DE102020215920A1 - Method for operating an arithmetic unit system and arithmetic unit system - Google Patents

Abstract

The invention relates to a method for operating a processing unit system (100), which has a memory area (106), wherein a plurality of virtual guest systems (120, 130) and a switching system (110) are operated on the processing unit system (100), with the steps: Obtaining , by the switching system (110), a request from one of the guest systems to transfer access to the storage area from one or more current guest systems to one or more other of the guest systems, and assigning, by the switching system (110), exclusive access the memory area (106) only to the one or more other guest systems, and such a computing unit system (100).

Description

The present invention relates to a method for operating a processor system and a processor system and a computer program for its implementation.

Background of the Invention

Arithmetic unit systems consist of several networked or connected arithmetic units in which mutual access to resources such as memory areas can be possible. In this case, in particular, a plurality of processing units can be implemented as virtual processing units on the same physical processing unit. The individual computing units can have different functionalities, for example, in order to provide a higher-level functionality together. Data can, for example, be received or sent via a wireless communication system on computing units in vehicles, in particular on particularly powerful computing units but also on other control devices, but important and safety-critical data must also be processed.

Disclosure of Invention

According to the invention, a method for operating a computing unit system and a computing unit system, a computing unit and a computer program for its implementation with the features of the independent patent claims are proposed. Advantageous configurations are the subject of the dependent claims and the following description.

The invention relates to computing unit systems, particularly in vehicles. This means, in particular, high-performance control devices, which usually contain at least one microcontroller and at least one microprocessor system (and in particular a non-divisible unit in a common housing), so-called "package"). These systems often include multiple processor cores and enough memory and other resources to host multiple guest operating systems managed by hypervisors. In particular, these are particularly powerful computing unit systems, but other control devices are also conceivable. Such a processing unit system has--possibly in addition to other components as just mentioned--a memory area and several virtual guest systems (or guest operating systems) and a switching system are operated on the processing unit system. This is done in particular in order, for example, to provide different system environments with different functions for safety, performance, flexibility and functionality on a vehicle control unit hardware.

The various virtual guest systems are typically hosted using the hypervisor or hypervisor system and preferably have different levels of security classification or can meet different security requirements. For example, the hypervisor (or virtual machine monitor, VMM) is computer software, firmware, or hardware that creates and runs virtual machines as computing units. A computer or processing unit on which a hypervisor runs one or more virtual machines is called a host machine, and each virtual machine is called a guest machine or system. There can be guest systems that are "more open", i.e. can only guarantee lower functional safety or can only meet lower functional safety requirements, and there can be guest systems that are "more closed" and can therefore guarantee higher functional safety or higher can meet functional safety requirements. In addition to providing the switching functions yet to be described, the switching system itself can also contain one of the several guest systems and thereby in particular make available or carry out further functions with specific functional security requirements.

Functional safety or safety requirement is to be understood in particular as an aspect of a system - in this case a guest system - in relation to its ability to deal with dangers to people or material goods, to control the probability of such risks occurring and to reduce the effects of events . In the context of automotive engineering, there are standards, processes and methods to provide framework conditions for safety engineering and to classify systems into safety levels according to their safety-related capabilities.

In the context of vehicles or automotive, "closed" systems are typically associated with functions for higher safety (e.g. a specific ASIL level; ASIL stands for "Automotive Safety Integrity Level"), more restrictive resource management and deterministic runtime behavior. In contrast, "open" systems in this context are usually connected to non-vehicle or external computing units (so-called "cloud"), connected systems that may be able to meet demanding functional safety requirements, but not necessarily for applications requiring security (in the sense of the IT security) are used be able. Functional security (e.g. that a certain function has to be carried out at a certain point in time) is to be seen in contrast to IT security (e.g. that a system can withstand a cyber attack). .

Against this background, there are in particular two different use cases that relate to data exchange on such a computing unit system or between guest systems. On the one hand, data is transferred from a "more open" to a "closed" system (downwards or inwards, so to speak, i.e. from a guest system for lower functional safety requirements to one for higher functional safety requirements), on the other hand, data is transferred from a "more closed" system transferred to a "more open" system (so to speak, upwards or outwards, i.e. from a guest system for higher functional security requirements to one for lower functional security requirements).

In order to enable such a transfer of data in a particularly efficient manner and with little memory requirement, it is now proposed within the scope of the invention that the memory area that is present on the processing unit system is always assigned to only one - or possibly also several selected - by means of the switching system. which is assigned to several guest systems for exclusive access and is thereby removed or surrendered by one or more current guest systems. If the switching system itself also contains a guest system, it can also assign or remove access to this own guest system). So access is passed. This is done in response to a request or request command from one of the guest systems. The requesting guest system can request access itself, or it can also want to relinquish access. In this case, accesses are to be understood in particular as reading and/or writing processes. It goes without saying that further memory areas, in particular also independently of the one memory area already mentioned, can be assigned to one or possibly several selected guest systems if such memory areas are provided. It should also be mentioned that other storage areas or storage media can also be provided on the computing unit system, which are used for other purposes than for exchanging data between guest systems.

As mentioned, the switching system can also be a virtual guest system, but expediently a privileged guest system. Such a system, which may also be referred to as a "housekeeping system", has the task of allocating resources to other, less privileged guest systems and ensuring the availability and performance of the system. However, it can also fulfill other functions, but expediently only those with the highest security requirements.

The memory area can be exclusively assigned to a guest system by means of the switching system, in particular at the request of the guest system in question or also of another guest system; allocation of the memory area to a guest system can also be removed (again) by means of the switching system, e.g. on request.

In this way, redundant storage of data on different guest systems (due to storage resource limitations) can be avoided. The procedure can, for example, be based on existing OS / POSIX mechanisms and implementations, in particular for reasons of compatibility, maintainability, expandability and quality.

A system isolated from its environment is typically of very limited value. Therefore, even in the case of vehicle control units with hypervisors, different guest systems should be able to exchange large data files. However, since even a particularly high-performance vehicle computing unit system is still a vehicle control device, hardware resources such as non-volatile memory are a cost factor. However, the procedure described now makes it possible for a memory for the exchange of large data files to be used jointly by guest systems. File exchange between different guest systems without intermediate copy ("zero copy") is made possible, so to speak, which can nevertheless meet the security requirements according to vehicle security technology. This is possible because the system with the higher functional safety requirements ("safety") manages, allows and revokes the access of all parties to the shared memory in an orderly manner. An example from the security (not safety) area could be that data is received from the Internet, this data is potentially dangerous. Before these are passed on to a security-critical area, they could first be checked in a neutral area, e.g. checking the certificates, and only then be passed on to the security-critical area (security checkpoint). This would not require the use of a copy process which is time and resource intensive.

So it becomes a mechanism to allocate memory or memory resources to guestsys tems, e.g. as a so-called block device (“block device”, this is a kind of virtual hard disk). It is made possible to dynamically make such block devices available and/or unavailable (ie, grant or revoke access) to guest systems. This can be done, for example, via a mechanism to control shared memory use (“Storage Share Control Mechanism”) in, for example, the switching system. A control interface can also be provided for this mechanism to allow other guests to request or release block devices for data exchange.

Especially against the background of POSIX or Unix-like guest systems, the storage area for all relevant guest systems can not only be provided via a network file system hosted by the switching system (housekeeping system), which is made accessible to the other guest systems via interfaces; it is also possible to make virtual hardware block or storage devices, which are managed, for example, by the switching system or by a separate entity, visible or provided for other guest systems.

Regardless of the technology used to share or provide the storage area, the service that offers the interface to other guest systems for transferring files or accessing the storage area can, for example, offer an API call in which a guest system switching system that it has made data available in the shared memory and that the switching system can now remove access to this data or access to the memory from the guest system and can, for example, carry out checks as to the integrity and/or authenticity of the data .

A guest system for lower functional security requirements than, for example, another guest system can particularly preferably be used or set up to receive data on the processing unit system and/or to send data from the processing unit system, in each case via a communication interface. An application example for this is a so-called FOTA, a "Firmware-Over-The-Air", i.e. a wirelessly installed software update for the computing unit system. Data received here can then be passed on to another guest system for higher functional security requirements, via the shared memory area.

For example, a more "open" guest might have a communications and data distribution application that receives update data and forwards it down to a more "closed" guest that hosts potentially security-sensitive update modules.

For example, this use case follows the following conceptual steps: Data (which needs to be moved down to the "more closed" guest system) is received from the application in the "more open" system and stored in the shared memory area. Then, for example, the completeness, integrity and authenticity of the data can be checked by the "more open" guest system. The more "open" guest then signals the more "closed" guest that data is available on the shared storage area and that the more "closed" guest should take over access to that data. The "more closed" guest system then takes over access to the data, e.g. by blocking the access rights for the "more open" guest system, and then carries out further actions on the data, if necessary, e.g. further checks of integrity and authenticity.

A guest system for higher functional safety requirements than, for example, another guest system can particularly preferably be used or set up to receive and/or determine and/or process sensor data on the computing unit system. An application example for this is an application for autonomous or automated driving, which then uses such sensor data in particular. For the development, validation and operation of autonomous or automated driving, large amounts or collected sensor data often have to be aggregated and made available from the vehicle in order to support systems for analysis and learning. This means that data is transferred from the "closed" guest system to a "more open" guest system on which, for example, an application for uploading and (external) communication is running.

For example, this use case follows the following conceptual steps. Data (which needs to be moved up into a "more open" guest system) is collected or aggregated in the "more closed" guest system and stored in the shared memory area. Then, for example, the completeness, integrity and authenticity of the data can be checked by the "closed" guest system, or signed and/or encrypted by the "closed" guest system, if appropriate. The more "closed" guest signals the more "open" guest that data is available in the shared memory and that the more "open" guest can or should request access to the memory area. The "more open" guest system then accesses the data and runs Actions on the data (e.g. uploading to a backend system). At this point, depending on the system design, the more "open" guest can either remove the data from the storage area itself, or signal the more "closed" guest that this can be done, and the data can be deleted (the decision about who deletes the data can be e.g determined by whether the authorization for the data has been transferred to the "more open" guest system or not; the data can only be deleted with the authorization).

A processing unit system according to the invention is set up, in particular in terms of programming, to carry out a method according to the invention.

The implementation of a method according to the invention in the form of a computer program or computer program product with program code for carrying out all method steps is advantageous because this causes particularly low costs, especially if an executing control device is also used for other tasks and is therefore available anyway. Suitable data carriers for providing the computer program are, in particular, magnetic, optical and electrical memories, such as hard drives, flash memories, EEPROMs, DVDs, etc. It is also possible to download a program via computer networks (Internet, intranet, etc.).

Further advantages and refinements of the invention result from the description and the attached drawing.

The invention is shown schematically in the drawing using an exemplary embodiment and is described below with reference to the drawing.

character list

• 1 shows schematically a computing unit system, on the basis of which the invention is explained in a preferred embodiment.

embodiment(s) of the invention

In 1 a processing unit system 100, e.g. a powerful control unit, is shown, which is a processing unit system according to the invention in a preferred embodiment and on the basis of which the invention is also to be explained, in particular within the scope of a method according to the invention in a preferred embodiment for operating the processing unit system 100. The computing unit system 100 can in particular be a vehicle computing unit system.

The computing unit system 100 has hardware 101, which includes, for example, an interface 102 to a sensor, a communication interface 103, for example for wireless communication, a processor 104 and a memory area 106, for example a non-volatile memory. A hypervisor 108 is executed on the computing unit system 100, which hosts three virtual guest systems or guest operating systems 110, 120 and 130, for example, which are connected via virtual Ethernet 150, for example. The guest system 110 is a switching system that provides a controller 112 that controls a file system server 114 and via which access to the storage area 106 is possible.

The guest system 120 provides an application 122 that can access a mount point 124 of the file system or file system server 114 . The guest system 130 provides an application 132 which can also access a mount point 134 of the file system or file system server 114 . For example, the guest system 120 can be a "closed" guest system, while the guest system 130 can be "more open", i.e. the guest system 120 meets higher functional security requirements than the guest system 130. B. intended to collect and process data or sensor data 160 via the interface 102 from a sensor, the guest system 130, however, is provided e.g. to receive and/or send data 162 via the communication interface 103.

If, for example, the guest system 120 has received and processed the sensor data 160, it may be the case that this sensor data or the results of the processing are to be sent to a backend system or to a cloud. To do this, the data must be transferred to guest system 130, which then sends them as data 162 using communication interface 103.

For this purpose, the guest system 120 sends a request to the switching system 110, e.g. via an interface or API interface 140, that access to the memory area 106 is requested. Such access does not initially exist. The switching system 110 then establishes this access exclusively for the guest system 120, which is indicated by reference number 142. At this point it should be mentioned that the guest system 130 has no access to the memory area 106 at this point in time.

The guest system 120 can then store the data in the memory area 106, possibly also after certain security checks, signature procedures, etc. have been carried out. The guest system 120 then informs the switching system that access is no longer required and, in particular, that access should be granted to the guest system 130 . In this case, the guest system 120 requests that access should be granted exclusively to the guest system 130. This can also be done via the interface 140.

The switching system then provides the guest system 130 with exclusive access to the memory area 106, which is indicated by reference number 144. The guest system 130 can then access the data in the memory area 106 that were previously stored there by the guest system 120, check this if necessary and send it via the communication interface 103. The guest system 130 can then inform the switching system that access is no longer required.

In this way, data can be transferred between guest systems that meet different security requirements by using only one memory area. Intermediate copying or other storage areas are not necessary.

It goes without saying that in this way—but in reverse order—data can also be received from the guest system 130 and transmitted to the guest system 120 .

Claims (10)

Method for operating a processing unit system (100), which has a memory area (106), a plurality of virtual guest systems (120, 130) and a switching system (110) being operated on the processing unit system (100), with the steps: receiving, by the switching system (110), a request from one of the guest systems to transfer access to the storage area from one or more current guest systems to one or more other of the guest systems, and Allocating, by the switching system (110), exclusive access to the storage area (106) only to the one or more of the other guest systems. procedure after claim 1 , wherein the request includes assigning access to the requesting guest. procedure after claim 1 or 2 , wherein the request includes that the access be relinquished by the requesting guest system. Method according to one of the preceding claims, wherein at least two of the plurality of guest systems are operated as systems (120, 130) with different security requirements. procedure after claim 4 , wherein a guest system (130), which is provided for lower security requirements than another guest system (120), for receiving data (162) on the processing unit system (100) and / or for sending data from the processing unit system (130), respectively via a communication interface (103). procedure after claim 4 or 5 , wherein a guest system (120), which is provided for higher security requirements than another guest system (130), for receiving and / or determining and / or processing sensor data (160) on the computing unit system (100) is used. The method of any preceding claim, wherein the switching system (110) includes one of the plurality of guest systems (120, 130). Arithmetic unit system (100) which is set up to carry out all method steps of a method according to one of the preceding claims. Computer program that causes a computing unit system (100) to carry out all method steps of a method according to one of Claims 1 until 7 to perform when executed on the computing device system (100). Machine-readable storage medium with a computer program stored on it claim 9 .

Images