Classifications

• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B60—VEHICLES IN GENERAL
  • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
  • B60R99/00—Subject matter not provided for in other groups of this subclass
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
  • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
  • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode

Definitions

• Vehicle unit and method for operating the vehicle unit are Vehicle unit and method for operating the vehicle unit
• the invention relates to a vehicle unit for controlling vehicle functions, such as a central driving ⁇ imaging control unit, a multimedia-vehicle unit or the ⁇ same, and a method for operating this vehicle unit.
• vehicle unit includes, as usual, to a micropro cessor ⁇ with an attached memory, is implemented on the microprocessor, a main operating system, which is also referred to as Main Operating System OS.
• main operating system forms the interface of the hardware of the vehicle control unit to application programs (applications) implemented in the main system and / or optionally additionally implemented on the microprocessor, and user interactions via a user interface (user interface).
• Such electronic vehicle units are increasingly used in vehicles, in which application programs are installed on the vehicle units, the components connected by Hardwarekompo-technikeinga ⁇ ben or to the vehicle unit, or both can be controlled.
• Such open systems lead with some probability cause the Hauptbe ⁇ operating system and / or application programs on the vehicle ⁇ unit no longer function under certain conditions, for example due to errors in describing the connected in-vehicle unit memory.
• Such problems can arise with too many rollback memory accesses to previous memory entries or programs' addition or deletion actions.
• a Neuinstallati ⁇ on the main operating system and, where appropriate, the application programs is necessary.
• the object of the present invention is to reduce the number of cases in which the repair Construction and sending the vehicle unit described above must be performed on a re ⁇ paraturservice.
• the microprocessor is constructed in a microkernel architecture with separate partitions for a main operating system unit, a crypto unit and a supervision unit, wherein in the main operating system unit Hauptbe ⁇ operating system and, optionally, application programs incorporated ⁇ directed are, in the CRYPTO unit software certificates are ge ⁇ stores and a verification program is adapted to validation of certificates and software packages, and wherein in the supervision unit a monitoring program for monitoring the functions of the other partitions the microkernel architecture is provided.
• the separate partitions with the programs set up on them operate independently of each other, the supervisory unit monitoring program monitoring the functions of the other partitions and preferably initiating a repair operation upon detection of an error, for example rewriting the failed partition in the microkernel architecture.
• Flash serves to repair the system by returning it to the system's most recent stable state.
• the microkernel architecture With separate partitions, it is therefore possible in the invention to use the Super Vision unit even if the main ⁇ operating system unit is faulty, so that by the Supervision unit repair of the entire system suc ⁇ gen, which had to be done conventionally by connecting a corresponding repair system at a repair service.
• the monitoring program of the supervision unit can be realized, for example, as a kind of watchdog function, in particular for the main operating system unit.
• the entire microkernel architecture is preferably implemented on exactly one microprocessor, on which all units of the various partitions are set up and on which all the functions assigned to the various units run by implementation of suitable programs.
• the partition can be set up with the Haupt horrssys ⁇ tem unit to by an end user, examples example by a download and install new applications and / or firmware programs, be changeable.
• Firmware programs can also include new Versio ⁇ nen of the main operating system in particular. It is possible according to both updates in ⁇ stalling and the partition completely re-writing ⁇ ben (Flashing), the main operating system is reinstalled in the vehicle unit. This represents a possible ⁇ ability to put the vehicle unit in a functional error again in a functional condition.
• further partitions of the microkernel architecture in the microprocessor can be set up to be unchangeable by the end user. This may preferably concern all further partitions of the microkernel architecture, but in particular the crypto unit and the Supervision unit or the respective Partitio ⁇ nen with the crypto unit and the supervision unit.
• the crypto unit can be set up to decrypt and / or check packages of software to be installed in the vehicle unit in the check program.
• US 2009/0217136 Al already describes a memory device with a flash memory module and a controller contained in the memory device, which has its own microprocessor with an error correction module which is used in the storage or reading of data from the flash memory module performs a packetwise correction.
• this 2009/0217136 proposes US AI an intrinsically ⁇ permanent microprocessor before, which is firmly associated with the memory unit, the memory unit may even be connected to a host computer system.
• a realization of this function in the context of a microkernel architecture offers the advantage that a single microprocessor can be used, since the crypto unit according to the invention is also one of the microkernel architectures externally unchangeable partition is designed, which is here ⁇ secured against unwanted or deliberate manipulation and works particularly reliable in the context of the decryption and review of the main operating system and / or application software. In the context of this proposed architecture, it is not necessary to provide a separate processor and controller for this purpose.
• the invention particularly important supervision unit is set up to initiate a recovery process for the partitions with the main operating system with the monitoring ⁇ program in case of failure in the main operating system.
• the vehicle operating unit can thereby be operated particularly safely and reliably.
• the basic version of a functioning main operating system with the essential application programs for example in the form of an image (image) can be stored in the flash memory connected to the vehicle ⁇ unit, which as a backup image of the partition of the main operating system by the supervision unit to ⁇ is written back.
• the vehicle unit may be an interface for an ex- Have ternes storage medium, which is also controlled by the super vision unit.
• This interface can be, for example, a USB interface, an interface for plugging in a Secure Digital Card (SD card), another data card or the like.
• SD card Secure Digital Card
• the super-vision unit or the implemented therein monitoring program on an emergency operating system which is adapted to drive necessary user interface such as a display, an input unit, and the like, as well as interfaces for an external storage medium and to execute the Reset factory ⁇ averaging method.
• the micro-kernel architecture can (Kernel separation) may be formed with a separate partition for a policy unit as a so-called separation kernel, wherein the policy unit is as ⁇ to set up the communication between the individual partitions of the microkernel architecture be monitored and, if necessary, controlled.
• the policy unit is as ⁇ to set up the communication between the individual partitions of the microkernel architecture be monitored and, if necessary, controlled.
• the vehicle unit or the respective units of the various partitions of the microkernel architecture According to the invention set thereof for carrying out the following be written ⁇ method for operating the vehicle unit, or parts thereof.
• the method is suitable Operator Op ⁇ ben a vehicle unit comprising a microprocessor on WEL ehern the prescribed microkernel architecture is fitted with the separate partitions for a main operating system unit, egg ⁇ ne crypto unit, and a Supvervisions unit.
• the main operating system unit according to the invention, the main operating system and optionally application programs are set up. These can be changed by the user.
• software certificates are stored and set up a verification program for checking certificates and complete software packages.
• the invention provides in the microkernel architecture, and by the monitoring program of a supervision unit drive the main operating system and optionally EXISTING ⁇ dene application software during startup and / or the loading of the Main operating system or the vehicle ⁇ unit monitors and in case of deviations from a predetermined behavior, a recovery process for the main operating system is initiated.
• the vehicle unit can be restarted in a failure and restored to an operational state, without a removal of the vehicle unit and rewriting the memory connected to the microprocessor for re-implementation of the main operating system software and the application programs are necessary.
• a particularly advantageous embodiment of the method according to the invention is to detect deviations during startup and / or operation of the main operating ⁇ system a typical start time for a user interface (Human Machine Interface - HMI), which claimed by the Hauptbe ⁇ operating system computing time of the microprocessor and / or the storage claimed by the main operating system. For example, by comparing with predetermined limits for a normal operation monitored.
• Such data can be easily monitored by the monitoring program in a kind of watchdog function, for example, by simulating a response of the user interface and till ⁇ queries and the operation of the microprocessor and the memory ⁇ place are monitored. This is possible under an inde ⁇ -ended process in the Super Vision unit easily without any errors in the partition of
• Main operating system unit affect this function.
• the recovery process is started may preferably be in the context of this recovery process, the Partiti ⁇ on the main operating system unit completely bringsschal ⁇ tet and discharged from the microkernel architecture.
• the emergency operating system of the Su ⁇ pervisions unit then takes over the control of the user interface and / or an interface for the external storage medium to indicate the failure of the vehicle unit and a new implement the main operating system unit in the ent ⁇ speaking partition the micro-kernel To be able to carry out architecture.
• the recovery process of the invention can be automated and / or Runaway ⁇ leading user-controlled. A particularly fast, automatic re ⁇ production of the defective partition can then be achieved if in the inventive method a writeback in the vehicle unit, for example, on the
• Microprocessor connected memory stored backup images of the partition of the main operating system is done. After writing back such a backup image, the vehicle unit can be restarted, with the restart running the newly installed main operating system.
• a serial number, a version identification ⁇ number or the like to be output to the user, to the user to select the appropriate main operating system, that is ei ⁇ ner appropriate firmware to allow a manufacturer's site in the Internet.
• a serial number, a version identification ⁇ number or the like to be output to the user, to the user to select the appropriate main operating system, that is ei ⁇ ner appropriate firmware to allow a manufacturer's site in the Internet.
• information can also be a suitable Internet link, particularly in the form of an html file that is output on the external Spei ⁇ chermedium that can be called ⁇ when connected to another computer system with an Internet connection directly up and download the appropriate main operating system.
• the html file optionally with yes ⁇ vaScript shares, checks the size of the storage medium and stores an image file and / or an update file of the main operating system to be installed in a suitable directory.
• an error reduction is achieved because a faulty installation of a wrong operating ⁇ system is avoided from the outset, without the installed in the vehicle unit crypto unit would have to grasp ⁇ accordingly.
• a certifi cate ⁇ can be used here.
• a check is carried out by the crypto unit.
• serial number, hardware version, integrity, certificate or the like can be checked and, if necessary, a decryption can be carried out.
• the presence checks an external storage medium to the image file and / or the update file and their in ⁇ stallation starts at presence immediately. Otherwise, the presence of the external memory is not checked. This also ensures that an update with the same software version does not occur several times, which can sometimes lead to an unstable system. After a successful reinstallation of the main operating system, also called flashing, then in the normal and usual way faster start mode is switched again.
• main operating system also called flashing
• the present invention also relates to a computer program product with program code means for setting up in a computer unit, which computer program product is characterized in that by the program code means when executing the computer program a microkernel architecture according to one of claims 1 to 6 and / or a method according to one of claims 7 to 12 is set up in the microprocessor of the vehicle unit.
• FIG. 1 shows schematically the structure of a device according to the invention.
• FIG. 2 shows a schematic sequence for operating a vehicle unit according to the present invention.
• Fig. 1 the system partitioning of a memory connected to the microprocessor is shown on the the memory accesses the sequence of various programs in the partitions.
• This partition is formed as a Separati ⁇ onskernel, which is a special variant of a microkernel architecture.
• the various partitions 1, 2, 3, 4 implemented for the main operating system unit, the super-vision unit, the policy unit and the crypto unit in the same Mik ⁇ roratior with an attached memory, the different partitions run independently on the microprocessor and can also be executed in parallel.
• the main operating system of the vehicle unit is installed, which can be changed by the end user, for example by downloading and installing new application programs or new Kleinbe ⁇ operating system software versions.
• the partition 4 with the crypto unit is responsible for storing and validating certificates and checking the certificates of application software or complete software packages. All software certificates are installed inside Par ⁇ titionen 4 with the crypto unit without the other partitions 1, 2, 3 access to the partition 4 ben ha-. As a result, the security is increased according to the invention, because the crypto unit can not be changed by the user.
• Partition 2 with the supervision unit for example, monitors the others with watchdog-like mechanisms
• Partitions 1, 3, 4, and in particular the partition 1 with the main operating system unit which is responsible for the proper functioning of the vehicle unit.
• This unit is so inventively responsible for detecting a non-function-onsstoryen main operating system and the introduction of a car ⁇ matic or user-interactive recovery process.
• the partition 3 with the policy unit is a standard unit of a separation kernel and monitors rackingswei ⁇ se controls the communication between the different partitions 1, 2, 4. For example, checks whether a partition A send a message M to a partition B may.
• the policy unit controls the access rights to physical volumes or flash partitions, and changes the budgets for processor power allocation to individual processes or storage space.
• An essential concept of the present invention is now outsource responsible for the monitoring and restore the entire vehicle unit program code from the par ⁇ tition 1 with the main operating system unit in the partition 2 with the Supervision unit, said Par ⁇ tition 2 by the microkernel architecture is protected from interference or access from partition 1 while still running on the same microprocessor.
• This function allows the monitoring function of a this usually provided external Mikrokon- is troller in the partition 2 of the Supervision Unit übertra ⁇ gen cooperating within the framework of their duties with the policy unit and the crypto unit.
• the supervision unit, the crypto unit and the policy unit can replace the three different partitions 2 3 and 4 are also combined in a common partition, which according to the invention, however, differs from the partition 1 of the main operating system unit.
• the partition 1 of the main operating system unit differs from the partition 1 of the main operating system unit.
• a monitoring program runs in the super vision unit of the partition 2 in order to detect faults in the main operating system.
• the Supervision Unit monitors the start of the main operation ⁇ system with regard to some detail functions. These detailed functions include important service functions and states of the main operating system.
• HMI man-machine interface
• angesteu ⁇ ert from the main operating system.
• the function of the human-machine interface is checked by the supervision unit, for example by means of a fictitious input. If the man-machine interface after starting the vehicle unit after is not operational for a given time, this can be considered a failure of the main operating system.
• the partition 1 of the main operating system can be regarded as faulty if an extraordinary loading ⁇ the processing power of the processor or an exceptional storage space requirement is determined. Excessive network traffic between the individual partitions of the separation kernel can also be seen as a characteristic of a faulty main operating system.
• Main OS unit is completely powered off and unloaded from the microkernel architecture.
• the a supervision unit then takes over under an emergency operating system, the remaining functions of the vehicle unit to which in particular also the response of the spot man-machine interface ⁇ belongs.
• the supervision unit issues an error message to the end user via a screen of the human-machine interface.
• An Internet link in particular an https link, with some details such as the serial number or a version identification number is output on the same screen on which the error message is displayed, so that the end user receives an up-to-date software package for the main operating system and / or the he requires application soft ⁇ ware can be downloaded from the Internet from a service side of the manufacturer of the vehicle unit.
• the software download can be done by a conventional PC and on an external storage means, such as a USB memory stick done.
• the supervision unit activates in the Emergency operating system the needed driver for external
• the emergency operating system detects such an external storage means to egg ner interface, for example, when restarting the vehicle unit, the file system is searched for ei ⁇ nem software update package. Once such Pa ⁇ ket is detected, the hash value of the packet calculation ⁇ net, a signature is read and read the Locks ⁇ doubted software version and hardware compatibility of the package of the storage device and the partition 4 with the Crypto unit sent.
• the crypto unit ⁇ checks the contents of the software package and gives the moni ⁇ toring unit feedback whether the software package for the present hardware is permitted. Furthermore, the Cryptoworks to-package can decrypt the software packets and provide for in ⁇ stallation.
• the supervision unit performs a complete check on the blocks of the flash partitions used for the main operating system. Then it starts a reinstallation of the flash partition with the main operating system (flashing). After a successful installation in the partition 1, the main operating system unit, the vehicle starts generating unit at the next start with the new Radiosys ⁇ tem. In addition to error handling, they can also import targeted updates in this way, which can be triggered, for example, by a user input in the main operating system.
• the super ⁇ visions unit chert a Launching an online link storage offered on a Schlos ⁇ Senen to the Vehicle Unit memory device in which already necessary information to Identifika ⁇ tion of the appropriate and required software are included. In this way, error entries are avoided.
• a user-controllable method for operating the vehicle unit can be carried out, which allows the unit to be restored in the event of a software error without it having to be removed and sent to a special service point.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Physics & Mathematics (AREA)
• Computer Hardware Design (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Mathematical Physics (AREA)
• Computer Security & Cryptography (AREA)
• Software Systems (AREA)
• Mechanical Engineering (AREA)
• Stored Programmes (AREA)
• Debugging And Monitoring (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=46331337

Family Applications (1)

Country Status (5)

Families Citing this family (16)

Citations (1)

Family Cites Families (8)

• 2011
  • 2011-06-30 DE DE102011106078A patent/DE102011106078A1/de not_active Ceased
• 2012
  • 2012-06-25 CN CN201280032791.5A patent/CN103688268B/zh active Active
  • 2012-06-25 EP EP12729145.8A patent/EP2727039A1/de not_active Ceased
  • 2012-06-25 US US14/129,018 patent/US9205809B2/en active Active
  • 2012-06-25 WO PCT/EP2012/062203 patent/WO2013000854A1/de active Application Filing

Patent Citations (1)

Non-Patent Citations (2)

Also Published As

Similar Documents

Legal Events