Method and Device for Monitoring an Unauthorized Memory Access of a Computing Device, in Particular in a motor Vehicle

• US 20080178292A1
• Filed: 12/20/2007
• Published: 07/24/2008
• Est. Priority Date: 06/23/2005
• Status: Active Grant

• Current Assignee: Bayerische Motoren Werke AG
• Original Assignee: Bayerische Motoren Werke AG
• Inventors: SCHROEDER, Astrid, STAUNER, Thomas, THIEDE, Martin E.
• Granted Patent: US 9,286,244 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 11/073 in a memory management context, e.g. virtual memory or cache management memory management G06F12/00; testing of static memory units G11C29/00
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 12/1441 for a range

Abstract

A method and a device for monitoring an unauthorized memory access to a predetermined memory area in a computing device are described, in which a monitoring medium is provided, having at least one sensor medium, which is set up for the purpose of recognizing an event of the computing device, and at least one recognition medium, which is set up for the purpose of tracking the behavior of the event recognized by the sensor medium, the monitoring medium being integrated into a sequence pattern on the computing device, and the monitoring medium being set up for the purpose of monitoring the sequence pattern at its runtime, in that memory accesses to a memory address or an address range are detected by the monitoring medium as events.

Claims

1. A method for monitoring an unauthorized memory access to a predetermined memory area in a computing device, comprising the acts of:

providing a sequence pattern in the computing device;

providing a monitoring medium, having at least one sensor medium which is adapted to recognize an event of the computing device, and at least one recognition medium, adapted to track a behavior of the event recognized by the sensor medium;

integrating the monitoring medium in the sequence pattern; and

monitoring the sequence pattern at its runtime, and detecting by the monitoring medium, as the event, memory accesses to one of a memory address and an address range.

2. The method according to claim 1, wherein the step of generating the monitoring medium further comprises establishing a specified behavior of the sequence pattern having at least one event, and states and state changes assigned to the at least one event, and converting the specified behavior into a program code.

3. The method according to claim 2, wherein the step of generating the monitoring medium further comprises establishing at least one of authorized and unauthorized address ranges of a memory, recognizing behavior deviating from the specified behavior if the sequence pattern attempts to access an unauthorized address range.

4. The method according to claim 2, further comprising automatically generating the monitoring medium, and in particular the conversion into the program code.

5. The method according to claim 1, wherein the step of integrating the monitoring medium into the sequence pattern further comprises introducing the program code into a sequence pattern program code.

6. The method according to claim 1, further comprising monitoring as an event an access to a memory area attempted by the sequence pattern, a check being performed by the monitoring medium whether the memory access occurs in one of an unauthorized and an authorized memory area, and when access is to an unauthorized area, at least one of a denial of the memory access, a call of an error handling routine, and signaling of the unauthorized memory access is performed by the sequence pattern as a reaction.

7. The method according to claim 1, further comprising performing a function call in the sequence pattern program code in that in the event of the detection of an event by the monitoring medium.

8. The method according to claim 1, further comprising providing the monitoring medium in one selected computer of multiple computers, the selected computer of the multiple computers of the computing device being monitored for its sequence pattern.

9. The method according to claim 1, further comprising providing the monitoring medium in at least two selected computers of multiple computers, a memory accesses between the selected computers of the computing device being monitored.

17. The method according to claim 1, wherein the computing device comprises a motor vehicle computing device.

10. A device for monitoring an unauthorized memory access to a predetermined memory area in a computing device in which a monitoring medium is provided, comprising:

at least one sensor medium adapted for recognizing an event of the computing device; and

at least one recognition medium adapted for tracking the behavior of the event recognized by the sensor medium,

wherein the monitoring medium is integrated into a sequence pattern on the computing device, and the monitoring medium is adapted to monitor the sequence pattern at its runtime, and wherein memory accesses to a memory address or an address range are detected by the monitoring medium as the event.

11. The device according to claim 10, wherein the computing device further comprises multiple computers coupled to one another, the monitoring medium being situated in at least one of the multiple computers.

12. The device according to claim 10, wherein the computing device comprises a bus system of a motor vehicle, and the computers comprise bus users of the bus system, which are coupled to one another via a bus line allowing exchange of messages.

13. The device according to claim 10, wherein the monitoring medium represents a computer program product which is integrated into the sequence pattern.

14. The device according to claim 10, wherein the monitoring unit is adapted to monitor at least one of the computers of the computing device.

15. The device according to claim 10, wherein the monitoring medium is adapted to monitor memory accesses between at least two computers of the computing device.

18. The device according to claim 10, wherein the computing device comprises a motor vehicle computing device.

16. A computer program product for a computing device of a motor vehicle, comprising:

a monitoring medium integrated into a sequence pattern for controlling the computing device; and

a computer-readable specification of the behavior of the sequence pattern, being set up for the establishing memory accesses at the runtime of the sequence pattern and initiating a reaction thereto if there is a memory access to an unauthorized memory area of a memory device of the computing device.