Hypervisor-based security data exchange system in in-vehicle multi-operating system environment

Abstract

A hypervisor-based security data exchange system in an in-vehicle multi-operating system environment is disclosed. The hypervisor-based security data exchange system in an in-vehicle multi-operating system environment, according to the present invention, comprises a hypervisor system for virtualizing and executing: a first operating system in which installation of a user application is not allowed; and a second operating system in which installation of a user application is allowed, and which is executed independently of the first operating system. The hypervisor directly communicates with vehicle hardware and transmits, to the first operating system, through a messaging service, data collected from the vehicle hardware, and a user application of the second operating system communicates with the first operating system through the messaging service of the hypervisor.

Description

Hypervisor-based secure data exchange system in an in-vehicle multi-operating system environment

[0001] The present invention relates to data exchange and security technology in a multi-operating system environment within a vehicle, and more specifically, to a system that enables secure data exchange between a high-security operating system and a low-security operating system based on a hypervisor.

[0002] In conventional in-vehicle multi-operating system systems, various methods are used for data exchange between high-security operating systems and low-security operating systems. These methods include file system sharing, memory area sharing, or the use of communication protocols between applications.

[0003] Methods in which high-security and low-security operating systems share the same file system or memory area to exchange data increase complexity in access rights and management, and pose potential threats to security and stability.

[0004] To address these issues, for example, U.S. Patent No. 12079354 discloses a technology for encrypting data when transmitting data from a high-security operating system to a low-security operating system to enhance security between operating systems of such vehicle hypervisors.

[0005] However, while this method of performing direct communication between applications on a high-security operating system and applications on a low-security operating system can enhance security through encryption during data transmission, data from the high-security operating system may be exposed if the low-security operating system is hacked. In particular, when the two operating systems run on the same processor, this communication channel can become a potential security threat.

[0006] To solve the problems of such conventional technology, a new system is required that can safely exchange data while operating two operating systems physically and logically independently.

[0007] The present invention was developed to resolve the problems of the prior art described above, and the objective of the present invention is to implement a system that provides safe and efficient data exchange between a high-security operating system and a low-security operating system in a multi-operating system environment within a vehicle.

[0008] In particular, we propose a structure that minimizes security threats by having the hypervisor directly collect vehicle data at a lower level than the operating system and manage messaging services between the two operating systems based on this data. The purpose of this is to prevent critical vehicle control information from being exposed or tampered with due to vulnerabilities in low-security operating systems, and to enhance the overall stability and reliability of the system.

[0009] To achieve the above objectives, a hypervisor-based secure data exchange system in a multi-operating system environment within a vehicle according to the present invention comprises: a first operating system in which the installation of user applications is not permitted; and a hypervisor system that virtualizes and executes a second operating system in which the installation of user applications is permitted and which runs independently of the first operating system.

[0010] The first operating system is a high-security operating system, and the second operating system corresponds to a low-security operating system.

[0011] At this time, the hypervisor communicates directly with the vehicle hardware and transmits data collected from the vehicle hardware to the first operating system through a messaging service, and

[0012] The user application of the second operating system communicates with the first operating system through the messaging service of the hypervisor.

[0013] Meanwhile, the hypervisor has a multi-layered software structure and includes a hardware communication layer, a data processing and buffering layer, a secure message broker layer (SMB), and an inter-operating system data transmission layer.

[0014] At this time, the security message broker mediates the transmission and reception of data between the first operating system and the second operating system.

[0015] At this time, the messaging service of the hypervisor generates a system event of the second operating system whenever the first operating system updates the state of the vehicle hardware, so that the user application of the second operating system receives the relevant information in real time.

[0016] Meanwhile, the messaging service of the hypervisor enhances security during data transmission by encrypting the data using the AES-256 method before transmitting the vehicle information received from the first operating system to the second operating system.

[0017] At this time, the user application of the second operating system has only read-only access rights to the vehicle information accessed through the hypervisor's messaging service, and is configured so that modification or alteration of said information is impossible.

[0018] Meanwhile, the hypervisor detects abnormal access attempts during data transmission between the first operating system and the second operating system, or generates a security event when a security threat occurs, and takes protective measures for the first operating system.

[0019] At this time, the messaging service of the hypervisor transmits vehicle information of the first operating system only when requested by a user application of the second operating system, and such request is permitted only for pre-authenticated user applications of the second operating system.

[0020] Furthermore, the messaging service of the hypervisor includes a secure message broker (SMB), and the secure message broker mediates the transmission and reception of messages between the first operating system and the second operating system, and is configured with separate message queues so that messages from each operating system are managed independently.

[0021] At this time, the messaging service of the hypervisor encrypts and transmits a message received from the first operating system, uses a symmetric key algorithm (AES) for encryption, and verifies the integrity of the message using a digital signature generated using an asymmetric key algorithm (RSA, ECDSA).

[0022] Meanwhile, the messaging service of the hypervisor includes an access control module, and the access control module verifies the permissions of the sender and receiver of a message so that each operating system can send and receive messages only within a specified permission range.

[0023] At this time, the messaging service of the hypervisor includes a security event response function, detects abnormal message access attempts from the second operating system, and immediately generates a security event upon detection to cause the hypervisor to take protective measures against the first operating system.

[0024] Meanwhile, the messaging service of the hypervisor includes a key management module, which generates, manages, and distributes keys used for message encryption and authentication, and is configured to transmit keys through a secure channel when distributing keys between operating systems.

[0025] According to the present invention, the hypervisor directly collects and processes vehicle data at a lower level than the operating system, thereby minimizing security threats that may occur during data transmission between operating systems. In addition, it has the effect of ensuring the confidentiality and integrity of data through encryption and authentication processes via a secure message broker (SMB).

[0026] Furthermore, the high-security and low-security operating systems are physically and logically separated and run independently, and the hypervisor mediates data exchange between the two systems to minimize mutual influence. This enhances system stability and security.

[0027] Furthermore, the hypervisor's messaging service is designed to flexibly handle data exchange between operating systems and can dynamically manage permissions for each operating system through an access control module. This results in improved system scalability and flexibility.

[0028] Furthermore, it detects abnormal data access attempts in real time, and the hypervisor can immediately generate security events to respond. This enables rapid system protection and recovery in the event of hacking attempts or security incidents.

[0029] FIG. 1 is a functional illustration of a vehicle equipped with a hypervisor-based security data exchange system in a multi-operating system environment within a vehicle according to the present invention.

[0030] Figure 2 is a diagram illustrating the structure of a Security Message Broker (SMB), a component of the hypervisor, and other layers within the hypervisor.

[0031] Figure 3 is a flowchart illustrating the flow of the message creation, transmission, verification, and reception processes within an SMB, and

[0032] FIG. 4 is a flowchart showing the data transmission process between the first operating system and the second operating system in steps, and

[0033] Figure 5 is a flowchart illustrating the process in which a hypervisor detects abnormal access attempts, generates security events, and takes protective measures.

[0034] Figure 6 is a flowchart illustrating a real-time data processing process in which a hypervisor collects data from a first operating system, processes it, and transmits it to a second operating system.

[0035] Explanation of the symbols

[0036] 100 : Hypervisor

[0037] 110: Secure Message Broker (SMB)

[0038] 111 : Message Queue System

[0039] 111a: First operating system dedicated message queue

[0040] 111b: Message queue dedicated to the second operating system

[0041] 112 : Security Interface

[0042] 113: Access Control Module

[0043] 114 : Key Management Module

[0044] 120: Hardware Communication Layer

[0045] 130: Data Processing and Buffering Layer

[0046] 140: Data Transfer Layer Between Operating Systems

[0047] 200: The First Operating System

[0048] 300: Second Operating System

[0049] 400 : Vehicle Hardware

[0050] Hereinafter, the present invention will be described in detail with reference to preferred embodiments of the invention and the accompanying drawings, under the premise that identical reference numerals in the drawings refer to identical components.

[0051] When a component is described as "comprising" another component in the detailed description of the invention or the claims, this shall not be interpreted as being limited to being composed solely of said component unless specifically stated otherwise, but shall be understood as potentially including additional components.

[0052] Additionally, components named as "~means," "~part," "~module," or "~block" in the detailed description of the invention or the claims refer to units that process at least one function or operation, and each of these may be implemented by software or hardware, or a combination thereof.

[0053]

[0054] Hereinafter, an example of a hypervisor-based secure data exchange system implemented in a multi-operating system environment within a vehicle according to the present invention will be described through specific embodiments.

[0055] FIG. 1 is a diagram functionally illustrating the components of a vehicle equipped with a hypervisor-based security data exchange system in a multi-operating system environment within the vehicle according to the present invention.

[0056] The multi-operating system environment within the vehicle is an environment in which the first operating system (200) and the second operating system (300) each maintain independent security levels while operating.

[0057] As illustrated in FIG. 1, the first operating system (200) and the second operating system (300) operate independently with different functions and security levels in a multi-operating system environment within the vehicle.

[0058] The first operating system (200) is a high-security operating system that manages important information related to the driving safety of the vehicle and performs functions essential for vehicle control. This operating system is restricted to an environment where users cannot arbitrarily install applications in order to be protected from potential external security threats. Therefore, the high-security operating system maintains the high level of security necessary to minimize risk factors that may occur while driving and is granted the authority to access functions directly related to safety and security within the vehicle. This restriction is even more important because the first operating system performs the role of directly communicating with and controlling the vehicle's hardware.

[0059] On the other hand, the second operating system (300) is an operating system with a standard level of security and is executed with a focus on user convenience functions. This operating system provides functions such as infotainment, navigation, and smartphone connectivity, and allows for the installation of external applications. The second operating system is designed based on a general user interface such as Android, enabling users to freely install and conveniently use various applications. The second operating system is separated from the vehicle's core safety functions and is used to handle functions that require external connectivity or are user-centric.

[0060] In the present invention, a hypervisor (100) virtualizes these operating systems and mediates to enable the safe exchange of data collected from vehicle hardware (400) between operating systems.

[0061] The hypervisor communicates directly with the vehicle hardware and processes the collected data through a secure message broker (SMB, 110) so that it is delivered in accordance with the security policy of each operating system.

[0062] Meanwhile, IP communication-based data exchange in connected cars can be carried out as follows.

[0063] The hardware communication layer (120) is structured to communicate directly with the vehicle's hardware (400) via an IP protocol, and is designed to allow smooth exchange of data between the inside and outside of the vehicle using TCP / IP or UDP protocols. This hardware communication layer (120) is connected to various electronic devices and sensors to collect and process real-time data of the vehicle, thereby providing a communication path that provides information required by the first operating system (200). At this time, security elements such as firewalls and network gateways are integrated to prevent security threats that may occur during the network routing process, and control packet transmission of each network and prevent illegal data access.

[0064] Network packets collected from the hardware communication layer (120) are transmitted to the data processing and buffering layer (130) for temporary storage and undergo various data filtering and refinement processes to meet real-time processing requirements. For example, the data processing and buffering layer (130) plays a role in increasing transmission efficiency and preventing data loss by removing noise from data and performing compression based on IP packets. Through this, the operating system can utilize the received data more stably and reliably. In addition, optimal communication speed and performance are ensured by setting priorities for important data packets through Quality of Service (QoS) standards.

[0065] The inter-operating system data transmission layer (140) performs the function of mediating data transmission between the first operating system (200) and the second operating system (300), and includes the process of transmitting messages as encrypted packets via SMB (110). Specifically, data generated in the first operating system (200) is protected by the AES-256 encryption algorithm, and additionally, a digital signature is assigned using the RSA or ECDSA asymmetric key algorithm and transmitted to the second operating system (300). Through this, the integrity of the data and the identity of the sender are verified, and the second operating system (300) is restricted to accessing the data in read-only mode.

[0066] In particular, data transmission between operating systems is managed through message queue systems (111a, 111b) within the SMB (110) in a queue structure separated from each operating system. This structure ensures that mutual intrusion does not occur by allowing each operating system to send and receive data through independent queues. Unauthorized access attempts occurring during the data transmission process between operating systems are monitored in real time through an access control module (113), and if a security threat is detected, it is immediately blocked to maintain secure data communication.

[0067] Meanwhile, to this end, the present invention has a layer structure as shown in FIG. 2.

[0068] The layer structure within the hypervisor is a software-based multilayer structure, and each layer is designed to be independent yet interact to safely and efficiently process and transmit in-vehicle data. The software layer structure in this invention consists of virtualized layers defined in software, rather than a structure fixed to physical hardware.

[0069] Figure 2 is a diagram illustrating the structure of the Security Message Broker (SMB), a component of the hypervisor, and other layers within the hypervisor.

[0070] Each layer centrally controls the interaction between the hardware and the upper operating system, and in particular, the hypervisor protects data transmitted through messaging services.

[0071] Each of the hardware communication layer (120), the data processing and buffering layer (130), and the data transmission layer between operating systems (140) is implemented with software-based processes and algorithms to optimize the collection, processing, and transmission of data occurring in real time within the hypervisor.

[0072] A Security Message Broker (SMB) is a component for ensuring secure and independent data exchange in a multi-operating system environment within a vehicle according to the present invention.

[0073] The SMB (110) mediates data between the first operating system (200) and the second operating system (300) and is designed to safely exchange mutually necessary information while maintaining the security of each operating system. Generally, the in-vehicle hypervisor communicates directly with the hardware and is responsible for the security of the entire system, and the SMB functions as an independent data exchange module that ensures security and stability within this hypervisor.

[0074] The SMB (110) plays an important role in ensuring the integrity and confidentiality of data shared between the first operating system (200), which is a high-security operating system, and the second operating system (300), which is a low-security operating system. The SMB (110) supports each operating system in maintaining an independent security structure and prevents the first operating system (200), which handles functions directly related to vehicle safety, from directly exchanging data with the second operating system (300), which is a low-security operating system.

[0075] These data arbitrators block unauthorized access to or tampering with data and prevent mutual penetration between operating systems through multi-layered security mechanisms such as message queues, encryption and digital signatures, and access control.

[0076] According to the layer structure illustrated in FIG. 2, the hypervisor (100) includes a hardware communication layer (120), a data processing and buffering layer (130), and an operating system data transmission layer (140), along with a secure message broker (SMB, 110).

[0077] The hardware communication layer (120) performs real-time data collection and communication between the hypervisor (100) and the vehicle hardware (400), and is directly connected to various electronic devices within the vehicle to transmit core data required by the first operating system (200) to the SMB (110). In this way, the hypervisor secures the ability to precisely identify and control the hardware status at a lower level than the OS.

[0078] The data processing and buffering layer (130) temporarily stores data collected from the hardware communication layer (120) and performs preprocessing operations such as filtering and encryption before transmitting it to the operating system. This is a function that enables the SMB to securely store data and provide it to the second operating system (300) when necessary.

[0079] The data transmission layer (140) between operating systems acts as an intermediary for message transmission between the first operating system and the second operating system. The transmission layer centrally manages data transmitted via SMB, and data access rights for the second operating system are restricted to read-only. This allows necessary information to be safely transmitted to the low-security operating system while maintaining the data integrity of the high-security operating system.

[0080] A secure message broker (SMB, 110) is composed of a message queue system (111), a security interface (112), an access control module (113), a key management module (114), etc.

[0081] The message queue system (111) forms an independent memory structure for data exchange between each operating system, and the queue (111a) of the first operating system and the queue (111b) of the second operating system are separated to prevent data intrusion. This system securely stores and manages data in real time and provides it appropriately to the operating system when needed, thereby achieving both security and efficiency.

[0082] The security interface (112) provides encryption and authentication when transmitting and receiving data between the SMB and each operating system. It ensures data confidentiality and integrity through AES-256 symmetric key encryption and RSA or ECDSA signatures, and protects messages from external intrusions. The interface operates within secure memory to maximize the level of security.

[0083] The access control module (113) manages message access rights between operating systems to block unauthorized access and sets low-security operating systems to access data in read-only mode. This is controlled by a central policy, and changes to the security policy are reflected immediately.

[0084] The key management module (114) generates, stores, and manages encryption and authentication keys required for each operating system. It distributes keys through a secure channel and immediately updates the keys when a security event occurs to enhance system security.

[0085] A specific example of how a hypervisor-based secure data exchange system in the present invention processes and transmits data in a multi-operating system environment within a vehicle is described as follows.

[0086] Data is collected through a hardware communication layer (120). The vehicle hardware (400) continuously generates data regarding the vehicle's status information, such as speed, location, and fuel status. The hardware communication layer (120) collects this data in real time through communication between the hypervisor (100) and the vehicle hardware (400). At this time, the hardware communication layer is directly connected to various electronic devices within the vehicle and transmits key information required by the first operating system (200) to a security message broker (SMB, 110).

[0087] The hardware communication layer (120) recognizes, in particular, rapid changes in vehicle status or security-critical data in real time and rapidly transmits this to the first operating system (200). For example, if the vehicle's speed increases rapidly or an abnormal brake condition is detected, the information is rapidly transmitted so that the hypervisor (100) can take security measures.

[0088] The data processing and buffering layer (130) processes the data. Raw data collected from the hardware communication layer (120) is transmitted to the data processing and buffering layer (130). The data processing and buffering layer (130) performs intermediate processing operations to filter the data to remove noise and encrypt sensitive information. For example, when vehicle speed data is collected, the data processing and buffering layer corrects errors and removes unnecessary noise to prepare the data in a form optimized for the first operating system (200).

[0089] In this process, the data processing and buffering layer (130) encrypts sensitive information using the AES-256 encryption method and prepares the data so that the first operating system (200) can store it in the SMB. The data thus encrypted is kept secure through the SMB and is ready to be provided to the second operating system (300).

[0090] The inter-operating system data transmission layer (140) manages data transmission and reception between the first operating system (200) and the second operating system (300), and in particular, enhances security so that the second operating system can access it only in read-only mode.

[0091] For example, when a user application installed on the second operating system (300) requests vehicle speed information, the data transmission layer between operating systems (140) transmits the information to the second operating system through the security interface (112) of the SMB. At this time, the access rights of the second operating system are restricted to read-only, and the access control module (113) applies security settings so that the second operating system cannot modify or delete data.

[0092] At this time, the security message broker (SMB, 110) mediates the transmission and reception of data between the first operating system (200) and the second operating system (300) and includes several security modules to ensure secure data transmission.

[0093] The message queue system (111) has a separate memory structure that independently manages data of the first operating system (200) and the second operating system (300), and each operating system exchanges data through an independent queue. The first operating system (200) writes the data it has collected to the message queue, and the second operating system (300) can only access it in read-only mode.

[0094] The security interface (112) ensures data integrity by applying AES-256 encryption and RSA-based digital signatures when transmitting and receiving data between each operating system and SMB.

[0095] The access control module (113) reviews message transmission and reception permissions to ensure that the second operating system (300) cannot modify the data of the first operating system (200). For example, when an application of the second operating system (300) requests vehicle information, the access control module maintains security by granting only read-only permissions.

[0096] The key management module (114) generates and manages keys used for encryption and authentication of each operating system, and periodically updates the keys to continuously maintain security.

[0097] With reference to FIG. 3 below, the process of creating, transmitting, verifying, and receiving messages in a hypervisor-based secure data exchange system in a multi-operating system environment within a vehicle according to the present invention will be described. FIG. 3 is a flowchart showing the flow of the process of creating, transmitting, verifying, and receiving messages within an SMB (110).

[0098] The first operating system (200) collects necessary data from the vehicle hardware (400) and converts it into a specific message format (S11). The collected data is transmitted in real time to the first operating system (200) through the hardware communication layer (120), and the first operating system (200) organizes and converts the data and proceeds to the message generation stage.

[0099] After a message is generated, the security interface (112) of the SMB (110) encrypts the data using the AES-256 symmetric key algorithm and signs it using the RSA or ECDSA signature algorithm (S12). During this process, the key management module (114) generates and securely stores the keys used for message encryption and signing to restrict user access.

[0100] The signed message is reviewed by the access control module (113) to see if it can be transmitted to the second operating system (300), and once the authorization review is complete, it is stored in the message queue (111a) dedicated to the first operating system of the message queue system (111) (S13). Here, the message queues of each operating system are maintained independently so that data is not mixed.

[0101] When the second operating system (300) sends a request to access vehicle data, the SMB (110) reviews the data stored in the first operating system dedicated message queue (111a) within the message queue system (111) and transmits the information that matches the request to the second operating system dedicated message queue (111b) (S14).

[0102] The second operating system (300) retrieves data from its message queue, decrypts the data through the security interface (112), and verifies the signature (S15). The verified data is accessible in read-only mode by the user application of the second operating system (300), thereby safely transmitting vehicle information to the second operating system.

[0103] With reference to FIG. 4 below, the process of data transmission between a first operating system and a second operating system in a hypervisor-based secure data exchange system in a multi-operating system environment within a vehicle according to the present invention will be explained. FIG. 4 is a flowchart showing the data transmission process between a first operating system and a second operating system in steps.

[0104] The second operating system (300) receives a request from a user application that requires vehicle-related information and transmits it to the SMB (110) in the form of a data request (S21). The access rights to this request are reviewed by an access control module (113) within the SMB, and the application of the second operating system is granted only read-only rights by default.

[0105] When access rights are confirmed, the SMB (110) transmits the latest vehicle data stored by the first operating system (200) in the first operating system-dedicated message queue (111a) of the message queue system (111) to the second operating system-dedicated message queue (111b) (S22). Subsequently, the security interface (112) of the SMB prepares to transmit AES-encrypted data to the second operating system.

[0106] After receiving data transmitted from the SMB, the second operating system (300) decrypts the data through the security interface (112) and verifies the digital signature (S23). After the signature verification is complete, the data is accessible in read-only mode by the user application of the second operating system, and the safe and consistent transmission of vehicle information is achieved (S24).

[0107] Through this procedure, the present invention ensures the security of data transmission between the first operating system and the second operating system, and allows key vehicle data to be safely accessed only by authorized applications.

[0108] With reference to FIG. 5, the process of detecting an abnormal access attempt and taking protective measures in a hypervisor-based security data exchange system in a multi-operating system environment within a vehicle according to the present invention will be described in detail step by step. FIG. 5 is a flowchart showing the flow in which a hypervisor (100) detects an abnormal access from a second operating system (300), generates a security event, and implements necessary protective measures.

[0109] The second operating system (300) transmits a request to the hypervisor (100) to access vehicle data or security messages (S31).

[0110] The second operating system (300) may request necessary data through a user application, and this request is transmitted to the security interface (112) of the hypervisor through a message queue system (111). The data requested by the second operating system may be information collected from vehicle hardware (400), and this information is usually high-security data that is primarily managed by the first operating system (200).

[0111] When the hypervisor (100) receives a data access request from the second operating system (300), it reviews it through the access control module (113) of the SMB (110). The access control module verifies the data access rights requested by the second operating system and determines that if the access exceeds the rights or violates the policy, it is an abnormal access attempt (S32). For example, if the second operating system is granted only read-only rights but requests data modification or deletion, the hypervisor recognizes this as an abnormal access. The access control module maintains the data integrity of the vehicle system by evaluating the validity of the request and detecting requests that exceed the policy.

[0112] When abnormal access is detected, the SMB (110) immediately generates a security event and records it inside the hypervisor (S33). This security event occurs in real time and is automatically generated the moment a policy violation is confirmed by the access control module (113). The security event includes detailed information such as the time of the access attempt, the requester ID, the type of the request data, and information on the violated authority, and this information serves as an important reference for subsequent protective measures. As soon as the security event is recorded, the SMB transmits a signal for protective measures to the hypervisor to enable a rapid response.

[0113] After a security event is generated, the hypervisor (100) executes protection measures through the access control module (113) within the SMB (110) (S34). The protection measures are implemented by immediately blocking data access to respond to abnormal access and temporarily restricting the authority for the second operating system to access. In certain cases, all data requests from the second operating system may be temporarily suspended, and the problematic user application may be disabled or logged out. Additionally, depending on the severity of the security event, a notification is sent directly to the first operating system (200) via the hardware communication layer (120) to enhance the overall security of the system.

[0114] After the hypervisor (100) detects an abnormal access attempt and executes a protective measure, it records the details in a security log system to enable continuous monitoring and subsequent review (S35). The security log includes the time of occurrence of all events, the details of the attempted access, and information on the protective measures executed.

[0115] Hereinafter, with reference to FIG. 6, the real-time data processing process in a hypervisor-based secure data exchange system in a multi-operating system environment within a vehicle according to the present invention will be described. FIG. 6 is a flowchart showing the entire process in which a hypervisor (100) collects vehicle data from a first operating system (200), processes it in real time, and safely transmits it to a second operating system (300).

[0116] According to the present invention, a first operating system (200) collects data from vehicle hardware (400), processes the data in real time through a data processing and buffering layer (130) of a hypervisor, and then transmits it to a second operating system (300). This process is carried out by utilizing a multi-layer structure within the hypervisor, and each step proceeds as follows.

[0117] The first operating system collects vehicle data (S41). The first operating system (200) collects key data, such as vehicle status, speed, and fuel level, in real time from the vehicle hardware (400). This data is received through the hardware communication layer (120) of the hypervisor (100), which enables real-time monitoring of the vehicle system.

[0118] Data collected from the hardware communication layer (120) is transferred to the data processing and buffering layer (130) (S42). This layer temporarily stores the collected data and separates and prepares the information required by the first operating system (200) and the information to be transferred to the second operating system (300).

[0119] The data processing and buffering layer (130) processes the data received from the first operating system (200) in real time (S43). Here, the data is filtered, error corrected, and encrypted as needed, thereby removing unnecessary noise and preparing reliable data.

[0120] The SMB (110) performs preparation work to securely transmit data processed in the data processing and buffering layer (130) (S44). At this stage, the SMB checks the authority for the second operating system (300) to access through the access control module (113) and the security interface (112), and, if necessary, encrypts the data to ensure integrity.

[0121] The second operating system (300) receives data transmitted via SMB, and this data can always be accessed with read-only permissions (S45). User applications of the second operating system can use the data to display vehicle information or for analysis, but data modification is not allowed.

[0122]

[0123] The technical concept of the present invention has been examined through the above examples.

[0124] It is obvious that a person skilled in the art to which the present invention pertains can make various modifications or changes to the embodiments described above from the description of the present invention. Furthermore, it is obvious that a person skilled in the art to which the present invention pertains can make various modifications including the technical concept according to the present invention from the description of the present invention, even if not explicitly illustrated or described, and such modifications still fall within the scope of the rights of the present invention. The embodiments described above with reference to the accompanying drawings are described for the purpose of explaining the present invention, and the scope of the rights of the present invention is not limited to these embodiments.

Claims

1. A hypervisor system that virtualizes and executes a first operating system in which the installation of user applications is not permitted; and a second operating system in which the installation of user applications is permitted and which runs independently of the first operating system; wherein The hypervisor communicates directly with the vehicle hardware and transmits data collected from the vehicle hardware to the first operating system through a messaging service, and A hypervisor-based secure data exchange system in an in-vehicle multi-operating system environment, characterized in that a user application of the second operating system communicates with the first operating system through the messaging service of the hypervisor.

2. In Paragraph 1, The above hypervisor has a multi-layer software layer structure and includes a hardware communication layer, a data processing and buffering layer, a secure message broker layer (SMB), and an inter-operating system data transmission layer, wherein A hypervisor-based secure data exchange system in a multi-operating system environment within a vehicle, characterized in that the above-mentioned secure message broker mediates data transmission and reception between a first operating system and a second operating system.

3. In Paragraph 1 or 2, A hypervisor-based secure data exchange system in a multi-operating system environment within a vehicle, characterized in that the messaging service of the hypervisor above generates a system event of the second operating system whenever the first operating system updates the state of the vehicle hardware, thereby enabling a user application of the second operating system to receive the information in real time.

Images