On-board diagnostic protection system and method based on DoIP protocol

Abstract

The present invention discloses an on-vehicle diagnosis protection system and method based on the DoIP protocol. The DoIP traffic sent by the diagnostic instrument is first filtered by a MAC protection module. If the MAC is illegal or the system is in a forced protection mode, the traffic is discarded. If the MAC of the device is legal, the DoIP traffic is captured. Malicious behavior detection is performed on the captured DoIP traffic to determine whether malicious behavior exists. If malicious behavior exists, the data is discarded and information is recorded, and the MAC of the data packet is added to a MAC blacklist to deny subsequent access. When no malicious behavior is detected, the traffic content is matched according to the protection rules. If the rules are matched, the data is discarded and information is recorded, and the MAC of the data packet is added to a MAC blacklist to deny subsequent access. If no match is found, the traffic is handed over to the DoIP server entity for processing.

Description

Technical Field

[0001] The present invention relates to on-board diagnostic information technology, and in particular to an on-board diagnostic protection system and method based on a DoIP protocol. Background Art

[0002] With the popularization of Internet of Vehicles technology, the on-board diagnostic information technology, which is mainly based on the CAN network, can no longer meet the demand for transmitting large amounts of data. This is because the bandwidth of the CAN network limits the communication rate between the diagnostic equipment and the ECU, especially when performing operations with large amounts of data transmission, such as refreshing software and system upgrades, the communication time needs to be improved urgently.

[0003] In order to solve the problem of large transmission volume and improve the security and stability of the vehicle network, the Ethernet-based DoIP diagnostic communication technology fully utilizes the advantages of Ethernet's high bandwidth and low latency to establish a high-speed transmission channel between the diagnostic equipment and the ECU, and realize diagnostic communication based on Ethernet and UDS protocol.

[0004] The communication environment of the in-vehicle network has extremely high requirements for security and reliability. When the DoIP protocol is used for vehicle diagnosis, traditional Ethernet network security issues are also introduced. Summary of the invention

[0005] In order to solve the deficiencies in the prior art, the object of the present invention is to provide a vehicle-mounted diagnostic protection system and method based on the DoIP protocol.

[0006] To achieve the purpose of the present invention, the technical solution adopted by the present invention is:

[0007] A vehicle-mounted diagnostic protection system based on the DoIP protocol, the system is deployed in the DoIP edge gateway node, and the DoIP traffic of the diagnostic instrument is sent to the DoIP edge gateway node if it is a legitimate message after being diagnosed by the system, otherwise it is discarded in this system;

[0008] The system includes a MAC protection module, a DoIP traffic capture module, a malicious behavior detection module, and a traffic content matching module;

[0009] The MAC protection module performs MAC filtering on the DoIP traffic sent by the diagnostic instrument. If the MAC is illegal or the system is in forced protection mode, the traffic will be discarded; if the MAC of this device is legal, DoIP traffic will be captured;

[0010] The DoIP traffic capture module captures DoIP traffic through the hook mechanism provided by the Linux kernel Netfilter network subsystem or by directly obtaining network card traffic;

[0011] Malicious behavior detection module performs malicious behavior detection on the captured DoIP traffic to determine whether there is malicious behavior. If there is malicious behavior, the data is discarded and the information is recorded. At the same time, the MAC of this data packet is added to the MAC blacklist to deny subsequent access behavior;

[0012] The traffic content matching module matches the traffic content according to the protection rules when no malicious behavior is detected. If the rules are matched, the data is discarded and the information is recorded. At the same time, the MAC of this data packet is added to the MAC blacklist to deny subsequent access. If there is no match, the traffic is handed over to the DoIP server entity for processing.

[0013] Furthermore, the functions of the MAC protection module include: traffic filtering based on MAC blacklist, mandatory protection mode, adding a new MAC blacklist, deleting a MAC blacklist based on a policy, and user-initiated deletion of a MAC blacklist.

[0014] Furthermore, traffic filtering based on MAC blacklist: the MAC protection module maintains a MAC blacklist, and all DoIP traffic is discarded if the source MAC address is in this blacklist;

[0015] Forced protection mode: prohibit all DoIP traffic access for a certain period of time, and release this mode after the timeout; if the traffic filtering hits based on the MAC blacklist continue to occur after the release, the time of this mode will be dynamically adjusted; if the device traffic sending frequency in the MAC blacklist is higher than the set threshold, enter the forced protection mode; if multiple different MACs are added to the blacklist within a certain period of time, enter this mode;

[0016] New MAC blacklist: When malicious behavior detection or traffic content matching finds an illegal device, the MAC address device can be added to the MAC blacklist;

[0017] Policy-based MAC blacklist deletion: Remove MAC from the blacklist based on the built-in algorithm;

[0018] User actively deletes MAC blacklist: used when vehicle diagnostic personnel make mistakes.

[0019] A vehicle-mounted diagnosis protection method based on the DoIP protocol includes the following steps:

[0020] The DoIP traffic sent by the diagnostic instrument first passes through the MAC protection module for MAC filtering. If it is an illegal MAC or the system is in forced protection mode, the traffic is discarded; if the MAC of this device is legal, DoIP traffic is captured;

[0021] Perform malicious behavior detection on the captured DoIP traffic to determine whether there is malicious behavior. If there is malicious behavior, discard the data and record the information. At the same time, add the MAC of this data packet to the MAC blacklist to deny subsequent access behavior.

[0022] When no malicious behavior is detected, the traffic content is matched according to the protection rules. If the rules are matched, the data is discarded and the information is recorded. At the same time, the MAC of this data packet is added to the MAC blacklist to deny subsequent access. If there is no match, the traffic is handed over to the DoIP server entity for processing.

[0023] Furthermore, the malicious behavior detection process is as follows:

[0024] The captured DoIP traffic is verified according to the message format defined in the ISO13400-2 specification. If it does not conform to the message format defined in the specification, the access log is recorded and the configuration determines whether to store the traffic as pcap. At the same time, the message is discarded and the MAC address is added to the MAC blacklist. When it conforms to the ISO13400-2 message format, the traffic is classified according to the transport layer protocol, including UDP type traffic, TCP type traffic, and routing activation type messages.

[0025] Furthermore, if it is UDP type traffic, determine whether the sending frequency exceeds the preset sending threshold based on different DoIP function codes. If it exceeds the threshold, record the access log and determine whether to store the traffic in pcap based on the configuration. At the same time, discard the message and add the MAC address to the MAC blacklist; otherwise, forward the message to the DoIP server entity for further processing.

[0026] Furthermore, if it is TCP type traffic, first determine whether the MAC device repeatedly establishes a socket to try to connect to the DoIP entity. If it meets the conditions, record the access log and determine whether to store the traffic in pcap according to the configuration. At the same time, discard the message and add the MAC address to the MAC blacklist.

[0027] Furthermore, if it is a routing activation type message, it is determined whether the number of routing activation failures exceeds the preset threshold. If so, the access log is recorded and it is determined according to the configuration whether to store the traffic in pcap. At the same time, the message is discarded and the MAC address is added to the MAC blacklist; when the routing activation is successful and the diagnostic instrument starts to diagnose, it is determined whether the sending frequency of the diagnostic message exceeds the preset threshold. If so, the access log is recorded and it is determined according to the configuration whether to store the traffic in pcap. At the same time, the message is discarded and the MAC address is added to the MAC blacklist. Otherwise, the message is forwarded to the DoIP server entity for further processing.

[0028] Furthermore, the flow content matching process is as follows: rely on the malicious rule library to match the content in the flow. If a hit is found, the access log is recorded and it is determined whether to store the flow in pcap according to the configuration. At the same time, the message is discarded and the MAC address is added to the MAC blacklist. This malicious rule library can be updated with the latest official rule library online or offline.

[0029] The beneficial effect of the present invention is that, compared with the prior art, the system of the present invention can be deployed in all DoIP entities (MCU / MPU) in the vehicle, and can be quickly adapted; it can be deployed together with the DoIP protocol software through code architecture fusion to achieve cache sharing, further reduce the resource occupation of the vehicle system, and improve the detection and protection efficiency. After identifying that the vehicle has been diagnosed by a malicious person, all subsequent diagnostic behaviors can be completely rejected, which improves the security of the DoIP vehicle diagnostic network and can prevent malicious persons from attacking the vehicle through the DoIP protocol.

[0030] When a malicious person attempts to diagnose the vehicle again after the device used is rejected and the malicious person replaces the diagnostic device, the mandatory protection mode proposed in the present invention can reject all devices' diagnostic behavior on the vehicle, leaving enough response time for resolving the attack incident.

[0031] The present invention is applicable to a DoIP-based on-board diagnostic network, realizes DoIP-based network diagnostic protection, provides security protection for vehicle DoIP diagnosis, and can 100% prevent illegal personnel from subsequent access to the vehicle after malicious diagnosis is discovered, thereby improving the reliability and security of the on-board diagnostic network. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a schematic diagram of the deployment of the on-board diagnostic protection system based on the DoIP protocol described in the present invention;

[0033] Figure 2 It is a flow chart of the vehicle-mounted diagnosis protection method based on the DoIP protocol described in the present invention;

[0034] Figure 3 This is a functional diagram of the MAC protection module;

[0035] Figure 4 This is a schematic diagram of the MAC protection module workflow;

[0036] Figure 5 This is a schematic diagram of the malicious behavior detection process. DETAILED DESCRIPTION

[0037] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of this application.

[0038] In order to solve the problem of malicious personnel forging messages or attacking the system through fuzzy methods, in addition to filtering the identified illegal messages based on the DoIP message format, working scenario, and the sending frequency of the detection message, new policy rules and protection diagnosis methods will be introduced to form a DoIP protocol on-board diagnosis protection system with MAC protection, DoIP traffic capture, malicious behavior detection, and traffic content matching. After filtering the identified attack messages, the subsequent operation of the vehicle can be blocked, effectively preventing the intruder's illegal vehicle diagnosis, preventing the vehicle from encountering malicious attacks, and improving the network security and stability of the vehicle.

[0039] like Figure 1 As shown, the DoIP protocol-based on-board diagnostic protection system described in the present invention is deployed in a DoIP edge gateway node. After the DoIP traffic of the diagnostic instrument is diagnosed by the system, if it is a legal message, it is sent to the DoIP edge gateway node, otherwise it is discarded in this system.

[0040] Specifically, the diagnostic instrument is physically connected to the exposed external OBD port, and accesses the DoIP edge gateway node through Ethernet. After vehicle discovery, TCP connection, and routing activation, the routing function of the DoIP edge gateway node is used to diagnose all DoIP entities and gateway nodes in the vehicle. After the diagnosis is completed, the TCP connection is disconnected.

[0041] The DoIP protocol-based on-board diagnostic protection system of the present invention comprises four parts: a MAC protection module, a DoIP traffic capture module, a malicious behavior detection module, and a traffic content matching module.

[0042] The MAC protection module performs MAC filtering on the DoIP (TCP, UDP) traffic sent by the diagnostic instrument. If the MAC is illegal or the system is in forced protection mode, the traffic will be discarded; if the MAC of this device is legal, DoIP traffic will be captured;

[0043] The DoIP traffic capture module captures DoIP traffic through the hook mechanism provided by the Linux kernel Netfilter network subsystem or by directly obtaining network card traffic.

[0044] Malicious behavior detection module performs malicious behavior detection on the captured DoIP traffic to determine whether there is malicious behavior. If there is malicious behavior, the data is discarded and the information is recorded. At the same time, the MAC of this data packet is added to the MAC blacklist to deny subsequent access behavior;

[0045] The traffic content matching module matches the traffic content according to the protection rules when no malicious behavior is detected. If the rules are matched, the data is discarded and the information is recorded. At the same time, the MAC of this data packet is added to the MAC blacklist to deny subsequent access. If there is no match, the traffic is handed over to the DoIP server entity for processing.

[0046] like Figure 2 As shown, the vehicle-mounted diagnosis protection method based on the DoIP protocol of the present invention comprises the following steps:

[0047] The DoIP (TCP, UDP) traffic sent by the diagnostic instrument first passes through the MAC protection module for MAC filtering. If it is an illegal MAC or the system is in forced protection mode, the traffic will be discarded; if the MAC of this device is legal, DoIP traffic will be captured;

[0048] Perform malicious behavior detection on the captured DoIP traffic to determine whether there is malicious behavior. If there is malicious behavior, discard the data and record the information. At the same time, add the MAC of this data packet to the MAC blacklist to deny subsequent access behavior.

[0049] When no malicious behavior is detected, the traffic content is matched according to the protection rules. If the rules are matched, the data is discarded and the information is recorded. At the same time, the MAC of this data packet is added to the MAC blacklist to deny subsequent access. If there is no match, the traffic is handed over to the DoIP server entity for processing.

[0050] like Figure 3 and 4 As shown, the functions of the MAC protection module include: traffic filtering based on MAC blacklist, mandatory protection mode, adding a new MAC blacklist, deleting the MAC blacklist based on a policy, and user-initiated deletion of the MAC blacklist.

[0051] Traffic filtering based on MAC blacklist: The MAC protection module maintains a MAC blacklist. All DoIP traffic will be discarded if the source MAC address is in this blacklist.

[0052] Forced protection mode: prohibit all DoIP traffic access for a certain period of time, and release this mode after the timeout; if the traffic filtering hits based on the MAC blacklist continue to occur after the release, the time of this mode will be dynamically adjusted. If the device traffic sending frequency in the MAC blacklist is higher than the set threshold, it will enter the forced protection mode; if multiple different MACs are added to the blacklist within a certain period of time, it will also enter this mode.

[0053] New MAC blacklist: When malicious behavior detection or traffic content matching finds an illegal device, you can add the device with this MAC address to the MAC blacklist.

[0054] Policy-based MAC blacklist deletion: Removes MAC addresses from the blacklist based on a built-in algorithm.

[0055] User actively deletes MAC blacklist: This method is used by vehicle diagnostic personnel when they make a mistake.

[0056] like Figure 5 As shown, the MAC protection module of the on-board diagnostic protection system needs to rely on malicious behavior detection and traffic content matching to provide MAC information for processing. The malicious behavior detection process is as follows:

[0057] The captured DoIP traffic is verified according to the message format defined in the ISO13400-2 specification. If it does not conform to the standard message format, the access log is recorded and the configuration determines whether to store the traffic as pcap. At the same time, the message is discarded and the MAC address is added to the MAC blacklist.

[0058] When the message format conforms to ISO13400-2, the traffic is classified according to the transport layer protocol. If it is UDP type traffic, the sending frequency is determined based on different DoIP function codes to see whether it exceeds the preset sending threshold. If it exceeds, the access log is recorded and the configuration determines whether to store the traffic in pcap. At the same time, the message is discarded and the MAC address is added to the MAC blacklist; otherwise, the message is forwarded to the DoIP server entity for further processing.

[0059] If the traffic is of TCP type, first determine whether the MAC device repeatedly establishes a socket to try to connect to the DoIP entity. If it meets the conditions, record the access log and determine whether to store the traffic in pcap according to the configuration. At the same time, discard the message and add the MAC address to the MAC blacklist.

[0060] If it is a routing activation type message, determine whether the number of routing activation failures exceeds the preset threshold (failure includes failure to comply with the message format or behavior defined in the ISO13400 specification, failure of the identity authentication mechanism, failure of certificate authentication when using TLS communication, etc.). If exceeded, record the access log and determine whether to store the traffic in pcap according to the configuration. At the same time, discard the message and add the MAC address to the MAC blacklist.

[0061] When the routing is successfully activated and the diagnostic instrument starts to diagnose, it determines whether the sending frequency of the diagnostic message exceeds the preset threshold. If it exceeds, it records the access log and determines whether to store the traffic in pcap according to the configuration. At the same time, it discards the message and adds the MAC address to the MAC blacklist. Otherwise, it forwards the message to the DoIP server entity for further processing.

[0062] The traffic content matching of this on-board diagnostic protection system relies on the malicious rule library to match the content in the traffic. If a hit is found, the access log is recorded and the configuration determines whether to store the traffic as pcap. At the same time, the message is discarded and the MAC address is added to the MAC blacklist. This malicious rule library can be updated with the latest official rule library online or offline.

[0063] The beneficial effect of the present invention is that, compared with the prior art, the system of the present invention can be deployed in all DoIP entities (MCU / MPU) in the vehicle, and can be quickly adapted; it can be deployed together with the DoIP protocol software through code architecture fusion to achieve cache sharing, further reduce the resource occupation of the vehicle system, and improve the detection and protection efficiency. After identifying that the vehicle has been diagnosed by a malicious person, all subsequent diagnostic behaviors can be completely rejected, which improves the security of the DoIP vehicle diagnostic network and can prevent malicious persons from attacking the vehicle through the DoIP protocol.

[0064] When a malicious person attempts to diagnose the vehicle again after the device used is rejected and the malicious person replaces the diagnostic device, the mandatory protection mode proposed in the present invention can reject all devices' diagnostic behavior on the vehicle, leaving enough response time for resolving the attack incident.

[0065] The present invention is applicable to a DoIP-based on-board diagnostic network, realizes DoIP-based network diagnostic protection, provides security protection for vehicle DoIP diagnosis, and can 100% prevent illegal personnel from subsequent access to the vehicle after malicious diagnosis is discovered, thereby improving the reliability and security of the on-board diagnostic network.

[0066] The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, but not to limit the scope of protection of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the scope of protection of the present invention.

Claims

1. A vehicle-mounted diagnostic protection system based on the DoIP protocol, characterized in that: The system is deployed at the DoIP edge gateway node. After the DoIP traffic of the diagnostic instrument is diagnosed by the system, if it is a legitimate message, it will be sent to the DoIP server entity, otherwise it will be discarded in this system. The system includes a MAC protection module, a DoIP traffic capture module, a malicious behavior detection module, and a traffic content matching module; The MAC protection module performs MAC filtering on the DoIP traffic sent by the diagnostic instrument. If the MAC is illegal or the system is in forced protection mode, the traffic will be discarded; if the MAC of this device is legal, DoIP traffic will be captured; The DoIP traffic capture module captures DoIP traffic through the hook mechanism provided by the Linux kernel Netfilter network subsystem or by directly obtaining network card traffic; Malicious behavior detection module performs malicious behavior detection on the captured DoIP traffic to determine whether there is malicious behavior. If there is malicious behavior, the data is discarded and the information is recorded. At the same time, the MAC of this data packet is added to the MAC blacklist to deny subsequent access behavior; Traffic content matching module: when no malicious behavior is detected, the traffic content is matched according to the protection rules. If the rules are matched, the data is discarded and the information is recorded. At the same time, the MAC of the data packet is added to the MAC blacklist to deny subsequent access behavior. If there is no hit, the traffic is handed over to the DoIP server entity for processing; The functions of the MAC protection module include: traffic filtering based on MAC blacklist, mandatory protection mode, adding MAC blacklist, deleting MAC blacklist based on policy, and user-initiated deletion of MAC blacklist; Traffic filtering based on MAC blacklist: The MAC protection module maintains a MAC blacklist. All DoIP traffic will be discarded if the source MAC address is in this blacklist. Forced protection mode: prohibit all DoIP traffic access for a certain period of time, and release this mode after the timeout; if the traffic filtering hits based on the MAC blacklist continue to occur after the release, the time of this mode will be dynamically adjusted; if the device traffic sending frequency in the MAC blacklist is higher than the set threshold, enter the forced protection mode; if multiple different MACs are added to the blacklist within a certain period of time, enter this mode; New MAC blacklist: When malicious behavior detection or traffic content matching finds an illegal device, the MAC address device can be added to the MAC blacklist; Policy-based MAC blacklist deletion: Remove MAC from the blacklist based on the built-in algorithm; User actively deletes MAC blacklist: used when vehicle diagnostic personnel make mistakes.

2. A vehicle-mounted diagnostic protection method based on the DoIP protocol, based on the vehicle-mounted diagnostic protection system based on the DoIP protocol according to claim 1, characterized in that: The following steps are involved: The DoIP traffic sent by the diagnostic instrument first passes through the MAC protection module for MAC filtering. If it is an illegal MAC or the system is in forced protection mode, the traffic is discarded; if the MAC of this device is legal, DoIP traffic is captured; Perform malicious behavior detection on the captured DoIP traffic to determine whether there is malicious behavior. If there is malicious behavior, discard the data and record the information. At the same time, add the MAC of this data packet to the MAC blacklist to deny subsequent access behavior. If no malicious behavior is detected, the traffic content is matched according to the protection rules. If the rules are matched, the data is discarded and the information is recorded. At the same time, the MAC address of this data packet is added to the MAC blacklist to deny subsequent access. If there is no hit, the traffic will be handed over to the DoIP server entity for processing.

3. The vehicle-mounted diagnosis protection method based on the DoIP protocol according to claim 2 is characterized in that: The malicious behavior detection process is as follows: The captured DoIP traffic is verified according to the message format defined in the ISO13400-2 specification. If it does not conform to the standard message format, the access log is recorded and the configuration determines whether to store the traffic as pcap. At the same time, the message is discarded and the MAC address is added to the MAC blacklist. When it conforms to the ISO13400-2 message format, the traffic is classified according to the transport layer protocol, including UDP type traffic, TCP type traffic, and routing activation type messages.

4. The vehicle-mounted diagnosis protection method based on the DoIP protocol according to claim 3 is characterized in that: If the traffic is of UDP type, the sending frequency is judged according to different DoIP function codes to see whether it exceeds the preset sending threshold. If it exceeds, the access log is recorded and the pcap storage is judged according to the configuration. At the same time, the message is discarded and the MAC address is added to the MAC blacklist. Otherwise, the message is forwarded to the DoIP server entity for further processing.

5. The vehicle-mounted diagnosis protection method based on DoIP protocol according to claim 3 is characterized in that: If it is TCP type traffic, first determine whether the MAC device repeatedly establishes a socket to try to connect to the DoIP server entity. If it meets the conditions, record the access log and determine whether to store the traffic in pcap according to the configuration. At the same time, discard the message and add the MAC address to the MAC blacklist.

6. The vehicle-mounted diagnosis protection method based on DoIP protocol according to claim 3 is characterized in that: If it is a route activation type message, determine whether the number of route activation failures exceeds the preset threshold. If so, record the access log and determine whether to store the traffic in pcap according to the configuration. At the same time, discard the message and add the MAC address to the MAC blacklist. When the routing is successfully activated and the diagnostic instrument starts to diagnose, it determines whether the sending frequency of the diagnostic message exceeds the preset threshold. If it exceeds, the access log is recorded and the pcap storage of the traffic is determined according to the configuration. At the same time, the message is discarded and the MAC address is added to the MAC blacklist. Otherwise, the message is forwarded to the DoIP server entity for further processing.

7. The vehicle-mounted diagnosis protection method based on DoIP protocol according to claim 2 is characterized in that: The flow content matching process is as follows: rely on the malicious rule library to match the content in the flow. If a match is found, the access log is recorded and it is determined whether to store the flow in pcap according to the configuration. At the same time, the message is discarded and the MAC address is added to the MAC blacklist. This malicious rule base can be updated with the latest official rule base online or offline.

Images