DE102022116976A1 - Procedure for reporting an attack - Google Patents

Abstract

The invention relates to a method for indicating an attack (12) on a computer system of a vehicle (2), whereby in the event that the computer system is attacked, the attack (12) is detected, with a main message containing information about this attack ( 12) is encrypted and transmitted from the own vehicle (2) via electromagnetic waves to at least one third-party vehicle (18) and from there to a control center (8), the encrypted main message being decrypted by the control center (8).

Description

The invention relates to a method for indicating an attack and a system for indicating an attack.

A motor vehicle can be physically attacked if it is broken into by an unauthorized person. However, it is also possible to attack a network for processing vehicle data, for example via a hacker attack.

The publication US 2020/128409 A1 describes a system for detecting attacks on a vehicle network.

A system for intrusion detection into a vehicle network is in publication DE 10 2018 122 143 A1 described.

From the publication US 2019/071056 A1 a system for intrusion detection for a vehicle is known.

Against this background, it was a task to adequately protect a vehicle against a hacker attack.

This task is solved by a method and a system with the features of the independent patent claims. Embodiments of the method and the system emerge from the dependent claims and the description.

The method according to the invention is for indicating an attack, for example a hacker or cyber attack, on a computer system, for example a software and/or computer system, of a vehicle as a vehicle that has at least one computing unit, usually several connected to one another Has computing units, provided. In the event that the computer system is attacked, the attack is usually detected using sensors, with a main message containing information about this attack being encrypted and/or anonymized in the own vehicle and sent from the own vehicle via electromagnetic waves to at least one third-party vehicle as a further vehicle and from there is transmitted to a central office, whereby the anonymized main message is decrypted and processed by the central office.

Furthermore, it is possible for the control center to inform an owner and/or a driver of the vehicle or transmit the information about the attack based on the main message, with a corresponding follow-up message being sent to a terminal device, for example a smartphone, of the owner and/or the is transmitted to the driver on which software or application (app) intended for this purpose is installed. It is possible for the main message of the own vehicle to be received by only one third-party vehicle or by several third-party vehicles and forwarded by the respective third-party vehicle either to the headquarters directly and/or indirectly to the headquarters via at least one other third-party vehicle.

In one embodiment, the information about the detected attack in the vehicle is processed according to an IDS or intrusion detection system or attack detection system standard and standardized and/or formatted or prepared accordingly as data, for example IDS data. The corresponding data about the attack as an event is made available via the IDS of the main message and transmitted via the communication path described. It is possible that the owner and/or driver of the vehicle must agree to the use of such data.

Cryptographic encryption of the main message prevents the main message from being analyzed during transmission via the at least one third-party vehicle to the control center. Corresponding secrets for anonymization and/or encryption are available or stored in the vehicle, for example in a Key Management System (KMS). Anonymity of the main message is only resolved or removed in the headquarters as a backend. The owner and/or driver must agree to a corresponding pairing to decrypt the main message.

It is possible for the data to be compressed for the main message to be transmitted, with only a part, for example a subset or a subset, of the prepared standardized information about the attack being incorporated into the main message, with a quantity of data to be transmitted Data is reduced before the main message is anonymized and sent to at least one third-party vehicle. In addition, it is conceivable that all or all of the information that is set according to IDS is incorporated into a standard message that is transmitted directly to the control center by the vehicle, for example via mobile communications or WLAN. However, since there is a risk that an attacker will try to disrupt a direct communication path between the vehicle and the control center and thus the transmission of the standard message with all information about the attack to the control center, at least a reduced data packet with the subset can be sent indirectly via the main message be transmitted to the headquarters. The headquarters usually carries out an IDS evaluation of the information ations carried out. This increases the depth of observation and enables better analysis of security incidents.

It is also possible for the main message of the own vehicle, which is received by the at least one third-party vehicle, to be combined by the third-party vehicle with a signaling message that indicates an attack on a vehicle, i.e. any vehicle, usually generally and/or fundamentally becomes. In contrast to general information in the signaling message, which usually informs in principle that an attack has occurred, the information in the anonymized main message provides details about a position or whereabouts of the own vehicle and about the attack that is taking place and/or has occurred known to this own vehicle and/or to the own vehicle. In order to provide the signaling message by a respective third-party vehicle, standardized data, for example IDS data, of the third-party vehicle, which generally provides information about the existence of an attack, is anonymized. The main message of the own vehicle and the standard message of the respective third-party vehicle are combined and transmitted from the third-party vehicle to the control center, from which the data is decrypted and analyzed.

It is provided in one embodiment that the main message is transmitted from the own vehicle to the at least one third-party vehicle via radio technology, which has a radio range of approximately 1 m to approximately 100 m or approximately 200 m and is energy-saving. The main message is sent, for example, via Bluetooth, via mobile communications, for example the mobile communications standard LTE (Long Time Evolution, for example LTE-Advanced), BTLE (Bluetooth Low Energy) and/or via near-field communication as a communication connection or communication path from the vehicle to the vehicle at least one third-party vehicle is transmitted. The indirect transmission of the main message via the at least one third-party vehicle to the headquarters is an alternative to an otherwise direct transmission from the own vehicle to the headquarters. The procedure is suitable, among other things, also for an own vehicle that is outside of an otherwise conceivable direct V2X or vehicle(V)-to-infrastructure(X) communication and thus direct communication between the own vehicle and the headquarters as infrastructure.

Furthermore, the main message is transmitted from the at least one third-party vehicle to the headquarters via a higher-bandwidth communication connection, for example WLAN or mobile communications; the same also applies to the optionally provided standard message of the own vehicle and/or the signaling message of the respective third-party vehicle, which is transmitted to the headquarters or become.

Furthermore, a maximum existence time or lifetime is set, specified and/or defined for the main message, with the main message having the lifetime set for this purpose, it being possible that the main message is usually automatically deleted in one embodiment as soon as the lifetime has expired. The main message includes a validity in time units, typically in hours, and/or a validity of a number of hops or stations that are passed through, here usually a number of external vehicles via which the main message is transmitted starting from the own vehicle. The main message has the lifetime or a lifespan to ensure that not all third-party vehicles that belong to a fleet and/or are in the reception area for the main message receive the main message and are therefore bothered. The validity information is part of the main message. The main message is cryptographically secured against alteration. It also includes information about a current location of the own vehicle and/or the location, usually the location, where the own vehicle is or has been attacked, this information being provided, for example, via a satellite-based global positioning system (GPS). Furthermore, it is possible that such information about the whereabouts is blurred for data protection reasons. At least one message to be transmitted or transmitted here in addition to the main message, here the follow-up message and/or the standard message, is/are cryptographically encrypted. Depending on the version, the signaling message is unencrypted, as it usually only reports a general attack, or cryptographically encrypted.

The system according to the invention is designed to indicate an attack, for example a hacker or cyber attack, on a software and/or computer system as a computer system of a vehicle, the system having at least one anomaly detection sensor, for example an attack detection sensor. Sensor, an encryption unit, a communication device of the vehicle and a control center. If the computer system is attacked, the at least one anomaly detection sensor is designed to detect the attack, with the encryption unit being designed to encrypt a main message with information about this attack in the vehicle and thereby anonymize it. The communication device of the vehicle is designed to be the main one to transmit a message via electromagnetic waves to at least one third-party vehicle, wherein a communication device of the third-party vehicle is designed to receive the main message and to transmit it to the control center, for example a communication device of the control center, which is designed to decrypt the anonymized main message and to process and automatically report the attack to an owner of the vehicle.

The main message is usually generated by a message unit provided for this purpose and cryptographically encrypted by an encryption unit, it being possible for the message unit and the encryption unit to be designed as components of the software and/or computer system or as components of a notification system independent thereof, the presented one System is designed as a component of the system presented. The at least one anomaly detection sensor, for example an IDS and/or anomaly sensor, is designed to monitor a behavior of the software and/or computer system of the vehicle and its behavior and/or a behavior of data from the software - and/or computer system and to record or detect any attack that may be present. The information or corresponding data from the at least one attack sensor is processed and/or consolidated by the communication unit in the vehicle, with the data being reduced to a subset of the total data provided by the at least one anomaly detection sensor.

It is possible to carry out an embodiment of the presented method with an embodiment of the presented system. A distributed transmission of IDS data via a vehicle-implemented and/or vehicle-internal relay system is possible starting from the vehicle. The relay system receives a respective message, i.e. the main message, stores, for example temporarily stores, this in time units in accordance with the validity described above, additionally checks the lifespan of the main message and either sends it via the addressed near-field communication to the at least one third-party vehicle or prepares the main message accordingly IDS as a standard message, with an IDS message being provided from the main message. In addition, the main message has a UUID (Universal Unique Identifier) and therefore a number, for example a 128-bit number, to identify the main message, which acts as a backend in the headquarters to prevent the headquarters from being flooded with too many main messages becomes. Furthermore, the relay system is designed to recognize main messages transmitted and/or received twice or multiple times in a timely manner using the UUID.

The described communication devices of the own vehicle, the at least one third-party vehicle and the control center for transmission and/or transmission, i.e. for the respective sending and/or receiving of the main message and possibly a signaling message, form a communication system with very low power consumption. In principle, the communication devices of the communication system can control the quality of the transmission of messages, i.e. the main message and the standard message, and can therefore also independently detect disruptions in the communication channels. The main message is transmitted from the own vehicle to at least one third-party vehicle whose communication devices are within radio range.

The software and/or computer system is a mobile computer system, for example with a multi-stage structure, in which a certain limited amount of data can be stored. A respective communication device is designed for communication, typically via mobile radio, Bluetooth and/or WLAN. The control center as a backend is designed to evaluate the status of at least one own vehicle, possibly an entire fleet or a group of vehicles, for example own vehicles.

It is understood that the features mentioned above and those to be explained below can be used not only in the combination specified in each case, but also in other combinations or alone, without departing from the scope of the present invention.

• 1 zeigt in schematischer Darstellung eine Ausführungsform des erfindungsgemäßen Systems beim Durchführen einer Ausführungsform des erfindungsgemäßen Verfahrens.

The invention is shown schematically using embodiments in the drawing and is described schematically and in detail with reference to the drawing.

• 1 shows a schematic representation of an embodiment of the system according to the invention when carrying out an embodiment of the method according to the invention.

The embodiment of the system according to the invention for indicating an attack 12, for example a hacker or cyber attack, on a software and/or computer system as a computer system of a vehicle 2 comprises at least one anomaly detection sensor 4, an encryption unit 5 and a communication device 6 of the own vehicle 2 and a control center 8, for example a facility with a server.

If an attacker 10 attacks the computer system of the vehicle 2 with his attack 12 fen, it is provided that this attack 12 is detected by the at least one anomaly detection sensor 4 and information about it is sent directly to the communication device 6 in a standard message via a direct, for example usual and/or standard, communication connection 14 Central 8 transmitted, received and processed by the central office 8. However, there is a risk that the attacker 10 will continue to try to disrupt and/or interrupt this direct communication connection 14 by setting up a fault 16.

In the embodiment of the method according to the invention, it is provided that at least part or a subset of the information or corresponding data from the anomaly detection sensor 4 is encrypted and anonymized by the encryption unit 5. A corresponding encrypted main message, which includes at least the subset of the data, is transmitted to a communication device 20 of a third-party vehicle 18 via a first communication connection 22, for example a first partial communication connection 22. Furthermore, the main message is transmitted from the communication device 20 via a second communication connection 24, for example a second partial communication connection 24, to the control center 8, where it is decrypted and evaluated or analyzed and processed, whereby it is possible for an owner of the own vehicle 2, who may be in a different location than his own vehicle, is informed by the control center 8 about the attack 12, with the control center 8 sending an information message to the owner's terminal for this purpose.

In one embodiment, it is not clear to the communication device 20 of the third-party vehicle 18, which receives the encrypted main message anonymously, due to the encryption, which own vehicle 2 it could be and at what location it is, since all further details are encrypted and only can be decrypted by the control center 8. In this case, a signaling message is additionally generated by the communication device 20 of the third-party vehicle 18, which explicitly refers to the fact that an attack is being carried out and/or has been carried out on a vehicle, thereby emphasizing the importance of the main message, which is now shared with the signaling message is transmitted to the control center 8 via the second communication connection 24. This signaling message can also include its own information about the third-party vehicle 18 and its location, which can also be encrypted.

It is possible that at least one of the two vehicles, i.e. the own vehicle 2 and the third-party vehicle 18, is either stationary or parked or moving. It is thus possible for the own vehicle 2 to be stationary and the third-party vehicle 18 to drive past it, with the main message being transmitted from the own vehicle 2 to the third-party vehicle 18 driving past.

In one scenario, both vehicles, i.e. the own vehicle 2 and the third-party vehicle 18, are in an electromagnetically shielded area, for example in a parking garage or an underground car park, whereby direct communication between the communication devices 6, 20 and the control center 8 is disrupted and not is possible. It is provided here that the external vehicle 18 initially stores the main message received from the own vehicle 2 if and/or as long as it is still in the shielded area. As soon as the external vehicle 18 leaves or has left the electromagnetically shielded area, its communication device 20 sends the main message and optionally also the signaling message to the control center 8. It is also possible that both vehicles are in a reception area for mobile communications, but the direct communication connection 14 of the own vehicle 2 to the control center 8 is interrupted by the fault 16.

REFERENCE SYMBOLS:

2

Own vehicle

4

Anomaly detection sensor

5

Encryption unit

6

Communication device

8th

Headquarters

10

attacker

12

attack

14

Communication link

16

Disturbance

18

Third-party vehicle

20

Communication device

22, 24

Communication link

QUOTES INCLUDED IN THE DESCRIPTION

This list of documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• US 2020128409 A1 [0003]
• DE 102018122143 A1 [0004]
• US 2019071056 A1 [0005]

Claims (7)

Method for indicating an attack (12) on a computer system of a vehicle (2), wherein in the event that the computer system is attacked, the attack (12) is detected, a main message with information about this attack (12) being encrypted and is transmitted from the own vehicle (2) via electromagnetic waves to at least one third-party vehicle (18) and from there to a control center (8), the encrypted main message being decrypted by the control center (8). Procedure according to Claim 1 , in which the information about the detected attack (12) is processed and standardized according to an IDS or intrusion detection system or attack detection system standard. Procedure according to Claim 2 , in which only part of the standardized information is included in the main message. Method according to one of the preceding claims, in which the main message from the at least one third-party vehicle (18) is combined with a signaling message indicating an attack (12) on a vehicle. Method according to one of the preceding claims, in which the main message is transmitted from the own vehicle (2) to the at least one third-party vehicle (18) via radio technology with a radio range of from approximately 1 m to approximately 200 m. Method according to one of the preceding claims, in which a maximum lifetime is set for the main message. System for indicating an attack (12) on a computer system of a vehicle (2), the system having at least one anomaly detection sensor (4), an encryption unit (5) and a communication device (6) of the vehicle (2) and a Central unit (8), wherein in the event that the computer system is attacked, the at least one anomaly detection sensor (4) is designed to detect the attack (12), the encryption unit (5) being designed to do so. to encrypt a main message with information about this attack (12), the communication device (6) of the own vehicle (2) being designed to transmit the main message via electromagnetic waves to at least one third-party vehicle (18), wherein a communication device (20) of the External vehicle (18) is designed to receive the main message and transmit it to the control center (8), which is designed to decrypt and process the encrypted main message.

Images