Threat analysis method, device, medium and program product oriented to internet-of-intelligence automobile

Abstract

The embodiment of the invention provides a threat analysis method and device for an Internet of Things automobile, a medium and a program product, and relates to the technical field of automobile information safety. The method comprises the following steps: determining a target attack path corresponding to a target service scene and a target modeling component corresponding to the target attack path according to a rule base constructed for the Internet of Things automobile; wherein the rule base is constructed according to a corresponding relationship between each service scene in the service scene base and each attack path in the attack path base, and a corresponding relationship between each attack path and each modeling component in the modeling component base; the target service scene is a service scene specified by a user in each service scene; connecting the target modeling component according to the target attack path, and establishing a threat model; and searching target threat data matched with the threat model from a threat database. According to the embodiment of the invention, the technical effect of automatically carrying out threat modeling analysis on the Internet of Things automobile can be realized.

Description

Technical Field

[0001] The present application relates to the field of automobile information security technology, and more specifically, to a threat analysis method, device, medium and program product for intelligent networked vehicles. Background Art

[0002] With the rapid development of intelligent technology, cars have gradually transformed from traditional mechanical equipment to complex systems with strong computing, communication and control capabilities. At the same time, car information security issues such as hacker attacks and malware injection are becoming increasingly prominent. These car information security issues are not only easy to leak the personal information of drivers and passengers in the car, but also easy to cause car failures and even traffic accidents and other serious consequences.

[0003] Although there are many solutions to these automotive information security issues, such as encrypted communication, firmware upgrades, and network monitoring, these solutions still have some challenges and problems: 1. The system structure of intelligent connected cars is relatively complex, and the various components of the system are interrelated, making it difficult to locate which components contain information security threats; 2. A single component can be subdivided into multiple functional modules, and different functional modules need to be focused on in locating information security threats in different business scenarios; 3. Information security threats come in various forms, and locating information security threats also requires comprehensive consideration of factors such as the external environment of the car, internal status, and communication content, and often relies on manual experience; 4. The lack of an efficient and automated identification and response mechanism makes it difficult to analyze and respond to automotive information security threats in a timely and accurate manner. Therefore, it is necessary to study an automated threat analysis method for intelligent connected cars to better solve current automotive information security issues. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a threat analysis method, device, medium and program product for intelligent connected vehicles, so as to achieve the technical effect of automatically performing threat modeling analysis for intelligent connected vehicles.

[0005] In a first aspect, an embodiment of the present application provides a threat analysis method for an intelligent networked vehicle, including:

[0006] According to the rule base constructed for the intelligent network car, the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path are determined; wherein the rule base is constructed according to the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path and each modeling component in the modeling component library; the target business scenario is a business scenario specified by a user in each business scenario;

[0007] Connect the target modeling components according to the target attack path to establish a threat model;

[0008] Search the threat database for target threat data that matches the threat model.

[0009] In the above implementation process, by building a unified rule base and threat database for intelligent connected vehicles, the target attack path and target modeling components corresponding to the user-specified business scenario can be automatically determined according to the rule base to establish a threat model, and the target threat data matching the threat model can be automatically searched from the threat database, so as to automatically perform threat modeling analysis for intelligent connected vehicles.

[0010] Furthermore, before determining the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path according to the rule base constructed for the intelligent networked car, it also includes:

[0011] Determining the functional modules in the electronic information architecture of the intelligent networked car as modeling components, obtaining the respective modeling components, and constructing the modeling component library;

[0012] Determine the business scenarios processed by the networked terminals in the Internet of Vehicles, obtain the business scenarios, and construct the business scenario library;

[0013] Determine the attack paths between the modeling components in the business scenarios, obtain the attack paths, and construct the attack path library;

[0014] According to the business scenario library, the attack path library and the modeling component library, the correspondence between the various business scenarios and the various attack paths, and the correspondence between the various attack paths and the various modeling components are determined to construct the rule library.

[0015] In the above implementation process, by constructing a modeling component library in advance according to the functional modules in the electronic information architecture of the intelligent connected car, constructing a business scenario library according to the business scenarios processed by the networked terminals in the Internet of Vehicles, and constructing an attack path library according to the attack paths between each modeling component under each business scenario, it is possible to ensure that a unified rule library is built for the intelligent connected car.

[0016] Further, the target attack path is an attack path including an external component component, a communication protocol component and a business processing component; the target modeling component includes the external component component, the communication protocol component and the business processing component;

[0017] The step of connecting the target modeling components according to the target attack path to establish a threat model includes:

[0018] Determining the arrangement order of the external component assembly, the communication protocol assembly, and the business processing assembly according to the target attack path;

[0019] The threat model is established by respectively using the external component assembly and the business processing assembly as nodes and the communication protocol assembly as directed edges, connecting the nodes and the directed edges in the arrangement order.

[0020] In the above implementation process, by taking the external component components and business processing components in the target modeling component as nodes, and the communication protocol components in the target modeling component as directed edges, and connecting the nodes and directed edges according to the arrangement order of the external component components, communication protocol components and business processing components in the target attack path, a threat model is established, which can ensure that the threat model is established completely and accurately.

[0021] Further, after connecting the target modeling components according to the target attack path to establish a threat model, the method further includes:

[0022] In response to a threat model modification request initiated by a user, a modeling tool is called to modify the threat model.

[0023] In the above implementation process, after the threat model is established, by responding to the threat model modification request initiated by the user and calling the modeling tool to modify the threat model, it can be further ensured that the threat model conforms to the target business scenario.

[0024] Furthermore, searching the threat database for target threat data matching the threat model includes:

[0025] extracting a target execution path from the threat model;

[0026] Determine whether the attack path corresponding to each threat data in the threat database is the same as the target execution path; wherein each threat data has a corresponding relationship with each attack path;

[0027] In the case where it is determined that the attack path corresponding to any threat data among the threat data is the same as the target execution path, the threat data is determined as the target threat data.

[0028] In the above implementation process, by extracting the target execution path from the threat model, when the attack path corresponding to any threat data in the threat database is the same as the target execution path, this threat data is determined as the target threat data, which can ensure a comprehensive analysis of the information security threats in the threat model and accurately obtain the target threat data.

[0029] Further, the threat model includes at least one data flow path, and the at least one data flow path includes a data flow path obtained by connecting a node for representing an external component component, a node for representing a business processing component, and a directed edge for representing a communication protocol component;

[0030] The extracting the target execution path from the threat model includes:

[0031] For each data flow path in the threat model, determine an execution start point and an execution end point on the data flow path; wherein the execution start point is a node on the data flow path used to characterize an external component component, and the execution end point is a node at the end of the data flow path and used to characterize a business processing component of a process type or a storage type;

[0032] The target execution path is determined according to element identifiers on the data flow path from the execution start point to the execution end point.

[0033] In the above implementation process, by determining the execution starting point and execution end point on the data flow path in the threat model, and determining the target execution path according to the element identification between the execution starting point and the execution end point, it is possible to ensure that the target execution path required for analyzing information security threats is extracted from the threat model completely and accurately.

[0034] Further, after searching the threat database for target threat data matching the threat model, the method further includes:

[0035] Evaluating the risk index value of the target threat data according to the attribute information carried by the target threat data;

[0036] A target threat list is generated according to the attribute information carried by the target threat data and the risk indicator value of the target threat data.

[0037] In the above implementation process, by evaluating the risk index value of the target threat data according to the attribute information carried by the target threat data, and generating a target threat list according to the attribute information carried by the target threat data and the risk index value of the target threat data, the risk index value of the target threat data can be provided to the user at the same time, so that the user can take countermeasures preferentially for the target threat data with larger risk index values.

[0038] Furthermore, the method further comprises:

[0039] Respond to the threat model self-building request initiated by the user and call the modeling tool to build a new threat model;

[0040] The target threat data matching the new threat model is searched in the threat database.

[0041] In the above implementation process, by responding to the threat model self-building request initiated by the user and calling the modeling tool to build a new threat model, the user's threat model self-building needs for the target business scenario can be met.

[0042] In a second aspect, an embodiment of the present application provides a threat analysis device for an intelligent networked vehicle, including:

[0043] A modeling data acquisition module, used to determine a target attack path corresponding to a target business scenario and a target modeling component corresponding to the target attack path according to a rule library constructed for an intelligent networked car; wherein the rule library is constructed according to the correspondence between each business scenario in a business scenario library and each attack path in an attack path library, and the correspondence between each attack path and each modeling component in a modeling component library; the target business scenario is a business scenario specified by a user in each business scenario;

[0044] A threat model building module, used to connect the target modeling components according to the target attack path to build a threat model;

[0045] The threat data analysis model is used to search the threat database for target threat data that matches the threat model.

[0046] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the memory is coupled to the processor, and the processor implements the method described above when executing the computer program.

[0047] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored computer program; wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method described above.

[0048] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes instructions, and when the instructions are executed by a computer, the computer implements the method as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0050] Figure 1A flowchart of a threat analysis method for intelligent networked vehicles provided in the first embodiment of the present application;

[0051] Figure 2 This is a schematic diagram of the structure of the threat model used as an example in the first embodiment of the present application;

[0052] Figure 3 A schematic diagram of the structure of a threat analysis device for intelligent networked vehicles provided in the second embodiment of the present application;

[0053] Figure 4 A schematic diagram of the structure of an electronic device provided in the third embodiment of the present application. DETAILED DESCRIPTION

[0054] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0055] It should be noted that in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance. At the same time, the step numbers in the text are only for the convenience of explanation of the embodiments of this application and do not serve to limit the order of execution of the steps. The method provided in the embodiments of this application can be executed by a related terminal device, and the following description will be taken as an example of a user terminal as the execution subject.

[0056] It should be noted that user terminals include terminal devices such as mobile phones, tablets and computers held by users.

[0057] Please see Figure 1 , Figure 1 The first embodiment of the present application provides a threat analysis method for a smart connected car, including steps S101 to S103:

[0058] S101. According to a rule library constructed for the intelligent networked car, determine a target attack path corresponding to a target business scenario and a target modeling component corresponding to the target attack path; wherein the rule library is constructed according to the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path and each modeling component in the modeling component library; the target business scenario is a business scenario specified by a user in each business scenario;

[0059] S102, connecting target modeling components according to target attack paths to establish a threat model;

[0060] S103: Search the threat database for target threat data that matches the threat model.

[0061] As an example, a business scenario library, an attack path library, a modeling component library and a threat database are constructed in advance for the intelligent connected car. According to the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path in the attack path library and each modeling component in the modeling component library, a rule library is constructed, and the rule library stores the association rules between each business scenario, each attack path and each modeling component.

[0062] For example, assuming that the business scenario of "near field communication" in the business scenario library corresponds to the attack path of "radio frequency key→NFC (Near Field Communication, near field communication technology) module→cockpit domain controller" in the attack path library, and the attack path of "radio frequency key→NFC module→cockpit domain controller" in the attack path library corresponds to the three modeling components of "radio frequency key", "NFC module" and "cockpit domain controller" in the modeling component library, then the rule library stores the following association rules: "near field communication" business scenario - "radio frequency key→NFC→cockpit domain controller" attack path - "radio frequency key", "NFC module" and "cockpit domain controller" three modeling components.

[0063] When users need to analyze information security threats of connected cars, they can specify any business scenario in the business scenario library as the target business scenario based on the actual application scenario and input the target business scenario into the user terminal.

[0064] After obtaining the target business scenario, the user terminal searches the rule base for the association rule corresponding to the target business scenario, and determines the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path according to the association rule corresponding to the target business scenario.

[0065] After obtaining the target attack path and the target modeling component, the user terminal connects the target modeling component according to the target attack path to establish a threat model.

[0066] After obtaining the threat model, the user terminal searches the threat database for target threat data that matches the threat model. At this time, the user can view the target threat data and take timely countermeasures against the target threat data.

[0067] The embodiment of the present application builds a unified rule base and threat database for intelligent connected vehicles. It can automatically determine the target attack path and target modeling components corresponding to the user-specified business scenario according to the rule base to establish a threat model, and automatically search the threat database for target threat data that matches the threat model, so as to automatically perform threat modeling analysis for intelligent connected vehicles.

[0068] In an optional embodiment, before determining the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path according to the rule base constructed for the intelligent networked car, it also includes: determining the functional modules in the electronic information architecture of the intelligent networked car as modeling components, obtaining each modeling component to construct a modeling component library; determining the business scenarios processed by the networked terminals in the network of vehicles, obtaining each business scenario to construct a business scenario library; determining the attack path between each modeling component under each business scenario, obtaining each attack path to construct an attack path library; determining the correspondence between each business scenario and each attack path, and the correspondence between each attack path and each modeling component according to the business scenario library, the attack path library and the modeling component library to construct a rule base.

[0069] As an example, the user terminal divides the electronic information architecture of the intelligent connected car into multiple functional modules in advance for the intelligent connected car, determines the functional modules in the electronic information architecture of the intelligent connected car as modeling components, obtains each modeling component, and constructs a modeling component library according to each modeling component.

[0070] In actual applications, each modeling component in the modeling component library carries unique identification information. For example, the identification information carried by the three modeling components "radio frequency key", "NFC module" and "cockpit domain controller" in the modeling component library are 2, 3 and 4 respectively.

[0071] It can be understood that by constructing a modeling component library based on multiple functional modules in the electronic information architecture of the intelligent connected car, each modeling component in the modeling component library can be refined into functional modules within the system components of the intelligent connected car, ensuring that threat models can be established and information security threats can be analyzed more finely in the future.

[0072] For the Internet of Vehicles to which the intelligent connected car is connected, the networked terminals in the Internet of Vehicles are determined, and the business scenarios processed by the networked terminals in the Internet of Vehicles are determined to obtain various business scenarios so as to build a business scenario library according to the various business scenarios.

[0073] For example, the networked terminals in the Internet of Vehicles include automobile terminals, management terminals, service terminals and other networked ecological terminals. The business scenarios processed by automobile terminals, management terminals, service terminals and other networked ecological terminals are shown in Table 1. The business scenario library stores multiple business scenarios such as "in-vehicle infotainment system", "Internet of Vehicles control unit", "in-vehicle gateway", "remote communication" and "near field communication".

[0074] It should be noted that the automobile terminal is an intelligent connected car, the management terminal includes terminal devices such as mobile phones, tablets and computers held by management users, the service terminal includes terminal devices such as servers and cloud servers, and other networked ecological terminals include terminal devices used to power intelligent connected cars and terminal devices on the road for collecting driving information of intelligent connected cars.

[0075] Table 1

[0076]

[0077]

[0078] After completing the construction of the business scenario library, the threat items under each business scenario in the business scenario library are determined respectively, and threat data are generated according to the threat items and the attribute information corresponding to the threat items, such as threat assets, threat categories, attack success rates, damage scenarios, impact levels, countermeasures, etc., such as the threat data shown in Table 2, to obtain various threat data so as to build a threat database according to the various threat data.

[0079] Table 2

[0080]

[0081]

[0082] After the threat database is constructed, the attack paths corresponding to the threat data in the threat database are determined, and the attack paths are obtained to construct an attack path library according to the attack paths.

[0083] For example, the attack path corresponding to the threat data shown in Table 2 is the attack path of “RF key→NFC module→cockpit domain controller”.

[0084] For another example, in the "TBOX" business scenario, there is a threat data corresponding to the attack path of "UART (Universal Asynchronous Receiver / Transmitter) interface → I / O (Input / Output) module → TBOX".

[0085] After completing the construction of the business scenario library, attack path library and modeling component library, a rule library is constructed based on the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, as well as the correspondence between each attack path in the attack path library and each modeling component in the modeling component library. The rule library stores the association rules between each business scenario, each attack path and each modeling component.

[0086] It can be understood that, since one business scenario corresponds to at least one threat data and one threat data corresponds to one attack path, one business scenario corresponds to at least one attack path, and since one attack path is composed of at least two modeling components, one attack path corresponds to multiple modeling components.

[0087] For example, assuming that the business scenario of "near field communication" in the business scenario library corresponds to the two attack paths of "radio frequency key→NFC module→cockpit domain controller" and "Bluetooth interface→ADB (Android Debug Bridge, command line tool) module→TBOX→I / O module→cockpit domain controller" in the attack path library, the attack path of "radio frequency key→NFC module→cockpit domain controller" in the attack path library corresponds to the three modeling components of "radio frequency key", "NFC module" and "cockpit domain controller" in the modeling component library, and the attack path of "Bluetooth interface→ADB module→TBOX→I / O module→cockpit domain controller" in the attack path library corresponds to the five modeling components of "Bluetooth interface", "ADB module", "TBOX", "I / O module" and "cockpit domain controller" in the modeling component library, then the rule base stores two association rules as shown in Table 3.

[0088] Table 3

[0089]

[0090] The embodiments of the present application construct a modeling component library in advance according to the functional modules in the electronic information architecture of the intelligent connected car, construct a business scenario library according to the business scenarios processed by the networked terminals in the connected car network, and construct an attack path library according to the attack paths between each modeling component in each business scenario, thereby ensuring that a unified rule library is built for the intelligent connected car.

[0091] In an optional embodiment, the target attack path is an attack path including external component components, communication protocol components and business processing components; the target modeling components include external component components, communication protocol components and business processing components; the target modeling components are connected according to the target attack path to establish a threat model, including: determining the arrangement order of the external component components, communication protocol components and business processing components according to the target attack path; using the external component components and business processing components as nodes, and the communication protocol components as directed edges, connecting the nodes and directed edges in the arrangement order, and establishing a threat model.

[0092] As an example, after the user terminal obtains the target attack path and the target modeling component, since the target attack path is an attack path including external component components, communication protocol components and business processing components, the arrangement order of the external component components, communication protocol components and business processing components can be determined according to the target attack path.

[0093] It should be noted that the external component component is the modeling component corresponding to the functional module used to connect to the external system or device, such as the "radio frequency key", "Bluetooth interface" and "UART interface" modeling components; the communication protocol component is the modeling component corresponding to the functional module obtained by encapsulating the communication protocol, such as the "NFC module", "ADB module" and "I / O module" modeling components; the business processing component is the modeling component corresponding to the functional module used to process the business, such as the "cockpit domain controller" and "TBOX" modeling components.

[0094] In actual applications, business processing components can be divided into process-type business processing components, such as "TBOX" and other modeling components, and storage-type business processing components, such as "on-board firmware" and other modeling components, according to the business processing method.

[0095] And because the target modeling components include external component components, communication protocol components and business processing components, the external component components and business processing components can be used as nodes respectively, and the communication protocol components can be used as directed edges. The nodes used to represent the external component components, the nodes used to represent the business processing components and the directed edges used to represent the communication protocol components are connected in order of arrangement to form a data flow path and establish a threat model.

[0096] For example, assuming that the user terminal obtains the two target attack paths of "RF key → NFC module → cockpit domain controller" and "Bluetooth interface → ADB module → TBOX → I / O module → cockpit domain controller", and obtains the target modeling components of "RF key", "NFC module", "cockpit domain controller", "Bluetooth interface", "ADB module", "TBOX" and "I / O module", the established threat model is as follows: Figure 2 shown.

[0097] The embodiment of the present application establishes a threat model by using the external component components and business processing components in the target modeling component as nodes, and the communication protocol components in the target modeling component as directed edges, connecting the nodes and directed edges according to the arrangement order of the external component components, communication protocol components and business processing components in the target attack path, thereby ensuring that the threat model is established completely and accurately.

[0098] In an optional embodiment, after connecting the target modeling components according to the target attack path and establishing the threat model, the method further includes: responding to a threat model modification request initiated by a user and calling a modeling tool to modify the threat model.

[0099] As an exemplary embodiment, after acquiring the threat model, the user terminal may return the threat model to the user, so that the user can view the threat model and confirm whether the threat model meets the target business scenario.

[0100] When the user determines that the threat model does not conform to the target business scenario, the user can input a threat model modification request to the user terminal to modify the threat model to make it conform to the target business scenario.

[0101] After obtaining the threat model modification request initiated by the user, the user terminal responds to the threat model modification request and calls a pre-developed modeling tool to modify the threat model.

[0102] In actual applications, the user terminal can directly call the drawing tool to display the threat model in the drawing area, and modify the threat model according to the user's operation instructions in the drawing area, such as adding nodes, deleting directed edges, and adjusting the indication direction of directed edges.

[0103] The embodiment of the present application can further ensure that the threat model conforms to the target business scenario by responding to a threat model modification request initiated by a user after the threat model is established and calling a modeling tool to modify the threat model.

[0104] In an optional embodiment, searching the threat database for target threat data matching the threat model includes: extracting a target execution path from the threat model; determining whether an attack path corresponding to each threat data in the threat database is the same as the target execution path; wherein each threat data has a corresponding relationship with each attack path; and determining the threat data as target threat data when it is determined that the attack path corresponding to any one of the threat data is the same as the target execution path.

[0105] As an example, after obtaining the threat model, the user terminal extracts the target execution path from the threat model, determines the attack path corresponding to the threat data for each threat data in the threat database, determines whether the attack path corresponding to the threat data is the same as the target execution path, and when it is determined that the attack path corresponding to the threat data is the same as the target execution path, determines the threat data as the target threat data.

[0106] In practical applications, if multiple target execution paths are extracted from the threat model, then for each threat data in the threat database, it is necessary to determine whether the attack path corresponding to the threat data is the same as each target execution path in the multiple target execution paths, and if it is determined that the attack path corresponding to the threat data is the same as any target execution path in the multiple target execution paths, the threat data is determined as target threat data.

[0107] The embodiment of the present application extracts the target execution path from the threat model, and when the attack path corresponding to any threat data in the threat database is the same as the target execution path, this threat data is determined as the target threat data, thereby ensuring a comprehensive analysis of information security threats in the threat model and accurately obtaining the target threat data.

[0108] In an optional embodiment, the threat model includes at least one data flow path, and the at least one data flow path includes a data flow path obtained by connecting nodes for characterizing external component components, nodes for characterizing business processing components, and directed edges for characterizing communication protocol components; the extraction of the target execution path from the threat model includes: for each data flow path in the threat model, determining an execution start point and an execution end point on the data flow path; wherein the execution start point is a node on the data flow path for characterizing the external component components, and the execution end point is a node at the end of the data flow path and for characterizing a business processing component of a process type or a storage type; and determining the target execution path based on element identifiers on the data flow path from the execution start point to the execution end point.

[0109] As an example, after the user terminal obtains the threat model, since the threat model includes at least one data flow path, and the at least one data flow path includes a data flow path obtained by connecting nodes for characterizing external component components, nodes for characterizing business processing components, and directed edges for characterizing communication protocol components, the various data flow paths in the threat model can be determined. For each data flow path in the threat model, the execution starting point and execution end point on the data flow path are determined, wherein the execution starting point is the node on the data flow path used to characterize the external component components, and the execution end point is the node at the end of the data flow path and used to characterize the business processing components of the process type or storage type, and the target execution path is determined based on the element identifiers between the execution starting point and the execution end point on the data flow path, that is, the identification information carried by the modeling components represented by the nodes and directed edges between the execution starting point and the execution end point.

[0110] In actual applications, the user terminal can first determine the execution starting points in the threat model, start from each execution starting point, traverse to the next node according to the indicated direction of the directed edge connected to the tail end of the execution starting point, and determine whether there is a directed edge connected to the tail end of the current node, and determine whether the current node represents a business processing component of the process type or storage type. If there is a directed edge connected to the tail end of the current node, continue to traverse the next node according to the pointing direction of the directed edge connected to the tail end of the current node. If there is no directed edge connected to the tail end of the current node, but the current node does not represent a business processing component of the process type or storage type, it is determined that the data flow path where the execution starting point and the current node are located does not contain the target execution path, and the traversal of this data flow path ends. If there is no directed edge connected to the tail end of the current node, and the current node represents a business processing component of the process type or storage type, the current node is determined as the execution end point, and the target execution path is determined based on the element identifier on the data flow path from the execution starting point to the execution end point.

[0111] For example, assuming that there is a data flow path of "UART interface → I / O module → TBOX → I / O module → on-board firmware" in the threat model, and the identification information of the modeling components "UART interface", "I / O module", "TBOX" and "on-board firmware" are 1, 18, 31 and 35 respectively, then the target execution path is "1, 18, 31, 18, 35".

[0112] The embodiment of the present application determines the execution starting point and execution end point on the data flow path in the threat model, and determines the target execution path according to the element identifiers between the execution starting point and the execution end point, thereby ensuring that the target execution path required for analyzing information security threats is extracted from the threat model completely and accurately.

[0113] In an optional embodiment, after searching the threat database for target threat data matching the threat model, the method further includes: evaluating a risk index value of the target threat data according to attribute information carried by the target threat data; and generating a target threat list according to the attribute information carried by the target threat data and the risk index value of the target threat data.

[0114] As an example, according to actual application requirements, risk indicator assessment rules are defined in advance for attribute information carried by threat data.

[0115] After acquiring the target threat data, the user terminal evaluates the risk index value of the target threat data based on the predefined risk index evaluation rules and the attribute information carried by the target threat data.

[0116] For example, assuming that the predefined risk indicator assessment rule is to perform weighted calculation based on the score corresponding to the attack success rate carried by the threat data and the score corresponding to the impact level carried by the threat data to obtain the risk indicator value of the threat data, the user terminal obtains the target threat data shown in Table 2, and determines that the score corresponding to the attack success rate carried by the target threat data is 2, and the score corresponding to the impact level carried by the target threat data is 4, then the risk indicator value of the target threat data is 2W a +4W b , where W a and W b The target threat list is generated by the weights of attack success rate and impact level, and W a +W b =1.

[0117] A target threat list is generated based on the attribute information carried by the target threat data and the risk index value of the target threat data. At this time, the user can view the target threat list, determine the target threat data and its risk index value at the same time, and take countermeasures first for the target threat data with larger risk index values.

[0118] The embodiment of the present application evaluates the risk index value of the target threat data according to the attribute information carried by the target threat data, and generates a target threat list according to the attribute information carried by the target threat data and the risk index value of the target threat data, so as to provide the risk index value of the target threat data to the user, so as to facilitate the user to take countermeasures preferentially for the target threat data with larger risk index values.

[0119] In an optional embodiment, the method further includes steps S104 to S105:

[0120] S104, responding to the threat model self-building request initiated by the user, calling the modeling tool to build a new threat model;

[0121] S105: Search the threat database for target threat data that matches the new threat model.

[0122] As an exemplary embodiment, after acquiring the threat model, the user terminal may return the threat model to the user, so that the user can view the threat model and confirm whether the threat model meets the target business scenario.

[0123] When the user determines that the threat model does not conform to the target business scenario at all, the user can directly input a threat model self-building request into the user terminal to customize and build a new threat model to conform to the target business scenario.

[0124] After obtaining the threat model self-building request initiated by the user, the user terminal responds to the threat model self-building request and calls a pre-developed modeling tool to build the threat model.

[0125] In actual applications, the user terminal can directly call the drawing tool to establish a new threat model based on the user's operating instructions on the drawing area, such as adding nodes, adding directed edges, and connecting nodes and directed edges.

[0126] In actual applications, when users need to analyze information security threats of connected cars, they can also directly input threat model self-building requests into the user terminal to customize threat models that meet the target business scenarios.

[0127] The embodiment of the present application responds to the threat model self-building request initiated by the user and calls the modeling tool to build a new threat model, thereby meeting the user's demand for self-building threat models for target business scenarios.

[0128] Please see Figure 3 , Figure 3 A structural diagram of a threat analysis device for a smart connected car provided in the second embodiment of the present application. The second embodiment of the present application provides a threat analysis device for a smart connected car, including: a modeling data acquisition module 201, which is used to determine the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path according to the rule base constructed for the smart connected car; wherein the rule base is constructed according to the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path and each modeling component in the modeling component library; the target business scenario is the business scenario specified by the user in each business scenario; a threat model establishment module 202, which is used to connect the target modeling component according to the target attack path to establish a threat model; a threat data analysis model 203, which is used to search the threat database for target threat data matching the threat model.

[0129] In an optional embodiment, the device also includes: a rule base construction module, which is used to determine the functional modules in the electronic information architecture of the intelligent network car as modeling components, obtain each modeling component, and construct a modeling component library before determining the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path according to the rule base constructed for the intelligent network car; determine the business scenarios processed by the networked terminals in the network of vehicles, obtain each business scenario, and construct a business scenario library; determine the attack path between each modeling component under each business scenario, obtain each attack path, and construct an attack path library; determine the correspondence between each business scenario and each attack path, and the correspondence between each attack path and each modeling component according to the business scenario library, the attack path library and the modeling component library, and construct a rule base.

[0130] In an optional embodiment, the target attack path is an attack path including external component components, communication protocol components and business processing components; the target modeling components include external component components, communication protocol components and business processing components; the target modeling components are connected according to the target attack path to establish a threat model, including: determining the arrangement order of the external component components, communication protocol components and business processing components according to the target attack path; using the external component components and business processing components as nodes, and the communication protocol components as directed edges, connecting the nodes and directed edges in the arrangement order, and establishing a threat model.

[0131] In an optional embodiment, the threat model building module 202 is further used to respond to a threat model modification request initiated by a user and call a modeling tool to modify the threat model after the threat model is established by connecting the target modeling components according to the target attack path.

[0132] In an optional embodiment, searching the threat database for target threat data matching the threat model includes: extracting a target execution path from the threat model; determining whether an attack path corresponding to each threat data in the threat database is the same as the target execution path; wherein each threat data has a corresponding relationship with each attack path; and determining the threat data as target threat data when it is determined that the attack path corresponding to any one of the threat data is the same as the target execution path.

[0133] In an optional embodiment, the threat model includes at least one data flow path, and the at least one data flow path includes a data flow path obtained by connecting nodes for characterizing external component components, nodes for characterizing business processing components, and directed edges for characterizing communication protocol components; the extraction of the target execution path from the threat model includes: for each data flow path in the threat model, determining an execution start point and an execution end point on the data flow path; wherein the execution start point is a node on the data flow path for characterizing the external component components, and the execution end point is a node at the end of the data flow path and for characterizing a business processing component of a process type or a storage type; and determining the target execution path based on element identifiers on the data flow path from the execution start point to the execution end point.

[0134] In an optional embodiment, the threat data analysis model 203 is further used to evaluate the risk index value of the target threat data according to the attribute information carried by the target threat data after searching the threat database for target threat data matching the threat model; and generate a target threat list according to the attribute information carried by the target threat data and the risk index value of the target threat data.

[0135] In an optional embodiment, the threat model building module 202 is also used to respond to a threat model self-building request initiated by a user and call a modeling tool to build a new threat model; the threat data analysis model 203 is also used to search the threat database for target threat data that matches the new threat model.

[0136] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.

[0137] Please see Figure 4 , Figure 4 The third embodiment of the present application provides an electronic device 30, comprising a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; the memory 302 is coupled to the processor 301, and when the processor 301 executes the computer program, the method described in the first embodiment of the present application is implemented and the same beneficial effects can be achieved.

[0138] When the processor 301 reads the computer program from the memory 302 through the bus 303 and executes the computer program, the method of any embodiment included in the method described in the first embodiment of the present application can be implemented.

[0139] Processor 301 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 301 can be a microprocessor.

[0140] The memory 302 may be used to store instructions executed by the processor 301 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 301 of the disclosed embodiment may be used to execute instructions in the memory 302 to implement the method described in the first embodiment of the present application. The memory 302 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0141] The fourth embodiment of the present application provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method described in the first embodiment of the present application, and can achieve the same beneficial effects as the method.

[0142] The fifth embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed by a computer, the computer implements the method described in the first embodiment of the present application and can achieve the same beneficial effects.

[0143] The method described in the first embodiment of the present application can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in each embodiment of the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM (Open Application Model) or other programmable device.

[0144] The computer program or instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0145] In summary, the embodiment of the present application provides a threat analysis method, device, medium and program product for intelligent networked vehicles, and the threat analysis method for intelligent networked vehicles includes: determining the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path according to the rule base constructed for the intelligent networked vehicle; wherein the rule base is constructed according to the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path and each modeling component in the modeling component library; the target business scenario is the business scenario specified by the user in each business scenario; the target modeling component is connected according to the target attack path to establish a threat model; and the target threat data matching the threat model is searched from the threat database. The embodiment of the present application constructs a unified rule base and threat database for intelligent networked vehicles, and can automatically determine the target attack path and target modeling component corresponding to the business scenario specified by the user according to the rule base to establish a threat model, and automatically search for the target threat data matching the threat model from the threat database, so as to automatically perform threat modeling analysis for intelligent networked vehicles.

[0146] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0147] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0148] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0149] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A threat analysis method for intelligent networked vehicles, characterized in that: include: According to the rule base constructed for the intelligent network car, the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path are determined; wherein the rule base is constructed according to the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path and each modeling component in the modeling component library; the target business scenario is a business scenario specified by a user in each business scenario; Connect the target modeling components according to the target attack path to establish a threat model; Search the threat database for target threat data that matches the threat model.

2. The method according to claim 1, characterized in that Before determining the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path according to the rule base constructed for the intelligent networked car, the method further includes: Determining the functional modules in the electronic information architecture of the intelligent networked car as modeling components, obtaining the respective modeling components, and constructing the modeling component library; Determine the business scenarios processed by the networked terminals in the Internet of Vehicles, obtain the business scenarios, and construct the business scenario library; Determine the attack paths between the modeling components in the business scenarios, obtain the attack paths, and construct the attack path library; According to the business scenario library, the attack path library and the modeling component library, the correspondence between the various business scenarios and the various attack paths, and the correspondence between the various attack paths and the various modeling components are determined to construct the rule library.

3. The method according to claim 1, characterized in that: The target attack path is an attack path including an external component component, a communication protocol component and a business processing component; the target modeling component includes the external component component, the communication protocol component and the business processing component; The step of connecting the target modeling components according to the target attack path to establish a threat model includes: Determining the arrangement order of the external component assembly, the communication protocol assembly, and the business processing assembly according to the target attack path; The threat model is established by respectively using the external component assembly and the business processing assembly as nodes and the communication protocol assembly as directed edges, connecting the nodes and the directed edges in the arrangement order.

4. The method according to claim 1, characterized in that: After connecting the target modeling components according to the target attack path to establish a threat model, the method further includes: In response to a threat model modification request initiated by a user, a modeling tool is called to modify the threat model.

5. The method according to claim 1, characterized in that The step of searching the threat database for target threat data matching the threat model includes: extracting a target execution path from the threat model; Determine whether the attack path corresponding to each threat data in the threat database is the same as the target execution path; wherein each threat data has a corresponding relationship with each attack path; In the case where it is determined that the attack path corresponding to any threat data among the threat data is the same as the target execution path, the threat data is determined as the target threat data.

6. The method according to claim 5, characterized in that The threat model includes at least one data flow path, wherein the at least one data flow path includes a data flow path obtained by connecting a node for representing an external component component, a node for representing a business processing component, and a directed edge for representing a communication protocol component; The extracting the target execution path from the threat model includes: For each data flow path in the threat model, determine an execution start point and an execution end point on the data flow path; wherein the execution start point is a node on the data flow path used to characterize an external component component, and the execution end point is a node at the end of the data flow path and used to characterize a business processing component of a process type or a storage type; The target execution path is determined according to element identifiers on the data flow path from the execution start point to the execution end point.

7. The method according to claim 1, characterized in that After searching the threat database for target threat data matching the threat model, the method further includes: Evaluating the risk index value of the target threat data according to the attribute information carried by the target threat data; A target threat list is generated according to the attribute information carried by the target threat data and the risk indicator value of the target threat data.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Respond to the threat model self-building request initiated by the user and call the modeling tool to build a new threat model; The target threat data matching the new threat model is searched in the threat database.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the memory is coupled to the processor, and the processor implements the method according to any one of claims 1 to 8 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program; wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 8.

11. A computer program product, characterized in that The computer program product comprises instructions which, when executed by a computer, cause the computer to implement the method according to any one of claims 1 to 8.

Images