DE102020212452B3 - Method for reducing the impact of a message injected on a communication bus - Google Patents

Abstract

In the method according to the invention for reducing the effects of a message (EB) introduced on a communication bus (CB), a message (EB) introduced on the communication bus (CB) with corrupted data content is recognized (10). A correction message (KB), which contains the correct, unadulterated data content of the attacked message, is then generated (11) and then sent (12) on the communication bus (CB). If, in the case of several network nodes (CK1-CK3) networked by the communication bus (CB), a message transmitted via the communication bus is provided with an identifier that is only used by one of the sending network nodes for the transmission of user data and is unique for the message sent in each case , a smuggled message (EB) with falsified data content is recognized (1) by the fact that a network node (CK1-CK3) on the communication bus (CB) detects an external message for the transmission of user data with an identifier that is for its own message for transmission is reserved by user data. The identifier of the smuggled message (EB) with corrupted data content is then determined and a correction message in the form of that regular message (RB) which has the same identifier as the identified identifier of the smuggled message (EB) is sent.

Description

The invention relates to a method for reducing the effects of a message introduced on a communication bus, which can be used in particular to reduce damage in the event of unauthorized access to CAN buses in vehicles.

A large number of control units are installed in modern motor vehicles, such as the engine and transmission control unit for the drive train, door or window lifter control units, air conditioning control units, seat adjustment control units for corresponding comfort functions, or a control unit for an infotainment system in the vehicle . Bus systems are used in the vehicle to network the control units. In the course of the progressive automation of motor vehicles, the protection of the bus systems installed in the motor vehicle is becoming increasingly important. This applies in particular to the CAN bus, which is widely used for networking safety-related control units, sensors and actuators in motor vehicles, but is also used in other technical areas of application such as automation technology or medical technology.

Communication on the CAN bus takes place with so-called messages, also referred to as telegrams or frames, which are sent to the CAN bus by CAN bus components such as the control units or sensor units in the vehicle. For information that is regularly required, the messages are usually sent cyclically. Likewise, the messages can also be event-based, for example in the event of a defect in a vehicle component. In principle, the messages are not addressed to a specific addressee, rather the transmission takes place according to the broadcast principle. A control device that requires information contained in a message then accesses this message using a unique identification of the message, also known as an identifier (ID). The identifier thus identifies the content of a message, not a device, whereby there can be several recipients for an identifier, but only one sender.

In addition to normal messages, the so-called data frames, for the transmission of user data, such as in particular the control unit or sensor information, there are also so-called remote messages or remote frames in the CAN protocol, with which user data or data frames from any CAN nodes can be requested. However, these are rarely used in the automotive sector because the data transmission essentially takes place on the initiative of the control units and sensors, rather than on demand. Furthermore, so-called error frames are provided for signaling transmission errors.

A method for checking the transmission of CAN telegrams for errors and correcting transmission errors to reduce data loss and data corruption is from the WO 2011/051157 A1 known. In this case, the CAN bus is divided into at least two CAN segments, which are connected to one another by a packet-oriented network, with CAN telegrams being transmitted between the CAN segments by means of the network. A CAN telegram is sent to all other CAN interfaces via a sending CAN interface. If a CAN telegram is received from the network via a receiving CAN interface and its transmission is classified as error-free, this CAN interface sends a positive confirmation message to the sending CAN interface. However, if the sending CAN interface does not receive a positive confirmation message from at least one of the other receiving CAN interfaces within a specifiable timeout period, the CAN telegram is resent using the sending CAN interface in order to avoid a CAN telegram that was apparently incorrectly transmitted to correct.

In addition to detecting transmission errors, a suitable monitoring system can also be used to detect an external attack on a CAN bus, in which messages with incorrect signal content are injected. In addition to recognizing the smuggled messages, the reaction to such an attack is also of great importance. Various methods are known for this. In this way, smuggled messages can be rendered harmless through targeted overwriting with dominant bits. This led to the CAN controller in a sending control unit then aborting the transmission or the receiving control units evaluating the message as invalid. Such an intervention in the CAN bus, however, requires changes to the hardware of the control units, since the standard CAN bus components that have been commonly used up to now do not have such a functionality. However, there are now specialized chips on the market that can render smuggled messages unusable.

Previously known software-based surveillance systems based on standard CAN bus components cannot react immediately to an attack or destroy a smuggled message. However, it is possible to warn affected control units or functions in a suitable manner and to inform them of an attack mix In addition to special messages with a corresponding content that contains information about the attack, messages with deliberately incorrect signals can also be used. In both cases, receiver control units or functions are transferred to a safe state so that the data that has been smuggled in no longer poses a risk.

It is an object of the invention to provide an improved method for reducing the effects of a message injected on a communication bus.

This object is achieved by a method having the features of claim 1. Preferred developments of the invention are the subject matter of the dependent claims.

In the method according to the invention for reducing the effects of a message introduced on a communication bus, a message with corrupted data content introduced on the communication bus is recognized. A correction message containing the correct, unadulterated data content of the attacked message is then generated. The correction message is then sent on the communication bus.

This allows for a simple but effective software-based implementation to minimize the impact of unauthorized access to a communications bus, such as a vehicle's CAN bus.

According to one embodiment of the invention, several network nodes are networked by the communication bus. In this case, a message transmitted via the communication bus is provided with an identifier which is only used by one of the transmitting network nodes for the transmission of user data and is unique for the message sent in each case. A smuggled-in message with falsified data content is recognized by the fact that a network node on the communication bus detects an external message for the transmission of user data with an identifier that is reserved for its own message for sending user data.

In this case, the identifier of the injected message with falsified data content is advantageously determined and a correction message is sent in the form of that regular message which has the same identifier as the identified identifier of the injected message.

In this case, the correction message is preferably sent by the network nodes, which select the injected message on the basis of their identifier on the receiver side, before data acceptance of the injected message with falsified data content, and is received by these network nodes, selected and processed instead of the injected message.

The correction message is advantageously sent in such a way that it is received and processed by the network node as directly as possible before the data is accepted.

Furthermore, a sequence of several correction messages can advantageously be sent.

In this case, the sequence of correction messages preferably ends at the latest at the point in time at which the subsequent regular message is sent.

According to one embodiment of the invention, the communication bus is designed as a CAN bus on which CAN messages provided with an identifier are transmitted.

In particular, the CAN bus can be provided for the exchange of CAN messages between CAN bus components of a vehicle.

The invention also relates to a device set up to carry out a method according to any one of the preceding claims.

• 1 zeigt ein Flussdiagramm, das die grundlegenden Schritte des erfindungsgemäßen Verfahrens zur Reduzierung der Auswirkungen von einer auf einem Kommunikationsbus eingeschleusten Botschaft wiedergibt;
• 2 zeigt ein detaillierteres Flussdiagramm des erfindungsgemäßen Verfahrens;
• 3 zeigt schematisch den Zeitverlauf der Reaktion auf einen Angriff durch eine eingeschleuste Botschaft durch Versenden einer Korrekturbotschaft (A) oder einer Folge von Korrekturbotschaften (B); und
• 4 zeigt schematisch einen Kommunikationsbus mit mehreren Netzwerkknoten, bei dem das erfindungsgemäße Verfahren durchgeführt wird.

Further features of the present invention will become apparent from the following description and claims in conjunction with the figures.

• 1 Fig. 12 is a flow chart showing the basic steps of the method of reducing the impact of a message injected on a communication bus according to the invention;
• 2 shows a more detailed flow chart of the method according to the invention;
• 3 shows schematically the time course of the reaction to an attack by a smuggled message by sending a correction message (A) or a sequence of correction messages (B); and
• 4 shows a communication bus with a plurality of network nodes, in which the method according to the invention is carried out.

For a better understanding of the principles of the present invention, the following exemplifications tion forms of the invention explained in more detail with reference to the figures. It goes without saying that the invention is not limited to these embodiments and that the features described can also be combined or modified without departing from the protective scope of the invention as defined in the claims.

1 shows schematically the basic steps for the method according to the invention for reducing the effects of a message introduced on a communication bus. The method is described below using the example of an external attack on a CAN bus in which messages with incorrect signal content are injected. Such an attack can take place, for example, using a CAN bus adapter if the attacker has access to the CAN bus of the motor vehicle. Instead of gaining physical access to the vehicle, this can also be done with a so-called "connected car", which can connect to the Internet with its own mobile phone and/or WLAN unit, for example to connect to a backend server of the manufacturer connect, done by accessing the CAN bus via the mobile radio or WLAN unit and the vehicle's internal gateway. However, the method can also be used to defend against attacks on other communication buses.

The method can be started, for example, when the ignition of the motor vehicle is switched on. A CAN bus monitoring system monitors the bus traffic. In this case, this monitoring system can be implemented in a decentralized manner on the various network nodes as a standardized software component. In method step 10, the monitoring system then initially recognizes the attack with the smuggled-in message, for example based on the use of an identifier reserved for a network node to transport data through a message that has not been sent by the respective network node.

If the monitoring system has recognized a message that has been smuggled in, then in method step 11 a correction message is generated. In this case, this correction message corresponds to that regular CAN message which corresponds to the identified identifier of the introduced message with falsified data content and thus contains the correct, unadulterated data content of this regular CAN message.

The correction message is then sent in method step 12 on the communication bus. By ensuring that the correction message is received by these network nodes before data acceptance of the injected message by the network node, which selects the injected message on the basis of its identifier on the recipient side, the correction message is then processed instead of the injected message. In this way it can be prevented that the wrong signal contents of the injected message can lead to the execution of vehicle functions which, although intended by the attacker, represent a potential danger for the vehicle occupants and the vehicle environment.

2 shows a more detailed flow chart of the method according to the invention. First, a monitoring module is activated in a CAN bus component, for example in a control unit. Provision can be made here for the monitoring module to be switched inactive during the time in which the CAN bus component itself is sending a message via the communication bus and to be switched active during the time in which these messages are being received from the communication bus. Since no other messages can be transmitted via the communication bus during transmission, switching the monitoring module to inactive does not pose a security risk.

In method step 20, the identifier of this message is then determined for each message received via the CAN bus. The monitoring module then checks the identified identifier in method step 21 to see whether this message is marked with an identifier that is used by the CAN bus component itself when sending messages with user data. A CAN matrix or a special transmission table can be used for this purpose, in which all identifiers that are used by the CAN bus component when user data is transmitted are listed. As long as no message with its own identifier is detected here, the monitoring of the communication bus is continued in order to also determine and check the identifier for subsequent messages.

If it is determined that the identifier of a received message matches an entry in the transmission table, in a subsequent optional method step 22 it can first be checked whether it is a remote frame, which may have been sent by another CAN bus component to request data was sent. As already mentioned, the remote function is hardly used in the automotive industry and is even forbidden by some car manufacturers, but the remote function can certainly be used in other technical areas. This can be at a set RTR ("Remote Transmission Request") bit of the message be recognized. If it is actually a remote frame, it is not rendered unusable by sending a correction message. However, the monitoring of the communication bus continues even after receiving a message with the RTR bit set, in order to prevent an attacker from first sending a remote frame and then injecting the response.

Subsequent to method step 21 or if it is recognized in the optional method step 22 that it is not a remote frame, it can be assumed that it is a smuggled message. A correction message is then sent in the subsequent method step 23 as a countermeasure in order to make the injected message ineffective immediately after it has been transmitted.

Provision can be made here for a sequence of correction messages to be sent before the next regular message is sent by the CAN bus component. For this purpose, it can be checked in the subsequent method step 24 whether the point in time for sending this subsequent regular message has already been reached. In the case of messages transmitted cyclically via the bus, it can be checked whether a timer provided for this purpose has already expired or will expire shortly. As long as this is not the case, further correction messages can then be sent.

3 shows the time course of the reaction to an attack by a smuggled message. After a regular message RB, which was sent to the bus by a control unit of a motor vehicle such as an engine control unit, for example, a message EB with incorrect data content is introduced into the CAN bus _{at time t 0 .}

If the monitoring system then recognizes the attack with the injected message EB using an identifier reserved for the respective network node, it responds at time t ₁ by sending a correction message KB, as in 3A shown. In this case, the correction message KB contains the current and correct data for the corresponding message with the identified identifier instead of the forged data. At time t ₂ the receiver function, for example of a further control device, then reads in the correct data content in accordance with the correction message KB. The smuggled message thus remains ineffective. In this case, it is optimal if the correction message is sent immediately before the data is accepted by the receiver function, since then the receiver function can no longer accept incorrect signals from an infiltrated message.

Sending a single correction message hardly increases the bus load on the CAN bus. However, it can also be advantageous to send a sequence of correction messages, for example in order to reduce the risk of another attack if an attack is detected. This is in 3B shown. In this case, after a first regular message RB ₁ and the injected message EB, a sequence of correction messages KB ₁ , KB ₂ , KB ₃ , KB _{4 is} sent. This sequence of correction messages ends at the point in time t ₃ at which the following regular message RB _{2 is} sent.

Whether only a single correction message or a sequence of correction messages is sent can be decided, for example, depending on the cycle time, the probability of an impending attack or the importance of the respective regular message.

4 shows schematically a CAN bus CB, in which the method according to the invention is carried out, with several CAN bus components or network nodes CK ₁ - CK ₃ . The CAN bus components CK ₁ - CK ₃ can represent a wide variety of electronic components such as in particular control devices, sensors, actuators, which exchange data with one another via their respective CAN interfaces and the CAN bus CB. In this case, a CAN interface is composed of communication software SW and communication hardware HW, which includes a CAN controller and a CAN transceiver.

As part of the communication software SW, the CAN bus component CK ₁ is provided a monitoring module UE, which performs the monitoring of the messages described above to the CAN bus CB and causes the sending of correction messages. Such a monitoring module UE can be provided as a standardized software component in each of the CAN bus components connected to the CAN bus or can be loaded in the case of a secure update of the firmware. However, it is also possible to provide only one or selected of the CAN bus components with such monitoring modules.

The method according to the invention is not limited to the CAN bus, but can also be used in other communication bus systems in which messages with a specific identifier are only sent by a specified transmission unit.

Reference List

10-12, 20-24

process step

RB

regular message

EB

smuggled message

KB, KB1 - KB4

correction message

CK1 - CK3

CAN node

cb

CAN bus

SW

communication software

hw

communication software

UE

monitoring module

Claims (8)

Method for reducing the effects of a message (EB) smuggled in on a communication bus (CB), wherein a plurality of network nodes (CK1 - CK3) are networked by the communication bus (CB) and a message transmitted via the communication bus (CB) is provided with an identifier , which is only used by one transmitting network node of the plurality of network nodes (CK1 - CK3) for the transmission of user data and is unique for the message sent in each case; in which - a message (EB) with falsified data content introduced on the communication bus (CB) is recognized (10) by the fact that a network node (CK ₁ - CK ₃ ) on the communication bus (CB) has received a foreign message for the transmission of user data with a Identifier recorded that is reserved for a separate message for sending user data; - the identifier of the injected message (EB) with falsified data content is determined and a correction message (KB) containing the correct, unadulterated data content of a message with this identifier is generated (11); and - the correction message (KB) is sent (12) on the communication bus (CB) in the form of that regular message (RB) which has the same identifier as the identified identifier of the introduced message (EB). procedure after claim 1 , the correction message (KB) being sent before a data transfer of the smuggled message (EB) with corrupted data content by respective receiver functions of the network nodes (CK ₁ - CK ₃ ), which select the smuggled message (EB) on the recipient side on the basis of their identifier and received by these network nodes (CK ₁ - CK ₃ ), selected and processed instead of the introduced message (EB). procedure after claim 2 , wherein the correction message (KB) is sent in such a way that it is received and processed _{by the respective receiver function of the network node (CK 1} - CK ₃ ) as soon as possible before the data transfer of the introduced message (EB) with corrupted data content. Method according to one of the preceding claims, in which a sequence of a plurality of correction _{messages (KB 1} - KB ₄ ) is sent. procedure after claim 4 , the sequence of correction _{messages (KB 1} - KB ₄ ) ending at the latest at the point in time at which the following regular message (RB) is sent. Method according to one of the preceding claims, in which the communication bus (CB) is designed as a CAN bus on which CAN messages provided with an identifier are transmitted. procedure after claim 6 , The CAN bus for the exchange of CAN messages between CAN bus components (CK ₁ - CK ₃ ) of a vehicle is provided. Apparatus arranged to carry out a method according to any one of the preceding claims.

Images