function, the RTOS, and the application, which may lead to security issues.

[0057] Specifically, with the MPU settings in Pattern 1, an abnormality occurs. General Privileged levels are set for the intelligent functions and RTOS, while unprivileged levels are set for each application. In this case, even if an application is compromised, the RTOS will not be compromised, but if the RTOS is compromised, an abnormal state will occur. General There is a possibility that even our cognitive functions could be hijacked.

[0058] In Pattern 2's MPU settings, an abnormality occurs. General A privileged level is set for the intelligent functions, and a non-privileged level is set for the RTOS and each application. In this case, even if the RTOS is taken over, an abnormality will occur. General While intelligent functions may not be hijacked, if an application is compromised, the RTOS could also be compromised, leading to a decrease in RTOS security.

[0059] Figure 6 shows an example of a processor memory map and MPU configuration in an area ECU according to an embodiment of the present disclosure. Similar to Figure 5, Figure 6 shows a case where the processor includes one core, one anomaly detection function, two RTOSs, and multiple applications.

[0060] Referring to Figure 6, the processor 51 allows setting three privilege levels: EL0, EL1, and EL2. This allows setting EL2, EL1, and EL0 respectively for the anomaly notification function, RTOS, and application, as described above, thereby improving security. Specifically, even if an application is compromised, the RTOS will not be compromised, and even if the RTOS is compromised, an anomaly will not be detected. General Intelligent functions can be kept in a state where they cannot be hijacked.

[0061] [Operation Flow] The in-vehicle device according to the embodiment of this disclosure includes a computer including memory, and the processor in the computer reads and executes a program from the memory that includes some or all of the steps of the following flowchart and sequence. This program can be installed externally. This program is distributed either stored on a recording medium or via a communication line.

[0062] Figure 7 is a flowchart illustrating an example of the operation procedure when the processor of the in-vehicle device according to the embodiment of this disclosure detects a memory access violation.

[0063] Referring to Figure 7, first, when the processor 51 is powered on or reset (step S1), the boot loader starts at privilege level EL2 (step S2).

[0064] Next, the boot loader sets the privilege levels EL1 and EL2, respectively, for the RTOS and error notification function, according to the MPU settings in memory 14 (step S3).

[0065] Next, the boot loader starts the RTOS (step S4).

[0066] Next, the RTOS sets the privilege level to EL0 for each application according to the MPU settings in memory 14 (step S5).

[0067] Next, the RTOS launches each application (step S6).

[0068] Next, if a memory access violation by the RTOS or application is detected (YES in step S7), an interrupt is generated as a memory exception (step S8), and the abnormality notification function is activated by the interrupt (step S9).

[0069] Next, the abnormality notification function performs notification processing, for example, self-initialization, initialization of the functions of the processor 51 necessary for abnormality notification, and sending an abnormality notification to the integrated ECU 201 (step S10).

[0070] Figure 8 shows an example of the processing sequence for the abnormality notification function and abnormality monitoring function in an in-vehicle system according to an embodiment of the present disclosure.

[0071] Referring to Figure 8, first, in area ECU 101, the abnormality notification function is activated upon detection of a memory access violation (step S11).

[0072] Next, abnormal General The intelligence function initializes itself and the functions of the processor 51 necessary for abnormality notification (step S12), and sends an abnormality notification to the integrated ECU 201 (step S13).

[0073] Next, when the anomaly monitoring function in the integrated ECU 201 receives an anomaly notification from the area ECU 101 (YES in step S14), it determines what action should be taken in the area ECU 101. Specifically, for example, the anomaly monitoring function determines that if the source of the anomaly notification is an infotainment system ECU such as an ECU related to car navigation or an ECU related to audio, it should restart the system; otherwise, it determines that it should shut down the system (step S15).

[0074] Next, the abnormality monitoring function sends a processing request indicating the judgment result to the area ECU 101 (step S16).

[0075] Next, when the abnormality notification function in the area ECU 101 receives a processing request from the integrated ECU 201 (YES in step S17), it determines the content of the abnormality processing according to the processing request (step S18), and then restarts the system (step S19) or shuts down the system (step S20).

[0076] In the in-vehicle device according to the embodiment of this disclosure, a host-type IDS is implemented as described above. More specifically, intrusion detection refers to the process of detecting signs that may indicate an incident by monitoring events occurring in a computer system or network and analyzing the monitoring results. IDS (Intrusion Detection System) refers to software that has the function of automating the intrusion detection process. A host-type IDS is one that monitors events occurring within a single host, such as a microcontroller or microprocessor, and notifies a detection master. One type of host-type IDS is one that has the function of detecting access to memory areas that are not permitted by the software.

[0077] The embodiments described above should be considered in all respects to be illustrative and not restrictive. The scope of the present invention is indicated by the claims rather than the above description, and all modifications within the meaning and scope of the claims are intended to be included. [Explanation of Symbols]

[0078] 1 vehicle 3,4 Cable 11. Settings section 12 Detection unit 13 Notification Department 14 memory 51 processors 101, 101A, 101B Area ECU 201 Integrated ECU 301 In-vehicle systems

Claims

1. It is an in-vehicle device, Equipped with a processor capable of setting three or more privilege levels for memory access, The aforementioned privilege level, which is higher than the aforementioned privilege level of the OS (Operating System) and applications, is set to an abnormality notification function that notifies the outside of the in-vehicle device of a memory access violation. The in-vehicle device wherein, when the processor detects the memory access violation, it generates an interrupt process for the OS or application that detected the memory access violation, which has one higher privilege level, and the abnormality notification function is activated by the interrupt process.

2. The processor is capable of setting a first privilege level, a second privilege level higher than the first privilege level, and a third privilege level higher than the second privilege level. The in-vehicle device according to claim 1, wherein the first permission level is set for the application, the second permission level is set for the OS, and the third permission level is set for the abnormality notification function.

3. The in-vehicle device according to claim 2, wherein the third authority level is further set for the boot loader in the processor.

4. The in-vehicle device according to any one of claims 1 to 3, wherein the abnormality notification function, after notifying the memory access violation, selects whether to stop the abnormality notification function or restart the processor based on the determination result of the recipient of the notification regarding the memory access violation.

5. The in-vehicle device according to claim 4, wherein if the in-vehicle device that notified the memory access violation is an infotainment-type in-vehicle device, the determination result indicating a restart of the processor is given to the in-vehicle device, and if it is not an infotainment-type in-vehicle device, the determination result indicating a deactivation of the abnormality notification function is given to the in-vehicle device.

6. An information processing method in an in-vehicle device equipped with a processor capable of setting three or more privilege levels for memory access, The processor sets the privilege level, which is higher than the privilege level of the OS and the application, to an abnormality notification function that notifies the outside of the in-vehicle device of a memory access violation. An information processing method comprising the steps of: the processor detecting the memory access violation by the OS or application, generating an interrupt process at one privilege level higher than the privilege level of the OS or application in which the memory access violation was detected, and activating the abnormality notification function by the interrupt process.

7. An information processing program used in an in-vehicle device equipped with a processor capable of setting three or more privilege levels for memory access, Computers, A setting unit sets the aforementioned privilege level, which is higher than the aforementioned privilege levels of the OS and applications, to an abnormality notification function that notifies the outside of the in-vehicle device of a memory access violation, A detection unit that detects the memory access violation by the OS or application and activates the abnormality notification function. It is a program designed to function as such. The detection unit, upon detecting the memory access violation, generates an interrupt process at one privilege level higher than the privilege level of the OS or application where the memory access violation was detected, and the abnormality notification function is activated by the interrupt process, according to the information processing program.

Images