EP2540053A1

EP2540053A1 - System and method for preventing an attack on a networked vehicle

Info

Publication number: EP2540053A1
Application number: EP11703708A
Authority: EP
Inventors: Roland Dietz; Rainer Falk; Hans-Joachim Hof; Franz Stadler
Original assignee: Continental Automotive GmbH
Current assignee: Continental Automotive GmbH
Priority date: 2010-02-22
Filing date: 2011-02-17
Publication date: 2013-01-02
Also published as: CN102893574B; DE102010008816A1; US9843926B2; WO2011101414A1; CN102893574A; US20130104186A1

Abstract

The invention relates to a system for preventing an attack on a networked vehicle via a wireless communication device of a vehicle. The system comprises a wireless data traffic network and a security status determination unit for controlling the access to the wireless data traffic network depending on a determined security status, wherein the security status is based on an evaluation of a current configuration of the vehicle and/or on log data of the vehicle and/or on time that has passed since an update of relevant software. The system further comprises a communication device which is suitable for connection to the wireless data traffic network and an access control device for controlling the network access to the wireless data traffic network, which access control device can be connected to the security status determination unit. The invention further relates to a method for a system for preventing an attack on a networked vehicle via a wireless communication device of a vehicle, wherein a security status is determined, wherein the security status is based on an evaluation of a current configuration of the vehicle and/or on log data of the vehicle and/or on time that has passed since an update of relevant software. The method also comprises the determination of a network access rule set for the access to the data traffic network on the basis of the determined security status, said rule set being subsequently activated.

Description

description

SYSTEM AND METHOD FOR PREVENTING AN ATTACK TO A NETWORKED VEHICLE

The invention relates to a system for preventing an attack on a networked vehicle via a wireless communication device of a vehicle according to the preamble of patent claim 1 and a corresponding method.

10 State of the art

Vehicles are turning into increasingly complex systems that use different types of content, such as Current weather and traffic data, music, movies, point-of-interest information, software updates or remote diagnosis via one or more

15 wireless connections can load from one or more data networks.

For the wireless connection, a communication interface (Communication Box, ComBox) can be installed in vehicles

20, which has one or more radio standards (eg GSM / GPRS,

EDGE, UMTS, HSDPA, LTE, WLAN, WiMAX, ...). Thus, the vehicle or components of the vehicle, such. As an infotainment system, infrastructure servers, other vehicles (car-2-car communication) or the roadside

25 established radio beacons (Road Side Units) communicate and

load from this content.

Through this wireless communication vehicles are opened to the untrustworthy outside world, and so are

30 attacks exposed via the communication interface.

Therefore, networked vehicles need protective measures that

Prevent attacks on the vehicle via the communication interfaces.

35

From the prior art devices are known which

Receive external connections to internal control units. te forward, perform a cryptographic communication and are externally programmable.

When retrieving data from the vehicle, however, these devices are not suitable to provide protection.

Furthermore, systems are known which determine an update status online. However, these systems only determine an update status after a connection has already been established and, in principle, are not suitable for preventing access to contents from the vehicle before the update status has been checked.

task

The object of the present invention is therefore to provide a system and a method which is suitable for preventing an attack on a networked vehicle via a wireless communication device and thereby solving one or more disadvantages of the prior art.

According to the invention, a system for preventing an attack on a networked vehicle via a wireless communication device of a vehicle is provided. This system comprises a wireless traffic network, a security status determination device for regulating access to the wireless traffic network in dependence on a determined security status, the security status being based on an evaluation of a current configuration of the vehicle and / or log data of the vehicle and / or. or based on an elapsed time since an update of a related software. Furthermore, the system has a communication device suitable for connection to the wireless traffic network and an access control device for regulating network access to the wireless traffic network, which is connectable to the security status determination device on. Furthermore, the invention also relates to a method for a system for preventing an attack on a networked vehicle via a wireless communication device of a vehicle, wherein a safety status is determined based on an evaluation of a current configuration of the vehicle and / or log data of the vehicle and / or based on an elapsed time since an update of any relevant software. Furthermore, the method has the determination of a network access rule set for access to the data traffic network on the basis of the determined security status, which is subsequently activated.

Training of the system according to the invention according to claim 1 and a method according to claim 9 are the subject of the respective dependent claims.

The invention will be explained below by way of example with reference to the drawing. However, the invention is not limited to the illustrated embodiment.

In these pictures shows:

1 is a schematic representation of an embodiment of a system according to the invention,

2 shows a detail of a possible arrangement of he inventive components based on an in-vehicle bus system,

3 shows an exemplary method according to the invention according to a first embodiment,

4 shows a further exemplary method according to the invention according to a second embodiment,

5 shows a further exemplary method according to the invention according to a third embodiment, 6 shows a further exemplary method according to the invention according to a fourth embodiment,

7 shows a message flow according to the invention according to egg ner embodiment of the invention,

Fig. 8 is a schematic representation of another imple mentation of a system according to the invention.

Figure 1 shows a vehicle having an on-board unit (OBU), which is connected via a communication device using different mobile radio systems, eg. UMTS, LTE, GPRS, WiMAX, WLan, can communicate with infrastructure servers in an exemplary data network.

An exemplary infrastructure server may e.g. B. a download server (DL), the downloads z. B. for music offers. Another InfrastructureServer can, for. A vehicle management server (VM) that configures and monitors the vehicle, e.g. For example, to diagnose or import software updates. Yet another Infrastructure Server may be a Vehicle Online Services Server (VOS) that provides online services, e.g. B. current weather and traffic information provides.

Furthermore, a Vehicle Security Status Evaluation Server (VSSES) can be provided, which provides a vehicle information about its security status.

In addition, the vehicle or the OBU can communicate with other vehicles or OBUs via car-2-car communication (C2C) or with a permanently installed road side unit (RSU). Figure 2 shows a section of a possible arrangement of components according to the invention with respect to an in-vehicle bus system. Transceiver units are connected to an exemplary communication device (ComBox) in order to be able to use different radio systems (UMTS, HSDPA, WLAN, broadcast, WAVE (C2C)). Via an exemplary Ethernet vehicle bus, an infotainment system with an exemplary head unit, as well as by way of example with two units for the rear seats, so-called rear seat entertainment (RSE1, RSE2), is connected. Instead of Ethernet here could also z. As MOST, Flexray or any other suitable bus can be used.

Via a gateway (GW) two ECUs ECU1, ECU2 are connected via another protocol, eg. For example, the CAN protocol can communicate.

The ComBox can have a Network Access Enforcement Engine (NAEE) that limits or affects the communication between "outside" and "inside". This is done according to a current network access rule (AOAP = Active OTA Access Policy). This network access policy set (AOAP) is selected or defined by a Network Access Policy Selection (NAPS) selection function, which may be dependent on the result of the security self-evaluation (SSE). Furthermore, the network access rule set can also depend on further parameters.

The ComBox may include a Network Access Control Policy Enforcement Unit that restricts network traffic from / to "outside," ie, to the transceiver units, and may perform an evaluation of security status determine a security rule set that you activate and enforce can put. Furthermore, it can optionally also change the configuration of network communication filters (firewall functions) of other components of the vehicle via a control command. In particular, it can change a network communication filter of the gateway (GW), a unit of the infotainment system (HU, RSE1, RSE2) or a radio module accordingly.

FIG. 3 shows an exemplary method according to the invention according to a first embodiment. In this case, the method is started in step 100. The process can be started by numerous events. So z. B. be provided that when you turn on the ignition, when you start the vehicle engine, when you turn on / activate the infotainment system when connecting (activation of the ComBox), or even after a configuration change / software update or even regularly, for. B. Scheduled (eg every hour) the process is started.

Subsequently, the current vehicle security status is determined in a step 300. On the basis of the determined vehicle security status, a network access rule set is determined in step 400, which is activated in step 900. Subsequently, the method terminates in step 1000. In the method described above, all steps can proceed autonomously in the vehicle and be arranged in a corresponding manner in the ComBox or the OBU.

This makes it possible for security to be checked even before a communication is established and thus before a potential source of danger is contacted, and communication is not even permitted in the case of doubt.

In a further preferred embodiment, a network access rule set "NULL" / "CLOSED" / "DENY ALL" can be explicitly activated immediately after the start in step 100 in a step 200, not illustrated here, in order to eliminate any OTA Prevent communication prior to activation of the determined network access rule set in step 300.

FIG. 4 shows an exemplary method according to the invention according to a second embodiment. In this case, the method is started in step 100.

In step 500, an initial network access rule set is activated. Thereafter, the current configuration of the vehicle and / or log data of the vehicle and / or the elapsed time since an update of a respective software to an evaluation server (VSSES) for determining the security status are transmitted in a step 600. The result of the determination of the security status is received in step 700, whereupon in a step 800 a suitable network access rule set is determined. The particular network access policy set is then activated in step 900. Subsequently, the method terminates in step 1000. In this variant, an evaluation takes place on an external server. Thus, the method may be referred to as server-assisted evaluation.

Only if the local security status check determines as a result a minimum level of security in the result will the server-assisted security evaluation be continued.

FIG. 5 shows yet another exemplary method according to the invention according to a third embodiment. In this case, the method is started in step 100.

Immediately after the start, a network access rule set "NULL" / "CLOSED" / "DENY ALL" can be explicitly activated in step 200 in order to prevent any OTA communication for the time being before the activated network access rule set is activated Current vehicle security status determined in a step 300. On the basis of the determined vehicle security status, it is determined in step 400 whether minimum safety requirements have been met. If the requirements are not fulfilled, the method terminates in step 1000.

In the event that the minimum requirements are met, the method continues as previously described with reference to FIG. h., in step 500, an initial network access rule set is activated.

Thereafter, current configuration of the vehicle and / or log data of the vehicle and / or an elapsed time since an update of a respective software is transmitted to an evaluation server (VSSES) for determining the safety status in a step 600. The result of the determination of the security status is received in step 700, whereupon in a step 800 a suitable network access rule set is determined. The particular network access rule set is then activated in step 900. Subsequently, the method terminates in step 1000.

This embodiment can be referred to as a multi-level query of the security status, wherein both evaluation can run autonomously in the vehicle and can be arranged in the ComBox or the OBU in the same way as well as an evaluation can take place on an external server.

FIG. 6 also shows an exemplary method according to the invention according to a fourth embodiment. In this case, the method is started in step 100.

Immediately after the start, a network access rule set "NULL" / "CLOSED" / "DENY ALL" can be explicitly activated in step 200 in order to prevent any OTA communication for the time being before the activation of the determined network access rule set. Subsequently, the current vehicle security status is determined in a step 300.

On the basis of the determined vehicle security status, it is determined in step 400 whether safety requirements have been met. If the requirements are met, in a step 900a a network access rule set is activated which activates the OTA communication. Subsequently, the method terminates in step 1000.

However, if it is determined in step 400 that the requirements are not fulfilled, then a server-assisted evaluation is initiated. This starts by activating an initial network access rule set in step 500. Thereafter, the current configuration of the vehicle and / or log data of the vehicle and / or the elapsed time since an update of a relevant software to an evaluation server (VSSES) to determine the security status in transmitted to a step 600. The result of the determination of the security status is received in step 700.

In step 800 it is checked whether the received evaluation result is sufficient, ie it is determined which network access rule set is activated. If the result of the evaluation is sufficient to designate the system as safe, then in step 900a a network access rule set is activated which activates the OTA communication. Thereafter, the method terminates in step 1000. If the evaluation result is not sufficient to designate the system as secure, a network access rule set "NULL" / "CLOSED" / "DENY ALL" is explicitly activated in step 900b in order to eliminate any OTA To prevent communication from activating the determined network access rule set for the time being, the method then terminates in step 1000. That is, the server is requested only if the vehicle itself is "not secure," if it is in a secure security status. "Figure 7 illustrates a message flow according to the invention, in accordance with an embodiment of the invention. For example, in the OBU or a ComBox, a vehicle configuration is determined in a first step 2100. Subsequently, the communication interface is activated in the vehicle in a further step 2200. Now, in a further step 2300, an authentication to a VSSES or more generally This communication may include a plurality of messages exchanged between the communication interface and the security status determination device 14. After this has been done, in a further step 2400 the determination may be made a security status can be activated by an appropriate e request is sent to the SEE. This requirement can already include as parameters a current configuration of the vehicle and / or log data of the vehicle and / or an elapsed time since an update of the relevant software. Of course, it is also possible to provide these parameters in one or more separate messages.

Subsequently, the SEE evaluates a configuration based on the obtained parameters, i. H. a security status, and provides this in a further step 26000 the vehicle.

The vehicle can now by a suitable device, for. For example, an access control device can activate a corresponding network access rule set for access to the data traffic network. In a further particular embodiment, the vehicle configuration information can already be present in the Vehicle Security Status Evaluation Server (VSSES) or can be queried by a vehicle manager. In this embodiment, it is not necessary to transmit the parameters of a current configuration of the vehicle and / or log data of the vehicle and / or an elapsed time since an update of a respective software, but it suffices to transmit instead a vehicle identification information. Again, this information may be transmitted to the SEE at the same time as the request or in a separate message.

Figure. 8 shows a schematic representation of a further embodiment of a system according to the invention. It is assumed that a vehicle has an on-board unit OBU which communicates with infrastructure servers via a communication device using different mobile radio systems.

Typically, the Vehicle Manager VM is connected to or has a vehicle database VDB. This database stores configuration information for vehicles managed by Vehicle Manager.

In this embodiment, the communication or parts of the communication can take place via a Trusted Vehicle Online Communication Proxy (TVOCP). Shown by a black line is a communication relationship (eg, http) between the vehicle and a vehicle online service (VOS). This communication can be tunnelled between the vehicle and the TVOCP by, for. B. a VPN from the vehicle to the TVOCP is established. In an alternative embodiment, the HTTPOCP can be implemented as an HTTP proxy for HTTP. Then no tunneling must be done, but HTTP requests can also be sent directly from the vehicle to the TVOCP, which - if necessary modified - to a destination server, eg. B. one VOS, forwards. The response to such a request can be transmitted from the target server VOS to the TVOCP, which can forward it - possibly modified again - to the vehicle.

When constructing the tunnel, the vehicle can authenticate itself to the TVOCP. The TVOCP can then query the current configuration of the vehicle from the vehicle database VDB. This configuration is analyzed to determine whether B. current security patches are recorded. Depending on this, a network access rule set or several network access rule sets will be enforced for this vehicle.

It is characteristic that all communication or part of the communication between the vehicle and a destination server is routed via the TVOCP, so that the data traffic can be examined there and potentially dangerous or unwanted communication can be blocked before it reaches the vehicle.

This TVOCP is based on the evaluation, eg. Depending on the type of vehicle and the configuration of the vehicle, defined network access policy, d. That is, only the communication that is allowed by the defined network access rules is enabled. Other communication is blocked.

The basis for the evaluation is given by the TVOCP in the following exemplary ways:

- Direct transfer from the vehicle (especially vehicle identification / vehicle authentication), eg. For example, if the vehicle is setting up a tunnel to the TVOCP (IPSec,

SSL / TLS) and the vehicle authenticates itself. Optionally, the vehicle can already transmit further information about itself (manufacturer, series, chassis number / VIN, configuration information). The information about the vehicle can be requested by the TVOCP from a database; In particular, information may be requested from a vehicle manager (VM) or from the database (VDB) used by the VM to store configuration information of a vehicle. In particular, information about the software status of a particular vehicle is available here. In particular, it can be considered whether current software updates (critical security updates) have been recorded. If necessary, the VM can be triggered by the TVOCP to query the current configuration from the vehicle.

- A TVOCP can also actively scan a vehicle to obtain information about the vehicle. Depending on these parameters, a network access rule can be determined by the TVOCP, which is enforced in the following communication of the vehicle.

If a communication is blocked, it can optionally be redirected to another server, or the TVOCP responds proxy. For example, an HTTP request from the vehicle may be intercepted by the TVOCP and an HTTP REDIRECT message transmitted to the vehicle redirecting the vehicle client to another HTTP server. There can then z. For example, a web page may be displayed in HTML that informs the driver that the access has been blocked and why.

Furthermore, information can be transmitted to the vehicle by the TVOCP that the vehicle should contact the VM server. This can be done, for example, by inserting a special HTTP header into an HTTP response that is transmitted to the vehicle. This allows the VM server z. For example, transfer available software updates to the vehicle. Furthermore, the TVOCP can transmit information to the VM server that the vehicle is currently online. For pending updates, the VM server can initiate a management session with the vehicle. By sending a trigger SMS message.

It is readily apparent to those skilled in the art that the aforementioned embodiments can be combined with each other and z. For example, each application or protocol used may be re-and separate, with different network access policy sets for different applications and different approaches to security status detection coexisting. In summary, it can be said of all exemplary embodiments that it is possible by means of the invention to carry out an evaluation autonomously by the vehicle, or the evaluation is supported by a server (serverassisted evaluation), or both previously mentioned possibilities are combined.

In the case of an autonomous evaluation, the evaluation function can load the current configuration of the vehicle and / or the log data and / or the information about how long ago the last update was or when the last update was checked or if pending updates are also loaded and have been installed, check.

Updates can for example be played by a workshop. This can be z. B. via a workshop tester, which is connected via a diagnostic interface with the vehicle.

Alternatively, updates can also be made by the user himself, for. B. by means of update medium, z. CD / DVD, USB stick, memory card, etc., or by updating from one Update server via the radio communication interfaces are loaded (OTA Seif Update).

In an OTA Seif Update, the vehicle communicates with a Vehicle Management Server (VM) to receive information about deployed updates and, if necessary, to load and install them.

Depending on the evaluation result determined, network access rules can then be determined and activated for enforcement.

For example, two network access rule sets can be defined (UNRESTRICTED, RESTRICTED). If the result of the evaluation is that the vehicle is in a safe configuration status (eg pending safety-critical updates have been checked and installed within the last 7 days), then the network access rule set UNRESTRICTED is activated (enables, for example, free , direct internet access). Otherwise, the network access rule set RESTRICTED is activated, in which only trusted web services offered directly by the vehicle manufacturer can be accessed. In a server-assisted evaluation, the vehicle may transmit parameters to a Vehicle Security Status Evaluation Server (VSSES) or, more generally, a Security Status Investigation Facility (SEE) and in return receive an evaluation result ,

The transmitted parameters may include:

Identification of the vehicle (eg VIN, VIN),

- Vehicle type information (manufacturer, model, year of manufacture, installed accessories), - configuration information (built-in components, software version),

- Log information (logging data of the vehicle, also in connection with the respective used vehicle key, especially regarding OTA communication, which can be evaluated on the server).

In particular, it is sufficient to transmit only vehicle identification information if information about the current configuration of this vehicle is stored in a server (VM) in a database (VDB) and can be queried by the VSSES. This is z. B. the case when the vehicle configuration z. For example, it can be managed using the OMA (Open Mobile Al- liance) DM protocol OTA. If the information is not stored in a database, the information can be transmitted directly from the vehicle to the VSSES.

The evaluation result may include:

- Flag (secure yes / no),

Value (e.g., 0, 1, 2, 9),

- Identifier (policy identifier directly or mapping),

- provided security updates, possibly with information about their criticality or the functionality involved,

- Network access rules.

Depending on the evaluation result received, the vehicle configures and enforces network access rules. The Vehicle Security Status Evaluation Server (VSSES) is, for example, a server of the vehicle manufacturer or of a communications provider. Authentication takes place between server and vehicle. The communication can z. B. be protected by IPSec, SSL or TLS protocol. The information can z. Via HTTP, SOAP, OMA DM, SyncML, SNMP. Although the VSSES is described as a self-contained unit, it may be included in other units. So the VSSES z. For example, it could be part of a VM server that might provide updates.

As already stated, some network access rule sets may be predefined, e.g. B .:

- UNRESTRICTED: any communication allowed (even directly without a proxy);

- UNRESTRICTED INFRASTRUCTRE: allow any communication with infrastructure services (also direct), but not vehicle-to-vehicle communication;

- MANAGED INFRASTRUCTURE: allow any (even direct) communication with infrastructure services, but only use mobile networks operated by a known infrastructure operator (eg only GPRS, UMTS / HSDPA via Vodafone, T-Mobile or Orange, but not WLAN);

- TUNNEL: Communication tunnels to Trusted Gateway (traffic is tunneled and sent to VPN servers where it can be parsed and filtered before being forwarded to, for example, an Internet server; Server is coming, will be further processed);

- TRUSTED SERVER: only communication with online services offered by a server listed on a configured whitelist of the vehicle (eg http: // *. Bmw. De; https: // * bmw. com; http: // *. bmw. com; https: // *. bmw. com);

- NULL / CLOSED / DENY ALL: no OTA communication possible.

Alternatively or additionally, a network access rule set can also be provided by the Vehicle Security Status Evaluation Server (VSSES) or another server. It can also be fine granular network access rule sets are defined: It can, for. For example, content filtering can be performed to filter dangerous content for the car. For example, game, Flash content or JavaScripts on web pages are only allowed to pass if a particular vehicle has loaded the current security patches for the corresponding display programs.

The content of a network access rule set may, for. For example, you may require the use of a firewall and a VPN.

A network access rule set consists of rules. These describe what type of network traffic is to be handled and how it is handled

- is permitted, d. H. is further processed and, if necessary, forwarded to the target ECUs in the vehicle (allow);

- tunneling is (tunnel; encapsulate), d. H. is to be transmitted via a VPN tunnel;

- tunnel out (detunnel, decapsulate), d. H. Unpack data received via a VPN tunnel before further processing or forwarding to the destination controller;

- to discard is (discard).

In addition, certain restrictions may be imposed on permitted traffic, in particular restrictions on the maximum data rate, e.g. B. to prevent the overload of target components.

Possible filter criteria include:

- Vehicle: Vehicle Manufacturer, Model, Version / Year,

installed accessories (especially version of the built-in infotainment system);

- direction (inbound to the vehicle, outbound from the vehicle);

Target component in the vehicle (ie to which control unit the data are forwarded or from which control unit they originate);

- OTA interface (GPRS, UMTS, WLAN, ...); - current OTA network operators (eg T-Mobile, Vodafone, unknown) and country (Germany, France, ...);

- IP address (sender, receiver);

- country of origin IP address (certain countries can be blocked);

Protocol (e.g., TCP, UDP);

- port number;

- URL Filter;

- Communication encrypted (eg SSL, TLS) or unencrypted;

- dedicated filters for known attacks, especially denial of service (DoS) (eg ping packet with a certain length);

- Tunnel directly received data via Trusted Server. In addition to pure network communication, network access rules can also refer to content, the so-called content (web pages, multimedia files, program code):

- Usable multimedia formats (eg, CDs and WAV files could always be playable while MP3 and videos are no longer playable);

- Supported browser plug-ins, eg. For example, for Flash animations;

- Criteria for the assignment of online content (web pages) to security zones (A security zone eg in Microsoft's Internet Explorer defines which possibilities are granted to web contents of web sites of this zone, eg whether Use of JavaScript is possible.). The assignment is based on the URL from which a web page or generally an online content is loaded.

- The permissions associated with a security zone

(for online content);

- Authorizations for executed program code: In the state of the art Code Access Security is known, eg. For example, the Microsoft Common Language Runtime or the Java Runtime Environment. Program code is granted access rights depending on its origin (ie depending on who signed it or from where it was loaded). New Now, depending on the security evaluation, the entitlements granted to a particular code are set; or it is defined depending on the evaluation result whether a specific code can be executed at all. For example, in this way the execution of Untrusted Code / Downloaded 3rd Party Code can be prevented if the patch status of the vehicle component is not up-to-date.

The selected network access rule set is preferably enforced by the communication unit of the vehicle. Alternatively, this can also be done by a separate, upstream Si cherheitskommunikationseinheit.

In one variant, in addition vehicle internal i board network by access control device (vehicle bus gate ways, control devices) filtering the communication. To this end, the communication unit or the security communication unit can transmit information to this access control device via the vehicle security status (indicator, filter rules), thereby adapting its network access rules accordingly. However, the respective component can also individually perform the described method.

In order to avoid blocking, the user should preferably receive an indication to install security patches in time or as soon as possible in order to be able to continue to use all services.

With limited access the communication possibilities are limited and therefore not all services can be used. However, it should preferably still be possible to install the necessary software updates. The user can be made aware that a software update is necessary for a corresponding service usage. By means of the invention, a vehicle can communicate relatively freely directly, as far as this is possible without danger. However, if attacks are detected, or if the protective measures of the vehicle are out of date or no longer sufficiently effective, hazards, eg. B. manipulation of vehicle components via online connections, can be avoided by appropriate self-protection measures. If required for security reasons, the mentioned protection mechanisms restrict or completely eliminate online services.

Vehicle components receive full access to the outside only at the current security update status of the software, since they can then fend off the attacks that occur from the network. This ensures reliable vehicle operation.

Claims

A system for preventing an attack on a networked vehicle via a wireless communication device of a vehicle, comprising:

- a wireless network,

a security status determination device for regulating access to the wireless traffic network as a function of a determined security status,

wherein the security status is based on an evaluation of a current configuration of the vehicle and / or log data of the vehicle and / or on an elapsed time since an update of the relevant software,

a communication device suitable for connection to the wireless traffic network,

an access control device for the regulation of

Network access to the wireless traffic network, which is connectable to the security status determination device.

The system of claim 1, wherein the security status determining means is located in the vehicle, and an evaluation of the security status is autonomous.

The system of claim 1, wherein the security status determination means is located in the traffic network.

System according to one of claims 1 to 3, wherein the access control device is arranged in the vehicle.

5. System according to one of claims 1 to 3, wherein the access control device is arranged in the traffic network. System according to one of claims 1 to 5, wherein the regulation of the network access to the wireless traffic network is regulated by network access rule sets, wherein the network access rule sets are selected to the wireless network in the manner of a connection, on the type of filter criteria and / or on the type of content.

The system of any one of claims 1 to 6, wherein the network access control further includes determining whether the access is to be encrypted or tunneled.

The system of one of claims 1 to 7, wherein the evaluation of the security status further comprises: detecting that a vehicle component has detected an attack or a malfunction within the scope of the network access.

A method for a system for preventing an attack on a networked vehicle via a wireless communication device of a vehicle, the system comprising:

- a wireless network,

a security status determination facility,

a communication device suitable for connection to the wireless traffic network and

- an access control device

having the steps:

Determining a security status, wherein the security status is based on an evaluation of a current configuration of the vehicle and / or log data of the vehicle and / or on an elapsed time since an update of the relevant software,

on the basis of the determined security status, determining a network access rule set for access to the traffic network, - activate the specified network access rule set.

The method of claim 9, further comprising the steps of:

- activation of an initial network access rule set,

Transmission of current configuration of the vehicle and / or log data of the vehicle and / or on an elapsed time since an update of a respective software to an evaluation server to determine the security status,

- Transmission of the determined security status.

The method of claim 10, wherein a security status is determined both locally and remotely.