DE102022209777A1 - DETECTION OF EXTERNAL INTERVENTIONS IN A COMPUTER SYSTEM WITH ZONE SEPARATION FOR A DEVICE, IN PARTICULAR FOR A VEHICLE - Google Patents

Abstract

One aspect of the present disclosure relates to a computer system for providing a plurality of functions for a device, in particular for a vehicle. The computing system of the first aspect includes a plurality of system modules, a plurality of system resources, and a security module, the plurality of system modules being configured to provide functions for the device. In addition, a first number of system modules and/or parts of system modules are assigned to the plurality of system modules of a first zone from a plurality of zones. In addition, a second number of system modules and/or parts of system modules of the plurality of system modules are assigned to a second zone from the plurality of zones. A zone of the first aspect is a logically and/or physically delimitable unit in the computer system, with the first zone being assigned a first number of system resources from the plurality of system resources. In addition, the second zone is assigned a second number of system resources from the plurality of system resources. The security module of the first aspect is designed to detect violations of rules governing the allocation of the first number of system resources of the plurality of system resources for the first zone and of rules governing the allocation of the second number of system resources of the plurality of system resources for the second zone .

Description

Technical area

The present invention relates to techniques for providing a plurality of functions for a device, particularly for a vehicle. Associated aspects concern a computer-implemented method and a computer program.

background

Recently, vehicles have been increasingly networked with each other and/or with a backend located in a cloud. More specifically, the vehicles have one or more interfaces through which data is received and/or sent during operation of a vehicle, which in turn is used to operate the vehicle. In addition, the complexity of the vehicle components and their software is constantly increasing, especially in connection with autonomous or semi-autonomous vehicles and the demand for “smarter mobility”, which implies the integration of the vehicle into the digital world. Cybersecurity therefore plays an increasingly important role in the software and hardware development of modern vehicles. In addition, problems with some prior art cybersecurity methods arise from the variety of applications provided by different manufacturers and running on different systems in the vehicle.

In this context, some prior art methods are based on the concept of zone separation, i.e. the concept of separating trust zones within an electronic control unit (ECU), whereby more exposed components are isolated from less exposed components in order to to reduce the attack surface.

However, some methods according to the state of the art are not able to detect intrusion attempts in different zones in a timely manner and to react accordingly.

Therefore, there is a need to develop new efficient techniques that can solve some or all of the above problems.

Summary of the invention

A first general aspect of the present disclosure relates to a computer system for providing a plurality of functions for a device, in particular for a vehicle. The computing system of the first aspect includes a plurality of system modules, a plurality of system resources, and a security module, the plurality of system modules being configured to provide functions for the device. In addition, a first number of system modules and/or parts of system modules are assigned to the plurality of system modules of a first zone from a plurality of zones. In addition, a second number of system modules and/or parts of system modules of the plurality of system modules are assigned to a second zone from the plurality of zones. A zone of the first aspect is a logically and/or physically delimitable unit in the computer system, with the first zone being assigned a first number of system resources from the plurality of system resources. In addition, the second zone is assigned a second number of system resources from the plurality of system resources. The security module of the first aspect is designed to detect violations of rules governing the allocation of the first number of system resources of the plurality of system resources for the first zone and of rules governing the allocation of the second number of system resources of the plurality of system resources for the second zone .

A second general aspect of the present disclosure relates to a computer-implemented method for providing a plurality of functions for a device, in particular for a vehicle, through a computer system. The method of the second aspect includes enforcing zone separation in the computer system. Furthermore, the method includes providing the plurality of functions for the device, in particular for the vehicle. Finally, the method includes detecting violations of regulations via an allocation of system resources assigned to at least two zones from a plurality of zones.

A third general aspect of the present disclosure relates to a computer program that contains instructions that, when executed by a computing system, cause the computing system to execute the computer-implemented method according to the second general aspect.

The techniques of the first to third general aspects may have one or more of the following advantages.

On the one hand, with the present techniques a greater differentiation of the security requirements in a computer system (e.g. vehicle computer) can be achieved than in some prior art technologies by dividing the computer system into zones (e.g. can nen the zones have different trustworthiness in relation to each other) and system modules of the computer system are assigned to the corresponding zones (eg depending on the degree of criticality of functions for a device which these system modules provide). As a result, the zone separation in the computer system of the present techniques can reduce the probability that a successful manipulation in one zone will spread to other zones.

Second, the techniques of the present disclosure can detect computer system intrusions more efficiently than some prior art techniques. In particular, violations of regulations governing the allocation of system resources for different zones (e.g. unauthorized access of these zones to system resources) may indicate that an intrusion has occurred, or even that the intrusion did not take place if the regulations on allocations of system resources for the zones were complied with ( e.g. these zones only access the permitted system resources).

Third, the present techniques offer the possibility of detecting (and, for example, accumulating and responding to) such regulatory violations in a computer system of a device (e.g. in a vehicle) in a centralized manner through a security module. The present techniques thus enable a quicker and clearer assessment than some prior art techniques as to whether or not there is an intervention on the entire computer system.

• Ein „Systemmodul“ kann eine Hardware- und/oder Software-Einheit umfassen, die eine Mehrzahl von Funktionen für eine Vorrichtung (bspw. für ein Fahrzeug) bereitstellt. Ein Systemmodul kann einen oder mehrere Prozessoren, Controller, Steuereinheiten, (Kommunikations-)Schnittstellen, Netzwerkkomponenten, Softwareapplikationen, Softwarearchitekturen, sämtliche anderen Software/- und/oder Hardware-Komponenten, Teile der genannten, oder eine beliebige Kombination davon umfassen oder eine oder mehrere der oben genannten Realisierungen von Systemmodulen sein. Ein Systemmodul oder sein Teil kann in einer Zone oder in einer Subzone angeordnet sein.

Some terms are used in the present disclosure in the following ways:

• A “system module” may include a hardware and/or software unit that provides a plurality of functions for a device (e.g., a vehicle). A system module can include one or more processors, controllers, control units, (communications) interfaces, network components, software applications, software architectures, all other software/and/or hardware components, parts of those mentioned, or any combination thereof or one or more of the above-mentioned implementations of system modules. A system module or its part can be arranged in a zone or in a subzone.

A “zone” can be a logically (functionally) and/or physically (spatially) delimitable unit in a system. In other words, two or more zones are logically delimited from one another if they are separated from one another on a software basis (e.g. represent different logical models in one software), while two or more zones form physically delimitable units if they are spatially separated from one another (e.g located in different computing units or parts thereof). A zone may include one or more system modules and/or a part and/or parts of one or more system modules. A zone can be defined, i.e. determined, by its components. All system modules or parts of system modules that are assigned to a zone can form the zone. A zone can contain various computing units, computing cores, controllers, control units, storage units, peripherals, (communications) interfaces, network components, software applications, software architectures, bus systems (e.g. CAN bus systems in vehicles), all other software and/or hardware components , parts of those mentioned, or any combination thereof. Several zones can form an overall system (e.g. an entire computer system). A “zone” may, in some examples, be divided into two or more “subzones,” which together may form that zone. A “subzone” can be a logically (functionally) and/or physically (locally) delimitable sub-unit of a zone. Similar to a zone, a subzone may include one or more system modules or portions thereof associated with the corresponding zone.

The term “system resource” can refer to any resources that, as a whole, ensure the (at least partial) executability of one or more functions of the computer system for a device (e.g. for a vehicle). A “system resource” may be a software and/or hardware component that provides services to system modules. For example, a system resource may include one or more memories, one or more peripherals (e.g., vehicle-internal and/or vehicle-external peripherals), a system resource associated with the power supply, or any combination thereof. The term “software component” (or “software”) can in principle be any part of the software of a component (e.g. a control device) of the present disclosure. In particular, a software component may be a firmware component of a component of the present disclosure. “Firmware” is software that is embedded in (electronic) components and provides basic functions there. Firmware is functionally firmly linked to the respective hardware of the component (so that one cannot be used without the other). It may be stored in non-volatile memory such as flash memory or EEPROM. A zone of the present disclosure may be permitted or denied access to a system resource be defended. For example, a zone can be allowed access to a system resource through an access right (more on this below). A “system resource” can be assigned to a zone or subzone, or can be independent of the zone separation in a computer system, ie not assigned to a zone or subzone.

The term “system resource” can also refer to a “communication resource” (e.g. a bus system, in particular a CAN bus system in a vehicle, or parts thereof, or be a bus system or parts thereof), which, for example, have properties of a communication connection via a Transmission path or multiple transmission paths in the computer system in the case of multi-path communication (e.g. using multi-path TCP), which can be described as a set of transmission parameters (e.g. using a data rate, transmission capacity, transmission latency, transmission bandwidth, transmission reliability or any combination thereof ). The corresponding communication can take place, for example, between vehicle-internal and/or vehicle-external modules/components via one or more radio networks, for example 5G, LTE mobile radio networks or WLAN networks, or via near-field communication connection or Bluetooth. For example, communication resources may include communication interfaces (e.g., one or more of 12C, SPI, CAN, LIN, USB, PCIe, Bluetooth, and Wi-Fi).

A “memory” can be a data storage device or a data medium on which data is stored (stored). A memory can be read from or written to by a computer and/or some type of peripheral device. A memory can be a semiconductor memory and/or a magnetic memory or a memory based on a technology not mentioned here. A memory may be volatile memory and/or non-volatile memory. A memory may include one of DRAM, RAM, ROM, EPROM, HDD, SDD, etc. on which data is stored.

A “periphery” can be a component that can be connected to a (central) computing unit. Such a component may require control by the computing unit and, if necessary, initialization. A component can be a “vehicle component”. A peripheral can include a part of a computer or a computer that offers functionalities that cannot be provided by a computing core itself, but by additional hardware. For example, a peripheral can be an analog-to-digital converter (ADC), a safety-related peripheral, a security-related peripheral (MPU, MMU or others), a timer. or an interface such as a Serial Peripheral Interface (SPI) or other interface mentioned above.

The term “vehicle component” refers to any internal components of a vehicle. A vehicle component can be an engine (e.g. an internal combustion engine, an electric motor, a hybrid engine or a fuel cell or parts of an engine such as a turbocharger), a control device (e.g. an engine controller), a battery or other energy-absorbing systems, components of a drive train (e.g. a transmission ), assistance systems (e.g. brake assistants, lane keeping assistants, parking assistants), climate control systems, sensors or sensor systems (e.g. camera-based systems, LIDAR systems, RADAR systems, ultrasonic sensor systems) or electronic systems for controlling Interior functions. A vehicle component can also be a part of the systems described above or a combination of several of the systems described above (or parts thereof).

A “computer system” of the present disclosure may include a (e.g., central) vehicle computer (e.g., a vehicle computer may form the computer system). The computer system can include systems within a vehicle (e.g. system modules and/or vehicle components in the sense defined above). In some cases, the computer system can also include systems outside the vehicle (e.g. peripherals external to the vehicle, data cloud systems, other components, or any combination thereof). In this context, a “vehicle computer” is a class of highly integrated electronic vehicle control devices that are characterized by a much higher computing power compared to microcontroller-based ECUs. VCs are designed with at least one microprocessor and a communication interface. In addition, a vehicle computer can contain one or more physical or virtual switches, a system-on-a-chip (SoC) hardware with several CPU cores, co-processors and powerful graphics cards on which, for example, several virtual machines run different operating systems using hypervisors that are connected via a virtual switch (e.g. implemented in the hypervisor). Alternatively or additionally, VCs can use container technologies that rely on creating a container to provide virtual resources. VCs usually run complex software for a wide variety of tasks with a wide variety of requirements, especially for time-critical and safety-critical functions. VCs communicate with others Systems in the vehicle, in particular with vehicle components, user interfaces, as well as with other VCs or ECUs (any combination of these alternatives is also conceivable). In addition, VCs can communicate with systems external to the vehicle, such as cloud systems, smartphones, charging infrastructure, traffic control technology or other vehicles. In addition, the computer system can contain a bus system with which several logical/physical communication connections can be implemented between different components of the computer system (e.g. using appropriate physical communication channels). A possible example of such a bus system in the vehicle sector is the Controller Area Network bus system (CAN bus system).

In other cases, “a computer system” may include an embedded system (e.g. an embedded system may constitute the computer system). An embedded system is an electronic calculator or computer that is integrated into a technical context. An embedded system can carry out regulation, control, monitoring functions or data processing tasks. In yet other examples (or in addition), “the computer system” may include one or more control units (ECU) (e.g. one or more control units may form the computer system).

A “function” can be any task (or subtask) that is performed in the operation of a device. A function can relate to the control, regulation or monitoring of the device or a part of the device (e.g. a component of the device). Additionally or alternatively, a function may relate to data or signal processing in the device (e.g. a communication function). The term “function” in the vehicle sector includes control-based functions of a vehicle, for example functions of driving or parking assistance systems, functions for autonomous or semi-autonomous driving, functions of an entertainment system as well as functions for receiving, transmitting and storing various data between different systems (e.g. System modules and/or vehicle components) of the computer system (or any combination of the above functions). Within the scope of the present disclosure, functions in connection with air conditioning systems and/or electronic systems for controlling functions of the interior are also conceivable. A corresponding “system module” can be responsible for the executability of the function, which can, for example, communicate with corresponding other systems, e.g. components (e.g. vehicle components), other system modules within the vehicle or functional units external to the vehicle (as already mentioned above) or a combination thereof .

A “software architecture” can be a structured and/or hierarchical arrangement of the system components and a description of their relationships in a software system, whereby system components can be software parts whose relationships to one another and whose properties can be described by the software architecture. For example, the software architecture of “AUTOSAR” (Automotive Open System Architecture) is an open and standardized software architecture for electronic control units (ECUs) in the automotive sector. For example, the “AUTOSAR Classic Platform” and the “AUTOSAR Adaptive Platform” are two different software architectures.

A “security module” (e.g. a central “security module”) may be a component for detecting violations of regulations on the allocation (or in other words “on the allocation”) of (assigned) system resources for the respective zones (including, for example, system modules). . Further, the security module of the present disclosure may serve the purpose of centralized collection and processing of detected violations (more on this below). The security module can be a hardware unit, which can have its own memory, preconfigured hardware logic, one or more registers and an internal data connection. (For example, a register can contain or describe memory areas.) In addition, a security module can include respective logical and/or physical connections to the zones (including, for example, system modules). In this context, a security module can have one or more interfaces to the outside, e.g. to the zones, to a computing core, to one or more communication connections or any combination thereof. A security module can be part of a processor (Central Processing Unit, CPU). In some cases, the security module may be integrated into a vehicle computer or designed as a stand-alone component (e.g. vehicle-internal or vehicle-external component) which, for example, communicates with the vehicle computer (in the latter case, the computer system of the present disclosure may include the vehicle computer and the security module ). The security module can communicate externally via appropriate communication protocols (e.g. with system modules, components, other components of a computer system or any combination thereof).

A “domain controller” can include peripherals implemented in hardware and access rights, for example to memory and/or external Manage peripherals. A domain controller can segregate various peripherals and/or protect the memory of a system, whereby a domain of a domain controller can be a contiguous area that has equal access rights to peripherals and/or memory. A domain controller can be, for example, an Extended Resource Domain Controller (XRDC), which is a hardware-implemented peripheral of the S32G274A processor. The latter is a high-performance vehicle network processor from the S32G2 family from the semiconductor manufacturer NXP and represents a system-on-chip (SoC) that includes a microcontroller (µC) and microprocessor components (µP components).

A “computing core” means the central part of a microprocessor, although several computing cores can also be present in a microprocessor. A computing core can perform arithmetic and/or logical operations on input data and/or information.

A “vehicle” can be any device that transports passengers and/or cargo. A vehicle can be a motor vehicle (for example a car or a truck), but also a rail vehicle. A vehicle can also be a motorized, non-motorized and/or a human-powered two- or three-wheeler. However, floating and flying devices can also be vehicles. Vehicles can operate autonomously or at least partially autonomously or be assisted. For example, in the present disclosure, the vehicle may include a partially or fully autonomous robot (e.g., an industrial robot).

Short description of the characters

• 1 schematically shows an exemplary embodiment of a computer system 100 according to the first aspect for providing a plurality of functions for a device by separating a plurality of zones. The computer system of the 1 includes four zones 20-23 (dashed boxes), six system modules 30-35 and a security module 10. Two computing units 40, 41 and five interfaces 50-54 are also shown in this figure.
• 2 illustrates an exemplary embodiment of the computer system (for simplicity without the third zone 22), which is in addition to the embodiment of 1 has peripherals 60, 61, two memories 62, 63 and a domain controller 70.
• 3a is a flowchart showing an exemplary embodiment of a computer-implemented method provided by a computer system according to the first aspect (e.g. using a in 1 or 2 computer system shown). 3b represents a flowchart that shows further possible method steps according to the second aspect.

Detailed description

First, based on 1 and 2 Techniques for providing a plurality of functions for a device (in particular for a vehicle) and exemplary structures of a computer system are described. Then become 3a and 3b illustrate further aspects relating to the method of the present disclosure.

A first general aspect relates to a computer system 100 (e.g. a vehicle computer) for providing a plurality of functions for a device, in particular for a vehicle (e.g. a vehicle operating autonomously or semi-autonomously), the computer system comprising a plurality of system modules 30-35 ( e.g. hardware and/or software units, as already mentioned above), a plurality of system resources 60-63 (e.g. memory, vehicle-internal and/or vehicle-external peripherals, communication resources, such as a whole or part of a bus system, see discussions above) and a security module 10 (possible exemplary embodiments of such a computer system 100 are in the 1 and 2 shown). The plurality of system modules of the first general aspect are configured to provide functions for the device (e.g. functions for controlling, regulating or monitoring the device, as already discussed above).

In the present techniques, a first number of system modules 30, 31 and/or parts of system modules of the plurality of system modules are assigned to a first zone 20 from a plurality of zones 20-23. In addition, a second number of system modules 32 and/or parts of system modules of the plurality of system modules are assigned to a second zone 21 from the plurality of zones. A zone is a logically and/or physically delimitable unit in the computer system (as defined above). For example, one or more, two or more, three or more, four or more, five or more, six or more, ten or more, twenty or more, fifty or more, one hundred or more zones can be separated in the computer system 100. In a non-limiting example of 1 Four zones 20, 21, 22 and 23 as well as six system modules 30 to 35 are shown. The two system modules 30, 31 (the first number of system modules in this example) are assigned to the first zone 20, while the one system module 32 (the second number of system modules in this example) is assigned to the second zone 21 (this arrangement is also in the exemplary embodiment of 2 shown). In the same way as for the two zones 20 and 21, one or more other system modules or parts thereof that are not assigned to either zone may be assigned to corresponding other zones that are different from the first and second zones. In the example of 1 three system modules 33, 34 and 35 are assigned to the third zone 22.

In some cases, a zone may contain one or more, two or more, three or more, four or more, five or more, six or more, ten or more, twenty or more, fifty or more, one hundred or more system modules (e.g., processors or other implementations of system modules according to the above definitions) or parts thereof (e.g. computing cores). For example, the first zone 20 may include a portion (e.g., two cores) of the multiple cores of a processor (e.g., four cores) and the second zone 21 may include another portion (e.g., two remaining cores) of the multiple cores of the processor (in the figures Not shown). For example, a first software application can be executed on a computing core of the processor that is assigned to the first zone 20 and a second software application can be executed on at least one computing core that is assigned to the second zone 21. In some examples, a zone may include interfaces, bus systems, or portions thereof. In 1 For example, the first zone 20, which includes a first interface 50 and a second interface 51, a second zone 21, which includes an interface 52, and the third zone 22, which includes an interface 53, is shown. For example, an interface may include a CAN bus interface, a CAN FD bus interface and/or a GMAC port.

In the techniques of the present disclosure, the first zone 20 is assigned a first number of system resources 60-62 (e.g., software and/or hardware component) from the plurality of system resources 60-63. In addition, the second zone 21 of the plurality of zones is assigned a second number of system resources 62, 63 from the plurality of system resources. In some cases, the second number of system resources 62 may be different from the first number of the plurality of system resources. As already discussed above, “system resources” can provide corresponding services for system modules and are, for example, required for the execution of one or more functions of the computer system. The second number of system resources 62, 63 can be more limited than the first number of system resources 60-62. For example, the second number of system resources may include fewer system resources than the first number of system resources. Alternatively or additionally, the second zone 21 may have fewer access rights to the same or other system resources, as will be explained in more detail below. In a non-limiting example of 2 two peripherals 60, 61 and a memory 62 (the first number of system resources in this example) are assigned to the first zone 20 (e.g. by means of a domain controller 70, more on this below), while two memories 62, 63 (the second number of System resources in this example) are assigned to the second zone 21. In the example of 2 the same system resource, namely the memory 62, is assigned to the two zones 20, 21 and the other system resources 60, 61 and 63 are assigned to the first 20 and the second zone 21, respectively. In some cases, the same system resource can be assigned to two or more zones. In other cases, a system resource can only be assigned to a corresponding zone and not to any other zone.

The security module 10 of the present disclosure is designed to detect violations of rules governing the allocation of the first number of system resources 60-62 of the plurality of system resources for the first zone 20 and of rules governing the allocation of the second number of system resources 62, 63 of the plurality of system resources for the second zone 21. As explained further below, for example, the first and/or the second zone (e.g. system modules assigned to these zones) may access (e.g. can) an unauthorized system resource due to an external intervention (or in other words: an intrusion from outside). the first zone 20 can access the memory 62 for writing purposes, although this zone is only allowed to access the memory for reading purposes (more on this below). Furthermore, the security module 10 can be designed to detect violations of regulations regarding the allocation of system resources for the other zones (e.g. for all remaining zones, such as for the third and fourth zones 22, 23 of the 1 ). The security module 10 of the first aspect may include one or more logical and/or physical connections to a zone of the plurality of zones (e.g., one or respective logical and/or physical connections to the first and second zones of the plurality of zones). In the examples of 1 and 2 Such connections are shown by solid lines from the security module 10 to the respective zones 20, 21, 22.

In the computer system 100 of the first aspect, the first zone 20 may be more trustworthy than the second 21, less trustworthy zone, whereby the risk of manipulation of a more trustworthy zone is lower than a less trustworthy zone. Manipulation can include an external intervention (or in other words: an intrusion from outside, for example a cyber attack), which reduces the operational security of the device. Furthermore, in some cases, a third zone 22 of the plurality of zones may be more trustworthy than or equally trustworthy as the first zone 20. In other cases, the third zone 22 may be more trustworthy than or equal to the second zone 21 and less trustworthy than the first zone. In still other cases, the third zone 22 may be less trustworthy than the second zone 21 and the first zone 20. In this way, other zones (e.g. all zones) of the majority of zones can also be classified in terms of how trustworthy they are in relation to one another.

The extent to which a zone of the majority of zones is more or less trustworthy, i.e. the degree of trustworthiness, can be based on a classification of zones 20-23 based on a security level. The computer system of the present disclosure may have at least two security levels, but also more than two security levels (e.g. more than five). The degree of trustworthiness or the security level can be determined by the configuration of the corresponding zone (e.g. the system modules it contains). For example, the level of security or the extent of security measures with which the system modules of a zone 20-23 are protected against manipulation, for example as part of an external intervention, can determine whether a zone 20-23 is more trustworthy or less trustworthy or what security level it has (e.g. the presence of certain hardware and/or software-based security measures in the zone's system modules). Furthermore, for example, the extent of communication between the system modules, which are arranged in the corresponding zone, with external systems, such as a backend, can determine what level of trustworthiness a zone has or what security level it has. For example, a zone that communicates predominantly or exclusively within the computer system may be more trustworthy than a zone that communicates at least partially with external systems (e.g. a backend, other devices such as vehicles or infrastructure components).

In some examples, the zones can be classified in terms of trustworthiness into untrusted zones and trusted zones. For example, two zones 20, 21 as described herein may be trusted and a less trusted third zone 22 may be untrusted, for example (see 1 and 2 ). The computer system 100, for example a computer system of a vehicle, can, for example, be the target of a cyber attack, whereby safety-critical functions, for example a braking function in a vehicle, can be disabled or manipulated in such a way that a dangerous situation can arise. A more trustworthy zone 20, 21 is a zone whose manipulation is less likely than a less trustworthy zone 22. For example, a zone 22 that includes multimedia functions and has many interfaces for communication with a backend can be a less trustworthy zone 22. since the probability of external intervention on a communication channel to the backend is higher than with a zone 20, which predominantly includes functions that only require information from within the vehicle and/or only execute processes within the vehicle. In addition, the security module 10 responsible for violations of system resource allocation regulations for various zones may be the first zone 20 of the plurality of zones, or another zone 23 of the plurality of zones which is more trustworthy than the first zone, be assigned. In some cases, the security module 10 may be associated with the most trusted zone 23 of the plurality of zones (eg, the security module 10 may be associated with the fourth most trusted zone 23, such as the 1 and 2 illustrate).

In the present techniques, the functions provided by the system modules may have varying levels of criticality to the operational safety of the device. A first, more critical function of the plurality of functions can be provided by a system module 30, 31 of the first zone 20 and a second, less critical function of the plurality of functions by a system module 32 of the second zone 21. In some cases, two or more system modules (e.g., all system modules) of the second zone may provide corresponding functions that are less critical than any functions provided by the system modules of the first zone. In addition to the division of zones 20-23 according to a degree of trustworthiness, i.e. a security level, the zones are also related to the relevance for operational safety (e.g. by means of a security level or "safety level"), i.e. the criticality of the zone's function the operational safety of the device. A zone 20, the manipulation of which can lead to a serious dangerous situation, is more critical than a zone 21, the manipulation of which cannot lead to a serious one dangerous situation or can lead to a less serious dangerous situation. For example, a zone 21 that includes multimedia functions may be less critical than a zone 20 that includes, for example, a braking function. In the above example, the probability that the failure of music in the interior of a vehicle will create a dangerous situation is less high than the probability that a malfunctioning brake of a vehicle can create a dangerous situation. In addition, a zone 23 to which the security module 10 is assigned may be more critical than one or more (e.g. all) other zones of the plurality of zones. Back to the example of 1 : the fourth zone 23 is more critical than the other three zones 20, 21 and 22. A classification of the zones based on a safety level or safety level or the relevance for the operational safety of the device can be done in any suitable way. In some examples, the classification may be through the Automotive Safety Integrity Level (ASIL) classification, where the classification has five levels (QM (least critical), ASIL-A, ASIL-B, ASIL-C and ASIL- D (most critical)) may include. For example, the relevance, i.e. the criticality, of a zone for operational safety can be derived from the severity, frequency, controllability of a safety hazard or any combination thereof in the respective zone.

In the present disclosure, one or more more trustworthy zones 20, 21 may be formed on a first computing unit 40 of the computer system and one or more less trustworthy zones 22 may be formed on a second computing unit 41 of the computer system. 1 shows an example of such a computer system 100 (for example, the computer system 100 can include a vehicle computer, a one-chip system or an embedded system, see also definitions above), which has a first computing unit 40 and a second computing unit 41. For example, a first trusted zone 20 and a second trusted zone 21 may be formed on the same computing unit 40 and a third untrusted zone 22 may be formed on the second computing unit 41. For example, zones 20 and 21 may be logically separated from each other on a software basis. In some examples, the third zone 22 can be physically, ie locally, separated from the first zone 20 and/or the second zone 21 by forming it on a second computing unit 22.

In the present techniques, zones among the plurality of zones may be assigned corresponding access rights to system resources. In other words, a zone can be denied access to a system resource or allowed through an access right. The access rights can include permitted read, write, execute access or any combination thereof of a zone to a corresponding system resource. In some cases, one or more access rights assigned to a zone may remain unchanged over time (e.g., the access right may be predefined before the operation of the computer system or during its operation). In other cases, one or more access rights assigned to a zone may change over time (e.g., a zone is permitted to read a system resource at startup of the computer system, while at another time that zone is permitted to read the same system resource). to use writing). In one example, access for a zone to a system resource may be classified as permitted if a predetermined criterion is met. In addition, access for the same zone to the system resource can be classified as unauthorized if the predetermined criterion is not met. The predetermined criterion can be a criterion that relates to contextual information of the device and/or a plurality of devices, e.g. to contextual information of a vehicle (or its vehicle components) and/or a vehicle fleet. For example, the contextual information of the vehicle (or its vehicle components) may include information about an operating state of the vehicle (or its vehicle components) and/or about predetermined rules for operating the vehicle (or its vehicle components). (This definition can similarly be extended to the entire vehicle fleet.) In another example, the predetermined criterion may require that an expected number of messages be sent in a predetermined period of time from a zone (e.g. over a CAN Bus system), must be less than or equal to a predetermined value (or must be greater than or equal to a predetermined value). In further examples, the predetermined criterion may be a predetermined order in which the data is sent from the zone and/or a predetermined range included in the sent data of a particular type (e.g. a value is between a predetermined value and a another predetermined value and/or a predetermined pattern is included therein). In still other examples, the predetermined criterion may include one or more criteria mentioned above.

In some cases, the second zone may be assigned fewer access rights to the second number of system resources than the first zone to the first number of system resources. Back to the example of 2 : the first Zone 20 of the plurality of zones, which may be more trusted than the second, less trusted zone 21, may be granted access to use the memory 62 for reading and writing or for reading, writing and executing a software application. On the other hand, the second, less trustworthy zone 21 can be granted access rights to use the memory 62 for reading, while access for writing and/or executing a software application is denied.

In some examples, as in 2 shown, the computer system has a domain controller 70 which contains a plurality of domains (the latter are not shown in this figure). A domain controller 70 may contain one or more, two or more, three or more, four or more, five or more, six or more, seven or more, eight or more domains. In the first aspect of the present techniques, a first domain of the plurality of domains may be assigned at least the first zone 20, and the first domain may have equal access rights of the first zone to system resources. In addition, a second domain of the plurality of domains can be assigned at least the second zone, and the second domain can have the same access rights of the second zone to system resources, with the second domain being assigned fewer access rights to system resources than the first domain (as already above in described in connection with the first and second zones). In other words, in some examples, a domain may be assigned system modules and/or portions of system modules with the same access rights, or a domain may be assigned the system modules and/or portions of system modules that require the same access rights to system resources in order to provide the corresponding functions . The domain controller may, in some examples, be configured to allow or prohibit access by system modules 70 to system resources. In some examples, access rights to system resources (e.g., via domain controller 70) may be assigned based on the Principle of Least Privilege (PoLP). This means that the zones only have access rights to the system resources that they need to fulfill their tasks. In other words: The system modules that are assigned to the zones only have access rights to the system resources that they need to provide the respective functions. In some examples, a domain can be assigned a security level. For example, a first domain (e.g., domain 0) of the plurality of domains (e.g., five domains) may be assigned a lower trustworthiness than a fifth domain (e.g., domain 5).

In some examples, zones 20, 21 can be assigned access rights to peripherals 60, 61 and/or memories 62, 63 by means of the domain controller 70. For example, a domain may include a logical/physical area that has equal access rights to memory 63 and/or peripherals 61, 62. In addition, in a zone of the plurality of zones (e.g. in the first 20 or in another zone), a system module and / or a part of a system module may comprise a first software architecture and in another zone of the plurality of zones (e.g. in the second 21 or in another zone), another system module and/or part of a system module may comprise a second software architecture. For example, in the first zone 20, a system module 30, 31 and/or part of a system module may include an AUTOSAR Classic software architecture and in the other zone 21, a system module 32 and/or part of a system module may include an AUTOSAR adaptive software architecture . For example, in the first zone 20 a system module 30, 31 and/or part of a system module may be configured to run a first operating system (e.g. Windows) and in the second zone 21 a system module 32 and/or part of a system module may be configured to run a second operating system (e.g. Linux).

In the present techniques, a violation of regulations over an associated system resource for a zone may correspond to unauthorized access by that zone to a system resource for which the corresponding zone is not assigned access rights. For example, the violations of the rules governing the allocation of the first number of system resources of the plurality of system resources for the first zone may correspond to one or more unauthorized accesses by the first zone to one or more system resources for which the first zone is not assigned access rights. Alternatively or additionally, the violations of the rules governing the allocation of the second number of system resources of the plurality of system resources for the second zone may correspond to one or more unauthorized accesses of the second zone to one or more system resources for which the second zone is not assigned access rights. For example, a violation of rules governing the system resources allocated for the first zone (or another zone) may occur if the first zone (e.g. a system module assigned to that zone) attempts to write to a system resource (e.g. memory) even though it Only read access to the system resource is permitted. In another example, a Violation of regulations regarding the system resources allocated for the first zone (or another zone) occurs when the first zone (e.g. a system module assigned to this zone) attempts to execute a system resource (e.g. a software application) although it does not have access rights to execute it system resource has.

In the present techniques, the security module 10 may be further configured to communicate with one or more zones 20, 21, 22 (e.g. all zones) (e.g., as already described above, using appropriate logical and/or physical connections) . As a result, the security module may be configured to collect information about accesses to system resources by one or more zones (e.g., each zone) of the plurality of zones. This information (e.g. in the form of digital or analog signals, messages or the like) can be provided to the security module, for example by the respective zones. In some cases, the security module may be configured to send a request to obtain information about a zone's accesses to system resources at the zone, and the zone may provide the security module with this information. Such a request can, for example, occur regularly once per a predetermined time interval and/or irregularly if the respective successive time intervals are different. For example, this information can be stored in a register of the zone, e.g. in a system module (e.g. a storage unit) assigned to this zone, so that the security module can read this information. Alternatively or additionally, the zone itself may send this information to the security module (e.g. regularly once per a predetermined time interval and/or irregularly if the respective successive time intervals are different) without the security module making this request. Furthermore, the security module can compare the information about accesses of the one or more zones to system resources with information regarding regulations regarding the allocation of system resources for these zones. For example, the information about the allocation regulations can be stored in the security module or in another system module with which the security module can communicate. Based on the comparison result, the security module of the present techniques can in some cases detect whether violations of system resource allocation regulations have occurred for the one or more zones. For example, if the information about the zone's access to system resources does not match the information regarding the rules for the allocation of system resources for this zone (e.g. because at least one unauthorized access of this zone to a system resource has been detected), the security module can use this comparison result classified as a violation of regulations. As already discussed above, violations of regulations regarding the allocation of system resources for the respective zone can occur due to an external intervention in the computer system (e.g. in this zone or in one or more system modules in this zone).

In addition, the security module 10 of the first aspect or another module with which the security module is in communication connection (e.g. to inform this module of corresponding violations of mapping rules, e.g. using a corresponding signal) can be configured to have a Triggers a reaction in a manipulated zone in order to mitigate the effects of manipulation by external intervention on the computer system. The manipulated zone can correspond to a zone for which violations of regulations regarding the allocation of system resources assigned to this zone have been detected. The reaction can include initiating a countermeasure against the detected violations within the manipulated zone. In some cases, such countermeasure may include changing access rights to system resources associated with the compromised zone. For example, if a zone has two or more different access rights for using a system resource (e.g. zone 20 in the example of 2 reading, writing, and executing the memory 62), as a countermeasure, a number of access rights to use this system resource can be reduced (e.g., as a countermeasure, the zone 20 is allowed to use the memory 62 only in a read-only manner).

In other cases, the countermeasure may include blocking access to system resources associated with the compromised zone (e.g., denying zone 20 access to memory 62 as a countermeasure). In still other cases, the countermeasure in the tampered zone may include shutting down the tampered zone. In addition, the countermeasure can include sending information (e.g. in the form of digital or analog signals, messages or the like) about the detected violations of regulations in the manipulated zone and/or other relevant information (e.g. also in the form of digital or analog signals, Messages or the like) from the security module 10 to system modules 30, 31 that belong to the manipulated zone 20. The other relevant information can include, for example, the context information of the device described above device and/or a variety of devices, for example the context information of a vehicle (or its vehicle components) and/or a vehicle fleet. Alternatively or additionally, the countermeasure may include sending information about the detected regulatory violations in the tampered zone and/or other relevant information from the security module 10 to system modules 32-35 associated with the other non-tampered zones. Alternatively or in addition to the two alternatives mentioned above, the countermeasure may include sending information about the detected violations of regulations in the manipulated zone and/or other relevant information from the security module to an external system (e.g. a backend, other devices such as vehicles or infrastructure components ). In some cases, the security module 10 (or other module mentioned above) may be further configured to execute a routine (e.g., a software program or code, such as compiled code) as the response within the tampered zone. For example, one or more of the countermeasures described above can be implemented in the computer system 100 using this routine.

Alternatively or in addition to the (possible) triggered response in the tampered zone, the security module 10 or the other module with which the security module is in communication connection may be configured in the present techniques to trigger a response in a non-tampered zone in order to mitigate the effects of manipulation caused by external intervention on the computer system. The reaction can include initiating a countermeasure in the non-manipulated zone as a result of detected violations in the manipulated zone. In some cases, such countermeasure may include changing access rights to system resources associated with the untampered zone. For example if a first zone 20 of 2 is the manipulated zone, and the second (non-tampered) zone 21 has two or more different access rights for using a system resource (e.g. the zone 21 may read, write and execute the memory 63), as a countermeasure a number of Access rights to use this system resource from the second non-manipulated zone 21 are reduced (for example, as a countermeasure, the zone 21 is allowed to only use the memory 63 for reading purposes). In other cases, the countermeasure may include blocking access to system resources associated with the untampered zone (e.g., denying zone 21 access to memory 63 as a countermeasure). In still other cases, the countermeasure in the untampered zone may include shutting down the untampered zone. In some cases, the security module 10 (or other module mentioned above) may be further configured to execute a routine (e.g., the routine mentioned above) as the response within the untampered zone. For example, one or more of the countermeasures described above can be implemented in the computer system 100 using this routine.

As already described in detail above, the security module 10 can send the information about the detected violations of regulations in the manipulated zone and/or the other relevant information to the system modules 30-35 that belong to the manipulated zone 20 and/or to the other non- manipulated zones 21, 22 belong. (As already discussed, any information may be in the form of, for example, digital or analog signals, messages, or the like.) Alternatively or additionally, one or more system modules (e.g., all system modules) of the plurality of system modules may be configured to provide security module 10 to query information about the detected violations in one or more manipulated zones or for other relevant information (so-called “polling” - a term known to those skilled in the art). Such a query can, for example, take place regularly once per a predetermined time interval and/or irregularly if the respective successive intervals are different. Further, the security module 10 may be configured to provide this information to the one or more system modules (e.g., send and/or allow this information to be read by the system modules). Additionally, each of the one or more system modules of the plurality of system modules may be configured to identify, from the information about the detected violations, whether violations of system resource allocation regulations have occurred for one or more zones of the plurality of zones. Additionally, each of the one or more system modules of the plurality of system modules may be configured to trigger a response in a corresponding zone to which that system module is associated (e.g., in an untampered or tampered zone, depending on which zone the corresponding system module is associated with is) when violations of system resource allocation rules have been identified for at least one of the plurality of zones. The reaction can include initiating a countermeasure within the zone to which this system module is assigned. The countermeasure can, for example, include one or more countermeasures that are already in the context have been described with the security module. Namely, in some cases, the countermeasure may include changing access rights or blocking access to system resources associated with the zone to which this system module is associated. In other cases, the countermeasure may include shutting down the zone to which this system module is associated.

A second general aspect of the present disclosure relates to a computer-implemented method for providing a plurality of functions for a device, in particular for a vehicle, through a computing system 100. In some cases, the method of the second aspect may be provided by a computing system 100 according to the first general aspect be (e.g. through the in the 1 or 2 computer system shown or by another computer system). The procedure is exemplary in 3a and 3b shown. The method steps of the corresponding independent claim are in the boxes drawn by solid lines 3a to 3b while the method steps of some dependent claims are shown in the boxes represented by dashed lines. The method of the second aspect includes enforcing 200 zone separation in the computer system. Furthermore, the method includes providing 300 the plurality of functions for the device, in particular for the vehicle. Finally, the method includes detecting 400 violations of regulations via an allocation of system resources associated with at least two zones from a plurality of zones 20-23.

Furthermore, the “enforce 200” step of the second general aspect may include assigning 210 a first number of system modules 30, 31 and/or parts of system modules of a plurality of system modules to a first zone 20 of the at least two zones 20-23. Additionally, the “enforce 200” step may include allocating 220 a first number of system resources 60-62 from a plurality of system resources 60-63 to the first zone. In addition, the step “enforce 200” may include assigning 230 a second number of system modules 32 and/or dividing system modules of the plurality of system modules to a second zone 21 of the at least two zones 20-23. Additionally, the “enforce 200” step may include allocating 240 a second number of system resources 62, 63 from the plurality of system resources 60-63 to the second zone 22. In the present techniques, system modules or parts thereof that do not belong to the first and second zones, as well as respective system resources, may be assigned to the corresponding other zones different from the first and second zones in the same manner as for the first and second zones second zones. In the methods of the second aspect, assigning system resources to a zone may further include assigning corresponding access rights to system resources to that zone.

A third general aspect of the present disclosure relates to a computer program that contains instructions that, when executed by a computing system, cause the computing system to execute a computer-implemented method in accordance with the present disclosure.

The present disclosure further relates to a computer-readable medium (e.g., a DVD or solid-state memory) that contains a computer program of the third general aspect.

The present disclosure further relates to a signal (e.g., an electromagnetic signal according to a wireless or wired communication protocol) that a computer program of the third general aspect encodes.

Claims (15)

Computer system (100) for providing a plurality of functions for a device, in particular for a vehicle, the computer system having a plurality of system modules (30-35), a plurality of system resources (60-63) and a security module (10), wherein the plurality of system modules is configured to provide functions for the device, wherein a first number of system modules (30, 31) and / or parts of system modules of the plurality of system modules of a first zone (20) from a plurality of zones (20-23 ) is assigned, wherein a second number of system modules (32) and / or parts of system modules of the plurality of system modules are assigned to a second zone (21) from the plurality of zones, a zone being a logically and / or physically delimitable unit in the Computer system, wherein the first zone (20) is assigned a first number of system resources (60-62) from the plurality of system resources (60-63), the second zone (21) being assigned a second number of system resources (62, 63) from the plurality of system resources (60-63), the security module (10) being designed to detect violations of regulations regarding the allocation of the first number of system resources (60-62) to the plurality of system resources for the first zone (20 ) and against regulations about to recognize the assignment of the second number of system resources (62, 63) to the plurality of system resources for the second zone (21). computer system Claim 1 , where the first zone (20) is more trustworthy than the second (21), less trustworthy zone, with the risk of manipulation of a more trustworthy zone being lower than a less trustworthy zone. computer system Claim 1 or 2 , wherein the functions provided by the system modules are differently critical for the operational safety of the device, a first more critical function of the plurality of functions being provided by a system module (30, 31) of the first zone (20) and a second less critical function of the plurality of functions is provided by a system module (32) of the second zone (21). Computer system according to one of the present Claims 1 until 3 , wherein the zones from the plurality of zones are assigned corresponding access rights to system resources, the second zone being assigned fewer access rights to the second number of system resources than the first zone to the first number of system resources. computer system Claim 4 , wherein the access rights include permitted read, write, execute access, or any combination thereof, of a zone to a corresponding system resource, optionally wherein one or more access rights assigned to a zone remain unchanged over time or change over time. computer system Claim 4 or 5 , wherein access for a zone to a system resource is classified as permitted if a predetermined criterion is met, and access for the same zone to the system resource is classified as prohibited if the predetermined criterion is not met, the predetermined criterion being one or includes several of the following criteria: a predetermined criterion relating to contextual information of the device and/or a plurality of devices; an expected number of messages sent by a zone in a predetermined period of time is less than or equal to a predetermined value; which data is sent from the zone in a predetermined order and/or whether the data sent contains a range. Computer system according to one of the present Claims 4 until 6 , where a violation of regulations regarding an associated system resource for a zone corresponds to unauthorized access by that zone to a system resource for which the corresponding zone has no access right assigned. Computer system according to one of the present Claims 1 until 7 , wherein the security module (10) is assigned to the first zone (20) of the plurality of zones, or to another zone (23) of the plurality of zones that is more trustworthy than the first zone, or to the most trustworthy zone (23) of the plurality of zones is. Computer system according to one of the present Claims 1 until 8th , wherein the security module is configured to: collect information about accesses from one or more zones of the plurality of zones to system resources, this information being provided to the security module by the respective zones; compare the information about accesses of the one or more zones to system resources with information regarding rules on the allocation of system resources for these zones; and Based on the comparison result, determine whether violations of system resource allocation regulations have occurred for the one or more zones. Computer system according to one of the present Claims 1 until 9 , wherein the security module or another module with which the security module is in communication connection is configured to trigger a reaction in a manipulated zone in order to mitigate the effects of manipulation by an external intervention on the computer system, the manipulated zone being a zone for which violations of rules governing the allocation of system resources associated with that zone have been detected, the response comprising initiating a countermeasure against the detected violations within the compromised zone. Computer system according to one of the present Claims 1 until 10 , wherein the security module or the other module with which the security module is in communication connection is configured to trigger a reaction in a non-tampered zone to mitigate the effects of manipulation by an external intervention on the computer system, wherein the reaction initiates a countermeasure in the non- manipulated zone as a result of detected violations in the manipulated zone. Computer system according to one of the present Claims 1 until 11 , wherein one or more system modules of the plurality of system modules are configured to query the security module 10 for information about the detected violations in one or more manipulated zones or for other relevant information; wherein the security module is configured to provide this information to the one or more system modules; and wherein each of the one or more system modules of the plurality of system modules is further configured to: identify from the detected violation information whether violations of system resource allocation regulations have occurred for one or more zones of the plurality of zones; and trigger a response in a corresponding zone to which that system module is associated when violations of system resource allocation rules have been identified for at least one of the plurality of zones. Computer-implemented method for providing a plurality of functions for a device, in particular for a vehicle, through a computer system (100), the method comprising the following steps: Enforcing (200) zone separation in the computer system (100); Providing (300) the plurality of functions for the device, in particular for the vehicle; and Detecting (400) violations of regulations via an allocation of system resources assigned to at least two zones from a plurality of zones (20-23). Computer-implemented method Claim 13 , wherein enforcing (200) the zone separation in the computer system further comprising: assigning (210) a first number of system modules (30, 31) and / or parts of system modules of a plurality of system modules to a first zone (20) of the at least two zones (20-23); assigning (220) a first number of system resources (60-62) from a plurality of system resources (60-63) to the first zone (20); Assigning (230) a second number of system modules (32) and/or parts of system modules of the plurality of system modules to a second zone (21) of the at least two zones (20-23); Allocating (240) a second number of system resources (62, 63) from the plurality of system resources (60-63) to the second zone (22). Computer program that contains instructions that, when executed by a computing system, cause the computing system to follow the computer-implemented procedures Claim 13 or 14 to carry out.

Images