WO2022141243A1

WO2022141243A1 - Method and apparatus for preventing arp attack, and system

Info

Publication number: WO2022141243A1
Application number: PCT/CN2020/141602
Authority: WO
Inventors: 黄俊瑞
Original assignee: 华为技术有限公司
Priority date: 2020-12-30
Filing date: 2020-12-30
Publication date: 2022-07-07
Also published as: CN112789840A

Abstract

The present application relates to the field of communications, and in particular to a method and apparatus for preventing an ARP attack, and a system. The method is applied to a vehicle-mounted controller of a vehicle-mounted network, and comprises: obtaining MAC addresses and IP addresses of all access terminals in the vehicle-mounted network; generating an ARP mapping relationship table, the ARP mapping relationship table comprising mapping relationships between the MAC addresses and the IP addresses of all the access terminals in the vehicle-mounted network; and sending the ARP mapping relationship table to all the access terminals in the vehicle-mounted network. Therefore, in the present application, any access terminal in the vehicle-mounted network can perform data communication according to the ARP mapping relationship table issued by the vehicle-mounted controller, so that the ARP attack in the vehicle-mounted network is effectively prevented, and the reliability of data communication is also ensured.

Description

Method, device and system for preventing ARP attack

technical field

The present application relates to the field of communications, and in particular, to a method, device and system for preventing ARP attacks.

Background technique

The basic function of ARP (Address Resolution Protocol) is to query the MAC address of the target device through the IP address of the target device to ensure smooth communication. ARP spoofing means that the attacker makes the network communication abnormal by sending wrong ARP information.

In the in-vehicle environment, the attacker generally uses the cracked vehicle WIFI (Wireless Fidelity, wireless fidelity) password to enter the vehicle network to perform ARP spoofing to attack the terminal device. After the attack is successful, the MAC address of the gateway in the ARP mapping table of the attacker is If it is changed to the attacker's MAC address, the victim's data stream will be sent to the attacker. At this time, the attacker can hijack the traffic to obtain sensitive information.

SUMMARY OF THE INVENTION

The embodiments of the present application provide a method, device, and system for preventing ARP attacks. The on-board controller of the on-board network generates an ARP mapping relationship table by acquiring the MAC addresses and IP addresses of all access terminals in the on-board network. The ARP mapping relationship The table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the in-vehicle network, and sends the ARP mapping table to all access terminals in the in-vehicle network, so that any access terminal in the in-vehicle network can be controlled according to the in-vehicle control. The ARP mapping relationship table issued by the controller is used for data communication, thereby effectively preventing ARP attacks in the vehicle network and ensuring the reliability of data communication.

In a first aspect, an embodiment of the present application provides a method for preventing ARP attacks, and the method is used in an in-vehicle controller of an in-vehicle network, including:

Acquiring the MAC address of the medium access control and the IP address of the interconnection protocol between the networks of all access terminals in the vehicle network;

generating an ARP mapping relationship table, where the ARP mapping relationship table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the vehicle network;

Sending the ARP mapping relationship table to all access terminals in the vehicle network, so that any access terminal in the vehicle network performs data communication according to the ARP mapping relationship table.

That is to say, in the embodiment of the present application, the on-board controller generates an ARP mapping relationship table by acquiring the MAC addresses and IP addresses of all access terminals in the on-board network, and the ARP mapping relationship table includes the MAC addresses of all access terminals in the on-board network. The mapping relationship between addresses and IP addresses, and the ARP mapping relationship table is sent to all access terminals in the vehicle network, and the access terminal only receives the ARP mapping relationship table issued by the vehicle controller. The mapping relationship table is used for data communication, so that the ARP mapping relationship table of all access terminals in the vehicle network is maintained by the vehicle controller, thereby ensuring the reliability of data communication between the access terminal and other access terminals.

In a possible implementation manner, the sending the ARP mapping relationship table to all access terminals in the vehicle network includes:

The ARP mapping relationship table is sent to the receiving systems of all access terminals in the in-vehicle network through the issuing system of the in-vehicle controller.

That is to say, in this implementation manner, the vehicle controller can send the ARP mapping relationship table through the delivery system, and the access terminal can receive the ARP mapping relationship table through the receiving system, which effectively prevents the transmission path from the ARP mapping relationship table in the vehicle network. ARP attack.

In a possible implementation manner, the sending system is a first application APP, the receiving system is a second APP, and the first APP and the second APP are the same.

That is to say, in this implementation manner, both the vehicle controller and the access terminal use the same APP (for example, a third-party application of a smartphone) to process the ARP mapping relationship table, thereby enriching the implementation of preventing ARP attacks Way.

In a possible implementation manner, the acquiring the MAC addresses and IP addresses of all access terminals in the in-vehicle network includes:

The MAC address and IP address of the first terminal are obtained by using the dynamic host configuration protocol DHCP, where the first terminal is used to represent any access terminal in the vehicle network.

That is to say, in this implementation, the on-board controller can obtain the MAC addresses and IP addresses of all access terminals in the on-board network via DHCP, which facilitates the on-board controller to manage the IP addresses of the access terminals, and also facilitates on-board control. The device is used to maintain the ARP mapping relationship table of all access terminals in the in-vehicle network.

In a possible implementation manner, the obtaining the MAC address and IP address of the first terminal by using DHCP includes:

receiving a DHCP address request message sent by the first terminal, where the address request message includes the MAC address of the first terminal;

A DHCP address reply message is sent to the first terminal, where the address reply message includes the IP address of the first terminal.

That is to say, in this implementation manner, the vehicle-mounted controller may carry the DHCP server function. For example, the vehicle-mounted controller includes a gateway, and the gateway may specifically implement the DHCP server function. The DHCP server function refers to the assignment and management of IP addresses of all access terminals in the vehicle network.

In a possible implementation, it also includes:

It is detected that the specified update condition for the ARP mapping relationship table is met;

The ARP mapping relationship table is updated to obtain the updated ARP mapping relationship table;

The updated ARP mapping relationship table is sent to all access terminals in the vehicle-mounted network, so that any access terminal in the vehicle-mounted network performs data communication according to the updated ARP mapping relationship table.

That is to say, in this implementation manner, for the ARP mapping relationship table, when certain update conditions are met (for example, the ARP mapping relationship table changes), the vehicle controller will actively update and issue the updated ARP mapping relationship table, In this way, any access terminal in the in-vehicle network can avoid using the ARP mapping relationship table before updating for data communication but use the updated ARP mapping relationship table for data communication, thereby ensuring the accuracy of data communication.

Wherein, when the updated ARP mapping relationship table is sent to all access terminals in the vehicle network, the updated ARP mapping relationship table may be sent to all access terminals through the delivery system of the vehicle controller. The receiving system of all access terminals in the vehicle network described above.

In a possible implementation manner, the specified update condition includes: a second terminal accesses the in-vehicle network, and the second terminal is used to represent any terminal that is not connected to the in-vehicle network;

The described ARP mapping relationship table is updated to obtain the updated ARP mapping relationship table, including:

The mapping relationship between the MAC address and the IP address of the second terminal is added to the ARP mapping relationship table to obtain the updated ARP mapping relationship table.

That is to say, in this implementation, if a new terminal accesses the in-vehicle network, the in-vehicle controller needs to update the ARP mapping relationship table and issue the updated ARP mapping relationship table, so that the access in the in-vehicle network The terminal can perform data communication with the terminal newly connected to the vehicle network, which improves the communication efficiency.

In a possible implementation manner, the specified update condition includes: a third terminal disconnects the in-vehicle network, and the third terminal is used to represent any terminal that has accessed the in-vehicle network;

Delete the mapping relationship between the MAC address and the IP address of the third terminal from the ARP mapping relationship table to obtain the updated ARP mapping relationship table.

That is to say, in this implementation, if a terminal disconnects from the in-vehicle network, the in-vehicle controller needs to update the ARP mapping table and deliver the updated ARP mapping table, so that the access terminal in the in-vehicle network can Data communication with terminals disconnected from the in-vehicle network is no longer performed, thus avoiding data loss.

In a possible implementation, it also includes:

Detecting whether there is an ARP attack in the in-vehicle network through the virtual terminal of the in-vehicle controller;

If it is determined that there is an ARP attack in the in-vehicle network, the ARP attack device is marked, and the data whose target address is the MAC address of the ARP attack device is filtered out.

That is to say, in this implementation, the vehicle controller can actively attract attackers to carry out ARP attacks through virtual terminals, determine the attacker's MAC address, and restrict the attacker's network, which enriches the defense methods to prevent ARP attacks.

In a possible implementation manner, the detecting whether there is an ARP attack in the in-vehicle network through the virtual terminal of the in-vehicle controller includes:

Broadcast an ARP request message including a target IP address through the virtual terminal, where the target IP address is a known non-existent IP address or an IP address of a known gateway;

If the ARP reply message including the target MAC address is received, it is determined that there is an ARP attack in the vehicle network, and the ARP attack device is the device that sends the ARP reply message.

That is to say, in this implementation manner, the ARP request message is broadcast through the virtual terminal, and if an ARP reply message is received, the attacker's MAC address can be determined according to the ARP reply message, and network restrictions are imposed on the attacker (for example, discarding all data pointing to the attacker's MAC address).

In a second aspect, an embodiment of the present application provides a method for preventing ARP attacks, the method is used for any access terminal in a vehicle network, including:

Receive the ARP mapping relationship table sent by the vehicle-mounted controller of the vehicle-mounted network, where the ARP mapping relationship table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the vehicle-mounted network;

Data communication is performed according to the ARP mapping relationship table.

In a possible implementation manner, the receiving ARP mapping relationship table sent by the on-board controller of the on-board network includes:

The ARP mapping relationship table sent by the delivery system of the vehicle-mounted controller is received by the receiving system of the access terminal.

That is to say, in this implementation manner, the vehicle controller can send the ARP mapping relationship table through the delivery system, and the access terminal can receive the ARP mapping relationship table through the receiving system, which effectively prevents the in-vehicle network from the transmission path. ARP attack.

In a possible implementation, it also includes:

Receive the updated ARP mapping relationship table sent by the on-board controller;

Data communication is performed according to the updated ARP mapping relationship table.

Wherein, when receiving the updated ARP mapping relationship table sent by the on-board controller, the updated ARP mapping relationship table sent by the delivery system of the on-board controller may be received by the receiving system of the access terminal.

In a possible implementation manner, the access terminal is a device that accesses the in-vehicle network for the first time and does not include the receiving system; the method further includes:

Download and install the receiving system from the download page provided by the onboard controller.

That is to say, in this implementation manner, the on-board controller can provide a download mode for the access terminal, thereby ensuring that when the access terminal receives the ARP mapping relationship table, it can use the receiving system downloaded from the on-board controller to receive, Further, ARP attacks in the in-vehicle network are effectively prevented from the transmission path.

In a third aspect, an embodiment of the present application provides a device for preventing ARP attacks, and the device is used in an in-vehicle controller of an in-vehicle network, including:

an acquisition module, configured to acquire the media access control MAC addresses of all access terminals in the in-vehicle network and the IP addresses of the interconnection protocol between networks;

A generating module is used to generate an ARP mapping relationship table, and the ARP mapping relationship table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the vehicle network;

A first sending module, configured to send the ARP mapping relationship table to all access terminals in the in-vehicle network, so that any access terminal in the in-vehicle network performs data communication according to the ARP mapping relationship table.

In a possible implementation manner, the first sending module includes:

The sending submodule is configured to send the ARP mapping relationship table to the receiving systems of all access terminals in the on-board network through the delivery system of the on-board controller.

In a possible implementation manner, the obtaining module includes:

The obtaining submodule is used for obtaining the MAC address and IP address of the first terminal by using the dynamic host configuration protocol DHCP, where the first terminal is used to represent any access terminal in the vehicle network.

In a possible implementation manner, the obtaining submodule includes:

a receiving unit, configured to receive a DHCP address request message sent by the first terminal, where the address request message includes the MAC address of the first terminal;

A sending unit, configured to send a DHCP address reply message to the first terminal, where the address reply message includes the IP address of the first terminal.

In a possible implementation, it also includes:

a first detection module, configured to detect that a specified update condition for the ARP mapping relationship table is met;

an update module for updating the ARP mapping relationship table to obtain the updated ARP mapping relationship table;

The second sending module is configured to send the updated ARP mapping relationship table to all access terminals in the vehicle network, so that any access terminal in the vehicle network can use the updated ARP mapping relationship according to the updated ARP mapping relationship. table for data communication.

In a possible implementation manner, the specified update condition includes: a second terminal accesses the vehicle network, and the second terminal is used to represent any terminal that is not connected to the vehicle network; the update module include:

The adding submodule is configured to add the mapping relationship between the MAC address and the IP address of the second terminal to the ARP mapping relationship table to obtain the updated ARP mapping relationship table.

In a possible implementation manner, the specified update condition includes: a third terminal disconnects from the in-vehicle network, and the third terminal is used to represent any terminal that has accessed the in-vehicle network; the update module include:

A deletion sub-module is configured to delete the mapping relationship between the MAC address and the IP address of the third terminal from the ARP mapping relationship table to obtain the updated ARP mapping relationship table.

In a possible implementation, it also includes:

a second detection module, configured to detect whether there is an ARP attack in the vehicle network through the virtual terminal of the vehicle controller;

The marking module is configured to mark the ARP attacking device if it is determined that there is an ARP attack in the vehicle network, and filter out the data whose target address is the MAC address of the ARP attacking device.

In a possible implementation, the second detection module includes:

A broadcast submodule, configured to broadcast an ARP request message including a target IP address through the virtual terminal, where the target IP address is a known IP address that does not exist or the IP address of a known gateway;

The determining submodule is configured to determine that an ARP attack exists in the in-vehicle network if an ARP reply message including the target MAC address is received, and the ARP attack device is the device that sends the ARP reply message.

In a fourth aspect, an embodiment of the present application provides a device for preventing ARP attacks, where the device is used for any access terminal in a vehicle network, including:

The first receiving module is configured to receive the ARP mapping relationship table sent by the vehicle-mounted controller of the vehicle-mounted network, where the ARP mapping relationship table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the vehicle-mounted network ;

The first communication module is configured to perform data communication according to the ARP mapping relationship table.

In a possible implementation manner, the first receiving module includes:

The receiving sub-module is configured to receive, through the receiving system of the access terminal, the ARP mapping relationship table sent by the delivery system of the vehicle-mounted controller.

In a possible implementation, it also includes:

The second receiving module is used for receiving the updated ARP mapping relationship table sent by the on-board controller;

The second communication module is configured to perform data communication according to the updated ARP mapping relationship table.

In a possible implementation manner, the access terminal is a device that accesses the in-vehicle network for the first time and does not include the receiving system; the apparatus further includes:

A download and installation module is used to download and install the receiving system from a download page provided by the vehicle-mounted controller.

In a fifth aspect, an embodiment of the present application provides an apparatus for preventing ARP attacks, the apparatus is used in an in-vehicle controller of an in-vehicle network, and the apparatus includes: a processor, a memory, and a transceiver;

the memory for storing computer instructions;

When the apparatus operates, the processor executes the computer instructions to cause the apparatus to perform the method of the first aspect.

In a sixth aspect, an embodiment of the present application provides an apparatus for preventing ARP attacks, the apparatus is used for any access terminal in an in-vehicle network, and the apparatus includes: a processor, a memory, and a transceiver;

the memory for storing computer instructions;

When the apparatus operates, the processor executes the computer instructions to cause the apparatus to perform the method of the second aspect.

In a seventh aspect, an embodiment of the present application provides a communication system, including a vehicle-mounted controller and one or more access terminals;

Wherein, the in-vehicle controller includes the device described in the third aspect; the access terminal includes the device described in the fourth aspect.

In an eighth aspect, an embodiment of the present application provides a computer storage medium, where the computer storage medium includes computer instructions, when the computer instructions are run on an in-vehicle controller of an in-vehicle network, the in-vehicle controller is made to execute the The method described in one aspect.

In a ninth aspect, an embodiment of the present application provides a computer storage medium, where the computer storage medium includes computer instructions, and when the computer instructions are run on a terminal device in a vehicle network, the terminal device is made to execute the second aspect the method described.

The present application discloses a method, device and system for preventing ARP attacks. The on-board controller of the on-board network generates an ARP mapping relationship table by acquiring the MAC addresses and IP addresses of all access terminals in the on-board network, and the ARP mapping relationship table includes: The mapping relationship between the MAC addresses and IP addresses of all access terminals in the in-vehicle network, and the ARP mapping table is sent to the receiving system of all access terminals in the in-vehicle network through the issuing system of the in-vehicle controller, so that in the in-vehicle network Any access terminal can perform data communication according to the ARP mapping relationship table, thereby effectively preventing ARP attacks in the in-vehicle network and ensuring the reliability of data communication.

Description of drawings

Figure 1 is a schematic diagram of an ARP attack scenario;

Fig. 2 is a kind of vehicle-mounted network schematic diagram;

FIG. 3 is a schematic diagram of an implementation manner of preventing ARP attacks;

FIG. 4 is a schematic diagram of an implementation manner of preventing ARP attacks;

5 is a schematic flowchart of a method for preventing an ARP attack provided by an embodiment of the present application;

6 is a schematic flowchart of a method for preventing an ARP attack provided by an embodiment of the present application;

7 is a schematic structural diagram of an apparatus for preventing ARP attacks provided by an embodiment of the present application;

8 is a schematic structural diagram of an apparatus for preventing ARP attacks provided by an embodiment of the present application;

FIG. 9 is a schematic structural diagram of a terminal provided by an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments.

In the description of this specification, "one embodiment" or "some embodiments" etc. means that a particular feature, structure or characteristic described in connection with the embodiment is included in one or more embodiments of the present application. Thus, appearances of the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in other embodiments," etc. in various places in this specification are not necessarily All refer to the same embodiment, but mean "one or more but not all embodiments" unless specifically emphasized otherwise.

Wherein, in the description of this specification, unless otherwise stated, "/" means or means, for example, A/B can mean A or B; "and/or" in this document is only an association to describe the associated object Relation, it means that there can be three kinds of relations, for example, A and/or B can mean that A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "plurality" refers to two or more than two.

In the description of this specification, the terms "first" and "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implying the number of indicated technical features. Thus, a feature defined as "first" or "second" may expressly or implicitly include one or more of that feature. The terms "including", "including", "having" and their variants mean "including but not limited to" unless specifically emphasized otherwise.

The basic function of ARP is to query the MAC address of the target device through the IP address of the target device to ensure smooth communication. ARP spoofing means that the attacker makes the network communication abnormal by sending wrong ARP information.

In the in-vehicle environment, the attacker usually uses the cracked vehicle WIFI password to enter the vehicle network to conduct ARP spoofing to attack the terminal device. After the attack is successful, the MAC address of the gateway in the attacker's ARP mapping table is changed to the attacker's MAC address. The attacker's data stream becomes sent to the attacker, and the attacker can hijack the traffic to obtain sensitive information. As shown in Figure 1, the in-vehicle entertainment system IVI (In-Vehicle Infotainment, in-vehicle infotainment system) includes the owner's mobile phone A and the attacker B (IP-B, MAC-B); the attacker B performs ARP on the owner's mobile phone A. Before the attack, the gateway list in the ARP mapping table of car owner mobile phone A is: IP-A, MAC-A, and the Internet access path of car owner mobile phone A is: car owner mobile phone A - gateway - Internet; After the ARP attack, the gateway list in the ARP mapping relationship table of the owner's mobile phone A is changed to: IP-A, MAC-B, and the Internet path of the owner's mobile phone A is changed: the owner's mobile phone A - the attacker B - the gateway - the Internet, The car owner's mobile phone A sends the data that should be sent directly to the gateway to the attacker B, so that the attacker B hijacks the traffic of the car owner's mobile phone A, and can carry out phishing, tampering, sniffing and other attacks.

In order to prevent ARP attacks, the implementation methods that can be used include: 1. The gateway is bound to the device IP and MAC address, and the terminal is bound to the gateway IP and MAC address; 2. Install an ARP firewall to monitor the ARP mapping table, if an abnormal change request occurs That is, the change action is blocked; 3. The ARP server is used to maintain the ARP mapping table, and the terminal is addressed through the IP and MAC mapping table maintained by the ARP server. However, the shortcomings of the above-mentioned implementation methods include: 1. Two-way binding requires manual operation. If the ARP mapping table is frequently replaced, a lot of workload will be generated, and it is difficult to configure the connected devices in the in-vehicle environment; 2. When the ARP firewall is installed in the mobile terminal environment, when the mobile terminal network changes, such as changing the WIFI environment or changing the gateway, the ARP firewall may not be able to correctly refresh the gateway IP and MAC mapping relationship, resulting in denial of service. 3. Additional equipment bearer services are required in the car. If the ARP server is attacked, tampering with the device IP and MAC mapping table will cause all terminals to be attacked by ARP.

Therefore, in order to better prevent ARP attacks, the present application provides a method, device and system for preventing ARP attacks. The in-vehicle controller of the in-vehicle network generates ARP by acquiring the MAC addresses and IP addresses of all access terminals in the in-vehicle network. Mapping relationship table, the ARP mapping relationship table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the vehicle network, and the ARP mapping relationship table is sent to all access terminals in the vehicle network through the delivery system of the vehicle controller. The terminal receiving system, so that any access terminal in the vehicle network can perform data communication according to the ARP mapping relationship table, thereby effectively preventing ARP attacks in the vehicle network and ensuring the reliability of data communication.

It should be noted:

The in-vehicle network involved in this application may be an in-vehicle local area network, which belongs to the category of local area networks. Specifically, the in-vehicle network may be a wireless AP (Access Point, access point) function provided by the in-vehicle controller, such as a wireless hotspot, WIFI, and the like.

The access terminal involved in this application may also be referred to as UE (User Equipment, user equipment) and the like. Access terminals include but are not limited to handheld devices and vehicle-mounted devices. For example, it can be a mobile phone, a tablet computer, a notebook computer, a UMPC (Ultra-Mobile Personal Computer, an ultra-mobile personal computer), a netbook, or a PDA (Personal Digital Assistant, a personal digital assistant).

The following description will be given through specific embodiments.

Fig. 2 is a schematic diagram of an in-vehicle network; as shown in Fig. 2, an in-vehicle controller of the in-vehicle network, such as a CDC (Cockpit Domain Controller, intelligent cockpit domain controller), includes a gateway, a delivery system, and a virtual terminal.

It should be noted that, in the embodiments of the present application, the on-board controller may refer to an operating system that combines software and hardware, and the gateway, the delivery system, and the virtual terminal are all functional modules in the operating system.

Among them, the function implemented by the gateway is: using DHCP (Dynamic Host Configuration Protocol, dynamic host configuration protocol) to obtain the MAC (Medium Access Control, medium access control) addresses and IP (Internet Protocol, between the network) of all access terminals in the vehicle network interconnection protocol) address, and generate an ARP mapping relationship table according to the MAC addresses and IP addresses of all access terminals in the vehicle network, the ARP mapping relationship table includes the mapping between the MAC addresses and IP addresses of all access terminals in the vehicle network relation.

It should be noted that DHCP is a network protocol applied to a local area network, which allows servers to dynamically assign IP addresses and configuration information to clients. In this embodiment of the present application, the gateway may dynamically allocate IP addresses and configuration information to each terminal in the vehicle network.

The function implemented by the delivery system is: sending the ARP mapping relationship table to the receiving systems of all access terminals in the vehicle network. Exemplarily, the delivery system may be a delivery software; correspondingly, the receiving system may be receiving software corresponding to the delivered software.

The function implemented by the virtual terminal is to send an ARP broadcast request to detect whether there is an ARP attack in the vehicle network. If there is an ARP attack, the gateway will mark the ARP attack device and discard all data pointing to the MAC address of the ARP attack device.

It can be seen that in the embodiment of the present application, the vehicle controller can send the ARP mapping table to the receiving systems of all access terminals in the vehicle network through the delivery system, and detect ARP attacks through the virtual terminal, and the combination of the two can prevent ARP attack.

It should be noted that if the terminal device is connected to the in-vehicle network for the first time and the receiving system is not installed, after the terminal device is connected to the in-vehicle network, the in-vehicle controller can enable the terminal device to open the download page through the captive portal to download and install The receiving system that receives the ARP mapping table. Exemplarily, when the terminal device is connected to the in-vehicle network, it will go to the download page to download the software, and the downloaded software is used to receive the ARP mapping relationship table and update the ARP mapping relationship table stored locally by the terminal device according to the received ARP mapping relationship table. .

Figure 3 is a schematic diagram of an implementation manner of preventing ARP attacks; as shown in Figure 3, the implementation manner of preventing ARP attacks is to actively update the ARP mapping relationship table, and its specific implementation process includes:

(1) When the terminal device is connected to the in-vehicle network, the in-vehicle controller (eg, CDC) obtains the IP and MAC address of the access terminal according to DHCP, and generates an ARP mapping relationship table according to the IP and MAC address of the access terminal. Exemplarily, the terminal device sends the device MAC to apply for an IP address to the gateway of the vehicle controller, and the gateway of the vehicle controller issues the IP address allocated by the gateway to the terminal device.

It should be noted that after receiving the IP address assigned by the gateway, the terminal device can connect to the Internet, but may be attacked by ARP.

(2) When the terminal device connected to the vehicle network for the first time is connected to the Internet, it will be transferred to the download page for software download. The software is mainly used to receive the ARP mapping relationship table issued by the vehicle controller, and update the ARP mapping relationship table according to the received ARP mapping relationship table. The ARP mapping table saved locally by the terminal device.

(3) The on-board controller issues the ARP mapping relationship table through the issuing system, and the receiving system in the terminal updates according to the issued ARP mapping relationship table, which is convenient for preventing ARP attacks in the local area network. The gateway or other terminal of the controller conducts data communication.

It should be noted that the terminal only performs data communication with the gateway or other terminals of the vehicle controller according to the ARP mapping relationship table issued by the vehicle controller, which not only prevents ARP attacks in the vehicle network, but also ensures the reliability of data communication.

(4) When any device is connected to the in-vehicle network or disconnected from the in-vehicle network, the in-vehicle controller will update the ARP mapping relationship table and issue the updated ARP mapping relationship table.

Therefore, through the above solution, it can be solved that in the vehicle environment, the terminal device and the vehicle-mounted controller perform bidirectional IP and MAC address configuration steps that require manual configuration; and, by flexibly updating the ARP mapping relationship between the vehicle-mounted controller and the access terminal Table, solves the terminal denial of service problem caused by the ARP firewall preventing the update of the normal ARP mapping relationship table caused by changes in the network environment. specific

It can be understood that because the gateway binds the device IP and MAC address, and the terminal binds the gateway IP and MAC address, when a terminal device accesses the network, it is necessary to manually bind the IP address and MAC address on the terminal device and the gateway in both directions; but The present application can automatically bind the issuing system and the receiving system (for example, issuing software and receiving software), so as to solve the trouble of inconvenient manual configuration.

Since the ARP firewall is installed to monitor the ARP mapping table, if an abnormal change request occurs, the change action will be blocked. However, when the ARP firewall is installed in the mobile terminal environment, when the mobile terminal network changes, such as changing the WIFI environment or changing the gateway, the ARP The firewall may cause the gateway IP and MAC mapping relationship to be incorrectly refreshed, resulting in denial of service; while this application flexibly manages the ARP mapping relationship table between the gateway and other terminal devices through the distribution system and the receiving system (for example, the distribution software and the receiving software). After the terminal device leaves the in-vehicle network, if the receiving software does not receive the data to update the ARP mapping table, it will no longer maintain the APR table to ensure that the terminal device can still access the Internet normally after leaving the in-vehicle network, thus solving the problems caused by changes in the network environment. Terminal denial of service problem caused by ARP firewall blocking normal ARP mapping table update.

Figure 4 is a schematic diagram of an implementation of preventing ARP attacks; as shown in Figure 4, the implementation of preventing ARP attacks is to detect ARP attacks through virtual terminals, and the specific implementation process includes:

(2) The vehicle-mounted controller performs ARP broadcast through the virtual terminal, that is, requests a MAC address of an unused IP address through the virtual terminal broadcast. Exemplarily, the ARP broadcast message sent by the virtual terminal is: who has x.x.x.x (addressed IP) tell x.x.x.x (virtual terminal IP). Wherein, the addressing IP is the IP that is not used in the DHCP service application or the gateway IP.

(3) If the device in the vehicle network has an ARP attack tendency, the attacking device will respond with an ARP reply. Exemplarily, the ARP reply text responded by the attacking device is: x.x.x.x (addressed IP) is at x:x:x:x:x:x (attacker MAC).

(4) The on-board controller determines whether there is an ARP attack by detecting whether the virtual terminal receives an ARP response.

Specifically, if the virtual terminal receives an ARP response, it is determined that the device performing the ARP response is conducting an ARP attack, and the vehicle-mounted controller records and filters the data whose target address is the attacker's MAC.

Therefore, through the above solution, an attacker can be attracted to conduct an ARP attack through a virtual terminal, and the IP and MAC address of the attacker can be determined, and by acquiring the attacker information, the joint gateway can restrict the network of the attacker.

Next, please refer to FIG. 5 . FIG. 5 is a schematic flowchart of a method for preventing ARP attacks provided by an embodiment of the present application, and the method can be used in an on-board controller (eg, CDC) of an on-board network; as shown in FIG. 5 , the method may include the following steps:

S501. Acquire the MAC addresses and IP addresses of all access terminals in the vehicle network.

As an embodiment, as shown in FIG. 2 , the in-vehicle controller may obtain the MAC address and IP address of the first terminal by using DHCP, and the first terminal is used to represent any access terminal in the in-vehicle network. For example: the vehicle-mounted controller receives a DHCP address request message sent by the first terminal, where the address request message includes the MAC address of the first terminal; and sends a DHCP address reply message to the first terminal, where the address reply message includes the IP address of the first terminal, which The implementation process is specifically shown in FIG. 3 or FIG. 4 .

S502. Generate an ARP mapping relationship table, where the ARP mapping relationship table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the vehicle network.

S503: Send the ARP mapping relationship table to all access terminals in the in-vehicle network, so that any access terminal in the in-vehicle network performs data communication according to the ARP mapping relationship table.

As an embodiment, as shown in FIG. 2 , the in-vehicle controller may send the ARP mapping relationship table to the receiving systems of all access terminals in the in-vehicle network through the delivery system. The delivery system may be the first application APP, the receiving system may be the second APP, and the first APP and the second APP are the same. That is to say, the issuing system and the receiving system can be the same application APP.

It can be seen that the in-vehicle controller is responsible for maintaining the ARP mapping relationship table including the mapping relationship between the MAC addresses and IP addresses of all access terminals in the in-vehicle network, and sends the ARP mapping relationship table through the delivery system, and the access terminal receives it through the receiving system. ARP mapping relationship table, which effectively prevents ARP attacks in the in-vehicle network from the transmission path; and only after receiving the ARP mapping relationship table issued by the vehicle controller, the access terminal will perform data processing according to the ARP mapping relationship table. In this way, the on-board controller maintains the ARP mapping relationship table of all access terminals in the on-board network, thereby ensuring the reliability of data communication between the access terminal and other access terminals.

As an embodiment, when the on-board controller detects that the specified update condition of the ARP mapping relationship table is satisfied, it can update the ARP mapping relationship table to obtain the updated ARP mapping relationship table; It is sent to all access terminals in the in-vehicle network, so that any access terminal in the in-vehicle network performs data communication according to the updated ARP mapping relationship table.

For example, the specified update conditions include: the second terminal is connected to the in-vehicle network, and the second terminal is used to represent any terminal that is not connected to the in-vehicle network; the in-vehicle controller will map the MAC address and IP address of the second terminal. Add to the ARP mapping relationship table, obtain the updated ARP mapping relationship table, and send the updated ARP mapping relationship table to all access terminals in the vehicle network.

Another example: the specified update conditions include: the third terminal is disconnected from the in-vehicle network, and the third terminal is used to represent any terminal that has been connected to the in-vehicle network; the in-vehicle controller will delete the third terminal's MAC address and The mapping relationship between the IP addresses is obtained, and the updated ARP mapping relationship table is obtained, and the updated ARP mapping relationship table is sent to all access terminals in the vehicle network.

It can be seen that the on-board controller is responsible for updating the ARP mapping relationship table, and sending the updated ARP mapping relationship table to all access terminals in the on-board network, so that any access terminal in the on-board network can perform operations according to the updated ARP mapping relationship table. Data communication further ensures the reliability of data communication between the access terminal and other access terminals.

As an embodiment, the vehicle controller can also detect whether there is an ARP attack in the vehicle network through the virtual terminal; if it is determined that there is an ARP attack in the vehicle network, it will mark the ARP attack device, and filter out the MAC address of the ARP attack device. address data.

For example, as shown in Figure 4, an ARP request message including the target IP address is broadcast through the virtual terminal, and the target IP address is a known non-existent IP address or an IP address of a known gateway; if an ARP reply including the target MAC address is received message, it is determined that there is an ARP attack in the in-vehicle network, and the ARP attack device is the device that sends the ARP reply message.

It can be seen that the vehicle controller can actively attract attackers to carry out ARP attacks through virtual terminals, determine the attacker's MAC address, and restrict the attacker's network, which enriches the defense methods to prevent ARP attacks.

6 is a schematic flowchart of a method for preventing ARP attacks provided by an embodiment of the present application, and the method can be used for any access terminal in a vehicle-mounted network; as shown in FIG. 6 , the method may include the following steps:

S601. Receive an ARP mapping relationship table sent by an on-board controller (eg, CDC) of the on-board network, where the ARP mapping relationship table includes the mapping relationship between MAC addresses and IP addresses of all access terminals in the on-board network.

As an embodiment, as shown in FIG. 2 , the access terminal may receive, through the receiving system, the ARP mapping relationship table sent by the delivery system of the vehicle-mounted controller of the vehicle-mounted network. The delivery system may be the first application APP, the receiving system may be the second APP, and the first APP and the second APP are the same. That is to say, the issuing system and the receiving system can be the same application APP.

S602. Perform data communication according to the ARP mapping relationship table.

As an embodiment, as shown in FIG. 2 , the access terminal may also receive, through the receiving system, the updated ARP mapping relationship table sent by the delivery system of the vehicle-mounted controller.

As an embodiment, the access terminal is a device that accesses the in-vehicle network for the first time and does not include the receiving system; the access terminal can download and install the receiving system from a download page provided by the in-vehicle controller.

It can be seen that the on-board controller can provide a download method for the access terminal, thereby ensuring that the access terminal can use the receiving system downloaded from the on-board controller to receive the ARP mapping table, which further effectively prevents the transmission path from being blocked. ARP attacks within in-vehicle networks.

Fig. 7 is a structural schematic diagram of a device for preventing ARP attacks provided by an embodiment of the present application, and the device can be used for a vehicle-mounted controller (for example, CDC) of a vehicle-mounted network; as shown in Fig. 7, the device can include:

An acquisition module 71, configured to acquire the MAC address of the medium access control of all the access terminals in the vehicle network and the IP address of the interconnection protocol between networks;

A generating module 72, configured to generate an ARP mapping relationship table, where the ARP mapping relationship table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the vehicle network;

The first sending module 73 is configured to send the ARP mapping relationship table to all access terminals in the in-vehicle network, so that any access terminal in the in-vehicle network performs data communication according to the ARP mapping relationship table.

As an embodiment, the first sending module 73 may include:

As an embodiment, the sending system is a first application APP, the receiving system is a second APP, and the first APP and the second APP are the same.

As an embodiment, the obtaining module 71 may include:

As an embodiment, the obtaining submodule may include:

As an embodiment, the device for preventing ARP attacks may further include:

As an embodiment, the specified update condition includes: a second terminal accesses the in-vehicle network, and the second terminal is used to represent any terminal that is not connected to the in-vehicle network; the update module includes:

As an embodiment, the specified update condition includes: a third terminal disconnects the in-vehicle network, and the third terminal is used to represent any terminal that has accessed the in-vehicle network; the update module includes:

As an embodiment, the device for preventing ARP attacks may further include:

The marking module is configured to mark the ARP attack device if it is determined that there is an ARP attack in the vehicle network, and filter out the data whose target address is the MAC address of the ARP attack device.

As an embodiment, the second detection module includes:

It should be understood that the above-mentioned apparatus is used to execute the method for preventing ARP attacks in the above-mentioned FIG. 5, and the corresponding program modules in the apparatus have similar implementation principles and technical effects as described in the above-mentioned method for preventing ARP attacks in FIG. 5. , the working process of the apparatus may refer to the corresponding process in the method for preventing ARP attack in the above-mentioned FIG. 5 , which will not be repeated here.

FIG. 8 is a schematic structural diagram of an apparatus for preventing ARP attacks provided by an embodiment of the present application, and the apparatus can be used for any access terminal in a vehicle-mounted network; as shown in FIG. 8 , the apparatus may include:

The first receiving module 81 is configured to receive the ARP mapping relationship table sent by the delivery system of the vehicle-mounted controller (for example, CDC) of the vehicle-mounted network, where the ARP mapping relationship table includes the information of all access terminals in the vehicle-mounted network. The mapping relationship between MAC address and IP address;

The first communication module 82 is configured to perform data communication according to the ARP mapping relationship table.

As an embodiment, the first receiving module 81 includes:

As an embodiment, the device for preventing ARP attacks may further include:

As an embodiment, the access terminal is a device that accesses the in-vehicle network for the first time and does not include the receiving system; the device for preventing ARP attacks may further include:

It should be understood that the above-mentioned apparatus is used to execute the method for preventing ARP attack in the above-mentioned FIG. 6 , and the corresponding program modules in the apparatus have similar implementation principles and technical effects as described in the above-mentioned method for preventing ARP attack in FIG. 6 . , the working process of the apparatus may refer to the corresponding process in the method for preventing ARP attacks in FIG. 6 , which will not be repeated here.

FIG. 9 is a schematic structural diagram of a terminal provided by an embodiment of the present application, where the terminal can implement the functions of the terminal in the foregoing method embodiment. For ease of description, Figure 9 illustrates the main components of the terminal, as shown in Figure 9:

The terminal includes at least one processor 611 , at least one transceiver 612 and at least one memory 613 . The processor 611 , the memory 613 and the transceiver 612 are connected. Optionally, the terminal may further include an output device 614 , an input device 615 and one or more antennas 616 . The antenna 616 is connected to the transceiver 612 , and the output device 614 and the input device 615 are connected to the processor 611 .

The processor 611 is mainly used to process communication protocols and communication data, control the entire terminal, execute software programs, and process data of the software programs.

As an optional implementation manner, the terminal device may include a baseband processor and a central processing unit. The baseband processor is mainly used to process communication protocols and communication data. The central processing unit is mainly used to control the entire terminal equipment, execute software programs, and process data of software programs.

The processor in FIG. 9 may integrate the functions of the baseband processor and the central processing unit. Those skilled in the art can understand that the baseband processor and the central processing unit may also be independent processors, interconnected by technologies such as a bus. Those skilled in the art can understand that a terminal device may include multiple baseband processors to adapt to different network standards, a terminal device may include multiple central processors to enhance its processing capability, and various components of the terminal device may be connected through various buses. The baseband processor may also be expressed as a baseband processing circuit or a baseband processing chip. The central processing unit can also be expressed as a central processing circuit or a central processing chip. The function of processing the communication protocol and communication data may be built in the processor, or may be stored in the memory in the form of a software program, and the processor executes the software program to realize the baseband processing function.

The memory 613 is mainly used to store software programs and data. The memory 613 may exist independently and be connected to the processor 611 . Optionally, the memory 613 may be integrated with the processor 611, for example, integrated within a chip, that is, an on-chip memory, or the memory 613 is an independent storage element, which is not limited in this embodiment of the present application. The memory 613 can store program codes for implementing the technical solutions of the embodiments of the present application, and is controlled and executed by the processor 611 .

The transceiver 612 can be used for converting the baseband signal to the radio frequency signal and processing the radio frequency signal, and the transceiver 612 can be connected to the antenna 616 . The transceiver 612 includes a transmitter (Tx) and a receiver (Rx). Specifically, one or more antennas 616 may receive radio frequency signals, and the receiver Rx of the transceiver 612 is configured to receive the radio frequency signals from the antennas, convert the radio frequency signals into digital baseband signals or digital intermediate frequency signals, and convert the digital The baseband signal or digital intermediate frequency signal is provided to the processor 611, so that the processor 611 performs further processing on the digital baseband signal or digital intermediate frequency signal, such as demodulation processing and decoding processing. In addition, the transmitter Tx in the transceiver 612 is used for receiving the modulated digital baseband signal or the digital intermediate frequency signal from the processor 611, and converting the modulated digital baseband signal or the digital intermediate frequency signal into a radio frequency signal, and passing through an or A plurality of antennas 616 transmit the radio frequency signals. Specifically, the receiver Rx can selectively perform one or more stages of down-mixing processing and analog-to-digital conversion processing on the radio frequency signal to obtain a digital baseband signal or a digital intermediate frequency signal. The order of precedence is adjustable. The transmitter Tx can selectively perform one or more stages of up-mixing processing and digital-to-analog conversion processing on the modulated digital baseband signal or digital intermediate frequency signal to obtain a radio frequency signal, and the up-mixing processing and digital-to-analog conversion processing The sequence of s is adjustable. Digital baseband signals and digital intermediate frequency signals can be collectively referred to as digital signals. Optionally, the transmitter Tx and the receiver Rx may be implemented by different physical structures/circuits, or may be implemented by the same physical structure/circuit, that is, the transmitter Tx and the receiver Rx may be inherited together.

A transceiver may also be referred to as a transceiver unit, a transceiver, a transceiver, or the like. Optionally, the device used to implement the receiving function in the transceiver unit may be regarded as a receiving unit, and the device used to implement the transmitting function in the transceiver unit may be regarded as a transmitting unit, that is, the transceiver unit includes a receiving unit and a transmitting unit, and the receiving unit also It can be called a receiver, an input port, a receiving circuit, etc., and the sending unit can be called a transmitter, a transmitter, or a transmitting circuit, etc. Alternatively, a combination of Tx, Rx and antenna can be used as a transceiver.

Output device 614 displays information in a variety of ways. For example, the output device 614 may be a Liquid Crystal Display (LCD), a Light Emitting Diode (LED) display device, a Cathode Ray Tube (CRT) display device, or a projector (projector) Wait. Input device 615 may accept user input in a variety of ways. For example, the input device 615 may be a mouse, a keyboard, a touch screen device, a sensor device, or the like.

Embodiments of the present application also provide a communication system, including an on-board controller and one or more access terminals; wherein, the on-board controller can execute a method for preventing ARP attacks on the on-board controller side; the access terminal can A method for preventing ARP attacks on the terminal side is performed.

Embodiments of the present application further provide a computer storage medium, where the computer storage medium includes computer instructions, when the computer instructions are executed on the vehicle-mounted controller, the vehicle-mounted controller can execute the method for preventing ARP attacks on the vehicle-mounted controller side .

Embodiments of the present application also provide a computer storage medium, where the computer storage medium includes computer instructions, when the computer instructions are executed on the access terminal, the access terminal can execute the method for preventing ARP attacks on the terminal side.

It can be understood that the processor in the embodiments of the present application may be a central processing unit (central processing unit, CPU), and may also be other general-purpose processors, digital signal processors (digital signal processors, DSP), application-specific integrated circuits (application specific integrated circuit, ASIC), field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. A general-purpose processor may be a microprocessor or any conventional processor.

The method steps in the embodiments of the present application may be implemented in a hardware manner, or may be implemented in a manner in which a processor executes software instructions. Software instructions can be composed of corresponding software modules, and software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (programmable rom) , PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically erasable programmable read-only memory (electrically EPROM, EEPROM), registers, hard disks, removable hard disks, CD-ROMs or known in the art in any other form of storage medium. An exemplary storage medium is coupled to the processor, such that the processor can read information from, and write information to, the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and storage medium may reside in an ASIC.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented in software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, special purpose computer, computer network, or other programmable device. The computer instructions may be stored in or transmitted over a computer-readable storage medium. The computer instructions can be sent from one website site, computer, server, or data center to another website site by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.) , computer, server or data center. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes an integration of one or more available media. The usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.

It can be understood that, the various numbers and numbers involved in the embodiments of the present application are only for the convenience of description, and are not used to limit the scope of the embodiments of the present application.

Claims

A method for preventing ARP attacks, characterized in that the method is used in a vehicle-mounted controller of a vehicle-mounted network, comprising:

Acquiring the MAC address of the medium access control and the IP address of the interconnection protocol between the networks of all access terminals in the vehicle network;

generating an ARP mapping relationship table, where the ARP mapping relationship table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the vehicle network;

Sending the ARP mapping relationship table to all access terminals in the vehicle network, so that any access terminal in the vehicle network performs data communication according to the ARP mapping relationship table.
The method according to claim 1, wherein the sending the ARP mapping relationship table to all access terminals in the in-vehicle network comprises:

The ARP mapping relationship table is sent to the receiving systems of all access terminals in the in-vehicle network through the issuing system of the in-vehicle controller.
The method according to claim 2, wherein the sending system is a first application APP, the receiving system is a second APP, and the first APP and the second APP are the same.
The method according to claim 1, wherein the acquiring the MAC addresses and IP addresses of all access terminals in the in-vehicle network comprises:

The MAC address and IP address of the first terminal are obtained by using the dynamic host configuration protocol DHCP, where the first terminal is used to represent any access terminal in the vehicle network.
The method according to claim 4, wherein the obtaining the MAC address and the IP address of the first terminal by using DHCP comprises:

receiving a DHCP address request message sent by the first terminal, where the address request message includes the MAC address of the first terminal;

A DHCP address reply message is sent to the first terminal, where the address reply message includes the IP address of the first terminal.
The method of claim 1, further comprising:

It is detected that the specified update condition for the ARP mapping relationship table is met;

The ARP mapping relationship table is updated to obtain the updated ARP mapping relationship table;

The updated ARP mapping relationship table is sent to all access terminals in the vehicle-mounted network, so that any access terminal in the vehicle-mounted network performs data communication according to the updated ARP mapping relationship table.
The method according to claim 6, wherein the specified update condition comprises: a second terminal accessing the in-vehicle network, and the second terminal is used to represent any terminal that is not connected to the in-vehicle network;

The described ARP mapping relationship table is updated to obtain the updated ARP mapping relationship table, including:

The mapping relationship between the MAC address and the IP address of the second terminal is added to the ARP mapping relationship table to obtain the updated ARP mapping relationship table.
The method according to claim 6, wherein the specified update condition comprises: a third terminal disconnects the vehicle network, and the third terminal is used to represent any terminal that has accessed the vehicle network;

The described ARP mapping relationship table is updated to obtain the updated ARP mapping relationship table, including:

Delete the mapping relationship between the MAC address and the IP address of the third terminal from the ARP mapping relationship table to obtain the updated ARP mapping relationship table.
The method of claim 1, further comprising:

Detecting whether there is an ARP attack in the in-vehicle network through the virtual terminal of the in-vehicle controller;

If it is determined that there is an ARP attack in the in-vehicle network, the ARP attack device is marked, and the data whose target address is the MAC address of the ARP attack device is filtered out.
The method according to claim 9, wherein the detecting whether there is an ARP attack in the in-vehicle network through the virtual terminal of the in-vehicle controller comprises:

Broadcast an ARP request message including a target IP address through the virtual terminal, where the target IP address is a known non-existent IP address or an IP address of a known gateway;

If the ARP reply message including the target MAC address is received, it is determined that there is an ARP attack in the vehicle network, and the ARP attack device is the device that sends the ARP reply message.
A method for preventing ARP attacks, wherein the method is used for any access terminal in a vehicle network, comprising:

Receive the ARP mapping relationship table sent by the vehicle-mounted controller of the vehicle-mounted network, where the ARP mapping relationship table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the vehicle-mounted network;

Data communication is performed according to the ARP mapping relationship table.
The method according to claim 11, wherein the receiving the ARP mapping relationship table sent by the on-board controller of the on-board network comprises:

The ARP mapping relationship table sent by the delivery system of the vehicle-mounted controller is received by the receiving system of the access terminal.
The method according to claim 12, wherein the sending system is a first application APP, the receiving system is a second APP, and the first APP and the second APP are the same.
The method of claim 11, further comprising:

Receive the updated ARP mapping relationship table sent by the on-board controller;

Data communication is performed according to the updated ARP mapping relationship table.
The method according to claim 12 or 13, wherein the access terminal is a device that accesses the in-vehicle network for the first time and does not include the receiving system; the method further comprises:

Download and install the receiving system from the download page provided by the onboard controller.
A device for preventing ARP attacks, characterized in that the device is used for a vehicle-mounted controller of a vehicle-mounted network, comprising:

an acquisition module, configured to acquire the media access control MAC addresses of all access terminals in the in-vehicle network and the IP addresses of the interconnection protocol between networks;

A generating module, configured to generate an ARP mapping relationship table, where the ARP mapping relationship table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the vehicle network;

The first sending module is configured to send the ARP mapping relationship table to all access terminals in the vehicle network, so that any access terminal in the vehicle network can perform data communication according to the ARP mapping relationship table.
The apparatus according to claim 16, wherein the first sending module comprises:

The sending submodule is configured to send the ARP mapping relationship table to the receiving systems of all access terminals in the on-board network through the delivery system of the on-board controller.
The apparatus according to claim 17, wherein the sending system is a first application APP, the receiving system is a second APP, and the first APP and the second APP are the same.
The apparatus according to claim 16, wherein the acquiring module comprises:

The obtaining submodule is used for obtaining the MAC address and IP address of the first terminal by using the dynamic host configuration protocol DHCP, where the first terminal is used to represent any access terminal in the vehicle network.
The apparatus according to claim 19, wherein the obtaining submodule comprises:

a receiving unit, configured to receive a DHCP address request message sent by the first terminal, where the address request message includes the MAC address of the first terminal;

A sending unit, configured to send a DHCP address reply message to the first terminal, where the address reply message includes the IP address of the first terminal.
The apparatus of claim 16, further comprising:

a first detection module, configured to detect that a specified update condition for the ARP mapping relationship table is met;

an update module, for updating the ARP mapping relationship table to obtain the updated ARP mapping relationship table;

The second sending module is configured to send the updated ARP mapping relationship table to all access terminals in the vehicle network, so that any access terminal in the vehicle network can use the updated ARP mapping relationship according to the updated ARP mapping relationship. table for data communication.
The device according to claim 21, wherein the specified update condition comprises: a second terminal accesses the in-vehicle network, and the second terminal is used to represent any terminal that is not connected to the in-vehicle network; The update module includes:

The adding submodule is configured to add the mapping relationship between the MAC address and the IP address of the second terminal to the ARP mapping relationship table to obtain the updated ARP mapping relationship table.
The device according to claim 21, wherein the specified update condition comprises: a third terminal disconnects from the in-vehicle network, and the third terminal is used to represent any terminal that has accessed the in-vehicle network; The update module includes:

The deletion sub-module is configured to delete the mapping relationship between the MAC address and the IP address of the third terminal from the ARP mapping relationship table to obtain the updated ARP mapping relationship table.
The apparatus of claim 16, further comprising:

a second detection module, configured to detect whether there is an ARP attack in the vehicle network through the virtual terminal of the vehicle controller;

The marking module is configured to mark the ARP attacking device if it is determined that there is an ARP attack in the vehicle network, and filter out the data whose target address is the MAC address of the ARP attacking device.
The device according to claim 24, wherein the second detection module comprises:

A broadcast submodule, configured to broadcast an ARP request message including a target IP address through the virtual terminal, where the target IP address is a known IP address that does not exist or the IP address of a known gateway;

The determining submodule is configured to determine that an ARP attack exists in the in-vehicle network if an ARP reply message including the target MAC address is received, and the ARP attack device is the device that sends the ARP reply message.
A device for preventing ARP attacks, characterized in that the device is used for any access terminal in a vehicle-mounted network, comprising:

The first receiving module is used to receive the ARP mapping relationship table sent by the vehicle-mounted controller of the vehicle-mounted network, where the ARP mapping relationship table includes the mapping relationship between the MAC addresses and IP addresses of all access terminals in the vehicle-mounted network ;

The first communication module is configured to perform data communication according to the ARP mapping relationship table.
The apparatus according to claim 26, wherein the first receiving module comprises:

The receiving sub-module is configured to receive, through the receiving system of the access terminal, the ARP mapping relationship table sent by the delivery system of the vehicle-mounted controller.
The device according to claim 27, wherein the sending system is a first application APP, the receiving system is a second APP, and the first APP and the second APP are the same.
The apparatus of claim 26, further comprising:

The second receiving module is used for receiving the updated ARP mapping relationship table sent by the on-board controller;

The second communication module is configured to perform data communication according to the updated ARP mapping relationship table.
The apparatus according to claim 27 or 28, wherein the access terminal is a device that accesses the in-vehicle network for the first time and does not include the receiving system; the apparatus further comprises:

A download and installation module is used to download and install the receiving system from a download page provided by the vehicle-mounted controller.
A device for preventing ARP attacks, characterized in that the device is used in a vehicle-mounted controller of a vehicle-mounted network, and the device comprises: a processor, a memory, and a transceiver;

the memory for storing computer instructions;

When the apparatus operates, the processor executes the computer instructions to cause the apparatus to perform the method of any one of claims 1-10.
A device for preventing ARP attacks, characterized in that the device is used for any access terminal in a vehicle-mounted network, and the device includes: a processor, a memory, and a transceiver;

the memory for storing computer instructions;

When the apparatus operates, the processor executes the computer instructions, causing the apparatus to perform the method of any of claims 11-15.
A communication system, comprising a vehicle-mounted controller and one or more access terminals;

Wherein, the in-vehicle controller includes the device according to any one of claims 16-25; the access terminal includes the device according to any one of claims 26-30.
A computer storage medium, characterized in that the computer storage medium comprises computer instructions, when the computer instructions are executed on the vehicle-mounted controller of the vehicle-mounted network, the vehicle-mounted controller is made to execute any one of claims 1-10. method described in item.
A computer storage medium, characterized in that, the computer storage medium includes computer instructions, when the computer instructions are executed on a terminal device in a vehicle-mounted network, the terminal device is made to execute any one of claims 11-15. method described.