Tbox-based vehicle network information security protection system and method

Abstract

This invention discloses a vehicle-to-everything (V2X) information security protection system and method based on a T-box. The in-vehicle T-box collects environmental information and log information from vehicle components. The in-vehicle T-box performs intrusion detection on the collected information. When a security event is detected, the in-vehicle T-box uploads the log information to a cloud server. The cloud server performs data format analysis and filtering on the log information, normalizes the format of sensitive data, and stores the normalized data. Using security rules from a predefined security rule base, the stored data is correlated, analyzed, and matched to generate analysis results. The cloud server displays the analysis results and sends them to the in-vehicle T-box, and implements a coordinated response from the vehicle's security protection devices based on the analysis results. Abnormal data detected on the vehicle is uploaded, and policy rules are updated and distributed on the cloud server's security operation platform to maximize the security of the vehicle.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of automotive electronic wireless communication and information security technology, in particular to a Tbox-based Internet of Vehicles information security protection system and method. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute the prior art.

[0003] With the continuous development of automotive electronics, instrument panels, central control screens and vehicle information entertainment system terminals will face upgrading and integration. Today's processor technology development provides a hardware foundation for the integration of full-liquid crystal instruments, vehicle information entertainment systems, Internet of Vehicles modules, HD, etc., but the integration of multiple hardware in the vehicle will inevitably lead to the continuous expansion of the operating system and software size, threatening the stability and security of the entire message communication system, and the communication problem between multiple operating systems will become particularly important.

[0004] In recent years, Internet of Vehicles information security incidents have increased. Global vehicle manufacturers and information service providers and other Internet of Vehicles related enterprises have been subjected to more than 2.8 million malicious attacks, and information security hazards have become more serious. According to the Upstream report, the number of publicly reported Internet of Vehicles information security attack incidents is increasing, and the types of attacks are also showing a trend of diversification. SUMMARY

[0005] In order to solve the problems of the prior art and improve the stability and security of the Internet of Vehicles message communication system, the present application provides a Tbox-based Internet of Vehicles information security protection system and method; abnormal data detected by the vehicle end is uploaded, message data is encrypted and decrypted, and policy rules are updated on the cloud server security operation platform, thereby maximizing the security of the vehicle end.

[0006] In a first aspect, the present application provides a Tbox-based Internet of Vehicles information security protection system;

[0007] The Tbox-based Internet of Vehicles information security protection system comprises: a plurality of vehicle ends, each vehicle end is equipped with a vehicle Tbox, and each vehicle Tbox communicates with a cloud server;

[0008] The vehicle Tbox collects environmental information and log information of vehicle parts;

[0009] The vehicle Tbox performs intrusion detection on the collected information, and when a security event is detected, the vehicle Tbox uploads the log information to the cloud server;

[0010] The cloud server performs data format analysis and filtering on the log information, performs format normalization processing on sensitive data information, stores the normalized data, and uses security rules in a predefined security rule library to associate, analyze and match the stored data to generate an analysis result.

[0011] The cloud server displays and issues the analysis result to the vehicle Tbox, and implements a linkage response of the security protection equipment of the vehicle terminal according to the analysis result.

[0012] In a second aspect, the present application provides a Tbox-based information security protection method for vehicle networking.

[0013] The Tbox-based information security protection method for vehicle networking comprises the following steps.

[0014] The vehicle Tbox collects environmental information and log information of vehicle parts.

[0015] The vehicle Tbox performs intrusion detection on the collected information, and uploads the log information to the cloud server when a security event is detected.

[0016] The cloud server performs data format analysis and filtering on the log information, performs format normalization processing on sensitive data information, stores the normalized data, and uses security rules in a predefined security rule library to associate, analyze and match the stored data to generate an analysis result.

[0017] The cloud server displays and issues the analysis result to the vehicle Tbox, and implements a linkage response of the security protection equipment of the vehicle terminal according to the analysis result.

[0018] Compared with the prior art, the present application has the following advantages:

[0019] 1. The attacks and risk items suffered by the vehicle terminal can be effectively monitored and identified, and the log is transmitted to the cloud server, which makes an emergency response back to the vehicle terminal to form a closed-loop management.

[0020] 2. The cloud server monitors the log data transmitted by the vehicle terminal in real time, identifies the risk items, classifies and grades the security events, and takes different strategy management and solution measures; the vulnerability library connected by the cloud server is also updated in real time, ensuring that the latest security events can be identified and managed.

[0021] 3. The subsequent operation and maintenance of the cloud server tends to be intelligent, the whole set of security management strategy has a standardized implementation process, can be compatible with various vehicle architectures, various parts, various operating systems, and supports platformized vehicle models, and can more quickly identify security events and take corresponding solution measures to ensure the safety of intelligent networked vehicles.

[0022] 4. The probe deployed by the end of the vehicle is perfectly linked with the cloud server, and the constantly innovative big data security technology is used to achieve "listening to its sound and identifying its shape", so as to establish a closed-loop management system integrating monitoring, early warning, reporting, disposal and feedback, and become the sharpest weapon to resist network threats. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings, which form a part of this specification, are included to provide a further understanding of the application, and are incorporated in and constitute a part of this specification. The embodiments of these drawings are shown to explain the present application and are not intended to limit the present application unduly.

[0024] Figure 1 A Tbox information security management design strategy system flowchart is provided.

[0025] Figure 2 A rule generation tool is provided. DETAILED DESCRIPTION

[0026] It should be noted that the following detailed description is merely exemplary in nature and is intended to provide further description of the application. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0027] It should be noted that the terms used herein are merely for the purpose of describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, the singular form is intended to include the plural form unless the context clearly indicates otherwise. In addition, it should be understood that the terms "comprise" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units need not be limited to only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product or device.

[0028] The embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0029] All data acquisition of the present embodiment is based on compliance with laws and regulations and user consent, and legal application of data.

[0030] Term explanation:

[0031] Vehicle-mounted Tbox: Telematic box; vehicle-mounted information communication module.

[0032] Embodiment one

[0033] The present embodiment provides a Tbox-based Internet of Vehicles information security protection system;

[0034] The vehicle-to-everything (V2X) information security protection system based on Tbox includes: several vehicle terminals, each vehicle terminal is equipped with an in-vehicle Tbox, and each in-vehicle Tbox communicates with a cloud server;

[0035] The in-vehicle T-box collects environmental and log information from vehicle components.

[0036] The in-vehicle Tbox performs intrusion detection on the collected information. When a security event is detected, the in-vehicle Tbox uploads the log information to the cloud server.

[0037] The cloud server performs data format analysis and filtering on log information, normalizes the format of sensitive data, and stores the normalized data; it also uses security rules from a predefined security rule base to correlate, analyze, and match the stored data to generate analysis results.

[0038] The cloud server displays the analysis results and sends them to the vehicle's Tbox, and the vehicle's security protection devices respond in conjunction with the analysis results.

[0039] Furthermore, the vehicle-mounted Tbox collects environmental information and log information from vehicle components;

[0040] The environmental information specifically includes: hardware environment, software environment, operating environment, operating system and middleware;

[0041] The hardware environment includes: information communication module components; the software environment includes: 5G version TOBX: Linux 4.14.206; 4G version TBOX: Linux 3.18; the operating environment uses a public cloud server; the operating system uses CentOS 7.9; the middleware includes: MySQL 5.7, Redis 5.0, Kafka 2.8.1, Elasticsearch 7.6.2, MongoDB 4.4.13, and cloud load balancing service.

[0042] Furthermore, the in-vehicle Tbox performs intrusion detection on the collected information. When a security event is detected, the in-vehicle Tbox uploads the log information to the cloud server.

[0043] The specific tool used for intrusion detection is the Intrusion Detection and Prevention System (IDPS).

[0044] It should be understood that an intrusion detection and prevention system is a network security device that monitors network transmissions in real time and issues alerts or takes proactive measures when suspicious transmissions are detected.

[0045] Security incidents include: system security incidents, communication security incidents, application security incidents, data security incidents, and business security incidents.

[0046] System security incidents include: mandatory access control, creation, deregistration, and deletion of system users, access control, and system vulnerabilities.

[0047] Communication security incidents include: filtering firewalls, stateful firewalls, scanning and probing (Scan), denial-of-access (DoS), spoofing, malformed packets, password brute-force attacks, Trojan horse implantation, and vulnerability exploitation;

[0048] Application security incidents include: unauthorized application installation, unauthorized application privilege escalation, authorized application data tampering, authorized application uninstallation, application signature tampering, and application permission control.

[0049] Data security incidents include: certificate tampering, impersonation, unauthorized key reading, application critical data tampering, unauthorized access, log information tampering, and unauthorized access.

[0050] Business security incidents include: FOTA firmware signature verification failure, FOTA firmware transmission failure, FOTA firmware flashing failure, SOTA application full package signature verification failure, incremental package signature verification failure, incremental package transmission failure, incremental package installation failure, OBD diagnostic Tester authentication failure, OBD diagnostic seed probe, remote diagnostic remote authentication failure, and remote diagnostic seed probe.

[0051] Furthermore, the cloud server performs data format analysis and filtering on the log information, specifically including:

[0052] Collect, classify, and evaluate intelligence information related to the Internet of Vehicles (IoV), including internal and external cybersecurity information; identify and evaluate the reliability and completeness of reported information; shut down information if the evaluation result is invalid; trigger the security incident emergency response process if the evaluation result is a security incident; trigger the risk assessment process if the evaluation result is risk information; and trigger the vulnerability management process if the evaluation result is vulnerability information.

[0053] Furthermore, the format normalization processing of sensitive data information refers to the log information collected by the intrusion detection and prevention system; the normalization processing includes: uniformly reporting to the cloud server.

[0054] Furthermore, the step of using security rules from a predefined security rule base to correlate, analyze, and match stored data to generate analysis results specifically includes:

[0055] Among them, the security rule base is used to store security events collected by the intrusion detection and prevention system through the selog;

[0056] Among them, security rules include: firewall rules, network intrusion detection rules, and host intrusion detection rules;

[0057] Among them, firewall rules receive and forward firewall rule requests from slave nodes to the backend, and forward firewall rules returned by the backend to slave nodes;

[0058] Among them, the network intrusion detection rules receive and forward network intrusion detection rule requests from slave nodes to the backend, and forward the network intrusion detection rules returned by the backend to the slave nodes;

[0059] Among them, the host intrusion detection rule receives and forwards the host intrusion detection rule request from the slave node to the backend, and forwards the host intrusion detection rule returned by the backend to the slave node.

[0060] Among them, the association, analysis and matching of stored data refers to the process by which the intrusion detection and prevention system collects vehicle security events from the selog, matches the security events to the network security event database to determine their level and source, and then takes corresponding emergency response measures based on the security event level and the source of the security threat.

[0061] Furthermore, the cloud server displays the analysis results and sends them to the in-vehicle Tbox, and implements a coordinated response from the vehicle terminal's security protection devices based on the analysis results;

[0062] Among them, security protection equipment refers to the software development kit for intrusion detection and prevention systems;

[0063] Among them, the linkage response of the vehicle terminal security protection equipment based on the analysis results refers to the Intrusion Detection and Prevention System (IDPS) detecting and scanning attacks and generating events when the corresponding attacks are detected.

[0064] The Intrusion Detection and Prevention System (IDPS) reports events to the NodeManager, which is deployed in various components, for event aggregation within the controller.

[0065] Then, the NodeManager, the controller management node deployed in each component, reports the events to the VehicleManager, the vehicle management node deployed in the TBOX, for vehicle event aggregation.

[0066] Ultimately, the VehicleManager node deployed in TBOX reports the event to the vehicle safety operations center on the cloud server.

[0067] The vehicle safety operations center on the cloud server analyzes security incidents, identifies risk levels and sources, collects emergency response measures and transmits them to the vehicle for coordinated response, forming a closed-loop management system.

[0068] Furthermore, the cloud server is also configured to: determine whether the current security rules need to be updated based on the vulnerability data in the log information; if updates are required, configure new security rules within the cloud server.

[0069] Furthermore, the in-vehicle Tbox polls and pulls the latest security rules from the cloud server and stores the latest security rules in its own memory.

[0070] Furthermore, the generation process of the new security rules includes:

[0071] The OEM client sends a communication matrix to the Intrusion Detection and Prevention System (IDPS) vendor client;

[0072] The Intrusion Detection and Prevention System (IDPS) vendor client generates initial security rules based on the communication matrix, and then sends these initial security rules to the component vendor client.

[0073] The component supplier client updates the initial security rules and stores the updated security rules in the microprocessor of the cloud server.

[0074] When intelligent connected vehicles are in use, the need for network connectivity for communication inside and outside the vehicle may lead to external attacks. Therefore, it is necessary to equip the TBOX with probe packages to monitor the risks of components, including environmental monitoring and log monitoring.

[0075] The cloud server's security operations center (situation awareness platform) performs event analysis and presentation, and determines whether the policy needs to be updated based on vulnerability information. If an update is required, the new policy is configured in the cloud server security operations center (situation awareness platform) policy management.

[0076] Each intrusion detection and prevention system polls the cloud server security operations center (situational awareness platform) to pull updated security rules, and the master node also plays a forwarding role in this process.

[0077] An Intrusion Detection and Prevention System (IDS) or Intrusion Detection and Prevention System (IDPS) is divided into five modules based on system architecture design and functional requirements: Vehicle Manager, Node Manager, NIDPS, HIDS, and SELOG. These five modules work together to form a complete vehicle-side IDPS system.

[0078] 1. Vehicle Manager: The vehicle management node, deployed in TBOX, interacts directly with VSOC. It includes functions such as engine-related services, registration services, configuration services, rule-related services, upload services, log services, and node communication services.

[0079] 2. Node Manager: The management node within the controller, deployed in various components, including ICC and TBOX. It is responsible for managing the IDPS components, interacting with the Vehicle Manager to obtain VSOC configuration rules, and reporting security events, logs, traffic, and other information.

[0080] 3. NIDPS: Deployed in ICC (both QNX7.0 and Android R systems) and TBOX to implement firewall configuration, network intrusion detection, deep packet inspection, traffic inspection, Bluetooth inspection and other functions.

[0081] 4. HIDS: Deployed on ICC (Android R system) to implement log monitoring, interface status monitoring, system environment monitoring, integrity detection, and rootkit detection functions.

[0082] 5. SELOG: Deployed in various components to realize the function of collecting and storing vehicle safety logs. This invention describes TBOX.

[0083] like Figure 1 As shown, a remotely controlled vehicle network system includes:

[0084] The vehicle's TBOX terminal should be equipped with a software development kit (SDK) to monitor network security incidents on the vehicle's Ethernet and 4G / 5G networks;

[0085] A cloud server is used to build a security operation platform to receive and analyze vehicle-side security event logs, then issue rules to the vehicle-side, configure and update security policies, thus forming a closed loop for information security policy management.

[0086] like Figure 2 As shown, rule generation includes:

[0087] 1. The vehicle Tbox manufacturer releases the communication matrix / actual vehicle data, and the OEM outputs the communication matrix or actual vehicle data; whether message and signal filtering is needed is determined based on the IDS performance assessment.

[0088] 2. The IDPS (Intrusion Detection and Prevention System) provider generates rules, binds these rules to the communication matrix, and regenerates the rules as the communication matrix changes.

[0089] 3. Component suppliers update the rules for components. The rules are stored in the microprocessor and memory protection unit (MPU). Online updates are made by sending the rules to the MPU via HTTPS after mass production, and the rules are pulled when CANIDS restarts. Offline updates are made through the basic services in the diagnostic service.

[0090] Example 2

[0091] This embodiment provides a vehicle network information security protection method based on Tbox;

[0092] T-box-based vehicle-to-everything (V2X) information security protection methods include:

[0093] The in-vehicle T-box collects environmental and log information from vehicle components.

[0094] The in-vehicle Tbox performs intrusion detection on the collected information. When a security event is detected, the in-vehicle Tbox uploads the log information to the cloud server.

[0095] The cloud server performs data format analysis and filtering on log information, normalizes the format of sensitive data, and stores the normalized data; it also uses security rules from a predefined security rule base to correlate, analyze, and match the stored data to generate analysis results.

[0096] The cloud server displays the analysis results and sends them to the vehicle's Tbox, and the vehicle's security protection devices respond in conjunction with the analysis results.

[0097] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A Tbox-based information security protection system for Internet of Vehicles, characterized in that, The system comprises: a plurality of vehicle terminals, each of which is equipped with a vehicle Tbox, and each vehicle Tbox communicates with a cloud server; the vehicle Tbox collects environmental information and log information of vehicle parts, wherein the environmental information specifically includes hardware environment, software environment, running environment, operating system and middleware; the vehicle Tbox performs intrusion detection on the collected information, and uploads log information to the cloud server when a security event is detected, wherein the security event includes system security event, communication security event, application security event, data security event and business security event; the cloud server performs data format analysis and filtering on the log information, performs format normalization processing on sensitive data information, and stores the normalized data; the cloud server uses security rules in a predefined security rule library to associate, analyze and match the stored data, and generates an analysis result; the cloud server displays and sends the analysis result to the vehicle Tbox, and implements a linkage response of a security protection device of the vehicle terminal according to the analysis result; the cloud server is further configured to determine whether the current security rule needs to be updated based on vulnerability data in the log information, and if the current security rule needs to be updated, configure a new security rule in the cloud server; the vehicle Tbox polls and pulls the latest security rule from the cloud server, and stores the latest security rule in a storage of the vehicle Tbox; the generation process of the new security rule comprises: a host factory client sends a communication matrix to an intrusion detection and prevention system (IDPS) supplier client; the IDPS supplier client generates an initial security rule according to the communication matrix, and the IDPS supplier client sends the initial security rule to a parts supplier client; the parts supplier client updates the initial security rule, and stores the updated security rule in a microprocessor of the cloud server. 2.The Tbox-based information security protection system for Internet of Vehicles according to claim 1, characterized in that, The vehicle Tbox performs intrusion detection on the collected information, and uploads log information to the cloud server when a security event is detected; wherein the tool used for intrusion detection is an intrusion detection and prevention system (IDPS). 3.The Tbox-based information security protection system for Internet of Vehicles according to claim 1, characterized in that, The system security event includes mandatory access control, creation, logout, deletion, permission control and system vulnerability of system user; The communication security event includes filtering firewall, state firewall, scanning and detection, denial of access, spoofing, abnormal packet, password cracking, Trojan implantation and vulnerability exploitation; The application security event includes installation of unauthorized application program, privilege escalation of unauthorized application program, data tampering of authorized application program, uninstallation of authorized application program, application signature tampering and application permission control; The data security event includes certificate tampering, forgery, illegal key reading, application critical data tampering, illegal access, log information tampering and illegal access. Business security events, including: FOTA firmware signature verification failure, FOTA firmware transmission failure, FOTA firmware flashing failure, SOTA application complete package signature verification failure, incremental package signature verification failure, incremental package transmission failure, incremental package installation failure, OBD diagnostic tester authentication failure, OBD diagnostic seed probe, remote diagnosis remote authentication failure, remote diagnosis seed probe.

4. The Tbox-based information security protection system for Internet of Vehicles according to claim 1, characterized in that, The cloud server performs data format analysis and filtering on the log information, specifically including: Collecting intelligence information related to Internet of Vehicles for classification and evaluation, wherein the intelligence information includes internal and external network security information; identifying whether the reported information is reliable and complete, and evaluating; if the evaluation result is invalid information, it is closed; if the evaluation result is a security event, trigger the security event emergency response process; if the evaluation result is risk information, trigger the risk assessment process; if the evaluation result is vulnerability information, trigger the vulnerability management process. 5.The Tbox-based information security protection system for Internet of Vehicles according to claim 1, characterized in that, The security rules in the pre-defined security rule library are used to associate, analyze and match the stored data to generate analysis results, specifically including: The security rule library is used to store security events collected by the intrusion detection and prevention system through selog; the security rules include: firewall rules, network intrusion detection rules and host intrusion detection rules; Associating, analyzing and matching the stored data means that after the selog of the intrusion detection and prevention system collects the security events of the vehicle, the security events are matched and analyzed according to the network security event library, and then the corresponding emergency response measures are taken according to the security event level and the source of security threat. 6.The Tbox-based information security protection system for Internet of Vehicles according to claim 1, characterized in that, The cloud server displays and issues the analysis results to the vehicle Tbox, and realizes the linkage response of the security protection equipment of the vehicle terminal according to the analysis results, wherein the security protection equipment refers to the software development kit of the intrusion detection and prevention system; Among them, according to the analysis results, the linkage response of the security protection equipment of the vehicle terminal is realized, which means that the intrusion detection and prevention system IDPS detects the scanning attack, and generates an event when a corresponding attack is detected; The intrusion detection and prevention system IDPS reports the event to the controller management node NodeManager deployed in each component for controller event aggregation; Then the controller management node NodeManager deployed in each component reports the event to the whole vehicle management node VehicleManager deployed in the Tbox for whole vehicle event aggregation; Finally, the whole vehicle management node VehicleManager deployed in the Tbox reports the event to the vehicle safety operation center of the cloud server; The vehicle safety operation center of the cloud server analyzes the security events, identifies the risk level and risk source; collects emergency response measures to the vehicle terminal for linkage response, forming a closed-loop management.

7. The Tbox-based information security protection method for Internet of Vehicles, which adopts the Tbox-based information security protection system for Internet of Vehicles according to any one of claims 1-6, characterized in that, Including: The vehicle Tbox collects the environmental information and log information of the vehicle components; The vehicle Tbox performs intrusion detection on the collected information, and uploads the log information to the cloud server when detecting a security event; The cloud server performs data format analysis and filtering on the log information, performs format normalization processing on sensitive data information, and stores the normalized data; The security rules in the predefined security rule library are used to associate, analyze and match the stored data, and an analysis result is generated; The cloud server displays and issues the analysis result to the vehicle-mounted Tbox, and implements a linkage response of the security protection equipment of the vehicle terminal according to the analysis result.

Images