DE102018214587A1 - Method for checking the security of an in-vehicle communication system against attacks - Google Patents

Abstract

The invention relates to a method for checking the security of an in-vehicle communication system (10) against attacks, comprising the steps of: simulating an attack on at least one control device (14a-14d) of the in-vehicle communication system (10) by an in-vehicle attack device (12), the at least one control device (14a-14d) has one or more safety devices (16a-16d), and checking the functionality of the one or more safety devices (16a-16d) of the at least one control device (14a-14d) after and / or during the simulation of the attack.

Description

The invention relates to a method for checking the security of an in-vehicle communication system against attacks.

Furthermore, the invention relates to a communication system for a vehicle, with at least one in-vehicle control device which has one or more security devices.

In-vehicle communication systems, such as CAN bus systems, usually have control devices which can be designed as an electronic control unit (ECU). To secure the in-vehicle communication system, the control devices can have security devices such as firewalls, anomaly detection systems (ADS) or intrusion detection systems (IDS). Such systems can detect and / or prevent attacks that are based on invalid CAN messages or buffer overflows, for example.

To check the security of an in-vehicle communication system, a diagnostic mode has been used in the prior art in which a fault memory of the in-vehicle communication system or the vehicle is read out. The problem here is that attackers can also actively manipulate the error memory and / or the security devices. So far, it has not been possible to ensure without further ado that the security devices of the in-vehicle communication system work properly, that is, according to their specifications.

The object on which the invention is based is therefore to improve the checking of the security of an in-vehicle communication system.

The object is achieved by a method of the type mentioned at the outset, an attack on at least one control device of the in-vehicle communication system being simulated by an on-board attack device in the context of the inventive method, at least one control device having one or more security devices. Furthermore, the functionality of the one or more security devices of the at least one control device is checked after and / or during the simulation of the attack.

The invention makes use of the knowledge that attack simulations on vehicle-internal security devices and the reaction of security devices to correspondingly simulated attacks cannot be easily manipulated, so that attack simulations can be used to evaluate the functionality of security devices in vehicle-internal communication systems. In this way, manipulation of a control device and / or a security device caused by an attacker can be reliably determined. A corresponding manipulation can be implemented, for example, by loading malware onto the control device and / or the security device.

The one or more security devices are preferably designed as a firewall, as an intrusion detection system and / or as an anomaly detection system. The vehicle-internal attack device can be, for example, a vehicle-internal switching device, in particular a gateway device. In particular, a security self-test is carried out by the in-vehicle communication system through the attack simulation. On the basis of the method according to the invention, the vulnerability of an in-vehicle communication system can be assessed by known attacks. The simulated attack on the at least one control device can also be an attack which is directed to a network of several vehicle-internal communication systems or several vehicles, for example a vehicle fleet. The in-vehicle communication system can be, for example, a CAN bus system.

In a preferred embodiment of the method according to the invention, one or more simulable attacks are stored on the attack device. The attack device preferably has an internal memory on which known attacks can be stored. A simulable attack can also include a combination of several individual attacks or a special attack pattern. The attack patterns can include a denial of service or replay sequences.

The method according to the invention is further advantageously developed in that the simulable attacks stored on the attack device are updated. Alternatively or additionally, the simulable attacks stored on the attack device are modified and / or supplemented. In the life cycle of a vehicle, the attacks aimed at the in-vehicle communication system will change over time. So that a usable check of the security of vehicle-internal communication systems can continue to be carried out by means of the method, new and changed attacks must also be simulable by means of the attack device. Updating, Modification and / or addition is preferably carried out by accessing the attack device by means of a device external to the vehicle, in particular by means of a computer system external to the vehicle, such as a backend, or a diagnostic or test device external to the vehicle.

In another embodiment of the method according to the invention, checking the functionality of the one or more security devices of the at least one control device includes detecting the actual reaction of the one or more security devices of the at least one control device to the simulated attack and / or comparing the actual reaction of the one or more security devices of the at least one control device to the simulated attack with an expected reaction of the one or more security devices of the at least one control device to the simulated attack. The expected reaction results from the specifications of the one or more safety devices of the at least one control device. If the actual reaction of the one or more security devices of the at least one control device to the simulated attack deviates from the expected reaction of the one or more security devices of the at least one control device to the simulated attack, it can be assumed that a successful attack has already occurred the at least one control device or the in-vehicle communication system has taken place or the control device and / or the safety device does not correspond to the most current specification. The latter case can exist if an update of the control device and / or the security device, which should be installed, for example, over-the-air by the manufacturer or a third-party provider, has been prevented by an attacker. This can result in security gaps not being closed. The simulation of a corresponding attack can reliably determine whether the control device and / or the security device is up to date.
In addition, a method according to the invention is preferred, in which the comparison of the actual reactions of the one or more security devices of the at least one control device to the simulated attack with an expected reaction of the one or more security devices of the at least one control device to the simulated attack inside the vehicle and / or done outside the vehicle. If the described comparison is carried out in the vehicle, the in-vehicle communication system preferably comprises a corresponding evaluation device. In this case, it is also advantageous if the in-vehicle communication system is connected to a display device for the optical and / or acoustic display of information, so that the comparison result can be communicated to a user or a technician. For the in-vehicle comparison, it is also necessary that the evaluation device knows the expected reaction of the one or more security devices of the at least one control device to the simulated attack. It may therefore be necessary for the specifications of the one or more security devices to be transmitted to the evaluation device. If the comparison described is carried out outside the vehicle, the actual reaction of the one or more security devices of the at least one control device to the simulated attack must be sent to an evaluation device external to the vehicle. The vehicle-external evaluation device should preferably be provided with additional information on the simulated attack and on the anticipated reaction of the one or more security devices of the at least one control device to the simulated attack, so that a corresponding comparison can be carried out. For example, the described comparison is carried out by a computer system external to the vehicle, for example by a backend which is operated by a vehicle manufacturer or a third-party provider.

In a further embodiment of the method according to the invention, the actual reaction of the one or more Security devices of the at least one control device on the simulated attack are documented in the vehicle and / or in the vehicle. Alternatively or additionally, the actual reaction of the one or more security devices of the at least one control device to the simulated attack can be read out by a reading device external to the vehicle. The external readout device can be a diagnostic or test device, for example. Furthermore, the actual reaction of the one or more security devices of the at least one control device to the simulated attack on a vehicle-internal and / or on a vehicle-external memory can be stored. In addition, the actual reaction of the one or more security devices of the at least one control device to the simulated attack can be sent to a computer system external to the vehicle. The computer system external to the vehicle is preferably a backend, in particular a backend of a vehicle manufacturer or a third party.

In an advantageous development of the method according to the invention, checking the functionality of the one or more safety devices of the at least one control device leads to a test result. The test result is preferably documented inside the vehicle and / or outside the vehicle and / or read out by a reading device outside the vehicle. Alternatively or additionally, the test result is stored on a vehicle-internal and / or a vehicle-external memory and / or sent to a vehicle-external computer system. The documentation of the test result can be used to demonstrate that the method can be used to correctly identify attack patterns.

In another embodiment of the method according to the invention, the simulation of the attack on the at least one control device of the vehicle-internal communication system is initiated inside or outside the vehicle. The attack simulation can be initiated, for example, by manually entered control commands. Furthermore, the attack simulation can be initiated automatically by processes, in particular monitoring processes. When prompted by the vehicle, manual commands can be entered directly on the vehicle, for example. As an alternative or in addition, the attack simulation can be initiated by in-vehicle processes, in particular monitoring processes. When the attack simulation is initiated outside the vehicle, computer systems external to the vehicle can be used for entering commands. Alternatively or additionally, processes external to the vehicle, in particular monitoring processes, can trigger the attack simulation. The attack simulation can also be carried out regularly and / or cyclically. A regular and / or cyclical attack simulation is particularly advantageous in the case of changing functionalities of the vehicle-internal control devices, which can result, for example, from software updates. The attack simulation can also be initiated automatically when the vehicle is started and / or when a predefined vehicle state is assumed.

The object on which the invention is based is further achieved by a communication system of the type mentioned at the outset, the communication system according to the invention having an on-board attack device which is set up to simulate an attack on the at least one control device. In particular, the vehicle-internal attack device has a memory on which attacks and / or attack patterns are stored.

In a preferred embodiment of the communication system according to the invention, this is set up to carry out the method for checking the security of an in-vehicle communication system against attacks according to one of the embodiments described above. With regard to the advantages and modifications of the communication system according to the invention, reference is made to the advantages and modifications of the method according to the invention.

The invention can also be used in the context of automated industrial processes, smart home applications, smart metering systems, avionics applications or in other areas with networked infrastructures and comparatively high security requirements.

• 1 eine Kommunikationsumgebung mit einem erfindungsgemäßen Kommunikationssystem in einer schematischen Darstellung.

A preferred embodiment of the invention is explained and described in more detail below with reference to the accompanying drawing. It shows:

• 1 a communication environment with a communication system according to the invention in a schematic representation.

The in the 1 shown communication environment 100 includes an in-vehicle communication system 10 , a computer system external to the vehicle 102 and a readout device external to the vehicle 104 ,

The in-vehicle communication system 10 is a bus system and includes an attack device 12 , several, namely four, control devices 14a-14d and a playback device 18th ,

The attack facility 12 is part of an in-vehicle switching device, namely a gateway device, and is set up to attack the control devices 14a-14d to simulate.

The control devices 14a-14d are each designed as an electronic control unit (ECU) and each have safety devices 16a-16d on. The security devices 16a-16d may include a firewall, an attack detection system, and / or an anomaly detection system. The security devices 16a-16d are set up to attack the respective control device 14a-14d to recognize and preferably also to ward off.

To check the security of the communication system 10 against attacks, is by means of the attack device 12 an attack on the controls 14a-14d simulated, with the functionality of the security devices after and / or during the simulation of the attack 16a-16d the control devices 14a-14d is checked. Simulating an attack by the attack facility 12 can be arranged inside or outside the vehicle.

So by means of the attack device 12 appropriate attacks can be simulated, the attack device 12 a memory on which several simulable attacks are stored. A simulable attack can either be a single attack or a combination of several individual attacks, for example a special attack pattern. The one on the attack facility 12 Stored simulable attacks can be updated and can be modified and / or supplemented later, so that attacks and attack patterns can also be simulated, which are at the time of implementation of the communication system 10 were not yet known.

After executing a simulated attack on a control device 14a-14d is the actual response of the security device to be checked 16a-16d captured on the simulated attack. The actual response of the safety device follows 16a-16d to the simulated attack with an expected reaction of the security device 16a-16d compared to the simulated attack. The expected response of the safety device 16a-16d results from their specifications. Comparing the actual response of the belay device 16a-16d to the simulated attack with the expected reaction of the security device 16a-16d the simulated attack can take place inside and / or outside the vehicle.

If the actual response of the belay device 16a-16d to the simulated attack from the expected response of the security device 16a-16d deviates from the simulated attack, it can be assumed that a successful attack on the corresponding control device is already in progress 14a-14d has taken place and the security device 16a-16d was manipulated or a control device 14a-14d and / or a safety device 16a-16d does not meet the latest specification.

Checking the functionality of the safety device 16a-16d leads to a test result, the test result being documented internally and / or externally. For example, the test result is obtained by the reading device external to the vehicle 104 read out and / or to the vehicle-external computer system 102 Posted. The vehicle-external readout device 104 can be, for example, a portable or stationary test or diagnostic device. The computer system external to the vehicle 102 can be a backend of the vehicle manufacturer or a third party.

Corresponding attack simulations can take place when the vehicle is started, at regular or irregular time intervals and / or after updates are loaded onto a control device 14a-14d respectively.

Reference list

10

Communication system

12th

Attack facility

14a-14d

Control devices

16a-16d

Security devices

18th

Playback device

100

Communication environment

102

Computer system

104

Reader

Claims (10)

Method for checking the security of an in-vehicle communication system (10) against attacks, characterized by the steps: - Simulating an attack on at least one control device (14a-14d) of the in-vehicle communication system (10) by an in-vehicle attack device (12), the at least one Control device (14a-14d) has one or more safety devices (16a-16d); and - checking the functionality of the one or more security devices (16a-16d) of the at least one control device (14a-14d) after and / or during the simulation of the attack. Procedure according to Claim 1 , characterized in that one or more simulable attacks are stored on the attack device (12). Procedure according to Claim 2 , characterized by at least one of the following steps: - updating the simulable attacks stored on the attack device (12); - Modifying the simulable attacks stored on the attack device (12); - Supplementing the simulable attacks stored on the attack device (12). Method according to one of the preceding claims, characterized in that checking the functionality of the one or more safety devices (16a-16d) of the at least one control device (14a-14d) comprises at least one of the following steps: - Detecting the actual reaction of the one or the plurality of security devices (16a-16d) of the at least one control device (14a-14d) on the simulated attack; - Comparing the actual reaction of the one or more security devices (16a-16d) of the at least one control device (14a-14d) to the simulated attack with an expected reaction of the one or more security devices (16a-16d) of the at least one control device (14a -14d) on the simulated attack. Procedure according to Claim 4 , characterized in that comparing the actual reaction of the one or more security devices (16a-16d) of the at least one control device (14a-14d) to the simulated attack with an expected reaction of the one or more security devices (16a-16d) the at least one control device (14a-14d) takes place on the simulated attack inside the vehicle and / or outside the vehicle. Procedure according to Claim 4 or 5 , characterized by at least one of the following steps: - vehicle-internal and / or vehicle-external documentation of the actual reaction of the one or more security devices (16a-16d) of the at least one control device (14a-14d) to the simulated attack; - reading out the actual reaction of the one or more security devices (16a-16d) of the at least one control device (14a-14d) to the simulated attack by a reading device (104) external to the vehicle; - storing the actual reaction of the one or more security devices (16a-16d) of the at least one control device (14a-14d) to the simulated attack on a vehicle-internal and / or on a vehicle-external memory; - Sending the actual reaction of the one or more security devices (16a-16d) of the at least one control device (14a-14d) to the simulated attack to a computer system (102) external to the vehicle. Method according to one of the preceding claims, characterized in that checking the functionality of the one or more safety devices (16a-16d) of the at least one control device (14a-14d) leads to a test result and preferably comprises at least one of the following steps: vehicle-internal and / or vehicle-external documentation of the test result; - Reading out the test result by a reading device (104) external to the vehicle; - Saving the test result on a vehicle-internal and / or on a vehicle-external memory; - Sending the test result to a computer system (102) external to the vehicle. Method according to one of the preceding claims, characterized in that the simulation of the attack on the at least one control device (14a-14d) of the vehicle-internal communication system (10) is initiated inside or outside the vehicle. Communication system (10) for a vehicle, with - at least one in-vehicle control device (14a-14d) which has one or more security devices (16a-16d); characterized by an on-board attack device (12) which is set up to simulate an attack on the at least one control device (14a-14d). Communication system (10) after Claim 9 , characterized in that the communication system (10) is set up to implement the method according to one of the Claims 1 to 8th to execute.

Images