Abnormality detection device, abnormality detection method, and abnormality detection program

Abstract

An abnormality detection device according to the present invention detects abnormalities at one or more virtual systems included in a virtualized system built on hardware. The abnormality detection device comprises: a measurement unit that measures at least one of a first period that is the execution period of the virtual system and a second period that is the execution period of a virtual machine executed on the virtual system over repeated first periods and second periods; and an abnormality detection unit that detects abnormalities at the virtual system on the basis of at least one of the first period and the second period as measured by the measurement unit.

Description

Anomaly detection device, anomaly detection method, and anomaly detection program

[0001] This application claims priority to Japanese Patent Application No. 2023-094215 filed on June 7, 2023, and incorporates by reference the entire contents of that application.

[0002] Patent Document 1 discloses a system that detects abnormalities by monitoring the operation of applications in virtual machines (hereinafter also referred to as "VMs") in a virtualization system virtualized by a hypervisor (hereinafter also referred to as "HVs") and by monitoring requests from VMs to HVs in the virtualization system.

[0003] International Publication No. WO 2022 / 185626 JP 2012-168755 A International Publication No. WO 2022 / 130743 International Publication No. WO 2022 / 254521 US Patent Application Publication No. 2012 / 0324236 Specification International Publication No. WO 2019 / 237072

[0004] An anomaly detection device according to one aspect of the present disclosure is an anomaly detection device that detects an anomaly in one or more virtual systems included in a virtualization system configured on hardware, and includes: a measurement unit that measures at least one of a first period, which is the execution period of the virtual system, and a second period, which is the execution period of a virtual machine running in the virtual system, in a repetition of the first period and the second period; and an anomaly detection unit that detects an anomaly in the virtual system based on at least one of the first period and the second period measured by the measurement unit.

[0005] FIG. 1 is a block diagram showing an example of the configuration of an in-vehicle system according to a first embodiment. FIG. 2 is a block diagram showing an example of the configuration of an in-vehicle device according to the first embodiment. FIG. 3 is a schematic diagram illustrating a virtual environment in an in-vehicle device according to the first embodiment. FIG. 4 is a diagram illustrating an example of time management by a hypervisor. FIG. 5 is a diagram illustrating an example of measurement of an execution period of a virtual machine. FIG. 6 is a flowchart illustrating an example of measurement processing by a measurement program in an in-vehicle device according to the first embodiment. FIG. 7 is a flowchart illustrating an example of anomaly detection processing by an anomaly detection program in an in-vehicle device according to the first embodiment. FIG. 8 is a diagram illustrating the results of simulation 1. FIG. 9 is a diagram illustrating the results of anomaly detection in simulation 1. FIG. 10 is a diagram illustrating the results of simulation 2. FIG. 11 is a diagram illustrating the results of anomaly detection in simulation 2. FIG. 12 is a schematic diagram illustrating a virtual environment in an in-vehicle device according to a second embodiment. FIG. 13 is a schematic diagram illustrating a virtual environment in an in-vehicle device according to a third embodiment. FIG. 14 is a schematic diagram illustrating a virtual environment in an in-vehicle device according to a fourth embodiment. FIG. 15 is a schematic diagram illustrating a virtual environment in an in-vehicle device according to a fifth embodiment. FIG. 16 is a schematic diagram for explaining a virtual environment in an in-vehicle device according to the sixth embodiment.

[0006] <Problem to be Solved by the Present Disclosure> However, the system disclosed in Patent Document 1 can only detect predetermined types of abnormalities.

[0007] <Effects of the Present Disclosure> According to the present disclosure, it is possible to detect an abnormality occurring in a hypervisor, not limited to a specific type of abnormality.

[0008] <Outline of Embodiments of the Present Disclosure> Below, an outline of embodiments of the present disclosure will be listed and described.

[0009] (1) An anomaly detection device according to this embodiment is an anomaly detection device that detects an anomaly in one or more virtual systems included in a virtualization system configured on hardware, and includes: a measurement unit that measures at least one of a first period, which is an execution period of the virtual system, and a second period, which is an execution period of a virtual machine running in the virtual system, over a cycle of the first period and the second period; and an anomaly detection unit that detects an anomaly in the virtual system based on at least one of the first period and the second period measured by the measurement unit. If the virtual system is subjected to an attack such as tampering, unauthorized processing occurs in the virtual system, causing the first period or the second period to become abnormally long. Therefore, it is possible to detect an anomaly occurring in the virtual system, not limited to a specific type of anomaly, based on at least one of the first period and the second period.

[0010] (2) In the above (1), the measurement unit may measure the second period by recording a start time of the process by the virtual machine and an end time of the process by the virtual machine, and calculating a difference between the recorded end time and the start time. The second period can be measured by recording the start time and end time of the process by the virtual machine using timestamps.

[0011] (3) In the above (2), the measurement unit may measure the first period by calculating a difference between the recorded start time and end time. This allows the first period to be measured by recording the start time and end time of processing by the virtual machine using timestamps.

[0012] (4) In the above (2) or (3), the measurement unit may estimate a start timing of the second period by the virtual machine and record the start time by acquiring time information at the estimated start timing, and may estimate an end timing of the second period and record the end time by acquiring time information at the estimated end timing. A virtual machine cannot recognize the start and end of processing. Therefore, with the above configuration, for example, the virtual machine can record the start and end times of processing of the virtual machine.

[0013] (5) In the above (4), the measurement unit may estimate the end timing to be a timing a certain period of time after recording the start time. This allows, for example, a virtual machine to estimate the end timing of the virtual machine's processing.

[0014] (6) In the above (5), the certain period may be a period shorter than the remaining time of the second period from the recording of the start time. If the end timing cannot be accurately estimated, for example, it is possible to erroneously estimate a time after the execution period of the virtual machine's processing has ended as the end timing. With the above configuration, it is possible to estimate a time before the execution period of the virtual machine's processing has ended as the end timing.

[0015] (7) In any one of (4) to (6) above, the measurement unit may estimate the start timing of the second period of the next cycle based on the remaining time of the second period from when the start time was recorded and a margin period. This makes it possible to record the start time and end time of the second period over multiple cycles.

[0016] (8) In any one of (1) to (7) above, the anomaly detection unit may detect the anomaly when the first period measured by the measurement unit deviates from a first normal range or when the second period measured by the measurement unit deviates from a second normal range. This makes it possible to detect an anomaly occurring in the virtual system, not limited to a specific type of anomaly.

[0017] (9) In any one of (1) to (8) above, the anomaly detection unit may be included in the virtual machine. This makes it possible to detect an anomaly in the virtual system while suppressing the impact of the anomaly occurring in the virtual system.

[0018] (10) In any one of (1) to (8) above, the anomaly detection unit may be implemented by a processor different from a processor that executes the virtual system, thereby enabling accurate detection of an anomaly in the virtual system while suppressing the impact of the anomaly occurring in the virtual system.

[0019] (11) In any one of (1) to (8) above, the anomaly detection unit may be realized by a hardware security module. This allows anomalies to be detected by a hardware security module (HSM) that has security measures implemented.

[0020] (12) In any one of (1) to (8) above, the anomaly detection unit may be included in a second virtual system that is a virtual system different from the first virtual system, which is the virtual system. This makes it possible to detect an anomaly in the first virtual system while suppressing the impact of an anomaly occurring in the first virtual system.

[0021] (13) In any one of (1) to (12) above, the measurement unit may be included in the virtual machine, thereby making it possible to measure the first period and the second period while suppressing the influence of an abnormality occurring in the virtual system.

[0022] (14) In any one of (1) to (8) above, the measurement unit may be included in a first virtual machine that is the virtual machine, and the anomaly detection unit may be included in a second virtual machine that runs in a second virtual system that is a virtual system different from the first virtual system that is the virtual system. This makes it possible to measure the first period and the second period while suppressing the influence of an anomaly occurring in the virtual system.

[0023] (15) In the above (14), the measurement unit may provide information indicating the measured first and second periods to the anomaly detection unit via a shared memory, thereby allowing information on the measurement results by the measurement unit to be passed from the first virtual machine to the second virtual machine.

[0024] (16) An anomaly detection method according to this embodiment is an anomaly detection method for detecting an anomaly in one or more virtual systems included in a virtualization system configured on hardware, and includes the steps of: measuring at least one of a first period, which is an execution period of the virtual system, and a second period, which is an execution period of a virtual machine executed in the virtual system, during repetition of the first period and the second period; and detecting an anomaly in the virtual system based on the measured at least one of the first period and the second period. Therefore, it is possible to detect an anomaly occurring in the virtual system, not limited to a specific type of anomaly, based on at least one of the first period and the second period.

[0025] (17) An anomaly detection program according to this embodiment is an anomaly detection program for detecting an anomaly in one or more virtual systems included in a virtualization system configured on hardware, and causes a computer to execute the steps of: measuring at least one of a first period that is an execution period of the virtual system and a second period that is an execution period of a virtual machine executed in the virtual system, while the first period and the second period are repeated; and detecting an anomaly in the virtual system based on the measured at least one of the first period and the second period. Therefore, it is possible to detect an anomaly occurring in the virtual system, not limited to a specific type of anomaly, based on at least one of the first period and the second period.

[0026] The present disclosure can be realized not only as an anomaly detection device having the above-described characteristic configuration, an anomaly detection method having characteristic processing steps, and an anomaly detection program that causes a computer to execute the characteristic processing, but also as an anomaly detection system that includes the anomaly detection device, or as a semiconductor integrated circuit in which part or all of the anomaly detection device is implemented.

[0027] <Details of the embodiments of the present disclosure> Hereinafter, the details of the embodiments of the present disclosure will be described with reference to the drawings. Note that at least some of the embodiments described below may be combined in any manner.

[0028] 1. First Embodiment 1-1. In-Vehicle System Fig. 1 is a block diagram showing an example of the configuration of an in-vehicle system according to the first embodiment. An in-vehicle system 10 is mounted on a vehicle.

[0029] The in-vehicle system 10 according to the first embodiment includes in-vehicle devices 100A, 100B, 100C, and 100D, a relay device 20, and an external communication device 30. Note that the in-vehicle devices included in the in-vehicle system 10 are not limited to the in-vehicle devices 100A, 100B, 100C, and 100D, and an in-vehicle device not shown may also be included in the in-vehicle system 10. The in-vehicle system 10 is an in-vehicle network configured by the in-vehicle devices 100A, 100B, 100C, and 100D, the relay device 20, the external communication device 30, and communication cables (communication buses 40A, 40B, and 40C) connecting them.

[0030] Multiple in-vehicle devices 100A, 100B, 100C, and 100D are arranged in various parts of the vehicle. The in-vehicle devices 100A, 100B, 100C, and 100D individually control the hardware of each part of the vehicle and monitor the status of the hardware of each part of the vehicle. For example, the in-vehicle devices 100A, 100B, 100C, and 100D are ECUs (Electronic Control Units) for a control system, a body system, and an information system. In the following description, the in-vehicle devices 100A, 100B, 100C, and 100D are also collectively referred to as "in-vehicle devices 100."

[0031] The relay device 20 is connected to the in-vehicle devices 100A, 100B, 100C, and 100D via buses 40A, 40B, and 40C, such as a CAN (Controller Area Network) bus. Specifically, the in-vehicle devices 100A and 100B are connected to the bus 40A. The in-vehicle devices 100C and 100D are connected to the bus 40B. The external communication device 30 is connected to the bus 40C. The relay device 20 relays communications between the buses 40A, 40B, and 40C.

[0032] The relay device 20 and the in-vehicle device 100 use a specific communication protocol, such as CAN, CAN FD (CAN with Flexible Data Rate), or Ethernet ("Ethernet" is a registered trademark).

[0033] The relay device 20 functions as a gateway that relays communications between a plurality of on-board devices 100. The on-board devices 100 can transmit messages. The relay device 20 relays messages between on-board devices 100 connected to different buses. For example, the relay device 20 can relay messages between on-board device 100A connected to bus 40A and on-board device 100C connected to bus 40B.

[0034] The relay device 20 is connected to the external communication device 30 via a bus 40C. The external communication device 30 is, for example, a wireless communication terminal conforming to 5G or 4G, such as a TCU (Telematics Control Unit). The external communication device 30 can communicate with the server 50. The external communication device 30 and the relay device 20 relay communication between the server 50 and the in-vehicle device 100.

[0035] 2 is a block diagram showing an example of the configuration of the in-vehicle device according to embodiment 1. The in-vehicle device 100 includes a processor 101, a non-volatile memory 102, a volatile memory 103, a communication interface (I / F) 104, and a hardware security module (HSM) 105.

[0036] The volatile memory 103 is a semiconductor memory such as a static random access memory (SRAM) or a dynamic random access memory (DRAM). The nonvolatile memory 102 is a flash memory, a hard disk, etc. The nonvolatile memory 102 is capable of reading and writing data.

[0037] The processor 101 is, for example, a CPU (Central Processing Unit). However, the processor 101 is not limited to a CPU. The processor 101 may be a GPU (Graphics Processing Unit). The processor 101 is configured to be able to execute computer programs. However, the processor 101 may include, for example, an ASIC (Application Specific Integrated Circuit) in part, or may include a programmable logic device such as an FPGA (Field Programmable Gate Array) in part.

[0038] The processor 101 includes a clock (CLK) 106. The clock 106 outputs a clock signal at regular intervals. The processor 101 includes, for example, a time stamp counter (TSC) (not shown), which can clock the time of the processor 101. The time clocked by the TSC is the internal time of the in-vehicle device 100. The internal time of the in-vehicle device 100 is, for example, absolute time synchronized by an NTP (Network Time Protocol) server. The absolute time is, for example, Japan Standard Time (JST), or, in another example, Coordinated Universal Time (UTC). Hereinafter, the internal time of the in-vehicle device 100 is also referred to as "system time."

[0039] The communication I / F 104 is a communication interface that complies with the above-described communication protocol for the in-vehicle network. The communication I / F 104 includes one communication port and is connected to one of the buses 40A, 40B, and 40C. Hereinafter, the buses 40A, 40B, and 40C are collectively referred to as the "bus 40." The communication I / F 104 is connected to the in-vehicle device 100 and the relay device 20 via the bus 40. The in-vehicle device 100 can communicate with other in-vehicle devices 100, the relay device 20, and the external communication device 30 via the communication I / F 104. Furthermore, the in-vehicle device 100 can communicate with the server 50 via the external communication device 30 via the communication I / F 104.

[0040] A hypervisor (HV) 110, operating systems (OS) 111A and 111B, and applications (APP) 112A and 112B are installed in the non-volatile memory 102. The HV 110 is executed by the processor 101, causing the in-vehicle device 100 to function as a virtual machine. Some or all of the HV 110, the OSs 111A and 111B, and the APPs 112A and 112B may be loaded into the volatile memory 103 and executed.

[0041] 3 is a schematic diagram illustrating a virtualization system in an in-vehicle device according to the first embodiment. The HV 110 operates on hardware 120 (including a processor 101, a non-volatile memory 102, a volatile memory 103, and a communication I / F 104). The HV 110 can emulate virtual hardware (HW). The HV 110 is a virtual system that virtualizes hardware. A virtual machine VM_1 is realized by emulating one virtual HW, and a virtual machine VM_2 is realized by emulating another virtual HW. The term "virtualization system" used here refers to the entire computer system virtualized by the HV 110 in the in-vehicle device 100. The virtualization system 200 is configured on the hardware 120 and includes an HV 110, a VM_1, an OS 111A and an APP 112A executed on the VM_1, and a VM_2, an OS 111B and an APP 112B executed on the VM_2. In the first embodiment, the virtualization system 200 includes one HV 110. However, this is not limited thereto, and the virtualization system 200 may include multiple HVs. Note that, although the number of virtual machines in one HV is two here, this is not limited thereto. For example, the number of virtual machines in one HV may be one, or may be three or more. Furthermore, it is sufficient that at least one in-vehicle device 100 has a virtualization system based on the HV. In other words, all in-vehicle devices 100 may have a virtualization system based on the HV, or only some of the in-vehicle devices 100 may have a virtualization system based on the HV.

[0042] OS 111A runs on VM_1. In VM_1, APP 112A runs on OS 111A. OS 111B runs on VM_2. In VM_2, APP 112B runs on OS 111B. APP 112A is, for example, engine control software. When processor 101 executes APP 112A, in-vehicle device 100 can control the engine. APP 112B is, for example, power window control software. When processor 101 executes APP 112B, in-vehicle device 100 can control the power window.

[0043] The HV 110 manages the execution periods of the VM_1 and the VM_2. The execution periods of the VM_1 and the VM_2 are allocated in a time-sharing manner.

[0044] A partial area of ​​the volatile memory 103 is used as a shared memory 103a, which is a memory area available to both VM_1 and VM_2.

[0045] Returning to FIG. 2 , the non-volatile memory 102 stores an anomaly detection program 113 and a measurement program 114, which are computer programs. The non-volatile memory 102 stores, for example, data used in the anomaly detection program 113 and the measurement program 114. Note that it is sufficient that the anomaly detection program 113 and the measurement program 114 are installed in at least one on-board device 100. That is, the anomaly detection program 113 and the measurement program 114 may be installed in all on-board devices 100, or may be installed in only some of the on-board devices 100. For example, the anomaly detection program 113 and the measurement program 114 may be installed in the on-board device 100 in which the HV 110 is installed. Either one or both of the anomaly detection program 113 and the measurement program 114 may be loaded into the volatile memory 103 and executed.

[0046] The anomaly detection program 113 is a program for detecting an anomaly in the HV 110. For example, the HV 110 may be subjected to attacks such as hyperjacking, hypercall attacks, hypervisor DoS (Denial of Services), VM escape attacks, and cross-VM cache (side channel attacks). When subjected to such attacks, the HV 110 may execute abnormal (illegal) processing or may become unable to perform normal processing. The anomaly detection program 113 is a program for detecting such an anomaly.

[0047] The measurement program 114 is a program for acquiring data for detecting an abnormality in the HV 110. Specifically, the measurement program 114 is a program for measuring the execution periods of the VM_1 and VM_2.

[0048] 1-3. Functions of the In-Vehicle Device The functions of the in-vehicle device 100 will be described with reference to Fig. 3. The in-vehicle device 100 is an example of an "anomaly detection device."

[0049] The in-vehicle device 100 has the functions of measurement units 121A and 121B, an abnormality detection unit 122, and an abnormality notification unit 123. The processor 101 executes an abnormality detection program 113 to realize the functions of the abnormality detection unit 122 and the abnormality notification unit 123. The processor 101 executes a measurement program 114 to realize the functions of the measurement units 121A and 121B.

[0050] The abnormality detection program 113 is a program executed in the VM_1. In the VM_1, the abnormality detection program 113 runs on the OS 111A. That is, the abnormality detection unit 122 and the abnormality notification unit 123 are functions of the VM_1.

[0051] The measurement program 114 is a program executed in VM_1 and VM_2. In VM_1, the measurement program 114 runs on OS 111A. In VM_2, the measurement program 114 runs on OS 111B. That is, the measurement unit 121A is a function of VM_1, and the measurement unit 121B is a function of VM_2.

[0052] 4 is a diagram illustrating an example of time management by a hypervisor. The HV 110 allocates an execution period of the HV 110, an execution period of VM_1, and an execution period of VM_2 in a time-sharing manner. Specifically, the time schedule of the HV 110 repeats a fixed schedule period. Each schedule period includes an execution period of the HV 110, an execution period of VM_1, and an execution period of VM_2.

[0053] 4, C1 and C2 indicate schedule periods. Schedule period C1 starts at time t10, and the execution period of HV110 is first allocated from time t10 to t11. t11 to t12 is the execution period T1 of VM_1, t12 to t13 is the execution period of HV110, t13 to t14 is the execution period T2 of VM_2, and t14 to t15 is the execution period of HV110. t15 to t20 are idle periods. Schedule period C1 ends at time t20, and the next schedule period C2 starts.

[0054] Returning to FIG. 3, the measurement units 121A and 121B measure the execution period of the HV 110, the execution period T1 of the VM_1, and the execution period T2 of the VM_2, respectively.

[0055] In a specific example, the measurement unit 121A measures an execution period T1 of VM_1, and the measurement unit 121B measures an execution period T2 of VM_2.

[0056] 5 is a diagram illustrating an example of measurement of the execution period of VM_2. Here, measurement of the execution period T2 of VM_2 will be described as a representative example, but measurement of the execution period T1 of VM_1 is similar.

[0057] VM_2 can measure time using a timer based on the clock 106. This timer function of VM_2 measures time only within its own execution period (hereinafter also referred to as "local time") and cannot measure time during the execution periods of the HV and VM_1. VM_2 does not recognize each execution period as being a separate period, but rather as a continuous period. In other words, VM_2 recognizes that the end of one execution period and the start of the next execution period are continuous. Therefore, VM_2's local time is the continuous time between the end of one execution period and the start of the next execution period.

[0058] VM_2 can recognize the start timing of its first execution period, but as described above, VM_2 cannot recognize the end timing of its first execution period or the start and end timings of its second and subsequent execution periods.

[0059] After VM_2 is started, VM_2 starts the measurement unit 121B first. That is, the measurement unit 121B starts before the APP 112B. At the start timing of the first execution period of VM_2 (that is, the execution period immediately after VM_2 is started), more specifically, without delay from the time when VM_2 is started, the measurement unit 121B records the start time in an internal memory of the in-vehicle device 100, for example, in the volatile memory 103. Hereinafter, recording time information in the internal memory is also referred to as "time stamping."

[0060] The measurement unit 121B estimates the end time of the execution period when Δt has elapsed since the start time of the execution period. At the start time of the execution period, the measurement unit 121B sets the first timer of VM_2 to Δt. Δt is a time corresponding to the length of one execution period, and more specifically, is a period that is a predetermined time shorter than one execution period. Δt is a period shorter than the remaining time tL, which will be described later.

[0061] The measurement unit 121B acquires the remaining time tL of the execution period. The measurement unit 121B estimates the start timing of VM_2's execution period in the next schedule cycle as a time ΔM after the actual end time of the execution period (i.e., the time after the remaining time tL has elapsed). After VM_2's execution period, the next execution period of VM_2 arrives after the execution period of HV110, an idle period, the execution period of HV110, the execution period of VM_1, and the execution period of HV110. However, because VM_2 can only recognize the local time described above, it recognizes the start of its next execution period as the time when tL has elapsed since the start time was stamped (although this may actually be slightly earlier or later due to a small error). In other words, VM_2's timers (the first timer described above and the second timer described below) are stopped during the idle period, the execution period of HV110, and the execution period of VM_1. Therefore, the timing when the remaining time tL and ΔM have elapsed for VM_2 is the timing when ΔM has elapsed since the start of the next execution period.

[0062] The measurement unit 121B determines the actual end time of the execution period when the remaining time tL has elapsed since the start time was stamped. The measurement unit 121B sets the second timer of VM_2 to tL+ΔM, which is the estimated start time of the execution period of VM_2 in the next schedule cycle.

[0063] When the end timing arrives, that is, when the first timer expires, the measurement unit 121B stamps the end time. In other words, the measurement unit 121B acquires time information at the end timing and records the acquired time information in its internal memory.

[0064] The measurement unit 121B records the start time when the remaining time tL and ΔM have elapsed, that is, when the execution period of VM_2 in the next schedule cycle starts. That is, the measurement unit 121B records the start time by obtaining time information at the start time.

[0065] ΔM is the margin time. Here, consider the point when the remaining time tL has elapsed as the start timing for the next execution period and stamp the start time. In this case, if fluctuations in time measurement occur due to the accuracy of the timer, it is possible that the start time of the next execution period will be stamped before the end of the previous execution period. ΔM is a value that avoids such stamping errors and ensures that the start time of the next execution period is stamped reliably.

[0066] As with the first execution period described above, the measurement unit 121B estimates the end time of the execution period to be the time Δt after the start time, and stamps the end time when the end time arrives. Thereafter, the start time and end time of each execution period are repeatedly stamped in the same manner as described above.

[0067] Returning to FIG. 3 , the measurement unit 121B measures the execution period (second period) T_VM2 of VM_2 based on the timestamps of the start and end times obtained as described above. Specifically, the measurement unit 121B measures the execution period T_VM2 of VM_2 by calculating the difference between the recorded end time and start time. Similarly, the measurement unit 121A measures the execution period T_VM1 of VM_1 by calculating the difference between the recorded end time and start time. The measurement of T_VM2 is performed during the execution period of VM_2. More specifically, the measurement of T_VM2 is performed repeatedly for each execution period of VM_2. The measurement of T_VM1 is performed during the execution period of VM_1. Even more specifically, the measurement of T_VM1 is performed repeatedly for each execution period of VM_1.

[0068] Furthermore, the measurement units 121A and 121B can measure the execution period T_HV1 of the HV 110. For example, the measurement unit 121B writes the recorded start time and end time along with the measured execution period of VM_2 to the shared memory 103a. That is, the measurement unit 121B writes the execution period T_VM2 of VM_2 and the start time and end time of the execution period of VM_2 to the shared memory 103a for each execution period of VM_2. The measurement unit 121A reads the start time and end time of the execution period of VM_2 from the shared memory 103a. That is, the measurement unit 121A reads the start time and end time of the execution period T_VM2 of VM_2 and the start time and end time of the execution period of VM_2 from the shared memory 103a for each execution period of VM_1. Here, it is assumed that the schedule period next to schedule period C1 is C2, and that schedule period C2 is currently being executed. The measurement unit 121A calculates the difference between the start time of the execution period of VM_2 in schedule cycle C2 and the end time of the execution period of VM_1 in schedule cycle C2, thereby measuring the execution period T_HV1 of the HV 110 after the execution period of VM_1 in schedule cycle C2 and before the execution period of VM_2 in schedule cycle C2. The measurement unit 121A calculates the difference between the start time of the execution period of VM_1 in schedule cycle C2 and the end time of the execution period of VM_2 in schedule cycle C1, thereby measuring the execution period (and idle period) T_HV2 of the HV 110 after the execution period of VM_2 in schedule cycle C1 and before the execution period of VM_1 in schedule cycle C2.

[0069] The anomaly detection unit 122 detects an anomaly in the HV 110 based on the execution periods T_HV1 and T_HV2 of the HV 110, the execution period T_VM1 of VM_1, and the execution period T_VM2 of VM_2 measured by the measurement units 121A and 121B. Detection of an anomaly in the HV 110 is repeatedly performed in synchronization with the schedule period.

[0070] Specifically, the abnormality detection unit 122 determines whether the execution period T_HV1 of the HV 110 measured by the measurement units 121A and 121B deviates from the normal range R_HV1 (first normal range), and if the execution period T_HV1 deviates from the normal range R_HV1, detects an abnormality in the HV 110. The abnormality detection unit 122 determines whether the execution period T_HV2 of the HV 110 measured by the measurement units 121A and 121B deviates from the normal range R_HV2 (first normal range), and if the execution period T_HV2 deviates from the normal range R_HV2, detects an abnormality in the HV 110.

[0071] The abnormality detection unit 122 determines whether the execution period T_VM1 of VM_1 measured by the measurement unit 121A deviates from the normal range R_VM1 (second normal range), and if the execution period T_VM1 deviates from the normal range R_VM1, detects an abnormality in the HV 110. The abnormality detection unit 122 determines whether the execution period T_VM2 of VM_2 measured by the measurement unit 121B deviates from the normal range R_VM2 (second normal range), and if the execution period T_VM2 deviates from the normal range R_VM2, detects an abnormality in the HV 110.

[0072] In the above example, two virtual machines, VM_1 and VM_2, are implemented on the HV 110, but three or more virtual machines may be implemented on the HV 110. Consider an example in which three virtual machines, VM_1, VM_2, and VM_3, are implemented on the HV 110. In this case, for example, the measurement unit 121A operates on VM_1, the measurement unit 121B operates on VM_2, and the measurement unit 121C operates on VM_3. The measurement unit 121B writes identification information of VM_2, along with the execution period, start time, and end time of VM_2, into the shared memory 103a. The measurement unit 121C writes identification information of VM_3, along with the execution period, start time, and end time of VM_3, into the shared memory 103a. The measurement unit 121A reads the identification information of VM_2, the execution period, start time, and end time of VM_2, and the identification information of VM_3, the execution period, start time, and end time of VM_3 from the shared memory 103a. The measurement unit 121A specifies the execution period, start time, and end time of VM_2 and the execution period, start time, and end time of VM_3 from the identification information. For example, when VM_1, VM_2, and VM_3 are executed in this order in one schedule cycle, the measurement unit 121A measures the execution period T_HV1 of the HV 110 after the execution period of VM_1 and before the execution period of VM_2 by calculating the difference between the end time of the execution period of VM_1 and the start time of the execution period of VM_2 in one schedule cycle. The measurement unit 121A measures the execution period T_HV2 of the HV110 after the execution period of VM_2 and before the execution period of VM_3 by calculating the difference between the end time of the execution period of VM_2 and the start time of the execution period of VM_3 in one schedule cycle. The measurement unit 121A measures the execution period (and idle period) T_HV3 of the HV110 after the execution period of VM_3 in one schedule cycle and before the execution period of VM_1 in the next schedule cycle by calculating the difference between the end time of the execution period of VM_3 in one schedule cycle and the start time of the execution period of VM_1 in the next schedule cycle. Even when the number of virtual machines is four or more, the execution period of the HV110 can be measured in a similar manner.

[0073] When the abnormality detection unit 122 detects an abnormality, the abnormality notification unit 123 notifies the abnormality that has been detected.

[0074] For example, the abnormality notification unit 123 outputs notification data for notifying the driver of the detected abnormality. Specifically, the abnormality notification unit 123 generates a notification frame for notifying the driver of the detected abnormality and transmits the generated notification frame to the in-vehicle network. For example, a user interface device (hereinafter also referred to as a "UI device") is connected to the in-vehicle system 10 (not shown). The UI device is one of the in-vehicle devices mounted on the vehicle. The UI device is used by the driver of the vehicle. The UI device includes an input device and a display device, and can accept input from the driver and display information to be provided to the driver. The UI device receives the notification frame transmitted from the in-vehicle device 100 and displays a screen for notifying the driver of the abnormality. This notifies the driver of the abnormality.

[0075] In another example, a data storage device (not shown) is connected to the in-vehicle system 10. The data storage device is one of the in-vehicle devices mounted on the vehicle. The data storage device stores data related to an abnormality detected by the abnormality detection unit 122 (hereinafter also referred to as "abnormality data"). The data storage device receives a notification frame transmitted from the in-vehicle device 100 and stores the abnormality data. This stores a history of abnormality detection, and allows, for example, a maintenance person performing maintenance on the vehicle to refer to the history of abnormality detection.

[0076] In yet another example, the external communication device 30 transmits a notification frame to a security department outside the vehicle. The security department is an organization that detects and analyzes cyberattacks and provides advice on countermeasures. For example, the server 50 is used in the security department, and the notification frame is transmitted to the server 50. Based on the received notification frame, the server 50 notifies a terminal used by a security department employee of the detected abnormality. This allows an appropriate response to the detected abnormality to be taken.

[0077] [1-4. Operation of the In-Vehicle Device] Hereinafter, the operation of the in-vehicle device according to the first embodiment will be described.

[0078] 6 is a flowchart showing an example of measurement processing by a measurement program in the in-vehicle device according to the first embodiment. In the following description, VM_1 and VM_2 will be collectively referred to as "VM."

[0079] When a VM is started, its first execution period begins. The processor 101 estimates the start timing as the time ΔM has elapsed since the start of the VM's first execution period. When the start timing arrives, the processor 101 stamps the start time tS (step S101). This records the start time TS.

[0080] The processor 101 sets a timer for Δt (step S102).

[0081] The processor 101 acquires the remaining time tL of the execution period of the VM (step S103), and sets tL+ΔM in the timer (step S104).

[0082] The processor 101 determines whether Δt has arrived, that is, whether the timer set for Δt has expired (step S105). If Δt has not arrived (NO in step S105), the processor 101 executes step S105 again.

[0083] When Δt has arrived (YES in step S105), the processor 101 stamps the end time TE (step S106), thereby recording the end time TE.

[0084] The processor 101 calculates the difference TE-TS between the recorded start time TS and end time TE to measure the execution period T_VM of the VM (step S107). The processor 101 writes the start time TS and end time TE together with the execution period T_VM to the shared memory 103a.

[0085] The processor 101 determines whether tL+ΔM has arrived, i.e., whether the timer set for tL+ΔM has expired (step S108). If tL+ΔM has not arrived (NO in step S108), the processor 101 executes step S108 again.

[0086] When tL+ΔM has arrived (YES in step S108), the processor 101 estimates that the start timing has arrived and stamps the start time TS (step S109). The processor 101 writes the recorded start time TS into the shared memory 103a.

[0087] For example, for VM_1, the processor 101 calculates the execution periods T_HV1 and T_HV2 of the HV 110 (step S110). T_HV1 is calculated as the difference between the end time of the execution period of VM_1 in the target schedule period and the start time of the execution period of VM_2 in the target schedule period. T_HV2 is calculated as the difference between the end time of the execution period of VM_2 in the schedule period immediately preceding the target schedule period and the start time of the execution period of VM_1 in the target schedule period. For example, if the target schedule period is C2 and the schedule period immediately preceding schedule period C2 is C1, the execution period T_HV1 of the HV 110 is calculated as the difference between the end time of the execution period of VM_1 in schedule period C2 and the start time of the execution period of VM_2 in schedule period C2. An execution period T_HV2 of HV110 is calculated as the difference between the end time of the execution period of VM_2 in schedule period C1 and the start time of the execution period of VM_1 in schedule period C2. Note that in step S110 in the first schedule period, since there is no previous schedule period, calculation of the execution period T_HV2 of HV110 is omitted. Step S110 is omitted in the measurement process of VM_2.

[0088] The processor 101 returns to step S102, whereby steps S102 to S110 are repeated.

[0089] FIG. 7 is a flowchart showing an example of an abnormality detection process performed by the abnormality detection program in the in-vehicle device according to the first embodiment.

[0090] The processor 101 reads T_VM1, T_VM2, T_HV1, and T_HV2 from the shared memory 103a (step S201).

[0091] The processor 101 determines whether T_VM1 falls outside the normal range R_VM1 (step S202).

[0092] If T_VM1 is within the normal range R_VM1 (NO in step S202), the processor 101 determines whether T_VM2 deviates from the normal range R_VM2 (step S203).

[0093] If T_VM2 is within the normal range R_VM2 (NO in step S203), the processor 101 determines whether T_HV1 deviates from the normal range R_HV1 (step S204).

[0094] If T_HV1 is within the normal range R_HV1 (NO in step S204), the processor 101 determines whether T_HV2 deviates from the normal range R_HV2 (step S205).

[0095] If T_HV2 is within the normal range R_HV2 (NO in step S205), the processor 101 returns to step S201. For example, the loop of the abnormality detection process is controlled in synchronization with the schedule period. Specifically, the processor 101 returns to step S201 when a timer with the same period as the schedule period expires. As another example, the processor 101 may return to step S201 in response to a call from the measurement program 114.

[0096] If any one of T_VM1, T_VM2, T_HV1, and T_HV2 falls outside the normal ranges R_VM1, R_VM2, R_HV1, and R_HV2 (YES in steps S202, S203, S204, and S205), the processor 101 detects an abnormality in the HV 110 (step S206).

[0097] The processor 101 notifies the driver of the detected abnormality (step S207). That is, for example, the processor 101 notifies the driver of the abnormality, stores the abnormality data in a data storage device, or notifies the security department of the abnormality. This completes the abnormality detection process.

[0098] Note that the example of FIG. 7 illustrates an anomaly detection process in which two virtual machines, VM_1 and VM_2, are implemented on the HV 110; however, the number of virtual machines is not limited to two and may be one, or three or more. When the number of virtual machines is three or more, the execution period of the HV 110 is measured between the execution periods of each virtual machine as described above. In the anomaly detection process, the processor 101 compares the execution period of each virtual machine with a normal range and compares each execution period of the HV 110 with a normal range. If at least one of the execution periods of all the virtual machines and all the execution periods of the HV 110 deviates from the normal range, an anomaly is detected.

[0099] As a variant, VM1 and VM2 may not include OS 111A and 111B. When VM1 and VM2 include OS 111A and 111B, as described above, the abnormality detection unit 122, the abnormality notification unit 123, the measurement unit 121A, and APP 112A are executed as application programs on OS 111A, and the measurement unit 121B and APP 112B are executed as application programs on OS 111B. On the other hand, when VM1 and VM2 do not include OS 111A and 111B, the abnormality detection unit 122, the abnormality notification unit 123, and the measurement unit 121A are each realized as a function (interrupt processing routine) in APP 112A, and the measurement unit 121B is realized as a function (interrupt processing routine) in APP 112B.

[0100] When VM1 and VM2 do not include OSs 111A and 111B, the anomaly detection unit 122, the anomaly notification unit 123, and the measurement unit 121A each realize their functions through an interrupt (signal) generated by VM1, and the measurement unit 121B realizes their functions through an interrupt generated by VM2. Therefore, in this configuration, after starting VM_2, VM_2 first needs to send a signal to APP112B to start the measurement unit 121B. Similarly, after starting VM_1, VM_1 first needs to send a signal to APP112A to start the measurement unit 121A. More specifically, after VM_1 is started, VM_1 sends a signal to APP112A to start the measurement unit 121A, then VM_1 sends a signal to APP112A to start the abnormality detection unit 122, and then VM_1 sends a signal to APP112A to start the abnormality notification unit 123.

[0101] [1-5. Simulation of Anomaly Detection] The inventors performed a simulation of the anomaly detection method according to the first embodiment. MATLAB (registered trademark) was used for the simulation.

[0102] [1-4-1. Simulation 1] In the simulation, the execution periods HV1 of the first HV110, VM1 of the VM_1, HV2 of the second HV110, VM2 of the VM_2, HV3 of the third HV110, and the idle period IDL were set to occur in this order in one schedule cycle. Each of the execution periods HV1, HV2, and HV3 of the HV110 was set to 100 μs, the execution period VM1 of VM_1 was set to 1000 μs, the execution period VM2 of VM_2 was set to 500 μs, the idle period IDL was set to 200 μs, and the schedule cycle was set to 2000 μs.

[0103] Furthermore, the start time of execution period VM1 of VM_1 is set to 100 μs after the actual start of VM1, and the end time of VM1 is set to 900 μs after the actual start of VM1 (i.e., 100 μs before the actual end of VM1). The start time of execution period VM2 of VM_2 is set to 100 μs after the actual start of VM2, and the end time of VM2 is set to 400 μs after the actual start of VM2 (i.e., 100 μs before the actual end of VM2).

[0104] 8 shows the results of Simulation 1. In the figure, the execution periods HV1, HV2, and HV3 of HV110 extended by the attack are shown in bold lines. The timings SVM1 and EVM1 of the start and end times of VM1, as well as the timings SVM2 and EVM2 of the start and end times of VM2, are shown in dashed lines.

[0105] In Simulation 1, the simulation was performed assuming that, in 15 schedule periods, HV1, HV2, and HV3 from the 6th to 10th periods were each changed from 100 μs to 200 μs (i.e., extended by 100 μs), and HV1, HV2, and HV3 from the 11th to 15th periods were each changed from 100 μs to 300 μs (i.e., extended by 200 μs).

[0106] From the sixth to tenth cycles, HV1, HV2, and HV3 are each extended by 100 μs, so the idle period IDL disappears and the schedule cycle ends midway through HV3.

[0107] From the 11th to 15th cycles, HV1, HV2, and HV3 are each extended by 200 μs, eliminating the idle periods IDL and HV3, and the schedule period ends in the middle of VM2. As a result, the end time of VM2 fails to be stamped.

[0108] 8, the period from the punch timing SVM1 of VM1's start time to the punch timing EVM1 of its end time is measured as the execution period T_VM1 of VM_1. The period from the punch timing SVM2 of VM2's start time to the punch timing EVM2 of its end time is measured as the execution period T_VM2 of VM_2. The period from the punch timing EVM1 of VM1's end time to the punch timing SVM2 of VM2's start time is measured as the execution period T_HV1 of HV110. The period from the punch timing EVM2 of VM2's end time to the punch timing SVM1 of VM1's start time in the next schedule cycle is measured as the execution period T_HV2 of HV110.

[0109] FIG. 9 is a diagram showing the results of anomaly detection in Simulation 1. In the simulation, the normal range R_HV1 was set to a range of 250 μs or more and 350 μs or less. The normal range R_HV2 was set to a range of 550 μs or more and 650 μs or less. The normal range R_VM1 was set to a range of 750 μs or more and 850 μs or less. The normal range R_VM2 was set to a range of 250 μs or more and 350 μs or less. In FIG. 9, the normal ranges R_HV1, R_HV2, R_VM1, and R_VM2 are shown as hatched areas. Note that the normal ranges R_HV1 and R_VM2 overlap and are shown as a single area.

[0110] In Simulation 1, from 2 ms to 8 ms after the start of the simulation, that is, from the first cycle to the fourth cycle, T_VM1, T_VM2, T_HV1, and T_HV2 are each within the normal range.

[0111] T_VM1 is within the normal range R_VM1 throughout the simulation.

[0112] 10 ms after the start of the simulation, i.e., at the fifth cycle, T_HV2 is greater than the upper limit of the normal range R_HV2. Furthermore, from 12 ms to 18 ms (the sixth to ninth cycles), T_HV2 is smaller than the lower limit of the normal range R_HV2. After 20 ms (the eleventh cycle and after), T_HV2 significantly exceeds the upper limit of the normal range R_HV2. This is due to a failure to stamp the end time of VM2.

[0113] From 2 ms to 10 ms, i.e., from the first cycle to the fifth cycle, T_HV1 falls within the normal range R_HV1. From 12 ms onwards, i.e., from the sixth cycle onwards, T_HV1 exceeds the upper limit of the normal range R_HV1.

[0114] From 2 ms to 20 ms, i.e., from the first cycle to the tenth cycle, T_VM2 is within the normal range R_VM2. After 20 ms, i.e., from the eleventh cycle onwards, T_VM2 falls significantly below the lower limit of the normal range R_VM2. This is due to a failure to clock in the end time of VM2.

[0115] From the above, an abnormality in the HV 110 is detected after 10 ms, that is, after the fifth cycle.

[0116] [1-4-2. Simulation 2] FIG. 10 is a diagram showing the results of Simulation 2.

[0117] In Simulation 2, during 15 schedule periods, an invalid execution period HVA interrupt occurs in VM2 from the sixth to the fifteenth period of the schedule period. The length of the HVA from the sixth to the tenth period is 100 μs, and the length of the HVA from the eleventh to the fifteenth period is 300 μs. The other conditions in Simulation 2 are the same as those in Simulation 1.

[0118] In the sixth to tenth cycles, an HVA interrupt of 100 μs occurs, so the end time of HV3 is delayed by 100 μs and the idle period IDL is reduced by 100 μs.

[0119] In the 11th to 15th cycles, a 300 μs HVA interrupt occurs, eliminating the idle periods IDL and HV3, and the schedule period ends in the middle of VM2. As a result, the end time of VM2 fails to be stamped.

[0120] 11 is a diagram showing the results of anomaly detection in Simulation 2. The normal ranges R_HV1, R_HV2, R_VM1, and R_VM2 are the same as those in Simulation 1.

[0121] In Simulation 2, from 2 ms to 10 ms after the start of the simulation, that is, from the first cycle to the fifth cycle, T_VM1, T_VM2, T_HV1, and T_HV2 are each within the normal range.

[0122] T_VM1 is within the normal range R_VM1 throughout the simulation.

[0123] T_HV1 is within the normal range R_HV1 throughout the simulation.

[0124] From 12 ms to 20 ms (the sixth to tenth cycles), T_HV2 is smaller than the lower limit of the normal range R_HV2. After 20 ms (the eleventh cycle and after), T_HV2 significantly exceeds the upper limit of the normal range R_HV2. This is due to a failure to clock in the end time of VM2.

[0125] From 12 ms to 20 ms (cycles 6 to 10), T_VM2 is greater than the upper limit of the normal range R_VM2. After 20 ms (cycles 11 and onward), T_VM2 falls significantly below the lower limit of the normal range R_VM2. This is due to a failure to stamp the end time of VM2.

[0126] From the above, an abnormality in the HV 110 is detected after 12 ms, that is, after the sixth cycle.

[0127] 2. Second Embodiment FIG. 12 is a schematic diagram for explaining a virtual environment in an in-vehicle device according to a second embodiment.

[0128] In the second embodiment, the HSM 105 has the functions of an abnormality detection unit 122A and an abnormality notification unit 123A. The VM_1 has only the function of a measurement unit 121A, and does not have the functions of the abnormality detection unit 122 or the abnormality notification unit 123.

[0129] In the second embodiment, the measurement unit 121B of VM_2 outputs the measured T_VM2, and the output T_VM2 is input to the abnormality detection unit 122A of the HSM 105. The measurement unit 121A of VM_1 outputs the measured T_VM1, T_HV1, and T_HV2, and the output T_VM1, T_HV1, and T_HV2 are input to the abnormality detection unit 122A of the HSM 105.

[0130] The abnormality detection unit 122A detects an abnormality in the HV 110 based on the input T_VM1, T_VM2, T_HV1, and T_HV2. The functions of the abnormality detection unit 122A and the abnormality notification unit 123A are similar to the functions of the abnormality detection unit 122 and the abnormality notification unit 123 in the first embodiment, and therefore description thereof will be omitted.

[0131] Since the anomaly detection unit 122A is provided in the HSM 105, the anomaly detection function is not affected by an anomaly in the HV 110, and an anomaly can be accurately detected.

[0132] 3. Third Embodiment FIG. 13 is a schematic diagram for explaining a virtual environment in an in-vehicle device according to a third embodiment.

[0133] In the third embodiment, in the in-vehicle device 100A, the VM_1 has only the function of the measurement unit 121A, and does not have the functions of the abnormality detection unit 122 and the abnormality notification unit 123. The in-vehicle device 100B has the functions of the abnormality detection unit 122B and the abnormality notification unit 123B.

[0134] In the third embodiment, T_VM1, T_VM2, T_HV1, and T_HV2 output from the measurement units 121A and 121B of the in-vehicle device 100A are transmitted to the in-vehicle device 100B via the in-vehicle network.

[0135] The in-vehicle device 100B receives T_VM1, T_VM2, T_HV1, and T_HV2, which are input to the abnormality detection unit 122B. The abnormality detection unit 122B detects an abnormality in the HV 110 based on the input T_VM1, T_VM2, T_HV1, and T_HV2. The functions of the abnormality detection unit 122B and the abnormality notification unit 123B are similar to the functions of the abnormality detection unit 122 and the abnormality notification unit 123 in the first embodiment, and therefore description thereof will be omitted.

[0136] In the third embodiment, the abnormality detection unit 122B is realized by a processor (the processor 101 of the in-vehicle device 100B) different from the processor 101 of the in-vehicle device 100A that runs the HV 110. This makes it possible to accurately detect an abnormality in the HV 110 while suppressing the influence of an abnormality that occurs in the HV 110 on the in-vehicle device 100A.

[0137] 4. Fourth Embodiment FIG. 14 is a schematic diagram for explaining a virtual environment in an in-vehicle device according to a fourth embodiment.

[0138] In the fourth embodiment, in the in-vehicle device 100, the VM_1 has only the function of the measurement unit 121A, and does not have the functions of the abnormality detection unit 122 and the abnormality notification unit 123. The server 50 has the functions of the abnormality detection unit 501 and the abnormality notification unit 502.

[0139] In the fourth embodiment, T_VM1, T_VM2, T_HV1, and T_HV2 output from the measurement units 121A and 121B of the in-vehicle device 100 are transmitted to the server 50 via the external communication device 30.

[0140] The server 50 receives T_VM1, T_VM2, T_HV1, and T_HV2, which are input to the abnormality detection unit 501. The abnormality detection unit 501 detects an abnormality in the HV 110 based on the input T_VM1, T_VM2, T_HV1, and T_HV2. The functions of the abnormality detection unit 501 and the abnormality notification unit 502 are similar to the functions of the abnormality detection unit 122 and the abnormality notification unit 123 in the first embodiment, and therefore description thereof will be omitted.

[0141] In the fourth embodiment, the abnormality detection unit 501 is realized by a processor (a processor of the server 50) different from the processor 101 of the in-vehicle device 100 that executes the HV 110. This makes it possible to accurately detect an abnormality in the HV 110 while suppressing the influence of an abnormality that occurs in the HV 110 on the in-vehicle device 100.

[0142] 5. Fifth Embodiment FIG. 15 is a schematic diagram for explaining a virtual environment in an in-vehicle device according to a fifth embodiment.

[0143] The processor 101 of the in-vehicle device 100 according to the fifth embodiment is a multi-core processor including cores 101A and 101B. The processor 101 may have one clock, or each of the cores 101A and 101B may have a clock.

[0144] The core 101A executes the HV 110A, and the core 101B executes the HV 110B. The HV 110A configures the VMs VM_1 and VM_2. The HV 110B configures the VMs VM_21 and VM_22.

[0145] The OS 111A runs on the VM_1. In the VM_1, the APP 112A runs on the OS 111A. The OS 111B runs on the VM_2. In the VM_2, the APP 112B runs on the OS 111B.

[0146] The OS 111C runs on the VM_21. In the VM_21, the APP 112C runs on the OS 111C. The OS 111D runs on the VM_22. In the VM_22, the APP 112D runs on the OS 111D.

[0147] VM_1 has the functions of a measurement unit 121A, an abnormality detection unit 122, and an abnormality notification unit 123. VM_2 has the function of a measurement unit 121B. VM_21 has the function of a measurement unit 121C. VM_22 has the function of a measurement unit 121D.

[0148] The functions of the measurement units 121A and 121B are the same as those of the measurement units 121A and 121B in the first embodiment. Even if each of the cores 101A and 101B has a clock, the execution period of each virtual machine and the execution period of the HV do not depend on time, so the measurement units 121A and 121B can measure the execution period of each virtual machine and the execution period of the HV.

[0149] The measurement unit 121A measures the execution period T_VM1 of the VM_1 and the execution periods T_HV1 and T_HV2 of the HV 110A. The measurement unit 121A writes the measured T_VM1, T_HV1, and T_HV2 into the shared memory 103a.

[0150] The measurement unit 121B measures the execution period T_VM2 of VM_2 and writes the measured T_VM2 into the shared memory 103a.

[0151] The measurement unit 121C measures the execution period of VM_21 (hereinafter referred to as "T_VM21"). The measurement unit 121C measures the execution period of HV 110B (hereinafter referred to as "T_HV21" and "T_HV22"). T_HV21 corresponds to T_HV1 in HV 110A, and T_HV22 corresponds to T_HV2 in HV 110A.

[0152] The measurement unit 121C writes the measured T_VM21, T_HV21, and T_HV22 into the shared memory 103a.

[0153] The measurement unit 121D measures the execution period of VM_22 (hereinafter referred to as "T_VM22") and writes the measured T_VM22 into the shared memory 103a.

[0154] The abnormality detection unit 122 reads T_VM1, T_VM2, T_HV1, T_HV2, T_VM21, T_VM22, T_HV21, and T_HV22 from the shared memory 103a.

[0155] The abnormality detection unit 122 determines whether T_HV21 deviates from a normal range (hereinafter referred to as "R_HV21"). If T_HV21 deviates from the normal range R_HV21, the abnormality detection unit 122 detects an abnormality in the HV 110B. If T_HV22 deviates from a normal range R_HV22, the abnormality detection unit 122 detects an abnormality in the HV 110B.

[0156] The abnormality detection unit 122 determines whether VM_21 deviates from a normal range (hereinafter referred to as "R_VM21"). If the execution period T_VM21 deviates from the normal range R_VM21, the abnormality detection unit 122 detects an abnormality in the HV 110B. The abnormality detection unit 122 determines whether VM_22 deviates from a normal range (hereinafter referred to as "R_VM22"). If the execution period T_VM22 deviates from the normal range R_VM22, the abnormality detection unit 122 detects an abnormality in the HV 110B.

[0157] The abnormality notification unit 123 notifies the HV 110A when an abnormality is detected in the HV 110A. The abnormality notification unit 123 notifies the HV 110B when an abnormality is detected in the HV 110B.

[0158] In the fifth embodiment, an anomaly detection unit is included in the HV 110A, which is a virtual system different from the HV 110B, which is a virtual system targeted for anomaly detection. This makes it possible to accurately detect an anomaly in the HV 110B while suppressing the impact of an anomaly occurring in the HV 110B.

[0159] 6. Sixth Embodiment FIG. 16 is a schematic diagram for explaining a virtual environment in an in-vehicle device according to a sixth embodiment.

[0160] In the sixth embodiment, in the in-vehicle device 100, the HV 110 has the functions of the measurement unit 131, the abnormality detection unit 132, and the abnormality notification unit 133. The VM_1 does not have the functions of the measurement unit 121A, the abnormality detection unit 122, or the abnormality notification unit 123. The VM_2 does not have the function of the measurement unit 121B.

[0161] The measurement unit 131 measures the execution period T_VM1 of the VM_1, the execution period T_VM2 of the VM_2, and the execution periods T_HV1 and T_HV2 of the HV 110.

[0162] The HV 110 manages the execution periods of VM_1 and VM_2 and the HV 110. That is, the HV 110 measures the execution periods of VM_1, VM_2, and HV 110 using a timer. The HV 110 invokes VM_1 when the start time of VM_1 arrives, and switches to the execution period of HV 110 when the end time of the execution period of VM_1 arrives. The HV 110 invokes VM_2 when the start time of VM_2 arrives, and switches to the execution period of HV 110 when the end time of the execution period of VM_2 arrives.

[0163] In a specific example, the measurement unit 131 measures T_VM1, T_VM2, T_HV1, and T_HV2 using the execution period management function of the HV 110. That is, the measurement unit 131 measures T_VM1, T_VM2, T_HV1, and T_HV2 without stamping the start time and end time of VM_1 and VM_2.

[0164] The functions of the abnormality detection unit 132 and the abnormality notification unit 133 are similar to the functions of the abnormality detection unit 122 and the abnormality notification unit 123 in the first embodiment, and therefore a description thereof will be omitted.

[0165] As described above, in the sixth embodiment, the measurement unit 131 uses the functions of the HV 110, so there is no need to stamp the start times of the VM_1 and VM_2, and the processing in the measurement unit 131 can be simplified.

[0166] [7. Supplementary Note] The embodiments disclosed herein are illustrative in all respects and are not restrictive. The scope of the present invention is defined by the claims, not the above-described embodiments, and includes meanings equivalent to the claims and all modifications within the scope thereof.

[0167] 10 In-vehicle system 20 Relay device 30 External communication device 40A, 40B, 40C Communication bus 50 Server 100, 100A, 100B, 100C, 100D In-vehicle device 101 Processor 101A, 101B Core 102 Non-volatile memory 103 Volatile memory 103a Shared memory 104 Communication interface (communication I / F) 105 Hardware security module (HSM) 106 Clock (CLK) 110, 110A, 110B Hypervisor (HV, virtual system) 111A, 111B, 111C, 111D Operating system (OS) 112A, 112B, 112C, 112D Application (APP) 113 Anomaly detection program 114 Measurement program 120 Hardware 121A, 121B, 121C, 121D, 131 Measuring unit 122, 122A, 122B, 501, 132 Abnormality detection unit 123, 123A, 123B, 502, 133 Abnormality notification unit 200 Virtualization system VM_1, VM_2, VM_21, VM_22 Virtual machine C1, C2 Schedule period t10-t15, t20-t22 Time T1, T2, T_VM1, T_VM2, T_HV1, T_HV2, HV1, HV2, HV3, VM1, VM2, T_VM21, T_VM22, T_HV21, T_HV22 Execution period R_HV1, R_HV2, R_VM1, R_VM2, R_HV21, R_HV22, R_VM21, R_VM22 Normal range SVM1, EVM1, SVM2, EVM2 Time stamp timing

Claims

1. An anomaly detection device that detects an anomaly in one or more virtual systems included in a virtualization system configured on hardware, a measurement unit that measures at least one of a first period, which is an execution period of the virtual system, and a second period, which is an execution period of a virtual machine executed in the virtual system, in a repetition of the first period and the second period; an anomaly detection unit that detects an anomaly in the virtual system based on at least one of the first period and the second period measured by the measurement unit; Equipped with Anomaly detection device.

2. the measurement unit measures the second period by recording a start time of the process by the virtual machine and an end time of the process by the virtual machine, and calculating a difference between the recorded end time and the recorded start time. The anomaly detection device according to claim 1 .

3. the measurement unit measures the first period by calculating a difference between the recorded start time and the recorded end time. The anomaly detection device according to claim 2 .

4. the measurement unit estimates a start timing of the second period by the virtual machine and records the start time by acquiring time information at the estimated start timing, and estimates an end timing of the second period and records the end time by acquiring time information at the estimated end timing; The anomaly detection device according to claim 2 .

5. the measurement unit estimates, as the end timing, a timing after a certain period has elapsed since the start time was recorded. The anomaly detection device according to claim 4 .

6. the certain period is shorter than the estimated remaining time of the second period from the time the start time is recorded; The anomaly detection device according to claim 5 .

7. the measurement unit estimates a start timing of the second period of the next cycle based on an estimated remaining time of the second period from when the start time was recorded and a margin period. The anomaly detection device according to claim 4 .

8. the abnormality detection unit detects the abnormality when the first period measured by the measurement unit deviates from a first normal range or when the second period measured by the measurement unit deviates from a second normal range; The anomaly detection device according to claim 1 .

9. the anomaly detection unit is included in the virtual machine, The anomaly detection device according to any one of claims 1 to 8.

10. the anomaly detection unit is realized by a processor different from a processor that executes the virtual system; The anomaly detection device according to any one of claims 1 to 8.

11. The anomaly detection unit is realized by a hardware security module. The anomaly detection device according to any one of claims 1 to 8.

12. the anomaly detection unit is included in a second virtual system that is a virtual system different from a first virtual system that is the virtual system, The anomaly detection device according to any one of claims 1 to 8.

13. the measurement unit is included in the virtual machine, The anomaly detection device according to any one of claims 1 to 8.

14. the measurement unit is included in a first virtual machine that is the virtual machine, the anomaly detection unit is included in a second virtual machine executed in a second virtual system that is a virtual system different from a first virtual system that is the virtual system; The anomaly detection device according to any one of claims 1 to 8.

15. the measurement unit provides information indicating the measured first period and the measured second period to the anomaly detection unit via a shared memory; The anomaly detection device according to claim 14.

16. 1. An anomaly detection method for detecting an anomaly in one or more virtual systems included in a virtualization system configured on hardware, comprising: a step of measuring at least one of a first period, which is an execution period of the virtual system, and a second period, which is an execution period of a virtual machine executed in the virtual system, in a repetition of the first period and the second period; detecting an anomaly in the virtual system based on at least one of the measured first period and the measured second period; Including, Anomaly detection methods.

17. An anomaly detection program for detecting an anomaly in one or more virtual systems included in a virtualization system configured on hardware, On the computer, a step of measuring at least one of a first period, which is an execution period of the virtual system, and a second period, which is an execution period of a virtual machine executed in the virtual system, in a repetition of the first period and the second period; detecting an anomaly in the virtual system based on at least one of the measured first period and the measured second period; In order to execute Anomaly detection program.