Secure access control via authenticated timekeeping

Abstract

Method (300) for controlling the access of a supplicant (210) to an Ethernet network (110) via an authenticator (201); wherein the Ethernet network (110) is part of a communication system of a vehicle (100); wherein the supplicant (210) and the authenticator (201) are each a control unit of the vehicle (100); wherein the method (300) comprises - authenticating (301) the supplicant (210) with the authenticator (201) using an authentication protocol; - determining (302) a runtime of a message between the supplicant (210) and the authenticator (201); wherein a line (212) between the supplicant (210) and the authenticator (201) has a length that is equal to or less than a predefined length threshold; wherein the length of the line (121) is predetermined by dimensions of the vehicle (100); and - Controlling (303) the access of the supplicant (210) to the Ethernet network (110) based on the authentication performed and the determined runtime; wherein the supplicant (210) gains access to the Ethernet network (110) if the authentication of the supplicant (210) with the authenticator (201) is successful and if the determined runtime is less than a predefined runtime threshold; and otherwise the supplicant (210) is rejected.

Description

[0001] The invention relates to a method and a corresponding device for securing access to a network, in particular to a local area network (LAN).

[0002] Vehicles (e.g., passenger cars, trucks, and / or motorcycles) typically include a communication system with one or more bus systems for exchanging information between different control units within a vehicle. The one or more bus systems may, in particular, include an Ethernet network. Vehicle control units (e.g., cameras) can exchange relatively large amounts of data via an Ethernet network.

[0003] One or more of the control units connected to a vehicle's Ethernet network (also referred to as Ethernet control units) may be located in the vehicle in such a way that they are relatively easily accessible to an attacker. These control units could be used by an unauthorized person to gain access to the vehicle's communications system (e.g., by replacing a control unit or by inserting a remote computer for a man-in-the-middle attack).

[0004] To prevent this, authentication according to the IEEE 802.1X standard can be implemented in the vehicle's Ethernet network. However, it has been shown that even authentication according to the IEEE 802.1X standard cannot completely rule out man-in-the-middle attacks.

[0005] US 8 359 470 B1 describes a method for securely establishing a wireless communication connection. DE 10 2010 033 230 A1 describes a method for integrating a device into a network. US 2009 / 0 059 797 A1 describes a method for verifying the arrangement of devices that exchange data with each other.

[0006] This document therefore deals with the technical task of designing access to a vehicle's Ethernet network in such a way that access for unauthorized persons (including by means of a man-in-the-middle attack) can be avoided in a cost-effective manner.

[0007] The object is achieved by the independent claims. Advantageous embodiments are described, inter alia, in the dependent claims.

[0008] According to one aspect, a method for controlling a supplicant's access to an Ethernet network via an authenticator is described. The Ethernet network may be part of a vehicle's communication system. In this case, the supplicant and / or the authenticator may each be a control unit of the vehicle. The authenticator may comprise an Ethernet switch for controlling access to the Ethernet network.

[0009] The method includes authenticating the supplicant with the authenticator using an authentication protocol. The authentication protocol may include Ethernet port-based access control according to the IEEE 802.1X standard. Furthermore, authenticating the supplicant may include sending an Extensible Authentication Protocol (EAP) message.

[0010] The method further comprises determining a transit time of a message between the supplicant and the authenticator. For this purpose, the method may comprise synchronizing a time of the supplicant and a time of the authenticator using a time synchronization protocol. Examples of the time synchronization protocol are the IEEE 802.AS standard and / or the Precision Time Protocol (PTP). By synchronizing the times of the supplicant and the authenticator, it can be ensured that the transit time of the message can be determined precisely.

[0011] Furthermore, determining the runtime of a message may involve assigning a random identifier to the message for which the runtime is being determined. This ensures that the message can be uniquely identified by the supplicant and / or the authenticator, and thus the runtime of the message can be reliably determined.

[0012] The method further includes controlling the supplicant's access to the Ethernet network based on the authentication performed and the determined runtime. By taking the runtime of a message into account during access control, man-in-the-middle attacks can be reliably excluded, as such attacks typically lead to a significant increase in the runtime of messages.

[0013] A line between the supplicant and the authenticator can have a length that is equal to or less than a predefined length threshold. This is particularly the case in vehicles, where the length of connecting lines between two control units (i.e., between the supplicant and the authenticator) is typically predetermined by the dimensions of the vehicle. Controlling access can then include checking whether the determined propagation time is equal to or less than a predefined propagation time threshold. This provides a simple and cost-effective way to determine whether a man-in-the-middle attack is occurring, in which the propagation time of a message exchanged between the supplicant and the authenticator would exceed the predefined propagation time threshold.

[0014] The predefined runtime threshold can be determined mathematically, e.g., based on a known length of the connection line between the supplicant and the authenticator. Alternatively or additionally, the predefined runtime threshold can be determined experimentally (e.g., in a secure environment before delivery of a vehicle).

[0015] The Ethernet network may include a full-duplex link between the supplicant and authenticator. In other words, a message between the supplicant and authenticator can be exchanged over a full-duplex Ethernet bus. The use of a full-duplex link is advantageous because, in such a case, conducting a man-in-the-middle attack requires the introduction of an intermediary computer and / or the physical disruption of the link. These steps significantly increase the latency of messages between the supplicant and authenticator. Consequently, the use of full-duplex links facilitates the detection of a man-in-the-middle attack based on the latency of a message.

[0016] According to a further aspect, a control unit for a vehicle is described. The control unit can have the function of a supplicant that requests or requests access to an Ethernet network of the vehicle. The control unit is configured to authenticate itself with an authenticator of the Ethernet network of the vehicle using an authentication protocol. Furthermore, the control unit can be configured to determine a runtime of a message between the control unit and the authenticator. For this purpose, the control unit can be configured to send a message with a random identifier to the authenticator. Furthermore, the control unit is configured to gain access to the Ethernet network based on the authentication performed and the determined runtime.

[0017] According to a further aspect, a component for an Ethernet network of a vehicle is described. The component can comprise, for example, a control unit of the vehicle. The component can have the function of an authenticator for the Ethernet network. For this purpose, the component can comprise an Ethernet switch.

[0018] The component is configured to authenticate a supplicant requesting access to the Ethernet network using an authentication protocol. Furthermore, the component is configured to determine a runtime of a message between the supplicant and the component. Furthermore, the component is configured to control the supplicant's access to the Ethernet network based on the authentication performed and the determined runtime.

[0019] According to a further aspect, a vehicle (e.g., a passenger car, a truck, or a motorcycle) is described that includes a control unit described in this document and / or a component of an Ethernet network described in this document.

[0020] According to another aspect, a software (SW) program is described. The SW program can be configured to be executed on a processor (e.g., on a control unit) and thereby to carry out the method described in this document.

[0021] According to a further aspect, a storage medium is described. The storage medium may comprise a software program configured to be executed on a processor and thereby to carry out the method described in this document.

[0022] It should be noted that the methods, devices, and systems described in this document can be used alone or in combination with other methods, devices, and systems described in this document. Furthermore, any aspects of the methods, devices, and systems described in this document can be combined in a variety of ways. In particular, the features of the claims can be combined in a variety of ways.

[0023] The invention will be described in more detail below with reference to exemplary embodiments. Fig. 1 is a block diagram of an exemplary communication system of a vehicle; Fig. 2 a block diagram of exemplary components for authentication in an Ethernet network; and Fig. 3 a flowchart of an exemplary method for authenticating a control unit.

[0024] As stated at the beginning, this document deals with the technical task of authenticating the access of an ECU to an Ethernet network in a vehicle in a cost-efficient manner.

[0025] Fig. 1 shows an exemplary communication system 100 for a vehicle (e.g., for a motor vehicle or automobile). The system 100 comprises a central gateway (ZGW) or a central control unit (ZSG) 101, to which various bus systems 120, 130, 140 are connected. The bus system 120 is, for example, a synchronous FlexRay bus system, the bus system 130 is, for example, an asynchronous CAN (Controller Area Network) bus system, and the bus system 140 is, for example, a synchronous MOST (Media Oriented Systems Transport) bus system. Various components of the vehicle (such as sensors, actuators, and / or electronic control units (ECUs)) are connected to the respective bus systems. Thus, components 121 are connected to bus 122 of bus system 120, components 131 are connected to bus 132 of bus system 130, and components 141 are connected to bus 142 of bus system 140.

[0026] The components (e.g. the individual control units, SG, of the vehicle) can transmit data to the bus as a sender or receive data from the bus as a receiver according to the protocol of the respective bus system. As in Fig. As shown in Figure 1, in the case of the FlexRay bus system 120, the CAN bus system 130, and the MOST bus system 140, a common bus 122, 132, 142 is used, the transmission capacity of which must be shared by all components 121, 131, 141 connected to the bus 122, 132, 142. This has the disadvantage that the transmission capacity available for each individual component 121, 131, 141 is reduced as the number of components 121, 131, 141 increases.

[0027] An Ethernet network 110 is also connected to the gateway 101. The Ethernet network 110 also includes a plurality of components or control devices 111, which are interconnected via buses 112. In the case of the Ethernet network 110, some or all of the components 111 usually include switches (represented by hatched boxes), which enable data to be directed specifically from a sending component 111 to a receiving component 111, so that this data is usually not transmitted on all buses 112, but only on buses 112 that lie on the transmission path between the sending component 111 and the receiving component 111. The use of switches leads to an increase in the transmission capacity available for each individual component 111.

[0028] The use of an Ethernet network 110 thus has advantages with regard to the transmission capacity available for the individual control units 111. This is particularly important for sensors 111 such as cameras, which generate a relatively large amount of data to be transmitted. On the other hand, Ethernet networks 110 pose the technical problem of ensuring that the individual components 111 of the Ethernet network 110 have access authorization to the Ethernet network 110. For example, externally accessible components 111 of the vehicle could be replaced with unauthorized components 111, which could pose a security risk to the vehicle.

[0029] In this context, the IEEE 802.1X standard was specified, which enables authentication and authorization of components 111 in an Ethernet network 110 (ie in an IEEE 802 network). Fig. Figure 2 illustrates, by way of example, the distribution of roles in an authentication according to IEEE 802.1X. A so-called supplicant (or requester) 210 submits a request for network access to an authenticator 201. The authenticator 201 can be implemented, for example, in a port of an Ethernet switch of a component 111 of the vehicle's Ethernet network 110. The authenticator 201 verifies the authentication information transmitted by the supplicant 210 using an authentication server 202 (e.g., a RADIUS server) and, if appropriate, grants access to the network 110 accessible via the authenticator 201.

[0030] The IEEE 802.1X standard recommends the Extensible Authentication Protocol (EAP) or the PPP (Point to Point Protocol) - EAP-TLS (Transport Layer Security) Authentication Protocol for authentication. Alternatively or additionally, EAP-TTLS, EAP-CHAP, EAP-PAP, or other protocols can also be used. However, these protocols are insecure against man-in-the-middle attackers. A man-in-the-middle attack is particularly possible because, according to IEEE 802.1X, only the beginning of a connection is secured. After authentication, potential attackers can misuse the opened connection for other purposes if they succeed in physically infiltrating the connection. For this purpose, a computer 220 (also called a middle computer) connected between an authenticated control unit 210 and a secured port of the authenticator 201 can be used (see Fig. 2).

[0031] In this context, the IEEE 802.1X standard allows for encryption and / or authentication of a link (e.g., using LinkSec) and would thus not be vulnerable to man-in-the-middle attacks. However, the use of encryption requires additional hardware and / or software resources for end-to-end encryption and / or authentication of the communication between the supplicant 210 and the authenticator 201. Alternatively or additionally, IPsec, TLS, and / or other protocols could be used to encrypt and authenticate the communication. This would prevent the port on the authenticator 201 from being vulnerable to man-in-the-middle attacks. However, these protocols are generally not suitable for multicast and broadcast communication and therefore have limited application in vehicles.

[0032] This document describes a method that enables a control device (supplicant) 210 to authenticate itself to an Ethernet switch (authenticator) 201 and, in doing so, ensures that no man-in-the-middle attacker is present. The described method is particularly applicable in full-duplex Ethernet networks (such as a BroadR-Reach Ethernet network). The use of a full-duplex Ethernet network is advantageous because the use of a common physical line (such as a common two-wire line) can reduce the costs and weight of the bus 112 of the Ethernet network 110. Furthermore, the described method is resource-efficient and thus cost-effective because, in particular, no encryption of the connection is required to ensure that no man-in-the-middle attack is possible.

[0033] Vehicles have the special feature that the individual control units / components 210, 201, 111 of the Ethernet network 110 have a predefined and / or fixed distance from one another. In particular, the supplicant 210 (e.g., the control unit of a vehicle camera) in a vehicle is typically connected to the authenticator 201 via a line 212 with a fixed length. This results in messages exchanged between the supplicant 210 and the authenticator 201 having a fixed propagation time. In particular, messages exchanged between the supplicant 210 and the authenticator 201 have a propagation time that is below a predefined propagation time threshold.

[0034] To verify the presence of a man-in-the-middle attack, the runtime of a message exchanged between the supplicant 210 and the authenticator 201 can be checked. If a man-in-the-middle attack is present, a message is typically routed via an intermediate computer 220 and modified if necessary. This extends the runtime of the message. In particular, this results in the actual runtime of the message being above the predefined runtime threshold. The increased runtime can be detected by the authenticator 201, and access of the supplicant 210 to the vehicle's Ethernet network 110 can then be prevented.

[0035] To determine the latency ("path_delay") of a message, the IEEE 802.1AS standard or the Precision Time Protocol (PTP) or another protocol for the exchange of time information can be used. Through such protocols, latencies can be determined with an accuracy of approximately 1 - 10 ns. To measure the latency, a unique random ID can be assigned to a transmitted message, which is transported, for example, by means of a header extension (e.g., TLV (Type Length Value) in IEEE 802.1AS) or in an existing header field of the message.

[0036] With PTP, for example, authenticator 201 can send its time in a message to supplicant 210, with supplicant 210 determining the receipt time of the message based on its time. Furthermore, supplicant 210 can send a delay request message to authenticator 201, with the receipt time of the delay request message at authenticator 201 being sent back to supplicant 210 as a delay response message. The time of a message between supplicant 210 and authenticator 201 can be determined from the differences in the timestamps (even if there is an offset between the times of supplicant 210 and authenticator 201).

[0037] The runtime threshold can be determined and set in advance. In particular, the runtime threshold can be determined and set in a secure environment (e.g., before the vehicle is delivered). This ensures that setting excessively high runtime thresholds will invalidate the runtime check.

[0038] Fig. 3 shows a flowchart of an exemplary method 300 for authenticating a supplicant 210 with an authenticator 201. In a first step 301, the supplicant 210 (e.g., a vehicle control unit) authenticates itself with an authenticator 201 (e.g., a switch control unit of the vehicle). The IEEE 802.1X standard can be used for this purpose, for example, using EAP. The EAP module used can perform authentication based on certificates, asymmetric keys, symmetric keys, or the like.

[0039] The method 300 further comprises checking 302 the runtime (e.g., the path_delay) between the supplicant 210 and the authenticator 201. The aforementioned protocols can be used for this purpose. In particular, a path_delay measurement using challenge-response or signatures or similar methods can be used for this purpose. The runtime can be determined using a single path_delay message or based on multiple messages. To check the runtime, the determined runtime can be compared with the predefined runtime threshold. If the determined runtime is above the predefined runtime threshold, this can lead to a failure of the authentication of the supplicant 210 with the authenticator 201.

[0040] The method 300 further includes verifying 303 whether both the EAP authentication (in step 301) and the authentication of the path_delay messages were successful (in step 302), and whether the measured delay (i.e., the measured runtime) is below the configured and / or learned runtime threshold. If this is the case, the supplicant 210 can be approved. Otherwise, the supplicant 210 can be rejected.

[0041] In particular, both the supplicant 210 and the authenticator 201 (i.e., both control devices) can check whether the EAP authentication and the authentication of the path_delay messages were successful, and whether the measured delay (i.e., the measured runtime) is below the configured and / or learned runtime threshold.

[0042] The procedure for unlocking an ECU described in this document enables increased security for vulnerable Ethernet ECUs at a moderate cost. In particular, vehicle ECUs are already frequently equipped with time recording units that enable precise determination of runtimes at no additional cost. By determining the runtime, a man-in-the-middle attack can be reliably detected and thus excluded, especially on a full-duplex Ethernet network.

[0043] The present invention is not limited to the embodiments shown. In particular, it should be noted that the description and figures are intended only to illustrate the principle of the proposed methods, devices, and systems.

Claims

[1] Method (300) for controlling the access of a supplicant (210) to an Ethernet network (110) via an authenticator (201); wherein the Ethernet network (110) is part of a communication system of a vehicle (100); wherein the supplicant (210) and the authenticator (201) are each a control unit of the vehicle (100); wherein the method (300) comprises - authenticating (301) the supplicant (210) with the authenticator (201) using an authentication protocol; - determining (302) a runtime of a message between the supplicant (210) and the authenticator (201); wherein a line (212) between the supplicant (210) and the authenticator (201) has a length that is equal to or less than a predefined length threshold; wherein the length of the line (121) is predetermined by dimensions of the vehicle (100); and - Controlling (303) the access of the supplicant (210) to the Ethernet network (110) based on the authentication performed and the determined runtime; wherein the supplicant (210) gains access to the Ethernet network (110) if the authentication of the supplicant (210) with the authenticator (201) is successful and if the determined runtime is less than a predefined runtime threshold; and otherwise the supplicant (210) is rejected. [2] The method (300) of claim 1, wherein authenticating (301) the supplicant (210) comprises sending an Extensible Authentication Protocol, EAP, message. [3] The method (300) of any preceding claim, wherein the method (300) comprises synchronizing a time of the supplicant (210) and a time of the authenticator (201) using a time synchronization protocol. [4] The method (300) of claim 3, wherein the time synchronization protocol comprises IEEE 802.AS and / or Precision Time Protocol, PTP. [5] The method (300) of any preceding claim, wherein determining (302) a runtime of a message comprises assigning a random identifier to the message for which the runtime is determined. [6] Method (300) according to any preceding claim, wherein the Ethernet network (110) comprises a full duplex connection line (212) between supplicant (210) and authenticator (201). [7] Control device (210) for a vehicle (100), wherein the control device (210) is configured - to authenticate itself with an authenticator (201) of an Ethernet network (110) of the vehicle using an authentication protocol; wherein the Ethernet network (110) is part of a communication system of the vehicle (100); wherein the authenticator (201) is a further control unit of the vehicle (100); wherein a line (212) between the control unit (210) and the authenticator (201) has a length that is equal to or less than a predefined length threshold; wherein the length of the line (121) is predetermined by dimensions of the vehicle (100); - to determine a runtime of a message between the control unit (210) and the authenticator (201); and - to gain access to the Ethernet network (110) based on the authentication performed and the determined runtime; wherein the control unit (210) gains access to the Ethernet network (110) if the authentication of the control unit (210) with the authenticator (201) is successful and if the determined runtime is less than a predefined runtime threshold; and wherein otherwise the control unit (210) is rejected. [8] Component (201) for an Ethernet network (110) of a vehicle, wherein the component (201) comprises an Ethernet switch, and wherein the component is configured - to authenticate a supplicant (210) requesting access to the Ethernet network (110) using an authentication protocol; wherein the Ethernet network (110) is part of a communication system of the vehicle (100); wherein the supplicant (210) and the component (201) are each a control unit of the vehicle (100); wherein a line (212) between the supplicant (210) and the component (201) has a length that is equal to or less than a predefined length threshold; wherein the length of the line (121) is predetermined by dimensions of the vehicle (100); - to determine a runtime of a message between the supplicant (210) and the component (201); and - to control the access of the supplicant (210) to the Ethernet network (110) based on the authentication performed and the determined runtime; wherein the supplicant (210) gains access to the Ethernet network (110) if the authentication of the supplicant (210) with the component (201) is successful and if the determined runtime is less than a predefined runtime threshold; and otherwise the supplicant (210) is rejected.

Images