WO2022047617A1

WO2022047617A1 - Method and system for improving vehicle security

Info

Publication number: WO2022047617A1
Application number: PCT/CN2020/112822
Authority: WO
Inventors: 彭建芬; 郭志鹏; 徐云飞
Original assignee: 华为技术有限公司
Priority date: 2020-09-01
Filing date: 2020-09-01
Publication date: 2022-03-10
Also published as: CN112752682A

Abstract

A method and system for improving vehicle security, comprising: obtaining first IDS event information and a first vehicle running state; determining a first response strategy according to the first IDS event information and the first vehicle running state; and sending the first response strategy to a vehicle-mounted component. The network security and the functional security are jointly considered, so that in the case of a network attack, a response strategy can be taken in time, and the personal safety of drivers and passengers in vehicles can be guaranteed while the network security of the vehicles is protected.

Description

Method and system for improving vehicle safety

technical field

The present application relates to the field of automobiles, and in particular, to a method and system for improving vehicle safety.

Background technique

After decades of evolution, the automotive industry has matured in traditional electronic and mechanical technologies. In recent years, the innovation of related technologies has mainly revolved around the needs of vehicle electrification, intelligence, networking and sharing. In this process, information technology and the Internet have been continuously integrated with the automobile industry, realizing a full range of network connections in vehicles, between vehicles, between vehicles, and between vehicles and roads. More and more vehicles are equipped with network access functions. .

On July 23, 2015, Americans Chris Valasek and Charlie Miller used a security vulnerability in the Uconnect in-vehicle entertainment system of Fiat Chrysler (Fiat Chrysler) 2014 Jeep Cherokee models, through a wireless base station without physical contact. The remote attack takes remote control of the vehicle, re-flashes the virus-laden firmware, and sends instrument cluster control, steering, braking and shifting commands to the CAN bus to control the car. It was the signature security incident of a long-range attack on cars, which led to a worldwide recall of more than 1.4 million vehicles by Chrysler. In recent years, reports of remote cyber-attacks on vehicles have become more frequent. Since cyberattacks against cars may affect the functional safety of cars, and thus threaten the lives of drivers and passengers, car cybersecurity issues have attracted more and more attention from car manufacturers, users, and regulators. Problems that need to be solved urgently in the process of evolution and networking.

SUMMARY OF THE INVENTION

The embodiments of the present application provide a method and system for improving vehicle safety, which can implement a response strategy in a timely manner in the event of a network attack on the vehicle, so as to ensure the safety of the vehicle and occupants.

In a first aspect, an embodiment of the present application provides a method for improving vehicle safety, including:

Obtain the event information of the first IDS (Intrusion Detection System) and the running status of the first vehicle;

Determine the first response strategy according to the first IDS event information and the first vehicle operating state;

A first response policy is sent to the first onboard component.

In the embodiment of the present application, an IDS event refers to the security warning information generated by the intrusion detection system when the triggering condition of the intrusion detection system is satisfied, and the triggering condition of the intrusion detection system is an IDS event detection rule, a set of IDS event detection rules Set of detection rules for IDS events. The response strategy refers to a processing rule for responding to the above-mentioned IDS event information and vehicle running state, the set of response strategies is a response strategy set, and the above-mentioned first response strategy belongs to the response strategy set.

According to the technical solutions of the embodiments of the present application, the steps of acquiring and analyzing the information related to the running state of the complete vehicle are added to the processing flow of the IDS event. In the event of an IDS incident, the impact factors of network security and functional safety can be considered together, and the response strategy can be determined and executed on the vehicle side in time, which can effectively ensure the safety of the vehicle and its passengers.

In a second aspect, an embodiment of the present application provides a system for improving vehicle safety, the system comprising: a collection module, an analysis module, and a response module;

an acquisition module for acquiring the first IDS event information and the first vehicle running state;

an analysis module, configured to determine a first response strategy according to the first IDS event information and the first vehicle operating state;

The response module is used for: sending the first response strategy to the first vehicle-mounted component.

With reference to the second aspect, in a possible implementation manner, the system includes one or more sensors, and/or the acquisition module includes one or more sensors, and/or the first vehicle-mounted component includes one or more sensors.

With reference to the second aspect, in a possible implementation manner, the analysis module is integrated in the vehicle-mounted component, or the analysis module is an independent vehicle-mounted component.

With reference to the second aspect, in a possible implementation manner, the system further includes an execution module, where the execution module is configured to receive at least one of the first response strategy or the second response strategy, and/or execute the first response strategy or at least one of the second response strategies.

According to the technical solutions of the above-mentioned embodiments, the vehicle end can execute the response strategy in time, so that the damage to the vehicle and the driver and passengers can be effectively avoided or reduced.

In combination with any of the above aspects or possible implementation manners, in a possible implementation manner, the first IDS event information includes the event type, event description, risk level, event source, attacked component of the first IDS event one or more of the.

In combination with any of the above aspects or possible implementation manners, in a possible implementation manner, the running state of the entire vehicle includes an intelligent driving level and a driving scenario.

In combination with any of the above aspects or possible implementation manners, in a possible implementation manner, the driving scene is composed of one or more of driving speed, terrain, road surface conditions, driving environment, traffic conditions, and driving time periods. Item parameter definition.

In combination with any of the above aspects or possible implementation manners, in a possible implementation manner, the driving scenario of the vehicle includes highway cruise HWP, adaptive cruise control ACC, automatic valet parking AVP, automatic traffic jam At least one of driving TJP, manual high-speed driving, manual low-speed driving, and stationary.

In combination with any of the above aspects or possible implementations, in a possible implementation, the first response strategy is associated with at least one IDS event information and at least one vehicle operating state, and the first IDS event belongs to the at least one IDS event. In one of an IDS event, the first complete vehicle operating state belongs to one of the at least one complete vehicle operating state.

With reference to any of the above aspects or possible implementation manners, in a possible implementation manner, the first response strategy includes a processing strategy, or the first response strategy includes a processing strategy and a processing opportunity.

In this possible implementation, the first response strategy includes both the processing strategy and the corresponding processing timing. In case of emergency, the response strategy can be executed in time, which improves the overall safety of the vehicle and the driver and passengers.

In combination with any of the above aspects or possible implementation manners, in a possible implementation manner, the processing strategy includes: executing the lowest risk strategy, prompting an exception, recommending the driver to pull over, prompting the automatic driving function to exit, reporting to safety One or more of the operation module alarm, vehicle power off, and blocking of illegal requests; the processing timing includes one or more of: immediate execution, execution after pulling over, and execution the next time the function is turned on.

In combination with any of the above aspects or possible implementation manners, in a possible implementation manner, the method or system for improving vehicle safety further includes: an analysis module according to the first IDS event information and the first vehicle operation The state determines a first failure mode, the first response strategy is associated with at least one failure mode, and the first failure mode belongs to one of the at least one failure modes.

In this possible implementation, the influence factors of network security and functional safety are integrated in the process of determining the failure mode. Therefore, executing the associated response strategy can enable the vehicle to simultaneously resist network attacks and protect the safety of drivers and passengers. Purpose.

In combination with any of the above aspects or possible implementations, in a possible implementation, the aforementioned on-board components include: in-vehicle information box T-Box (Telematics Box), in-vehicle infotainment system IVI (In-Vehicle Infotainment), body control module BCM (Body Control Module), vehicle control unit VCU (Vehicle Control Unit), transmission control unit TCU (Transmission Control Unit), motor controller MCU (Motor Control Unit) cockpit domain controller CDC ( One or more of Cockpit Domain Controller), Mobile Data Center (MDC), and Vehicle Integrated Unit (VIU).

In combination with any of the above aspects or possible implementations, in a possible implementation, the method or system for improving vehicle safety further includes: interacting with a safety operation module, the safety operation module receiving the first IDS event information, and send a second response policy to the response module according to the first IDS event information.

In this possible implementation manner, the second response policy is a processing rule for responding to the first IDS event information on the network device side.

In combination with any of the above aspects or possible implementation manners, in a possible implementation manner, the second response strategy includes:

Update at least one of the firmware or software of the vehicle components;

and/or update at least one item in the IDS event detection rule set;

and/or update at least one item in the response policy set.

In a third aspect, embodiments of the present application provide a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the method in the foregoing first aspect or possible implementation manner.

In a fourth aspect, embodiments of the present application provide an electronic device, including a processor, the processor is coupled to a memory, a computer program is stored in the memory, and the processor is configured to execute the computer program stored in the memory, so as to realize the aforementioned first A method in an aspect or possible implementation.

In a fifth aspect, embodiments of the present application provide a vehicle including the system for improving vehicle safety in the aforementioned second aspect or possible implementation manner.

In the technical solution of the present application, in the case of a network intrusion event, the impact factors of network security and functional safety are considered to determine a response strategy, and the response strategy can be executed on the vehicle side in time, so as to better protect network security while protecting Safety of the driver and passengers.

Description of drawings

Fig. 1 is an intrusion detection system of an intelligent networked vehicle;

2 is a schematic flowchart of a method for improving vehicle safety;

3 is a schematic structural diagram of a system for improving vehicle safety;

detailed description

The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application.

Figure 1 is an intrusion detection system for intelligent networked vehicles. The system includes a vehicle-side intrusion detection system IDS and a cloud operation analysis center. The vehicle-side IDS can be deployed in on-board components, such as IVI, T-Box or TCU and other on-board components. . The intrusion detection system at the vehicle end includes modules such as acquisition, IDS detection and IDS management.

The acquisition module is used to acquire the status of the vehicle components and the system data of the vehicle. For example, the system data of the vehicle can come from the controller area network CAN (Controller Area Network), the message of the vehicle Ethernet (Ethernet) or the electronic control unit ECU (Electronic Control Unit).

The IDS detection module acquires the detection rule set corresponding to the state according to the state of the aforementioned vehicle components, and compares the characteristic information of the data acquired by the acquisition module with the valid state predefined by the detection rule. As an example, the valid state may be the signature and the value range of the characteristic parameter. The IDS detection module can also perform AI model-based recognition on the data obtained by the aforementioned acquisition module.

When the IDS event trigger condition is satisfied, that is, the IDS event detection rule is satisfied, the IDS management module creates an IDS event, and sends the IDS event information of the IDS event to the cloud operation analysis center.

The cloud operation analysis center receives and analyzes the IDS event information, and sends a response strategy to the vehicle components according to the analysis results. As an example, the response strategy may be: repairing system vulnerabilities through over-the-air OTA (Over The Air) technology upgrades.

In the above technical solution, in the event of a network attack, the intrusion detection system detects and records the network intrusion event, and needs to send the information of the intrusion event to the cloud, and then the cloud operation analysis center analyzes and issues a response strategy. However, this method cannot respond to network intrusion attacks in a timely manner, and the response strategy does not take into account the integration of vehicle network security and functional security, making it difficult to ensure the safety of drivers and passengers.

FIG. 2 is a schematic flowchart of a method for improving vehicle safety provided by an embodiment of the present application. The corresponding process is described below with reference to specific vehicle components.

Step 210: Acquire the first IDS event information and the first vehicle running state.

Specifically, the first IDS event information is associated with the first IDS event, and the first IDS event information is used to indicate one or more of the event type, event description, risk level, event source, and attacked component of the first IDS event . It can be understood that the event source and the attacked component can be the same on-board component or different on-board components. For example, when a gateway (Gateway) is attacked and a packet sent by the gateway is detected by the MDC, the event source component is the MDC, and the attacked component is the gateway. The event source and/or the attacked component may be one vehicle-mounted component or multiple vehicle-mounted components, which are not limited in this application.

Specifically, the first IDS event information is one of at least one IDS event information. Each IDS event message is associated with an IDS event. Table 1 lists some examples of IDS event information.

Table 1. Examples of IDS event information

It can be understood that the event description in Table 1 above can be regarded as an event description of an IDS event, that is, it can represent an IDS event.

As shown in Table 1 above, event types include:

(I) Vehicle control attacks: Attacks by exploiting vulnerabilities in software or the overall architecture of the vehicle to gain control of the vehicle or interfere with the normal operation of the user; for example, sending forged steering commands to the chassis CAN bus belongs to vehicle control attacks.

(II) Non-vehicle control attacks: stealing or tampering with user data, and conducting reconnaissance activities such as scanning ports and network sniffing, such network attacks do not affect vehicle control; Scanning, etc. are non-vehicle-controlled attacks.

(III) Illegal use of advanced functions: The attacker achieves the purpose of illegally using specific functions by destroying or validating the validity period detection mechanism. As an example, features that require payment, such as real-time traffic, karaoke, theater mode, music services, satellite maps, etc., are classified as premium features. The attacker obtains the security method adopted by the advanced function, for example, obtains the access control of the advanced function, and illegally uses the advanced function by bypassing the adopted security function. It can be understood that the scope of the advanced functions may also be divided according to other indicators, which are not specifically limited in the embodiments of the present application.

As shown in Table 1 above, the risk level can also be referred to as the network security risk level. The types of IDS incidents and the corresponding network security risk levels can be assessed using the commonly used dimensions of threat analysis and risk assessment TARA (Threat Analysis and Risk Assessment), such as functional safety (Safety), assets (Financial), availability (Operational), One or more of the four dimensions of Privacy. Alternatively, use a custom model, such as one or more of data compliance, legality, and application scenarios of the vehicle model (commercial vehicle, passenger vehicle) for evaluation. For example, the risk level of car control attacks is high. For non-vehicle control attacks, the risk level of data decryption failure in the HD map encrypted channel is high, and the risk level of external network port scanning is low. The risk level of illegal use of advanced features can be low. It can be understood that the risk level may also be assessed by other methods, which are not specifically limited in the embodiments of the present application.

Optionally, one IDS event information may also be associated with multiple IDS events. For example, remote control IDS events include a series of IDS events, such as root privilege escalation (ordinary users exploit vulnerabilities in the system to escalate their privileges to root privileges), rebound shell (the control terminal listens on a TCP/UDP port and is The control terminal initiates a request to this port, and transfers the input and output of its command line to the control terminal), modifying sensitive files and sending illegal vehicle control commands, etc. That is, the remote control IDS event information can be associated with multiple IDS events such as root privilege escalation, reverse shell, sensitive file modification, and illegal vehicle control command sending.

Specifically, the first vehicle operating state may also be referred to as the first vehicle operating state, including at least one of an automatic driving level and a driving scenario.

As an example of the above specific implementation, the automatic driving level can refer to the automotive intelligence classification standard formulated by the International Society of Automotive Engineers (SAE). For example, the L0 level is manual driving, L1 is assisted driving, L2 is partial automatic Conditional autonomous driving, L4 highly autonomous driving, and L5 fully autonomous driving. The above classification methods for automatic driving levels are only for the purpose of examples, and the embodiments of the present application do not limit the classification standards and levels of automatic driving.

As another example of the above specific embodiment, the driving scenario may include one or more parameter definitions of driving speed, terrain, road surface conditions, driving environment, traffic conditions, and driving time periods. Exemplarily, the driving scene division may include highway cruise HWP (Highway Pilot), adaptive cruise control ACC (Adaptive Cruise Control), automatic valet parking AVP (Autonomous Valet Parking), traffic jam automatic driving TJP (Traffic Jam Pilot), at least one of manual high-speed driving, manual low-speed driving, and stationary. Taking highway cruise HWP as an example, the operational design domain ODD (Operational Design Domain) of this driving scenario includes: the driver must hold a driver's license and pay attention to the road conditions at all times; only drive on roads with two-way lanes being physically separated; the maximum speed is 120km/h /h, there can be a vehicle ahead or no vehicle ahead, lane change is allowed, construction site is allowed; it can be driven in the environment of day or night, moderate rain or moderate snow. Exemplarily, for the speed range covered by manual high-speed, medium-speed, and low-speed driving scenarios, reference may be made to industry standards or relevant national laws, regulations, and rules and regulations, which are not specifically limited in the embodiments of the present application. It can be understood that the definition of the driving scene of the vehicle may also be divided according to other standards, and the embodiments of the present application are not specifically limited.

Optionally, other indicators may be used to represent the first vehicle running state. For example, the first vehicle running state may include at least one of a vehicle running state and a vehicle business state. The vehicle driving status may include at least one of driving speed, acceleration parameters, braking parameters, and steering parameters, and the vehicle business status may include one of intelligent driving level, high-precision map download status, driving road information, and driver status information. or more. It can be understood that the manner of representing the running state of the complete vehicle is not limited in the embodiments of the present application.

It can be understood that the specific manner of obtaining the first IDS event information and the first vehicle running state is not limited in the embodiments of the present application.

Step S220: Determine a first response strategy according to the first IDS event information and the first vehicle operating state.

Exemplarily, the first response strategy belongs to one of at least one response strategy, wherein each response strategy may include a processing strategy. The processing strategy may include one or more of: implementing the lowest risk strategy, prompting an exception, recommending the driver to pull over, prompting the automatic driving function to exit, alerting the safety operation module, powering off the entire vehicle, and blocking illegal requests. For example, implementing the lowest risk strategy includes the driver taking over the driving of the vehicle. For different response strategies, at least one of the contents included in the corresponding processing strategy is different.

Exemplarily, each response strategy includes a processing strategy and a processing opportunity. The processing strategy is as described above, and the processing timing includes one or more of immediate execution, execution after pulling over, and execution when the function is turned on next time.

Specifically, the first response strategy is determined according to the first IDS event information and the first vehicle operating state. The first response strategy may be one of at least one response strategy in the following table.

Table 2 below shows an example of determining different response strategies according to different IDS event information and different vehicle operating states.

Table 2. Examples of IDS event information, vehicle operation status and response strategy

As a specific example, as shown in Table 1, for a network attack event that sends a forged steering command to the chassis CAN bus, the event type is a vehicle control attack, and the event source is VCU, so the risk level of the IDS event is determined to be high. As shown in Table 2 above, under the condition that the intelligent driving level is L3 and the driving scene is highway cruise HWP, based on the aforementioned IDS event information and vehicle operation status, the processing strategies are determined as: 1. Execute the lowest risk strategy; 2. If the driver has taken over, it will prompt abnormality and suggest the driver to pull over to stop; 3. Alert the security operation module. The processing timings corresponding to processing strategies 1 and 2 are executed immediately, and the timing corresponding to processing strategy 3 is executed after pulling over.

As another specific example, as shown in Table 1, for the event that HD map encryption channel data fails to decrypt, the event type is non-vehicle control attack, and the event source is T-Box, so the risk of the IDS event is determined. level is high. As shown in Table 2 above, under the condition that the intelligent driving level is L0 and the driving scene is static, based on the aforementioned IDS event information and vehicle running status, the processing strategy is determined as: 1. Alert the user to alert the user that the device is abnormal; 2. , alert the security operation module. The processing timing corresponding to processing strategies 1 and 2 is immediate execution.

Optionally, before determining the response strategy, the embodiment of the present application further includes determining a failure mode. In the embodiments of the present application, the failure refers to a state in which the vehicle-mounted component loses a prescribed function. The failure mode refers to the entire failure process from the factors leading to failure, the mechanism of failure, the development process of failure to the arrival of the critical state of failure, and is the manifestation of failure.

Specifically, the first failure mode is determined according to the first IDS event information and the first vehicle operating state.

Further, determining the first response strategy according to the first IDS event information and the first vehicle operation state includes: determining the first failure mode according to the first IDS event information and the first vehicle operation state, and then according to the first failure mode, Identify first failure management measures. It can be understood that, in each embodiment of the present application, the first failure management measure corresponds to or has the same meaning as the first response strategy.

Table 3 below takes the IDS event information 1 as an example, and provides an example of determining different failure modes according to the IDS event information and different vehicle operating states, and further determining the response strategy according to the determined failure modes. The first failure mode may be one of the at least one failure mode in Table 3 below.

Table 3. Examples of IDS event information, vehicle operating status, failure mode and response strategy

As another specific example, as shown in Table 1 above, for a network attack event that sends a forged steering command to the chassis CAN bus, the event type is a vehicle control attack, and the event source is VCU, so the risk level of the IDS event is determined to be high. As shown in Table 2 above, under the condition that the intelligent driving level is L3 and the driving scene is highway cruising HWP, based on the aforementioned IDS event information and vehicle operating status, the determined failure mode is that the HWP function is attacked by the vehicle control type and cannot be controlled. Control the vehicle normally. Further, the processing strategies determined according to the failure mode are: 1. Execute the lowest risk strategy; 2. If the driver has taken over, prompt an exception and suggest the driver to pull over to stop; 3. Alert the safety operation module. The processing timings corresponding to processing strategies 1 and 2 are executed immediately, and the timing corresponding to processing strategy 3 is executed after pulling over.

Step S230: Send the first response strategy to the first vehicle-mounted component.

The first in-vehicle component may be one in-vehicle component, or may be a plurality of in-vehicle components.

The first vehicle component may be the same vehicle component as the event source or the attacked object, or a different vehicle component, or the same one or more vehicle components as the event source or attacked object.

Further, different response strategies for different IDS event information can be sent to different vehicle components.

Exemplarily, the on-board components may include: one or more of the VCU, T-Box, IVI, TCU, MCU, and BCM under the Electronic/Electronic Architecture (EEA), or a communication computing architecture (CCA). One or more of the vehicle components MDC, CDC, and VIU under the Computation Communication Architecture).

As a specific implementation, according to the aforementioned processing strategy, a message of executing the minimum risk status is sent to the vehicle controller VCU, and a warning message is sent to the cockpit domain controller CDC (Cockpit Domain Controller), prompting the user to exit the automatic driving function.

Optionally, the method further includes sending the first IDS event information to the network device.

For example, the network device may be a cloud server.

The first IDS event information may include a first IDS event index, or an event type, event description, risk level, event source, and attacked component of the first IDS event.

Further, the method further includes receiving a second response policy sent by the network device.

Specifically, the second response strategy includes: updating at least one item of firmware or software of the in-vehicle component; and/or updating at least one item in the IDS event detection rule set; and/or updating at least one item in the response policy set Update at least one item.

Further, the method also includes sending the second response strategy to the second vehicle-mounted component.

Specifically, the second vehicle-mounted component and the first vehicle-mounted component may be the same vehicle-mounted component, or may be different vehicle-mounted components. For example, the first response strategy for implementing the minimum risk strategy is sent to the first on-board component MDC, and the second response strategy for software upgrade of the on-board component is sent to the second on-board component T-Box.

It can be understood that sending or receiving a response policy in each embodiment of the present application refers to sending or receiving response policy information, where the response policy is indicated in the information.

FIG. 3 is a system for improving vehicle safety performance provided by an embodiment of the present application. The system includes a collection module 310 , an analysis module 320 and a response module 330 for executing the method for improving vehicle safety shown in FIG. 2 .

The acquisition module 310 is used for acquiring the first IDS event information and the first vehicle running state.

As a specific implementation manner, the acquisition module 310 includes one or more sensors, and/or the system includes one or more sensors, and/or the first vehicle-mounted component includes one or more sensors. The arrangement of the sensors may be performed according to the deployment of the vehicle architecture and the design requirements of the modules, which are not specifically limited in the embodiments of the present application.

Exemplarily, the in-vehicle components may be in-vehicle information box T-Box, in-vehicle infotainment system IVI, transmission control unit TCU, motor controller MCU, vehicle control unit VCU, body control module BCM, cockpit domain controller CDC, mobile One or more of the data center MDC and the vehicle integration unit VIU.

As an example of this specific embodiment, one or more sensors are arranged in the VCU of the vehicle to collect the driving state data of the vehicle, such as vehicle speed data, acceleration data, and steering data.

As another example of this specific implementation manner, sensors are arranged in the MCU of the electric vehicle to collect motor speed data.

The analysis module 320 is configured to: determine a first response strategy according to the first IDS event information and the first vehicle operating state.

Optionally, the analysis module 320 is configured to determine a first failure mode according to the first IDS event information and the first vehicle operating state, the first response strategy is associated with at least one failure mode, and the first failure mode belongs to the at least one failure mode. one of.

Optionally, the deployment mode of the analysis module 320 may be selected according to the requirements of the vehicle system architecture, the analysis module 320 may be integrated in the vehicle-mounted component, or the analysis module 320 may be an independent vehicle-mounted component.

The response module 330 is used for: sending the information of the first response strategy to the vehicle-mounted component.

Optionally, the system further includes an execution module 340, and the execution module 340 is configured to receive the information of the response strategy and execute the response strategy. Exemplarily, the execution module 340 is arranged at the vehicle end.

In one embodiment, the system further includes a sending module 350 for sending the first IDS event information to the security operation module 360. It can be understood that the security operation module 360 in this embodiment of the present application corresponds to the network device described in FIG. 2 above.

Further, the response module 330 is further configured to receive the second response policy from the security operation module 360 .

In another embodiment, the system further includes a sending module 350 and a security operation module 360, the sending module 350 sends the first IDS event information to the security operation module 360, and the security operation module 360 receives and analyzes the first IDS event information, The second response policy is sent to the response module 330 according to the result of the analysis. In the embodiment of the present application, the second response strategy is a processing rule for the system for improving vehicle safety to respond to the IDS event information and the running state of the entire vehicle.

Further, the response module 330 receives the second response policy.

Further, the response module 330 sends the second response policy to the execution module 340 .

In each embodiment of the present application, the second response strategy may include: updating at least one of firmware or software of the vehicle-mounted component. For example, in the case of a security vulnerability in the firmware and/or software of the vehicle component, the second response strategy includes upgrading the firmware and software involving the security vulnerability through OTA.

Alternatively, the second response strategy further includes: updating at least one item of the IDS event detection rule set or the response strategy set. For example, the management module of the external interface of the IDS is delivered to the IDS to configure the response policy, and then the response policy is delivered to the corresponding vehicle components.

For the convenience and brevity of description, for the specific description in this embodiment, reference may be made to the description in the foregoing method embodiment corresponding to FIG. 2 , which is not repeated here.

A computer-readable storage medium provided by an embodiment of the present application stores a computer program thereon, and when the computer program is executed by a processor, implements the method provided by the embodiment shown in FIG. 2 of the present application.

An electronic device provided by an embodiment of the present application includes:

One or more processors configured to execute the computer program stored in the memory to implement the method provided by the embodiment shown in FIG. 2 of the present application.

Optionally, the memory is coupled to the processor.

Optionally, the electronic device may further include the above-mentioned memory, where the computer program is stored.

An embodiment of the present application provides a vehicle, and the vehicle includes the system provided by the embodiment shown in FIG. 3 of the present application.

It should be noted that the above embodiments are described by taking the VCU as an on-board component as an example, but this does not constitute a limitation to the present application. The above solution can also be applied to technical solutions of other on-board components. limited.

Terms used in the detailed description of the embodiments of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the embodiments of the present application.

It should be noted that, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to identify the same or similar items that have basically the same function and effect. The distinction, for example, the first response strategy and the second response strategy is only for differentiating different response strategies, and unless otherwise explicitly specified and limited, the order of the response strategies is not limited, nor should it be interpreted as an indication or suggestion. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order.

"Automobile", "vehicle" and "vehicle" or other similar terms in the embodiments of this application include general motor vehicles, including, for example, sedans, SUVs, MPVs, buses, trucks and other cargo or passenger vehicles, Watercraft including various boats and boats, and aircraft, including hybrid vehicles, electric vehicles, fuel vehicles, plug-in hybrid vehicles, fuel cell vehicles and other alternative fuel vehicles. Wherein, a hybrid vehicle refers to a vehicle having two or more power sources, and an electric vehicle includes a pure electric vehicle, an extended-range electric vehicle, etc., which is not specifically limited in this application.

Those skilled in the art will appreciate that the functions described in connection with the various illustrative logical blocks, modules, and algorithm steps described in this disclosure may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions described by the various illustrative logical blocks, modules, and steps may be stored on or transmitted over as one or more instructions or code on a computer-readable medium and executed by a hardware-based processing unit. Computer-readable media may include computer-readable storage media, which correspond to tangible media, such as data storage media, or communication media including any medium that facilitates transfer of a computer program from one place to another (eg, according to a communication protocol) . In this manner, a computer-readable medium may generally correspond to (1) a non-transitory tangible computer-readable storage medium, or (2) a communication medium such as a signal or carrier wave. Data storage media can be any available media that can be accessed by one or more computers or one or more processors to retrieve instructions, code and/or data structures for implementing the techniques described in this application. The computer program product may comprise a computer-readable medium.

By way of example and not limitation, such computer-readable storage media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, flash memory, or may be used to store instructions or data structures desired program code in the form of any other medium that can be accessed by a computer. Also, any connection is properly termed a computer-readable medium. For example, if a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave are used to transmit instructions from a website, server, or other remote source, then the coaxial cable Wire, fiber optic cable, twisted pair, DSL or wireless technologies such as infrared, radio and microwave are included in the definition of medium. It should be understood, however, that computer-readable storage media and data storage media do not include connections, carrier waves, signals, or other transitory media, but are instead directed to non-transitory, tangible storage media. As used herein, magnetic disks and optical disks include compact disks (CDs), laser disks, optical disks, digital versatile disks (DVDs), and Blu-ray disks, where disks typically reproduce data magnetically, while disks reproduce optically with lasers data. Combinations of the above should also be included within the scope of computer-readable media.

may be processed by one or more of, for example, one or more digital signal processors (DSPs), general purpose microprocessors, application specific integrated circuits (ASICs), field programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuits to execute the instruction. Accordingly, the term "processor," as used herein may refer to any of the foregoing structure or any other structure suitable for implementation of the techniques described herein. In addition, in some aspects, moreover, the techniques may be fully implemented in one or more circuits or logic elements.

The techniques of this application may be implemented in a wide variety of devices or apparatuses, including in-vehicle equipment, an integrated circuit (IC), or a set of ICs (eg, a chip set). Various components, modules are described in this application to emphasize functional aspects of means for performing the disclosed techniques, but do not necessarily require realization by different hardware. Indeed, as described above, the various modules may be combined in hardware in conjunction with suitable software and/or firmware, or provided by interoperating hardware including one or more processors as described above.

In the above-mentioned embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.

The above descriptions are only specific embodiments of the present application. For those skilled in the art, changes or substitutions can be easily thought of within the scope disclosed in the present application, and all should be included within the protection scope of the present application. The protection scope of the present application shall be subject to the protection scope of the claims.

Claims

A method for improving vehicle safety, characterized in that the method comprises:

Obtain the first IDS event information and the first vehicle running state;

determining a first response strategy according to the first IDS event information and the first vehicle operating state;

The first response strategy is sent to the first onboard component.
The method according to claim 1, wherein the first IDS event information is used to indicate one or more of the event type, event description, risk level, event source, and attacked component of the first IDS event .
The method according to claim 1 or 2, wherein the first vehicle operating state includes at least one of an automatic driving level and a driving scenario.
The method according to any one of claims 1-3, wherein the driving scene is defined by one or more parameters including driving speed, terrain, road conditions, driving environment, traffic conditions, and driving time period.
The method according to claim 4, wherein the driving scenarios include highway cruise HWP, adaptive cruise control ACC, automatic valet parking AVP, traffic jam automatic driving TJP, manual high-speed driving, manual low-speed driving, one or more of stationary.
The method according to any one of claims 1-5, wherein the first response strategy is associated with at least one IDS event information and at least one vehicle operating state, and the first IDS event information belongs to the at least one IDS event information. One of the pieces of IDS event information, the first vehicle operating state belongs to one of the at least one vehicle operating state.
The method according to any one of claims 1-6, wherein the first response strategy includes a processing strategy, or the first response strategy includes a processing strategy and a processing opportunity.
The method according to claim 7, wherein the processing strategy comprises: executing the lowest risk strategy, prompting an exception, recommending the driver to pull over to the side, prompting the automatic driving function to exit, alerting the safety operation module, powering off the whole vehicle, One or more items of illegal requests are blocked; the processing timing includes one or more of: immediate execution, execution after pulling over, and execution when the next function is turned on.
The method according to any one of claims 1-8, wherein the determining the first response strategy according to the first IDS event information and the first vehicle operating state specifically includes:

A first failure mode is determined according to the first IDS event information and the first vehicle operating state,

The first response strategy is determined based on the first failure mode, wherein the first response strategy is associated with at least one failure mode, and the first failure mode belongs to one of the at least one failure modes.
The method according to any one of claims 1-9, wherein the on-board components include: on-board information box T-Box, on-board infotainment system IVI, transmission control unit TCU, motor controller MCU, complete vehicle One or more of the control unit VCU, the body control module BCM, the cockpit domain controller CDC, and the mobile data center MDC.
The method according to any one of claims 1-10, wherein the method further comprises: sending the first IDS event information to a network device.
11. The method of claim 11, further comprising receiving a second response policy from a network device.
13. The method of claim 12, further comprising sending the second response strategy to a second vehicle-mounted component.
The method according to claim 12 or 13, wherein the second response strategy comprises:

Updating at least one of the firmware or software of the on-board component;

and/or update at least one item in the IDS event detection rule set;

and/or update at least one item in the response policy set.
A system for improving vehicle safety, characterized in that the system includes an acquisition module, an analysis module and a response module;

The acquisition module is used to acquire the first IDS event information and the first vehicle running state;

the analysis module, configured to determine a first response strategy according to the first IDS event information and the first vehicle operating state;

The response module is configured to send the first response strategy to the first vehicle-mounted component.
The system according to claim 15, wherein the system includes one or more sensors, and/or the acquisition module includes one or more sensors, and/or the first vehicle-mounted component includes one or more sensors multiple sensors.
The system according to claim 15 or 16, wherein the analysis module is integrated in the vehicle-mounted component, or the analysis module is an independent vehicle-mounted component.
The system according to any one of claims 15-17, wherein the on-board components include: on-board information box T-Box, on-board infotainment system IVI, transmission control unit TCU, motor controller MCU, complete vehicle One or more of the control unit VCU, the body control module BCM, the cockpit domain controller CDC, the mobile data center MDC, and the vehicle integration unit VIU.
The system according to any one of claims 15 to 18, wherein the system further interacts with a security operation module, and the security operation module receives the first IDS event information and, according to the first IDS The event information sends the second response policy to the response module.
The system according to any one of claims 15-19, wherein the second response strategy comprises:

Updating at least one of the firmware or software of the on-board component;

and/or update at least one item in the IDS event detection rule set;

and/or update at least one item in the response policy set.
The system according to any one of claims 15-20, wherein the analysis module is specifically configured to determine a first failure mode according to the first IDS event information and the first vehicle operating state, and according to the The first failure mode is determined, and the first response strategy is determined, wherein the first response strategy is associated with at least one failure mode, and the first failure mode belongs to one of the at least one failure modes.
The system according to any one of claims 15-21, wherein the system further comprises an execution module, and the execution module is configured to receive at least one of the first response strategy or the second response strategy item, and/or implement at least one of the first response strategy or the second response strategy.
The system according to any one of claims 15-22, wherein the first IDS event information is used to indicate an event type, an event description, a risk level, an event source, and an attacked component of the first IDS event. one or more.
The system according to any one of claims 15-23, wherein the first vehicle operating state includes at least one of an automatic driving level and a driving scenario.
The system according to any one of claims 15-24, wherein the driving scenario is defined by one or more parameters including driving speed, terrain, road conditions, driving environment, traffic conditions, and driving time periods.
The system according to claim 25, wherein the driving scenarios include highway cruise HWP, adaptive cruise control ACC, automatic valet parking AVP, traffic jam automatic driving TJP, manual high-speed driving, manual low-speed driving, one or more of stationary.
The system according to any one of claims 15-26, wherein the first response strategy is associated with at least one IDS event information and at least one vehicle operating state, and the first IDS event information belongs to the at least one IDS event information. One of the pieces of IDS event information, the first vehicle operating state belongs to one of the at least one vehicle operating state.
The system according to any one of claims 15-27, wherein the first response strategy includes a processing strategy, or the first response strategy includes a processing strategy and a processing opportunity.
The system according to claim 28, wherein the processing strategy comprises: executing the lowest risk strategy, prompting an exception, recommending the driver to pull over to stop, prompting the automatic driving function to exit, alerting the safety operation module, powering off the whole vehicle, Block one or more of the illegal requests; the processing timing includes one or more of: executing immediately, executing after pulling over, and executing the next time the function is turned on.
A computer-readable storage medium on which a computer program is stored, characterized in that, when the computer program is executed by a processor, the method according to any one of claims 1-14 is implemented.
An electronic device, characterized in that it comprises a processor, wherein the processor is coupled with a memory, and a computer program is stored on the memory, and the processor is configured to execute the computer program to implement any one of claims 1-14. one of the methods described.
A vehicle, characterized in that the vehicle comprises the system of any one of claims 15-29.