DE102019220157A1 - Security check method, security check device, information system for a motor vehicle, motor vehicle - Google Patents

Abstract

The present invention relates to a method (1) for the safety check of an information system of a motor vehicle, comprising: carrying out (2, 12, 54) a safety check with a programming frame structure which has a set of safety protocols, the programming frame structure being created by adding a safety protocol to the set is expandable by security protocols.

Description

The invention relates to a method for safety checking, a safety checking device, an information system for a motor vehicle and a motor vehicle.

With an increasing number of software in a motor vehicle and increasing networking of motor vehicles, the area for potential attacks on the motor vehicle or on parts of the software of the motor vehicle also increases.

Such attacks (for example through cyber crime) can be a security risk for road traffic and / or for vehicle occupants, pedestrians and the like.

In general, methods are known for providing a safety check on a motor vehicle.

For example, from the laid-open specification EP 2 415 242 A1 a method known to combine software components in a vehicle. However, no software components can be added here without a software update.

Furthermore, from the patent specification US 7,269,482 B1 a framework known which combines software from different sources. However, no security check is carried out here. In addition, it is not modular.

The disclosure document WO 2014/061021 A1 describes a device to detect and prevent an attack on a vehicle. However, no new attacks can be recognized and / or prevented here without a complete software update.

The object of the present invention is to provide a method for safety checking, a safety checking device, an information system for a motor vehicle, and a motor vehicle which at least partially overcome the above-mentioned disadvantages.

This object is achieved by the method according to the invention for security checking according to claim 1, the security checking device according to the invention according to claim 13, the information system according to the invention according to claim 14, and the motor vehicle according to the invention according to claim 15.

• Ausführen einer Sicherheitsüberprüfung mit einer Programmierrahmenstruktur, welche einen Satz von Sicherheitsprotokollen aufweist, wobei die Programmierrahmenstruktur durch ein Hinzufügen eines Sicherheitsprotokolls zu dem Satz von Sicherheitsprotokollen erweiterbar ist.

According to a first aspect of the present invention, a method for the safety check of an information system of a motor vehicle comprises:

• Performing a security check with a programming framework having a set of security protocols, the programming framework being expandable by adding a security protocol to the set of security protocols.

According to a second aspect of the present invention, a security checking device is set up to carry out a method according to the first aspect.

According to a third aspect of the present invention, an information system for a motor vehicle can be checked with a safety checking device according to the second aspect.

According to a fourth aspect of the present invention, a motor vehicle has an information system according to the third aspect.

Further advantageous embodiments of the invention emerge from the subclaims and the following description of preferred exemplary embodiments of the present invention.

As already discussed, known systems and methods for a security check of motor vehicle software can only be expanded by performing a complete software update.

However, it has been recognized that this leads to a high expenditure of time, it being generally desirable for the expenditure of time to be reduced.

It was also recognized that this restricts the flexibility of a security check, namely, for example, because a complete software update can be developed more slowly than new attacks on the motor vehicle software arise, so that some attacks may be successful.

It is therefore desirable that the number of attacks detected and prevented is maximized.

In addition, known systems and methods can have limited functionality, so that if the functionality is to be expanded, major changes may have to be made on the software side, which can require a great deal of time, and which can also result in costs.

It has therefore been recognized that it is desirable to quickly provide a functionality of a safety check, as a result of which a safety system of a motor vehicle can be checked.

In addition, it was recognized that it is desirable to provide a framework by which a motor vehicle can be checked by, for example, an external interface, and which is modular, since known frameworks typically only for one purpose, such as a network check, a security gap (e.g. . Vulnerability scan) of a software, a network, a protocol, and the like, are designed so that only the intended function can be carried out within known frameworks.

In order to add new functionality to known frameworks, a complete software update must be carried out, so that it is typically associated with great effort if new functionality is to be provided for a known framework.

It is therefore desirable to provide a framework (programming frame structure) by means of which any tools for a security check (security protocols) can be executed without a software update being required for this.

• Ausführen einer Sicherheitsüberprüfung mit einer Programmierrahmenstruktur, welche einen Satz von Sicherheitsprotokollen aufweist, wobei die Programmierrahmenstruktur durch ein Hinzufügen eines Sicherheitsprotokolls zu dem Satz von Sicherheitsprotokollen erweiterbar ist.

Therefore, some exemplary embodiments relate to a method for the safety check of an information system of a motor vehicle, comprising:

• Performing a security check with a programming framework having a set of security protocols, the programming framework being expandable by adding a security protocol to the set of security protocols.

In this context, security can denote operational security or protection of components of the motor vehicle against external attack or access.

In addition, security can also denote a risk at which the motor vehicle is protected from a (remote) attacker. Such an attack can result, for example, in economic or financial damage, personal injury, (partial) loss of functionality of a motor vehicle component, and the like.

The security check can be a check of vehicle-internal programming, control, and the like, wherein the security check can serve to validate or to validate an attack on an information system (security system, internal programming, vehicle software, and the like) check.

The security check can check and assess the security of a motor vehicle and the like, with the security being able to be measured by a risk (e.g. on the basis of a probability) that the motor vehicle will be attacked by a physical attack or by a remote attack (e.g. hacking), so that it can be estimated whether a vehicle owner can suffer financial damage, whether a violation of the law can occur, whether a person (e.g. driver, owner, occupant of the vehicle) can be injured, whether vehicle functionality can be disrupted, and like that.

The security check can be based on a programming framework structure.

Programming framework structures (frameworks) are generally known. A framework can be set up to provide a basic framework for programming, for example in an object-oriented one Programming and / or component-based development approaches, where a user of the framework (for example a programmer) can create an application.

A framework according to the invention can have a set of security protocols (at least one).

A security protocol can include a program routine, a sequence, a script, a macro, a program, a fuzzy tool, a program layer, an application, a code, a module, an (open source) software, a template, and the like, which checks one or more components of the information system, for example in order to find and identify a security gap in the information system, and the like.

The security check can be set up to find a security hole.

For example, a problem may have been recognized in a TCP stack in a Linux operating system, which can be designed in such a way that a buffer overflow can occur when a message of a predetermined size is sent to a control unit of a motor vehicle.

A security protocol may have been developed in response to this, but is not yet available in the programming framework.

In order to make the security protocol available, the programming frame structure can be expanded, for example, by dragging and dropping the security protocol.

In some exemplary embodiments, a fuzzy tool can also be expanded by adding a security protocol (for example as a new program layer) so that a fuzzy test based on the added security protocol is possible.

In some exemplary embodiments, a security protocol can comprise a script and / or (open source) software that can manipulate an existing protocol (for example a communication protocol such as TCP / IP and the like).

In general, a security protocol according to the invention should not be construed as a communication protocol or the like, as it is generally known, since, as discussed herein, a security protocol according to the invention can generally represent a sequence in order to identify a security gap.

The framework can further be configured to be expanded by adding a security protocol to the set of security protocols.

For example, a further security protocol can be appended to the set of security protocols so that an extension of the framework can take place without an update of the framework itself taking place (i.e. no software update of the framework has to be performed).

In some exemplary embodiments, the programming frame structure has a backend (or substructure) which is set up to execute at least one security protocol of the set of security protocols.

The backend is typically a part of the framework which is set up to execute the at least one security protocol of the set of security protocols or other applications, for example by compiling them.

The security protocols or applications can be an open source program or script that can be executed by the framework

In some exemplary embodiments, the backend is also set up to be controllable via an interface.

For this purpose, standardized protocols can be integrated into the backend, which enable a terminal device (for example external computer) to be compatible via the interface.

In some embodiments, the interface includes at least one of a digital interface, a virtual interface, and a sensor interface

The digital interface can be, for example, Bluetooth, USB (Universal Serial Bus), W-LAN (wireless local area network), Ethernet, CAN (controller area network), DSI (Display Serial Interface), RFID (Radio Frequency Identification), OBD (On -Board Diagnosis), DSI (Display Serial Interface), and NFC (Near Field Communication).

The virtual interface can for example comprise a communication protocol such as SOME / IP (Scalable Service Oriented Middlewar over IP (Internet Protocol)), ViWo (Volkswagen Infotainment Web Interface), TLS (Transport Layer Security), LIN (Local Interconnect Network), LTE (Long Term Evolution), 5G, ISO / TP (Transport Layer) BAP (operating and display protocol), and the like.

The sensor interface can, for example, be a parking sensor, a parking pilot sensor, a parking assistance sensor, a distance sensor (e.g. radar, lidar), a camera, a location sensor (e.g. GPS sensor (Global Positioning System)), charging interface, an electric vehicle (or hybrid vehicle) and the like.

However, the present invention is not intended to be restricted to the interfaces mentioned, since any interface that can be checked using a security protocol as described herein. In addition, several interfaces can also be checked simultaneously and / or one after the other according to the invention.

In some exemplary embodiments, the backend also includes a message protocol.

The message protocol can be configured to generate a message, notification, and the like, based on the security check or based on the at least one executed security protocol.

This message can be made available to a user and the like who is interested in a result of the security check and thus contain an evaluation of the security check.

In some exemplary embodiments, the backend also includes fuzzy test protocols.

Fuzzy test protocols are generally known and can be viewed as a further exemplary embodiment of a security protocol and / or used to check a security protocol.

In some exemplary embodiments, the programming frame structure has a front end (or superstructure) which is set up to provide a graphical user interface.

The front end can be a network-based interface, through which administration, control and the like of the framework can be provided.

As is generally known, the graphical user interface can be controlled by a user (e.g. programmer, tester, developer, owner, and the like).

In addition, in some exemplary embodiments, a security log can be created via the graphical user interface (for example with a security log template, as discussed herein).

The graphical user interface can provide objects that can be related to one another (similar to programming), for example by linking, loops and the like, so that a program can be created that corresponds to a security protocol that can be executed according to the invention with the framework.

In some exemplary embodiments, various security releases are issued to users of the framework.

For example, an owner, developer, and the like can be granted full access rights (highest security clearance), a person with a lower security clearance can add new security protocols to the framework, while a person with no security clearance can only perform the security check, for example.

In this way, functionality of the framework can advantageously be guaranteed.

In some exemplary embodiments, a security protocol can be created based on a security protocol template.

The security protocol template can be a framework (for example template) in which specifications are made for the security protocol, for example by specifying parameters, defining test steps, and the like.

For example, the security protocol template can be based on YAML, XML or another language, wherein commands, objects and the like can be provided in the security protocol template (for example a file) so that a security protocol can be created.

A security protocol template can contain a name of the respective security protocol, of tools (e.g. commands, objects, and the like), whereby the tools can be written by themselves, open source, or provided by a manufacturer, and parameters (e.g. an input), which relates to the command and the like, a parameter which is expected to be issued, and an envisaged number of sequences in which or how often the security protocol is to be executed.

 model: eae_can.testcases
 pk:
 fields: {
      module: ‚eae_can‘,
      testcase: ‚info_can‘,
      input: [], 
}
    model: eae_can.testcases
    pk:
    fields: {
      module: ‚eae_can‘,
      testcase: ‚send_pdu‘
      input: [‚100‘, ‚01020304‘] 
}
    model: eae_can.testcases
    pk:
    fields: {
      module: ‚eae_can‘
      testcase: ‚send_pdu‘
      input: [‚200‘, ‚05060708‘
}

For example, a safety protocol template in YAML for testing a CAN bus of a motor vehicle can look like this:

 model: eae_can.testcases
 pk:
 fields: {
      module: 'eae_can',
      testcase: 'info_can',
      input: [], 
}
    model: eae_can.testcases
    pk:
    fields: {
      module: 'eae_can',
      testcase: 'send_pdu'
      input: ['100', '01020304'] 
}
    model: eae_can.testcases
    pk:
    fields: {
      module: 'eae_can'
      testcase: 'send_pdu'
      input: ['200', '05060708'
}

Such a YAML file can be created manually or from a graphical user interface of the framework in response to input from a user.

In some exemplary embodiments, a template for a security protocol template can be called up or created, as a result of which a complex security protocol template can advantageously be created with simple means.

In some exemplary embodiments, a security protocol can be added via an automated search.

For example, the automated search can take place in a network, on one or more servers, in which, for example, a database for security protocols is located.

In some exemplary embodiments, a web crawler, search bot, and the like can be used for this purpose.

Furthermore, a manually written script (for example open source) can also be added as a security protocol which is not based on a security protocol template and which can be executed by the framework.

Advantageously, a modularization of the framework can be used so that an aggregation of several security logs can be provided, but a number of security check results is minimized, so that a small number (e.g. one) of security check reports is created, which is advantageous on the one hand for the purpose of a Clarity of the security check and, on the other hand, is advantageous for the purpose of minimizing storage space.

In other words, a sequence, a chain, and the like can be provided by several (at least two) security protocols. For example, the sequence (or chain) can be provided automatically based on a specification or a user can define a sequence of security protocols.

For example, a port scan can be defined as the first security protocol for determining open ports. A second security protocol can then test the specific open ports for vulnerability.

For example, a script or a tool (tool) for security checking can be added to the framework via a graphical user interface (e.g. drag and drop), the script or tool can also be copied into a digital folder provided for this purpose, to which the framework has access so that it can be loaded and compiled by the backend.

This has the advantage that a person who carries out a security check does not need any security clearance (for example access to a source text of the framework and the like).

A person with a security clearance can, however, change the source text of the framework so that, for example, a new security protocol template can be called up by a user of the framework.

In some exemplary embodiments, a security check report can be created on the basis of the security check, so that visibility of the security check can advantageously be generated.

For example, the security review report can include which security protocols were run and what each result was.

The security check report can advantageously be output in a known format (for example pdf (Portable Document Format)).

It was recognized that standardization can contribute to increased security.

Based on the predetermined criteria (or common criteria, CC (common criteria)) or based on conditions or standards that are set (for example externally by an authority such as UNECE), the framework can, in some exemplary embodiments, a Determine the security level of a motor vehicle or a component of a motor vehicle and create a security certificate, whereby automation can advantageously take place, which saves time and minimizes errors by a human component.

In some exemplary embodiments, the security check is based on predetermined (common) criteria for the security check.

A predetermined criterion can generally be defined such that an attack (from a remote attacker, a close attacker, an attacker with physical access, and the like) on the information system can be classified.

For this purpose, in some exemplary embodiments, the at least one predetermined criterion comprises at least one of a time, a severity, a location, and a further security gap.

The time can include a period of time that provides information about how long an attacker needs to carry out an attack.

The severity can include a risk level which is determined based on a database (e.g. CVE (Common Vulnerabilities ans Exposure).

The severity can be included in a security protocol, which is added to the set of security protocols, or can be determined therefrom (for example by programming, coding, and the like of the security protocol).

An automated search (e.g. web crawler) can be used to add security logs that correspond to a specified severity.

The security logs found by an automated search can be compared with the risk level from the database before they are added, so that storage space can advantageously be saved.

For example, if a TCP (Transmission Control Protocol), a TLS (Transport Layer Security) protocol, and the like are to be checked, the database can be filtered based on keywords (e.g. TCP, TSP, buffer overflow in the TCP stack, and the like) and based on a sequence of security protocols (as detailed below) are compared to see whether corresponding entries already exist in the database.

For example, if a cipher suite of a TLS protocol (as an information system) is to be checked and a result could be found in the database, then the result (e.g. "high severity") can be accepted from the database.

If there is no entry in the database, it can be inferred that the vulnerability is not (yet) known, so a sequence of security protocols or a set of security protocols (without necessarily having to specify an order) is determined to verify the security vulnerability .

The location can include the location of a (potential) attacker.

In general, the attacker's location can be used to estimate potential damage in the event of an attack.

For example, the attacker can be a remote attacker, as a result of which the security check can be carried out via predetermined interfaces, such as, for example, W-LAN (Wireless Local Area Network), LTE (Long Term Evolution), 5G, GPS (Global Positioning System), and the like .

In addition, the attacker can be a close-range attacker, as a result of which the security check can be carried out via (other) predetermined interfaces, such as, for example, Bluetooth, a charging interface, a radar, a camera, a driver assistance system, and the like.

In some exemplary embodiments, it can also be an attacker who can have physical access to a motor vehicle (or to a key of a motor vehicle), so that the predetermined interfaces here can include CAN, Ethernet, OBD, LIN, and USB.

In this context, the attacker's location should not be understood as the actual location at which the attacker is, but rather as the location at which he must be in order to carry out an attack. For example, an attacker who has physical access to a motor vehicle can also carry out a remote attack.

Potential damage from a remote attack can be estimated to be higher than that of a close attack, which in turn can be estimated to be higher than that of an attacker with physical access to the motor vehicle. In this context, this is based on the fact that an attack in which an attacker can be further away from a motor vehicle can potentially be successful on more motor vehicles without restricting the present invention thereto.

This has the advantage that a security check time can be minimized.

In some exemplary embodiments, certification can be used to make a security level of the motor vehicle visible to a user, as a result of which the danger of an attack can advantageously be shown to him in an automated manner.

• Erstellen eines Sicherheitszertifikats basierend auf der Sicherheitsüberprüfung.

In some exemplary embodiments, the method further comprises:

• Create a security certificate based on the security check.

The security certificate can be created based on the predetermined criteria for the security check and can serve to verify or falsify a predetermined security level of the motor vehicle so that retrofitting, for example security software, can be carried out if necessary.

The security certificate can advantageously visualize a security level of the information system, which can advantageously be determined with the security check.

The security certificate can also be generated based on a security review report which is generated in response to the security review.

The security certificate can be a digital certificate in which it is recorded whether the security check was successful.

The security certificate can provide information about a state of the security of the motor vehicle so that, for example, the information system can be released or the information system can be accessed, for example, to a protected network.

Some exemplary embodiments relate to a method for a safety check of an information system of a motor vehicle, comprising: determining a sequence of safety protocols from a set of safety protocols of a programming frame structure, which can be expanded by adding a safety protocol to the set of safety protocols, the determining of the sequence of safety protocols on based at least one predetermined criterion for a security check; and executing the sequence of security protocols to identify at least one security gap in the information system of the motor vehicle.

A subset (or a subset) of security protocols can be selected from the set of security protocols.

The subset can comprise at least one security protocol (or more), so that one or more predetermined (known or unknown) security gaps can be determined with this if the security protocols are executed in a certain order (sequence), including an inventive sequence of security protocols For example, at least two security protocols of the subset of security protocols can be executed (approximately) simultaneously.

Another vulnerability can arise from the fact that an initial attack was successful. Therefore, in some exemplary embodiments, the sequence of security protocols can be established in such a way that a first security protocol tests the information system for a first security gap and a second security protocol tests for a second security gap.

An attack can take place via an interface, for example from a remote attacker, an attacker with means of access (for example by first leasing a vehicle, having a key to the vehicle), and the like.

A remote attacker can attack a vehicle via Bluetooth, WLAN, LTE, and the like.

A close attacker can attack a vehicle, for example via a sensor, for example GPS, radar, infrared sensor, camera, and the like.

An attacker who has physical access to a vehicle can attack the vehicle via CAN, Ethernet, LIN, NFC, RFID, OBD, DSI, charging interface (e.g. for electric or hybrid vehicles), USB interface, and the like.

A remote attacker can also attack (hack) a vehicle to which, for example, an owner of the vehicle has an external (compromised) (end) device (e.g. mobile phone, tablet, and the like) connected, for example via an infotainment system of the vehicle has (or has connected) (e.g. via USB, Bluetooth, WLAN, and the like). In such a case, the attacker can attack the infotainment system via the external device by finding weaknesses in the infotainment system and thus creating a safety risk for the owner (or driver) of the vehicle or financial damage (or loss) for the manufacturer generated by the vehicle.

An attacker can attack an infotainment system, for example via protocols and / or interfaces, such as B. SOME / IP, ViWi, TLS, BAP, ISO-TP, DoIP, and the like.

In some exemplary embodiments, a score is determined which is indicative of how secure the information system is with regard to a (potential) security gap (for example based on how many attacks out of a predetermined number of attacks are potentially successful).

In the sequence of security protocols, a number of points can thus be determined for each security protocol carried out, from which a total number of points for the information system can be determined (e.g. an average), from which the potential damage of such an attack or a security level can advantageously be determined.

In some exemplary embodiments, a security level of the information system is determined based on the sequence of the security protocols or based on the uncovered security gaps in the information system.

The security level can be represented with a security certificate and the like, such as “very safe”, “safe”, “unsafe”, “very unsafe”, so that a quality of the security system can advantageously be visualized.

In some exemplary embodiments, the at least one predetermined criterion comprises an expertise of a potential attacker. For example, the expertise can be determined to be public knowledge if the subset of security protocols is based solely on open source security protocols, publicly available security protocols, and the like.

In some exemplary embodiments, the at least one predetermined criterion comprises a tool that is used for a potential attack. For example, the tool can be set as the default if, for example, it can be found on the Internet.

In some exemplary embodiments, a score is determined which is indicative of how secure the information system is with regard to a (potential) security gap (for example based on how many attacks out of a predetermined number of attacks are potentially successful).

In the sequence of security protocols, a number of points can be determined for each security protocol carried out, from which a total number of points for the information system can be determined (e.g. an average), from which the potential damage of such an attack or a security level can advantageously be determined.

In some exemplary embodiments, a security level of the information system is determined based on the sequence of security protocols or based on the uncovered security gaps in the information system.

The security level can be represented with a security certificate and the like, such as “very safe”, “safe”, “unsafe”, “very unsafe”, so that a quality of the security system can advantageously be visualized.

The security level can be determined using a risk assessment, for example with the following table: Very high High Moderate Low Very little Very little Low Low Low Moderate Moderate Low Low Low Moderate High High Moderate Low Moderate High High Very high High Moderate High High Very high Very high Very high Moderate High Very high Very high Very high

The first column of the table shown contains an estimated potential damage in the event of an attack, while a probability of an attack is entered in the first line, resulting in a risk for the information system which is indicated in the other cells of the table.

A variety of predetermined criteria can be considered. For example, a potential remote attacker can use a standard tool (for an attack), with the potential remote attacker also being rated as an expert in his or her field. Furthermore, the potential attacker can need two hours for the potential attack.

Based on these criteria, the probability of an attack is determined as “very low”.

Furthermore, the potential damage in the event of an attack on the information system is classified as “high” based on a database.

Therefore, the table is used to determine the risk as “very high”.

Some exemplary embodiments relate to a security checking device which is set up to carry out the method according to the invention for security checking.

The security checking device may be a control arrangement such as a processor (e.g. a CPU (Central Processing Unit)) or multiple processors, a computer, a server (or multiple servers), and the like.

The safety checking device can be part of a motor vehicle or be provided separately in a terminal (for example computer, server) so that a safety check can be carried out on a motor vehicle by connecting the safety checking device to the motor vehicle (or to an information system according to the invention, see below) is, for example via the at least one interface.

Some exemplary embodiments relate to an information system for a motor vehicle which can be checked with a safety checking device according to the invention, as described herein.

The information system can be a (further) control arrangement, for example a processor, several processors, a computer, a server (or several in each case), and the like.

In exemplary embodiments in which it is part of the motor vehicle, the safety checking device can be integrated in the information system or connected to the information system.

Some exemplary embodiments relate to a motor vehicle which has an information system according to the invention.

The motor vehicle can designate any vehicle operated by a motor (e.g. internal combustion engine, electric machine, etc.), such as an automobile, a motorcycle, a truck, an omnibus, agricultural or forestry tractor, in which a programmable ( and thus vulnerable) motor vehicle electronics are available.

• 1 schematisch ein Ausführungsbeispiel eines erfindungsgemäßen Verfahrens zur Sicherheitsüberprüfung;
• 2 schematisch ein weiteres Ausführungsbeispiel eines erfindungsgemäßen Verfahrens zur Sicherheitsüberprüfung;
• 3 ein Blockdiagramm eines erfindungsgemäßen Sicherheitsüberprüfungssystems;
• 4 ein Blockdiagramm eines Verfahrens, um ein Sicherheitsprotokoll zu dem Framework hinzuzufügen;
• 5 ein Blockdiagramm eines Verfahrens, um ein Sicherheitsprotokoll auszuführen; und
• 6 ein Verfahren für eine erfindungsgemäße Sicherheitsüberprüfung zeigt.

Embodiments of the invention will now be described by way of example and with reference to the accompanying drawing, in which:

• 1 schematically an embodiment of a method according to the invention for security checking;
• 2 schematically a further embodiment of a method according to the invention for security checking;
• 3 a block diagram of a security screening system according to the invention;
• 4th a block diagram of a method to add a security protocol to the framework;
• 5 a block diagram of a method to execute a security protocol; and
• 6th shows a method for a security check according to the invention.

1 shows an embodiment of a method according to the invention 1 .

In 2 For example, a security check is performed with a programming framework having a set of security protocols, the programming framework being extensible by adding a security protocol to the set of security protocols, as described herein.

2 shows another embodiment of a method according to the invention 10 .

In 11 For example, a security check is performed with a programming framework having a set of security protocols, the programming framework being extensible by adding a security protocol to the set of security protocols, as described herein.

In 12th a security certificate is issued based on the security clearance as described herein.

3 shows a security checking system according to the invention, which a motor vehicle 20th and a security checking device according to the invention 21 includes.

The security checking device 21 is designed in this embodiment as a personal computer (PC), which via an NFC interface with the motor vehicle 20th is connected and which carries out a security check method according to the invention.

The car 21 has an information system according to the invention 22nd on, which is designed as a central on-board computer in this embodiment.

The information system 22nd is also connected to infotainment control units 23 , 24 , and 25th coupled, on which there is software that is checked by a security check according to the invention.

4th shows a block diagram of a method 30th to add a security protocol to the framework.

One user 31 having a security clearance identifies a potential threat 32 so that in 33 a threat scenario is identified.

This will take security clearance steps 34 defines which tools and configurations to use 35 in the framework so that the backend 36 Perform the test steps and generate a security clearance report.

5 shows a block diagram of a method 40 to run a security log.

First, a user initiates 41 a predetermined security protocol based on a threat scenario 42 based on preset tools and configurations 43 is accessed and security clearance steps 44 will be created, prompting security clearance report entries 45 Be prepared so that a security clearance report 46 is issued.

6th shows, in a block diagram, a method 50 for a security check according to the invention.

In 51 different security check concepts (or security protocols) are created based on a selection of different security protocol templates, ie a sequence of the security check is created.

In 52 the created security check is initiated and attacks on an information system are then simulated, which in 53 can be retrieved.

In 54 the security check is carried out, which is carried out in 55 monitored so that in 56 a security clearance report is prepared.

The security clearance report is in 57 sent to a memory as feedback for a future security review, which can serve as an enhancement to a stored security log (or multiple stored security logs).

Also, the security clearance report is used to meet predetermined criteria 58 for security review (as described herein) to be defined or improved.

The predetermined criteria 58 are used to in 59 improve the security audit, for example, as new security protocols and / or security protocol templates, in 60 to be transmitted to the framework.

It is not intended that the present invention be construed as having exclusive application to motor vehicles. In general, the present invention can also be applied to devices in the Internet of Things (loT, Internet of Things).

List of reference symbols

1

Security review procedures

2

Perform security clearance

10

Security clearance procedures

11

Perform security clearance

12th

Create security certificate

20th

Motor vehicle

21

Security checking device

22nd

Information system

23

Infotainment control unit

24

Infotainment control unit

25th

Infotainment control unit

30th

Procedure for adding a security protocol to the framework

31

Security clearance users

32

threat

33

Identification of a threat scenario

34

Security clearance steps

35

Configurations in the framework

36

Backend

40

Procedure for running a security protocol

41

Users

42

Threat scenario

43

Tools and configurations

44

Security clearance steps

45

Security Audit Report Entries

46

Security clearance report

50

Procedure for a security clearance

51

Creation of security review concepts

52

Initiate the security review

53

Get simulated attacks

54

Perform the security clearance

55

Monitor the security clearance

56

Create security clearance report

57

Sending the security clearance report to storage

58

Common security clearance criteria

59

Improve security clearance

60

Transmission of the predetermined criteria to the framework

QUOTES INCLUDED IN THE DESCRIPTION

This list of the documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• EP 2415242 A1 [0005]
• US 7269482 B1 [0006]
• WO 2014/061021 A1 [0007]

Claims (15)

Method (1; 10) for the safety check of an information system of a motor vehicle, comprising: Performing (2, 12, 54) a security check with a programming framework having a set of security protocols, the Programming framework is expandable by adding a security protocol to the set of security protocols. Method (1; 10) according to Claim 1 , wherein the programming frame structure has a backend (36) which is set up to execute at least one security protocol of the set of security protocols. Method (1; 10) according to Claim 2 , wherein the backend (36) is also set up to be controllable with an interface. Method (1; 10) according to Claim 3 wherein the interface comprises at least one of a digital interface, a virtual interface, and a sensor interface. Method (1; 10) according to one of the Claims 2 to 4th wherein the back end (36) further comprises a message protocol. Method (1; 10) according to one of the Claims 2 to 5 wherein the backend (36) further comprises fuzzy test protocols. The method (1; 10) according to claim one of the preceding claims, wherein the programming frame structure has a front end which is set up to provide a graphical user interface. Method (1; 10) according to Claim 7 , whereby a security protocol can be created via the graphical user interface. Method (1; 10) according to one of the Claims 7 and 8th , wherein a security protocol can be created based on a security protocol template. Method (1; 10) according to one of the preceding claims, wherein a security protocol can be added via an automated search. Method (1; 10) according to one of the preceding claims, wherein the security check is based on predetermined criteria for the security check (58). Method (1; 10) according to Claim 11 , further comprising: creating (12) a security certificate based on the security check. Security checking device (21) which is set up to carry out the method (1; 10) according to one of the preceding claims. Information system (22) for a motor vehicle (20) which is equipped with a security checking device (21) according to Claim 13 is verifiable. Motor vehicle (20) having an information system (22) according to Claim 14 having.

Images