A vehicle-mounted communication terminal information security intrusion detection method and system

Abstract

The present invention provides a vehicle-mounted communication terminal information security intrusion detection method and system, including: step S1, collecting system data of the vehicle-mounted terminal and classifying the system data; step S2, screening the system data according to a preset data preprocessing strategy, and uploading the screened system data to the cloud through a preset access control strategy; step S3, inputting the received system data into a preset information security model for matching to determine whether there is an intrusion event; generating an update file based on the received system data and sending it to the vehicle-mounted terminal; step S4, updating the data preprocessing strategy and access control strategy of the vehicle-mounted terminal based on the received update file. The present invention realizes data collection and terminal preprocessing covering all aspects of the system and business; realizes dynamic online update of the data preprocessing strategy and intrusion protection, and ensures that the intrusion detection function of the vehicle throughout its life cycle is real-time and effective.

Description

Technical Field

[0001] The present invention relates to the technical field of intrusion detection, and in particular to a method and system for detecting information security intrusion of a vehicle-mounted communication terminal. Background Art

[0002] Intrusion detection systems have become an indispensable information security product in the field of traditional information technology network security. With the continuous development of Internet of Vehicles technology, vehicle-mounted communication terminals, as the most important boundary access nodes in vehicle information security, their information security intrusion detection systems are also the focus of research in the industry.

[0003] In the intrusion detection and protection system solution for in-vehicle mobile terminals, the following issues need to be addressed: what levels of information need to be collected for auditing; how to dynamically implement intrusion protection and auditing strategies for the entire life cycle of the vehicle; how to improve the accuracy of security auditing and intrusion detection, etc.

[0004] A typical intrusion detection solution in the prior art, such as Figure 1 As shown in the figure, it consists of a terminal and a cloud. The terminal is mainly responsible for rule matching and preprocessing, and the cloud is mainly responsible for data collection, behavior analysis, and rule updates. The terminal module obtains the traffic data of the Internet of Vehicles terminal through traffic collection, performs rule matching after data preprocessing, and performs abnormal classification, and finally realizes alarm processing; the cloud collects abnormal classification data, updates the rule matching module after behavioral analysis, realizes dynamic change of the rule base, and manages abnormal classification online. However, the shortcomings of similar solutions are also quite obvious, such as: no dynamic online update of data preprocessing; single data collection source, unable to perform comprehensive intrusion detection on the system and business; no security audit of system information and status; no dynamic online update of protection functions combined with intrusion detection and security audit results. Summary of the invention

[0005] The purpose of the present invention is to propose a vehicle-mounted communication terminal information security intrusion detection method and system to solve the technical problems of insufficient coverage of data collection sources and untimely update of data processing strategies.

[0006] On the one hand, a method for detecting information security intrusion of a vehicle-mounted communication terminal is provided, comprising the following steps:

[0007] Step S1, collecting system data of the vehicle terminal and classifying the system data;

[0008] Step S2, screening the system data according to a preset data preprocessing strategy, and uploading the screened system data to the cloud through a preset access control strategy;

[0009] Step S3, inputting the received system data into a preset information security model for matching to determine whether there is an intrusion event; generating an update file based on the received system data and sending it to the vehicle terminal;

[0010] Step S4, updating the data preprocessing strategy and access control strategy of the vehicle terminal according to the received update file.

[0011] Preferably, in step S1, classifying the system data specifically includes:

[0012] According to the system architecture category to which the data source of the system data belongs, the system data is divided into module data, MCU data and communication data.

[0013] Preferably, in step S2, screening the system data specifically includes:

[0014] The system data is matched with the data preprocessing strategy according to the divided categories. If the match is successful, the successfully matched category is deleted according to the method recorded in the data preprocessing strategy; if the match is unsuccessful, the system data of the category is retained.

[0015] Preferably, in step S3, inputting the received system data into a preset information security model for matching specifically includes:

[0016] If the system data successfully matches the intrusion event data recorded in the information security model, it is determined that an intrusion event exists and an alarm message is generated; if the system data fails to match the intrusion event data recorded in the information security model, it is determined that no intrusion event exists.

[0017] Preferably, in step S3, generating an update file according to the received system data specifically includes:

[0018] When the system data successfully matches the data preprocessing strategy according to the divided categories, the vehicle speed signal and gear position signal at this time are recorded, and the vehicle speed signal and gear position signal are associated with the matched data preprocessing strategy as an update file of the data preprocessing strategy;

[0019] When there are changes between the real-time firewall and the access control list and the original firewall and the access control list, the real-time firewall and the access control list are used as update files of the firewall and the access control list.

[0020] Preferably, in step S4, updating the data preprocessing strategy and access control strategy of the vehicle terminal according to the received update file specifically includes:

[0021] Compare the firewall and access control list in the update file with the original firewall and access control list. If there are different policies, the access control policy update is triggered, and the firewall and access control list in the update file replaces the original firewall and access control list.

[0022] The vehicle speed signal corresponding to the data preprocessing strategy in the update file is compared with the vehicle output signal corresponding to the original data preprocessing strategy. If there is a difference, the data preprocessing strategy update is triggered, and the data preprocessing strategy in the update file replaces the original data preprocessing strategy.

[0023] On the other hand, a vehicle-mounted communication terminal information security intrusion detection system is also provided to implement the vehicle-mounted communication terminal information security intrusion detection method, comprising: a vehicle-mounted terminal and a cloud connected to each other; wherein the vehicle-mounted terminal at least includes a data acquisition module, a data preprocessing module, a policy update module and a communication module; the cloud at least includes a security audit module;

[0024] The data acquisition module is used to collect system data of the vehicle terminal and divide the system data into module data, MCU data and communication data;

[0025] The data preprocessing module is used to screen the system data according to a preset data preprocessing strategy;

[0026] The communication module is used to upload the filtered system data to the cloud through a preset access control policy; and to send update files to the vehicle terminal;

[0027] The policy update module is used to update the data preprocessing policy and access control policy of the vehicle terminal according to the update file;

[0028] The security audit module is used to input the received system data into a preset information security model for matching to determine whether there is an intrusion event; and to generate an update file based on the received system data.

[0029] Preferably, the data preprocessing module is also used to match the system data according to the divided categories with the data preprocessing strategy. If the match is successful, the successfully matched category is deleted as recorded in the data preprocessing strategy; if the match is unsuccessful, the system data of the category is retained.

[0030] Preferably, the security audit module is further used to determine that an intrusion event exists and generate an alarm message when the system data successfully matches the intrusion event data recorded in the information security model; if the system data fails to match the intrusion event data recorded in the information security model, determine that there is no intrusion event;

[0031] And, when the system data successfully matches the data preprocessing strategy according to the divided categories, the vehicle speed signal and gear position signal at this time are recorded, and the vehicle speed signal and gear position signal are associated with the matched data preprocessing strategy as an update file of the data preprocessing strategy;

[0032] When there are changes between the real-time firewall and the access control list and the original firewall and the access control list, the real-time firewall and the access control list are used as update files of the firewall and the access control list.

[0033] Preferably, the policy update module is further used to compare the firewall and access control list in the update file with the original firewall and access control list. If there are different policies, the access control policy update is triggered to replace the original firewall and access control list with the firewall and access control list in the update file.

[0034] The vehicle speed signal corresponding to the data preprocessing strategy in the update file is compared with the vehicle output signal corresponding to the original data preprocessing strategy. If there is a difference, the data preprocessing strategy update is triggered, and the data preprocessing strategy in the update file replaces the original data preprocessing strategy.

[0035] In summary, the implementation of the embodiments of the present invention has the following beneficial effects:

[0036] The vehicle-mounted communication terminal information security intrusion detection method and system provided by the present invention realizes data collection and terminal preprocessing covering all aspects of the system and business by collecting all system data of the vehicle-mounted terminal; dynamically updates the data preprocessing strategy and intrusion protection online to ensure that the intrusion detection function of the vehicle is real-time and effective throughout its life cycle; performs security audits on system and business information in the cloud, and stores them securely to achieve information security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, without paying creative labor, other drawings obtained based on these drawings still belong to the scope of the present invention.

[0038] Figure 1 A schematic diagram of an intrusion detection solution in the prior art.

[0039] Figure 2 The present invention is a schematic diagram of the main process of a method for detecting information security intrusion of a vehicle-mounted communication terminal in an embodiment of the present invention.

[0040] Figure 3The present invention is a schematic diagram of the structure of an information security intrusion detection system for a vehicle-mounted communication terminal according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings.

[0042] like Figure 2 FIG. 1 is a schematic diagram of an embodiment of a vehicle-mounted communication terminal information security intrusion detection method provided by the present invention. In this embodiment, the method includes the following steps:

[0043] Step S1, collect system data of the vehicle terminal and classify the system data; it can be understood that when collecting vehicle terminals, it is based on the business of the vehicle mobile terminal and the mainstream OpenCPU system architecture. The specific collection needs to collect data related to the module system, MCU (Microcontroller Unit) and communication business.

[0044] In a specific embodiment, data of the network monitoring information path, access control log path, system configuration path, and business log path are collected according to a preset period (the default is 10s, which can be configured through DID (Differences-in-Differences)); among them, the network monitoring information path, access control log path, system configuration path, and business log path are the target addresses for data collection.

[0045] Specifically, according to the system architecture category to which the data source of the system data belongs, the system data is divided into module data, MCU data and communication data. It is understandable that the uniformly collected data is classified according to the business and system architecture, and the classification specifically includes the system resources, system configuration, network monitoring information, file system, and access control log collection of the module system; the business logs and inter-core communication flow information of the MCU end; and the business-related data includes business application data, business logs, etc.

[0046] Step S2, screen the system data according to the preset data preprocessing strategy, and upload the screened system data to the cloud through the preset access control strategy; it can be understood that this process is to purify the collected data, and screen out the system resources, system configuration and other information that conforms to the data preprocessing strategy; upload the preprocessed system data to the cloud (intrusion detection cloud) through a secure channel.

[0047] In a specific embodiment, the preprocessing process is specifically to match the system data according to the divided categories with the data preprocessing strategy. If the match is successful, the successfully matched category is deleted according to the method recorded in the data preprocessing strategy; if the match is unsuccessful, the system data of this category is retained.

[0048] Step S3, input the received system data into the preset information security model for matching to determine whether there is an intrusion event; generate an update file based on the received system data and send it to the vehicle terminal; it can be understood that the collected system information is model matched through the cloud-based information security model to realize the identification of intrusion events and store key business information at the same time.

[0049] In a specific embodiment, the process of identifying an intrusion event is as follows: if the system data successfully matches the intrusion event data recorded in the information security model, it is determined that an intrusion event exists and an alarm message is generated; if the system data fails to match the intrusion event data recorded in the information security model, it is determined that there is no intrusion event. Cloud security auditing mainly uses the cloud information security model to perform model matching on the collected system information to identify intrusion events.

[0050] Generate an update file based on the received system data. Specifically, when the system data successfully matches the data preprocessing strategy according to the divided categories, record the vehicle speed signal and gear signal at this time, associate the vehicle speed signal and gear signal with the matching data preprocessing strategy, and use it as an update file for the data preprocessing strategy. It can be understood that the update trigger of the data preprocessing strategy is mainly based on the vehicle speed signal and gear signal. By collecting the real-time vehicle speed signal and gear signal when the data preprocessing is successful, the data preprocessing strategy can be updated, mainly the vehicle speed and gear corresponding to the preprocessing strategy. When the update file is pushed, it is mainly dynamically managed through the xml file.

[0051] When there are changes between the real-time firewall and the access control list and the original firewall and the access control list, the real-time firewall and the access control list are used as update files of the firewall and the access control list; it can be understood that the access control policy update is mainly for the access control list of the firewall and SElinux, which also uses xml (ExtensibleMarkup Language) files for dynamic management. When the access control policy needs to be changed, the access control policy update is triggered by issuing the access control xml file.

[0052] Step S4, update the data preprocessing strategy and access control strategy of the vehicle terminal according to the received update file. It is understandable that when updating the data preprocessing strategy and access control strategy, the original strategy file is replaced with a new one through an XML file to achieve dynamic management and update.

[0053] In a specific embodiment, the firewall and access control list in the update file are compared with the original firewall and access control list. If there are different policies, the access control policy update is triggered, and the firewall and access control list in the update file replace the original firewall and access control list;

[0054] The vehicle speed signal corresponding to the data preprocessing strategy in the update file is compared with the vehicle output signal corresponding to the original data preprocessing strategy. If there is a difference, the data preprocessing strategy update is triggered, and the data preprocessing strategy in the update file replaces the original data preprocessing strategy.

[0055] like Figure 3 FIG. 1 is a schematic diagram of an embodiment of a vehicle-mounted communication terminal information security intrusion detection system provided by the present invention. In this embodiment, the system is used to implement the vehicle-mounted communication terminal information security intrusion detection method, specifically comprising: a vehicle-mounted terminal and a cloud connected to each other; wherein the vehicle-mounted terminal at least comprises a data acquisition module, a data preprocessing module, a policy update module and a communication module; the cloud at least comprises a security audit module;

[0056] The data acquisition module is used to collect the system data of the vehicle terminal and divide the system data into module data, MCU data and communication data; it can be understood that it is based on the business of the vehicle mobile terminal and the mainstream OpenCPU system architecture, and the specific collection needs to collect data related to the module system, MCU and communication business. The data of the network monitoring information path, access control log path, system configuration path and business log path are collected according to the preset period (the default is 10s, which can be configured through DID); among them, the network monitoring information path, access control log path, system configuration path and business log path are the target addresses for data collection.

[0057] The data preprocessing module is used to screen the system data according to a preset data preprocessing strategy; it can be understood that the collected data is purified to filter out information such as system resources and system configuration that conforms to the data preprocessing strategy.

[0058] In a specific embodiment, the data preprocessing module is also used to match the system data according to the divided categories with the data preprocessing strategy. If the match is successful, the successfully matched category is deleted according to the method recorded in the data preprocessing strategy; if the match is unsuccessful, the system data of the category is retained.

[0059] The communication module is used to upload the filtered system data to the cloud through a preset access control policy; and to send update files to the vehicle terminal; it can be understood that data upload is to upload the locally processed data to the intrusion detection cloud through a secure channel, and the intrusion detection cloud can send security policies through a secure channel. The two-way authentication of the terminal and the intrusion detection cloud is achieved through the communication certificate path, communication certificate, and server certificate. "TLS (Transport Layer Security) + MQTT (Message Queuing Telemetry Transpor) + Protobuf (Google Protocol Buffers)" is used to achieve small-scale, high-efficiency, and high-security communication, so the certificate and certificate path are used to achieve two-way authentication.

[0060] The security audit module is used to input the received system data into a preset information security model for matching to determine whether there is an intrusion event; generate an update file based on the received system data; it can be understood that the collected system information is model matched through the cloud-based information security model to achieve the identification of intrusion events and store key business information at the same time.

[0061] In a specific embodiment, the security audit module is also used to determine that an intrusion event exists and generate an alarm message when the system data successfully matches the intrusion event data recorded in the information security model; if the system data does not successfully match the intrusion event data recorded in the information security model, it is determined that there is no intrusion event;

[0062] And, when the system data successfully matches the data preprocessing strategy according to the divided categories, the vehicle speed signal and gear position signal at this time are recorded, and the vehicle speed signal and gear position signal are associated with the matched data preprocessing strategy as an update file of the data preprocessing strategy;

[0063] When there are changes between the real-time firewall and the access control list and the original firewall and the access control list, the real-time firewall and the access control list are used as update files of the firewall and the access control list.

[0064] The policy update module is used to update the data preprocessing policy and access control policy of the vehicle terminal according to the update file; it can be understood that when the data preprocessing policy and access control policy are updated, the original policy file is replaced with a new one through an XML file to achieve dynamic management and implement updates.

[0065] In a specific embodiment, the policy update module is also used to compare the firewall and access control list in the update file with the original firewall and access control list. If there are different policies, the access control policy update is triggered to replace the original firewall and access control list with the firewall and access control list in the update file;

[0066] The vehicle speed signal corresponding to the data preprocessing strategy in the update file is compared with the vehicle output signal corresponding to the original data preprocessing strategy. If there is a difference, the data preprocessing strategy update is triggered, and the data preprocessing strategy in the update file replaces the original data preprocessing strategy.

[0067] In summary, the implementation of the embodiments of the present invention has the following beneficial effects:

[0068] The vehicle-mounted communication terminal information security intrusion detection method and system provided by the present invention realizes data collection and terminal preprocessing covering all aspects of the system and business by collecting all system data of the vehicle-mounted terminal; dynamically updates the data preprocessing strategy and intrusion protection online to ensure that the intrusion detection function of the vehicle is real-time and effective throughout its life cycle; performs security audits on system and business information in the cloud, and stores them securely to achieve information security protection.

[0069] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of the present invention. Therefore, equivalent changes made according to the claims of the present invention are still within the scope of the present invention.

Claims

1. A vehicle-mounted communication terminal information security intrusion detection method, characterized in that: The following steps are involved: Step S1, collecting system data of the vehicle terminal and classifying the system data; Step S2, screening the system data according to a preset data preprocessing strategy, and uploading the screened system data to the cloud through a preset access control strategy; Step S3, inputting the received system data into a preset information security model for matching to determine whether there is an intrusion event; Generate an update file based on the received system data and send it to the vehicle terminal; The step of generating an update file according to the received system data specifically includes: When the system data successfully matches the data preprocessing strategy according to the divided categories, the vehicle speed signal and gear position signal at this time are recorded, and the vehicle speed signal and gear position signal are associated with the matched data preprocessing strategy as an update file of the data preprocessing strategy; When there are changes between the real-time firewall and access control list and the original firewall and access control list, the real-time firewall and access control list are used as update files of the firewall and access control list; Step S4, updating the data preprocessing strategy and access control strategy of the vehicle terminal according to the received update file.

2. The method according to claim 1, characterized in that In step S1, the system data is classified, specifically including: According to the system architecture category to which the data source of the system data belongs, the system data is divided into module data, MCU data and communication data.

3. The method according to claim 2, characterized in that In step S2, the screening of the system data specifically includes: The system data is matched with the data preprocessing strategy according to the divided categories. If the match is successful, the successfully matched category is deleted according to the method recorded in the data preprocessing strategy; if the match is unsuccessful, the system data of the category is retained.

4. The method according to claim 3, characterized in that In step S3, the received system data is input into a preset information security model for matching, specifically including: If the system data successfully matches the intrusion event data recorded in the information security model, it is determined that an intrusion event exists and an alarm message is generated; if the system data fails to match the intrusion event data recorded in the information security model, it is determined that no intrusion event exists.

5. The method according to claim 4, characterized in that In step S4, the data preprocessing strategy and access control strategy of the vehicle terminal are updated according to the received update file, specifically including: Compare the firewall and access control list in the update file with the original firewall and access control list. If there are different policies, the access control policy update is triggered, and the firewall and access control list in the update file replaces the original firewall and access control list. The vehicle speed signal corresponding to the data preprocessing strategy in the update file is compared with the vehicle output signal corresponding to the original data preprocessing strategy. If there is a difference, the data preprocessing strategy update is triggered, and the data preprocessing strategy in the update file replaces the original data preprocessing strategy.

6. A vehicle-mounted communication terminal information security intrusion detection system, used to implement the method according to any one of claims 1 to 5, characterized in that: include: An on-board terminal and a cloud connected to each other; wherein the on-board terminal at least includes a data acquisition module, a data preprocessing module, a policy update module and a communication module; and the cloud at least includes a security audit module; The data acquisition module is used to collect system data of the vehicle terminal and divide the system data into module data, MCU data and communication data; The data preprocessing module is used to screen the system data according to a preset data preprocessing strategy; The communication module is used to upload the filtered system data to the cloud through a preset access control strategy; and to send an update file to the vehicle terminal; wherein, when the system data successfully matches the data preprocessing strategy according to the divided categories, the vehicle speed signal and gear position signal at this time are recorded, and the vehicle speed signal and gear position signal are associated with the matched data preprocessing strategy as an update file of the data preprocessing strategy; When there are changes between the real-time firewall and access control list and the original firewall and access control list, the real-time firewall and access control list are used as update files of the firewall and access control list; The policy update module is used to update the data preprocessing policy and access control policy of the vehicle terminal according to the update file; The security audit module is used to input the received system data into a preset information security model for matching to determine whether there is an intrusion event; and to generate an update file based on the received system data.

7. The system according to claim 6, characterized in that The data preprocessing module is also used to match the system data with the data preprocessing strategy according to the divided categories. If the match is successful, the successfully matched category is deleted according to the method recorded in the data preprocessing strategy; If the match is unsuccessful, the system data of this category is retained.

8. The system according to claim 7, characterized in that The security audit module is also used to determine the existence of an intrusion event and generate an alarm message when the system data successfully matches the intrusion event data recorded in the information security model; if the system data fails to match the intrusion event data recorded in the information security model, it is determined that there is no intrusion event.

9. The system according to claim 8, characterized in that The policy update module is also used to compare the firewall and access control list in the update file with the original firewall and access control list. If there are different policies, the access control policy update is triggered to replace the original firewall and access control list with the firewall and access control list in the update file. The vehicle speed signal corresponding to the data preprocessing strategy in the update file is compared with the vehicle output signal corresponding to the original data preprocessing strategy. If there is a difference, the data preprocessing strategy update is triggered, and the data preprocessing strategy in the update file replaces the original data preprocessing strategy.

Images