WO2020099291A1

WO2020099291A1 - Device for securing a real-time ethernet data network for a motor vehicle

Info

Publication number: WO2020099291A1
Application number: PCT/EP2019/080803
Authority: WO
Inventors: Helge ZINNER; Daniel HOPF
Original assignee: Continental Automotive Gmbh
Priority date: 2018-11-12
Filing date: 2019-11-11
Publication date: 2020-05-22
Also published as: DE102018219262A1

Abstract

The present invention relates to a device for securing a real-time Ethernet data network for a motor vehicle, the device (1) comprising: a database device (10) which is designed to store adjustable network configurations and adjustable security settings for the real-time Ethernet data network and also to store at least one currently used network configuration and at least one currently used security setting for the real-time Ethernet data network; and comprising a control device (20) which is designed to be coupled between an antenna module of the real-time Ethernet data network and a controller of the motor vehicle and which is further designed to compare currently transmitted data traffic between the antenna module and the controller of the motor vehicle with expected data traffic based on a data traffic estimate using the stored currently used network configuration and the stored currently used security setting and to store a result of the comparison.

Description

Device for securing a real-time Ethernet data network for a motor vehicle

The present invention relates to systems for real-time Ethernet data networks.

In particular, the present invention relates to a

Device for securing a real-time Ethernet data network for a motor vehicle.

DE 10 2014 220 462 A1 describes a device and a method for monitoring network communication of a data network for a motor vehicle, the communication being central or distributed in the data networks of the

Motor vehicle is monitored, analyzed and logged.

WO 2015/161870 A1 describes an apparatus and a method for filtering data packets in one

Communication network.

Techniques are being found for the first time based on the physical layer Ethernet and the Internet protocol above it

Entry into the vehicle electrical system, which are also widespread outside the vehicle.

This also offers a higher potential

Attack risk that has not existed to date with the automotive-specific electrical systems such as CAN (Controller Area Network) and FlexRay.

Especially with regard to the increasing use of the protocols Ethernet and the Internet Protocol, IP, a network protocol widely used in computer networks, Security mechanisms are becoming increasingly important, so that the car is already identified as a new point of attack.

Therefore there are new security mechanisms and functions

necessary to make the car more secure from attacks.

The term "new" in relation to security mechanisms and functions includes other requirements such as

Temperature, update ability, transportation of people,

reduced computing power.

The object of the invention results from the definition of mechanisms and protocols in order to make the vehicle network safer and more efficient. Ethernet and radio technologies are currently only finding their way into the automobile and, thanks to their open and standardized protocols, they offer the possibilities of the car from the outside for the first time

to attack.

It is an object of the present invention

to provide an improved device for securing input-side and output-side data traffic of a real-time Ethernet data network for a motor vehicle.

This object is solved by the subject matter of the independent claims. Further developments and embodiments can be found in the dependent claims, the description and the figures in the drawings.

A first aspect of the present invention relates to a device for securing a real-time Ethernet data network for a motor vehicle, the device

comprising: a database device which is designed to set adjustable network configurations and adjustable Save security settings for the real-time Ethernet data network and store at least one currently used network configuration and at least one currently used security setting for the real-time Ethernet data network; and a control device which is designed to be coupled between an antenna module of the real-time Ethernet data network and a control device of the motor vehicle, and which is further designed to base the currently transmitted data traffic between the antenna module and the control device of the motor vehicle with expected data traffic on a

Traffic estimation using the saved currently used network configuration and the

compare the currently used security setting and save a comparison result.

In other words, the present invention provides a technical system in a vehicle, which allows each input and

Check and filter outgoing data traffic (e.g. coming / going to / from the antenna module) in order to detect attacks and prevent them effectively. The antenna module can also be designed as a connectivity unit.

The device can also be designed to first calculate which network configuration and

Security settings are necessary in each case.

In other words, the present invention includes a system design around a control unit

to design, which has the task of warding off attacks and the vehicle network in a secure Maintain condition or in a safe condition

convict.

This control unit, hereinafter also "Filter ECU" - Abbreviation for English "Electronic Control Unit"

Control device or a microcontroller - called, uses, for example, dynamically changeable databases.

The databases can include data in the form of a communication matrix and a security configuration, for example, in order to query and save the current status of the network configuration with regard to data transmission and security mechanisms. The databases can

For example, be trained to be changed dynamically and / or to be individually rewritten in the case of new data traffic.

These databases can also be part of the ECU filter

will be realized. This is not necessarily implemented in a new ECU, but can also be done with the

proposed components and functions can optionally also be mapped in an existing ECU.

The present invention advantageously makes it possible to implement security for real-time Ethernet.

The essence of the invention is that, on the one hand, the security of the vehicle network is increased at almost the same cost and, on the other hand, redundancy for security mechanisms is created.

With the advent of ethernet among other things Mechanisms necessary that take advantage of simple techniques and given properties of technologies in order to be able to do without expensive implementations and additional hardware.

The present invention enables, by means of an individual design of filter rules, for example up to a length of 128 bytes, that very large packet headers can also be analyzed. The present invention therefore allows the firewall to be secured with a high data load and in the event of an error. The present invention enables an individual design of

Filter rules, for example up to a length of 128 bytes, which, for example, can also analyze very large headers.

If there is an error on a CAN or LIN bus, these are

Controllers are always able to cope with the flood of packets, even when the bus systems are fully utilized. Older bus systems only support slower data rates relative to new bus systems. However, Ethernet can achieve data rates which, as described, can overload conventional automotive controllers very quickly, which would mean a "denial of service", i.e. the controller can no longer calculate its original task because it accepts and

Processing too much data is busy.

The present invention advantageously enables that even with connections using LTE, 100Mbit / s Ethernet, or even 1000Mbit / s, 2.5Gbit / s, 5Gbit / s, 10Gbit / s Ethernet or by means of wired or wireless data networks

Protection of data traffic in the vehicle network can take place. The control device, which is designed for this purpose

for example between an antenna module of the real-time Ethernet data network and a control unit of the

To be coupled motor vehicle has in one

Embodiment of the present invention via hardware support in the form of an integrated

Circuit or a microcontroller.

For example, more than one antenna module can be provided on one side and, for example, more than one control unit (ECU) on the other side.

The control device is designed to analyze and manipulate Ethernet data streams in real time.

This advantageously makes it possible to offer so-called “security services” and “secure services”, such as very regular updates, for example in the minute range.

The terms "security services" and "secure services" stand for a large number of software modules which serve to maintain the operational readiness of a vehicle network for the desired purpose, to ensure or restrict the availability of data and to secure access rights to the system of the motor vehicle.

The terms "secure service" and "security service" as used by the present invention can be defined as follows.

Under the term "security service" the following can

be understood: A service that provides data protection or increased, for example virus scanner, firewall, intrusion detection system, IDS.

The term "secure service" can be understood to mean the following: Any service (expressly NOT on

Security limited), which thanks to appropriate measures

(Encryption, virus checking, etc. by means of the security services) is confidential, integrity and authenticated, for example a live map update, calling up

Web services, online banking.

The control device is designed, for example, to carry out earlier detection of attacks and misconduct.

Due to the multiple integration of the security functions in the vehicle electrical system, an attack / error can be detected even before the actual firewall and much faster

Countermeasures are initiated. The control device is suitable, for example, for recognizing and reporting errors.

The control device is designed, for example, to make the device conspicuous and undesirable

Detects data traffic in the network, isolates the vehicle network from it and weakens the data traffic or completely

prevents. The conspicuous data traffic could also be attacks or malfunctions against the

Act vehicle network.

The control device is designed, for example, to use the standard IEEE 802.1Qci-2017. Furthermore, the Control device among others as time sensitive

Networking, TSN, designated standards work.

The control device is designed, for example, to set and check the filters in safety-critical applications such as OTA software update (OTA: Over-the-Air). For this purpose, it should be checked beforehand (DB or by protocol) whether a critical application has been started. This can be OTA or a special recipient, sender, a high data rate, etc., specially adapted to the respective requirements of the update or and the possibilities of the vehicle electrical system.

The control device is designed, for example, to be constantly active, i.e. if an online connection to and / or from the motor vehicle - from the vehicle network - is required or is active and then monitors the

Traffic. Should an attack occur, such as a detected anomaly in the data traffic, this can be immediate

Trigger countermeasures.

The present invention advantageously enables the system consisting of combined computer hardware and software specially optimized for this hardware - also called an appliance - not to rely on signatures, but instead to work with the help of already identified attack patterns and

Conduct behavioral analysis.

Advantageous refinements of the present invention can be found in the subclaims.

In an advantageous embodiment of the present

The invention provides that the control device does this is designed to interrupt and / or adapt and / or maintain and / or continue the data traffic between the antenna module and the control unit of the motor vehicle based on the comparison result.

In an advantageous embodiment of the present invention, it is provided that the control device is designed to display the comparison result of the current

transmitted data traffic with the expected

Detect traffic based on attack patterns and / or behavioral analysis to identify an anomaly of the

Capture traffic.

In an advantageous embodiment of the present invention, it is provided that the database device is designed as a data filter module.

In an advantageous embodiment of the present invention, it is provided that the control device is designed to transmit the comparison result.

In an advantageous embodiment of the present invention it is provided that the control device is designed to handle data traffic with predictable and

Analyze guaranteed end-to-end latencies.

The embodiments and further developments described can be combined with one another as desired.

Further possible configurations, further training and

Implementations of the present invention also include combinations not explicitly mentioned of those described above or below with regard to the embodiments Features of the present invention.

The accompanying drawings are intended to provide further understanding of the embodiments of the present invention.

The accompanying drawings illustrate

Embodiments and serve in connection with the

Description of the explanation of concepts of the present invention.

Other embodiments and many of the advantages mentioned arise with regard to the figures of the drawings. The elements shown in the figures of the drawings are not necessarily shown to scale with respect to one another.

Show it:

Fig. 1: a schematic representation of a device for

Securing a real-time Ethernet data network for a motor vehicle according to one

Embodiment of the present invention;

Fig. 2: a schematic representation of a general

Operation and embedding of the filter ECU according to an embodiment of the present invention;

Fig. 3: a schematic representation of

application-specific filter rules according to an embodiment of the present invention;

Fig. 4 is a schematic representation of an optional

previous query and check of the ECU Capacities and setting of the filters according to an embodiment of the present invention;

Fig. 5: a schematic representation of a

Application-specific filter control setting according to an embodiment of the present invention;

Fig. 6: a schematic representation of a

Application launches and an exam of setting the

Filter rules according to an embodiment of the present invention;

7 shows a schematic illustration of an anomaly detection and adaptation of the filter settings according to an exemplary embodiment of the present invention;

Fig. 8: a schematic representation of a

Application example with an embodiment of the present invention;

9: a schematic representation of a hedge and

Configuration of the filters before an OTA function according to an embodiment of the present invention;

Fig. 10: a schematic representation of the filter rules on

Example of the Qci standard according to one

Embodiment of the present invention; and

11 is a schematic representation of the structure of the

Filter ECU and its main components and Control variables according to an embodiment of the present invention.

In the figures of the drawings designate the same

Identical or functionally identical elements,

Components, components or process steps, unless otherwise stated.

Fig. 1 shows a schematic representation of a

Device for securing a real-time Ethernet data network for a motor vehicle according to a

Embodiment of the present invention.

FIG. 2 shows a schematic illustration of a general functioning and embedding of the filter ECU according to an exemplary embodiment of the present invention.

Fig. 3 shows a schematic representation of

application-specific filter rules according to a

Embodiment of the present invention.

The following examples of filter rules are possible, whereby further filters, rules, key figures can also be used.

A restriction to a maximum of 1 packet / second or to a maximum packet size of 20 bytes.

A limitation to a maximum of 8000 packets / second or to a maximum packet size of 1400 bytes. Defined IP sender address for the purpose of

Time synchronization.

Fig. 4 shows a schematic representation of a

previous query and checking the ECU capacities and setting the filter according to an embodiment of the present invention.

This function creates an up-to-date database as required or includes an essential system query. Depending on the capacity, the rules are adjusted so that the ECU can be relieved or can still accommodate this newly arriving data.

Fig. 5 shows a schematic representation of a

application-specific filter regulation according to a

Embodiment of the present invention.

Fig. 5 shows a schematic representation of an 1: n, i.e. "One to many" relationship. Any number of applications and thus distinguishable data streams can exist on an ECU

Communication profiles checked.

Fig. 6 shows a schematic representation of a

Application launch and an examination of the setting of the

Filter rules according to an embodiment of the present invention. 7 shows a schematic illustration of an anomaly detection and adaptation of the filter settings according to an exemplary embodiment of the present invention.

The test of the external communication can be repeated until a

Connectivity exists.

In other words, the "connectivity" is quasi-continuous and the check for data stream patterns, i.e. whether prescribed characteristics of the data stream

are consistently adhered to and do not deviate from the defined target value, is ideally done continuously for each individual data packet. It can therefore be provided, for example, that the data stream has already been active for one

predetermined period of time, e.g. for up to 2 minutes, and only within the predetermined period of time regularly, i.e. expected data stream patterns occur.

Fig. 8 shows a schematic representation of a

Application example of the present invention.

8 shows, for example, the case of a change in the IP and / or Ethernet address in the event of anomaly detection.

9 shows a schematic illustration of a protection and configuration of the filters before an OTA function according to an exemplary embodiment of the present invention;

10 shows a schematic representation of the filter rules using the example of the Qci standard according to an exemplary embodiment of the present invention; and 11 shows a schematic representation of the structure of the filter ECU and its most important components and control variables according to an exemplary embodiment of the present invention.

The Ethernet TSN switch then transmits Ethernet data to other interfaces, not shown.

According to an embodiment of the present invention, the ECU or its functionality can also be part of an existing ECU.

Although the present invention is more preferred based on

Embodiments described above, it is not limited to this, but can be modified in a variety of ways. In particular, the invention can be varied or modified in a variety of ways without departing from the essence of the invention.

In addition, it should be pointed out that “comprising” and “having” do not exclude other elements or steps, and “a” or “an” does not exclude a plurality.

Furthermore, it should be pointed out that features or steps which have been described with reference to one of the above exemplary embodiments also in combination with other features or steps of others described above

Embodiments can be used. Reference signs in the claims are not to be viewed as a restriction.

Claims

Claims:

1. Device for securing a real-time Ethernet data network for a motor vehicle, the device (100) comprising:

- A database device (10) which is designed to store adjustable network configurations and adjustable security settings for the real-time Ethernet data network and to store at least one currently used network configuration and at least one currently used security setting for the real-time Ethernet data network; and

- A control device (20), which is designed to be coupled between an antenna module of the real-time Ethernet data network and a control device of the motor vehicle, and which is further designed to include currently transmitted data traffic between the antenna module and the control device of the motor vehicle expected traffic based on a traffic estimate using the stored currently used

Network configuration and the currently saved

compare the security setting used and save a comparison result.

2. Device according to claim 1, wherein the

Control device (20) is designed to base the data traffic between the

Interrupt antenna module and the control unit of the motor vehicle and / or adapt and / or maintain and / or continue.

3. Device according to claim 1 or 2, wherein the control device (20) is designed to

To also determine the comparison result of the currently transmitted data traffic with the expected data traffic based on attack patterns and / or behavior analyzes in order to detect an anomaly in the data traffic.

4. Device according to one of the preceding

Claims, wherein the database device (10) is designed as a data filter module.

5. Device according to one of the preceding

Claims, wherein the database device (10) as a subsystem of a control device of the motor vehicle

is trained.

6. Device according to one of the preceding

Claims, wherein the control device (20) as a subsystem of a control device of the motor vehicle

is trained.

7. Device according to one of the preceding

Claims, wherein the control device (20) further comprises a hardware circuit for analyzing and manipulating Ethernet data streams of the real-time Ethernet data network in real time.

8. Device according to one of the preceding

Claims, wherein the control device (20) is designed to transmit the comparison result.

9. Device according to one of the preceding

Claims, wherein the control device (20) is trained to traffic with predictable and

Analyze guaranteed end-to-end latencies.

10. Device according to one of the preceding

Claims, wherein the control device (20) is designed to analyze the data traffic by means of a self-learning artificial intelligence.