DE102018208832A1 - A method for containing an attack on a controller - Google Patents

Abstract

A method and an arrangement for containing an attack on a control unit (14) in a control unit network are presented. After detecting an attack on the control unit (14), a security manager (20) in the control unit network decides on security fallback levels and shares these with the remaining control units (24) as commands.

Description

The invention relates to a method for containing an attack on a control device, in particular an engine control unit in a vehicle, and an arrangement for carrying out the method. The invention further relates to a computer program and a machine-readable storage medium for carrying out the method.

State of the art

ECUs are electronic modules that are used in (power) vehicles for the control and regulation of technical components and thus of operations in these vehicles. Engine control units are used to control and / or regulate the engine of the vehicle and are of particular importance in the operation of the vehicle.

In the operation of the vehicle, it is particularly important to ensure the safety during operation of the vehicle, the so-called operational safety. All equipment and processes in the vehicle that serve this purpose are summarized under the term safety monitoring or safety monitoring. In addition to operational safety, so-called information security or security is also increasingly important in vehicles, the aim of which is to ensure the confidentiality of data and information, even in the event of attacks from outside or inside. In particular, it should be noted that such attacks can affect both the security and the safety. The method presented here represents a procedure for a detected attack and thus serves both safety and security.

It is thus known to carry out plausibility checks with regard to safety in an engine control unit in a monitoring component and to correct values such as, for example, the torque limitation in the case of suspected errors. This approach is known as a safety multi-level concept.

It should also be taken into account that ECUs perform built-in self-tests. In addition, due to emissions legislation in the engine control unit, there are a particularly large number of diagnostic fault checks or diagnostic fault checks. Upon detection of an error, eg. As in a sensor failure, predefined fail-safe values, so-called fail-safe values are used to bring the controller in a safe state. This is summarized under the term "Limp Home".

Attack detection systems are also known which serve to detect an attack directed against a computer system or computer network. These systems are also referred to as intrusion detection systems (IDS). Such intrusion detection systems are known and distributed in the IT world (IT: Information Technology). They are subdivided into host intrusion detection systems that need to detect an attack on a single machine and therefore need to be installed on that machine as well as network intrusion detection systems that detect network traffic anomalies. Network intrusion systems are also used to detect network traffic attack patterns.

Currently the first intrusion detection systems for vehicles are being developed. In these, the aim is to report a detected attack to the vehicle manufacturer, for example as a web service or service via mobile phone, so that it can initiate appropriate countermeasures.

The publication EP 2 433 457 B1 describes a safety system for vehicles and a method for detecting intrusion, a so-called intrusion detection. A method is described for reprogramming a node of an electronic communications system in which a signal is sent from a first to a second node, the signal requesting that the second node be reprogrammed, the second node being used to identify the first one The node is to be broadcast to other nodes and the second node is only reprogrammed if a predetermined set of the other nodes confirms by the identification that the first node is legitimate.

Disclosure of the invention

Against this background, a method with the features of claim 1 and an arrangement according to claim 7 are presented. Furthermore, a computer program according to claim 8 and a machine-readable storage medium according to claim 9 are presented. Embodiments result from the dependent claims and the description.

The presented method serves to contain a detected attack on a control unit in a control unit network. It is provided that after detecting the attack on the control unit, a security manager in the control unit network decides on security fallback levels and informs the remaining control units as commands or commands.

The arrangement described is set up to carry out the presented method and is implemented, for example, in a control unit or designed as such. The arrangement can be implemented as hardware and / or software. A corresponding computer program that represents this software is also the subject of this application.

It should be noted that an attack always first on one of the many control devices of a vehicle, eg. B. over the Internet to the Central Gateway controller, takes place. If an attacker takes control of a control device, eg. As by control flow hijacking exploit, so far no containment of the attack, for example, a prevention of subsequent attacks on other control devices, possible.

The presented method now allows increased resilience to cybersecurity attacks. Resilience is the ability of a network, for example a control unit network, to understand that if it is impaired in a part of the network it will not completely fail.

The presented method serves to contain an attack on a control unit. In this case, an attack on the control unit, which is typically located in a control unit network with other control units, has already taken place and this has been detected. Now, the method described herein begins and causes this attack to be contained, i. This means that measures are taken which mitigate the effects of the attack on the affected ECU and on other control units in the network and possibly even lead to the attack being aborted or discontinued.

For this purpose, the presented method provides that messages are exchanged between control units in the vehicle network via security fallback levels, in particular by so-called control and status messages.

Control units in the vehicle, including switches or switches and access points or gateways, implement security fallback or fallback levels. Upon detecting a successful attack on a controller, a security manager decides on the appropriate response. It is on this 1 directed. The detection of an attack can take place by means of an external detection, such as, for example, a Host Intrusion Detection or a Network Intrusion Detection.

• - Deaktivierung bestimmter Kommunikationswege zwischen Fahrzeug und Umgebung, z. B. Mobilfunk und WiFi,
• - Deaktivierung bestimmter Schnittstellen im Fahrzeugnetzwerk: ein Schalter bzw. Switch oder ein Zugang bzw. Gateway kann Nachrichten betroffener Steuergeräte verwerfen, anstatt sie weiterzuleiten,
• - Deaktivierung bestimmter Software-Schnittstellen zur Verkleinerung der verbleibenden Angriffsfläche,
• - Einschränkung von Fahrfunktionen, z. B. Begrenzung von Maximalgeschwindigkeit oder Drehmoment,
• - Rücksetzen bzw. Reset eines betroffenen Steuergeräts bei nächster Gelegenheit, bspw. beim nächsten Fahrzeughalt.

Reactions to an attack can be:

• - Deactivation of certain communication paths between the vehicle and the environment, eg. Mobile and WiFi,
• Deactivation of certain interfaces in the vehicle network: a switch or an access or gateway may discard messages from affected ECUs instead of forwarding them,
• - deactivation of certain software interfaces to reduce the remaining attack surface,
• - restriction of driving functions, eg. B. limitation of maximum speed or torque,
• - Reset or reset an affected controller at the next opportunity, eg. At the next Fahrzeughalt.

The presented method, at least in some of the embodiments, allows increased resilience to cybersecurity attacks.

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the particular combination indicated, but also in other combinations or in isolation, without departing from the scope of the present invention.

list of figures

• 1 shows a schematic representation of an arrangement for carrying out the method.
• 2 shows a flowchart of a flow of an embodiment of the presented method.

Embodiments of the invention

The invention is schematically illustrated by means of embodiments in the drawings and will be described in detail below with reference to the drawings.

1 shows an arrangement for carrying out the method, in total with the reference numeral 10 is designated and used in a vehicle. The illustration shows a switch or access 12 , an attacked controller 14 with a host intrusion detection system 16 , a communication control device 18 , a security manager 20 , a network intrusion detection system 22 and remaining controllers 24 , The Network Intrusion Detection System 22 is implemented as a dedicated control unit in the control unit network of the vehicle.

Important components are thus the intrusion detection systems 16 . 22 , the security manager 20 as well as the remaining, not under the control of Attacker's standing control devices including the switches and accesses 12 ,

There can be multiple Host Intrusion Detection Systems and Network Intrusion Detection Systems. These can each run as a separate control unit or as additional software on a control unit. Also possible is an implementation with hypervisor as part of a (hardware) virtualization.

Hardware virtualization is understood to mean the virtualization of computers as complete hardware platforms, certain logical abstractions of their components, or just the functionality required to operate different operating systems. Virtualization hides the physical properties of a computing platform or computing platform from users and instead presents an abstract computing platform.

It should be noted that many processors provide specific instructions or machine instructions that allow for efficient, lower computational overhead and secure virtualization. A virtualized guest system has no access to the hypervisor and other guest systems.

There may also be one or more security managers. These can each be implemented as a separate control unit or as software on a control unit. Also possible is an implementation with hypervisor in the context of a virtualization.

Messages about successful attacks are sent to the security manager (s) 20 cleverly. The security manager 20 decides on security fallback levels and shares these with the remaining controllers 24 as commands with. A return from a security fallback level to normal operation requires special authentication, for example from a workshop. If external interfaces, such as mobile radio, have not been deactivated, remote maintenance with special authentication is also conceivable.

A security fallback level is a particular mode of operation of the controller network or an individual controller that serves to contain an attack. This operating mode includes a different functionality than the usual operating modes, such as "Driving" (normal driving). In particular, many otherwise available functions are disabled or altered or restricted to reduce the remaining attack surface and damage potential.

Fallback levels can be defined either for the ECU network or individually for individual ECUs. An exemplary embodiment for the first case represents a fallback level ID that is unique in the control unit network, in accordance with which each control unit carries out its respective actions. The fallback level can be commanded as transmission or broadcast. An exemplary embodiment of the second case, the control unit individual fallback level, is given by fallback level IDs that are not unique in the control unit network and are therefore each commanded for a particular control unit. The corresponding message then includes the fallback level ID along with the destination ECU ID.

Significant are the messages about security fallback levels, namely control and status messages, between ECUs in the vehicle network. The remaining control units 24 send status messages regarding their current security fallback level.

• Pfeil 40: Incident report message; Ereignis-Bericht-Nachricht
• Pfeil 42: Incident report message; Ereignis-Bericht-Nachricht
• Pfeil 44: Security fallback A command message; Security-Rückfallebene A, Befehlsnachricht
• Pfeil 46: Security fallback A status message; Security-Rückfallebene A, Statusnachricht

Through the rectangular boxes in the illustration, with reference numerals 14 . 16 . 18 . 20 . 22 and 24 are designated, thus control devices are shown. The straight lines 30 . 32 . 34 . 36 and 38 indicate a communication bus, for example. Ethernet, which connects the control units together. arrows 40 . 42 . 44 and 46 indicate the direction in which messages are transmitted. These are:

• arrow 40 : Incident report message; Event report message
• arrow 42 : Incident report message; Event report message
• arrow 44 : Security fallback A command message; Security fallback A , Command message
• arrow 46 : Security fallback A status message; Security fallback A , Status message

A symbol 49 denotes an attack.

2 shows in a flow chart a possible sequence of the method described. In a first step 50 an attack on a control unit, which is provided in a control unit network in a motor vehicle, detected. In a second step 52 The remaining control devices are communicated by a security manager so-called security fallback levels, which are then occupied by them. Subsequently, in one step 54 Countermeasures initiated. If these are successful, you can do it in one step 56 the remaining control units return to normal operation.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• EP 2433457 B1 [0008]

Claims (9)

Method for containing an attack on a control unit (14) in a control unit network in which, after detecting an attack on the control unit (14), a security manager (20) in the control unit network decides on security fallback levels and assigns these to the remaining control units (24) as commands. Method according to Claim 1 in which the attack is detected by means of an intrusion detection system (16, 22). Method according to Claim 1 or 2 that is performed with a hypervisor as part of a virtualization. Method according to one of Claims 1 to 3 , which is carried out as part of a remote maintenance. Method according to one of Claims 1 to 4 in which a return from the security fallback level to a normal mode is carried out after authentication has taken place. Method according to one of Claims 1 to 5 in which after detecting an attack on one of the control devices (14) in the control unit network at least one countermeasure is initiated, which is selected from the following list: - deactivation of certain communication paths between the vehicle and the environment, - deactivation of certain interfaces in the vehicle network, Deactivation of certain software interfaces to reduce the remaining attack surface, - restriction of driving functions, - reset of an affected control unit (14) at the next opportunity. Arrangement for suppressing an attack on a control unit (14) in a control unit network, the arrangement for carrying out a method according to one of the Claims 1 to 6 is set up. Computer program with program code means adapted to perform a method according to any one of Claims 1 to 6 execute, if the computer program on a computing unit, in particular a computing unit in an arrangement according to Claim 7 , is performed. Machine-readable storage medium with a computer program stored thereon Claim 8 ,

Images