Vehicle One-Chip System Isolation via Input Output Firewall
Solution Overview
Problem
Existing one-chip systems for vehicle control devices face challenges in providing effective protection against mutual interference between safety-critical and comfort-related operating systems, as well as malware, due to incomplete signature databases and the inability to recognize programming errors, leading to increased risks of system malfunctions and accidents.
Innovation Solution
A one-chip system with an Input Output Firewall (IOFW) that uses a hardware-based protection system to manage access permissions and prevent unauthorized access between processors and peripheral devices, employing an authorization list stored in a read-only memory to define permitted and prohibited access rules, thereby preventing malware and overloading interruptions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple operating systems are executed in parallel in a central control unit, then functional versatility is improved, but system security deteriorates due to mutual interference and malware risks
Solution Approach 1:
The patent divides the control device into multiple isolated execution environments (virtual machines) that run on a common hardware platform. Each operating system is confined to its own virtual machine with defined resource allocations, preventing mutual interference while maintaining system versatility. The hypervisor layer segments the system architecture to enforce isolation between safety-critical and comfort-related operating systems.
Solution Approach 2:
The patent introduces a hypervisor as an intermediary layer between the hardware and multiple operating systems. This mediator manages resource allocation, enforces access control policies, and isolates operating systems from each other, thereby preventing malware propagation and unauthorized interference while enabling parallel execution of diverse functional systems.
2Measurement precision
If malware detection using signature databases is implemented, then detection capability is improved, but protection completeness deteriorates due to unknown malware and incomplete databases
Solution Approach 1:
The patent implements security measures before malware execution by establishing isolated virtual machine environments and enforcing access control policies in advance. The hypervisor pre-configures permission sets that restrict what each operating system can access, preventing malware from affecting other systems even if detection fails. This proactive isolation compensates for the limitations of reactive signature-based detection.
3Ease of operation
If access control between processors and peripheral devices is unrestricted, then system operability is improved, but security deteriorates due to unauthorized access and system overloading
Solution Approach 1:
The patent implements dynamic access control where permission sets are assigned to virtual machines based on their specific operational requirements. The hypervisor dynamically manages resource allocation and access permissions, allowing each operating system to access only the peripheral devices and resources it needs for its function, thereby maintaining operability while ensuring security through granular, adaptive permission management.
Data Source
AI summary
The present disclosure relates to a one-chip system for a control device of a vehicle with at least one bus, at least one control unit connected to the at least one bus for controlling a peripheral device assigned to the at least one control unit and several processors connected to the at least one bus.