EP4635150A1 - Method for monitoring a communication connection between two network nodes that are directly connected to one another - Google Patents

Abstract

A method for detecting intervention in a direct connection between two network nodes of a system during operation comprises initiating messages of a first type in a cyclical manner or in a manner repeated at irregular intervals, to which messages a transmission time stamp in the transmitter and/or a reception time stamp in the receiver is added or assigned. After the time stamp has been set and before the message is transmitted via the physical layer and/or after the message has been received via the physical layer and before the reception time stamp is set, the messages are delayed by a previously determined limit value or previously determined limit values for the direct connection. It is then checked whether the signal propagation time has exceeded a predetermined value and this is signalled.

Description

DESCRIPTION

METHOD FOR MONITORING A COMMUNICATIONS CONNECTION BETWEEN TWO DIRECTLY CONNECTED NETWORK NODES

FIELD

The present invention relates to communication networks with network nodes that are synchronized with one another in time. In particular, the invention relates to a method for monitoring an Ethernet-based communication network, for example a communication network in a motor vehicle, and a network node set up to carry out the method, for example in the form of a control unit. The method can be used, among other things, to monitor for errors in the communication network and/or for changes in the network topology. For this purpose, monitoring of a direct communication connection between two network nodes, for example designed as electronic control units, is provided.

BACKGROUND

In many areas of technology, a large number of control devices or computers communicate with each other via networks. In certain applications, it is necessary to synchronize these network nodes with each other in time, for example in networked multimedia systems that are to play media content in a synchronized manner, or in systems in which a large number of networked sensors send sensor data to a processing unit, which evaluates sensor data that match each other in time and generates control signals for the system from this.

An example of the latter application is partially automated or highly automated driving, in which sensor signals representing the vehicle environment and vehicle conditions are evaluated in real time or quasi-real time in order to derive control signals for the safe operation of the vehicle, among other things. The processing of sensor signals from a large number of sensors, including those of different types, is also referred to as sensor fusion. Ethernet technologies are also increasingly being used in vehicles, replacing older or proprietary data connections and buses. Ethernet-based communication is based on the so-called OSI layer model, in which each layer is assigned certain tasks that must be performed by the entities (devices and software) of the respective layer for the communication to function. Each instance of a layer provides services in accordance with the standardized network protocol that an entity above it can use without having to worry about how and with what technical means the entity below it solves its tasks. Corresponding interfaces are defined between the various layers.

Fig. 1 schematically shows the known Ethernet-based communication, which is also used in the present invention, between two network nodes 1, 2 of a wired communication network 3, which are designed as control units, for example, and which operates in a network protocol according to the OSI layer model with a total of 7 layers I to VII. The tasks to be performed by the individual layers are implemented in computing units of the network nodes 1, 2 (not shown separately) and are shown schematically in Fig. 1.

According to the well-known OSI layer model, the layers are named as follows:

Layer I: Physical Layer, Layer II: Data Link Layer, Layer III: Network Layer, Layer IV: Transport Layer, Layer V: Session Layer, Layer VI: Presentation Layer, Layer VII: Application Layer.

Layers III to VII are used to prepare the physically transmitted data and assign it to special applications that access the transmitted data via the Application layer (layer VII). These layers are of an organizational nature and have nothing to do with the physical transmission of data or data packets. Since these layers are not affected by the present invention, a description of the content of these layers known to the person skilled in the art is omitted.

The actual data transmission takes place in layers I and II. Layer I (PHY - Physical Layer) directly contains the tools for activating or deactivating the physical connection. This includes in particular devices and network components such as amplifiers, plugs, sockets for the network cable, repeaters, hubs, transceivers and the like. This layer I is therefore used to physically address the transmission channel using suitable electrical, optical, electromagnetic or sound signals; in the case of wired Ethernet communication networks, these are usually electrical or electromagnetic signals. The network interfaces required for physical communication are assigned to each network node and form layer I according to the OSI layer model.

Layer II of the OSI layer model, known as the data link layer, is used to organize and control a largely error-free transmission and to regulate access to the transmission medium. This also includes data flow control between sender and receiver. Logically, the data link layer is often divided into a media access control MAC (Medium Access Control) and a logical link control LLC (Logical Link Control). The media access control MAC regulates how several computers share the shared physical transmission medium. To do this, it uses, among other things, the so-called MAC addresses of the communication participants, which are assigned to each network node as a participant in the communication network 3 as a unique identification. The media access control MAC is managed by the logical link control LLC, which distributes incoming data in each transmission direction and coordinates access to the higher-level layers of the network control. The tasks of the media access control MAC and the logical link control LLC define the so-called data link layer. (Layer II) is formed in which the various network participants can be identified in order to organize the network communication in a regulated manner. This logical management is schematically integrated in Fig. 1 between the network nodes 1 and 2 in the line of the communication network 3 representing the physical connection.

The only control of the network nodes 1, 2 as participants in the communication network is therefore in the security view (layer II), for example through the unique MAC addresses for identifying the individual network participants, which is necessary for media access control. In the physical layer (layer I), a network node 1, 2 has no knowledge of the other network nodes 2, 1 in the communication network 3, but only controls the physical communication at its interface to the communication network 3.

A large number of systems that are communicatively connected to one another via Ethernet connections, including systems in vehicles or systems for the synchronized transmission of audio and video signals, can place particularly high demands on the reliability of the transmission and the temporal coordination of data packets. In particular, safety-critical applications in vehicles, e.g. the transmission of sensor and control information for driver assistance systems or autonomous driving, place high demands on the temporal coordination of data packets. Even relatively small changes in signal propagation times can lead to a change in system behavior, e.g. because signals that are to be processed together or that must be present in a certain, closely coordinated time frame with other signals no longer match one another due to the change in signal propagation time. If the system behavior changes or is unpredictable, the reliability of the system can no longer be guaranteed.

The prevalence of time-synchronized network nodes will continue to increase in the future, partly because an increasing number of control units transmit sensor data from different sensors that are used to provide safety and Comfort functions are linked and evaluated. A particularly important aspect of the fusion of sensor data is the temporal coherence of the sensor data. Depending on the application, it may be necessary to fuse sensor data that belong together to within milliseconds or microseconds, while in other applications a larger time interval between the recording times may be permissible. It is also conceivable that the recording times must belong together exactly in the range of nanoseconds. In addition to the data required for sensor fusion, data that was recorded when monitoring the operation of the vehicle and is only used for maintenance purposes or to document that the vehicle is operating correctly and in accordance with the regulations may also be subject to strict requirements for their correct recording and storage at the correct time.

The time synchronization of network nodes within an Ethernet network can be carried out using appropriate protocols so that a globally valid time base is available within the network. Time synchronization in Ethernet networks is, for example, agreed in the IEEE 802.1 AS standard, which uses the Precision Time Protocol (PTP).

PTP defines a master-slave clock hierarchy with a best clock within a network, also known as the grandmaster clock. The time base of the other network nodes in this network is derived from this best clock, the grandmaster, which is determined using the Best Master Clock Algorithm (BMCA). Time synchronization messages are distributed across the network from the grandmaster. PTP also defines a mechanism for measuring the signal propagation time on a connection, as well as a method for exchanging time information.

To determine the Grandmaster Clock according to the BMCA, IEEE 802.1AS-capable network nodes cyclically send Announce messages with information about their internal clock to other directly connected network nodes. The information about the internal clocks provides information about the accuracy of the respective clock, its reference or time reference, and other properties that can be used to determine the best clock in the network. Such an Announce message is shown in Figure 2 a). shown as an example. A recipient of such an announce message compares the information received with the characteristics of its own internal clock and possibly messages already received from another port with information on clocks at other network nodes, and accepts a clock in another network node if it has better clock parameters. After a short time, the best clock in the network is determined, which then becomes the grandmaster in the network, and a time synchronization spanning tree has been set up. Each port of a network node is assigned one of four port states. The master port state is assigned to the port that has a shorter path to the grandmaster than its link partner. The slave state is assigned if no other port on this node has this state. Disabled is selected by the port that cannot fully support the PTP protocol. The passive state is selected if none of the other three states apply.

In a variant of PTP, the generalized Precision Time Protocol (gPTP), two network nodes always communicate directly with each other for time synchronization, and neither of the two network nodes simply forwards a received time synchronization message to another network node in the network. Instead, the network node corrects the time information before forwarding it by the previously determined signal propagation time on the connection over which it receives time synchronization messages from a directly connected network node, as well as by the internal processing time before it creates and forwards a new time synchronization message with the corrected time information. Network nodes that support gPTP are also known as "time-aware systems".

The signal runtime on a connection between two network nodes can be determined using the Sync_Follow_Up mechanism, which is shown schematically in Figure 2 b). The master ports cyclically send Sync and Follow_Up messages to the neighboring link partner, i.e. their slave ports. When the Sync message leaves the master port, a time stamp is generated, which is immediately transmitted in a subsequent FollowJJP message. This time stamp corresponds to the current time of the Grandmaster at the time the sync message was sent. From the difference in the reception time of the two messages, the receiver can determine the signal propagation time of the connection, and with this and the time of the Grandmaster Clock transmitted in the sync message, the receiver can then set its clock.

The so-called "peer delay mechanism" is used to determine the delay between two connected ports independently of time synchronization messages from the grandmaster clock. This is shown as an example in Figure 2 c). A port, the initiator, starts the measurement of the line delay by sending a Delay_Request message to the port of a network node directly connected to it, the responder. As late as possible before the message is actually sent via the Ethernet transceiver, a transmission time stamp with the time t1 is generated and inserted into the message so that this transmission time stamp t1 defines the actual transmission time to a good approximation. When the message arrives, the responder generates a reception time stamp t2. In response, the responder sends a Delay_Response message to the initiator. In this message, it transmits the reception time stamp t2 of the Delay_Request message. If this message leaves the responder, it generates a transmission time stamp t3, which is sent to the initiator in an immediately following Delay_Response_Follow-Up message. When the initiator receives the Delay_Response message, it generates a reception time stamp t4. The initiator can calculate the average runtime on the communication link from the four time stamps t1 to t4. Since the runtime on a connection link can vary depending on the direction, Delay_Request messages are sent independently by both communication partners.

These measurements can be carried out cyclically, ie at predetermined time intervals of, for example, 100 ms up to several seconds or minutes. Even with a time interval of around one second, the network is not heavily loaded, so that even a measurement at these relatively short time intervals is not a problem for the operation of the network. It may be useful to carry out such signal propagation time measurements between all network nodes 1, 2 of the communication network 3 that are in communication connection with one another, preferably as a direct signal propagation time between two network nodes 1, 2.

During the development or analysis of networked systems, it may be necessary to listen to the data traffic sent over the network connections, for example to find errors that occur in the system. In order to be able to listen to the communication between two directly connected network nodes without having to specifically adapt or change the software of the network nodes, which could lead to a changed system behavior in which the error does not occur or in which other errors occur, a so-called test access point (TAP) or a switch or bridge is usually inserted into the network connection between the two devices.

From the schematic representation of the physical connection of the communication network 3 shown in Figure 3 a), according to the solid arrows, it can be seen that the physical connection can certainly be broken without the access control (MAC according to the data link layer or layer II) shown by the dashed arrows having to or being able to notice this. For this purpose, as shown in Figure 3 b), a tap 4, e.g. a TAP, is interposed at each of two physical interfaces PHY, and to which, for example, a network analyzer can be connected, which analyzes the data traffic between the two network nodes 1, 2 (not shown in the figure).

Such a TAP 4 is simply looped into the existing line connection, copies the data information or data packets bit by bit as the data stream passes through, without analyzing their content, and outputs the copied data information via another interface. The physical data stream is simply forwarded unchanged. The network analyzer 4 therefore does not appear in the communication network 3. In particular, the Data link layer (layer II of the OSI layer model) of network nodes 1 and 2 have no knowledge of the existence of this network analyzer 4.

Compared to a direct line connection between network nodes 1 and 2, looping the data stream through TAP 4 leads to an extended signal propagation time for the signals (data packets) transmitted between network nodes 1 and 2. This extension of the signal propagation time can amount to several hundred nanoseconds.

The use of switches or bridges in a connection between network nodes to monitor communication has an even greater impact on communication than a TAP. Even if a switch or bridge, like a TAP, does not have a direct address, it causes a large delay, among other things because of the possibility of storing data before forwarding it, and also takes part in Layer 2 communication.

As already described above, the insertion of a TAP or switch or bridge can lead to an increase in the signal propagation time, which reduces the accuracy of the time synchronization or even disrupts or prevents it. Particularly in systems in which correct and reliable time synchronization is essential for the functioning of a large number of networked network nodes, a disrupted or failed time synchronization can lead to one or more network nodes switching from the original operating mode to another operating mode, e.g. an error operating mode, and the intended permissible interception of the communication of the original operating mode of the network node or system cannot take place. This may no longer ensure safe operation and also makes troubleshooting considerably more difficult. It is easy to see that the disruption of the time synchronization increases with the number of TAPs or switches or bridges inserted between two network nodes, unless the signal propagation time is re-determined and corrected accordingly when forwarding time synchronization messages. Inserting TAPs or switches or bridges into a network connection can also be done for reasons other than troubleshooting, for example to eavesdrop on communication in the network without authorization and to identify vulnerabilities that can be used to deliberately change the system behavior without authorization. This approach can be used in particular in systems that are used in large numbers in identical fashion. An attacker only needs to gain access to one of the systems and, after analyzing and finding a vulnerability, can specifically attack any of the other systems.

This poses a certain risk potential, particularly in safety-relevant applications such as those found in motor vehicles. For example, if information evaluated by driver assistance systems is transmitted, it is necessary to determine whether this information is being read. Such reading can pave the way for a targeted attack on the vehicle's communication system, for example by revealing the keys or network addresses used.

Since monitoring the participants in the communication network is only possible if their addressing, i.e. their MAC addresses or other unique identification features, is known in the network, the insertion of a TAP or switch or a bridge represents an attack opportunity in an Ethernet-based communication system that cannot be detected on Layer II or higher layers of the OSI layer model.

In a static communication network, e.g. that of a motor vehicle, in which the network topology does not change unless the network is modified by a permissible or impermissible intervention, it is possible to detect an intervention by detecting changes in the signal propagation time. One option that can be used in this context to measure the signal propagation times between network nodes is the method described with reference to Figure 2 c). The use of average runtimes determined in a system before any intervention on connections between two network nodes requires that these runtimes are stored in each network node for each direct connection to other network nodes. In addition, the measurement of the runtimes must be repeated cyclically at intervals that are not too short in order to be able to detect even short-term interventions. This can lead to an increased communication load on the network connection on a cyclic basis, which means that particularly time-critical messages may reach their destination with a delay.

DESCRIPTION OF THE INVENTION

It is therefore desirable to provide a method for monitoring a communication connection between two directly connected network nodes of a system, by means of which an intervention in the direct connection can also be detected on the technical bit transmission layer, on which only the physical data traffic is processed, without having to carry out a cyclic measurement of the signal propagation time and a comparison with a previously determined value of the signal propagation time. It is also desirable to be able to adapt parameters of the connection between the two network nodes that have been changed by an intervention so that the operating behavior of the system does not differ from the operating behavior before the intervention. It is also desirable to provide a network node, in particular a control unit of a motor vehicle, which can be connected or is connected to other network nodes and which is set up to carry out one or more embodiments of the monitoring method according to the invention or parts thereof.

A first part of this object is achieved according to the invention by a method having the features of claim 1. A further part of the object is achieved by the method of claim 8. Yet another part is achieved by the network node specified in claim 11. Further developments and embodiments of the method are specified in the respective dependent claims. According to a first aspect of the invention, in order to detect an intrusion into the direct connection between two network nodes (network nodes), a limit value of a parameter of the direct connection between the two network nodes must first be determined, which is exceeded when the direct connection is intruded upon and which can be used as a reliable indication of the presence of an intrusion. One such parameter is, for example, the signal propagation time on the direct connection, since the signal propagation time is increased when a TAP or a switch or a bridge is inserted, as is required for active intrusion into the direct connection. This parameter cannot be queried from a network node, nor is it available for retrieval in a database or the like. In addition, the parameter can be different for each link and each link type. In the context of this description, the term "direct connection" refers to a direct physical connection between two network nodes, i.e. without any other network nodes in between.

A method according to the invention for determining a limit value of the signal propagation time of a direct connection between two network nodes firstly comprises determining the signal propagation time on the direct connection at a time when there is no interference with the direct connection between two directly connected network nodes of a system. This can be done, for example, using the peer-delay-X/ method known from the IEEE 802.1 AS standard, whereby the measurement can be carried out in one or both directions. However, the signal propagation time can also be determined by reading from a database or a configuration memory if the signal propagation time was previously determined and does not change over time. Other methods for determining the signal propagation time are conceivable and known to those skilled in the art.

In a next step, the sending of a message of a first type is initiated via the direct connection, to which first type of message a sending time stamp is added or assigned at least in the sender. In addition, a receiving time stamp can be added or assigned to the first type of message in the receiver.

The time stamp(s) in the first type of message can be used to check the signal propagation time at the physical level. The first type of message can also trigger a response from the receiver, so that a check of the signal propagation time is also possible in the sender of the message. The first type of message can be a message from the class of event messages specified in the IEEE 8201 .AS standard, eg also a peer-cfe/ay message.

Before the previously initiated message of the first type provided with the transmission time stamp is sent via the physical layer, it is delayed by a first transmission delay value. Additionally or alternatively, the message can be delayed by a first reception delay value after being received on the physical layer and before the reception time stamp is set. The first reception delay value can be dependent on or independent of the first transmission delay value.

According to the IEEE 802.1 AS standard, at least some messages from the event message class specify that if the signal propagation time on the direct connection exceeds a predetermined value, a variable that previously signaled that the signal propagation time on the direct connection was not exceeded is changed. The predetermined value is, for example, a value specified in the IEEE 802.1 AS standard via the meanLinkDelayThresh variable. The variable is, for example, the asCapableAcrossDomains or asCapable flag from the IEEE 802.1AS standard, which is used during the time synchronization of the system's network nodes and indicates the ability of a network port to perform time synchronization in accordance with the standard. Changes to the value of asCapableAcrossDomains or asCapable, which as a Boolean variable can assume the values true or false, are communicated to a state machine in the PHY, which then sets the state of the port in question to reenabled Ext or disabledExt.

The status of the port is communicated, among other things, during time synchronization, so that the change is made known to all other network nodes within a short time due to the cyclical transmission of time synchronization messages. Accordingly, the method includes checking whether the signal propagation time has exceeded a predetermined value. This can be done, for example, by comparing the transmission time specified in the transmission time stamp with the synchronized system time of the receiver, by comparing the transmission time with the reception time sent back by the receiver to the transmitter in a response message, by evaluating the asCapableAcrossDomains or asCapable flags of the IEEE 802.1 AS standard, by evaluating the port states or other methods known to those skilled in the art.

If the test shows that the signal propagation time has not exceeded the predetermined value, the sending of another message of a first type is initiated via the direct connection, whereby the delay after setting the time stamp and before the actual transmission on the physical layer is increased compared to the previously set value. It is then checked again whether the signal propagation time has exceeded the predetermined value. The initiation and delayed sending is repeated with a delay that is increased compared to the previous sending process until the signal propagation time has exceeded the predetermined value. The last delay value is then output and/or saved as the determined limit value for the direct connection at which the signal propagation time has not yet exceeded the predetermined value. If delay values are set separately for both sending and receiving, the last delay values are saved as the determined limit values. Storage can take place locally or in an external database.

The determination of the limit between the two directly connected network nodes can be done in both directions.

In one or more embodiments of the method, after the signal propagation time has exceeded the predetermined value for the first time, the transmission is repeated with the previously set delay for a previously set number of attempts or repetitions. If the signal propagation time has exceeded the predetermined value in all attempts or repetitions in succession, the method proceeds to the next step. If the signal propagation time exceeds the predetermined value before reaching the previously set delay, the transmission is repeated with the previously set delay for a previously set number of attempts or repetitions. If the signal delay falls below the predetermined value after the specified number of attempts or repetitions, this repetition phase is restarted, with the sending and checking taking place with a longer delay than the previously set value. In this way, a delay value which, due to the smallest deviations occurring in normal operation, leads to the predetermined signal delay time either being exceeded or not being reached can be reliably detected. Such a value which is at the limit can be specifically used or omitted when the limit value for the signal delay time is used later, depending on the application, particularly if the delay can only be set in discrete steps which have a certain minimum size.

In one or more embodiments of the method, after the signal propagation time has exceeded the predetermined value at a set delay once or possibly several times, the value or values for the delay can be reduced again and the test for exceeding the signal propagation time can be carried out again. The reduction and test are repeated if necessary until the signal propagation time is below the predetermined value. In one or more embodiments of this method, a repetition phase with the previously set delay can be used to check whether the signal propagation time is below the predetermined value in a previously defined number of attempts or repetitions in a row and if necessary the repetition phase can be restarted with a further reduced delay.

In order not to disrupt the ongoing operation of the system, in one or more embodiments of the method, after each message whose signal propagation time has exceeded the predetermined value, a message of the first type, to which a transmission time stamp is added or assigned in the transmitter and/or a reception time stamp in the receiver, can be sent without delay. This makes it possible to reset any existing mechanism that only puts the system or one or more network nodes into an error operating mode or another mode that differs from the original operating mode after a previously defined number of attempts. In particular, the methods for time synchronization according to The IEEE 802.1AS standard can compensate for the failure of up to two consecutive synchronization messages. Only if three consecutive synchronization messages are missing would the system's time synchronization be disrupted or re-initiated, network nodes would go into error mode or show other effects that result in a change in the operation of the system.

In one or more embodiments of the method, the delay for delayed sending can be added, for example, by encrypting at least the messages of the first type on the physical layer, i.e. on the physical connection, after setting the time stamp and before the then encrypted data bits are actually transmitted over the communication medium. For this purpose, the MACsec mechanism known from IEEE 802.1AE can be used, for example. The MACsec mechanism supports a method for securing the integrity of the transmitted data and, on the other hand, encrypting the data. In the former, the sender appends an 8-byte header and a 16-byte tail, which are checked by the receiver to ensure the integrity of the data. These 24 additional bytes alone increase the signal propagation time. Since encryption requires at least a certain number of data bits to be stored, this means that a delay, which depends among other things on the number of data bits encrypted in each block, occurs before the message is actually transmitted to the receiver. In addition, depending on the encryption method and key selected, the number of bits or octets of the message to be transmitted can be increased considerably, so that the increased amount of data to be transmitted through encryption also leads to an additional delay. Accordingly, in one or more embodiments of the method, different delays can be set by using different encryption parameters. For example, the use of GCM-AES-128 encryption can result in a shorter delay than the use of GCM-AES-256 encryption. If only a short delay is required, the method can be used to ensure integrity without encrypting the data. Alternatively or in addition to encrypting the messages of the first type, immediately before the After sending the message of the first type, any other message can be sent encrypted and/or with additional bytes to ensure integrity. Since in both cases the amount of data to be sent is increased and the corresponding processing may require additional time, the sending of the subsequent message of the first type is delayed accordingly after the send time stamp has been set in the sender's flow control buffer. In the same way, the received message of the first type is stored in the receiver buffer until the message sent before it has been decrypted, so that the use of the MACsec mechanism also delays the setting of the receive time stamp and the signal propagation time visible to the network nodes is extended. Since a response to an encrypted message is also encrypted, the signal propagation time can be significantly extended when the peer delay method described with reference to Figure 2 c) is used.

Since the signal propagation times in a static communications network, such as in a motor vehicle, do not change significantly apart from small, insignificant deviations, for example due to normal jitter or temperature-related propagation time differences, the determination of the limit value for the signal propagation time does not have to be repeated at short intervals. In order to take account of the aging of electronic components in the system of network nodes, it is sufficient to repeat the determination of the limit value at longer intervals.

According to a second aspect of the invention, in a method for detecting an intervention in a direct connection between two network nodes of a system during operation in a first operating mode, messages of the first type are initiated cyclically or at irregular intervals, to which the transmission time is added or assigned in the transmitter, for example a transmission time stamp, and/or for which the receiver logs the reception time, for example by means of a reception time stamp. After setting the transmission time stamp and before sending via the physical layer and/or after receiving the message via the physical layer and before setting the reception time stamp, at least the messages of the first type are delayed by a time specified in the previously described The delay is then delayed by a limit value determined by the method or by limit values determined in the previously described method for the signal propagation time on the direct connection. It is then checked whether the signal propagation time has exceeded a predetermined value. If the signal propagation time has exceeded the predetermined value, the exceedance is signaled. This makes it possible to detect interventions in the direct connection between the two network nodes and to take action accordingly. The extension of the signal propagation time set by the delay is expediently selected so that on the one hand the predetermined value of the signal propagation time is reliably not exceeded, but even a small additional extension of the signal propagation time leads to an exceedance.

The role of the sending and receiving network node can also change repeatedly in this aspect of the invention, since the messages of the first type can be sent cyclically and bidirectionally, i.e. in every direction of communication between the two network nodes. Monitoring is expediently carried out cyclically, i.e. at predetermined or predeterminable time intervals, so that changes can be reliably detected.

As soon as an intervention in a direct connection between two network nodes is detected, the network node executing the procedure can communicate this to the affected system components at a higher communication level in the OSI layer model. This means that, if necessary after a further check to see if the intervention is permissible, an adjustment can be triggered to enable the system to continue operating without exceeding the predetermined value of the signal propagation time.

In order to be able to detect and ignore only one-off exceedances of the predetermined value of the signal propagation time at irregular intervals, it can be provided that only if the predetermined value of the signal propagation time is exceeded several times does a signaling occur. This makes it possible, for example, to intercept temporary overloads of network nodes, which slightly delay the signal acceptance or the calculation operations carried out during it, but which do not represent an intervention in the structure of the network. According to one or more embodiments of the method according to the second aspect of the invention, in response to the signaling of the exceedance of the limit value, the system or at least one of the network nodes is put into an error mode in which, for example, safety-relevant functions are carried out in a particularly secure manner or are switched off. A network node operating in an error mode can notify other network nodes of the system of its operation in an error mode via the network.

Alternatively, the delay of at least the messages of the first type can be reduced to a reduced value at which the signal propagation time does not exceed a predetermined value. The method according to the first aspect of the invention can optionally be used to determine this reduced value.

If the delay is reduced to a value at which the signal propagation time does not exceed the predetermined value, a system behavior can be restored that is no different from the system behavior before the signaling of the exceedance of the limit value. This means, for example, that a system behavior that has been changed by the permissible insertion of a TAP in a direct connection between two network nodes can be brought back to the state it was in before the TAP was inserted, so that, for example, no additional errors caused by the insertion of the TAP occur during troubleshooting, or the system's operating behavior is unchanged compared to before the TAPs were inserted.

According to a third aspect of the invention, a network node comprises one or more processors, volatile and non-volatile memory associated with it or these, and a physical network interface communicatively connected to the one or more processors and set up to send and/or receive data via a communication medium shared by several network nodes. The elements of the network node are communicatively connected to one another by means of one or more data lines or buses. In The non-volatile memory stores computer program instructions which, when executed by the at least one processor, set up the network node to carry out one or more embodiments of the method according to the invention.

According to a fourth aspect of the invention, a system, in particular a vehicle system, comprises one or more network nodes, each networked via a direct connection. According to the invention, at least one of the network nodes is set up to carry out at least one embodiment of the method according to the invention described above.

A computer program product according to a fifth aspect of the invention contains instructions which, when executed by a computer, cause the computer to carry out one or more embodiments and further developments of the method described above.

The computer program product can be stored on a computer-readable medium or data carrier. The medium or data carrier can be physically embodied, for example as a hard disk, CD, DVD, flash memory or the like, but the medium or data carrier can also comprise a modulated electrical, electromagnetic or optical signal that can be received by a computer by means of a corresponding receiver and stored in the computer's memory.

The methods described above and the network nodes executing the method can advantageously be implemented without changes to existing hardware and can be integrated into existing networks accordingly, since the protocols already used do not have to be changed and the function of the network in normal operation, ie without inadmissible interference with at least one direct connection between two network nodes, is not impaired by inadmissible exceedances of the signal propagation time. Since the integrity of the direct connections is monitored during operation, the operational reliability of systems, e.g. sensor networks and control units that control and execute actions based on sensor data, can be increased, e.g. in vehicles with a high degree of driver assistance or autonomous vehicles. Unauthorized interventions in one or more direct connections between two network nodes can be quickly detected and appropriate measures can be taken more quickly to restore safe operation or to switch to a safe operating mode.

Using the method for determining the limit value of the signal propagation time according to the first aspect, a signal propagation time map of the communication network can be created in which the time reserves of the respective connections between two network nodes are entered. This information cannot normally be easily queried from a network node, either because no query is implemented for this purpose or the implementation is not disclosed. Nevertheless, the method according to the invention can be used to identify, among other things, connections into which network analyzers or diagnostic devices can be looped. In the case of such permissible intervention in one or more direct connections between two network nodes, a signal propagation time increased by the intervention, which is then above a predetermined value, can be brought back into a range that is below the predetermined value by reducing the delay at the transmitter and/or receiver accordingly. In this way, a system behavior that has changed due to the intervention can be brought back to a state comparable to that before the intervention. In contrast to previous methods, no residual bus simulation or the like needs to be used in order to be able to test network nodes separately in the simulated system context. In a similar way, it can be determined in advance whether transmission protocols that cause additional time delays when sending can be used in a system.

Even if network nodes are replaced or communication lines between network nodes are replaced or repaired, the methods according to the invention can be carried out again without great effort in order to implement any changes parameters and to continue the operation of the system as before, if necessary with modified delays on individual connections.

The method described above and the network nodes executing the method can be used platform-independently and therefore flexibly due to the simple and lean implementation and the use of resources already available in standards.

The type of monitoring proposed in accordance with the invention also helps to eliminate additional complex and/or computationally intensive security protocols. This reduces the load on the communications network as a whole.

Although the invention has been described above with reference to Ethernet-based communication and a strong focus on the automotive environment, the principle is applicable to all systems in which directly connected network nodes use methods of the IEEE 802.1AS standard or comparable methods to those described therein for time synchronization, and in which network nodes can deliberately cause delays between the setting of a time stamp and the actual transmission on the physical layer by various measures.

SHORT DESCRIPTION OF THE DRAWING

In the following, the invention is explained by way of example with reference to the drawing, from which further advantages, features or possible applications of the invention also emerge. All described and/or illustrated features form the subject matter of the present invention, either individually or in any combination, regardless of their summary in the claims or their references.

In the drawing shows: Fig. 1 schematically shows the communication process between two network nodes of an Ethernet-based communication network according to the OSI layer model,

Fig. 2 Swim-lane diagrams of exemplary messages used for time synchronization and measurement of signal propagation times,

Fig. 3 schematically shows the physical and logical communication paths between two network nodes before and after the interposition of a TAP,

Fig. 4 is a schematic flow diagram of a method for determining a limit value for the signal propagation time of two directly connected network nodes,

Fig. 5 is an exemplary schematic flow diagram of a method for determining a limit value for the signal propagation time of two directly connected network nodes during operation of a system in a first operating mode, without the operation of the system or the network nodes in the first operating mode being disrupted in an uncorrectable or uncompensable manner when determining the upper limit value of the signal propagation time or one of the network nodes of the system being placed in a second operating mode,

Fig. 6 shows an exemplary block diagram of a network node with a microprocessor pP and a typical physical Ethernet interface PHY,

Fig. 7 is a schematic flow diagram of a method according to the invention for monitoring the operation of a system with two or more network nodes that are directly connected to each other,

Fig. 8 is a schematic flow diagram of an exemplary application of an aspect of the invention in a system with two or more network nodes that are directly interconnected, and

Fig. 9 is an exemplary block diagram of a network node configured to carry out one or more aspects of the method according to the invention.

Identical or similar elements may be referenced in the figures with the same reference numerals. Figures 1 to 3 have already been described above and will therefore not be discussed again below.

DESCRIPTION OF EXAMPLES OF IMPLEMENTATION

Figure 4 shows a schematic flow diagram of a basic method 100 for determining a limit value for the signal propagation time of two directly connected network nodes. In step 102, the signal propagation time is first measured in a first operating mode. For this purpose, the method described with reference to Figure 2 c) can be used, for example. The first operating mode is, for example, normal operation of the two network nodes in their system context. The measurement can be carried out several times in succession in order to filter out smaller fluctuations or deviations that can occur during normal operation by averaging or the like. In step 104, the sending of a message of a first type from a first of the two network nodes to the second of the two network nodes is initiated. Before the message is actually sent via the communication medium, it is delayed by a delay value in step 106. In step 108, it is then checked whether the signal propagation time of the message is below a predetermined value despite the delay, so that the message can be processed by the receiving network node without changing an operating mode or an operating parameter of the receiving network node. If this is the case, "yes" branch of step 108, the sending of further messages of the first type is initiated from the first of the two network nodes to the second of the two network nodes, wherein these further messages of the first type are delayed by a delay value that is greater than the respective previous delay value of the previous message. If the check in step 108 shows that the signal propagation time of the message is above a predetermined value due to the delay, so that the message cannot be processed by the receiving network node without changing an operating mode or an operating parameter of the receiving network node, "no" branch of step 108, a limit value for the signal propagation time is determined, or at least a limited range within which the limit value lies. The limit value lies in a range, the lower end of which is determined by the sum of the first in step 102 Signal propagation time and the last set delay value at which the signal propagation time of the message is below a predetermined value despite the delay, so that the message can be processed by the recipient network node without changing an operating mode or an operating parameter of the recipient network node. The upper end of the range is marked by the sum of the signal propagation time first determined in step 102 and the delay value at which the signal propagation time of the message is above a predetermined value for the first time due to the delay, so that the message cannot be processed by the recipient network node without changing an operating mode or an operating parameter of the recipient network node. The limit value or range determined according to the method described above, or a value selected from this range, can then be stored locally and/or output in step 114.

Figure 5 shows an exemplary schematic flow diagram of a method 500 for determining a limit value for the signal propagation time of two network nodes that are directly connected to one another during operation of a system in a first operating mode, without the operation of the system or the network nodes in the first operating mode being disrupted in an uncorrectable or uncompensable manner when determining the upper limit value of the signal propagation time or one of the network nodes of the system being put into a second operating mode. The method according to the invention uses the knowledge that certain messages of the first type do not lead to a disruption of operation if a predetermined value for the signal propagation time is exceeded by no more than a predetermined number of consecutive messages. Individual messages whose signal propagation time is above the limit value can increment an error counter, but this is reset again by the next message whose signal propagation time is below the predetermined value. In this way, the operating behavior of the system can be prevented from being influenced by sporadic errors.

The steps 104, 106 and 108 correspond to those already described with reference to Figure 4. In step 104, the sending of a message of a first type from a first of the two network nodes to the second of the two network nodes. Before the message is actually sent over the communication medium, it is delayed by a delay value in step 106. In step 108, it is then checked whether the signal propagation time of the message is below a predetermined value despite the delay, so that the message can be processed by the receiving network node without changing an operating mode or an operating parameter of the receiving network node.

If this is the case (“yes” branch of step 108), a check is made in step 110 to see whether a longer delay can be set for messages to be sent. If this is possible (“yes” branch of step 110), a longer delay is selected in step 112 and the process is repeated starting with step 104. The setting of a modified delay is indicated by the dashed arrow from step 112 to step 106. If a longer delay cannot be set for messages to be sent (“no” branch of step 110), this greatest possible delay is assumed as the limit value and stored and/or output in step 114.

If the test in step 108 shows that the signal propagation time is above the predetermined value (“no” branch of step 108), the signal propagation time of the direct connection is determined for this delay in step 116, and the delay is deactivated again in step 118. Then, in step 120, another message of the first type is sent so that an error counter that may have been incremented previously due to the signal propagation time being exceeded is reset or so that the system can compensate for or correct this exceeding of the signal propagation time in another way. Then, in step 122, a check is made as to whether a reduced delay can be set that is below the last delay set but above a delay set before this. If this is not the case (“no” branch of step 122), the delay value that led to the predetermined value being exceeded is assumed to be the limit value and stored and/or output in step 114.

If the check in step 122 shows that a reduced delay can be set, but which is higher than the delay set before last, “yes” - branch of step 122, it is selected in step 112 and the process is repeated starting with step 104.

Figure 6 shows an example block diagram of a network node 600 with a microprocessor pP and a typical physical Ethernet interface PHY. The figure shows in particular at which point within the PHY a transmission time stamp is added or assigned to a message, and at which points the message can subsequently be delayed. The microprocessor pP communicates with the PHY via an interface, the implementation of which can be parallel or serial, and which is usually different from the Ethernet transmission medium. Accordingly, a media-independent interface Mil (Media Independent Interface) is provided on the processor side of the PHY. The media-independent interface Mil receives messages from the MAC of the data link level, layer II of the OSI layer model, for transmission via the transmission medium, or forwards received messages to the MAC. A message to be sent, which was received at the media-independent interface Mil and is essentially available as raw data, is subjected to channel coding in a physical coding sublayer PCS before it is actually sent. Channel coding is used to protect digital data against transmission errors when transmitted over faulty channels by adding redundancy. Channel coding adds redundancy to the data at the input of a transmission channel and decodes the data at its output. If the additional information only indicates an error and requires the data to be retransmitted, this is referred to as backward error correction. If the redundancy information is sufficient to correct the error, this is forward error correction. Efficient channel coding increases the signal-to-noise ratio without changing the bit error rate. Depending on the channel coding method, the code gain can be several dB.

An essential property of a channel code is its code rate R = k/n, where k is the number of symbols at the input of the encoder, the information symbols, and n is the number of symbols at the output, the code symbols. Thus, k information symbols are mapped to n code symbols. A small rate, ie, the larger n at the same k means a higher proportion of code symbols in the transmitted symbols, thus a lower data transmission rate. Usually, a channel code with a lower code rate can correct more errors than a comparable channel code with a high code rate - so a trade-off between data transmission rate and error correction capability is possible.

Only the channel-coded data are sent into the transmission medium from a PMA interface adapted to the physical transmission medium.

Received data is processed accordingly in reverse order by the blocks mentioned above.

If a transmission time stamp is added or assigned to a message before transmission or after reception, this can be done in a time stamp unit (TSU) located between the MIL and the PCS so that the time stamps are also captured by the channel coding.

The protocols defined in IEEE 802.1AE for confidential and secure data transmission, also known as MACsec, make it possible to encrypt or decrypt data before sending or after receiving via the communication medium. Encryption takes place between setting the time stamp and before channel coding, among other things so that the time stamp is also protected by encryption and no conclusions can be drawn from the analysis of time stamps.

Based on the arrangement of the functional blocks described above and the resulting predetermined sequence of processing of data to be sent or received, the adjustable delay of the messages required for the method according to the invention after setting the respective time stamp can therefore only take place in one or more of the MACsec, PCS or PMA blocks. Due to the predominantly analog structure of this block, setting a delay in the PMA block does not appear to be possible or only possible to an extremely limited extent, which would not be sufficient for the purposes of the invention.

In contrast, setting a delay in the PCS block appears to be entirely possible, for example by selecting a suitable code rate for channel coding, by means of which the amount of data transmitted on the communication medium can be varied, so that a longer transmission time for a data packet of fixed size, i.e. an additional delay, can be achieved simply by the increased amount of data at a small code rate R compared to a large code rate R.

A particularly suitable block for setting a delay after setting the time stamp and before sending over the communication medium is the MACsec block. By selecting one of the different encryption methods agreed in IEEE 802.1AE, provided it is implemented in a PHY of a network node, a different, always larger amount of encrypted data is generated from a given amount of data after encryption. The choice of key, e.g. its length, can also influence the amount of data added by encryption. The encryption process itself requires data to be stored, which results in a certain additional delay. The increased amount of data caused by encryption, which has to be sent over the communication medium at the same speed as unencrypted data, results in a further delay.

To delay messages of the first type, either the message itself can be encrypted and/or a message of any type sent immediately before the message of the first type can be encrypted. Since the encryption of a message sent before the message of the first type increases its data volume, subsequently sent messages must be delayed accordingly in the flow control buffer of the PHY. Thus, by appropriately selecting the message to be encrypted, if necessary its length, and the encryption method, a delay of at least Messages of the first type can be set in a range from a few hundred nanoseconds to a few microseconds.

The appropriate method in each case, i.e. encryption of a message sent immediately before a message of the first type, choice of encryption method, choice of key length, choice of the length of the message to be encrypted, encryption (also) of the message of the first type as well as the key to be used in each case, its length and the encryption method to be used may depend on the transmission speed of the connection.

Figure 7 shows a schematic flow diagram of a method 700 according to the invention for monitoring the operation of a system with two or more network nodes that are each directly connected to one another. First, a limit value for the signal propagation time on a direct connection between two network nodes to be monitored is determined. For this purpose, one of the methods described with reference to Figure 4 or 5 can be used, for example. Alternatively, the limit value can be read from a memory. According to the invention, in step 702, for sending at least messages of the first type, the sending is delayed by a delay value at which the predetermined value for the signal propagation time is reliably just not exceeded. Then, in step 104, the sending of a message of the first type from a first of the two network nodes to the second of the two network nodes is initiated during operation of the system. Before the message is actually sent via the communication medium, it is delayed by a delay value in step 106. In step 108, it is then checked whether the signal propagation time of the message is below the predetermined value for the signal propagation time despite the delay, so that the message can be processed by the receiving network node without changing an operating mode or an operating parameter of the receiving network node. If this is the case, "yes" branch of step 108, the method is repeated starting with step 104 without changing the delay value set in step 702, whereby the repetition can take place cyclically or at irregular intervals. The control required for this in each case is provided by the between steps 108 and 104. The control can be of a conventional type and use a timer or a (pseudo-)random generator, or an external trigger that reacts to a change in an environmental or system variable or the like.

If the check in step 108 shows that the signal propagation time of the message is above the predetermined value due to the delay, so that the message cannot be processed by the receiving network node without changing an operating mode or an operating parameter of the receiving network node, "no" branch of step 108, an additional delay in the signal propagation time must have been inserted into the direct connection between the two network nodes, or there is another change or disturbance. In any case, the exceedance of the predetermined value of the signal propagation time is signaled in step 704, whereupon at least the network node carrying out the method can initiate further steps or measures.

The monitoring described above can therefore detect an intervention in a direct connection between two network nodes, which results in an extension of the signal propagation time.

If the change in signal propagation time was caused by a permissible intervention in the system, e.g. by temporarily inserting a measuring device via a TAP or a switch or bridge, the system behavior as it existed before the intervention can be restored, e.g. using the procedure described with reference to Figure 8.

Figure 8 shows a schematic flow diagram of a method 800 of an exemplary application of an aspect of the invention in a system with two or more network nodes that are directly interconnected. In the exemplary application, it is to be determined on which direct connections between two network nodes the communication between these network nodes can be recorded and evaluated without the necessary insertion of a TAP or Switches or a bridge result in the operation of the system or the network nodes being disrupted in a way that cannot be corrected or compensated for, or one of the network nodes of the system being put into a second operating mode. According to the invention, in step 802 the extension of the signal propagation time caused by the inserted TAP or switch or the bridge is determined. This can be done, for example, by suitable measurements, based on information in a data sheet or the like. Then, in step 804, a method is determined by means of which a corresponding delay of messages to be sent can be set in the PHY of a network node of the system. It is then verified whether, even with the added delay in the connection between two network nodes, the operation of the system in the previously set operating mode is still possible, or whether none of the network nodes changes to an operating mode other than the previously used operating mode. If this is the case, i.e. operation is possible without changes, a measuring device, TAP or switch or a bridge with a corresponding delay can be looped into this connection. The verification can be carried out, for example, using the method described with reference to Figure 5. This method can therefore be used to identify those connections in a system where a signal propagation time extended by an intervention can be compensated for without actually having to carry out the intervention.

If a monitoring method is carried out in the network nodes of the system as described with reference to Figure 7, the method described above can also be used. As a rule, even with many connections between two network nodes, a minimal further extension of the signal propagation time will result in the predetermined value for the signal propagation time being exceeded. However, this can be compensated by a corresponding reduction in the delay set for normal operation.

Figure 9 shows an exemplary block diagram of a network device 900 configured to carry out one or more aspects of the method according to the invention. The network device 900 comprises a microprocessor 902, volatile and non-volatile memory 904, 906 and one or more communication interfaces 908. The elements of the network device are communicatively connected to one another via one or more data links or buses 910. The non-volatile memory 906 contains computer program instructions which, when executed by the microprocessor 902, configure the network device to carry out at least one embodiment of the method according to the invention.

LIST OF REFERENCE SYMBOLS

1 , 2 network nodes 900 network nodes

3 Network/Connection 902 Microprocessor

904 volatile memory

100 Procedure 906 non-volatile memory

102 Measuring signal propagation time 908 Communication interface

104 Initiate sending 910 Data connections / buses

106 Delay sending

108 pre-determined value exceeded?

109 Repetition Control

110 larger delay adjustable?

112 select larger/smaller directory

114 Output limit value

116 Determine signal propagation time

118 Disable delay

120 Send message without delay

122 smaller delay adjustable?

500 procedures

600 network nodes

700 procedures

702 Delay sending

704 Signal exceedance

800 procedures

802 Determine signal propagation time

804 Determine delay procedure

Claims

EXPECTATIONS 1 . Method (100) for determining a limit value for the signal propagation time on a connection between two directly connected network nodes of a system comprising a plurality of network nodes connected via a network, the method comprising: a) determining (102) the signal propagation time between the directly connected network nodes, the method being characterized by the steps: b) initiating (104) a message of a first type via the direct connection, to which a transmission time stamp is added or assigned in the transmitter and/or a reception time stamp is added or assigned in the receiver, c) delaying (106) the message after setting the transmission time stamp and before sending the message via the physical layer and/or after receiving the message via the physical layer and before setting the reception time stamp by a first value or by first values in each case, d) delayed sending of the message via the physical layer, e) checking (108) whether the signal propagation time has exceeded a predetermined value, f1) repeating steps c) to e) with a value that is lower than the previously set value in each case Delay value or compared to the previously set Delay values increased delay value or delay values until the signal propagation time has exceeded the predetermined value, and h) storing and/or outputting (114) the last delay value or delay values as determined limit value or limits for the direct connection at which the signal propagation time has not yet exceeded the predetermined value. 2. Method according to claim 1, further comprising, after the signal propagation time has exceeded the predetermined value for the first time in step f1): f2) repeating steps c) to e) with the previously set delay value or the previously set delay values until the signal propagation time exceeds the predetermined value a previously set number of attempts or repetitions in sequence has been exceeded, whereby, if the signal propagation time has again fallen below the predetermined value before the specified number of attempts or repetitions is reached, the method is repeated with step c) and a further increased delay time. 3. Method according to claim 1 or 2, further comprising, after the signal propagation time has exceeded the predetermined value in step f1) or has exceeded a predetermined number of attempts or repetitions in a row in step f2): - g2) Repeating steps c) to e) with a delay value or delay values that are reduced compared to the previously set delay value or delay values until the signal propagation time no longer exceeds the predetermined value. 4. Method according to claim 3, further comprising, after the signal propagation time in step g2) has fallen below the predetermined value for the first time: g3) repeating steps c) to e) with the previously set delay value or the previously set delay values until the signal propagation time has fallen below the predetermined value for a previously set number of attempts or repetitions in succession, wherein, if the signal propagation time has exceeded the predetermined value again before the set number of attempts or repetitions is reached, the method is repeated with step c) and a further reduced delay time. 5. The method of claim 3 or 4, further comprising: - g1) initiating (104) and sending () without delay a message of a first type via the direct connection, to which a transmission time stamp is added or assigned in the transmitter and/or a reception time stamp in the receiver, after each delayed message whose signal propagation time has exceeded the predetermined value. 6. The method of any one of claims 1 to 5, wherein the delayed transmission (106) comprises: - Encrypting a message sent immediately before a message of the first type, and/or - Encrypting at least the first type of messages after setting the transmission timestamp, and/or wherein the delayed receiving comprises: - Decrypting the message received immediately before a message of the first type, and/or - Decrypt at least the first type of messages before setting the reception timestamp. 7. The method of claim 6, wherein setting different delays comprises: - Encryption of at least the first type of messages with different encryption parameters. 8. Method (700) for detecting an intrusion into a direct connection between two network nodes (1, 2) of a system during operation, comprising: - cyclical or irregularly repeated initiation (104) of messages of the first type, to which a transmission time stamp is added or assigned in the sender and/or a reception time stamp in the receiver, - delaying (106) at least the first type of messages after setting the transmission time stamp and before sending the message via the physical layer and/or after receiving the message via the physical layer and before setting the reception time stamp by a limit value determined in the method according to one of claims 1 to 6 or by limit values determined in the method according to claims 1 to 6 for the direct connection, - checking (108) whether the signal propagation time has exceeded a predetermined value, wherein the method, if the signal propagation time has exceeded a predetermined value, further comprises: - Signaling (704) that the limit value has been exceeded. 9. The method of claim 8, wherein in response to the signaling (704) the system or at least one of the network nodes is placed in an error mode or the delay (106) is reduced at least for the first type of messages to a value at which the signal propagation time does not exceed a predetermined value. 10. The method according to claim 9, wherein delaying (106) to a value at which the signal propagation time does not exceed a predetermined value comprises re-determining the limit value by means of a method according to one of claims 1 to 6. 11. Network node (900) configured to communicate with another network node via a direct connection (3), having at least one processor (902), volatile (904) and non-volatile (906) memory, and a network interface (908), wherein computer program instructions are stored in the non-volatile memory (906) in a retrievable manner, which, when executed by the at least one processor, configure the network node (900) to carry out a method for determining a limit value for the signal propagation time and/or for monitoring the integrity of the communication according to one of the preceding claims 1 to 10. 12. System, in particular vehicle system, with two or more network nodes each connected to one another via direct connections, wherein at least one of the network nodes is a network node (900) according to claim 11. 13. Computer program product comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method according to one or more of claims 1 to 10. 14. A computer-readable medium on which the computer program product according to claim 13 is stored.