WO2020013354A1

WO2020013354A1 - Method for operating in-vehicle firewall

Info

Publication number: WO2020013354A1
Application number: PCT/KR2018/007791
Authority: WO
Inventors: 나상혁; 김건우; 강병훈
Original assignee: 엘지전자 주식회사; 한국과학기술원
Priority date: 2018-07-10
Filing date: 2018-07-10
Publication date: 2020-01-16

Abstract

The present invention relates to a method for operating an in-vehicle firewall, the method comprising the steps of: hooking, by a first firewall, at least one piece of data which is transmitted via at least one program used by an electronic system provided in a vehicle before the data reaches a second firewall; and applying, by the first firewall, a predetermined ruleset to the data to determine whether the data is attacked by hacking.

Description

How a car firewall works

The present invention relates to a method of operating a vehicle firewall.

Various programs used in various electric field systems provided in vehicles are implemented to be connected to the Internet. This means that applications are exposed to potential security threats due to software vulnerabilities.

1 illustrates various paths through which programs of the battlefield system may be threatened from various hacking attack attempts, and security threats that may be caused by malicious code invading the battlefield system.

Hacking attacks against vehicles can pose a significant threat to the safety of occupants and pedestrians around the vehicle.

An object of the present invention is to provide a method of operating a vehicle firewall that can protect a vehicle from various hacking attacks in order to solve the above problems.

The objects of the present invention are not limited to the above-mentioned objects, and other objects that are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, the operation method of the vehicle firewall according to an embodiment of the present invention, by hooking the data transmitted by at least one program used in the battlefield system to determine whether or not a hacking attack.

Specific details of other embodiments are included in the detailed description and the drawings.

According to the present invention has one or more of the following effects.

First, it is possible to determine whether a hacking attack for all data transmitted and received from the vehicle has the effect of overcoming the threat of hacking attacks.

Second, by inspecting the plain packetized packet, different rulesets can be applied to each application, thereby improving the detection rate.

Third, there is no need to recompile more data by inspecting unencrypted data.

The effects of the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those skilled in the art from the description of the claims.

1 illustrates various paths through which applications of the battlefield system may be threatened from various hacking attack attempts, and security threats that may be caused by malicious code invading the battlefield system.

2 is a view referred to for explaining a firewall according to the prior art.

3 is a view referred to for explaining a method of operating a vehicle firewall according to an embodiment of the present invention.

4 is a diagram referred to describe a vehicle firewall according to an embodiment of the present invention.

5 is a diagram referred to for describing the TCP / IP layer.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings, and the same or similar components are denoted by the same reference numerals regardless of the reference numerals, and redundant description thereof will be omitted. The suffixes "module" and "unit" for components used in the following description are given or used in consideration of ease of specification, and do not have distinct meanings or roles from each other. In addition, in describing the embodiments disclosed herein, when it is determined that the detailed description of the related known technology may obscure the gist of the embodiments disclosed herein, the detailed description thereof will be omitted. In addition, the accompanying drawings are intended to facilitate understanding of the embodiments disclosed herein, but are not limited to the technical spirit disclosed in the present specification by the accompanying drawings, all changes included in the spirit and scope of the present invention. It should be understood to include equivalents and substitutes.

Terms including ordinal numbers such as first and second may be used to describe various components, but the components are not limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

Singular expressions include plural expressions unless the context clearly indicates otherwise.

In this application, the terms "comprises" or "having" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

In this specification, applications and programs may be used interchangeably. In the present specification, an application or program refers to an application program.

Referring to FIG. 1, various hacking attack patterns to which applications of the battlefield system may be exposed are as follows.

1. Exploit: Any software can be vulnerable to a developer error. These security vulnerabilities, in particular, increase in size and complexity of the software, and also increase the risk if the software processes arbitrary data that is not trusted. Potential exploit threats must be considered when applications in vehicle electronics systems access untrusted data through Internet Access. An exploit is not a detectable attack at the network level, but it allows an attacker to carry out additional attacks involving a secondary network level.

2. DNS Hijacking: DNS is one of the most important services in using the Internet, but it is relatively weak from hacking attacks. Services that use an unencrypted network can be easily exposed to hacking attacks such as phishing from DNS hijacking attacks. Even if the service performs secure communication encrypted by TLS, DNS hijacking attacks can be performed without authenticating the certificate. Additional verification at the firewall level is needed because it can be vulnerable

3. Cross Site Scripting (XSS): XSS is a potential vulnerability in Clients using HTTP services. The vulnerability could allow an attacker to intercept HTTP sessions and allow an unauthorized attacker to steal sensitive information. In the current automotive electronics system, applications (eg web browsers) that perform Client Scripting based on HTTP should be protected against XSS attacks. This can be done through enhanced security of the system itself and further inspection at the firewall level.

4. SQLi: SQL Injection attacks are usually attacks on server applications that run DataBase rather than client-side applications. However, if the battlefield system is infected with malicious code through exploit, etc., the battlefield system application becomes a zombie for executing SQL Injection, and may be exploited in the secondary attack. Considering this secondary attack possibility, it is necessary to protect against SQL Injection. In a network-based security solution such as a general web firewall, a check for SQL Injection attack is one of the essential elements.

If encrypted communication is performed through HTTPS communication, high-level semantic attacks such as DNS tampering, XSS, SQL Injection, etc., among the network level attacks, are used for packet headers such as the Snort Rule. Inspection level firewalls cannot cope.

These attacks can be countered by application firewalls (such as web firewalls). Because traditional application firewalls are designed for programs that use Internet Access for general purposes, detection rules may be more specific or specific. It is designed to use pattern matching through Regex.

In the embodiment according to the present invention, a smart firewall system that considers the application characteristics of the vehicle user, in addition to the general regular expression (Regex) -based firewall rules in consideration of the special environment of the vehicle electronic system, not protection for general-purpose applications I would like to propose.

Table 1

[Table 1] Limitations of Existing App Firewall Solution

Table 1 shows the limitations of existing firewalls. In order to generate the detection rules for the attack models assumed in the patent based on machine learning, access to accurate training data through deep packet inspection (DPI) is required.

However, at the network level, DPI introduces a high performance load, and for some protocols it is not possible due to problems such as encoding and encryption.

In addition, when encrypted communication using SSL (secure sockets layer), the external firewall not only needs to have a certificate to check the packet, but also causes a double decryption and decryption to generate a load.

In order to solve this problem, in this patent, a special module (In-Host Firewall) that operates in conjunction with an external network firewall (for example, a second firewall) inside an application by using protected programs developed exclusively for an electronic system. You want to insert additional.

The In-Host module effectively solves two problems in DPI.

First, it is more accurate and faster with the Semantic of the application based on the buffer location before the data is fragmented in the source code portion of the application that performs the network I / O, without having to reassemble the fragmented and transmitted packet at the network level. To perform the test.

This makes it easy to verify the data to be sent to the network without having to reassemble packets on the existing external firewall (eg second firewall) module.

Second, the problem of data encoding and encryption can be solved. In-Host module internal API is additionally provided for encryption / encoding related libraries such as SSL and GZip, and when the application is used in accordance with the specified specification, the plain text data before encryption / encoding at the API level is easily verified. can do.

Existing applications generally use libraries such as SSL to encrypt data and then communicate with the network, or to transmit plain text data over TCP. .

However, in the embodiment of the present invention, in order to apply the smart firewall system, when the application of the system is any kind of network communication, it must be inspected based on the given rule set through the In-Host module.

As a result, plaintext packets can be inspected over encrypted communication, and different rulesets can be applied to each application, thereby significantly improving the detection rate.

The in-host module works by hooking the application programming interface (API) used by Applicaton, so there is no need to modify or recompile the source of the original application.

In addition, a kernel module was additionally inserted to detect unauthorized networks by attack codes.

The kernel module considers each memory area to be an independent memory object, and may have separate permissions and related tasks.

Meanwhile, the special module, the In-Host Firewall, or the In-Host module of the present specification may be understood as a first firewall.

2 is a view referred to for explaining a firewall according to the prior art.

The firewall in FIG. 2 illustrates a firewall in the case of a network connection via a terminal (eg, desktop, laptop, smartphone, etc.) according to the prior art.

Referring to FIG. 2, the firewall 200 may include a transport layer (520 of FIG. 5) and an internet layer (FIG. 5) of a TCP / IP layer (Transmission Control Protocol / Internet Protocol Layer). 530), the data abnormality is checked.

The firewall 200 checks only the headers or tails of the encrypted data packets 211 and 212 by the uniform ruleset. In this case, the firewall 200 cannot check the path (eg, router, data transmission / reception application) source, contents, etc. of the data packets 211 and 212. Since the firewall 200 is limited and uniformly checks for data anomalies, the firewall 200 has limitations as shown in Table 1 above.

In order to overcome this limitation, a method of operating a firewall according to an embodiment of the present invention is proposed.

5 is a diagram referred to for describing the TCP / IP layer.

Referring to the drawings, the vehicle firewall 400 may be implemented in software. Alternatively, the vehicle firewall 400 may be implemented with hardware (for example, a processor) in which software is embedded. Processors include ASICs (application specific integrated circuits), DSPs (digital signal processors), DSPDs (digital signal processing devices), PLDs (programmable logic devices), FPGAs (field programmable gate arrays), processors (processors), controllers It may be implemented using at least one of micro-controllers, microprocessors, and electrical units for performing other functions.

Referring to FIG. 3, the method S300 of operating the vehicle firewall 400 includes hooking data (S310), determining whether a hacking attack is performed by the first firewall 401 (S320), and a second firewall 490. It may include a step of determining whether the hacking attack by (S330).

Hooking data (S310) may be performed by the first firewall 401 or the kernel module 402.

The first firewall 401 or the kernel module 402 may hook at least one data. For example, the first firewall 401 or kernel module 402 can hook data before the data is sent to the second firewall 490. For example, the first firewall 401 or kernel module 402 can hook unencrypted data. For example, the first firewall 401 or kernel module 402 may hook a demultiplexed packet. In this case, the step of hooking (S310) may include hooking a demultiplexed packet.

The at least one data hooked may be

data

411 and 421 transmitted by the at least one

application

410 or 420 used in the electronic system provided in the vehicle to a device outside the vehicle in the electronic system of the vehicle. .

The at least one

hooked data

411 and 421 may be data received by a device outside the vehicle from the device outside the vehicle to the battlefield system of the vehicle. In this case, the step of hooking (S310) may include receiving encrypted data from an external device, decrypting the received data, and hooking a formatted packet of the decrypted data.

The hooking step S310 may be hooked through a system call related to a network socket. The first firewall 401 or the kernel module 402 may hook a system call by a send function in user space.

Network sockets may be defined as endpoints of interprocess communication via a computer network. The system call may be defined as an interface for accessing a kernel module at the request of an application for a service provided by the kernel module 402.

As described above, the hooking step S310 may be performed through the kernel module 402.

Determining whether or not the hacking attack on the data (S320) may be performed by the first firewall 401.

The first firewall 401 may determine whether a hacking attack on the hooked data is applied by applying a preset ruleset.

The determining step S320 may include applying the ruleset to the

demultiplexed packets

411 and 421.

Meanwhile, the kernel module 402 may provide data and information of an application associated with the data together. The information of the application may include at least one of a right of the application (eg, a right of reading a specific memory space, a writing right, a right to execute), a name of the application, and a path of the application.

The ruleset may be set based on a protocol applied to the

deserialized packets

411 and 421. In this case, the applying step may include examining data based on whether the formatted packet is in violation of the protocol. For example, the first firewall 401 may determine whether the first plain culture packet 411 is in violation of the first protocol applied to the first plain culture packet 411. It is possible to determine whether or not a hacking attack against the 411). For example, the first firewall 402 may determine whether the second plain culture packet 421 is in violation of the second protocol applied to the second plain culture packet 421. It may be determined whether a hacking attack is performed on the 421. As such, the first firewall 401 may determine whether a hacking attack is applied by applying individual rulesets according to individual data.

The protocol may be at least one of doIP, someIP, doIP-sd, someIP-sd, http, dns, ftp, https, tls, and ssl.

The ruleset may be set based on the application information. In this case, the applying may include checking the data based on the authority information of the application corresponding to the decoded packet. For example, based on whether the first data 411 includes operation information that violates the authority of the first application 410 corresponding to the first data 411, the first firewall 401 may further include the first firewall 401. 1 may determine whether a hacking attack on the data (411). For example, the first firewall 401 may be configured based on whether the second data 421 includes operation information that violates the winding of the second application 420 corresponding to the second data 421. 2 may determine whether a hacking attack on the data (421).

The first data 411 may be data transmitted from the inside of the vehicle to the outside of the vehicle or received from the outside of the vehicle by the first application 410. The second data 421 may be data transmitted from the inside of the vehicle to the outside of the vehicle or received from the outside of the vehicle by the second application 420.

In the determining step S320, the application layer (510 of FIG. 5) of the TCP / IP layer may determine whether a hacking attack is performed. The first firewall 401 may determine whether the attack is a hacking attack based on the protocol or the authorization information of the application, thereby determining whether the hacking attack is performed in the application layer 510. By determining the hacking attack at the application layer, the detection rate accuracy of the hacking attack is improved.

In the determining step S320, the hacking attack may be determined based on the unencrypted data. By determining whether the first firewall 401 is a hacking attack on the plain packetized packet, the first firewall 401 may determine whether the hacking attack is on the unencrypted data.

The method S300 of operating a vehicle firewall may further include bypassing data to the second firewall when it is determined that the hacking attack has not occurred in the determining operation S320.

In operation S300 of the vehicle firewall, the second firewall 490 may determine whether the hacking attack is performed on the data in at least one of the transport layer and the Internet layer of the TCP / IP layer (S330). It may further include.

In operation S330 of determining whether the second firewall 490 is a hacking attack, the second firewall 490 may determine whether the second firewall 490 is a hacking attack.

Referring to FIG. 4, the vehicle firewall 400 may include a first firewall 401, a second firewall 490, and a kernel module 402.

According to an embodiment, the kernel module 402 may be classified into a subcomponent of the first firewall 401 or a component separate from the first firewall 401.

The first firewall 401 may be implemented in software. The first firewall 401 may be implemented in hardware. For example, the first firewall 401 may be installed in the processor. In this case, the processor may perform an operation of the first firewall 401. For example, the processor may perform the above-described hooking step S310 and the determining step S320.

The second firewall 490 may be implemented in software. The second firewall 490 may be implemented in hardware. For example, the second firewall 490 may be installed in the processor. In this case, the processor may perform an operation of the second firewall 490. For example, the processor may perform the above-described determination step (S330).

The kernel module 402 may be implemented as a memory. Here, the memory may mean random access memory (RAM).

The

applications

410 and 420 may be installed in a read only memory (ROM) and loaded into RAM according to management of the kernel module 402. In this case, the kernel module 402 may obtain and provide application information.

The present invention described above can be embodied as computer readable codes on a medium in which a program is recorded. The computer-readable medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable media include hard disk drives (HDDs), solid state disks (SSDs), silicon disk drives (SDDs), ROMs, RAMs, CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, and the like. This also includes implementations in the form of carrier waves (eg, transmission over the Internet). The computer may also include a processor or a controller. Accordingly, the above detailed description should not be construed as limiting in all aspects and should be considered as illustrative. The scope of the present invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

[Description of the code]

400: car firewall

Claims

Hooking at least one data transmitted or received by at least one application used in an electronic system provided in a vehicle; And

And determining a hacking attack on the data by applying a preset ruleset.
The method of claim 1,

The hooking step,

A method of operating a vehicle firewall that hooks through a system call related to a network socket.
The method of claim 1,

The hooking step,

Method of operation of a vehicle firewall made through a kernel module (kernel module).
The method of claim 1,

The hooking step,

Hooking the deserialized packet,

The determining step,

And applying said ruleset to said plaintext packet.
The method of claim 4, wherein

The applying step,

Examining the data based on whether the formatted packet violates the protocol.
The method of claim 4, wherein

The applying step,

And examining the data based on authorization information of an application corresponding to the plain packet.
The method of claim 1,

The determining step,

A method of operating a vehicle firewall that determines whether a hacking attack is performed at the application layer of the TCP / IP layer (Transmission Control Protocol / Internet Protocol Layer).
The method of claim 1,

The determining step,

A method of operating a vehicle firewall that determines whether a hacking attack is based on unencrypted data.
The method of claim 1,

If it is determined that a hacking attack has not occurred, bypassing the data to the second firewall.
The method of claim 9,

And determining, by the second firewall, whether or not a hacking attack is performed on the data in at least one of a transport layer and an internet layer of the TCP / IP layer.
The method of claim 10,

The determining by the second firewall,

A method of operating a vehicle firewall that determines whether a hacking attack is based on encrypted data.
The method of claim 1,

The hooking step,

Receiving encrypted data from an external device, and decrypting the received data; And

Hooking the plain text packet of the decrypted data.