KR20180072340A - Methods of secure transmitting control message at in-vehicle network - Google Patents

Abstract

The present invention relates to a method for securely transmitting control data in an in-vehicle network including an Ethernet network, which comprises: a step of detecting an outside attack; a step of determining whether a message transmitted through an Ethernet network is a control message when the outside attack is detected; and a step of conducting security processing and transmitting the control message transmitted to an electronic control unit (ECU) when the outside attack is detected and the message transmitted through the Ethernet network is a control message. In addition, the step of determining whether a message transmitted through the Ethernet network is a control message is to perform the determination by using at least one among a delay time demand condition, a link speed, an uplink and a downlink data rate, and an identifier of the ECU. Therefore, the method for identifying and securely transmitting control data in an in-vehicle network including an Ethernet network is able to compensate for security weak points when transmitting a control message due to an outside attack.

Description

[0001] The present invention relates to a method for securely transmitting control data in a vehicle internal network,

The present invention relates to a security processing method in a transportation means internal network, and more particularly, to a security processing method in a transportation means internal network in which an Ethernet and a Controller Area Network coexist.

The number of electronic control units (ECUs) mounted in a vehicle is rapidly increasing. As the number of attempts to provide various services through network communication in a vehicle increases, data to be maintained as integrity data, Data that should not be tampered with by unauthorized persons - for example, data that should not be tampered with, as well as personal information of the driver - should be kept confidential. Lt; / RTI >

By communicating with an ECU via CAN or Ethernet (Ethernet) using an external device, for example, an OBD-2 (On Board Diagnostics) terminal, the ECU can self-diagnose the vehicle or process data transmitted or received via CAN or Ethernet, Services that provide convenience are increasing gradually.

In such a case, there is a weak point that an external attacker may cause an abnormal control of the vehicle to damage the integrity, and the data to be kept confidential through the above-mentioned eavesdropping may be leaked. Therefore, in order to guarantee the integrity of data transmitted / received via CAN or Ethernet by an external device that is not authenticated (authenticated), the external device must be secured as in the case of ECU.

In recent years, there is an increasing possibility that a hacking of a vehicle control system using a wireless communication terminal such as an OBD (On Board Diagnostic) terminal or a smart phone, which is a vehicle self-diagnosis apparatus, is generated. However, an effective hack prevention method and apparatus therefor are not provided.

It is expected that the in-vehicle network will evolve into a coexistence of various network systems such as CAN (Controller Area Network), LIN (Local Interconnection Network), FlexRay, MOST (Media Oriented Systems Transport) .

In the future, when there is a tendency to introduce in-vehicle Ethernet, there is a weak problem in remote Ethernet attack, remote hacking, vehicle malicious attack using OBD2 Ethernet module, attack using vehicle AVN vulnerability, etc. .

In case of implementing the internal network in the Ethernet structure, control messages for controlling the multimedia data and the ECU in the entertainment aspect can be transmitted through the Ethernet network through the Ethernet network, and multimedia data and control messages transmitted through the Ethernet network Or if the external attack message is a control message, it is vulnerable to security from external attack if it is transmitted to the corresponding ECU through the in-vehicle Ethernet network without a separate security procedure.

It is an object of the present invention to provide a method for identifying and transmitting control data in a vehicle internal network including an Ethernet network for supplementing a security vulnerability when transmitting a control message by an attack from the outside.

According to an aspect of the present invention, there is provided a method for securely transmitting control data in a vehicle internal network including an Ethernet network, the method comprising the steps of: detecting an external attack; The method includes the steps of: determining whether a message transmitted through the network is a control message; transmitting, when an external attack is detected, an electronic control unit (ECU) when a message transmitted through the Ethernet network is a control message; Wherein the step of determining whether a message transmitted through the Ethernet network is a control message comprises the steps of determining a delay time requirement, a link rate, an uplink data rate, and an identifier of an ECU It can be judged by using at least one. When a low delay is required - when the maximum message size to be transmitted is small - can be authenticated and / or encrypted according to control data related to safety and transmitted without authentication and / or encryption if another low delay is required . (ECM), Electronic Brake Control Module (EBCM), and Transmission Control Module (TCM), which require a high-speed link speed even when the above-mentioned low delay is required, a telematics module (HVAC air conditioner , And BCM (Body Control Module), and transmits only the case of the ECU requiring the high-speed link speed, by authentication and / or encryption. When the control message is transmitted to the Ethernet packet by authentication and / or encryption, the Ethernet Ethernet frame is used, and the Ethernet packet can be encrypted with the Ethernet packet using a time division duplex using a single twisted pair cable. The transportation internal network may include an Ethernet network, which is a network in which a CAN (Control Area Network) and an Ethernet network coexist.

According to the method for identifying and performing secure transmission of control data in an intra-vehicle network including an Ethernet network according to embodiments of the present invention, when an external attack message is an attack on a control message, the multimedia data is transmitted without authentication and / And the control message is authenticated and / or encrypted so as to be transmitted, so that the security weakness of the control message due to an attack from the outside can be compensated.

1 is a conceptual diagram showing an example of the structure of a vehicle internal network in which CAN and Ethernet coexist.
2 is a flowchart illustrating a method of identifying and transmitting control data in an in-vehicle network including an Ethernet network according to an embodiment of the present invention.
3 is a timing diagram illustrating symmetrical uplink and downlink data rates during packet transmission over an in-vehicle network according to an embodiment of the present invention.
4 is a timing diagram illustrating asymmetric uplink and downlink data rates during packet transmission over an in-vehicle network according to an embodiment of the present invention.

1 is a conceptual diagram showing an example of the structure of a vehicle internal network in which CAN and Ethernet coexist.

Referring to FIG. 1, an external device such as a diagnostic device, for example, an OBD terminal, may be connected to the OBD terminal 20 and connected to the vehicle internal network through the gateway 10.

The gateway 10 includes a first gateway 12 for communicating with the infotainment / HMI module 30, a powertrain gateway 14 for communicating with the powertrain module 40 or the chassis module 50, a body module A body gateway 16 for communicating with the security module 70, and a security gateway 18 for communicating with the security module 70. Alternatively, the gateway 10 may be implemented by integrating the first gateway 12, the powertrain gateway 14, the body gateway 16, and the security gateway 18 into one gateway.

The infotainment / HMI module 30 is implemented as an RSU (Rear Seat Entertainment) 35, an ECU (Electronic Control Unit) 31 and a head unit 33. The ECU 31 and the head unit 33 are connected to an Ethernet switch 39, Lt; RTI ID = 0.0 > 12 < / RTI >

The powertrain module 40 includes a plurality of ECUs 41-1, 41-2, 41-3, ... for driving the powertrain device and is connected to the powertrain gateway 14 Can be connected.

The chassis module 50 includes an engine, a plurality of ECUs 51-1, 51-2, 51-3, ... for driving the transmission, and is connected to the powertrain gateway 14 via CAN and / or Ethernet .

The body module 60 includes a plurality of ECUs 61-1, 61-2, 61-3, 61-4, 61-5, ... for driving the brakes and the suspension devices, and the CAN and / or the Ethernet And may be connected to the body gateway 16.

The safety module 70 may be connected to the safety gateway 18 via the CAN bus to drive the seat, window locks, lights. The safety module 70 also includes an ECU 73 connected to the camera 74 via Ethernet to drive the camera 74 and a radar camera 72 connected to the radar / camera 72 via Ethernet to drive the radar / camera 72 And an ECU 72 for controlling the engine.

2 is a flowchart illustrating a method of identifying and transmitting control data in an in-vehicle network including an Ethernet network according to an embodiment of the present invention.

Referring to FIG. 2, first, it is determined whether the vehicle gateway 10 detects an external attack (step 210). The external attack may be remote wireless attack, remote hacking, vehicle malicious attack through OBD2 Ethernet module, attack using vehicle AVN vulnerability, etc. in case of using Ethernet of vehicle, control of forcible diagnosis of external standing vehicle.

When the vehicle gateway 10 detects an external attack, the control data and the non-control data transmitted through the in-vehicle network are identified (step 220). The uncontrolled data may be video data transmitted over an in-vehicle Ethernet network for entertainment services and / or multimedia data including audio data.

As a result of the determination, if an external attack is detected and a message transmitted through the in-vehicle network is identified as a control message, the control message is authenticated and / or encrypted by each ECU (step 250) And if the message transmitted through the in-vehicle network is identified as a non-control message, the non-control message is transmitted (step 240) without authentication and / or encryption at the vehicle gateway 10 or each ECU.

If the vehicle gateway 10 fails to detect an external attack, both the control data and the non-control data transmitted through the in-vehicle network are transmitted without performing a separate secure transmission procedure (step 260). That is, when the vehicle gateway 10 fails to detect an external attack, both the control data transmitted through the in-vehicle network and the non-control data are transmitted from the vehicle gateway 10 or each ECU without authentication and / or encryption.

If the external attack message is an attack against a control message, the multimedia data is transmitted without authentication and / or encryption, and the control message is transmitted by authentication and / or encryption, thereby completing a security vulnerability of the control message caused by an external attack .

A method for determining whether a message transmitted through an Ethernet network is a control message or control data is as follows.

1) Using delay time requirement, link speed

(a) when a low delay is required (that is, when the maximum message size transmitted through the vehicle internal network is small), the control message or control data related to safety can be determined. That is, when a low delay is required (that is, when the maximum message size transmitted through the in-vehicle network is small), the control message or control data related to safety is authenticated and / or encrypted and transmitted. It can be transmitted without authentication and / or encryption.

(ECU), an electronic brake control module (EBCM), a transmission control module (TCM), and a low-link-rate ECU (Telematics module, an HVAC air conditioner, and a BCM (Body Control Module)) to be authenticated and / or encrypted only for ECUs requiring high-speed link speeds.

2) phase, downlink asymmetry / symmetric data rate

When there is an uplink / downlink asymmetric / symmetric data rate in a packet transmission through an in-vehicle Ethernet network and a symmetrical data rate, i.e., uplink data and downlink data transmission speed are substantially equal, / Or encrypted.

3 is a timing diagram illustrating symmetrical uplink and downlink data rates during packet transmission over an in-vehicle network according to an embodiment of the present invention.

Referring to FIG. 3, in the case of a downlink (Master TX_ON) in which a packet is transmitted through a vehicle internal network at a master (e.g., a master ECU), a first data 310 and a slave (e.g., a slave ECU) The transmission time of the second data 320 in the case of the uplink (Slave TX_ON) in which the packet is transmitted through the in-vehicle network is substantially the same and symmetrical to each other. The first data 310 and the second data 320 are determined as control messages or control data in the case of symmetrical downlink and uplink data rates, 2 data 320 may be authenticated and / or encrypted and transmitted.

4 is a timing diagram illustrating asymmetric uplink and downlink data rates during packet transmission over an in-vehicle network according to an embodiment of the present invention.

Referring to FIG. 4, in the case of a downlink (Master TX_ON) in which a packet is transmitted through a vehicle internal network at a master (for example, a master ECU), a transmission time of the first data 410 and a slave In the case of an uplink (Slave TX_ON) in which a packet is transmitted through the in-vehicle network in the slave ECU, the transmission time of the second data 420 is asymmetrical, for example, (Or the amount of data) is larger than a predetermined reference value. The first data 410 may be transmitted to the radar / camera 72 or the camera 74 via the in-vehicle network including the Ethernet. Multimedia data, and the second data 420 may be a control message or control data. If the asymmetric downlink and uplink data rates are determined to be non-control messages, it can be implemented so that each ECU transmits without authentication and / or encryption thereafter.

3) Using the identifier of the ECU

It is possible to determine whether the message transmitted through the in-vehicle Ethernet network is a control message or control data by identifying whether the ECU is a driveline ECU such as an engine, a transmission, or a brake from an identifier of the ECU, for example, an ECU MAC address. Here, the mapping table between the MAC address and the ECU can be stored in advance.

Meanwhile, as a method of transmitting a control message to an Ethernet packet by authenticating and / or encrypting through an in-vehicle network, a VLAN Ethernet frame is used, but a time division duplex (Time Division Duplex) is encrypted with an Ethernet packet using a single twisted pair cable Lt; / RTI >

According to another embodiment of the present invention, when a packet transmitted when a packet is transmitted through an in-vehicle Ethernet network is required to be generated in the ECU or ADAS or a controller (for example, a multimedia controller) An identifier can be added to the identifier. In this case, the identifier may be added at the time of initial setting of the ECU physical layer (PHY) chip - during the vehicle manufacturing process. That is, an identifier can be generated in a data packet requiring security or real-time transmission on a physical layer (PHY layer).

In this case, when setting an identifier in a data packet, priority can be set for each packet, and a packet data delivery range can be set according to the priority. Specifically, when a data packet having the identifier is received, a data packet requiring security or real-time transmission can be transmitted using a bypass line or a redundancy link in the vehicle. For example, if a received data packet is parsed to include the above-mentioned identifier, it can be transmitted from the Ethernet switch or gateway through the bypass line or the redundant link.

When receiving an external hacking message, it can be compared with the stored message type to warn the user in case of a hacking message or collect the abnormal message type from the remote cloud server and update the database for each individual vehicle.

Claims (5)

A method for securely transmitting control data in a vehicle internal network including an Ethernet network,
Detecting an external attack;
Determining whether a message transmitted through the Ethernet network is a control message when the external attack is detected;
And if the message transmitted through the Ethernet network is a control message, performing security processing on a control message transmitted to an electronic control unit (ECU) when the external attack is detected,
Wherein the step of determining whether a message transmitted through the Ethernet network is a control message
Wherein the determination is made using at least one of a delay time requirement, a link speed, an uplink and downlink data rate, and an identifier of an ECU. The method as claimed in claim 1, wherein when a low delay is required, - when the maximum message size to be transmitted is small, authentication and / or encryption is determined based on control data related to safety, Or without encryption. ≪ Desc / Clms Page number 20 > 3. The apparatus of claim 2, further comprising: an ECU (Engine Control Module (ECM), Electronic Brake Control Module (EBCM), Transmission Control Module (TCM) Wherein the control unit authenticates and / or encrypts only the case of the ECU requiring the high-speed link speed by classifying the communication system, the telematics module, the HVAC air conditioner, and the BCM (Body Control Module) Of the control data. The method of claim 1, wherein when transmitting the control message to the Ethernet packet by authentication and / or encryption, the Ethernet Ethernet frame is used, and the Ethernet packet is encrypted with the Ethernet packet in a time division duplex using a single twisted pair cable The method comprising the steps of: receiving a control data from an Ethernet network; The method as claimed in claim 1, wherein the transport internal network is a network in which a CAN (Control Area Network) and an Ethernet network coexist. The transport network includes an Ethernet network including an Ethernet network. How to transfer.

Images