WO2018149245A1 - 汽车信息的安全测试方法及装置 - Google Patents

汽车信息的安全测试方法及装置 Download PDF

Info

Publication number
WO2018149245A1
WO2018149245A1 PCT/CN2017/120282 CN2017120282W WO2018149245A1 WO 2018149245 A1 WO2018149245 A1 WO 2018149245A1 CN 2017120282 W CN2017120282 W CN 2017120282W WO 2018149245 A1 WO2018149245 A1 WO 2018149245A1
Authority
WO
WIPO (PCT)
Prior art keywords
test
automobile
safety
security
information
Prior art date
Application number
PCT/CN2017/120282
Other languages
English (en)
French (fr)
Inventor
刘健皓
郭斌
Original Assignee
北京奇虎科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201710090247.0A external-priority patent/CN106886211B/zh
Priority claimed from CN201710089979.8A external-priority patent/CN106828362B/zh
Application filed by 北京奇虎科技有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2018149245A1 publication Critical patent/WO2018149245A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B23/00—Testing or monitoring of control systems or parts thereof
    • G05B23/02—Electric testing or monitoring

Definitions

  • the invention relates to the technical field of automobiles, in particular to a safety test method and device for automobile information, and a method and a device for determining a safety test level of a vehicle.
  • the present invention provides a method and apparatus for testing safety of automobile information, the main purpose of which is the information generated by various components in the existing automobile, and it is impossible to detect whether it is safe or not.
  • a method for testing safety of automobile information comprising: acquiring automobile information through a control local area network of a vehicle, the automobile information including data generated by various components in the automobile during operation of the automobile system And detecting a safety state of the automobile according to the preset abnormal situation correspondence relationship and the automobile information, wherein the preset abnormal situation correspondence relationship stores a safety state corresponding to the automobile information of each component in the automobile in different situations; The test result outputs the safety test result of the car.
  • a security testing apparatus for automotive information comprising: at least one processor; and at least one memory communicably coupled to the at least one processor;
  • a memory includes processor-executable instructions that, when executed by the at least one processor, cause the apparatus to perform at least: acquiring vehicle information through a control area network of a vehicle,
  • the automobile information includes data information generated by each component of the automobile in the operation of the automobile system; detecting a safety state of the automobile according to a preset abnormal situation correspondence relationship and the automobile information, and the preset abnormal situation corresponding relationship stores the automobile
  • the safety status corresponding to the vehicle information of each component in different situations according to the detection result, the safety test result of the automobile is output.
  • a computer program in an embodiment of the invention, comprising computer readable code, when the computer readable code is executed, causing the method described in the first aspect to be performed.
  • a computer readable medium is provided in the embodiment of the present invention, wherein the computer program according to the third aspect is stored.
  • a method for determining a safety level of a vehicle includes: obtaining a safety test result obtained by performing a safety test based on automobile information of a vehicle, the safety test result including passing of a vehicle component having different functions The test results obtained by different test modes; the test type of the car safety is analyzed according to the safety test result; the safety test result and the test type are matched with a preset car safety level, the preset car safety The rating is a security level configured according to different security test results and different test types; if the match is successful, the matching car safety level is determined as the safety test level of the car.
  • an apparatus for determining a level of safety of a vehicle includes: at least one processor; and at least one memory communicably coupled to the at least one processor;
  • a memory includes processor-executable instructions that, when executed by the at least one processor, cause the apparatus to perform at least the following: obtaining security obtained from security testing of the automobile information of the automobile a test result, the safety test result includes a result obtained by testing different functions of the automobile component through different test modes; and analyzing the test type of the automobile safety according to the safety test result; and the safety test result and the test type and the pre-test
  • the vehicle safety level is matched, and the preset vehicle safety level is a safety level configured according to different safety test results and different test types; if the matching is successful, the matched vehicle safety level is determined as the safety test of the automobile. grade.
  • a computer program is provided in an embodiment of the present invention, when the computer readable code is executed, when the computer runs the computer readable code, causing the method described in the fifth aspect to be performed.
  • the embodiment of the present invention provides a computer readable medium, wherein the computer program according to the seventh aspect is stored.
  • the technical solution provided by the embodiment of the present invention has at least the following advantages:
  • the invention provides a safety test method and device for automobile information, which firstly acquires automobile information through a control local area network of a vehicle, the automobile information includes data information generated by various components in the automobile in the operation of the automobile system, and then according to a preset Detecting a safety state of the automobile according to the abnormal situation correspondence relationship and the automobile information, wherein the preset abnormal situation correspondence relationship stores a safety state corresponding to the automobile information of each component in the automobile in different situations, and finally, according to the detection result, the output The safety test results of the car. Compared with the information generated by the various components in the existing automobile, it is impossible to detect whether it is safe or not.
  • the embodiment of the present invention detects the safety state of the automobile according to the correspondence between the automobile information generated by each component in the automobile and the preset abnormal situation, thereby realizing the safety.
  • the test found potential safety threats in the car to restore the car's safety level through repairs and other methods to improve the safety of car information.
  • the invention provides a method and a device for determining a safety level of an automobile, which first obtains a safety test result obtained by performing a safety test according to the automobile information of the automobile, and the safety test result comprises the test that the automobile components of different functions are tested by different test methods.
  • the test type of the car safety is further analyzed according to the safety test result, and then the safety test result and the test type are matched with a preset car safety level, and the preset car safety level is according to different safety.
  • the test result and the security level configured by different test types. If the match is successful, the matching car safety level is determined as the safety test level of the car.
  • the present invention obtains the safety test result of the vehicle. Determine the type of test corresponding to the test result, and then match the test result with the test type and the preset car safety level. If the match is successful, the matching level is taken as the safety test level of the car, and the vehicle safety test is realized. The results are graded so that users can repair, update, optimize, etc. according to different levels of safety test results, reducing safety hazards in the car, thereby improving the safety of car information.
  • Embodiment 1 is a flow chart of a method for testing safety of automobile information according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic diagram of a car CAN network provided by Embodiment 1 of the present invention.
  • FIG. 3 is a block diagram showing the composition of a function module of an automobile according to Embodiment 1 of the present invention.
  • FIG. 4 is a flowchart of another method for testing safety of automobile information according to Embodiment 2 of the present invention.
  • FIG. 5 is a flow chart showing the operation principle of a mongodb of a car according to Embodiment 2 of the present invention.
  • FIG. 6 is a block diagram of a safety test apparatus for automobile information according to Embodiment 3 of the present invention.
  • FIG. 7 is a block diagram showing another safety test apparatus for automobile information according to Embodiment 4 of the present invention.
  • Figure 8 shows a block diagram of a computer for performing the method according to the invention
  • Figure 9 shows a schematic diagram of a storage unit for holding or carrying program code implementing the method according to the invention.
  • FIG. 10 is a flowchart of a method for determining a safety level of a vehicle according to Embodiment 5 of the present invention.
  • Figure 11 is a block diagram showing the composition of a car function module according to Embodiment 5 of the present invention.
  • FIG. 12 is a schematic diagram of a car CAN network provided by Embodiment 5 of the present invention.
  • FIG. 13 is a flow chart showing another method for determining a vehicle safety level according to Embodiment 6 of the present invention.
  • FIG. 14 is a block diagram showing a device for determining a safety level of a vehicle according to Embodiment 7 of the present invention.
  • FIG. 15 is a block diagram of another apparatus for determining a vehicle safety level according to Embodiment 8 of the present invention.
  • Figure 16 shows a block diagram of a computer for performing the method according to the invention
  • Figure 17 shows a schematic diagram of a memory unit for holding or carrying program code implementing a method in accordance with the present invention.
  • the embodiment of the invention provides a method for testing safety of automobile information. As shown in FIG. 1 , the method includes:
  • the automobile information includes data information generated by various components in the automobile in the operation of the automobile system, the control local area network exists in the form of a car bus and the automobile system, and the automotive electronic components are controlled by the local area network CAN in the interior of the automobile Connect and communicate, as shown in Figure 2.
  • the vehicle system includes a host, a display, a keyboard, an antenna and the like.
  • the system can provide the driver with the status of the car system, entertainment information, driving information, etc., from the basic situation of the car system, it uses a dedicated central processor.
  • An in-vehicle integrated information processing system formed based on a body bus system and a network, wherein the car information includes information corresponding to each function module in the car information security formulation model shown in FIG. 3, for example, the sensing unit detects that the vehicle speed is generated. Analog signals, etc.
  • the CAN network is actually a large multi-port transponder HUB.
  • all units can start to send messages.
  • the unit that first accesses the bus can get the right to send.
  • the unit that sends the high priority ID message can obtain the transmission right.
  • the generation of automobile information can be divided according to the functions used in the automobile, and can also be classified into an in-vehicle terminal, an in-vehicle network, an in-vehicle application, and an in-vehicle service.
  • the vehicle terminal T-box includes the hardware design, software platform, network transmission, protocol application, etc. of the TU terminal in the vehicle.
  • the vehicle application includes application software installed in the vehicle system, and the vehicle service business includes the vehicle remote service provider TSP (Telematics). Service Provider).
  • the automotive remote service provider TSP is at the core of the telecommunications Telematics industry chain for long-distance communication, and is connected to automobile manufacturers, vehicle equipment manufacturers, network operators, and content providers.
  • the Telematics service combines modern computer technologies such as location services, geographic information systems (Gisor Information System) services and communication services to provide users with powerful services such as navigation, entertainment, information, security, SNS, and remote maintenance services.
  • the TSP system plays a springboard between the car and the mobile phone in the car CAN, providing content and traffic forwarding services for the car and the mobile phone. According to the survey results of many automakers, most of the TSPs are currently used in the cloud server to use public cloud technology, then the TSP platform has a part of the cloud threat.
  • the virtual machine can escape to the host machine, and then the host machine reaches the virtual machine of the TSP platform to obtain the key information of the TSP core interface, key, certificate, etc., and laterally control other cars.
  • the TSP platform deployed in the cloud is critical to the security of the system itself and the environment.
  • the TSP platform deployed in the OEM's own server it is necessary to consider the anti-denial service capability, as well as traditional IT protection, security management and other factors.
  • the message command for controlling the car is generated inside the T-BOX, and is encrypted by the extension module of the cellular network modem of the T-BOX, which is equivalent to encryption at the transmission level, so the content of the message session cannot be obtained, and the solution is solved.
  • the method is to analyze the firmware internal code, find the encryption method and the secret key, in order to know the content of the message session. So you need to disassemble the T-BOX, then blow the FLASH chip down and reverse the firmware. Found the control command sent, crack the key of the transmission encryption, and some T-BOX release the debug interface, so you do not need to blow FLASH to get the program, so T-BOX protection
  • the main object is how to protect the firmware from being taken away and protect the key inside the T-BOX.
  • the preset abnormal situation correspondence relationship stores a security state corresponding to the car information in which the various components in the automobile are in different situations, and the security state is whether the data information generated by the different components is within a threshold range for causing the car to operate normally.
  • the threshold value may be set by the technician according to the potential risk factor that may occur, and is not specifically limited in the embodiment of the present invention.
  • the acquired car information is in a state in which the control mode of the car system does not match the preset control mode in one day
  • the preset abnormality correspondence relationship occurs in the car system for one month or more.
  • the state in which the control mode does not match the preset control mode is a dangerous state.
  • the test result may be a test result of different levels, and the test result of the safe and dangerous state may be preset, which is not specifically limited in the embodiment of the present invention.
  • the output security test result is that the user information is leaked.
  • the invention provides a safety test method for automobile information, which is compared with the information generated by each component in the existing automobile and cannot detect whether it is safe or not.
  • the embodiment of the present invention adopts automobile information and preset abnormal conditions generated according to various components in the automobile. Corresponding relationship detects the safety status of the car, and realizes the potential safety threat in the car through safety test, so as to restore the safety level of the car through repairing, etc., thereby improving the safety of the car information.
  • An embodiment of the present invention provides another method for testing security of automobile information. As shown in FIG. 4, the method includes:
  • the preset security protocol is used to indicate that the respective components open historical data information
  • the preset security protocol is NGTP (Next Generation Telematics Protocol), which is applied to information communication of the CAN network.
  • NGTP Next Generation Telematics Protocol
  • NGTP enables information communication between components in a car to obtain data information generated in different components.
  • the security test command is used to instruct the system to perform the security test.
  • the specific form is not specifically limited in the embodiment of the present invention.
  • the operating principle of mongodb is to ensure the only guarantee of all car and server business logic in asynchronous execution.
  • the network is networked, and then distributed by the Dispatcher application to enter the mongodb library for fast storage, and then the business processes of IF2 and IF3 are completed.
  • the service is finally submitted to the business database Database, it is already the sixth step of the logical sequence. Therefore, when using the NGTP framework for development, it is necessary to consider the content and type of the request parameters applied by the security framework.
  • the automobile component having the intelligent control function may include a sensor unit, an intelligent control unit, a transmission system, a chassis system, and the like, and the automobile component having an extended function may include a vehicle body, a telematics, an information consultation system, and the like.
  • the auto parts of the commonly used functions may include an insertion device, a diagnostic tool, a dashboard, and the like.
  • the auto parts having additional functions may include Bluetooth, a wireless local area network, and the like, which are not specifically limited in the embodiment of the present invention, as shown in FIG.
  • the historical data information is stored in a data log corresponding to different components.
  • the preset time interval may be 1 day, 2 days, or the like, and may also be an extraction instruction that receives an indication from the user, which is not specifically limited in the embodiment of the present invention, and the car information may be historical data information of all components.
  • the historical data information of the part may also be used, and the historical data information of the selected part of the user may also be affirmed, which is not specifically limited in the embodiment of the present invention.
  • the test type includes an in-vehicle terminal type, an in-vehicle network type, an in-vehicle application type, and an in-vehicle service type.
  • the test type is divided according to a component that generates automobile information, and the component to be detected is classified into a type.
  • step of parsing is based on the fact that the component from which the car information is derived belongs to a specific test type.
  • the method further includes: configuring different test modes for different test types, where the test mode includes a function test mode, a vulnerability scan mode, a fuzzy test mode, and a penetration test mode.
  • the different test modes are configured for different test types.
  • the test information of one test type is tested by using one test mode, and the test information of the test type may be used in multiple test manners. Make specific limits.
  • a test method can test car information of different test types, and a test type of car information can be tested by various test methods.
  • the vehicle terminal type can correspond to the function test mode
  • the vehicle network type can correspond to the vulnerability scan
  • the vehicle application type can correspond to the fuzzy test
  • the vehicle service type can correspond to the penetration test.
  • test mode may be performed in parallel or in the order of setting, and is not specifically limited in the embodiment of the present invention.
  • test all safety-related functions test the correctness and robustness of the system. This step is similar to a general functional test, but focuses on security features. Careful execution of this test can reveal execution errors, specification differences, and especially unspecified features, which can lead to potential security threats.
  • the test system already knows common security vulnerabilities, such as known security vulnerabilities or (secure) configurations and known weaknesses.
  • the test includes theoretical safety analysis test and actual safety test.
  • the theoretical safety analysis test gradually becomes a routine analysis in the automobile, and is applied to identify and understand the safety weakness of the automobile IT system based on the corresponding system specifications and technical documents. Paper evaluation.
  • the actual security test can find execution errors, including differences in functions and specifications that an external attacker can exploit and that are not specified. Therefore, a thorough practical security test helps to establish the integrity of trust.
  • step 103 of FIG. 1 This step is the same as the method described in step 103 of FIG. 1, and details are not described herein again.
  • the step 206 specifically includes: if the detection is performed according to the functional test mode, the safety detection result of the outputting the automobile includes a performance test result, a correctness test result, a robustness test result, and a compliance test result.
  • the function testing method is a testing method for ensuring that the function of the automobile conforms to the standard and the standard security function, for example, the encryption algorithm and the authentication protocol of the vehicle IT system, which are not specifically limited in the embodiment of the present invention.
  • the functional test method not only tests the correct behavior according to the specification test, but also tests the robustness and compliance.
  • inspection security standards for the automotive sector can be selected for MISRA-C, as well as various automotive-specific security protocols such as secure flash algorithms or secure communications, security theft, OBD, and upcoming vehicle-to- x (V2X) communication, the implementation of these protocols can meet the test of security functions.
  • the step 206 specifically includes: if the detection is performed according to the vulnerability scanning mode, the security detection result of the outputting the automobile includes an interface test result, a configuration test result, a vulnerability test result, and a malware test result.
  • the vulnerability scanning method is used to detect known security vulnerabilities in all relevant applications, networks and back-end infrastructure of the automotive system. This security weakness is a constant update database in a known car security vulnerability.
  • vulnerability scanning also includes a variety of different vulnerability scanning methods.
  • the software/hardware running code of the system can be scanned and identified, for example, using static and dynamic analysis of buffer overflows and heap overflows.
  • automotive systems can be scanned through open ports and interfaces and provide services that can run on these interfaces, including traditional IT interfaces such as Ethernet network communications, Wi-Fi, or mobile Internet. Typical re-use of a range of operating systems, network stacks, applications, and libraries, including reconnaissance port scanning and in-depth scanning of specific vulnerabilities.
  • the automotive environment has a special automotive CAN bus system, which is not equivalent in traditional IT, which means that the automatic scanning tool is well suited to detect an outlined vulnerability. In this case, the diagnostic function of the scan is significant because the potential hazard is likely to include weak records of safety-critical functions, such as development or debugging functions.
  • the step 206 specifically includes: if the detection is performed according to the fuzzy test mode, the safety detection result of the outputting the automobile includes a black box test result, a gray box test result, a white box test result, and a function test result.
  • the fuzzy test method is used for the type of test software and IP network for a long time.
  • the ECU can be regarded as a small computer, running different software, and is composed of different types of networks such as CAN, FlexRay or MOST. .
  • the test consists of three distinct steps: first creating input to the target, then inputting to the target and monitoring the final target detection system program flow.
  • fuzzy tools such as Peach have a powerful fuzzy generator that can adapt to different protocols such as UDS. The input is generated by the blur generator, then input into the transport protocol that needs to be used, and then the target system is monitored to detect possible vulnerabilities.
  • This monitoring process can be used to examine the return range of the value and the debugger to observe the internal state of the target device. Finally, all the unusual behaviors found are analyzed by a vulnerability analysis software used by a professional analysis. In automotive systems, fuzzing can be applied to diagnostic protocols such as UDS, automotive network protocols (CAN, FlexRay, MOST or Lin)
  • the step 206 specifically includes: if the detection is performed according to the penetration test mode, the safety detection result of the outputting the automobile includes a hardware test result, a software test result, a network test result, and a platform test result.
  • the penetration test method is for testing IP protection or testing authoritative functions, such as anti-theft, component protection, odometer operation, function activation and protection to adjust the vehicle for false claims security functions, and penetration testing can also detect modern remotes.
  • Connection attack Typically, penetration testing begins with observing physical devices, including enumerating interfaces, determining components between PCBs and their connections, and collecting specifications for hypothetical attackers, often collecting any information that will help with the next attack.
  • the second step may include attacking an external interface such as a USB, serial port, or hardware attack. Attack hardware is usually an interface for testers trying to find neglected or undocumented debug access, or to get an interface inside the ECU, such as a memory bus.
  • all communication channel devices such as CNA bus, Ethernet, or Wi-Fi, are analyzed and used to attack the target device. Further attacks on the backend are based on the scope of the target system and penetration testing.
  • the penetration test includes a black box test, a white box test, and a gray box test.
  • black box testing there is basically no need for documentation or specifications. In addition to information, it can also be used by real-world attackers. Can simulate the effects of actual attacks in a very realistic way.
  • white-box testing complete specifications and documentation are required, the weaknesses of the target can be clarified, and more resources are available without the need to obtain information, which improves the efficiency of the test.
  • the gray box test represents the middle ground between the black box and the white box, and can receive partial information, focusing on the focus or information of a particular subsystem, specific attackers.
  • the step after the step 206 may be: analyzing the evaluation type of the automobile safety according to the safety test result; matching the safety test result and the evaluation type with a preset automobile safety level,
  • the preset car safety level is a safety level configured according to different safety test results and different test types; if the match is successful, the matched car safety level is determined as the safety test level of the car.
  • the test type includes an in-vehicle terminal type, an in-vehicle network type, an in-vehicle application type, and an in-vehicle service type.
  • the test type is divided according to a component that generates automobile information, and the component to be detected is classified into a type.
  • the preset car safety level is a safety level configured according to different safety test results and different test types, and the preset car safety level can be divided into four safety test levels, for example, a “trust guarantee level” is preset.
  • VCSL Vehicle Car Security Level
  • TAP1, TAP2, TAP3, and TAP4 are different test results under security threat and risk analysis, so corresponding to different levels of VSCL A, VSCL B, VSCL C, VSCL D, and other situations, analogy.
  • the present invention provides another safety test method for automobile information.
  • the embodiment of the present invention analyzes the test type corresponding to the automobile information according to the automobile information generated by each component in the automobile, and specifically includes the vehicle terminal type, the vehicle network type, and the vehicle application type.
  • the corresponding test method can be extracted, and the safety test can be carried out according to the test method corresponding to the car information, so that the potential security threat in the car can be found through the safety test, so as to restore the safety level of the car through repairing and the like.
  • Effective identification of car safety risks can reduce car accidents and effectively protect and protect the safety of car owners.
  • the embodiment of the present invention provides a security testing device for automobile information.
  • the device includes: an acquiring unit 31, a detecting unit 32, and an output unit 33. .
  • the obtaining unit 31 is configured to acquire automobile information through a control local area network of the automobile, where the automobile information includes data information generated by various components in the automobile during operation of the automobile system; and the obtaining unit 31 executes a safety test device for the automobile information through the automobile.
  • the control area network acquires car information, which includes functional modules of data information generated by various components of the car in the operation of the car system.
  • the detecting unit 32 is configured to detect a safety state of the automobile according to a preset abnormal situation correspondence relationship and the automobile information, where the preset abnormal situation corresponding relationship stores a car information corresponding to different parts of the automobile in different situations.
  • the safety state; the detecting unit 32 is a function module for detecting the safety state of the automobile according to the preset abnormal situation correspondence relationship and the automobile information for the safety test device of the automobile information.
  • the output unit 33 is configured to output a safety test result of the automobile according to the detection result.
  • the output unit 33 is a functional module that executes a safety test result of the automobile according to the detection result for a safety test device for automobile information.
  • the invention provides a safety test device for automobile information, which is compared with the information generated by each component in the existing automobile and cannot detect whether it is safe or not.
  • the embodiment of the present invention adopts automobile information and preset abnormal conditions generated according to various components in the automobile. Corresponding relationship detects the safety status of the car, and realizes the potential safety threat in the car through safety test, so as to restore the safety level of the car through repairing, etc., thereby improving the safety of the car information.
  • an embodiment of the present invention provides another security information detecting apparatus for an automobile information.
  • the apparatus includes: an acquiring unit 41, a detecting unit 42, and an output unit. 43.
  • the obtaining unit 41 is configured to acquire automobile information by using a control local area network of the automobile, where the automobile information includes data information generated by each component in the automobile during operation of the automobile system;
  • the detecting unit 42 is configured to detect a safety state of the automobile according to a preset abnormal situation correspondence relationship and the automobile information, where the preset abnormal situation correspondence relationship stores a car information corresponding to different parts of the automobile in different situations.
  • Safety status is configured to detect a safety state of the automobile according to a preset abnormal situation correspondence relationship and the automobile information, where the preset abnormal situation correspondence relationship stores a car information corresponding to different parts of the automobile in different situations.
  • the output unit 43 is configured to output a safety test result of the automobile according to the detection result.
  • the obtaining unit 41 includes:
  • the access module 4101 is configured to access historical data information generated by an automobile component having an intelligent control function, an automobile component having an extended function, an automobile component having a common function, and an automobile component having an additional function through a control local area network of the automobile;
  • the extracting module 4102 is configured to extract the historical data information according to a preset time interval to obtain automobile information.
  • the detecting unit 42 is specifically configured to test a safety state of the automobile according to a test manner determined according to a preset abnormal correspondence relationship and the automobile information, where the test includes a theoretical safety analysis test and an actual safety test.
  • the device further includes:
  • the first parsing unit 44 is configured to parse a test type corresponding to the car information, and the test type includes an in-vehicle terminal type, an in-vehicle network type, an in-vehicle application type, and an in-vehicle service type.
  • the first parsing unit 44 executes a functional module that parses the test type corresponding to the car information for another safety test device for car information.
  • the configuration unit 45 is configured to configure different test modes for different test types, including a functional test mode, a vulnerability scan mode, a fuzzy test mode, and a penetration test mode.
  • the configuration unit 45 performs a function module for configuring a different test mode for different test types for another safety information device for car information.
  • the output unit 43 includes:
  • the first output module 4301 is configured to: if the detection is performed according to the functional test mode, output safety test results of the automobile, including performance test results, correctness test results, robustness test results, and compliance test results;
  • the second output module 4302 is configured to: when detecting according to the vulnerability scanning manner, outputting the safety detection result of the automobile, including an interface test result, a configuration test result, a vulnerability test result, and a malware test result;
  • the third output module 4303 is configured to: if the detection is performed according to the fuzzy test mode, the safety detection result of the outputting the automobile includes a black box test result, a gray box test result, a white box test result, and a function test result;
  • the fourth output module 4304 is configured to: if the detection is performed according to the penetration test mode, output safety test results of the automobile include hardware test results, software test results, network test results, and platform test results.
  • the device further includes:
  • the access unit 46 is configured to access historical data information of each component in the automobile system by using a preset security protocol when the security test instruction is received, where the preset security protocol is used to indicate that the respective components open historical data information.
  • the access unit 46 performs a function module for accessing historical data information of various components in the automobile system through a preset security protocol when the safety test command is received for another vehicle information.
  • a second parsing unit 47 configured to parse an evaluation type of the vehicle safety according to the safety test result; and the second parsing unit 47 performs, for another safety information detecting device of the automobile information, an evaluation type for analyzing the safety of the vehicle according to the safety test result.
  • the matching unit 48 is configured to match the security test result and the evaluation type with a preset car security level, where the preset car security level is a security level configured according to different security test results and different test types;
  • the matching unit 48 performs a function module for matching the safety test result and the evaluation type with a preset vehicle safety level for another safety information device for automobile information.
  • the determining unit 49 is configured to determine the matched vehicle safety level as the safety test level of the automobile if the matching is successful.
  • the determining unit 49 performs, for another safety information device of the vehicle information, a functional module that determines the matching vehicle safety level as the safety test level of the vehicle.
  • the present invention provides another safety test device for automobile information.
  • the embodiment of the present invention analyzes the test type corresponding to the automobile information according to the automobile information generated by each component in the automobile, and specifically includes the type of the vehicle terminal, the type of the vehicle network, and the type of the vehicle application.
  • the corresponding test method can be extracted, and the safety test can be carried out according to the test method corresponding to the car information, so that the potential security threat in the car can be found through the safety test, so as to restore the safety level of the car through repairing and the like.
  • Effective identification of car safety risks can reduce car accidents and effectively protect and protect the safety of car owners.
  • Fig. 8 shows a computer (hereinafter collectively referred to as a device) which can implement the security test method for automobile information according to the present invention.
  • the device conventionally includes a processor 1010 and a computer program product or computer readable medium in the form of a memory 1020.
  • the memory 1020 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • the memory 1020 has a memory space 1030 for executing program code 1031 of any of the above method steps.
  • storage space 1030 for program code may include various program code 1031 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • Such computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks.
  • Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG.
  • the storage unit may have a storage section or a storage space or the like arranged similarly to the storage 1020 in FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit comprises program code 1031' for performing the steps of the method according to the invention, ie code that can be read by, for example, a processor such as 1010, which when executed by the device causes the device to perform the above Each step in the described method.
  • An embodiment of the present invention provides a method for determining a security level of a vehicle. As shown in FIG. 10, the method includes:
  • the safety test result includes a result obtained by testing different functions of the automobile component through different test modes, and the car information is information corresponding to each function module in the automobile information security formulation model shown in FIG. 11 , for example,
  • the sensing unit detects the vehicle speed as an analog signal generated.
  • the acquisition of the safety test result can be realized by the communication connection between the control area network CAN and the various parts in the automobile, as shown in FIG.
  • the CAN network is actually a large multi-port repeater HUB.
  • the generation of automobile information can be divided according to the functions used in the automobile, and can also be classified into an in-vehicle terminal, an in-vehicle network, an in-vehicle application, and an in-vehicle service.
  • the vehicle terminal T-box includes the hardware design, software platform, network transmission, protocol application, etc. of the TU terminal in the vehicle.
  • the vehicle application includes application software installed in the vehicle system, and the vehicle service business includes the vehicle remote service provider TSP (Telematics). Service Provider).
  • the test type includes an in-vehicle terminal type, an in-vehicle network type, an in-vehicle application type, and an in-vehicle service type.
  • the test type is divided according to a component that generates automobile information, and the component to be detected is classified into a type.
  • step of parsing is based on the fact that the component from which the car information is derived belongs to a specific test type.
  • the preset car safety level is a safety level configured according to different safety test results and different test types, and the preset car safety level can be divided into four safety test levels, for example, a pre-set "trust guarantee" Level "VCSL (Vehicle Car Security Level) - A, B, C, D four levels, the minimum requirements for each theory for security analysis and security assessment, the breadth and depth of each practice.
  • VCSL Vehicle Car Security Level
  • TAP1, TAP2, TAP3, and TAP4 are different test results under security threat and risk analysis, so corresponding to different levels of VSCL A, VSCL B, VSCL C, VSCL D, and other situations, analogy.
  • the matched vehicle safety level is determined as the safety test level of the automobile.
  • the test results of different levels can be processed to reduce the safety hazard in the car information.
  • the invention provides a method for determining the safety level of a vehicle, and after the vehicle system has a complete abnormal situation or a potential safety hazard, the vehicle information is tested for safety, but it is impossible to judge whether it is necessary to perform debugging according to the test result.
  • the present invention determines the test type corresponding to the test result by obtaining the safety test result of the automobile, and then matches the test result with the test type and the preset car safety level. If the match is successful, the matching level is made.
  • the evaluation of the car safety test results is carried out, so that the user can repair, update and optimize according to different levels of safety test results, thereby reducing the safety hazards in the car and improving the safety of the car information. Sex.
  • An embodiment of the present invention provides another method for determining a car security level. As shown in FIG. 13, the method includes:
  • the safety test result comprises the result of testing different automobile parts of different functions by different test methods
  • the test types of the automobile safety include a theoretical safety analysis test type and an actual safety test type.
  • the theoretical safety analysis test is gradually becoming a routine analysis in automobiles, and is applied to identify and understand the security weaknesses of automotive IT systems based on corresponding institutional specifications and technical documentation paper assessment.
  • the actual security test can find execution errors, including differences in functions and specifications that an external attacker can exploit and that are not specified. Therefore, a thorough practical security test helps to establish the integrity of trust.
  • the method further includes: acquiring, by the control area network of the automobile, the vehicle information, where the automobile information includes data information generated by each component of the automobile in the operation of the automobile system; and corresponding relationship according to the preset abnormal situation and The vehicle information is used to detect a safety state of the automobile, and the preset abnormal situation correspondence relationship stores a safety state corresponding to vehicle information in which different components in the automobile are in different situations; and outputs safety test results of the automobile according to the detection result. .
  • the automobile information includes data information generated by various components in the automobile in the operation of the automobile system, the control local area network exists in the form of a car bus and the automobile system, and the automotive electronic components are controlled by the local area network CAN in the interior of the automobile Connected and communicated, the car system includes a host, a display, a keyboard, an antenna, etc., and the system can provide the driver with the status of the car system, entertainment information, driving information, etc., from the basic situation of the car system, it It is an in-vehicle integrated information processing system formed by using a dedicated central processing unit based on a body bus system and a network, and the automobile information includes information corresponding to each function module in the automobile information security formulation model shown in FIG.
  • the sensing unit detects the vehicle speed as an analog signal generated.
  • the preset abnormal situation correspondence relationship stores a safety state corresponding to the vehicle information in which the various components in the automobile are in different situations, and the safety state is whether the data information generated by the different components is within a threshold range for the normal operation of the automobile, and the threshold may be The setting is not limited to the specific embodiment of the present invention.
  • the test result may be a test result of different levels, and the test result of the safe and dangerous state may be preset, which is not specifically limited in the embodiment of the present invention.
  • the acquired car information is in a state in which the control mode of the car system does not match the preset control mode in one day
  • the preset abnormality correspondence relationship occurs in the car system for one month or more.
  • the state in which the control mode does not match the preset control mode is a dangerous state.
  • the output security test result is that the user information is leaked.
  • 602a Determine, according to the theoretical security analysis test type and the security test result, whether the test type belongs to one of security threat and risk analysis, security design analysis, security development analysis, security deployment, and process analysis.
  • the security threat and risk analysis is to analyze potential car attacks, attack scenarios, and attack paths.
  • the security deployment and the process analysis are not limited to the embodiments of the present invention, which are to analyze the security of the component integration, the deployment in the background, and other security-related processes, the production, operation, and the stage of the automobile parts and communications.
  • step 602b determines whether the test type belongs to one of functional safety test, vulnerability scan, system fuzzy test, and penetration test according to the actual security test type and the security test result.
  • test type belongs to one of functional safety test, vulnerability scan, system fuzzy test, and penetration test according to the actual security test type and the security test result.
  • the function test method is a test method for ensuring that the vehicle function conforms to the specification and the standard security function.
  • the encryption algorithm and the authentication protocol of the vehicle IT system are not specifically limited in the embodiment of the present invention.
  • the vulnerability scanning method is used to detect known security vulnerabilities in all relevant applications, networks and back-end infrastructure of the automotive system. This security weakness is a constant update database in a known car security vulnerability.
  • the fuzzy test method is used for long-term use of test software and IP network types.
  • the ECU can be regarded as a small computer, running different software, and is composed of different types of networks such as CAN, FlexRay or MOST.
  • the penetration test method is for testing IP protection or testing authoritative functions, such as anti-theft, component protection, odometer operation, function activation and protection to adjust the vehicle for false claims security functions, and penetration testing can also detect modern remote connection attacks. .
  • test type is a security threat and a risk assessment
  • the target object to be attacked is an object that attacks the car, such as a vehicle owner, a garage, a competitor, and a third party, which are not specifically limited in the embodiment of the present invention.
  • the security test result is matched with a preset security threat and a risk assessment level according to an attack scenario and an attack path operated by the attack object.
  • the preset security threat and risk assessment level is a level division defined by the technician for different situations obtained by the security threat and the risk analysis.
  • Table 2 the different test contents and results of TAP1, TAP2, TAP3, and TAP4 in the table can correspond to VSCL A, VSCL B, VSCL C, and VSCL D.
  • test type is security deployment and process analysis, obtain software and hardware running conditions existing in the automobile.
  • the software and hardware are hardware and software associated with the automobile system in the automobile, for example, such as key generation/distribution, web injection, access authorization, security parameters of the back end, auto parts, such as key injection, access Control, initialization, and personalization, such as key length, operation, algorithm, key exchange, etc., are not specifically limited in the embodiment of the present invention.
  • 604b Match the security test result with a preset security deployment and process analysis level according to the software and hardware operating conditions.
  • the preset security deployment and process analysis level is a hierarchical division of different situations obtained by the technician for security deployment and process analysis. For example, as shown in Table 3, different test contents and results of DEP1, DEP2, and DEP3 in the table may correspond to VSCL B, VSCL C, and VSCL D.
  • test type is a system fuzzy test
  • the target security stack is a stack that performs different functions in the automobile system, for example, a stack, an Ethernet protocol stack, and the external interface is an interface for connecting an external device to the automobile, such as a USB, which is not specifically limited in the embodiment of the present invention. .
  • the preset system fuzzy test level is a level division defined by the technician for different situations obtained by the system fuzzy test.
  • the different test contents and results of SFT1, SFT2, and SFT3 in the table may correspond to VSCL B, VSCL C, and VSCL D.
  • the matched vehicle safety level is determined as the safety test level of the automobile.
  • This step is the same as the method described in step 504 of FIG. 10, and details are not described herein again.
  • the present invention provides another method for determining the safety level of a vehicle.
  • the embodiment of the present invention determines the type of test corresponding to the test result by obtaining the safety test result of the automobile, and specifically classifies the test type into a security threat and risk analysis, and a safety design analysis. , one of security development analysis, security deployment, and process analysis, and then matching the test results with the levels corresponding to the preset different test types according to the specific test type. If the matching is successful, the matching level is used as the car.
  • the safety test level realizes the evaluation of the level of automobile safety test results, effectively identifies the safety risks of automobiles and reduces automobile accidents, and the safety of the user's life can be effectively protected and protected, thereby improving the safety of automobile information.
  • an embodiment of the present invention provides a device for determining a car security level.
  • the device includes: a first acquiring unit 71, an analyzing unit 72, and matching. Unit 73, determining unit 74.
  • the first obtaining unit 71 is configured to obtain a safety test result obtained by performing a safety test according to the automobile information of the automobile, where the safety test result includes a result that the automobile component of different functions is tested by different testing manners; the first obtaining unit 71 is A vehicle safety level determining device performs a function module for obtaining a safety test result obtained by performing safety testing based on automobile information of a car.
  • the parsing unit 72 is configured to parse the test type of the car safety according to the safety test result; the parsing unit 72 is a function module for determining the test type of the car safety according to the safety test result for the determining device of the car safety level.
  • the matching unit 73 is configured to match the security test result and the test type with a preset car safety level, where the preset car safety level is a security level configured according to different safety test results and different test types;
  • the matching unit 73 performs a function module for matching the safety test result and the test type with a preset vehicle safety level for a vehicle safety level determining device.
  • the determining unit 74 is configured to determine the matched vehicle safety level as the safety test level of the automobile if the matching is successful.
  • the determining unit 74 performs a function module for determining the matching vehicle safety level as the safety test level of the automobile for the vehicle safety level determining device.
  • the invention provides a device for determining the safety level of a vehicle. After the vehicle system has a complete abnormal situation or a potential safety hazard, the vehicle information is tested for safety, but it is impossible to judge whether it is necessary to perform debugging according to the test result. Compared with the operation, the present invention determines the test type corresponding to the test result by obtaining the safety test result of the automobile, and then matches the test result with the test type and the preset car safety level. If the match is successful, the matching level is made. For the safety test level of the car, the evaluation of the car safety test results is carried out, so that the user can repair, update and optimize according to the different levels of safety test results, thereby reducing the safety hazards in the car, thereby improving the safety of the car information. Sex.
  • an embodiment of the present invention provides another apparatus for determining a security level of a vehicle.
  • the apparatus includes: a first acquiring unit 81 , an analyzing unit 82 , and The matching unit 83, the determining unit 84, the second obtaining unit 85, the detecting unit 86, and the output unit 87.
  • the first obtaining unit 81 is configured to obtain a safety test result obtained by performing a safety test according to the automobile information of the automobile, where the safety test result includes a result that the automobile component with different functions is tested by different testing methods;
  • the parsing unit 82 is configured to parse the test type of the car safety according to the security test result;
  • the matching unit 83 is configured to match the security test result and the test type with a preset car safety level, where the preset car safety level is a security level configured according to different safety test results and different test types;
  • the determining unit 84 is configured to determine the matched vehicle safety level as the safety test level of the automobile if the matching is successful.
  • the parsing unit 82 includes:
  • the first parsing module 8201 is configured to determine, according to the theoretical security analysis test type and the security test result, whether the test type belongs to security threat and risk analysis, security design analysis, security development analysis, security deployment, and process analysis.
  • One type is
  • the second parsing module 8202 is configured to determine, according to the actual security test type and the security test result, whether the test type belongs to one of a functional security test, a vulnerability scan, a system fuzzy test, and a penetration test.
  • the matching unit 43 includes:
  • the first obtaining module 8301 is configured to acquire a potential attack object existing in the car when the test type is a security threat and a risk assessment;
  • the first matching module 8302 is configured to match the security test result with a preset security threat and a risk assessment level according to the attack scenario and the attack path operated by the attack object.
  • the second obtaining module 8303 is configured to: when the test type is a security deployment and a process analysis, obtain software and hardware running conditions existing in the automobile;
  • the second matching module 8304 is configured to match the security test result with a preset security deployment and process analysis level according to changes in the software and hardware operating conditions.
  • the third obtaining module 8305 is configured to: when the test type is a system fuzzy test, obtain a target security stack and an external interface that are obtained by fuzzy analysis of the communication system in the automobile;
  • the third matching module 8306 is configured to match the security test result with a preset system fuzzy test level according to the target security stack and a communication protocol corresponding to the external interface.
  • the device further includes:
  • the second obtaining unit 85 is configured to acquire automobile information by using a control local area network of the automobile, where the automobile information includes data information generated by various components in the automobile during operation of the automobile system; and the second obtaining unit 85 is another type of automobile safety level.
  • the determining device performs acquisition of vehicle information via a control area network of the vehicle, the vehicle information including functional modules of data information generated by various components of the vehicle in operation of the vehicle system.
  • the detecting unit 86 is configured to detect a safety state of the automobile according to a preset abnormal situation correspondence relationship and the automobile information, where the preset abnormal situation correspondence relationship stores a car information corresponding to different parts of the automobile in different situations.
  • the safety state; the detecting unit 86 performs a function module for detecting the safety state of the automobile according to the preset abnormal situation correspondence relationship and the vehicle information for another vehicle safety level determining device.
  • the output unit 87 is configured to output a safety test result of the automobile according to the detection result.
  • the output unit 87 performs a function module for outputting the safety test result of the automobile based on the detection result for another vehicle safety level determining device.
  • the invention provides another device for determining the safety level of a vehicle.
  • the embodiment of the invention determines the test type corresponding to the test result by obtaining the safety test result of the automobile, and specifically classifies the test type into a security threat and risk analysis, and a safety design analysis. , one of security development analysis, security deployment, and process analysis, and then matching the test results with the levels corresponding to the preset different test types according to the specific test type. If the matching is successful, the matching level is used as the car.
  • the safety test level realizes the evaluation of the level of automobile safety test results, effectively identifies the safety risks of automobiles and reduces automobile accidents, and the safety of the user's life can be effectively protected and protected, thereby improving the safety of automobile information.
  • Fig. 16 shows a computer (hereinafter referred to as a device collectively referred to as a device) in which the method of determining the safety level of the automobile according to the present invention can be realized.
  • the device conventionally includes a processor 2010 and a computer program product or computer readable medium in the form of a memory 2020.
  • the memory 2020 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Memory 2020 has a memory space 2030 for program code 1031 for performing any of the method steps described above.
  • the storage space 2030 for program code may include respective program codes 2031 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks.
  • Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG.
  • the storage unit may have a storage section or a storage space or the like arranged similarly to the memory 2020 in FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit comprises program code 2031' for performing the steps of the method according to the invention, ie code that can be read by a processor such as 2010, which when executed by the device causes the device to perform the above Each step in the described method.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of some or all of the components of the security testing method and apparatus for automotive information in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

Abstract

一种汽车信息的安全测试方法及装置，涉及一种汽车技术领域，主要目的在于解决现有汽车中各个部件产生的信息，无法检测是否安全的问题。所述方法包括：通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息；根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态；根据检测结果，输出所述汽车的安全测试结果。用于汽车信息的安全测试。同时，还涉及一种汽车安全测试等级的确定方法及装置。

Description

汽车信息的安全测试方法及装置 技术领域
本发明涉及一种汽车技术领域，特别是涉及一种汽车信息的安全测试方法及装置，以及一种汽车安全测试等级的确定方法及装置。
背景技术
随着互联网技术在各行各业中的大范围应用，汽车互联网技术已经走向成熟。由于汽车中集成了多种不同功能的软、硬件，每个部件之间存在着高度的互联，某一部分出现执行恶意行为的情况，都可能会导致汽车系统的瘫痪，而一些潜在的、不易察觉的异常也会对汽车安全造成威胁。
目前，现有的汽车中各个软、硬件之间的互联是根据总线连接方式进行的，但是，仍然无法获知每个部件产生的信息是否安全，因此，对汽车信息进行安全测试已经成为亟待解决的问题。
同时，目前，当汽车系统出现异常情况或出现潜在的安全隐患后，会对汽车信息进行安全测试，但是无法根据测试结果判断是否需要进行调试等操作，因此，对汽车安全测试进行确定等级已经成为亟待解决的问题。
发明内容
有鉴于此，本发明提供一种汽车信息的安全测试方法及装置，主要目的在于现有汽车中各个部件产生的信息，无法检测是否安全的问题。
第一方面，依据本发明一个方面，提供了一种汽车信息的安全测试方法，包括：通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息；根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态；根据检测结果，输出所述汽车的安全测试结果。
第二方面，依据本发明一个方面，提供了一种汽车信息的安全测试装置，包括：至少一个处理器；以及，至少一个存储器，其与所述至少一个处理器可通信地连接；所述至少一个存储器包括处理器可执行的指令，当所述处理器可执行的指令由所述至少一个处理器执行时，致使所述装置执行至少以下操作：通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息；根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态；根据检测结果，输出所述汽车的安全测试结果。
第三方面，本发明实施例中提供了一种计算机程序，包括计算机可读代码，当计算机可读代码被运行时，导致第一方面中所述的方法被执行。
第四方面，本发明实施例中提供了一种计算机可读介质，其中存储了如第三方面所述的计算机程序。
第五方面，依据本发明一个方面，提供了一种汽车安全等级的确定方法，包括：获取根据汽车的汽车信息进行安全测试得到的安全测试结果，所述安全测试结果包括不同功能的汽车部件通过不同测试方式进行测试得到的结果；根据所述安全测试结果解析汽车安全的测试类型；将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级；若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。
第六方面，依据本发明一个方面，提供了一种汽车安全等级的确定装置，包括：至少一个处理器；以及，至少一个存储器，其与所述至少一个处理器可通信地连接；所述至少一个存储器包括处理器可执行的指令，当所述处理器可执行的指令由所述至少一个处理器执行时，致使所述装置执行至少以下操作：获取根据汽车的汽车信息进行安全测试得到的安全测试结果，所述安全测试结果包括不同功能的汽车部件通过不同测试方式进行测试得到的结果；根据所述安全测试结果解析汽车安全的测试类型；将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级；若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等 级。
第七方面，本发明实施例中提供了一种计算机程序，当计算机可读代码被运行时，当计算机运行所述计算机可读代码时，导致第五方面中所述的方法被执行。
第八方面，本发明实施例中提供了一种计算机可读介质，其中存储了如第七方面所述的计算机程序。
借由上述技术方案，本发明实施例提供的技术方案至少具有下列优点：
本发明提供了一种汽车信息的安全测试方法及装置，首先通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息，然后根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态，最后根据检测结果，输出所述汽车的安全测试结果。与现有汽车中各个部件产生的信息，无法检测是否安全相比，本发明实施例通过根据汽车中各个部件产生的汽车信息与预设异常情况对应关系对汽车的安全状态进行检测，实现通过安全测试发现汽车中潜在的安全威胁，以便通过修复等方法恢复汽车的安全等级，从而提高汽车信息的安全性。
本发明提供了一种汽车安全等级的确定方法及装置，首先获取根据汽车的汽车信息进行安全测试得到的安全测试结果，所述安全测试结果包括不同功能的汽车部件通过不同测试方式进行测试得到的结果，再根据所述安全测试结果解析汽车安全的测试类型，然后将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级，若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。与现有的汽车系统出现完全异常情况或出现潜在的安全隐患后，会对汽车信息进行安全测试，但是无法根据测试结果判断是否需要进行调试等操作相比，本发明通过获取汽车的安全测试结果，确定与测试结果对应的测试类型，然后将测试结果与测试类型与预设的汽车安全等级进行匹配，若匹配成功，则将匹配的等级做为汽车的安全测试等级，实现了对汽车安全测试结果进行等级的评估，以便用户根据不同等级的安全测试结果进行修复、更新、优化等操作， 减少汽车中的安全隐患，从而提高汽车信息的安全性。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1示出了本发明实施例一提供的一种汽车信息的安全测试方法流程图；
图2示出了本发明实施例一提供的一种汽车CAN网络示意图；
图3示出了本发明实施例一提供的一种汽车功能模块组成框图；
图4示出了本发明实施例二提供的另一种汽车信息的安全测试方法流程图；
图5示出了本发明实施例二提供的一种汽车的mongodb的运作原理流程图；
图6示出了本发明实施例三提供的一种汽车信息的安全测试装置框图；
图7示出了本发明实施例四提供的另一种汽车信息的安全测试装置框图；
图8示出了用于执行根据本发明的方法的计算机的框图；
图9示出了用于保持或者携带实现根据本发明的方法的程序代码的存储单元示意图；
图10示出了本发明实施例五提供的一种汽车安全等级的确定方法流程图；
图11示出了本发明实施例五提供的一种汽车功能模块组成框图；
图12示出了本发明实施例五提供的一种汽车CAN网络示意图；
图13示出了本发明实施例六提供的另一种汽车安全等级的确定方法流程图；
图14示出了本发明实施例七提供的一种汽车安全等级的确定装置框图；
图15示出了本发明实施例八提供的另一种汽车安全等级的确定装置框图；
图16示出了用于执行根据本发明的方法的计算机的框图；
图17示出了用于保持或者携带实现根据本发明的方法的程序代码的存储单元示意图。
具体实施方式
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。
实施例一
本发明实施例提供了一种汽车信息的安全测试方法，如图1所示，所述方法包括：
101、通过汽车的控制局域网络获取汽车信息。
其中，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息，所述控制局域网络以汽车总线形式存在与汽车系统中，汽车电子元器件在汽车内部是通过控制局域网络CAN相连接，并进行通信的，如图2所示。所述汽车系统包括主机、显示器、键盘、天线等部件，系统可以为驾驶者提供呈现汽车系统状态，娱乐信息，驾驶信息等，单从汽车系统的基本情况看，它是采用专用中央处理器，基于车身总线系统和网络而形成 的车载综合信息处理系统，所述汽车信息包括如图3所示的汽车信息安全制定模型中各个功能模块对应产生的信息，例如，传感单元在检测车速是产生的模拟信号等。
需要说明的是，CAN网络的实际上就是个大的多端口的转发器HUB，在CAN总线空闲时，所有的单元都可开始发送消息。最先访问总线的单元可获得发送权。多个单元同时开始发送时，发送高优先级ID消息的单元可获得发送权。
另外，还可以将汽车信息的产生按照用于汽车中的功能进行划分，还可以划分为车载终端、车载网络、车载应用、车载业务，对于不同的划分，产生汽车信息的具体部件也不同，例如，车载终端T-box包括车内装载TU端自身硬件设计、软件平台、网络传输、协议应用等，车载应用包括安装在汽车系统中的应用软件，车载服业务包括汽车远程服务提供商TSP(Telematics Service Provider)。
需要进一步说明的是，汽车远程服务提供商TSP在远距离通信的电信Telematics产业链中居于核心地位，上接汽车制造商、车载设备制造商、网络运营商，下接内容提供商。Telematics服务集合了位置服务、地理信息系统Gis(Geographic Information System)服务和通信服务等现代计算机技术，为用户提供强大的服务，如：导航、娱乐、资讯、安防、SNS、远程保养等服务。TSP系统在汽车CAN当中起到的是汽车和手机之间通讯的跳板，为汽车和手机提供内容和流量转发的服务。针对目前众多整车厂的调研结果来看目前大多数TSP是放在云端服务器使用公有云技术，那么TSP平台就有一部分面临的云端的威胁。比如，可以通过虚拟机逃逸到宿主机，再从宿主机到达TSP平台的虚拟机中获取TSP的核心接口，密钥，证书等关键信息，横向控制其它的汽车。所以部署在云端的TSP平台对于系统自身和依赖环境的安全至关重要。对于部署在整车厂自己的服务器中的TSP平台，则需要考虑抗拒绝服务能力，还有传统的IT防护，安全管理等因素。
另外，控制汽车的消息指令是在T-BOX内部生成的，并且是使用T-BOX的蜂窝网络调制解调器的扩展模块进行加密的，相当于在传输层面是加密,所以无法得到消息会话的内容，解决的方法就是需要通过分析固件内部的 代码，找到加密方法和秘钥，才能够知道消息会话的内容。所以需要对T-BOX进行拆解，然后把FLASH芯片吹下来，逆向固件。发现发送的控制指令，破解传输加密的密钥，还有的一些T-BOX出片的时候是留有调试接口的，这样就不需要吹FLASH就可以拿到程序了，所以T-BOX的保护对象主要在于如何防护固件被人拿走，保护好T-BOX内部的密钥。
102、根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态。
其中，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态，所述安全状态为不同部件产生的数据信息是否处于使得汽车正常运行的阈值范围内，这个阈值可以为技术人员根据可能出现的潜在危险系数进行设定，本发明实施例不做具体限定。
例如，当获取的汽车信息为在一天内汽车系统中出现2次控制方式与预先设定的控制方式不符的状态，预设异常情况对应关系中存储的1个月内汽车系统中出现1次以上控制方式与预先设定的控制方式不符的状态，即为危险状态。
103、根据检测结果，输出所述汽车的安全测试结果。
其中，所述测试结果可以为不同级别的测试结果，也可以预先设定安全、危险状态的测试结果，本发明实施例不做具体限定。
例如，若检测出与汽车系统相连的手机APP执行的控制命令为输出用户信息，则输出的安全测试结果为用户信息泄露。
本发明提供了一种汽车信息的安全测试方法，与现有汽车中各个部件产生的信息，无法检测是否安全相比，本发明实施例通过根据汽车中各个部件产生的汽车信息与预设异常情况对应关系对汽车的安全状态进行检测，实现通过安全测试发现汽车中潜在的安全威胁，以便通过修复等方法恢复汽车的安全等级，从而提高汽车信息的安全性。
实施例二
本发明实施例提供了另一种汽车信息的安全测试方法，如图4所示，所述方法包括：
201、当接收到安全测试指令时，通过预设安全协议访问汽车系统中各 个部件的历史数据信息。
其中，所述预设安全协议用于指示所述各个部件开放历史数据信息，所述预设安全协议为NGTP(Next Generation Telematics Protocol)，应用于CAN网络的信息通信。NGTP可以使汽车中的部件进行信息通信，从而得到不同部件中产生的数据信息。所述安全测试指令用于指示系统进行安全测试，具体形式本发明实施例不做具体限定。
需要说明的是，当前使用的NGTP2.0是最新版本，优点体现于在使用非关系型数据库monogdb上，对于Telematics而言牺牲存储来换取I/O性能的提升是一个明智的选择。
需要进一步说明的是，mongodb的运作原理是保证了所有车机和服务端业务逻辑在异步执行时的唯一保障。如图5所示，从TU车机端发起请求后经由Network组网，再经过Dispatcher应用分发后进入mongodb库快存，然后完成IF2和IF3的业务过程。当最终该服务被递交到业务数据库Database的时候，已经是逻辑时序第六步了，所以在使用NGTP框架进行开发的时候，要考虑套用安全框架过滤请求参数的内容，类型等。
202、通过汽车的控制局域网络访问由具有智能控制功能的汽车部件、具有拓展功能的汽车部件、具有常用功能的汽车部件、具有附加功能的汽车部件所产生的历史数据信息。
其中，所述具有智能控制功能的汽车部件可以包括传感器单元、智能控制单元、传动系统、底盘系统等，所述具有拓展功能的汽车部件可以包括车身、远程信息处理、信息咨询系统等，所述常用功能的汽车部件可以包括插入设备、诊断工具、仪表盘等，所述具有附加功能的汽车部件可以包括蓝牙、无线局域网络等，本发明实施例不做具体限定，如图3所示。
需要说明的是，历史数据信息为存储在不同部件对应的数据日志中。
203、按照预设时间间隔提取所述历史数据信息，得到汽车信息。
其中，所述预设时间间隔可以为1天、2天等，还可以为接收到用户进行指示的提取指令，本发明实施例不做具体限定，所述汽车信息可以为全部部件的历史数据信息，也可以为部分部件的历史数据信息，还可以肯定用户选定部件的历史数据信息，本发明实施例不做具体限定。
204、解析所述汽车信息对应的测试类型。
其中，所述测试类型包括车载终端类型、车载网络类型、车载应用类型、车载业务类型，所述测试类型是根据产生汽车信息的部件进行划分的，即将待检测安全性的部件进行划分类型。
需要说明的是，解析的步骤是根据汽车信息来源于的部件属于具体的测试类型进行解析的。
对于本发明实施例，步骤204之前还包括：为不同的测试类型配置不同的测试方式，所述测试方式包括功能测试方式、漏洞扫描方式、模糊测试方式、渗透测试方式。
其中，所述为不同的测试类型配置不同的测试方式为一种测试类型的汽车信息使用一种测试方式进行测试，也可以一种测试类型的汽车信息使用多种测试方式，本发明实施例不做具体限定。具体的，一种测试方式可以测试不同测试类型的汽车信息，一种测试类型的汽车信息可以由多种测试方式进行测试。例如，车载终端类型可以对应功能测试方式，车载网络类型可以对应漏洞扫描，车载应用类型可以对应模糊测试，车载业务类型可以对应渗透测试。
需要说明的是。每个测试方式可以并列进行、也可以按照设置的顺序进行，本发明实施例不做具体限定。例如，在功能安全测试时，测试所有的安全相关的功能，测试系统的正确性和鲁棒性。这一步是类似于一般的功能测试，但专注于安全功能，仔细执行这个测试可以发现执行错误，规范的差异，特别是未指定的功能，都可能导致潜在的安全威胁。在漏洞扫描时，测试系统已经知道常见的安全漏洞，如已知的安全漏洞或(安全)配置与已知的弱点。在模糊测试时，进一步试图通过发送系统格式不正确的输入到目标系统检查未知的新的安全漏洞，潜在的关键安全系统的行为，为了测试整个系统的安全性，这意味着软件和硬件的共同安全，高度针对性的渗透测试可以应用于最后一步。
205、按照根据预设的异常对应关系及所述汽车信息确定的测试方式，对所述汽车的安全状态进行测试。
其中，所述测试包括理论安全分析测试、实际安全测试，所述理论安 全分析测试在汽车中逐渐成为常规性分析，并应用于识别和理解汽车IT系统的安全弱点基于相应的制度规范和技术文档纸质评估。所述实际安全测试可以发现执行错误，包括外部攻击者能够进行利用且未指定的功能和规格的差异。因此，一个彻底的实际安全测试有助于建立信任的健全性的执行。
需要说明的是，要进行一个汽车系统的设计分析，一个理论描述的系统是必要的，根据这些描述的详细程度，可以进行深度和精度的分析变化。首先，高层次的描述可以充分的设计分析识别系统中的缺陷；其次，在可靠性系统的体系结构中测试结果可以建立信任。为了实现这些目标，文件需要被检查潜在攻击点，如由于不同标准协议的相互作用导致的弱密码算法或可能存在的攻击。
206、根据检测结果，输出所述汽车的安全测试结果。
本步骤与图1所述步骤103所述的方法相同，这里不再赘述。
对于本发明实施例，步骤206具体包括：若按照功能测试方式进行检测，输出所述汽车的安全检测结果包括性能测试结果、正确性测试结果、鲁棒性测试结果、合规测试结果。
其中，所述功能测试方式为确保汽车功能符合规范和标准安全功能的测试方法，例如，车辆IT系统的加密算法和认证协议，本发明实施例不做具体限定。
需要说明的是，功能测试方式不仅根据规范测试是否正确的行为，也对鲁棒性、合规性进行测试。一般地，适用于汽车领域的检测安全标准可以选取MISRA-C，还需要使用各种汽车专用的安全协议，例如安全的闪存算法或安全通信、安全防盗、OBD，和即将到来的vehicle-to-x(V2X)通信，这些协议的实现均可以满足安全功能的测试。
对于本发明实施例，步骤206具体还包括：若按照漏洞扫描方式进行检测，输出所述汽车的安全检测结果包括接口测试结果、配置测试结果、漏洞测试结果、恶意软件测试结果。
其中，所述漏洞扫描方式是用来检测汽车系统所有相关的应用程序、网络及后端基础设施中已知的安全弱点，这个安全弱点为一个已知的汽车 安全漏洞中不断的更新数据库。
需要说明的是，漏洞扫描也包括多种不同的漏洞扫描方法。首先，可以对系统的软件/硬件运行的代码进行扫描、识别，例如，使用静态和动态分析缓冲区溢出和堆溢出。其次，汽车系统可以通过开放的端口和接口被扫描，并且提供可运行在这些接口上的服务，包括传统的IT接口，如以太网的网络通信、Wi-Fi、或移动互联网。对于一系列的操作系统、网络协议栈、应用和库是典型的重复使用，扫描包括侦察端口扫描，以及对特定漏洞的深入扫描。此外，汽车环境具有特殊的汽车CAN总线系统，这在传统的IT没有对等的，这意味着，自动扫描工具非常适合于检测一个概述的漏洞。在这种情况下，扫描的诊断功能是显着的，因为存在的潜在危险很可能包含安全关键功能弱记录，如开发或调试功能。
对于本发明实施例，步骤206具体还包括：若按照模糊测试方式进行检测，输出所述汽车的安全检测结果包括黑盒测试结果、灰盒测试结果、白盒测试结果、功能测试结果。
其中，所述模糊测试方式用于长时间使用测试软件和IP网络的类型，事实上，ECU可以看作是小型计算机，运行不同的软件，是由不同类型的网络如CAN、FlexRay或MOST组成的。一般来说，测试包括了三个不同的步骤：首先对目标创造输入，其次输入到目标的输入和最后目标检测系统程序流程监控错误。由于模糊广泛应用在计算机世界中，模糊工具如Peach有一个强大的模糊产生器，可以适应个别不同的协议如UDS。由模糊产生器产生输入，然后输入到需要使用的传输协议中，然后监测目标系统，用以检测可能的漏洞。这个监测过程可以从检查的返回值的使用范围和调试器观察目标设备的内部状态，最后，所有发现的不寻常的行为由一个专业分析检测利用的漏洞软件进行分析。在汽车系统中，模糊测试可应用于诊断协议，如UDS、汽车网络协议(CAN，FlexRay，MOST或Lin)
对于本发明实施例，步骤206具体还包括：若按照渗透测试方式进行检测，输出所述汽车的安全检测结果包括硬件测试结果、软件测试结果、网络测试结果、平台测试结果。
其中，所述渗透测试方式是为了测试IP保护或测试权威性的功能，例 如，防盗、组件保护、里程表操作、功能激活及保护调整车辆进行虚假索赔安全功能，渗透测试还可以测出现代远程连接攻击。通常，渗透测试开始于观测物理设备，包括枚举接口、在PCB确定组件及其之间的连接，采集规格对于假设的攻击者，通常收集任何有助于下一步攻击的信息。第二步骤可能包括攻击外部接口，如USB、串口或硬件本身的攻击。攻击硬件通常为测试人员试图找到被忽视或无证调试访问的接口，或获取ECU内部的接口，如内存总线。在第三个步骤中，所有的通信通道的设备，如CNA总线、以太网、或Wi-Fi被分析，并且被用来攻击目标设备。根据目标系统和渗透测试的范围，对后端进行进一步的攻击。
需要说明的是，所述渗透测试包括黑盒测试、白盒测试、灰盒测试。对于黑盒测试，基本不需要文档或规格，除了信息，也可以现实世界中的攻击者需求。可以在一个非常逼真的模拟实际攻击的效果。对于白盒测试，需要完整规范和文档，可以明确目标的弱点，并拥有更多的资源，无需获取信息，提高了测试的效率。灰盒试验代表了黑盒和白盒的中间地带，可以接收部分信息，关注特定的子系统的焦点或信息，特定的攻击者。
对于本发明实施例，步骤206之后的步骤可以为：根据所述安全测试结果解析汽车安全的评估类型；将所述安全测试结果及所述评估类型与预设的汽车安全等级进行匹配，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级；若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。
其中，所述测试类型包括车载终端类型、车载网络类型、车载应用类型、车载业务类型，所述测试类型是根据产生汽车信息的部件进行划分的，即将待检测安全性的部件进行划分类型。所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级，所述预设的汽车安全等级可以划分为四个安全测试级别，例如，预先设置“信任的保证水平”VCSL(Vehicle Car Security Level)-A、B、C、D四个级别，最低要求为对每个理论进行安全分析和安全评估，每个实践的广度和深度。如表1所示，其中，TAP1、TAP2、TAP3、TAP4为安全威胁和风险分析下不同的测试结果，所以对应不同的等级VSCL A、VSCL B、VSCL C、VSCL D，其他的 情况，以此类推。
表1：汽车安全测试等级(VSCL)
Figure PCTCN2017120282-appb-000001
本发明提供了另一种汽车信息的安全测试方法，本发明实施例通过根据汽车中各个部件产生的汽车信息解析出汽车信息对应的测试类型，具体包括车载终端类型、车载网络类型、车载应用类型、车载业务类型，根据测试类型可以提取出对应的测试方式，根据汽车信息对应的测试方式进行安全测试，实现通过安全测试发现汽车中潜在的安全威胁，以便通过修复等方法恢复汽车的安全等级，有效的识别汽车安全风险，可以减少汽车事故，对车主的生命安全起到有效的防护和保护。
实施例三
进一步的，作为对上述图1所示方法的实现，本发明实施例提供了一种汽车信息的安全测试装置，如图6所示，该装置包括：获取单元31、检测单元32、输出单元33。
获取单元31，用于通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息；获取单元31为一种汽车信息的安全测试装置执行通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息的功能模块。
检测单元32，用于根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态；检测单元32为一种汽车信息的安全测试装置执行根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态的功能模块。
输出单元33，用于根据检测结果，输出所述汽车的安全测试结果。输出单元33为一种汽车信息的安全测试装置执行根据检测结果，输出所述汽车的安全测试结果的功能模块。
本发明提供了一种汽车信息的安全测试装置，与现有汽车中各个部件产生的信息，无法检测是否安全相比，本发明实施例通过根据汽车中各个部件产生的汽车信息与预设异常情况对应关系对汽车的安全状态进行检测，实现通过安全测试发现汽车中潜在的安全威胁，以便通过修复等方法恢复汽车的安全等级，从而提高汽车信息的安全性。
实施例四
进一步的，作为对上述图2所示方法的实现，本发明实施例提供了另一种汽车信息的安全测试装置，如图7所示，该装置包括：获取单元41、检测单元42、输出单元43、第一解析单元44、配置单元45、访问单元46、第二解析单元47、匹配单元48、确定单元49。
获取单元41，用于通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息；
检测单元42，用于根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态；
输出单元43，用于根据检测结果，输出所述汽车的安全测试结果。
具体地，所述获取单元41包括：
访问模块4101，用于通过汽车的控制局域网络访问由具有智能控制功能的汽车部件、具有拓展功能的汽车部件、具有常用功能的汽车部件、具有附加功能的汽车部件所产生的历史数据信息；
提取模块4102，用于按照预设时间间隔提取所述历史数据信息，得到汽车信息。
所述检测单元42，具体用于按照根据预设的异常对应关系及所述汽车信息确定的测试方式，对所述汽车的安全状态进行测试，所述测试包括理论安全分析测试、实际安全测试。
进一步地，所述装置还包括：
第一解析单元44，用于解析所述汽车信息对应的测试类型，所述测试类型包括车载终端类型、车载网络类型、车载应用类型、车载业务类型。第一解析单元44为另一种汽车信息的安全测试装置执行解析所述汽车信息对应的测试类型的功能模块。
配置单元45，用于为不同的测试类型配置不同的测试方式，所述测试方式包括功能测试方式、漏洞扫描方式、模糊测试方式、渗透测试方式。配置单元45为另一种汽车信息的安全测试装置执行为不同的测试类型配置不同的测试方式的功能模块。
具体地，所述输出单元43包括：
第一输出模块4301，用于若按照功能测试方式进行检测，输出所述汽车的安全检测结果包括性能测试结果、正确性测试结果、鲁棒性测试结果、合规测试结果；
第二输出模块4302，用于若按照漏洞扫描方式进行检测，输出所述汽车的安全检测结果包括接口测试结果、配置测试结果、漏洞测试结果、恶意软件测试结果；
第三输出模块4303，用于若按照模糊测试方式进行检测，输出所述汽车的安全检测结果包括黑盒测试结果、灰盒测试结果、白盒测试结果、功能测试结果；
第四输出模块4304，用于若按照渗透测试方式进行检测，输出所述汽车的安全检测结果包括硬件测试结果、软件测试结果、网络测试结果、平台测试结果。
进一步的，所述装置还包括：
访问单元46，用于当接收到安全测试指令时，通过预设安全协议访问汽车系统中各个部件的历史数据信息，所述预设安全协议用于指示所述各个部件开放历史数据信息。访问单元46为另一种汽车信息的安全测试装置执行当接收到安全测试指令时，通过预设安全协议访问汽车系统中各个部件的历史数据信息的功能模块。
第二解析单元47，用于根据所述安全测试结果解析汽车安全的评估类型；第二解析单元47为另一种汽车信息的安全测试装置执行根据所述安全测试结果解析汽车安全的评估类型的功能模块。
匹配单元48，用于将所述安全测试结果及所述评估类型与预设的汽车安全等级进行匹配，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级；匹配单元48为另一种汽车信息的安全测试装置执行将所述安全测试结果及所述评估类型与预设的汽车安全等级进行匹配的功能模块。
确定单元49，用于若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。确定单元49为另一种汽车信息的安全测试装置执行将匹配的汽车安全等级确定为所述汽车的安全测试等级的功能模块。
本发明提供了另一种汽车信息的安全测试装置，本发明实施例通过根据汽车中各个部件产生的汽车信息解析出汽车信息对应的测试类型，具体包括车载终端类型、车载网络类型、车载应用类型、车载业务类型，根据测试类型可以提取出对应的测试方式，根据汽车信息对应的测试方式进行安全测试，实现通过安全测试发现汽车中潜在的安全威胁，以便通过修复等方法恢复汽车的安全等级，有效的识别汽车安全风险，可以减少汽车事 故，对车主的生命安全起到有效的防护和保护。
图8示出了可以实现根据本发明的汽车信息的安全测试方法的计算机(下述将计算机统称为设备)。该设备传统上包括处理器1010和以存储器1020形式的计算机程序产品或者计算机可读介质。存储器1020可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器1020具有用于执行上述方法中的任何方法步骤的程序代码1031的存储空间1030。例如，用于程序代码的存储空间1030可以包括分别用于实现上面的方法中的各种步骤的各个程序代码1031。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如参考图9所述的便携式或者固定存储单元。该存储单元可以具有与图8中的存储器1020类似布置的存储段或者存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括用于执行根据本发明的方法步骤的程序代码1031’，即可以由例如诸如1010之类的处理器读取的代码，这些代码当由设备运行时，导致该设备执行上面所描述的方法中的各个步骤。
实施例五
本发明实施例提供了一种汽车安全等级的确定方法，如图10所示，所述方法包括：
501、获取根据汽车的汽车信息进行安全测试得到的安全测试结果。
其中，所述安全测试结果包括不同功能的汽车部件通过不同测试方式进行测试得到的结果，所述汽车信息为如图11所示的汽车信息安全制定模型中各个功能模块对应产生的信息，例如，传感单元在检测车速是产生的模拟信号等。
需要说明的是，获取安全测试结果可以通过汽车中的控制局域网络CAN与各科部件之间的通信连接进行实现，如图12所示。CAN网络的实际上就是个大的多端口的转发器HUB，在CAN总线空闲时，所有的单元都可开始发送消息。最先访问总线的单元可获得发送权。多个单元同时开始发送时，发送高优先级ID消息的单元可获得发送权。
另外，还可以将汽车信息的产生按照用于汽车中的功能进行划分，还可以划分为车载终端、车载网络、车载应用、车载业务，对于不同的划分，产生汽车信息的具体部件也不同，例如，车载终端T-box包括车内装载TU端自身硬件设计、软件平台、网络传输、协议应用等，车载应用包括安装在汽车系统中的应用软件，车载服业务包括汽车远程服务提供商TSP(Telematics Service Provider)。
502、根据所述安全测试结果解析汽车安全的测试类型。
其中，所述测试类型包括车载终端类型、车载网络类型、车载应用类型、车载业务类型，所述测试类型是根据产生汽车信息的部件进行划分的，即将待检测安全性的部件进行划分类型。
需要说明的是，解析的步骤是根据汽车信息来源于的部件属于具体的测试类型进行解析的。
503、将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配。
其中，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级，所述预设的汽车安全等级可以划分为四个安全测试级别，例如，预先设置“信任的保证水平”VCSL(Vehicle Car Security Level)-A、B、C、D四个级别，最低要求为对每个理论进行安全分析和安全评估，每个实践的广度和深度。如表1所示，其中，TAP1、TAP2、TAP3、TAP4为安全威胁和风险分析下不同的测试结果，所以对应不同的等级VSCL A、VSCL B、VSCL C、VSCL D，其他的情况，以此类推。
表1：汽车安全测试等级(VSCL)
Figure PCTCN2017120282-appb-000002
Figure PCTCN2017120282-appb-000003
504、若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。
通过将匹配的汽车安全等级做为汽车的安全测试等级，以便对不同等级的测试结果进行处理，减少汽车信息中的安全隐患。
本发明提供了一种汽车安全等级的确定方法，与现有的汽车系统出现完全异常情况或出现潜在的安全隐患后，会对汽车信息进行安全测试，但是无法根据测试结果判断是否需要进行调试等操作相比，本发明通过获取汽车的安全测试结果，确定与测试结果对应的测试类型，然后将测试结果与测试类型与预设的汽车安全等级进行匹配，若匹配成功，则将匹配的等级做为汽车的安全测试等级，实现了对汽车安全测试结果进行等级的评估，以便用户根据不同等级的安全测试结果进行修复、更新、优化等操作，减少汽车中的安全隐患，从而提高汽车信息的安全性。
实施例六
本发明实施例提供了另一种汽车安全等级的确定方法，如图13所示，所述方法包括：
601、获取根据汽车的汽车信息进行安全测试得到的安全测试结果。
其中，所述安全测试结果包括不同功能的汽车部件通过不同测试方式 进行测试得到的结果，所述汽车安全的测试类型包括理论安全分析测试类型、实际安全测试类型。所述理论安全分析测试在汽车中逐渐成为常规性分析，并应用于识别和理解汽车IT系统的安全弱点基于相应的制度规范和技术文档纸质评估。所述实际安全测试可以发现执行错误，包括外部攻击者能够进行利用且未指定的功能和规格的差异。因此，一个彻底的实际安全测试有助于建立信任的健全性的执行。
需要说明的是，要进行一个汽车系统的设计分析，一个理论描述的系统是必要的，根据这些描述的详细程度，可以进行深度和精度的分析变化。首先，高层次的描述可以充分的设计分析识别系统中的缺陷；其次，在可靠性系统的体系结构中测试结果可以建立信任。为了实现这些目标，文件需要被检查潜在攻击点，如由于不同标准协议的相互作用导致的弱密码算法或可能存在的攻击。
对于本发明实施例，步骤601之前还包括：通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息；根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态；根据检测结果，输出所述汽车的安全测试结果。
其中，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息，所述控制局域网络以汽车总线形式存在与汽车系统中，汽车电子元器件在汽车内部是通过控制局域网络CAN相连接，并进行通信的，所述汽车系统包括主机、显示器、键盘、天线等部件，系统可以为驾驶者提供呈现汽车系统状态，娱乐信息，驾驶信息等，单从汽车系统的基本情况看，它是采用专用中央处理器，基于车身总线系统和网络而形成的车载综合信息处理系统，所述汽车信息包括如图11所示的汽车信息安全制定模型中各个功能模块对应产生的信息，例如，传感单元在检测车速是产生的模拟信号等。所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态，所述安全状态为不同部件产生的数据信息是否处于使得汽车正常运行的阈值范围内，这个阈值可以为技术人员根据可能 出现的潜在危险系数进行设定，本发明实施例不做具体限定。其中，所述测试结果可以为不同级别的测试结果，也可以预先设定安全、危险状态的测试结果，本发明实施例不做具体限定。
例如，当获取的汽车信息为在一天内汽车系统中出现2次控制方式与预先设定的控制方式不符的状态，预设异常情况对应关系中存储的1个月内汽车系统中出现1次以上控制方式与预先设定的控制方式不符的状态，即为危险状态。
例如，若检测出与汽车系统相连的手机APP执行的控制命令为输出用户信息，则输出的安全测试结果为用户信息泄露。
602a、根据所述理论安全分析测试类型及所述安全测试结果判断所述测试类型是否属于安全威胁和风险分析、安全设计分析、安全发展分析、安全部署及流程分析中的一种。
其中，所述理论安全分析测试在汽车中逐渐成为常规性分析，并应用于识别和理解汽车IT系统的安全弱点基于相应的制度规范和技术文档纸质评估。所述安全威胁和风险分析为分析潜在的汽车攻击、攻击场景和攻击路径。所述安全部署及流程分析为分析构件集成的安全、在后台部署和其他安全相关的过程、汽车零部件和通信的生产、操作、阶段等，本发明实施例不做具体限定。
对于本发明实施例，与步骤602a并列的步骤602b、根据所述实际安全测试类型及所述安全测试结果判断所述测试类型是否属于功能安全测试、漏洞扫描、系统模糊测试、渗透测试中的一种。
其中，所述实际安全测试可以发现执行错误，包括外部攻击者能够进行利用且未指定的功能和规格的差异。因此，一个彻底的实际安全测试有助于建立信任的健全性的执行。所述功能测试方式为确保汽车功能符合规范和标准安全功能的测试方法，例如，车辆IT系统的加密算法和认证协议，本发明实施例不做具体限定。所述漏洞扫描方式是用来检测汽车系统所有相关的应用程序、网络及后端基础设施中已知的安全弱点，这个安全弱点为一个已知的汽车安全漏洞中不断的更新数据库。所述模糊测试方式用于长时间使用测试软件和IP网络的类型，事实上，ECU可以看作是小型计算 机，运行不同的软件，是由不同类型的网络如CAN、FlexRay或MOST组成的。所述渗透测试方式是为了测试IP保护或测试权威性的功能，例如，防盗、组件保护、里程表操作、功能激活及保护调整车辆进行虚假索赔安全功能，渗透测试还可以测出现代远程连接攻击。
603a、当所述测试类型为安全威胁和风险评估，则获取存在于汽车中的潜在攻击对象。
其中，所述潜在攻击对象为对汽车作出攻击行为的对象，如车主、车库、竞争对手、第三方，本发明实施例不做具体限定。
604a、根据所述攻击对象操作的攻击场景、攻击路径，将所述安全测试结果与预设的安全威胁和风险评估等级进行匹配。
其中，所述预设的安全威胁和风险评估等级为技术人员预先设定的针对安全威胁和风险分析得到的不同情况的等级划分。例如，如表2所示，表中TAP1、TAP2、TAP3、TAP4的不同测试内容及结果可以对应VSCL A、VSCL B、VSCL C、VSCL D。
表2：VSCL示范定义汽车的安全威胁和风险分析
Figure PCTCN2017120282-appb-000004
603b、当所述测试类型为安全部署及流程分析，则获取存在于汽车中的软件、硬件运行情况。
其中，所述软件、硬件为汽车中与汽车系统相关联的硬件及软件，例如，如密钥生成/分布、Web注入，访问授权、后端的安全参数，汽车零部件，如秘钥注入、访问控制、初始化、个性化，如密钥长度，操作，算法，密钥交换等，本发明实施例不做具体限定。
604b、根据所述软件、硬件运行情况的变化，将所述安全测试结果与预设的安全部署及流程分析等级进行匹配。
其中，所述预设的安全部署及流程分析等级为技术人员预先设定的针对安全部署及流程分析得到的不同情况的等级划分。例如，如表3所示，表中DEP1、DEP2、DEP3的不同测试内容及结果可以对应VSCL B、VSCL C、VSCL D。
表3：VSCL示范定义安全部署及流程分析
Figure PCTCN2017120282-appb-000005
603c、当所述测试类型为系统模糊测试，则获取存在于汽车中通过通信系统模糊分析得到的目标安全栈、外部接口。
其中，所述目标安全栈为在汽车系统中执行不同功能的栈，如，堆叠， 以太网协议栈，所述外部接口为汽车连接外部设备的接口，如USB，本发明实施例不做具体限定。
604c、根据所述目标安全栈及所述外部接口对应的通信协议，将所述安全测试结果与预设的系统模糊测试等级进行匹配。
其中，所述预设的系统模糊测试等级为技术人员预先设定的针对系统模糊测试得到的不同情况的等级划分。例如，如表4所示，表中SFT1、SFT2、SFT3的不同测试内容及结果可以对应VSCL B、VSCL C、VSCL D。
表4：VSCL示范定义汽车模糊测试系统
Figure PCTCN2017120282-appb-000006
605、若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。
本步骤与图10所述步骤504所述的方法相同，这里不再赘述。
本发明提供了另一种汽车安全等级的确定方法，本发明实施例通过获取汽车的安全测试结果，确定与测试结果对应的测试类型，将测试类型具体划分为安全威胁和风险分析、安全设计分析、安全发展分析、安全部署及流程分析中的一种，然后根据具体的测试类型将测试结果与预设的不同测试类型对应的等级进行匹配，若匹配成功，则将匹配的等级做为汽车的 安全测试等级，实现了对汽车安全测试结果进行等级的评估，有效的识别汽车安全风险并减少汽车事故，用户的生命的安全可以得到有效的防护和保护，从而提高汽车信息的安全性。
实施例七
进一步的，作为对上述图10所示方法的实现，本发明实施例提供了一种汽车安全等级的确定装置，如图14所示，该装置包括：第一获取单元71、解析单元72、匹配单元73、确定单元74。
第一获取单元71，用于获取根据汽车的汽车信息进行安全测试得到的安全测试结果，所述安全测试结果包括不同功能的汽车部件通过不同测试方式进行测试得到的结果；第一获取单元71为一种汽车安全等级的确定装置执行获取根据汽车的汽车信息进行安全测试得到的安全测试结果的功能模块。
解析单元72，用于根据所述安全测试结果解析汽车安全的测试类型；解析单元72为一种汽车安全等级的确定装置执行根据所述安全测试结果解析汽车安全的测试类型的功能模块。
匹配单元73，用于将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级；匹配单元73为一种汽车安全等级的确定装置执行将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配的功能模块。
确定单元74，用于若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。确定单元74为一种汽车安全等级的确定装置执行将匹配的汽车安全等级确定为所述汽车的安全测试等级的功能模块。
本发明提供了一种汽车安全等级的确定装置，与现有的汽车系统出现完全异常情况或出现潜在的安全隐患后，会对汽车信息进行安全测试，但是无法根据测试结果判断是否需要进行调试等操作相比，本发明通过获取汽车的安全测试结果，确定与测试结果对应的测试类型，然后将测试结果与测试类型与预设的汽车安全等级进行匹配，若匹配成功，则将匹配的等级做为汽车的安全测试等级，实现了对汽车安全测试结果进行等级的评估， 以便用户根据不同等级的安全测试结果进行修复、更新、优化等操作，减少汽车中的安全隐患，从而提高汽车信息的安全性。
实施例八
进一步的，作为对上述图11所示方法的实现，本发明实施例提供了另一种汽车安全等级的确定装置，如图15所示，该装置包括：第一获取单元81、解析单元82、匹配单元83、确定单元84、第二获取单元85、检测单元86、输出单元87。
第一获取单元81，用于获取根据汽车的汽车信息进行安全测试得到的安全测试结果，所述安全测试结果包括不同功能的汽车部件通过不同测试方式进行测试得到的结果；
解析单元82，用于根据所述安全测试结果解析汽车安全的测试类型；
匹配单元83，用于将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级；
确定单元84，用于若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。
具体地，所述解析单元82包括：
第一解析模块8201，用于根据所述理论安全分析测试类型及所述安全测试结果判断所述测试类型是否属于安全威胁和风险分析、安全设计分析、安全发展分析、安全部署及流程分析中的一种；
第二解析模块8202，用于根据所述实际安全测试类型及所述安全测试结果判断所述测试类型是否属于功能安全测试、漏洞扫描、系统模糊测试、渗透测试中的一种。
具体地，所述匹配单元43包括：
第一获取模块8301，用于当所述测试类型为安全威胁和风险评估，则获取存在于汽车中的潜在攻击对象；
第一匹配模块8302，用于根据所述攻击对象操作的攻击场景、攻击路径，将所述安全测试结果与预设的安全威胁和风险评估等级进行匹配。
第二获取模块8303，用于当所述测试类型为安全部署及流程分析，则 获取存在于汽车中的软件、硬件运行情况；
第二匹配模块8304，用于根据所述软件、硬件运行情况的变化，将所述安全测试结果与预设的安全部署及流程分析等级进行匹配。
第三获取模块8305，用于当所述测试类型为系统模糊测试，则获取存在于汽车中通过通信系统模糊分析得到的目标安全栈、外部接口；
第三匹配模块8306，用于根据所述目标安全栈及所述外部接口对应的通信协议，将所述安全测试结果与预设的系统模糊测试等级进行匹配。
进一步地，所述装置还包括：
第二获取单元85，用于通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息；第二获取单元85为另一种汽车安全等级的确定装置执行通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息的功能模块。
检测单元86，用于根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态；检测单元86为另一种汽车安全等级的确定装置执行根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态的功能模块。
输出单元87，用于根据检测结果，输出所述汽车的安全测试结果。输出单元87为另一种汽车安全等级的确定装置执行根据检测结果，输出所述汽车的安全测试结果的功能模块。
本发明提供了另一种汽车安全等级的确定装置，本发明实施例通过获取汽车的安全测试结果，确定与测试结果对应的测试类型，将测试类型具体划分为安全威胁和风险分析、安全设计分析、安全发展分析、安全部署及流程分析中的一种，然后根据具体的测试类型将测试结果与预设的不同测试类型对应的等级进行匹配，若匹配成功，则将匹配的等级做为汽车的安全测试等级，实现了对汽车安全测试结果进行等级的评估，有效的识别汽车安全风险并减少汽车事故，用户的生命的安全可以得到有效的防护和保护，从而提高汽车信息的安全性。
图16示出了可以实现根据本发明的汽车安全等级的确定方法的计算机(下述将计算机统称为设备)。该设备传统上包括处理器2010和以存储器2020形式的计算机程序产品或者计算机可读介质。存储器2020可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器2020具有用于执行上述方法中的任何方法步骤的程序代码1031的存储空间2030。例如，用于程序代码的存储空间2030可以包括分别用于实现上面的方法中的各种步骤的各个程序代码2031。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如参考图17所述的便携式或者固定存储单元。该存储单元可以具有与图16中的存储器2020类似布置的存储段或者存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括用于执行根据本发明的方法步骤的程序代码2031’，即可以由例如诸如2010之类的处理器读取的代码，这些代码当由设备运行时，导致该设备执行上面所描述的方法中的各个步骤。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。可以理解的是，上述方法及装置中的相关特征可以相互参考。另外，上述实施例中的“第一”、“第二”等是用于区分各实施例，而并不代表各实施例的优劣。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在此提供的算法和显示不与任何特定计算机、虚拟系统或者其它设备固有相关。各种通用系统也可以与基于在此的示教一起使用。根据上面的描述，构造这类系统所要求的结构是显而易见的。此外，本发明也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本发明的内容，并且上面对特定语言所做的描述是为了披露本发明的最佳实施方式。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解， 本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的汽车信息的安全测试方法及装置中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序 产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。

Claims (34)

  1. 一种汽车信息的安全测试方法，包括：
    通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息；
    根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态；
    根据检测结果，输出所述汽车的安全测试结果。
  2. 根据权利要求1所述的方法，其特征在于，所述通过汽车的控制局域网络获取汽车信息包括：
    通过汽车的控制局域网络访问由具有智能控制功能的汽车部件、具有拓展功能的汽车部件、具有常用功能的汽车部件、具有附加功能的汽车部件所产生的历史数据信息；
    按照预设时间间隔提取所述历史数据信息，得到汽车信息。
  3. 根据权利要求1所述的方法，其特征在于，所述根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态包括：
    按照根据预设的异常对应关系及所述汽车信息确定的测试方式，对所述汽车的安全状态进行测试，所述测试包括理论安全分析测试、实际安全测试。
  4. 根据权利要求3所述的方法，其特征在于，所述根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态之前，所述方法还包括：
    解析所述汽车信息对应的测试类型，所述测试类型包括车载终端类型、车载网络类型、车载应用类型、车载业务类型。
  5. 根据权利要求4所述的方法，其特征在于，所述解析所述汽车信息对应的测试类型之前，所述方法还包括：
    为不同的测试类型配置不同的测试方式，所述测试方式包括功能测试方式、漏洞扫描方式、模糊测试方式、渗透测试方式。
  6. 根据权利要求5所述的方法，其特征在于，所述根据检测结果，输出 所述汽车的安全测试结果包括：
    若按照功能测试方式进行检测，输出所述汽车的安全检测结果包括性能测试结果、正确性测试结果、鲁棒性测试结果、合规测试结果；
    若按照漏洞扫描方式进行检测，输出所述汽车的安全检测结果包括接口测试结果、配置测试结果、漏洞测试结果、恶意软件测试结果；
    若按照模糊测试方式进行检测，输出所述汽车的安全检测结果包括黑盒测试结果、灰盒测试结果、白盒测试结果、功能测试结果；
    若按照渗透测试方式进行检测，输出所述汽车的安全检测结果包括硬件测试结果、软件测试结果、网络测试结果、平台测试结果。
  7. 根据权利要求1-6任一项所述的方法，其特征在于，所述通过汽车的控制局域网络获取汽车信息之前，所述方法还包括：
    当接收到安全测试指令时，通过预设安全协议访问汽车系统中各个部件的历史数据信息，所述预设安全协议用于指示所述各个部件开放历史数据信息。
  8. 根据权利要求7所述的方法，其特征在于，所述根据检测结果，输出所述汽车的安全测试结果之后，所述方法还包括：
    根据所述安全测试结果解析汽车安全的评估类型；
    将所述安全测试结果及所述评估类型与预设的汽车安全等级进行匹配，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级；
    若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。
  9. 一种汽车信息的安全测试装置，包括：
    至少一个处理器；
    以及，至少一个存储器，其与所述至少一个处理器可通信地连接；所述至少一个存储器包括处理器可执行的指令，当所述处理器可执行的指令由所述至少一个处理器执行时，致使所述装置执行至少以下操作：
    通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息；
    根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态；
    根据检测结果，输出所述汽车的安全测试结果。
  10. 根据权利要求9所述的装置，其特征在于，所述通过汽车的控制局域网络获取汽车信息的操作包括：
    通过汽车的控制局域网络访问由具有智能控制功能的汽车部件、具有拓展功能的汽车部件、具有常用功能的汽车部件、具有附加功能的汽车部件所产生的历史数据信息；
    按照预设时间间隔提取所述历史数据信息，得到汽车信息。
  11. 根据权利要求9所述的装置，其特征在于，
    所述根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，的操作包括：按照根据预设的异常对应关系及所述汽车信息确定的测试方式，对所述汽车的安全状态进行测试，所述测试包括理论安全分析测试、实际安全测试。
  12. 根据权利要求11所述的装置，其特征在于，所述操作还包括：
    解析所述汽车信息对应的测试类型，所述测试类型包括车载终端类型、车载网络类型、车载应用类型、车载业务类型。
  13. 根据权利要求12所述的装置，其特征在于，所述操作还包括：
    为不同的测试类型配置不同的测试方式，所述测试方式包括功能测试方式、漏洞扫描方式、模糊测试方式、渗透测试方式。
  14. 根据权利要求13所述的装置，其特征在于，所述根据检测结果，输出所述汽车的安全测试结果的操作包括：
    若按照功能测试方式进行检测，输出所述汽车的安全检测结果包括性能测试结果、正确性测试结果、鲁棒性测试结果、合规测试结果；
    若按照漏洞扫描方式进行检测，输出所述汽车的安全检测结果包括接口测试结果、配置测试结果、漏洞测试结果、恶意软件测试结果；
    若按照模糊测试方式进行检测，输出所述汽车的安全检测结果包括黑盒测试结果、灰盒测试结果、白盒测试结果、功能测试结果；
    若按照渗透测试方式进行检测，输出所述汽车的安全检测结果包括硬件测试结果、软件测试结果、网络测试结果、平台测试结果。
  15. 根据权利要求9-14任一项所述的装置，其特征在于，所述操作还包括：
    当接收到安全测试指令时，通过预设安全协议访问汽车系统中各个部件的历史数据信息，所述预设安全协议用于指示所述各个部件开放历史数据信息。
  16. 根据权利要求15所述的装置，其特征在于，所述操作还包括：
    根据所述安全测试结果解析汽车安全的评估类型；
    将所述安全测试结果及所述评估类型与预设的汽车安全等级进行匹配，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级；
    若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。
  17. 一种计算机程序，包括计算机可读代码，当计算机可读代码被运行时，导致权利要求1-8中的任一项权利要求所述的方法被执行。
  18. 一种计算机可读介质，其中存储了如权利要求17所述的计算机程序。
  19. 一种汽车安全等级的确定方法，包括：
    获取根据汽车的汽车信息进行安全测试得到的安全测试结果，所述安全测试结果包括不同功能的汽车部件通过不同测试方式进行测试得到的结果；
    根据所述安全测试结果解析汽车安全的测试类型；
    将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级；
    若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。
  20. 根据权利要求19所述的方法，其特征在于，所述汽车安全的测试类 型包括理论安全分析测试类型、实际安全测试类型。
  21. 根据权利要求20所述的方法，其特征在于，所述根据所述安全测试结果解析汽车安全的测试类型包括：
    根据所述理论安全分析测试类型及所述安全测试结果判断所述测试类型是否属于安全威胁和风险分析、安全设计分析、安全发展分析、安全部署及流程分析中的一种；或
    根据所述实际安全测试类型及所述安全测试结果判断所述测试类型是否属于功能安全测试、漏洞扫描、系统模糊测试、渗透测试中的一种。
  22. 根据权利要求21所述的方法，其特征在于，所述将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配包括：
    当所述测试类型为安全威胁和风险评估，则获取存在于汽车中的潜在攻击对象；
    根据所述攻击对象操作的攻击场景、攻击路径，将所述安全测试结果与预设的安全威胁和风险评估等级进行匹配。
  23. 根据权利要求21.所述的方法，其特征在于，所述将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配包括：
    当所述测试类型为安全部署及流程分析，则获取存在于汽车中的软件、硬件运行情况；
    根据所述软件、硬件运行情况的变化，将所述安全测试结果与预设的安全部署及流程分析等级进行匹配。
  24. 根据权利要求21所述的方法，其特征在于，所述将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配包括：
    当所述测试类型为系统模糊测试，则获取存在于汽车中通过通信系统模糊分析得到的目标安全栈、外部接口；
    根据所述目标安全栈及所述外部接口对应的通信协议，将所述安全测试结果与预设的系统模糊测试等级进行匹配。
  25. 根据权利要求19-24任一项所述的方法，其特征在于，所述获取根据汽车的汽车信息进行安全测试得到的安全测试结果之前，所述方法还包括：
    通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息；
    根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态；
    根据检测结果，输出所述汽车的安全测试结果。
  26. 一种汽车安全等级的确定装置，其特征在于，包括：
    至少一个处理器；
    以及，至少一个存储器，其与所述至少一个处理器可通信地连接；所述至少一个存储器包括处理器可执行的指令，当所述处理器可执行的指令由所述至少一个处理器执行时，致使所述装置执行至少以下操作：
    获取根据汽车的汽车信息进行安全测试得到的安全测试结果，所述安全测试结果包括不同功能的汽车部件通过不同测试方式进行测试得到的结果；
    根据所述安全测试结果解析汽车安全的测试类型；
    将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配，所述预设的汽车安全等级为根据不同安全测试结果及不同测试类型配置的安全等级；
    若匹配成功，则将匹配的汽车安全等级确定为所述汽车的安全测试等级。
  27. 根据权利要求26所述的装置，其特征在于，所述汽车安全的测试类型包括理论安全分析测试类型、实际安全测试类型。
  28. 根据权利要求27所述的装置，其特征在于，所述根据所述安全测试结果解析汽车安全的测试类型的操作包括：
    根据所述理论安全分析测试类型及所述安全测试结果判断所述测试类型是否属于安全威胁和风险分析、安全设计分析、安全发展分析、安全部署及流程分析中的一种；
    根据所述实际安全测试类型及所述安全测试结果判断所述测试类型是否属于功能安全测试、漏洞扫描、系统模糊测试、渗透测试中的一种。
  29. 根据权利要求28所述的装置，其特征在于，所述将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配的操作包括：
    当所述测试类型为安全威胁和风险评估，则获取存在于汽车中的潜在攻击对象；
    根据所述攻击对象操作的攻击场景、攻击路径，将所述安全测试结果与预设的安全威胁和风险评估等级进行匹配。
  30. 根据权利要求28所述的装置，其特征在于，所述将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配的操作包括：
    当所述测试类型为安全部署及流程分析，则获取存在于汽车中的软件、硬件运行情况；
    根据所述软件、硬件运行情况的变化，将所述安全测试结果与预设的安全部署及流程分析等级进行匹配。
  31. 根据权利要求28所述的装置，其特征在于，所述将所述安全测试结果及所述测试类型与预设的汽车安全等级进行匹配的操作包括：
    当所述测试类型为系统模糊测试，则获取存在于汽车中通过通信系统模糊分析得到的目标安全栈、外部接口；；
    根据所述目标安全栈及所述外部接口对应的通信协议，将所述安全测试结果与预设的系统模糊测试等级进行匹配。
  32. 根据权利要求26-31任一项所述的装置，其特征在于，所述操作还包括：
    通过汽车的控制局域网络获取汽车信息，所述汽车信息包括汽车中各个部件在汽车系统运行中产生的数据信息；
    根据预设的异常情况对应关系及所述汽车信息，检测所述汽车的安全状态，所述预设异常情况对应关系存储有汽车中各个部件处于不同情况的汽车信息对应的安全状态；
    根据检测结果，输出所述汽车的安全测试结果。
  33. 一种计算机程序，包括计算机可读代码，当计算机可读代码被运行时，导致权利要求19-25中的任一项权利要求所述的方法被执行。
  34. 一种计算机可读介质，其中存储了如权利要求33所述的计算机程序。
PCT/CN2017/120282 2017-02-20 2017-12-29 汽车信息的安全测试方法及装置 WO2018149245A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201710090247.0A CN106886211B (zh) 2017-02-20 2017-02-20 汽车安全测试等级的确定方法及装置
CN201710090247.0 2017-02-20
CN201710089979.8A CN106828362B (zh) 2017-02-20 2017-02-20 汽车信息的安全测试方法及装置
CN201710089979.8 2017-02-20

Publications (1)

Publication Number Publication Date
WO2018149245A1 true WO2018149245A1 (zh) 2018-08-23

Family

ID=63169662

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/120282 WO2018149245A1 (zh) 2017-02-20 2017-12-29 汽车信息的安全测试方法及装置

Country Status (1)

Country Link
WO (1) WO2018149245A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103248691A (zh) * 2013-04-28 2013-08-14 苏州洁祥电子有限公司 车联网系统及其数据备份方法
CN104133469A (zh) * 2014-08-08 2014-11-05 奇瑞汽车股份有限公司 车辆数据采集处理系统及方法
CN105657029A (zh) * 2016-01-28 2016-06-08 北京交通大学 一种面向车联网应用的车载状态信息采集与传输系统
CN105989640A (zh) * 2015-03-05 2016-10-05 北京智视信息科技有限公司 车联网终端设备及其操作方法
CN106828362A (zh) * 2017-02-20 2017-06-13 北京奇虎科技有限公司 汽车信息的安全测试方法及装置
CN106886211A (zh) * 2017-02-20 2017-06-23 北京奇虎科技有限公司 汽车安全测试等级的确定方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103248691A (zh) * 2013-04-28 2013-08-14 苏州洁祥电子有限公司 车联网系统及其数据备份方法
CN104133469A (zh) * 2014-08-08 2014-11-05 奇瑞汽车股份有限公司 车辆数据采集处理系统及方法
CN105989640A (zh) * 2015-03-05 2016-10-05 北京智视信息科技有限公司 车联网终端设备及其操作方法
CN105657029A (zh) * 2016-01-28 2016-06-08 北京交通大学 一种面向车联网应用的车载状态信息采集与传输系统
CN106828362A (zh) * 2017-02-20 2017-06-13 北京奇虎科技有限公司 汽车信息的安全测试方法及装置
CN106886211A (zh) * 2017-02-20 2017-06-23 北京奇虎科技有限公司 汽车安全测试等级的确定方法及装置

Similar Documents

Publication Publication Date Title
CN106828362B (zh) 汽车信息的安全测试方法及装置
JP7241791B2 (ja) 攻撃を防御するための方法、装置、機器および記憶媒体
Kong et al. Security risk assessment framework for smart car using the attack tree analysis
Dürrwang et al. Enhancement of automotive penetration testing with threat analyses results
Cheah et al. Building an automotive security assurance case using systematic security evaluations
Bayer et al. Security crash test-practical security evaluations of automotive onboard it components
CN110929264B (zh) 漏洞检测方法、装置、电子设备及可读存储介质
CN102468985A (zh) 针对网络安全设备进行渗透测试的方法和系统
CN111770069B (zh) 一种基于入侵攻击的车载网络仿真数据集生成方法
Bayer et al. Automotive security testing—the digital crash test
Strandberg et al. Securing the connected car: A security-enhancement methodology
EP3857846A1 (en) Electronic controller security system
Huq et al. Driving security into connected cars: threat model and recommendations
CN109818972B (zh) 一种工业控制系统信息安全管理方法、装置及电子设备
Luo et al. Research on cybersecurity testing for in-vehicle network
CN113901475A (zh) 一种针对工控终端设备的输入验证漏洞的模糊挖掘方法
Kadhirvelan et al. Threat modelling and risk assessment within vehicular systems
CN112019512B (zh) 汽车网络安全测试系统
CN117254945A (zh) 基于汽车攻击链路的漏洞溯源方法及装置
CN113114659A (zh) 诊断设备检测方法、装置、终端设备及存储介质
Jadidbonab et al. A realtime in-vehicle network testbed for machine learning-based ids training and validation
CN115563618A (zh) 一种基于中央计算平台的渗透测试方法及装置
WO2018149245A1 (zh) 汽车信息的安全测试方法及装置
CN111800427B (zh) 一种物联网设备评估方法、装置及系统
CN109714371B (zh) 一种工控网络安全检测系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17896359

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17896359

Country of ref document: EP

Kind code of ref document: A1