DE102017208545A1 - Method for protecting a network from cyber attack - Google Patents

Abstract

A method of protecting a network from cyber attack is proposed wherein bits or bit strings of messages in the network are transmitted over different levels on a transmission link of the network. For a first transmission of a message in the network, at least one duration of at least one of the different levels is determined. The at least one duration or derived quantity is compared to at least one predetermined size, and depending on the comparison, the cyber attack on the network is detected or the cyber attack on the network is located in the network.

Description

Technical area

Disclosed are methods for protecting a network from cyber attack, network participants configured for this purpose and a computer program configured for this purpose.

State of the art

From the WO2012159940 A2 For example, a method is known for using a fingerprint to characterize a vehicle network in order to detect a manipulation of the vehicle network. The fingerprint is obtained in particular from a network configuration.

The EP2433457B1 describes a vehicle safety system and methods of intrusion detection (intrusion detection) as well as response measures if a corresponding cyberattack is detected.

Disclosure of the invention

Methods are proposed for increasing the protection of a network by detecting a cyber attack on the network by means of a transmission in the network or by locating a detected attack. For this purpose, bit lengths or level durations of the transmission with at least one predetermined value or fingerprint are compared as characteristics. In particular, the fingerprint is based on previously determined characteristic bit lengths or level durations for transmissions of specific network subscribers. Based on the comparison, an origin of the message can be detected and thus (if appropriate in combination with other properties) a cyberattack can be detected or a detected cyberattack can be located. The localization preferably takes place for a network subscriber, a network segment or a transmission link of the network.

A network or subscriber to a network is set up to perform the described procedures by having electronic memory and computational resources to perform the steps of a corresponding method. Also stored on a storage medium of such a user or on the distributed storage resources of a network may be a computer program configured to perform all the steps of a corresponding method when executed in the subscriber or in the network.

The proposed methods allow a more targeted response to the attack by locating the point of attack of a cyberattack on the network. By using a model (e.g., comprising a learning algorithm, a neural network, a stochastic model, or a data-based or automata-based model) to determine the fingerprint used from appropriate transmission characteristics, the method can be rendered particularly reliable and robust.

As additional advantages of the proposed methods, no additional data is required for this purpose, which means that there is no negative influence on real-time requirements of the network. An out-of-network attacker can not change the physical characteristics of the transmission, as these are due to hardware characteristics of the network and its components, and thus are inaccessible to higher-level software.

In preferred embodiments, the characteristics of the transmission referred to go back to physical properties of the network, of transmission channels or transmission media of the network such as cables, switching networks, filtering circuits or connection points, the subscriber hardware, in particular transceivers or microcontrollers, a topology of the network or network terminations or termination resistors etc ,

In a particularly preferred embodiment of the method, the error handling in the case of detected manipulation is carried out specifically for a localized network subscriber, a localized network segment or for a localized transmission link of the network. For this purpose, in particular the localized network participant, the localized network segment or the localized transmission link in the network can be restricted in function or disabled, be excluded via a deactivated gateway from the network or messages coming from them are not transmitted or discarded.

Through targeted circuit technology or hardware selection or manipulation of components of the network, the characteristics used can also be introduced into the network or amplified in the network. As a result, the reliability of the detection and localization of a point of attack can be further increased.

list of figures

• 1 schematisch ein beispielhaftes Netzwerk mit mehreren Netzwerkteilnehmer,
• 2 einen schematischen Ablauf eines beispielhaften Verfahrens zum Schutz eines Netzwerks vor einem Cyberangriff,
• 3 beispielhafte Bitlängen bzw. Pegeldauern für verschiedene Netzwerkteilnehmer.

The invention is described in more detail below with reference to the accompanying drawings and to exemplary embodiments. Show

• 1 schematically an exemplary network with multiple network participants,
• 2 a schematic flow of an exemplary method for protecting a network from cyber attack,
• 3 exemplary bit lengths or level durations for different network users.

Description of the embodiments

The present invention relates to a method for protecting a network from cyber attack by detecting the attack or location of a point of attack of such cyberattack in the network.

The security of networks in general and especially of networks in vehicles against cyber attacks is becoming increasingly important. Especially for networked and automated vehicles such attacks are more relevant. Researchers demonstrated successful remote attacks on vehicle ECUs. This makes it possible for attackers to take control functions in the vehicle by recording messages about the successfully attacked ECUs in a vehicle network.

On the one hand, it is important to detect an attack on a network and to identify the malicious messages brought in by it. On the other hand, it is also important to identify the origin of the attack, ie the attacked network participant or at least the attacked network segment, i.a. to initiate targeted countermeasures. If a message is identified as malicious, it should now be recognized on the basis of characteristics of the transmission of the message from which network participant or from which network segment the message comes.

For this purpose, a bit length or a corresponding level duration of a message transmission in the network is determined and compared with corresponding predetermined sizes. These predetermined quantities preferably correspond to characteristic bit lengths or level durations, for example of network subscribers or variables derived therefrom, for certain network subscribers. The bit lengths are characteristic of e.g. due to variations in the hardware characteristics of the subscribers (e.g., transceivers or microcontrollers) or static influences of the network topology (setup, as well as cables, connectors, termination resistors, etc.). Through the comparison, the origin of a message in the network can be determined and (possibly in combination with other properties of the message) a cyberattack can be detected or a detected cyberattack can be located in the network. For a remote attacker, it is hardly possible to specifically influence the bit lengths or level durations, in contrast to message contents including sender addresses etc. In a further embodiment, the described characteristics can also be deliberately introduced into the system, for example by the selection, the compilation or the targeted manipulation of hardware components of the network. Such targeted characteristics can be chosen to be more distinctive and the bit lengths or levels can be assigned to the corresponding network subscribers or network segments in a simpler, clearer or more robust manner.

• - ein Netzwerk oder Teilnetzwerk als Ganzes charakterisieren bzw. authentifizieren,
• - einen bestimmten Übertragungsweg oder Übertragungskanal im Netzwerk charakterisieren bzw. authentifizieren oder
• - individuelle Netzwerkteilnehmer (z.B. Steuergeräte in einem Fahrzeugnetzwerk oder Gateways eines Netzwerks) charakterisieren bzw. authentifizieren.

The bit lengths or level durations can be used here

• characterize or authenticate a network or subnetwork as a whole,
• characterize or authenticate a particular transmission path or transmission channel in the network or
• characterize or authenticate individual network participants (eg control units in a vehicle network or gateways of a network).

In a system, these characteristics can be used in all three different forms together.

In 1 is an exemplary network with terminators 10 and 11 shown. To the bus 1 are connected as network participants an ECU 101 , an ECU 102 as well as a network monitor or a network monitoring unit 103 , The network guard 103 preferably has transmitting and receiving means, messages of the bus 1 to receive as well as messages on the bus 1 to send. In addition, it preferably has evaluation means to determine physical characteristics of a transmission of a message on the bus, as well as an arithmetic unit or hardware circuit in order to determine an origin of the message, in particular by comparison with predetermined data.

In 2 An exemplary flow of a method for protecting a network against cyberattacks is shown. First, in a first step 201 in particular, by means of a model, at least one physical fingerprint is created as a predetermined, characterizing variable depending on bit lengths or level durations of transmissions. Preferably, corresponding quantities are predetermined for all network subscribers. This can be done by measuring the physical characteristics bit length or level duration of a Messaging with external measuring devices done (for example, an oscilloscope), especially in a secure environment (for example, in the factory). Alternatively, the characteristic bit lengths or level durations can also be determined with internal measuring devices of physical characteristics (eg with means of a network participant, eg a control device on a vehicle network or in measuring devices of a network node especially for network monitoring). Alternatively, model or predetermined quantities can also be received and stored externally, for example by an Internet server.

The model can be taught in different ways or determine the fingerprints. For example, a particular test pattern may be transmitted on the network, which in particular may be uncorrelated with other messages expected on the bus. Alternatively, the fingerprints may also be determined from regular messages transmitted during normal operation of the network or from portions of these messages. Also, certain network participants may be prompted by message to respond in a particular manner and fingerprints determined by the transmission of the particular answers. Optimally, the fingerprints are learned by the model based on the measured physical characteristics of repeated and different transmissions, to later enable fingerprinting to provide robust authentication.

Preferably, a step response or impulse response of a network to a transmission is utilized for the creation of the fingerprints. In particular, the occurring reflections in the system which result from the structure of the network, its transmission means, its resistors and its connected hardware elements can thus be described.

A test pulse can be generated here by an ordinary participant or by a special test participant. The test pulse may consist of one or any number of level changes in which the times between the level changes are determined or indeterminate. It is also possible that the network is put into a special learning mode for this, during which, for example, no normal data transmission takes place. The transmitter of the test pulse may have special modules of hardware and / or software for generating the test pulse.

For a CAN network, for example, a fingerprint could be determined by measuring only one of the CAN high and CAN low lines (measurement versus ground). That would be associated with relatively low measurement effort. Alternatively, the fingerprints can be created from the measurement of both, or it can also be used the differential signal. As a result, higher quality fingerprints could be determined.

In step 202 is a valid model or valid fingerprints, so that communication in the network in step 203 can be checked for their origin by comparison with the model or the fingerprints. Specifically, in this step, individual messages and their contents (eg individual message frames on a CAN bus or individual bits within such a frame), the transmission times, higher order patterns in message traffic, one or more transmission users (in particular transceivers) and the physical characteristics the transmission. Already with this information, malicious or unexpected messages can be identified and detected as (suspected) messages due to a cyberattack. By comparing the particular physical characteristics with the learned model or fingerprints, the origin of the message can be determined and cyber attack identified or confirmed, or a cyber attack target can be located. The latter, in turn, allows a targeted response to the attack at the point of attack.

For manipulation detection and localization, the physical characteristics of the transmission are determined and evaluated as lengths of the transmitted bits or bit sequences or symbols, or the corresponding durations of the different levels on the network line, which represent the bits or bit sequences. In favorable implementations, the actual measuring point for detecting the level is e.g. defined at approx. ¾ of the nominal bit length. This makes it possible that bits can vary in length and yet be reliably detected. These jitter may be unique to each device and may therefore be evaluated as characteristics for particular network participants or their components or for particular network segments or links. Also, such variations may be deliberately introduced into the network by selecting or manipulating the hardware of the network or a network participant to make the origin of a message more identifiable.

If, for example, the control units on a critical bus have a relatively long "1", a gateway on the same critical bus but a relatively short "1", it can be distinguished by whether a message has come from one of the controllers or through the gateway to the critical bus. In response, in the latter case, for example, the gateway could be disabled, but the communication of the controllers with the bus could be maintained.

For example, a different bit length may result from hardware characteristics of a transceiver or communications controller, cable characteristics, or both. For a transceiver, e.g. asymmetry in the built-in capacitances or in the capacitances of the electrical lines may be responsible for the asymmetry of the bit length.

Instead of merely considering the bit length itself, one could also use the relationship between recessive and dominant bit components as characteristics.

In 3 are three bit sequences or level sequences 31 . 32 . 33 shown, which each come from different network participants. The episode 32 shows in comparison to the episode 31 longer levels corresponding to the bit value 0 and shorter levels corresponding to the bit value 1 correspond. The episode 33 shows in comparison to the episode 31 shorter levels corresponding to the bit value 0 and longer levels corresponding to the bit value 1 correspond. On the basis of certain bit lengths or levels of transmission or due to certain ratios of the level components between 1 and 0, the sending network participants can thus be detected. The example in 3 shows only the differential signal. The idea is, for example in the case of a CAN bus, correspondingly also applicable to (CAN) High and (CAN) Low.

A CAN bus uses a difference signal on the physical layer. The idle state is generated by a level of approx. 2.5V on both signal lines. This corresponds then differentially to a level of 0V. Here it is now possible to make the level change differentially (change to a signal line). On the other hand, a differential change is also possible by an opposite level change in the two signal lines. Also, during the transmission of the frame in both signal lines, a same-level level change can be made as a fingerprint. This would not change the differential signal, but would be detectable in a measurement against ground.

The determination and evaluation of the data in step 203 can be done by individual network participants, for example, from individual control units of a vehicle network. Alternatively, separately provided monitoring units can be used as network subscribers for this purpose. Individual properties, eg transmission times but also further physical characteristics, can be detected without special hardware. For other properties, especially in the desired level of detail, additional hardware in the units makes sense. Therefore, it is preferably useful to transfer individual network participants, the acquisition and evaluation and equip them accordingly. These can also have additional security mechanisms, eg a TPM (Trusted Platform Module). The evaluation of the data can also be carried out cooperatively by several network participants.

The collection and evaluation of the data can take place periodically or dynamically, in particular to reduce the required storage space when a need is identified. A storage of the data makes it possible to carry out an analysis of the origin also for past messages, if a suspected cyber attack on the network exists. Real-time capture and computation are optimal for responding to attacks as quickly as possible.

The acquired data can be stored individually in each control unit, in one or more network monitoring units or also network-externally. In an advantageous embodiment, the data is stored at various locations to make it difficult to attack the data. In the case of a vehicle network, the data may also be vehicle-external, e.g. stored on a server. This has the advantage that an evaluation and reaction can also take place for other vehicles or from a superordinate location and that the data in a cyberattack on the vehicle can not (easily) be the subject of the attack.

Will a message in step 203 classified as harmless, becomes step 204 branches and the message can be transmitted and evaluated without countermeasures in the network. From step 204 can in step 202 be branched and carried out for further message transmissions data acquisition and analysis. Additionally or alternatively, after a branch to step 207 the collected data is used to adapt or refine the model or fingerprints. This can also help detect potential attacks where the individual messages are not harmful, but in their entirety can be detrimental. This may be useful because physical characteristics may also change over time, eg due to aging effects. From step 207 will be back in step 201 branched.

If a message is considered to be of concern, ie as part of a cyberattack, it is counted out of step 203 in step 205 branched. There appropriate countermeasures or reactions are triggered. In a particularly preferred embodiment, the countermeasures or reactions are specially adapted on the basis of the recognized origin of the message.

In response, further transmission (especially in a real-time response) or at least further evaluation of a message may be prevented, e.g. by transmitting dominant signals (which make the message illegible or at least erroneous, e.g., by overwriting a validation sequence) on a message channel, or send an error frame immediately following the message. These reactions can also be shaped depending on where the news came from.

As a further countermeasure, alternatively or additionally, (presumably) corrupted network subscribers can be removed from the network (in particular deactivated), in particular the network subscriber identified as sender of the message, or network subscribers from the network segment identified as the origin of the message , Likewise, transmission links over which the message was transmitted can be blocked. Furthermore, messages to gateways between particular networks or network segments may be blocked in order to avoid spreading an attack on neighboring or additional networks or network segments.

For example, the network in a vehicle may be divided into logically and / or physically separate segments. For example, the network segment to which a head unit of the vehicle is connected may be separated from another network segment via a gateway, the further network segment being used by safety-critical control devices (for example for engine control, for ABS or ESP functions). If such gateway, which separates two network segments, identifies characteristics of the transmission or corresponding fingerprints as the source of a message in one of the segments which can not be manipulated by an attacker via software, then targeted messages from this gateway (and thus from the other Network segment) or the gateway itself can be deactivated immediately. Thus, a safety-critical network segment can be protected from the effects of an attack on another network segment. Another countermeasure can also be the switching off of the supposed recipient of the message. In addition to a complete deactivation, it is also possible to switch over to a mode of operation with reduced functionality, e.g. an emergency run.

Finally, alternatively or additionally, warning signals or error reports can be transmitted within the network or external to the network, which contain the detected attack and preferably the determined origin.

In the following step 207 In turn, the model or fingerprints can be adjusted or refined on the basis of the recorded and evaluated data.

Changing the hardware of a network or its components may require the fingerprints to be customized or re-learned. This can e.g. Be the case at a workshop visit (exchange, change, addition or removal of a component) or by aging the system. Preferably, the system-wide fingerprints are adapted or re-learned, since such changes often have an effect on the fingerprints of other components or segments. Such a fitting or learning process may start automatically, e.g. even if the system automatically detects a change in characteristics. Alternatively, such an adjustment process can also be initiated by an authorized agency.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• WO 2012159940 A2 [0002]
• EP 2433457 B1 [0003]

Claims (13)

A method of protecting a network (1) from cyber attack, whereby bits or bifolges of messages in the network (1) are transmitted over different levels on a transmission path of the network (1), characterized in that for a first transmission of a message in the network Network (1) at least one duration of at least one of the different levels is determined, the at least one duration or a derived quantity is compared with at least one predetermined size and is detected in dependence of the comparison of cyber attack on the network (1) or the cyber attack on the network (1) is located in the network (1). Method according to Claim 1 , characterized in that the at least one predetermined size represents a characteristic of a particular network participant (103) duration of the at least one level or a variable derived therefrom. Method according to one of the preceding claims, characterized in that a ratio between different levels, in particular between dominant and recessive levels, is determined and compared with at least one predetermined ratio of levels. Method according to one of the preceding claims, characterized in that the network (1) is a CAN bus system. Method according to one of the preceding claims, characterized in that the network (1) is a vehicle-internal network and the vehicle-internal attack point of a cyberattack from vehicle-external to the network is located. Method according to Claim 5 , characterized in that the determination of the at least one duration and / or the comparison of at least one vehicle control device (101, 102), which is connected to the network, are performed. Method according to Claim 5 Characterized in that the determination of at least one time and / or the comparison with the at least one fingerprint of at least a specially provided for monitoring network subscriber (103) or from a connected external to the vehicle computing unit are performed the. Method according to one of the preceding claims, characterized in that via hardware selection for network subscribers or their components or via hardware manipulation of network subscribers or their components, a variability of characteristic level intervals between network subscribers in the network (1) is enhanced. Method according to one of the preceding claims, characterized in that in a detected cyber attack error handling, in particular a cancellation of the transmission of the message, a marking of the message as invalid, an exclusion of the localized attack point from the network (1), deactivating a gateway the network (1) to disconnect a localized point of attack of the network from other parts of the network (1), or send a detected manipulation warning message. Method according to Claim 9 , characterized in that the error handling is carried out specifically for a localized network participant (101, 102, 103), a localized network segment or for a localized transmission path of the network (1). Device which is set up as a subscriber (101, 102, 103) on a network (1) a method according to one of Claims 1 to 10 perform. Computer program, which is adapted to a method according to one of Claims 1 to 10 perform. Machine-readable storage medium with a computer program stored thereon Claim 12 ,

Images