CN109076081B

CN109076081B - Method for monitoring the safety of a communication connection of a vehicle

Info

Publication number: CN109076081B
Application number: CN201780025765.2A
Authority: CN
Inventors: M.扎博克; M.沃尔多斯基; T.温克尔沃斯
Original assignee: Volkswagen AG
Current assignee: Volkswagen AG
Priority date: 2016-03-24
Filing date: 2017-02-23
Publication date: 2023-04-04
Anticipated expiration: 2037-02-23
Also published as: DE102016204999A1; WO2017162395A1; CN109076081A

Abstract

The invention relates to a method for monitoring the security of a communication connection (18) of a vehicle (12), wherein the vehicle (12) communicates via at least one mobile radio protocol and/or at least one internet protocol. The following steps are provided: establishing rules (26) for permitted communication via at least one mobile radio protocol and/or at least one internet protocol; monitoring for a rule violation against a rule in at least one mobile radio protocol and/or at least one internet protocol used by the vehicle (12); and triggering an action, such as creating a report (28) containing the determined rule violation and/or taking at least one action, when one or more rule violations are determined. The invention aims to further improve the safety of the communication connection of the vehicle.

Description

Method for monitoring the safety of a communication connection of a vehicle

Technical Field

The invention relates to a method for monitoring the safety of a communication connection of a vehicle, a vehicle having a communication connection, and a control device having at least one communication connection.

Background

Networking of vehicles is becoming increasingly important in the automotive industry. Modern vehicles are today heavily networked and, due to different sensors and entrances, offer a wide variety of possibilities to subject the internal systems of the car to malicious hacking. A central challenge is to distinguish normal and abnormal traffic from each other and thus track manipulations and attacks.

DE 10 2013 016 096 A1 discloses a method for displaying the current operating state of a motor vehicle, wherein image data of an outer region of the motor vehicle are generated and the motor vehicle requests parameter values from components of the motor vehicle, which are then displayed graphically.

DE 10 2011 076 A1 discloses a method for identifying an operation on at least one vehicle network within a vehicle based on a digital fingerprint of the vehicle network.

US 2014/0257624A1 discloses a monitoring of an electrical energy generation system of a vehicle, wherein data is retrieved from a node and fed to a reporting system.

Disclosure of Invention

The object of the invention is to further improve the security of the communication link of the vehicle.

The above technical problem is solved by a method according to claim 1, a vehicle according to claim 9 and a control device according to claim 10.

The method according to the invention for monitoring the security of a communication connection of a vehicle comprises the following steps, wherein the vehicle communicates via at least one mobile radio protocol and/or at least one internet protocol:

-establishing rules for communication allowed by at least one mobile radio protocol and/or at least one internet protocol;

-monitoring for a rule violation against a rule in at least one mobile radio protocol and/or at least one internet protocol used by the vehicle; and

-triggering an action, e.g. upon determination of one or more rule violations, creating a report (28) containing the determined rule violations and/or taking at least one measure.

The method envisaged here is based on the idea of automatically evaluating network events and displaying their results in the vehicle or actively reacting in the event of a hazard. That is, before there is a hazard, not only can the driver be warned, but the driver can also be actively protected from the effect. In principle, two indices are used and compensated for each other. One index relates to events or rule violations, while another index relates to actions to be triggered, e.g., creating reports or taking measures, e.g., intensive observations and/or restricting communication connections. It is proposed, on the one hand, to classify possible events according to severity. Known methods in the vehicle technology and IT can be used for this purpose. On the other hand, the possible actions are also ordered according to the severity of their intervention. An action is triggered appropriately for the determined event.

The method according to the invention has the following advantages: the driver is given information about the safety status of his vehicle. If a problem is displayed in the report or status, measures are taken on the network side so that the customer can obtain the effect of the measures in the same report. The reduction of the functions on the network side does not affect the driving safety. Network disconnection and bandwidth fluctuations are everyday phenomena in mobile radio. This means that all online systems of the vehicle are developed so that all basic vehicle functions can continue to be used even in the event of a network outage. Due to these measures on the network side, it is possible for the manufacturer system to continue to access the vehicle. Thus, for example, diagnosis and intervention, for example, updating, can be continued. Thus, safety accidents can be excluded specifically for a vehicle. Safety reports may be provided to (authorized) drivers at any time. One possible embodiment is that the vehicle always calls for a report or a report when the data connection is established. The infotainment unit may then indicate that a new message is present. This solution, which is implemented first on the network side, is significantly easier to implement than the introduction of new technical systems in vehicles. In addition, the safety of the existing vehicle can be improved. This method enables vehicle users and manufacturers to retrieve information about the safety status of the vehicle and thus get a status report about the attack that occurred and its effects. These situation information forms the basis for taking countermeasures.

It may be provided that the report is displayed to the driver at least temporarily in the vehicle. Thus, the driver can be directly informed of the safety situation of his vehicle. An easy-to-read display, for example in the form of a signal light, can be selected. It may be arranged that the duration of the report display is related to the severity of the rule violation. Thus, a slight rule violation may be displayed, for example, as a short pop-up window. Detailed reports can then be recalled as needed.

It may further be arranged to create a report in the backend. The backend is here constituted by an IT infrastructure accessible via a network connection, providing services in respect of the network connection. This has the following advantages: no hardware need be provided in the vehicle or the hardware present may be used for other tasks. There is computing power in the back-end or the computing power is made more simple to use. Furthermore, it is simpler in the backend to communicate with a plurality of vehicles and a plurality of network components in different networks or protocols.

Furthermore, it may be provided that the reports of a plurality of vehicles are combined into a data set. In this way, a vehicle manufacturer, fleet operator, or service provider may obtain an overview of the entire fleet and, for example, check and evaluate rule violations or the distribution or severity of problems or attacks based on the rule violations. Therefore, the countermeasure can be performed more quickly and more specifically.

Based on the determined number of rule violations and/or security risks, intensive observations can be made and/or network capabilities of the vehicle can be at least temporarily limited. Thus, for example, address ranges or protocols may be blocked or restricted to minimize or prevent security risks. Limiting network capabilities may be performed in steps. The restriction may range from restricting the connection until disconnecting or deactivating various components of the communication connection, such as a smart phone or a SIM card. This enables targeted protection while maintaining as many functions as possible. Furthermore, it can be provided that less severe events trigger intensive observations first, before measures are taken. This enables better discrimination between errors and erroneous estimates ("false positives") and true attacks.

Monitoring for rule violations may be performed at a network interface of the vehicle. Thus, for example, incoming and outgoing communications can be observed directly on the vehicle. This enables a very fast reaction to rule violations.

The monitoring of the rule violation may be performed at a network component of a network implementing at least one mobile radio protocol and/or at least one internet protocol. These network components may be destination points or end points of the communication of the vehicle, or intermediate points or relay stations of the communication path. Monitoring rule violations inside the network may be simpler because there is often infrastructure required. Thus, independence from the hardware, software and model of the vehicle is obtained.

The convergence and/or trustworthiness of the rule violation may be checked at different network components. In this case, the different data sources can compensate for each other, in order thus to obtain a more accurate estimate of the situation and to be able to test the trustworthiness of the data.

It may be provided that a rule violation of the communication inside the vehicle is monitored. In this way, not only communication with external partners can be monitored, but also communication with internal partners, for example control devices, which further increases the security. The results of the monitoring of the vehicle interior may also be included in the report.

The vehicle according to the invention, which has a communication connection for at least one mobile radio protocol and/or at least one internet protocol, is configured to carry out the method described above for monitoring the security of the communication connection. The same advantages and modifications as described above apply. The vehicle may have a display device configured to display a report containing the determined rule violation. The display device may be an already existing unit, for example an infotainment system, which enables simple implementation in a vehicle. It may be provided that a communication network within the vehicle is present and a monitoring unit is provided, which is configured to monitor whether a communication within the vehicle violates a rule in the communication network within the vehicle. The communication Network within the vehicle CAN be a bus system, for example a CAN bus (Controller Area Network) or a local data Network, for example an ethernet Network. For example, the rear end can be informed of safety-relevant events by the control device, and the report or safety report can be expanded with diagnostic information from the vehicle system. Additional monitoring of the vehicle interior may further improve safety.

The control device according to the invention having at least one communication connection is configured to carry out the previously described method for monitoring the security of a communication connection. The same advantages and modifications as described above apply. The control device may be a stand-alone control device or the functionality may be integrated into an existing control device, e.g. for communication.

Further preferred embodiments of the invention result from the further features mentioned in the dependent claims.

The different embodiments of the invention mentioned in the present application can advantageously be combined with each other, unless stated otherwise in individual cases.

Drawings

The invention is explained below in an embodiment with the aid of the drawing.

Fig. 1 shows a schematic diagram of a system for monitoring the safety of a communication connection of a vehicle.

Detailed Description

FIG. 1 illustrates a system 10 for monitoring the security of communications of a vehicle 12. A schematic illustration of a vehicle 12, here in the form of a sedan, is shown. Land vehicles, such as trucks, buses, motorcycles, rail vehicles, as well as aircraft and ships, are furthermore considered as vehicles.

The vehicle 12 includes an interface 14 for communicating with a mobile radio network 16, which is compatible with one or more standards, such as UMTS, GSM, and/or protocols. The protocol is for example referred to as hierarchy (Strata) in UMTS and can be divided into protocol layers relating to radio access and special protocol layers relating to service and participant management in the core network. One or more communication connections 18 may be established through the interface 14 that enable the vehicle 12 to communicate with external partners. The interface 14 and, if appropriate, further components of the vehicle, for example, a corresponding control unit, are components of the communication link 18 or of at least one communication link 18.

The communication connection 18 often uses the mobile radio network 16 as a carrier, wherein external communication partners, for example a server 20, are arranged in a computer network 22. The computer network 22 and the mobile radio network 16 are correspondingly connected to each other. In turn, multiple protocols, such as ethernet, may be active in the computer network 22. The communication connection 18 may extend, for example, from the interface 14 of the vehicle 12 through the mobile radio network 16 and the computer network 22 to the server 20. The communication connection 18 may be unidirectional or bidirectional.

Multiple protocols are used for each network. By observing a plurality of protocols in different networks, an accurate analysis can be carried out by checking the convergence and/or the plausibility. Typically, one or more rule violations in one, more or all of the protocols used by the communication connection 18 are monitored or processed. The protocol monitored or processed here may extend over one, more or all networks used by the communication connection 18.

The monitoring unit 24 monitors the communication allowed according to the rule or rule set 26 via at least one mobile radio protocol and/or at least one internet protocol. When one or more rule violations are determined, the monitoring unit 24 creates a report 28. The report 28 contains the determined rule violation. The report or the display of the report or the filtering content may be adjusted according to the number and/or severity of the rule violations.

The monitoring unit 24 may be arranged in the back end 30. The back end 30 may be an integral part or participant of the computer network 22. The monitoring unit 24 may also be disposed in the vehicle 12. Further, the monitoring unit 24 may be configured to be distributed over a plurality of units. For example, the monitoring unit 24 may also monitor the communication network 32 inside the vehicle. This can be done via the interface 14 with the mobile radio network 16 or via a further interface 34, for example, specific to the manufacturer.

The monitoring of rule violations against the rules 26 in the mobile radio protocol and/or internet protocol used by the vehicle 12, and the creation of a report 28 containing the determined rule violations when one or more rule violations are determined, are described in detail below.

The solution described here is based on the following idea: rule-based observations of the

networks

16, 22 located in the vehicle 12 result in defined actions, such as creating reports 28 and/or taking actions, when abnormal. By recording network events for safety analysis, the impact of part of a safety accident, which may have a significant impact, on the driver and the vehicle can be significantly reduced. By networking of vehicles, a wide variety of processing possibilities are available.

Here, the preconditions for taking action are: the communication behaviour of the networked vehicles is checked not only at the level of the mobile radio protocol, but also for rule violations, for the protocols of the computer network. It should be noted here that such detection may be done such that only rule violations are detected to comply with applicable data protection conditions. This can be shown for example with DNS resolution. The networked vehicle 12 invokes a network address (URL) for the service. Because the service being released for the vehicle 12 is now known, the network 22 can identify when an anomalous address has been invoked from the vehicle 12. This type of invocation triggers the corresponding action. The (authorized) vehicle user can now recognize the presence of the rule violation via a display in the vehicle 12. Alternatively, the measures taken and their influence can also be displayed for the driver.

The display compresses the detected rule violations into easily identifiable categories, such as signal light colors, and provides detailed security reports as needed. The report is generated by a network element operating outside of the vehicle 12, such as the monitoring unit 24. That is, only the system for displaying the report 28, such as a browser in an infotainment component, is located in the vehicle 12. The report 28 may be communicated to the vehicle 12 via the interface 14 with the mobile radio network 16 or via a further interface 34.

The following list contains examples of monitoring rules 26 that are not followed in the

networks

16 and 22.

Rules are conceivable in the computer network 22, for example using impermissible network protocols, for example enabling HTTP protocols, disabling HTTP and/or FTP. As a rule, calls to unreleased URLs/addresses may be monitored. As a rule, the limitation of the Message type may be implemented in a Protocol, for example, ICMP (Internet Control Message Protocol).

In the Mobile radio network 20, as rules to be monitored, it is possible, for example, to implement a combination of attempting to establish a connection with a number that is not allowed, sending/receiving an SMS to/from an unauthorized participant and/or changing the IMEI (International Mobile Station Equipment Identity), checking the location of the vehicle 12 (e.g. leaving the EU) and the ICCID (Integrated Circuit Card Identifier), which indicates that the SIM Card is stolen.

The rule violation may be monitored and detected by different components of the

networks

16 and 22, such as an HLR (Home Location Register), an MSC (Mobile Switching Center), an SGSN (Serving GPRS Support Node) and/or a DNS (Domain Name System) server, firewall, gateway, server in the computer network 22 in the Mobile radio network 16.

Further, the monitoring unit 24 may send rules, rule sets, updates, etc. to the

networks

16 and 22 and components thereof. The

networks

16 and 22 feed back directly to the monitoring unit 24 or to a database that is also accessible to the monitoring unit 24.

Depending on the determined rule violation, an action is taken in the monitoring unit 24, such as creating a report 28 containing the determined rule violation and/or taking an action. The report is sent to the vehicle 12 for informing the driver and is displayed there at least temporarily to the driver. Further, reports 28 of multiple vehicles, such as a company's fleet, the same vehicle model, all vehicles of the manufacturer, or any query requesting vehicle, may be grouped and evaluated together to thereby derive information beyond a single vehicle regarding, for example, a threat condition. Such an evaluation may be implemented in the monitoring unit 24 or in a back-end of the manufacturer or service provider to which the report 28 or combined evaluation is sent.

In addition to creating the report 28, actions may be taken based on the results of the report. The solution proposed here provides different reactions to rule violations. The type of reaction is related to the severity of the rule violation. All reactions are technically triggered here by the network elements of the

networks

16 and 22 and not by the vehicle systems.

The simplest reaction is to collect additional network data for the vehicle 12. The evaluation of the network data forms the basis for determining whether a security incident exists. The evaluation is performed on the network element or in the monitoring unit 24. If there is a safety accident, the network capabilities of the vehicle 12 may be gradually limited. This is also used to reduce the impact on the driver and the vehicle and to limit the relevant vehicle.

The limitations may include, for example:

limiting the reachability (e.g. address range) of network resources;

-targeted switching off of individual services (combination of protocol and address);

-blocking all ongoing data connections;

separate client devices (e.g. smart phones, USB disks);

revoking the data tariff of the used SIM card (data connection is no longer possible);

permanently deactivate the SIM card (vehicle continuously off-line).

In the cascade of measures described above, the possible measures are classified according to the influence or severity of the intervention of the measure, with the simplest measure being the first. Such a cascade is here at least optionally arranged to interact with the number and/or relevance of the rule violations. Thus, for example, in the case of very relevant rule violations, the measures in the last stage of the cascade can be applied directly. In the case of slight or not completely clear rule violations, intensive observations can also be made first.

The described measures can be grouped in order to thus form a state that is easy for the user to interpret. Possible features

Or the Profile (Profile) may be: no problem, under observation, limited functionality, offline.

Thus, the user is always explicitly informed of the safety status of his vehicle, together with the signal light display for estimating the severity of the safety accident. The described measures are implemented as functions in the computation center or monitoring unit 24 and can therefore also be used in the course of customer service. This means that the network capacity of the vehicle 12 can therefore be limited according to customer requirements.

The described invention enables monitoring of communication with a vehicle by monitoring the protocol used for communication on a regular basis in a simple manner. Upon determining a rule violation, an action is performed, such as creating a report and/or taking a preferred hierarchy of countermeasures.

List of reference numerals

10. System

12. Vehicle with a steering wheel

14. Interface

16. Mobile radio network

18. Communication connection

20. Server

22. Computer network

24. Monitoring unit

26. Rule set

28. Report on

30. Back end

32. Communication network inside a vehicle

34. Interface

Claims

1. A method for monitoring the safety of a communication connection (18) of a vehicle (12), wherein the vehicle (12) communicates via at least one mobile radio protocol and/or at least one internet protocol, having the following steps:

-establishing rules (26) for permitted communication via at least one mobile radio protocol and/or at least one internet protocol;

-monitoring for a rule violation against a rule in at least one mobile radio protocol and/or at least one internet protocol used by the vehicle (12);

-first making intensive observations and at least gradually limiting the network capacity of the vehicle (12) according to the determined number of rule violations and/or security risks;

-upon determination of one or more rule violations during a dense observation, triggering the creation of a report (28) containing the determined rule violations; and

-taking at least one action when one or more rule violations are determined during the intensive observation.

2. The method according to claim 1, characterized in that the report (28) is displayed to the driver at least temporarily in the vehicle (12).

3. The method of claim 1, wherein the reports (28) of a plurality of vehicles (12) are combined into a data set.

4. The method according to claim 1, characterized in that the network capacity of the vehicle (12) is at least temporarily limited depending on the determined number of rule violations and/or security risks.

5. The method of claim 1, wherein the monitoring of the rule violation is performed at a network interface (14, 34) of the vehicle (12).

6. Method according to claim 1, characterized in that the monitoring of the rule violation is performed at a network component of a network (16, 22) implementing at least one mobile radio protocol and/or at least one internet protocol.

7. Method according to claim 6, characterized in that the convergence and/or trustworthiness of a rule violation is checked at different network components.

8. The method according to any one of claims 1 to 7, characterized by monitoring whether a communication inside the vehicle violates a rule.

9. A vehicle having a communication connection for at least one mobile radio protocol and/or at least one internet protocol, characterized in that the vehicle (12) is configured for carrying out a method for monitoring the security of a communication connection (18) according to any one of claims 1 to 8.

10. A control device having at least one communication connection, characterized in that the control device is configured for carrying out the method for monitoring the security of a communication connection according to any one of claims 1 to 8.