KR102447980B1 - Unmanned ground vehicle with dual network system and operating method thereof - Google Patents

Abstract

The present invention relates to a vehicle having a dual network structure and a method for operating the same, and an embodiment of the present invention includes a plurality of function control units configured to operate according to a predefined interface protocol (ICD), from an external operating device. A data network configured to receive a control message for operating the plurality of function control units and transmit it to a function control unit corresponding to the control message, configured to connect with an external management device for installing or checking software of the plurality of function control units and a network management device configured to manage the data network and the management network, wherein the plurality of function controllers transmit control messages transmitted and received through the data network to the network management device through the management network. duplicate transmission, and the network management device checks whether the duplicated transmitted message is a message defined in the interface protocol, and controls the connection between the plurality of function controllers and the data network based on the check result A vehicle having a dual network structure is provided.

Description

A vehicle having a dual network structure and an operating method thereof {UNMANNED GROUND VEHICLE WITH DUAL NETWORK SYSTEM AND OPERATING METHOD THEREOF}

The present invention relates to a vehicle having a dual network structure and a method for operating the same, and more particularly, to a vehicle having a dual network structure for protecting function controllers configured to operate according to a predefined interface protocol, and an operating method thereof will be.

Recently, due to the development of information processing technology and image processing technology, the development of a vehicle capable of remote operation and autonomous driving is being actively conducted. A large amount of data used for remote operation and autonomous driving of a vehicle is transmitted and received between functional units constituting a vehicle system through a network inside the vehicle. In order to stably operate the vehicle system, it is necessary to protect a large amount of data through the network inside the vehicle from external cyber attacks.

In order to protect the network inside the vehicle, in most cases, equipment for monitoring network traffic is separately constructed to check whether there is no hacking of the network or abnormal operation of functional units. In the defense field, if the internal network of a military vehicle is exposed to hacking or viruses, it can cause a large power loss. In addition, when the data network that controls each functional part of the vehicle system is exposed to the outside, there is a risk of the equipment being hijacked.

Each functional unit constituting the vehicle system used in the defense field operates according to the contents defined in a specially predefined interface control data (ICD). If each functional unit continuously transmits or receives a message that is not defined in the interface protocol, it is highly likely that the functional unit malfunctions or is exposed to cyber attacks, and a quick response is required. Security solutions for general Ethernet systems make it difficult to determine the operating state of each functional part constituting the vehicle system used in the defense field, as well as to determine whether a message transmitted and received through the network is a message defined in the interface protocol. it is impossible

Accordingly, there is a need to provide an appropriate security function for a vehicle having functional units operating according to a predefined interface protocol and an internal network composed of the functional units.

A first technical problem to be solved by the present invention is to provide a vehicle having a dual network structure including a data network, a management network, and a network management device.

A second technical problem to be solved by the present invention is to provide a method for operating a vehicle having the above-described dual network structure.

In order to solve the first technical problem described above, an embodiment of the present invention operates a plurality of function control units configured to operate according to a predefined interface protocol (ICD), and the plurality of function control units from an external operating device a data network configured to receive a control message for instructing and forward the control message to a function control unit corresponding to the control message, a management network configured to connect with an external management device for installing or checking software of the plurality of function control units, and the data a network management device configured to manage a network and the management network, wherein the plurality of function controllers duplicate and transmit control messages transmitted and received through the data network to the network management device through the management network, and the network management The device is configured to check whether the duplicated transmitted message is a message defined in the interface protocol, and to control a connection between the plurality of function control units and the data network and the management network based on the check result A vehicle having a structure is provided.

The vehicle having a dual network structure may further include a management interface for physically connecting the external management device to the management network.

The vehicle having a dual network structure checks whether the external management device is registered in an access control list, and when the external management device is registered in the access control list, the external management device and the It may further include a management network switch that allows access of the encryption access method of the management network.

The management network switch may request user authentication corresponding to a function control unit to be accessed by the management device, and allow the external management device to connect to the management network when the user is authenticated.

The network management apparatus includes: a recorder that duplicates the control messages transmitted and received through the data network and stores them in a message storage unit; a protocol storage unit that stores and manages interface protocol information defined for the control messages; and the protocol It may include an analyzer for comparing the interface protocol stored in the storage unit and the message recorded in the message storage unit.

The network management device compares the interface protocol with the stored control messages, records them in a log when control messages not defined in the interface protocol are transmitted and receives, and provides a notification about this through the manager interface, in advance When more than a preset number of control messages violating a set security condition are accumulated, the connection between the plurality of function controllers and the data network may be disconnected and reconfigured.

The network management apparatus includes a plurality of encrypted IP table sets, and when the number of control messages not defined in the interface protocol is accumulated more than a preset number, the IP assigned to the function control units is removed, and the plurality of A new IP may be assigned to the function controllers by selecting any one of the encrypted IP table sets.

In order to solve the second technical problem described above, in an embodiment of the present invention, an external management device connects to a management network to install or check software in a plurality of function control units configured to operate according to a predefined interface protocol. requesting, the management network switch confirming whether the external management device is registered in the access control list, if the external management device is registered in the access control list, the management network switch is the external management device A message transmitted and received by the management network switch through the management network, allowing access of the encryption access method of confirming whether they are messages defined in the interface protocol, and the management network switch and the plurality of function controllers based on whether messages transmitted and received through the management network are messages defined in the interface protocol A dual network structure comprising the step of controlling a connection of a data network, wherein the data network is configured to receive a control message for operating the plurality of function control units and forward the control message to a function control unit corresponding to the control message It provides a method of operating a vehicle having.

In this case, in the method of operating the vehicle, when the management network switch detects that a management device not registered in the access control list attempts to access the management network for more than a preset time or number of times, the network management device performs the The method may include reconfiguring by disconnecting the plurality of function controllers from the data network.

The step of the management network switch disconnecting and reconfiguring the connection between the plurality of function control units and the data network may include removing, by the management network switch, the existing connection between the plurality of function control units and the data network, and the management It may be a step of selecting one IP table from a plurality of encrypted IP table sets provided by the network switch, and assigning a new IP to the function controllers based on the selected IP table.

In another embodiment of the present invention, a data network receives a control message for operating a plurality of function control units configured to operate according to a predefined interface protocol from an external operating device, and sends the control message to the function control unit corresponding to the control message. transmitting, by the plurality of function controllers, copying and transmitting messages transmitted and received through the data network to a network management device through a management network, wherein the network management device copies the transmitted message to a message defined in the interface protocol checking whether or not the duplicated transmitted message is a message defined in the interface protocol, and controlling, by the network management device, a connection between the plurality of function control units and the data network. and, the management network is configured to connect with an external management device for installing or checking software of the plurality of function control units.

In the step of controlling, by the network management device, the connection between the plurality of function controllers and the data network, when the number of control messages violating a preset security condition is accumulated more than a preset number, the network management device performs the control of the plurality of functions removing an existing connection between the controllers and the data network; selecting one IP table from a plurality of encrypted IP table sets provided by the network management device; based on the selected IP table, the function controllers It may include the step of assigning a new IP to the.

One embodiment of the present invention provides a computer program stored in a computer-readable storage medium to execute any one of the above-described operating methods of a vehicle having a dual network structure using a computing device.

A vehicle having a dual network structure according to an embodiment of the present invention includes a data network configured to receive and transmit a control message for operating the function control units from an external operating device, and an external for installing or checking software of the function control units. By including the dual network structure of the management network configured to connect with the management device, even when the management network is attacked using an external management device, the data network controlling the operation of each functional unit can be protected.

The external management device may physically connect to a management interface located outside the vehicle. Accordingly, external management devices can easily perform software installation, inspection, or operation monitoring for functional units constituting the vehicle system by accessing the management network.

The management network switch may control access of the management device based on the access control list to prevent a cyber attack through the external management device.

The network management device stores control messages transmitted and received through the data network, analyzes them based on the interface protocol, and when a predetermined number or more of control messages that violate preset security conditions are accumulated, a plurality of function control units and the data network It is possible to efficiently protect the plurality of function control units by controlling the connection of the .

The technical effects of the present invention are not limited to those mentioned above, and other technical effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a block diagram illustrating a dual network structure of a vehicle according to an embodiment of the present invention.
FIG. 2 is a diagram for explaining a method of installing or checking software of a function control unit through the management network shown in FIG. 1 .
FIG. 3 is a diagram for explaining a method of controlling a function controller through the data network shown in FIG. 1 .
4 is a diagram illustrating a vehicle having a dual network structure according to an embodiment of the present invention.
5 is a diagram illustrating a user authentication screen according to an embodiment of the present invention.
6 is a flowchart illustrating a method of operating a vehicle having a dual network structure for installing or checking software of a function control unit according to an embodiment of the present invention.
7 is a flowchart illustrating a method of operating a vehicle having a dual network structure for controlling a function controller according to an embodiment of the present invention.

While the present invention is susceptible to various modifications and variations, specific embodiments thereof are illustrated and shown in the drawings and will be described in detail below. However, it is not intended to limit the invention to the particular form disclosed, but rather the invention includes all modifications, equivalents and substitutions consistent with the spirit of the invention as defined by the claims.

It will be understood that when an element, such as a layer, region, or substrate, is referred to as being “on” another component, it may be directly on the other element or intervening elements in between. .

The present invention may be represented in functional block configurations and various processing steps. These functional blocks may be implemented in any number of hardware and/or software configurations that perform specific functions. For example, the present invention provides integrated circuit configurations, such as memory, processing, logic, look-up tables, etc., capable of executing various functions by the control of one or more microprocessors or other control devices. can be hired Similar to how components of the present invention may be implemented as software programming or software elements, the present invention includes various algorithms implemented as data structures, processes, routines, or combinations of other programming constructs, including C, C++ , Java, assembler, etc. may be implemented in a programming or scripting language. It may be implemented as a functional or algorithm running on more than one processor. In addition, the present invention may employ prior art techniques for electronic configuration, signal processing, and/or data processing, and the like. Terms such as “part”, “element”, “means” and “constituent” may be used broadly, and the components of the present invention are not limited to mechanical and physical components. The term may include the meaning of a series of routines of software in connection with a processor or the like.

Although the terms first, second, etc. may be used to describe various elements, components, regions, layers and/or regions, such elements, components, regions, layers and/or regions are not It will be understood that they should not be limited by these terms.

With reference to the accompanying drawings, preferred embodiments of the present invention will be described in more detail. Hereinafter, the same reference numerals are used for the same components in the drawings, and repeated descriptions of the same components are omitted.

1 is a block diagram illustrating a dual network structure of a vehicle according to an embodiment of the present invention.

Referring to FIG. 1 , a dual network structure 100 of a vehicle according to an embodiment of the present invention includes a plurality of functional units 110 , a data network 120 , a management network 130 , a network management device 140 , and domain controller 150 .

The plurality of functional units 110 is configured to perform a main function of the vehicle, such as remote driving, autonomous driving, monitoring, or shooting. The plurality of functional units 110 are configured to operate according to a predefined interface control data, and include function control units 111 corresponding to each functional unit 110 .

The data network 120 is configured to receive a control message for operating the plurality of function control units 111 from the external operation device 10 and transmit it to the function control unit 111 corresponding to the control message. The data network 120 may include a communication device 121 for receiving a control message from the external operation device 10 and transmitting status information of the plurality of functional units 110 .

The communication device 121 may be configured to communicate with various types of external operation devices 10 according to various types of wireless communication schemes. The communication device 121 may include at least one of a Wi-Fi chip, a Bluetooth chip, a wireless communication chip, and an NFC chip. In particular, in the case of using a Wi-Fi chip or a Bluetooth chip, various types of connection information such as an SSID and a session key are first transmitted and received, and then various types of information can be transmitted and received after communication connection using the same. The wireless communication chip refers to a chip that performs communication according to various communication standards such as IEEE, Zigbee, 3rd Generation (3G), 3rd Generation Partnership Project (3GPP), and Long Term Evolution (LTE). The NFC chip refers to a chip operating in an NFC (Near Field Communication) method using a 13.56 MHz band among various RF-ID frequency bands such as 135 kHz, 13.56 MHz, 433 MHz, 860 to 960 MHz, 2.45 GHz, and the like.

Through the data network 120 , the plurality of function control units 111 provide not only a control message but also a large amount of data for performing the main function of the vehicle between the external operating device 10 and the mutual function units 110 . can receive

The management network 130 is configured to connect with an external management device 20 for installing or checking software of the plurality of function control units 111 .

The external management device 20 accesses the corresponding function control unit 111 through the management network 130 to install or check software of the function control unit 111 or monitor the operation of the function unit 110 . can do.

The management network 130 is a management interface 131 for physically accessing the external management device 20 and a management network switch that determines whether to allow the access of the external management device based on an access control list. (133) may be included.

The management interface 131 may be disposed outside the vehicle for smooth connection of the external management device 20 . The management interface 131 may include an interface connectable to various external management devices, such as gigabit Ethernet, RS-232/422, and CAN bus. The software of the function control unit 111 allows only installation and update through the management interface 131, and installation and update by other connection methods are not allowed.

The management interface 131 may further include an input/output device. The output device may be a display device for monitoring the status of the function unit 110 and the status of the function control unit 111 or displaying the connection status between the management device 20 and the management network 130 . The input device is a device for a user's input using the management interface 131 and may be a variety of well-known input devices such as a mouse, a keyboard, or a touch screen.

The management network switch 133 checks whether the external management device 20 is registered in the access control list, and when the external management device 20 is registered in the access control list, the external management device ( 20 ) and the management network 130 , and when the external management device 20 is not registered in the access control list, the external management device 20 accesses the management network 130 . to protect the plurality of function control units 111 by blocking.

The management network switch 133 permits only an encrypted connection method between the external management device 20 and the corresponding function control unit 111 to block access of a non-encrypted connection method such as telnet or ftp. In this case, the encryption access method may be an SSH (Secure Shell) method.

The management network switch 133 may request user authentication corresponding to the function controller 111 to which the external management device 20 wants to access. The user authentication request is displayed to the user through the output device of the management interface 131 , and the user may perform user authentication through the input device of the management interface 131 . The user authentication may be performed using various well-known user authentication methods such as a password input method, a biometric authentication method, and a security key method.

The management network switch 133 may be logically separated from the data network 120 by providing a logical device including an independent processor board or a single board computer. When the logic device detects a hacking attempt or abnormal traffic through the management interface 131 , it may block it. For example, when an abnormal message is received through the management interface 131 or access attempts of the external management device 20 not registered in the access control list are accumulated for a predetermined time or a predetermined number of times, the management network switch 133 is The access control list may be updated, and the connection between the plurality of function controllers 111 and the data network may be released and reconfigured. The logical device can remove the existing connection information, select one IP table from a plurality of encrypted IP table sets, and change the IP settings of each of the function control units 111 using the domain controller 150 . have.

The network management device 140 is configured to manage the data network 120 and the management network 130 .

The plurality of function controllers 111 duplicate and transmit a control message transmitted and received through the data network 120 to the network management device 140 through the management network 130 , and the network management device 140 . checks whether the duplicate transmitted message is a message defined in the interface protocol, and controls the connection between the plurality of function controllers 111 and the data network 120 based on the check result.

The network management device 140 duplicates the control messages transmitted and received through the data network 120 and stores the recorder 141 in the message storage unit 143 and the interface protocol information defined for the control messages. It may include a protocol storage unit 147 that stores and manages, and an analyzer 145 that compares the interface protocol stored in the agreement storage unit 147 with the duplicated transmitted message.

The analyzer 145 compares the interface protocol stored in the protocol storage unit 147 with the control messages stored in the message storage unit 143, and classifies control messages that violate a preset security condition as abnormal control messages.

The analyzer 145 receives the control message received by the function control unit 110 when the sender and the sender defined in the interface protocol are different, when the function control unit is not a control message defined to be received by the function control unit in the interface protocol, or the interface If it is received at a period different from the transmission period of the control message defined in the protocol, it can be classified as an abnormal control message.

When the number of abnormal control messages is accumulated by more than a preset number, the network management apparatus 140 may disconnect and reconfigure the connection between the plurality of function controllers 110 and the data network 120 . For example, when the control message transmitted from the first function control unit 111a to the second function control unit 111b through the data network 120 is a control message that is not defined in the interface protocol, the network management device 140 may It is possible to classify an abnormal control message, record it in a log, and provide a notification about this through the manager interface. In addition, the data network 120 connected to each function control unit 111 may be temporarily blocked. Thereafter, the access control list of the function control units 111 may be updated, and control of each function control unit 111 may be requested using the domain controller 150 . The network management device 140 includes a plurality of encrypted IP table sets, removes IPs assigned to the plurality of function control units 111, and selects any one of the plurality of encrypted IP table sets. A new IP may be assigned to the function controllers 111 .

Accordingly, in the network management device 140 , the recorder 141 and the message storage unit 143 serve as a black box of the data network 120 , and the analyzer 146 interfaces with the protocol storage unit 147 . By analyzing the stored messages based on the protocol, messages not defined in the interface protocol can be found.

FIG. 2 is a diagram for explaining a method of installing or checking software of a function control unit through the management network shown in FIG. 1 .

Referring to FIG. 2 , the external management device 20 may physically access the management network 130 through the management interface 131 .

The external management device 20 may be a device for installing or checking software of the function control unit 111 or monitoring the operation of the function unit 110 .

The external management device 20 may access the management network 130 only through the management interface 131 , and software installation or inspection of the function control unit 111 by other access methods is not permitted.

The management interface 131 may be disposed outside the vehicle for smooth connection of the external management device 20 . The management interface 131 may include an interface connectable to various external management devices, such as gigabit Ethernet, RS-232/422, and CAN bus.

The management network switch 133 checks whether the external management device 20 is registered in the access control list, and when the external management device 20 is registered in the access control list, the external management device ( 20 ) and the management network 130 , and when the external management device 20 is not registered in the access control list, the external management device 20 accesses the management network 130 . to protect the plurality of function control units 111 by blocking.

The management network switch 133 permits only an encrypted connection method between the external management device 20 and the corresponding function control unit 111 to block access of a non-encrypted connection method such as telnet or ftp. In this case, the encryption access method may be an SSH (Secure Shell) method.

The management network switch 133 may request user authentication corresponding to the function controller 111 to which the external management device 20 wants to access. The user authentication request is displayed to the user through the output device of the management interface 131 , and the user may perform user authentication through the input device of the management interface 131 . The user authentication may be performed using various well-known user authentication methods such as a password input method, a biometric authentication method, and a security key method.

The management network switch 133 may be logically separated from the data network 120 by providing a logical device including an independent processor board or a single board computer. When the logic device detects a hacking attempt or abnormal traffic through the management interface 131 , it may block it. For example, when an abnormal message is received through the management interface 131 or access attempts of the external management device 20 not registered in the access control list are accumulated for a predetermined time or a predetermined number of times, the management network switch 133 is The access control list may be updated, and the connection between the plurality of function controllers 111 and the data network may be released and reconfigured. The logical device can remove the existing connection information, select one IP table from a plurality of encrypted IP table sets, and change the IP settings of each of the function control units 111 using the domain controller 150 . have.

The management network switch 133 functions as a kind of firewall, and when the connection between the external management device 20 and the function control unit 111 is permitted from the management network switch 133 , the management device 20 functions as a function control unit 111 . It is possible to transmit and receive messages and data for software installation, inspection, or monitoring of the functional units 110 .

FIG. 3 is a diagram for explaining a method of controlling a function controller through the data network shown in FIG. 1 .

Referring to FIG. 3 , the operation device 10 transmits a control message to the function controller 110 through the data network 120 .

The operating device 10 transmits a control message to perform a main function of the vehicle, such as remote driving, autonomous driving, monitoring, or shooting, and provides status information and acquired data of the functional units 110 of the vehicle to the user. It may be a delivery device. For example, the operating device 10 may be a device for remotely controlling a vehicle, but is not limited thereto.

The data network 120 is configured to receive a control message for operating the plurality of function control units 111 from the external operation device 10 and transmit it to the function control unit 111 corresponding to the control message. The data network 120 may include a communication device 121 for receiving a control message from the external operation device 10 and transmitting status information of the plurality of functional units 110 .

The communication device 121 may be configured to communicate with various types of external operation devices 10 according to various types of wireless communication schemes. The communication device 121 may include at least one of a Wi-Fi chip, a Bluetooth chip, a wireless communication chip, and an NFC chip. In particular, in the case of using a Wi-Fi chip or a Bluetooth chip, various types of connection information such as an SSID and a session key are first transmitted and received, and then various types of information can be transmitted and received after communication connection using the same. The wireless communication chip refers to a chip that performs communication according to various communication standards such as IEEE, Zigbee, 3rd Generation (3G), 3rd Generation Partnership Project (3GPP), and Long Term Evolution (LTE). The NFC chip refers to a chip operating in an NFC (Near Field Communication) method using a 13.56 MHz band among various RF-ID frequency bands such as 135 kHz, 13.56 MHz, 433 MHz, 860 to 960 MHz, 2.45 GHz, and the like.

Through the data network 120 , the plurality of function control units 111 provide not only a control message but also a large amount of data for performing the main function of the vehicle between the external operating device 10 and the mutual function units 110 . can receive

In this case, the network management device 140 may be further included to monitor control messages and data through the data network 120 .

The network management device 140 is configured to manage the data network 120 and the management network 130 .

The plurality of function controllers 111 duplicate and transmit a control message transmitted and received through the data network 120 to the network management device 140 through the management network 130 , and the network management device 140 . checks whether the duplicate transmitted message is a message defined in the interface protocol, and controls the connection between the plurality of function controllers 111 and the data network 120 based on the check result.

The network management device 140 duplicates the control messages transmitted and received through the data network 120 and stores the recorder 141 in the message storage unit 143 and the interface protocol information defined for the control messages. It may include a protocol storage unit 147 that stores and manages, and an analyzer 145 that compares the interface protocol stored in the agreement storage unit 147 with the duplicated transmitted message.

The analyzer 145 compares the interface protocol stored in the protocol storage unit 147 with the control messages stored in the message storage unit 143, and classifies control messages that violate a preset security condition as abnormal control messages. The analyzer 145 receives the control message received by the function control unit 110 when the sender and the sender defined in the interface protocol are different, when the function control unit is not a control message defined to be received by the function control unit in the interface protocol, or the interface If it is received at a period different from the transmission period of the control message defined in the protocol, it can be classified as an abnormal control message.

When the number of abnormal control messages is accumulated by more than a preset number, the network management apparatus 140 may disconnect and reconfigure the connection between the plurality of function controllers 110 and the data network 120 . For example, when the control message transmitted from the first function control unit 111a to the second function control unit 111b through the data network 120 is a control message that is not defined in the interface protocol, the network management device 140 may It is possible to classify an abnormal control message, record it in a log, and provide a notification about this through the manager interface. In addition, the data network 120 connected to each function control unit 111 may be temporarily blocked. Thereafter, the access control list of the function control units 111 may be updated, and control of each function control unit 111 may be requested using the domain controller 150 . The network management device 140 includes a plurality of encrypted IP table sets, removes IPs assigned to the plurality of function control units 111, and selects any one of the plurality of encrypted IP table sets. A new IP may be assigned to the function controllers 111 .

The network management device 140 may include a processor to control the data network 120 and the management network 130 . In an embodiment, the processor unit may include a CPU, a RAM, a ROM, and a system bus. Here, the ROM is a configuration in which a command set for system booting is stored, and the CPU copies the operating system stored in the memory of the remote control device 100 to the RAM according to the commands stored in the ROM, and executes O/S to boot the system. make it Alternatively, the processor unit may be implemented as a digital signal processor (DSP), a microprocessor, or a time controller (TCON) that processes a digital signal, but is not limited thereto, and a central processing unit (central processing unit) unit (CPU)), micro controller unit (MCU), micro processing unit (MPU), controller, application processor (AP), or communication processor (CP), one of the ARM processors. or more, or may be defined by the term.

The management network 130 shown in FIG. 2 and the data network 120 shown in FIG. 3 are logically separated, so that even if there is a cyber attack attempt through the management interface 131 , data for controlling the main function of the vehicle It is possible to keep the network 120 secure.

4 is a diagram illustrating a vehicle having a dual network structure according to an embodiment of the present invention.

Referring to FIG. 4 , a vehicle having a dual network structure according to an embodiment of the present invention may be a military vehicle equipped with a weapon system.

The vehicle may be an unmanned vehicle capable of remote driving or autonomous driving, and functions such as shooting and monitoring may be performed by remote control or an unmanned program.

The vehicle may include a plurality of functional units 110 for performing main functions of the vehicle, such as remote driving, autonomous driving, shooting, and monitoring. The plurality of functional units 110 include corresponding function control units 111, respectively, and the function control units 111 include a management network 130 for installation and inspection, and a control message for controlling a main function. It is possible to configure the dual network structure 100 including the data network 120 for transmitting and receiving the data.

The vehicle may include a communication device 121 for receiving a control message from the external operation device 10 , and transmitting status information and acquired data of each functional unit 110 .

In addition, the vehicle installs or checks the software of the function control units 111 , and facilitates the external management devices 20 and the management network 130 for monitoring the operating state of the function units 110 . It may further include a management interface 131 for access.

The management interface 131 may be disposed outside the vehicle for smooth connection of the external management device 20 . The management interface 131 may include an interface connectable to various external management devices 20 such as gigabit Ethernet, RS-232/422 and CAN bus. The software of the function control unit 111 allows only installation and update through the management interface 131, and installation and update by other connection methods are not allowed.

The management interface 131 may further include an input/output device. The output device may be a display device for monitoring the status of the function unit 110 and the status of the function control unit 111 or displaying the connection status between the management device 20 and the management network 130 . The input device is a device for a user's input using the management interface 131 and may be a variety of well-known input devices such as a mouse, a keyboard, or a touch screen.

5 is a diagram illustrating a user authentication screen according to an embodiment of the present invention.

Referring to FIG. 5 , the management interface 131 may include an input/output device and display a user authentication screen as illustrated.

The management network switch 133 may request user authentication corresponding to the function controller 111 to which the external management device 20 wants to access. The user authentication request is displayed to the user through the output device of the management interface 131 , and the user may perform user authentication through the input device of the management interface 131 . Although not shown in the drawings, the user authentication may be performed using various well-known user authentication methods such as a password input method, a biometric authentication method, and a security key method.

6 is a flowchart illustrating a method of operating a vehicle having a dual network structure for installing or checking software of a function control unit according to an embodiment of the present invention.

6 , the operating method of a vehicle having a dual network structure is defined in the management network access request step (S101), the access control list registration check step (S102), the access permission or access block step (S103), and the interface protocol It includes a step (S104) of confirming whether the message has been sent, and a step (S105) of reconfiguring the network or installing or checking software according to the check result.

The management network access request step S101 is a step in which the external management device requests access to the management network to install or check software in a plurality of function control units configured to operate according to a predefined interface protocol. In this case, the external management device may be physically connected through a management interface located outside the vehicle.

The access control list registration check step ( S102 ) is a step in which the management network switch checks whether the external management device is registered in the access control list.

In the access permission or access blocking step (S103), when the external management device is registered in the access control list, the management network switch allows the external management device and the management network to access the encrypted connection method, When the external management device is not registered in the access control list, blocking access to the external management device. In this case, the encryption access method may be an SSH method.

The management network switch may block such abnormal access and update the access control list when access attempts of external management devices not registered in the access control list are accumulated for a predetermined time or a predetermined number of times or more. The management network switch may disconnect and reconfigure a connection between the plurality of functional control units and the data network and the management network. For example, the management network switch may remove the existing connection information, select one IP table from a plurality of encrypted IP table sets, and change the IP settings of each function control unit using a domain controller.

When the external management device is registered in the access control list, the external management device may be connected to a corresponding function control unit through the management network. At this time, although not shown in the drawing, the management network switch may request user authentication for the function control unit. A user who wants to install and inspect the software of the function control unit using an external management device or monitor the operation state of the function unit can perform user authentication using the input/output device of the management interface.

In the step of checking whether the message is defined in the interface protocol (S104), it is checked whether the message transmitted/received between the external management device and the function controller through the management network is a message defined in the interface protocol.

In the step of reconfiguring the network or installing or checking the software according to the check result (S105), if the message is a message that is not defined in the interface protocol, the management network switch connects the data network with the plurality of function control units. It is released and reconfigured, and when the message is a message defined in the interface protocol, software installation, inspection, or monitoring of the function control unit using the management device is performed.

7 is a flowchart illustrating a method of operating a vehicle having a dual network structure for controlling a function controller according to an embodiment of the present invention.

Referring to FIG. 7 , the operating method of a vehicle having a dual network structure includes receiving and delivering a control message (S201), replicating and transmitting the control message to the network management device (S202), and whether the control message is defined in the interface protocol. It includes the step of checking whether or not (S203) and the step of reconfiguring the network when the control message is not defined in the interface protocol (S204).

Receiving and transmitting the control message ( S201 ) is a step in which the data network receives a control message for operating the plurality of function control units from an external operating device and transmits the control message to the function control unit corresponding to the control message. In this case, the plurality of function control units are configured to operate according to a predefined interface protocol, and the control message is for controlling the plurality of function units to perform a main function such as remote driving, autonomous driving, shooting or monitoring of the vehicle. .

The data network may receive a control message from an external operating device through a communication device, and the communication device may be configured to communicate with various types of external operating devices according to various types of wireless communication methods.

The step of copying and transmitting the control message to the network management apparatus ( S202 ) is a step in which the plurality of function controllers copy and transmit control messages transmitted and received through the data network to the network management apparatus through the management network.

In the step S203 of confirming whether the control message is defined in the interface protocol, the recorder stores the control message duplicated and transmitted to the network management device in the message storage unit, and the analyzer stores the stored control message in the protocol storage interface Compared with the protocol, it is a step to check whether the message is defined in the interface protocol.

In the case of the control message defined in the interface protocol, the network management apparatus maintains the data network so that each functional unit receives the control message and performs a corresponding function.

In the case of a control message that violates a preset security condition, a step S204 of reconfiguring the network is performed. In the step of reconfiguring the network ( S204 ), the network management device compares the interface protocol stored in the protocol storage unit with the control messages stored in the message storage unit, and when control messages not defined in the interface protocol are transmitted and received, it is stored in the log. When the abnormal control message accumulates more than a preset number by recording, providing a notification about this through the manager interface, and classifying control messages that violate preset security conditions as abnormal control messages, the network management device performs a plurality of functions This is a step of disconnecting and reconfiguring the connection between the controllers and the data network.

For example, when the abnormal control messages are accumulated by more than a preset number, the network management apparatus may update the access control list of the function controllers and request control of each of the function controllers by using the domain controller. As an example, the network management apparatus includes a plurality of encrypted IP table sets, removes IPs assigned to the plurality of function control units, and selects any one of the plurality of encrypted IP table sets for the function control units. IP settings can be renewed.

The method of operating a vehicle having a dual network structure according to various embodiments of the present invention can be written as a program that can be executed on a computer, and can be implemented in a general-purpose digital computer that operates the program using a computer-readable recording medium. can The computer-readable recording medium includes a storage medium such as a magnetic storage medium (eg, ROM, floppy disk, hard disk, etc.) and an optically readable medium (eg, CD-ROM, DVD, etc.).

The method of operating a vehicle having a dual network structure according to various embodiments of the present disclosure may be performed by a computing device, and the computing device for this may correspond to at least one processor or include at least one processor. can The computing device may be driven by being included in another hardware device such as a microprocessor or general-purpose computer system.

In the above, the configuration and features of the present invention have been described based on the embodiments according to the present invention, but the present invention is not limited thereto. Various changes or modifications can be made by those skilled in the art to which the present invention pertains within the spirit and scope of the present invention, and therefore such changes or modifications fall within the scope of the appended claims.

10: external operation device 20: external management device
100: double network structure
110: a plurality of function units 111: a plurality of function control unit
120: data network 121: communication device
130: management network 131: management interface
133: management network switch
140: network management device 141: recorder
143: message storage 145: analyzer
147: protocol storage
150 : domain controller

Claims (13)

a plurality of function control units configured to operate according to a predefined interface protocol (ICD);
a data network configured to receive a control message for operating the plurality of function control units from an external operating device and transmit it to a function control unit corresponding to the control message;
a management network configured to connect with an external management device for installing or checking software of the plurality of function control units; and
a network management device configured to manage the data network and the management network;
The plurality of function control units duplicate and transmit a control message transmitted and received through the data network to the network management device through the management network,
The network management device is configured to check whether the duplicated transmitted message is a message defined in the interface protocol, and to control the connection between the plurality of function controllers and the data network and the management network based on the check result become,
A vehicle having a dual network structure in which installation or update of software of the plurality of function control units is permitted only through the management network. According to claim 1,
A vehicle having a dual network structure, further comprising a management interface for physically connecting the external management device to the management network. According to claim 1,
Checking whether the external management device is registered in the access control list (Access Control List), if the external management device is registered in the access control list, allowing the access of the encryption access method of the external management device A vehicle having a dual network structure further comprising a management network switch. 4. The method of claim 3,
The management network switch requests user authentication corresponding to a function control unit to which the external management device wants to access, and when the user is authenticated, a vehicle having a dual network structure allowing the external management device to connect to the management network. According to claim 1,
The network management device,
a recorder for replicating the control messages received from the plurality of function control units through the management network and storing them in a message storage unit;
a protocol storage unit for storing and managing interface protocol (ICD) information defined for the control messages; and
and an analyzer for comparing the interface protocol stored in the protocol storage unit with the message recorded in the message storage unit. 6. The method of claim 5,
The network management device,
comparing the interface protocol with the stored control messages;
When control messages that are not defined in the interface protocol are transmitted and received, they are recorded in a log, and a notification is provided through the manager interface,
A vehicle having a dual network structure, wherein when control messages violating a preset security condition are accumulated more than a preset number, the connection between the plurality of function controllers and the data network is disconnected and reconfigured. 7. The method of claim 6,
The network management device includes a plurality of encrypted IP table sets,
When the number of control messages not defined in the interface protocol is accumulated more than a preset number, the IP assigned to the plurality of function control units is removed, and any one of the plurality of encrypted IP table sets is selected to obtain the plurality of A vehicle having a dual network structure, which gives new IPs to functional control units. In the operating method of a vehicle having a dual network structure,
requesting, by an external management device, access to a management network to install or check software in a plurality of function control units configured to operate according to a predefined interface protocol;
checking, by a management network switch, whether the external management device is registered in an access control list;
When the external management device is registered in the access control list, the management network switch allows the external management device to access the encryption access method, and the external management device is not registered in the access control list, blocking access to the external management device;
checking, by the management network switch, whether messages transmitted and received through the management network are messages defined in the interface protocol; and
and controlling, by the management network switch, a connection between the plurality of function controllers and the data network based on whether messages transmitted and received through the management network are messages defined in the interface protocol,
The data network is configured to receive a control message for operating the plurality of function control units and transmit it to a function control unit corresponding to the control message,
The method of operating a vehicle having a dual network structure in which the installation or update of software of the plurality of function control units is permitted only through the management network. 9. The method of claim 8,
When the management network switch detects that a management device not registered in the access control list attempts to access the management network for a preset period of time or more than a preset number of times, the network management device connects the plurality of function controllers with the data network. A method of operating a vehicle having a dual network structure, comprising the step of reconfiguring by disconnecting the connection. 10. The method of claim 9,
The step of the management network switch reconfiguring by releasing the connection between the plurality of function control units and the data network,
removing, by the management network switch, an existing connection between the plurality of function control units and the data network; and
A vehicle having a dual network structure in which one IP table is selected from a plurality of encrypted IP table sets provided by the management network switch, and a new IP is assigned to the plurality of function control units based on the selected IP table operation method. In the operating method of a vehicle having a dual network structure,
receiving, by the data network, a control message for operating a plurality of function control units configured to operate according to a predefined interface protocol from an external operating device, and transmitting the control message to the function control unit corresponding to the control message;
replicating and transmitting, by the plurality of function controllers, control messages transmitted and received through the data network to a network management device through a management network;
checking, by the network management device, whether the duplicate transmitted message is a message defined in the interface protocol; and
and controlling, by the network management device, a connection between the plurality of function controllers and the data network based on whether the duplicate transmitted message is a message defined in the interface protocol,
the management network is configured to connect with an external management device for installing or checking software of the plurality of function control units;
The method of operating a vehicle having a dual network structure in which the installation or update of software of the plurality of function control units is permitted only through the management network. 12. The method of claim 11,
The step of controlling, by the network management device, a connection between the plurality of function controllers and the data network,
removing, by the network management device, an existing connection between the plurality of function controllers and the data network when the number of control messages that violate a preset security condition is accumulated more than a preset number; and
Selecting one IP table from a plurality of encrypted IP table sets provided by the network management device, and assigning a new IP to the plurality of function control units based on the selected IP table. A method of operating a vehicle having a structure. A computer program stored in a computer readable storage medium for executing the method of any one of claims 8 to 12 using a computing device.

Images