Automobile data safety compliance detection method

Abstract

The invention provides an automobile data safety compliance detection method, which comprises the following steps of: monitoring whether an intelligent networked automobile is electrified or not, and when the intelligent networked automobile is monitored to be electrified, acquiring automobile end data generated by the intelligent networked automobile in a target time period formed from electrification to outage through data monitoring equipment deployed on the intelligent networked automobile; performing sensitive data identification on the vehicle end data to obtain sensitive data in the vehicle end data; obtaining vehicle end data internal storage information and vehicle end data external transmission information of the intelligent network connection vehicle; automatically detecting and analyzing the sensitive data, the internal storage information of the vehicle-end data and the external transmission information of the vehicle-end data to obtain a detection and analysis result, and judging whether the sensitive data has security risks or not according to the detection and analysis result; and automatically generating and outputting a risk analysis report according to whether the sensitive data has a safety risk, so that the automobile data safety compliance detection efficiency can be improved, and the detection system is perfected.

Description

Technical Field

[0001] The present invention relates to the technical field of data detection, and in particular to a method for detecting automobile data security compliance. Background Art

[0002] Intelligent Connected Vehicle (ICV) refers to the organic combination of Internet of Vehicles and smart cars, which can eventually replace human operation. With the new generation of technology and industrial changes, the intelligentization and networking of automobiles are accelerating transformation and development. The rapid evolution of automobile networking has caused a sharp increase in the network security and data security risks faced by intelligent connected vehicles. The development of smart cockpits, smart driving, V2X vehicle-road collaboration, and SOA architecture has made cars increasingly vulnerable to cyber attacks. In order to achieve functions such as automatic driving, assisted driving, human-computer interaction, and intelligent networking, smart cars continuously collect sensitive data such as environmental perception information, vehicle operating conditions, and personal information of drivers and passengers. If effective protection measures are not taken, data and privacy security risks will be caused. Establishing Internet of Vehicles and automobile data security testing capabilities, and developing automobile data security testing platforms and equipment can effectively support testing centers in carrying out data security testing business, improve the testing system, enhance testing capabilities, improve testing efficiency, and better meet the data security compliance testing needs of the automotive industry. At present, due to the lack of unified testing standards, there is still a lack of relevant technologies for automobile data security compliance testing. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a method for automobile data security compliance detection, which makes the first-time business information electronic to reduce transmission time and improve audit efficiency, making its management more convenient.

[0004] To achieve the above-mentioned object of the invention, the present invention provides a method for detecting automobile data security compliance, the method comprising the following steps:

[0005] Monitor whether the intelligent connected vehicle is powered on. When the intelligent connected vehicle is powered on, collect vehicle-side data generated by the intelligent connected vehicle in a target time period from power on to power off through data monitoring equipment deployed on the intelligent connected vehicle.

[0006] Performing sensitive data identification on the vehicle-side data to obtain sensitive data in the vehicle-side data;

[0007] Obtain the internal storage information of the vehicle-side data and the external transmission information of the vehicle-side data of the intelligent networked vehicle;

[0008] Automatically detect and analyze sensitive data, internal storage information of vehicle-side data, and external transmission information of vehicle-side data, obtain detection and analysis results, and determine whether there are security risks in sensitive data based on the detection and analysis results;

[0009] Based on whether there are security risks in sensitive data, a risk analysis report is automatically generated and output.

[0010] Furthermore, the sensitive data identification of the vehicle-side data includes:

[0011] Obtain historical vehicle-side data as sample data, annotate the sample data, and divide the annotated sample data into a training set and a test set;

[0012] Establish a machine learning model, pre-train the machine learning model through a training set, and test the machine learning model through a test set. When the recognition accuracy of the machine learning model is higher than a preset accuracy threshold, use the machine learning model as a sensitive data recognition model;

[0013] The vehicle-side data is input into the sensitive data identification model for analysis to obtain sensitive data in the vehicle-side data, where the sensitive data includes sensitive data categories and sensitive data contents.

[0014] Furthermore, the vehicle-side data internal storage information includes storage path and storage mode, and the vehicle-side data external transmission information includes transmission mode and transmission object. The sensitive data, the vehicle-side data internal storage information, and the vehicle-side data external transmission information are automatically analyzed to determine whether the sensitive data has security risks, including:

[0015] Determine the storage path of the sensitive data according to the internal storage information of the vehicle-side data, and detect whether the sensitive data is stored in plain text based on the storage path of the sensitive data to obtain a first detection result;

[0016] Determine the storage method of sensitive data according to the internal storage information of the vehicle-side data, and detect whether the access permission setting of the sensitive data complies with the preset permission management rules, whether the sensitive data is encrypted with a password, and whether the sensitive data is destroyed regularly based on the storage method of the sensitive data, to obtain a second detection result;

[0017] Determine the transmission mode of sensitive data according to the external transmission information of vehicle-side data, and detect whether the sensitive data is transmitted in plain text based on the transmission mode of the sensitive data to obtain a third detection result;

[0018] The first detection result, the second detection result and the third detection result are updated into the detection analysis result.

[0019] Furthermore, the method further comprises:

[0020] Determine the transmission object of sensitive data based on the external transmission information of vehicle-side data, and determine the system architecture information of the transmission object based on the transmission object of sensitive data;

[0021] Determine the microservice module applicable to the transmission object according to the system architecture information of the transmission object, encapsulate the microservice module and deployment verification information and send them to the transmission object;

[0022] The transmission object verifies the deployment verification information and deploys the microservice module locally after passing the verification;

[0023] When the intelligent connected vehicle sends vehicle-side data to the transmission object, the microservice module detects whether the vehicle-side data received by the transmission object is tampered with, detects whether the transmission object is subjected to a replay attack, and obtains a fourth detection result;

[0024] The fourth detection result is updated into the detection and analysis result.

[0025] Furthermore, the microservice module detects whether the vehicle-side data received by the transmission object has been tampered with and whether the transmission object has been subjected to a replay attack, including:

[0026] In the intermediate period between when the intelligent networked vehicle generates vehicle-side data and when the vehicle-side data is transmitted to the transmission object, a data summary of the vehicle-side data to be transmitted is generated;

[0027] At the next time point after the data summary is generated, search for other intelligent connected vehicles within a preset range around the intelligent connected vehicle that generates the data summary, and use the intelligent connected vehicle and the other intelligent connected vehicles found as temporary chain nodes;

[0028] Write the data summary into the latest block of the temporary chain to update the temporary chain, and reach consensus on the updated temporary chain among all temporary chain nodes;

[0029] When receiving vehicle-side data, the microservice module verifies the vehicle-side data based on the data summary stored in the temporary chain.

[0030] Furthermore, the method further comprises:

[0031] Detecting whether there is unregistered external data transmission on the intelligent network-connected vehicle through a wireless signal detection device deployed on the intelligent network-connected vehicle, and obtaining a fifth detection result;

[0032] The fifth detection result is updated into the detection analysis result.

[0033] Furthermore, the method further comprises:

[0034] Monitor whether the smart connected car has entered an overseas area through the positioning equipment deployed on the smart connected car;

[0035] When the intelligent networked vehicle enters a foreign area, detecting whether the external data transmission registered on the intelligent networked vehicle contains sensitive data, or detecting whether there is unregistered external data transmission on the intelligent networked vehicle through a wireless signal detection device deployed on the intelligent networked vehicle, to obtain a sixth detection result;

[0036] The sixth detection result is updated into the detection analysis result.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] The present invention provides a vehicle data security compliance detection method. When monitoring that a smart connected vehicle is powered on, the vehicle-side data generated by the smart connected vehicle in a target time period formed from power-on to power-off is collected by a data monitoring device deployed on the smart connected vehicle, and sensitive data is identified on the vehicle-side data to obtain sensitive data in the vehicle-side data. At the same time, the vehicle-side data internal storage information and vehicle-side data external transmission information of the smart connected vehicle are obtained, and the sensitive data, the vehicle-side data internal storage information, and the vehicle-side data external transmission information are automatically detected and analyzed to obtain the detection and analysis results. According to the detection and analysis results, it is judged whether the sensitive data has security risks, and a risk analysis report is automatically generated and output, thereby improving the test efficiency and solving the problems of incomplete detection system, poor reference and operability of test cases existing in similar products. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only preferred embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 It is a schematic diagram of the overall process of an automobile data security compliance detection method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The principles and features of the present invention are described below in conjunction with the accompanying drawings. The enumerated embodiments are only used to explain the present invention and are not used to limit the scope of the present invention.

[0042] Reference Figure 1 This embodiment provides a method for detecting automobile data security compliance, the method comprising the following steps:

[0043] S101. Monitor whether the intelligent connected vehicle is powered on. When it is detected that the intelligent connected vehicle is powered on, collect vehicle-side data generated by the intelligent connected vehicle in a target time period from power-on to power-off through a data monitoring device deployed on the intelligent connected vehicle.

[0044] S102: Perform sensitive data identification on the vehicle-side data to obtain sensitive data in the vehicle-side data.

[0045] S103: Obtain the internal storage information of the vehicle-side data and the external transmission information of the vehicle-side data of the intelligent connected vehicle.

[0046] S104. Automatically detect and analyze sensitive data, internal storage information of vehicle-side data, and external transmission information of vehicle-side data to obtain detection and analysis results, and determine whether there are security risks in the sensitive data based on the detection and analysis results.

[0047] S105. Automatically generate and output a risk analysis report based on whether there is a security risk with the sensitive data.

[0048] The method provided in this embodiment monitors whether the intelligent connected vehicle is powered on, collects the vehicle-side data generated by the intelligent connected vehicle within the target time period through the data monitoring device, identifies the sensitive data in the vehicle-side data, combines the internal storage information of the vehicle-side data and the external transmission information of the vehicle-side data, performs detection and analysis, determines whether the sensitive data poses a security risk based on the detection and analysis results, and automatically generates a risk analysis report, thereby improving the efficiency of data security and compliance detection of intelligent connected vehicles.

[0049] As an optional embodiment, the identifying of sensitive data on vehicle-side data includes:

[0050] S201. Obtain historical vehicle-side data as sample data, label the sample data, and divide the labeled sample data into a training set and a test set.

[0051] S202. Establish a machine learning model, pre-train the machine learning model through a training set, and test the machine learning model through a test set. When the recognition accuracy of the machine learning model is higher than a preset accuracy threshold, use the machine learning model as a sensitive data recognition model.

[0052] In this optional embodiment, models such as decision trees, support vector machines, random forests, neural networks, etc. can be used as machine learning models, and the present invention does not make specific limitations on this.

[0053] S203: Input the vehicle-side data into a sensitive data identification model for analysis to obtain sensitive data in the vehicle-side data, where the sensitive data includes sensitive data categories and sensitive data contents.

[0054] As another optional embodiment, the vehicle-side data internal storage information includes storage path and storage mode, and the vehicle-side data external transmission information includes transmission mode and transmission object. Automatically analyze sensitive data, vehicle-side data internal storage information, and vehicle-side data external transmission information to determine whether sensitive data has security risks, including:

[0055] S301. Determine the storage path of sensitive data according to the internal storage information of the vehicle-side data, detect whether the sensitive data is stored in plain text based on the storage path of the sensitive data, and obtain a first detection result.

[0056] S302. Determine the storage method of sensitive data based on the internal storage information of the vehicle-side data, and based on the storage method of the sensitive data, detect whether the access permission settings of the sensitive data comply with the preset permission management rules, whether the sensitive data is encrypted with a password, and whether the sensitive data is destroyed regularly to obtain a second detection result.

[0057] S303. Determine the transmission method of sensitive data according to the external transmission information of the vehicle-side data, and detect whether the sensitive data is transmitted in plain text based on the transmission method of the sensitive data to obtain a third detection result.

[0058] S304: Update the first detection result, the second detection result, and the third detection result into the detection analysis result.

[0059] This optional embodiment determines the storage path, storage method and transmission method of sensitive data in the vehicle-side data inside the intelligent connected vehicle based on the internal storage information of the vehicle-side data and the external transmission information of the vehicle-side data, and further detects whether the access rights of the sensitive data comply with the preset permission management rules, whether the sensitive data is stored in plain text, and whether the sensitive data is transmitted in plain text, thereby judging from multiple dimensions whether there are security and compliance risks in the sensitive data generated by the intelligent connected vehicle, and establishing a complete detection system.

[0060] As another optional embodiment, the method further includes:

[0061] S401. Determine the transmission object of sensitive data based on the external transmission information of vehicle-side data, and determine the system architecture information of the transmission object based on the transmission object of the sensitive data.

[0062] S402: Determine a microservice module applicable to the transmission object according to the system architecture information of the transmission object, encapsulate the microservice module and deployment verification information, and send them to the transmission object.

[0063] Microservices is a software architecture design pattern that develops a single application as a set of small services, each of which runs in its own process and communicates using lightweight mechanisms (usually HTTP resource APIs). These services are built around business functions and can be independently deployed, expanded, and maintained. Microservices are characterized by modularity, loose coupling, and independent deployment. Each service is an independent module responsible for performing a single function. Services communicate through simple protocols (such as HTTP REST APIs) to reduce dependencies. Each service can be deployed independently without affecting other services. It also has technical diversity. Different services can use different programming languages ​​and technology stacks, and the most suitable technology stack can be used for different services.

[0064] It can be understood that in this embodiment, for different system architectures of the transmission object, the corresponding microservice modules can use different programming languages ​​and technology stacks, that is, the microservice modules corresponding to different system architectures are also different.

[0065] S403: The transmission object verifies the deployment verification information, and deploys the microservice module locally after the verification passes.

[0066] In this optional embodiment, the deployment verification information is used to indicate the identity of the sender of the service module. The transmission object will deploy the microservice module locally only after verifying the deployment verification information and passing the verification.

[0067] S404. When the intelligent connected vehicle sends vehicle-side data to the transmission object, the microservice module detects whether the vehicle-side data received by the transmission object has been tampered with, detects whether the transmission object has been subjected to a replay attack, and obtains a fourth detection result.

[0068] S405: Update the fourth detection result into the detection and analysis result.

[0069] This optional embodiment determines the transmission object of sensitive data based on the external transmission information of the vehicle-side data, sends a lightweight, modular, and diversified microservice module to the transmission object based on the system architecture information of the transmission object, and detects the vehicle-side data received by the transmission object by deploying the microservice module locally on the transmission object to determine whether the vehicle-side data has been tampered with and whether the transmission object has been subjected to a replay attack, and updates the detection and analysis results based on the fourth detection results obtained, thereby making the security and compliance detection of the vehicle-side data more comprehensive.

[0070] As another optional embodiment, the microservice module detects whether the vehicle-side data received by the transmission object has been tampered with, and detects whether the transmission object has been subjected to a replay attack, specifically including:

[0071] S501. Generate a data summary of the vehicle-side data to be transmitted during the intermediate period between when the intelligent network-connected vehicle generates the vehicle-side data and when it transmits the vehicle-side data to the transmission object.

[0072] S502. At the next time point after the data summary is generated, search for other intelligent connected vehicles within a preset range around the intelligent connected vehicle that generates the data summary, and use the intelligent connected vehicle and the other found intelligent connected vehicles as temporary chain nodes.

[0073] S503, writing the data summary into the latest block of the temporary chain to update the temporary chain, and reaching consensus on the updated temporary chain among all temporary chain nodes.

[0074] In this optional embodiment, the temporary chain is a consortium chain.

[0075] S504. When receiving vehicle-side data, the microservice module verifies the vehicle-side data according to the data summary stored in the temporary chain.

[0076] In this optional embodiment, the temporary chain has a backup storage locally on each temporary chain node. After the storage time of the temporary chain exceeds the preset storage time threshold, the temporary chain node deletes the locally stored temporary chain data to avoid occupying the storage space of the temporary chain node.

[0077] This optional embodiment uploads the data summary generated based on the vehicle-side data before the intelligent connected car transmits the vehicle-side data to a temporary chain composed of multiple temporarily determined intelligent connected cars for storage, and then verifies the vehicle-side data based on the data summary in the temporary chain to determine whether the vehicle-side data has been tampered with or whether the transmission object has been subjected to a replay attack. If the data summary of the vehicle-side data received by the transmission object is different from the data summary stored in the temporary chain, it means that the vehicle-side data has been tampered with; if the data summaries of multiple vehicle-side data received by the transmission object are the same, it means that the transmission object may have been subjected to a replay attack. This optional embodiment uses the characteristic that blockchain data is difficult to tamper with to achieve tampering detection and replay attack detection of vehicle-side data, thereby improving the security of vehicle-side data transmission.

[0078] As another optional embodiment, the method further includes:

[0079] S601. Detect whether there is unregistered external data transmission on the intelligent network-connected vehicle by using a wireless signal detection device deployed on the intelligent network-connected vehicle to obtain a fifth detection result.

[0080] In this optional embodiment, unregistered external data transmission refers to external data transmission that is not in the preset transmission plan of the intelligent network-connected vehicle. If there is unregistered external data transmission, it means that the intelligent network-connected vehicle may be provided with a backdoor for stealing sensitive data.

[0081] In this optional embodiment, the wireless signal detection device may be a spectrum analyzer, a wireless network sniffer, a Bluetooth detector, or other device, and the present invention does not specifically limit this.

[0082] S602: Update the fifth detection result into the detection and analysis result.

[0083] This optional embodiment detects through a wireless signal detection device whether the smart connected vehicle generates unregistered external data transmission during a target time period, thereby obtaining a fifth detection result as to whether the smart connected vehicle illegally transmits sensitive data, and updates the detection analysis result based on the fifth detection result, thereby improving the comprehensiveness of data security and compliance detection of smart connected vehicles.

[0084] As another optional embodiment, the method further includes:

[0085] S701. Monitor whether the intelligent connected vehicle enters overseas areas through the positioning equipment deployed on the intelligent connected vehicle.

[0086] S702: When the intelligent connected vehicle enters a foreign area, detect whether the external data transmission registered on the intelligent connected vehicle contains sensitive data, or detect whether there is unregistered external data transmission on the intelligent connected vehicle through a wireless signal detection device deployed on the intelligent connected vehicle to obtain a sixth detection result.

[0087] S703: Update the sixth detection result into the detection and analysis result.

[0088] This optional embodiment detects the outbound transmission of data of smart connected vehicles when the smart connected vehicles enter overseas areas by monitoring whether the smart connected vehicles transmit sensitive data externally or whether there is unregistered external data transmission, thereby further improving the comprehensiveness of data security and compliance detection of smart connected vehicles.

[0089] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting automobile data security compliance, characterized in that: The method comprises: Monitor whether the intelligent connected vehicle is powered on. When the intelligent connected vehicle is powered on, collect vehicle-side data generated by the intelligent connected vehicle in a target time period from power on to power off through data monitoring equipment deployed on the intelligent connected vehicle. Performing sensitive data identification on the vehicle-side data to obtain sensitive data in the vehicle-side data; Obtain the internal storage information of the vehicle-side data and the external transmission information of the vehicle-side data of the intelligent networked vehicle; Automatically detect and analyze sensitive data, internal storage information of vehicle-side data, and external transmission information of vehicle-side data, obtain detection and analysis results, and determine whether there are security risks in sensitive data based on the detection and analysis results; Based on whether there are security risks in sensitive data, a risk analysis report is automatically generated and output.

2. The automobile data security compliance detection method according to claim 1, characterized in that: The sensitive data identification of vehicle-side data includes: Obtain historical vehicle-side data as sample data, annotate the sample data, and divide the annotated sample data into a training set and a test set; Establish a machine learning model, pre-train the machine learning model through a training set, and test the machine learning model through a test set. When the recognition accuracy of the machine learning model is higher than a preset accuracy threshold, use the machine learning model as a sensitive data recognition model; The vehicle-side data is input into the sensitive data identification model for analysis to obtain sensitive data in the vehicle-side data, where the sensitive data includes sensitive data categories and sensitive data contents.

3. The method for detecting automobile data security compliance according to claim 1, characterized in that: The vehicle-side data internal storage information includes storage path and storage mode, and the vehicle-side data external transmission information includes transmission mode and transmission object. The sensitive data, the vehicle-side data internal storage information, and the vehicle-side data external transmission information are automatically analyzed to determine whether the sensitive data has security risks, including: Determine the storage path of the sensitive data according to the internal storage information of the vehicle-side data, and detect whether the sensitive data is stored in plain text based on the storage path of the sensitive data to obtain a first detection result; Determine the storage method of sensitive data according to the internal storage information of the vehicle-side data, and detect whether the access permission setting of the sensitive data complies with the preset permission management rules, whether the sensitive data is encrypted with a password, and whether the sensitive data is destroyed regularly based on the storage method of the sensitive data, to obtain a second detection result; Determine the transmission mode of sensitive data according to the external transmission information of vehicle-side data, and detect whether the sensitive data is transmitted in plain text based on the transmission mode of the sensitive data to obtain a third detection result; The first detection result, the second detection result and the third detection result are updated into the detection analysis result.

4. The automobile data security compliance detection method according to claim 3, characterized in that: The method further comprises: Determine the transmission object of sensitive data based on the external transmission information of vehicle-side data, and determine the system architecture information of the transmission object based on the transmission object of sensitive data; Determine the microservice module applicable to the transmission object according to the system architecture information of the transmission object, encapsulate the microservice module and deployment verification information and send them to the transmission object; The transmission object verifies the deployment verification information and deploys the microservice module locally after passing the verification; When the intelligent network-connected vehicle sends vehicle-side data to the transmission object, the microservice module detects whether the vehicle-side data received by the transmission object is tampered with, detects whether the transmission object is subjected to a replay attack, and obtains a fourth detection result; The fourth detection result is updated into the detection and analysis result.

5. The method for detecting automobile data security compliance according to claim 4, characterized in that: The microservice module detects whether the vehicle-side data received by the transmission object has been tampered with and whether the transmission object has been subjected to a replay attack, including: In the intermediate period between when the intelligent networked vehicle generates vehicle-side data and when the vehicle-side data is transmitted to the transmission object, a data summary of the vehicle-side data to be transmitted is generated; At the next time point after the data summary is generated, search for other intelligent connected vehicles within a preset range around the intelligent connected vehicle that generates the data summary, and use the intelligent connected vehicle and the other intelligent connected vehicles found as temporary chain nodes; Write the data summary into the latest block of the temporary chain to update the temporary chain, and reach consensus on the updated temporary chain among all temporary chain nodes; When receiving vehicle-side data, the microservice module verifies the vehicle-side data based on the data summary stored in the temporary chain.

6. The automobile data security compliance detection method according to claim 3, characterized in that: The method further comprises: Detecting whether there is unregistered external data transmission on the intelligent network-connected vehicle through a wireless signal detection device deployed on the intelligent network-connected vehicle, and obtaining a fifth detection result; The fifth detection result is updated into the detection analysis result.

7. The automobile data security compliance detection method according to claim 6, characterized in that: The method further comprises: Monitor whether the smart connected car has entered an overseas area through the positioning equipment deployed on the smart connected car; When the intelligent networked vehicle enters a foreign area, detecting whether the external data transmission registered on the intelligent networked vehicle contains sensitive data, or detecting whether there is unregistered external data transmission on the intelligent networked vehicle through a wireless signal detection device deployed on the intelligent networked vehicle, to obtain a sixth detection result; The sixth detection result is updated into the detection analysis result.

Images