METHODS AND SYSTEMS FOR VALIDATING AN AUTONOMOUS SYSTEM THAT INCLUDES A DYNAMIC-CODE MODULE AND A STATIC-CODE MODULE

• US 20170169208A1
• Filed: 12/15/2015
• Published: 06/15/2017
• Est. Priority Date: 12/15/2015
• Status: Active Grant

• Current Assignee: Nagravision SA (Kudelski SA)
• Original Assignee: Nagravision SA (Kudelski SA)
• Inventors: Jantz, Scott, Seltzer, Steven
• Granted Patent: US 10,073,965 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 3/045 Combinations of networks
• CPC Class Codes: G06N 5/01 Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

Disclosed herein are methods and systems for validating an autonomous system that comprises a static-code module and a dynamic-code module, the method including the steps of performing a code-integrity-validation process on the static-code module and performing a behavior-integrity-validation process on the dynamic-code module. In some embodiments, performing the code-integrity-validation process on the static-code module includes performing a signature-verification process on the static-code module. In some embodiments, performing the behavior-integrity-validation process on the dynamic-code module includes using an encrypted-and-signed test vector. In some embodiments, performing the behavior-integrity-validation process on the dynamic-code module includes selecting a test vector from among a plurality of test vectors, generating a modified test vector at least in part by modifying the selected test vector, and performing the behavior-integrity-validation process on the dynamic-code module using the modified test vector.

Claims

1. A method of validating an autonomous system that comprises a static-code module and a dynamic-code module, the method comprising:

performing a code-integrity-validation process on the static-code module; and

performing a behavior-integrity-validation process on the dynamic-code module.

2. The method of claim 1, wherein performing the code-integrity-validation process on the static-code module comprises:

performing a signature-verification process on the static-code module.

3. The method of claim 1, wherein performing the behavior-integrity-validation process on the dynamic-code module comprises:

performing the behavior-integrity-validation process on the dynamic-code module using an encrypted-and-signed test vector.

4. The method of claim 3, wherein performing the behavior-integrity-validation process on the dynamic-code module using the encrypted-and-signed test vector comprises:

generating an encrypted-and-verified test vector at least in part by verifying a signature of the encrypted-and-signed test vector;

generating a decrypted-and-verified test vector at least in part by decrypting the encrypted-and-verified test vector;

applying the decrypted-and-verified test vector to the dynamic-code module and receiving a corresponding actual output; and

checking whether the received actual output matches a range of stored acceptable outputs.

5. The method of claim 4, further comprising:

generating an encrypted-and-verified range of acceptable outputs at least in part by verifying a signature of an encrypted-and-signed expected output; and

generating the range of stored acceptable outputs at least in part by decrypting the encrypted-and-verified range of acceptable outputs.

6. The method of claim 5, further comprising:

receiving both the encrypted-and-signed test vector and the encrypted-and-signed range of acceptable outputs as part of a secure update.

7. The method of claim 1, further comprising:

determining that (i) the code-integrity-validation process on the static-code module returned a code-integrity-confirmed result and (ii) the behavior-integrity-validation process on the dynamic-code module returned a behavior-integrity-confirmed result, and responsively permitting continued autonomous operation of the autonomous system.

8. The method of claim 1, further comprising:

determining that one or both of the code-integrity-validation process on the static-code module and the behavior-integrity-validation process on the dynamic-code module returned an integrity-fail result, and responsively disabling autonomous operation of the autonomous system.

9. The method of claim 8, wherein the autonomous system comprises an autonomous driving vehicle, and wherein disabling autonomous operation of the autonomous system comprises continuing to permit manual driving of the autonomous driving vehicle.

10. The method of claim 8, wherein the autonomous system comprises an autonomous driving vehicle, and wherein disabling autonomous operation of the autonomous system comprises disabling all driving of the autonomous driving vehicle.

11. The method of claim 8, wherein disabling autonomous operation of the autonomous system comprises effecting a learning-system reset of the autonomous system.

12. The method of claim 1, wherein performing the behavior-integrity-validation process on the dynamic-code module comprises:

selecting a test vector from among a plurality of test vectors; and

performing the behavior-integrity-validation process on the dynamic-code module using the selected test vector.

13. The method of claim 12, wherein selecting the test vector comprises randomly selecting the test vector.

14. The method of claim 1, wherein performing the behavior-integrity-validation process on the dynamic-code module comprises:

selecting a test vector from among a plurality of test vectors;

generating a modified test vector at least in part by modifying the selected test vector; and

performing the behavior-integrity-validation process on the dynamic-code module using the modified test vector.

15. The method of claim 14, wherein performing the behavior-integrity-validation process on the dynamic-code module using the modified test vector comprises:

applying the modified test vector to the dynamic-code module and receiving a corresponding modified-test-vector actual result;

generating a modified range of acceptable results by modifying a stored range of acceptable results in accordance with the modified test vector; and

checking whether the received modified-test-vector actual result is within the modified range of acceptable results.

16. The method of claim 1, wherein the autonomous system comprises an autonomous vehicle;

and

the static-code module comprises a behavior arbiter that is configured to receive movement-vector-and-threat-level input and to produce corresponding driving-command output for the autonomous vehicle.

17. The method of claim 1, wherein:

the dynamic-code module comprises a neural network that is configured to receive 3D input data and to produce corresponding clustered-object output data; and

performing the behavior-integrity-validation process on the dynamic-code module comprises;

sending test-vector 3D-input data to the neural network and receiving corresponding clustered-object actual-output data; and

comparing the received clustered-object actual-output data with stored clustered-object expected-output data corresponding to the test-vector 3D-input data.

18. The method of claim 1, wherein:

the dynamic-code module comprises a classifier module that is configured to receive clustered-object data and to produce corresponding classified-object output data; and

performing the behavior-integrity-validation process on the dynamic-code module comprises;

sending test-vector clustered-object data to the classifier module and receiving corresponding classified-object actual-output data; and

comparing the received classified-object actual-output data with stored classified-object expected-output data corresponding to the test-vector clustered-object data.

19. The method of claim 1, wherein:

the dynamic-code module comprises a threat-assessment module that is configured to receive classified-object data and to produce a corresponding threat-matrix data; and

performing the behavior-integrity-validation process on the dynamic-code module comprises;

sending test-vector classified-object data to the threat-assessment module and receiving corresponding threat-matrix actual-output data; and

comparing the received threat-matrix actual-output data with stored threat-matrix expected-output data corresponding to the test-vector classified-object data.

20. A secure-processing module for validating an autonomous system that comprises a static-code module and a dynamic-code module, the secure-processing module configured to:

perform a code-integrity-validation process on the static-code module; and

perform a behavior-integrity-validation process on the dynamic-code module.