Attack defense method and device and vehicle

Abstract

The invention discloses an attack defense method and device and a vehicle. The method comprises the steps that access to a first bait in a first control node is monitored; when the access aiming at the first bait is detected, a first notification is sent to the second control node, and the first notification indicates the second control node to execute at least one of the following items: limiting the access right of the first control node, and updating or adjusting the deployment of the bait associated with the second control node; and / or when the access to the first bait is detected, a takeover system of the first control node is started, and the takeover system is used for directly controlling components influencing the driving safety of the vehicle. The scheme can be applied to the field of vehicle safety, is helpful to discover attacks in time and reduce the false alarm rate for the attacks, is helpful to block or delay the spread of the attacks for a single control node, and can enhance the toughness of a whole vehicle level network and improve the vehicle safety.

Description

Technical Field

[0001] The present application relates to the field of security, and more specifically, to a method, device and vehicle for defending against attacks. Background Art

[0002] As vehicles develop towards intelligence, the amount of software code in smart cars is gradually increasing, resulting in an increasing risk of attacks on the internal network structure of smart cars. Traditional network security defense technologies are mainly based on mechanisms such as firewalls, identity authentication, access control, and sandboxes. However, the determinism, static nature, and similarity of the internal network structure of smart cars make traditional network security defense technologies increasingly powerless in the face of the increasing risk of smart cars.

[0003] In view of this, a solution for defending against attacks that can effectively improve vehicle safety needs to be developed urgently. Summary of the invention

[0004] The present application provides a method, device and vehicle for defending against attacks, which are helpful for timely detecting attacks against the vehicle and can delay or block the attacks, thereby helping to improve the safety of the vehicle.

[0005] In a first aspect, a method for defending against attacks is provided, the method being applied to a vehicle, the vehicle comprising a first control node and a second control node. Exemplarily, the method may be executed by the first control node, for example, by a chip or a processor of the first control node.

[0006] The vehicles involved in this application are vehicles in a broad sense, which may be transportation vehicles (such as commercial vehicles, passenger cars, motorcycles, flying cars, trains, etc.), industrial vehicles (such as forklifts, trailers, tractors, etc.), engineering vehicles (such as excavators, bulldozers, cranes, etc.), agricultural equipment (such as mowers, harvesters, etc.), amusement equipment, toy vehicles, etc. The embodiments of this application do not specifically limit the types of vehicles. For example, the vehicle may be a transportation vehicle such as an airplane or a ship.

[0007] The method includes: monitoring access to a first bait in a first control node; when access to the first bait is detected, sending a first notification to a second control node, the first notification instructing the second control node to perform at least one of the following: restricting access rights of the first control node, updating or adjusting the deployment of the bait associated with the second control node; and / or when access to the first bait is detected, starting a takeover system of the first control node, the takeover system being used to directly control components that affect vehicle driving safety.

[0008] In the above technical solution, by setting bait, it is helpful to detect attacks in time and reduce the false alarm rate of attacks. After the attack is discovered, the control nodes can maintain synchronization and coordination to ensure the synchronization of the vehicle-level defense strategy, which helps to block or delay the spread of attacks against a single control node and enhance the network resilience of the vehicle. In addition, dynamic defense management can cooperate with the minimum system management module to prevent the vehicle control business from being affected by the attack, which helps to improve vehicle safety.

[0009] It should be noted that the first control node may be a control node or a gateway having an external interface; or the first control node may also be a control node for controlling the vehicle actuator. In some implementations, the control node in the former case does not include a takeover system, and the control node in the latter case includes a takeover system. In other implementations, both of the above cases include a takeover system.

[0010] Exemplarily, the takeover system can be used to implement a system of some or all functions of the first control node. By setting up the takeover system, the ability of the control node to resist attacks can be improved, thereby improving the ability of the entire vehicle system to resist attacks.

[0011] In combination with the first aspect, in certain implementations of the first aspect, the first bait is accessed at a first moment, and the method further includes: determining a target that may be accessed at a second moment based on the first bait, the second moment being a moment after the first moment; and deploying a second bait for the first control node based on the above target, the second bait being associated with the above target.

[0012] Exemplarily, deploying the second decoy for the first control node includes: deploying the second decoy in the first control node, or deploying the decoy that may be involved when the first control node implements certain functions.

[0013] Exemplarily, the second bait is associated with the target, including: when the attacker visits the target, the second bait needs to be used or accessed. Alternatively, when the attacker visits the target and does not interfere with the attacker's behavior, the attacker may use or access the second bait.

[0014] In the above technical solution, the first control node updates the bait deployment, which helps to hinder the spread of the attack. In addition, by deploying new baits, it is also helpful to analyze the attacker's attack purpose according to the bait that the attacker accesses next, so as to carry out a more effective and targeted defense strategy.

[0015] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: when access to the first bait is detected, sending a second notification to the cloud server, the second notification indicating that the first bait has been accessed; receiving a first preset strategy and / or a second bait from the cloud server, the first preset strategy being used to determine the above-mentioned target.

[0016] In the above technical solution, when an access to the first bait is detected, a relevant notification is sent to the cloud server so that the cloud server can determine the strategy and / or bait. This not only helps to reduce the computational complexity of the vehicle when deploying the defense strategy, but also facilitates the management of the defense strategies of multiple vehicles through the cloud server.

[0017] In combination with the first aspect, in certain implementations of the first aspect, a first copy is also deployed in the first control node, and the first copy is associated with at least one of the Internet protocol (IP) address, service port, and control algorithm of the first control node. The method also includes: when access to the first bait is detected, increasing the update frequency of the first copy.

[0018] Exemplarily, multiple copies are generated for the software module of the first control node, and the first copy may be one of the multiple copies. The update frequency of the first copy may include: updating the current copy to the frequency of other copies in the multiple copies except the current copy.

[0019] In the above technical solution, by deploying the first copy, it is possible to further increase the difficulty for attackers to attack, which helps to improve vehicle safety.

[0020] In combination with the first aspect, in certain implementations of the first aspect, the first bait includes at least one of the following: an application, file, account, permission, service, or message that the first control node and / or the vehicle will not access.

[0021] In a second aspect, a method for defending against attacks is provided, the method being applied to a vehicle, the vehicle comprising a first control node and a second control node. Exemplarily, the method may be executed by the second control node, for example, by a chip or a processor of the second control node.

[0022] The method includes: receiving a first notification from a first control node, the first notification indicating that a first bait in the first control node has been accessed; performing at least one of the following according to the first notification: limiting access rights of the first control node; updating or adjusting the deployment of the bait associated with the second control node; or starting a takeover system of the second control node, the takeover system being used to directly control components that affect vehicle driving safety.

[0023] In the above technical solution, when receiving the relevant notification that the bait of other control nodes has been accessed, corresponding measures are taken for the control node and the control node to ensure the synchronization of the vehicle-level defense strategy, which helps to block or delay the spread of attacks against a single control node and enhance the network resilience of the vehicle. In addition, dynamic defense management can cooperate with the minimum system management module to prevent the vehicle control business from being affected by attacks, which helps to improve vehicle safety.

[0024] In combination with the second aspect, in certain implementations of the second aspect, the first bait includes at least one of the following: an application, file, account, permission, service, or message that the first control node and / or vehicle will not access.

[0025] In combination with the second aspect, in certain implementations of the second aspect, updating or adjusting the deployment of the bait associated with the second control node includes: deleting the bait associated with the second control node and / or deploying a third bait for the second control node according to a second preset strategy, where the second preset strategy is associated with the attack faced by the second control node.

[0026] In combination with the second aspect, in some implementations of the second aspect, the method further includes: receiving a second preset strategy and / or a third bait from a cloud server.

[0027] In the above technical solution, updating or deploying the bait according to the information sent by the cloud server helps to reduce the computational complexity of the vehicle when deploying the defense strategy.

[0028] In combination with the second aspect, in certain implementations of the second aspect, a second copy is also deployed in the second control node, and the second copy is associated with at least one of the IP address, service port, and control algorithm of the second control node. The method also includes: increasing the update frequency of the second copy.

[0029] Exemplarily, multiple copies are generated for the software module of the second control node, and the second copy may be one of the multiple copies. The update frequency of the second copy may include: updating the current copy to the frequency of other copies in the multiple copies except the current copy.

[0030] In the above technical solution, by deploying the second copy, it is possible to further increase the difficulty for attackers to attack, which helps to improve vehicle safety.

[0031] In a third aspect, a method for defending against attacks is provided, the method being applied to a vehicle, the vehicle comprising a first control node and a second control node. Exemplarily, the method may be executed by the second control node, for example, by a chip or a processor of the second control node.

[0032] The method includes: executing at least one of the following according to the sending and receiving of periodic information: limiting the access rights of the first control node; updating or adjusting the deployment of baits associated with the second control node; or starting the takeover system of the second control node, the takeover system being used to directly control components that affect the driving safety of the vehicle.

[0033] In the above technical solution, it is possible to determine whether the control node has been dismantled based on the sending and receiving of periodic information, and then take relevant measures, which can prevent attackers from analyzing the defense measures deployed in the vehicle by dismantling the vehicle, etc., and help improve the safety of the vehicle.

[0034] Exemplarily, the periodic information includes at least one of the following: a periodic message sent by the second control node to the first control node, for example, a heartbeat message; a response message received by the second control node from the first control node, for example, a response message to the heartbeat message; a periodic message received by the second control node from the first control node, for example, a heartbeat message; or, a response message sent by the second control node to the first control node, for example, a response message to the heartbeat message.

[0035] Exemplarily, the sending and receiving of periodic information includes at least one of the following: whether the second control node receives periodic information from the first control node within a preset time length; whether the second control node sends periodic information within a preset time length; or whether the second control node passes the check of the periodic information.

[0036] In combination with the third aspect, in certain implementations of the third aspect, updating or adjusting the deployment of the bait associated with the second control node includes: deleting the bait associated with the second control node and / or deploying a third bait for the second control node according to a second preset strategy, where the second preset strategy is associated with the attack faced by the second control node.

[0037] Exemplarily, the second preset strategy may be determined by the second control node according to the receiving and sending of periodic information. For example, the second preset strategy may be determined by the second control node according to the receiving and sending of periodic information and whether the second control node is in the vehicle.

[0038] In some implementations, if the second control node is not in the vehicle, updating or adjusting the deployment of the decoy associated with the second control node includes: deleting the decoy associated with the second control node.

[0039] In some other implementations, if the second control node is in the vehicle, the deployment of the decoy associated with the second control node is updated or adjusted, including: deploying a third decoy for the second control node.

[0040] In the above technical solution, the second control node updates the bait deployment, which helps to hinder the spread of the attack; the second control node deletes the bait, which can prevent the attacker from obtaining the bait information of the second control node in the vehicle dismantling scenario. In addition, by deploying new baits, it is also helpful to analyze the attacker's attack purpose according to the bait that the attacker accesses next, so as to implement a more effective and targeted defense strategy.

[0041] In combination with the third aspect, in certain implementations of the third aspect, the method further includes: receiving a second preset strategy and / or a third bait from the cloud server.

[0042] In the above technical solution, updating or deploying the bait according to the information sent by the cloud server helps to reduce the computational complexity of the vehicle when deploying the defense strategy.

[0043] In combination with the third aspect, in certain implementations of the third aspect, a second copy is also deployed in the second control node, and the second copy is associated with at least one of the IP address, service port, and control algorithm of the second control node. The method also includes: increasing the update frequency of the second copy.

[0044] In the above technical solution, by deploying the second copy, it is possible to further increase the difficulty for attackers to attack, which helps to improve vehicle safety.

[0045] In a fourth aspect, a device for defending against attacks is provided, which is applied to a vehicle, and the vehicle includes a first control node and a second control node, and the device includes: a detection unit, used to monitor access to a first bait in the first control node; a transceiver unit, used to send a first notification to the second control node when the detection unit detects access to the first bait, the first notification instructing the second control node to perform at least one of the following: restricting access rights of the first control node, updating or adjusting the deployment of the bait associated with the second control node; and / or a processing unit, used to start a takeover system of the first control node when the detection unit detects access to the first bait, and the takeover system is used to directly control components that affect the driving safety of the vehicle.

[0046] In combination with the fourth aspect, in certain implementations of the fourth aspect, the first bait is accessed at a first moment, and the processing unit is also used to: determine a target that may be accessed at a second moment based on the first bait, the second moment being a moment after the first moment; and deploy a second bait for the first control node based on the above target, the second bait being associated with the above target.

[0047] In combination with the fourth aspect, in certain implementations of the fourth aspect, the transceiver unit is also used to: when access to the first bait is detected, send a second notification to the cloud server, the second notification indicating that the first bait has been accessed; receive a first preset strategy and / or a second bait from the cloud server, the first preset strategy being used to determine the above-mentioned target.

[0048] In combination with the fourth aspect, in certain implementations of the fourth aspect, a first copy is also deployed in the first control node, and the first copy is associated with at least one of the IP address, service port, and control algorithm of the first control node. The processing unit is also used to: when access to the first bait is detected, increase the update frequency of the first copy.

[0049] In combination with the fourth aspect, in certain implementations of the fourth aspect, the first bait includes at least one of the following: an application, file, account, permission, service, or message that the first control node and / or vehicle will not access.

[0050] In a fifth aspect, a device for defending against attacks is provided, which is applied to a vehicle, wherein the vehicle includes a first control node and a second control node, and the device includes: a transceiver unit, used to receive a first notification from the first control node, the first notification indicating that a first bait in the first control node is accessed; a processing unit, used to perform at least one of the following according to the first notification: restricting access rights of the first control node; updating or adjusting the deployment of the bait associated with the second control node; or starting a takeover system of the second control node, the takeover system being used to directly control components that affect the driving safety of the vehicle.

[0051] In combination with the fifth aspect, in certain implementations of the fifth aspect, the first bait includes at least one of the following: an application, file, account, permission, service, or message that the first control node and / or vehicle will not access.

[0052] In combination with the fifth aspect, in certain implementations of the fifth aspect, the processing unit is used to: delete the bait associated with the second control node and / or deploy a third bait for the second control node according to a second preset strategy, where the second preset strategy is associated with the attack faced by the second control node.

[0053] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to: receive a second preset strategy and / or a third bait from the cloud server.

[0054] In combination with the fifth aspect, in certain implementations of the fifth aspect, a second copy is also deployed in the second control node, and the second copy is associated with at least one of the IP address, service port, and control algorithm of the second control node. The processing unit is also used to: increase the update frequency of the second copy.

[0055] In a sixth aspect, a device for defending against attacks is provided, which is applied to a vehicle, and the vehicle includes a first control node and a second control node. The device includes: a transceiver unit for receiving periodic information; a processing unit for executing at least one of the following according to the reception and transmission of the periodic information: limiting the access rights of the first control node; updating or adjusting the deployment of baits associated with the second control node; or starting a takeover system of the second control node, and the takeover system is used to directly control components that affect the driving safety of the vehicle.

[0056] In combination with the sixth aspect, in certain implementations of the sixth aspect, the processing unit is used to: deploy a third bait for the second control node according to a second preset strategy, where the second preset strategy is associated with the attack faced by the second control node.

[0057] In combination with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further used to: receive a second preset strategy and / or a third bait from the cloud server.

[0058] In combination with the sixth aspect, in certain implementations of the sixth aspect, a second copy is also deployed in the second control node, and the second copy is associated with at least one of the IP address, service port, and control algorithm of the second control node. The processing unit is also used to: increase the update frequency of the second copy.

[0059] In the seventh aspect, a device for defending against attacks is provided, the device comprising: a memory for storing a computer program; and a processor for executing the computer program stored in the memory, so that the device performs a method in any possible implementation of the first to third aspects.

[0060] In an eighth aspect, a system for defending against attacks is provided, the system comprising a device as in any possible implementation of the fourth aspect, and a device as in any possible implementation of the fifth aspect or the sixth aspect.

[0061] In a ninth aspect, a system for defending against attacks is provided, the system comprising a first control node and a second control node, wherein the first control node monitors access to a first decoy in the first control node, and when access to the first decoy is detected, sends a first notification to the second control node, the first notification indicating that the first decoy in the first control node has been accessed; the second control node receives the first notification, and performs at least one of the following according to the first notification: restricting access rights of the first control node; updating or adjusting the deployment of the decoy associated with the second control node; or starting a takeover system of the second control node, the takeover system being used to directly control components that affect vehicle driving safety.

[0062] In a tenth aspect, a system for defending against attacks is provided, the system comprising a first control node and a second control node, wherein the first control node monitors access to a first decoy in the first control node, and upon detecting access to the first decoy, sends a first notification to the second control node, the first notification indicating that the first decoy in the first control node has been accessed; and / or upon detecting access to the first decoy, starts a takeover system of the first control node, the takeover system being used to directly control components that affect vehicle driving safety; the second control node receives the first notification, and performs at least one of the following according to the first notification: restricting access rights of the first control node; updating or adjusting the deployment of the decoy associated with the second control node.

[0063] In the eleventh aspect, a vehicle is provided, which includes a device as in any possible implementation of the fourth to seventh aspects; or, the vehicle includes a system as in any possible implementation of the eighth to tenth aspects.

[0064] In a twelfth aspect, a computer program product is provided, the computer program product comprising: a computer program code, when the computer program code is run on a computer, the computer executes a method in any possible implementation of the first to third aspects.

[0065] It should be noted that the above-mentioned computer program code may be stored in whole or in part on a first storage medium, wherein the first storage medium may be packaged together with the processor or may be packaged separately from the processor.

[0066] In the thirteenth aspect, a computer-readable medium is provided, wherein the computer-readable medium stores instructions, and when the instructions are executed by a processor, the processor implements the method in any possible implementation of the first to third aspects.

[0067] In a fourteenth aspect, a chip is provided, the chip comprising a circuit for executing a method in any possible implementation of the first to third aspects above. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 is a schematic diagram of the EEA of a vehicle;

[0069] Figure 2 is a schematic block diagram of the vehicle system architecture;

[0070] Figure 3 is a schematic block diagram of a system architecture for defending against attacks provided in an embodiment of the present application;

[0071] Figure 4 is a schematic flow chart of a method for defending against attacks provided in an embodiment of the present application;

[0072] Figure 5 is another schematic flow chart of the method for defending against attacks provided in an embodiment of the present application;

[0073] Figure 6 is another schematic flow chart of the method for defending against attacks provided in an embodiment of the present application;

[0074] Figure 7 is a schematic block diagram of a device for defending against attacks provided in an embodiment of the present application;

[0075] Figure 8 is another schematic block diagram of a device for defending against attacks provided in an embodiment of the present application;

[0076] Fig. 9 This is another schematic block diagram of the device for defending against attacks provided in an embodiment of the present application. DETAILED DESCRIPTION

[0077] Combine the following Figure 1 Introduction to the vehicle's electrical / electronic architecture (EEA).

[0078] Figure 1 Figure 2 shows the schematic diagram of two EEA architectures. Figure 1 (a) shows a domain-centralized architecture, that is, the functions are divided into domains and the functions within a single domain are centrally controlled to reduce the number of electronic control units (ECUs) and reduce system complexity. The current development trend of the domain-centralized architecture is to divide the vehicle functions into three domains according to vehicle control, intelligent driving and intelligent cockpit, and three domain controllers control the above three domains respectively. The domain controller communicates with the gateway through the backbone network, and the domain controller transmits and receives data with the sensor or actuator through the gateway. The gateway and the sensor or actuator communicate based on the intranet. It should be noted that in the specific implementation process, one or more controllers can also be included between the gateway and the sensor or actuator.

[0079] Figure 1(b) in the figure shows a centralized architecture, that is, the computing functions are centralized as much as possible to concentrate the computing power requirements and reduce the number of ECUs. The centralized architecture mainly includes a central computing platform and a zonal controller (ZCU) or a gateway. The central computing platform is used to meet the computing power requirements required in the function implementation process. In addition, the central computing platform can also have a networking function to communicate with the vehicle communication box (Telematics box, T-Box), roadside equipment and cloud servers. ZCU is responsible for sending and receiving data between the central computing platform and sensors or actuators to achieve specific functions. The central computing platform and ZCU communicate with each other through the backbone network, and the ZCU and sensors or actuators communicate with each other based on the intranet.

[0080] from Figure 1 It can be seen that the internal network structure of the vehicle is deterministic and static. The communication relationship between the controller and the gateway, the gateway and the sensor, and the actuator in the EEA architecture is fixed, making it easy for attackers to bypass traditional security defense technologies by dismantling the vehicle. In addition, the various parts of the vehicle's internal network are similar, and the internal network structures of different vehicles are also similar, so when an attacker successfully attacks one target, he can attack a large number of similar targets by reusing the attack method.

[0081] In view of this, the embodiments of the present application provide a method, device and vehicle for defending against attacks, by setting bait in each controller to monitor whether the controller is attacked. When a controller is attacked, the defense schemes between multiple controllers are coordinated through a heartbeat mechanism, a synchronization mechanism, etc., thereby delaying or blocking the attack and improving the safety of the vehicle. In addition, the moving target defense technology can be combined to further improve the safety of the vehicle.

[0082] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0083] Figure 2 A schematic block diagram of a vehicle system architecture is shown, which may include an application layer, a software system layer, and a hardware platform. Among them, the application layer may include one or more application nodes, each of which is used to implement a function. The software system includes an operating system and middleware, and the middleware is responsible for docking with the operating system to provide communication, resource management and other services for the application layer; the operating system runs on the hardware platform and can schedule resources according to the actual needs of the application layer during operation. The application layer obtains the computing power, memory, communication, storage, perception and other resources required for operation through the operating system. The present application sets baits at the application layer and the software system layer to lure attackers to access, thereby monitoring the attack behavior, helping to delay or block the attack, and thus improving vehicle safety.

[0084] It should be noted that in the embodiment of the present application, bait refers to a false asset that will not be accessed during normal operation of the vehicle's application. The false asset is used to lure attackers to access, and the false asset includes but is not limited to applications, files, accounts, permissions, services, and messages. Application refers to a collection of processes and threads that are encapsulated using communication middleware and have specific intelligent driving functions (hereinafter referred to as functions) in an intelligent driving operating system. The communication middleware may be a robot operating system (ROS), an automotive open system architecture communication management module (AUTOSAR CM), etc. The intelligent driving function may be functions such as vehicle environment perception, sensor fusion, and path planning. An application node is an abstract concept of a single application, and both or more parties of the application node implement the delivery of messages or services by calling the application programming interface (API) such as message sending and receiving of the communication middleware. An application node can perform one or more tasks to implement a specific intelligent driving function. In some possible implementations, an application node may be an application. The above-mentioned task refers to an activity completed by software, or a series of operations performed to achieve a certain purpose.

[0085] In the specific implementation process, multiple application nodes in the application layer may be implemented by multiple control nodes. Correspondingly, each control node includes an application layer and a software system layer. Based on this, the embodiment of the present application provides a system architecture for defending against attacks, such as Figure 3 As shown, the system includes a control node 310 , a gateway 320 and a control node 330 .

[0086] The application layer 311 of the control node 310 may include applications and decoy applications, which may also be real applications or copies of real applications. Exemplarily, a decoy file may be set in the application. The software system layer 312 of the control node 310 includes a dynamic defense management module 313. In addition, the software system layer 312 may also set one or more of decoy permissions, decoy accounts, decoy services, and decoy files. The dynamic defense management module 313 is used to adjust or update the deployment of dynamic defense technology in the control node 310 according to the access to the decoy in the control node 310. In addition, the dynamic defense management module 313 may also coordinate and synchronize with other dynamic defense management modules. Among them, the decoy permissions may include specific permissions required for the control node to perform a task; the decoy account may include the login account information / password of a certain control node; the decoy service may include a service API interface of a decoy nature, which is used to call or access system resources; the decoy file may include the file required for the control node to perform a task.

[0087] The gateway 320 has data format conversion and forwarding functions. For example, it can convert data from the backbone network into a data format supported by the intranet and forward the data to the intranet. A bait device and a dynamic defense management module 321 can be set in the gateway 320. The dynamic defense management module 312 is used to adjust or update the deployment of dynamic defense technology in the gateway 320 according to the access to the bait device, or it can also coordinate and synchronize with other dynamic defense management modules. Optionally, a diversified security mechanism can also be deployed in the gateway 320 to prevent attackers from successfully discovering circumvention means for a certain security mechanism. Exemplarily, the diversified security mechanism includes at least two security mechanisms, for example, it can include at least a security authentication mechanism and an access control policy.

[0088] The control node 330 includes an application layer 331 and a software system layer 332. The deployment of dynamic defense technologies such as decoys in the control node 330 is similar to that of the control node 310. The difference is that the software system layer 332 also includes a minimum system management module 334. The minimum system management module 334 is used to downgrade the control of the vehicle by the control node 330 when certain attacks occur to ensure vehicle safety.

[0089] In some possible implementations, a decoy message may be set at the communication network layer between the control node 310, the gateway 320, and the control node 330. The decoy message may enable an attacker to monitor the communication messages between the control nodes or between the control node and the gateway. For example, the decoy message may include the login account information / password of a certain control node, or the decryption password of a certain file. Once the decoy message is used, an alarm may be issued to the dynamic defense management module.

[0090] In some possible implementations, the software system layer of the control node can also deploy multiple randomizations to further improve the ability of the control node to defend against attacks. It should be noted that randomization refers to the transformation of certain attributes of software or programs, making certain attributes of the software unpredictable. Exemplarily, multiple randomizations may include but are not limited to one or more of running address randomization, global symbol randomization, and data structure randomization.

[0091] In some possible implementations, periodic information, such as heartbeat messages, is also transmitted between the control node 310 and the gateway 320, and between the gateway 320 and the control node 330. When any of the control node 310, the gateway 320, and the control node 330 is removed or attacked, the transmission of periodic information may be interrupted.

[0092] Exemplarily, the control node 310 and the gateway 320 , as well as the gateway 320 and the control node 330 communicate via a backbone network.

[0093] Exemplarily, the backbone network may be Ethernet. The intranet may be a controller area network (CAN), or a controller area network-flexible data (CAN-FD).

[0094] In the specific implementation process, the control node 310 may be a control node with an external interface. For example, the control node 310 may include at least one of the following domain controllers: vehicle domain controller (VDC), advanced driving domain controller (ADC), cockpit domain controller (CDC). For another example, the control node 310 may include an in-car application server (ICAS) controller, a body domain controller (BDC), a special equipment system (SAS), a media graphics unit (MGU), a body super core (BSC), and an advanced driving assistance system super core (ADAS super core). The present application does not limit this. Among them, ICAS may include at least one of the following: vehicle control server ICAS1, intelligent driving server ICAS2, intelligent cockpit server ICAS3, and infotainment server ICAS4. Alternatively, the control node 310 may include the central computing platform in the above-mentioned embodiment, for example, may include a vehicle central computer (VCC).

[0095] It should be noted that the external interface in this application may include a broad system interaction interface, such as an interface for information interaction with the outside world, including a wireless communication network interface such as a cellular network communication interface, a Bluetooth communication interface, a wireless fidelity (Wi-Fi) interface, etc. Alternatively, the external interface in this application may also include an interface for functional interaction with the outside world, such as an interface for over-the-air (OTA), an on-board diagnostic interface, and various vehicle-to-everything (V2X) interfaces.

[0096] The control node 330 may be a controller for controlling a vehicle actuator, for example, it may include a zone controller in the above embodiment, or a controller disposed between a gateway and an actuator in the above embodiment. Exemplarily, the control node 330 may include a chassis domain controller and a power domain controller. The vehicle actuator may be a drive device that provides linear or rotational motion under the action of a control signal, and the vehicle actuator may include a steering system, such as an electric power steering system (EPS); the vehicle actuator may also include a braking system, such as an electronic park brake (EPB).

[0097] It should be understood that Figure 3 The architecture shown is only an example. Figure 3 The system shown may include more control nodes or gateways, or may include fewer control nodes.

[0098] Figure 4 A schematic flow chart of a method for defending against attacks provided in an embodiment of the present application is shown. The method 400 can be applied to Figure 1 or Figure 3 The system shown. Exemplarily, the method 400 may be performed by Figure 3 The method 400 is executed by the dynamic defense management module shown, for example, by the dynamic defense management module of the first control node. The method 400 may include:

[0099] S401: Detect access to a first decoy in a first control node.

[0100] Exemplarily, the first control node may be a control node having an external interface, such as control node 310 ; or, the first control node may be a control node for controlling a vehicle actuator, such as control node 330 ; or, the first control node may be a gateway, such as gateway 320 .

[0101] Exemplarily, the first bait may be an application, file, account, permission, service, or message that the first control node and / or the vehicle will not access. For example, the first bait may include at least one of the bait application, bait file, bait account, bait permission, bait service, and bait message in the above embodiment.

[0102] S402, when access to the first bait is detected, sending a first notification to the second control node, the first notification instructing the second control node to perform at least one of the following: restricting access rights of the first control node, updating or adjusting the deployment of the bait associated with the second control node; and / or, when access to the first bait is detected, starting a takeover system of the first control node, the takeover system is used for components that directly affect the safety of vehicle driving.

[0103] Exemplarily, in the former case, the first control node may be any one of the control node 310, the gateway 320, and the control node 330; in the latter case, the first control node may be the control node 330. The takeover system may include a minimum system management module 334, or the takeover system may also be a system for implementing some or all functions of the first control node.

[0104] In some possible implementations, after the takeover system of the first control node is started, the first control node does not interact with other control nodes or gateways until the attack risk is eliminated.

[0105] Exemplarily, when the first control node is the control node 310, the second control node is the gateway 320 and / or the control node 330, and so on.

[0106] In one example, the first notification can be used to indicate that the first bait in the first control node is accessed. When the second control node receives the first notification, it determines the update or adjustment strategy of the bait and / or the restriction strategy of the access rights of the first control node based on the accessed first bait.

[0107] In yet another example, the first notification may be used to indicate to the second control node an update or adjustment strategy of the bait, and / or to indicate a restriction strategy of the access rights of the first control node.

[0108] In some possible implementations, the method further includes: the first bait is accessed at a first moment, a target that the attacker may access at a second moment is determined based on the first bait, and a second bait is deployed for the first control node based on the target, the second bait being associated with the target, wherein the second moment is a moment after the first moment.

[0109] Exemplarily, deploying the second decoy for the first control node may include: deploying the second decoy in the first control node, for example, deploying the second decoy in the application layer or software system layer. Alternatively, deploying the second decoy for the first control node may also include: deploying decoys that may be involved when the first control node implements certain functions, for example, deploying the second decoy in the network layer for the first control node to communicate with other control nodes or gateways.

[0110] Exemplarily, associating the second bait with the target may include: when the attacker accesses the target, the second bait needs to be used or accessed.

[0111] In some possible implementations, the method further includes: when access to the first bait is detected, sending a second notification to the cloud server, the second notification indicating that the first bait has been accessed; receiving a first preset strategy and / or the second bait from the cloud server, the first preset strategy being used to determine the above-mentioned target.

[0112] In one example, the first control node stores the second bait, and the cloud server determines the target that may be accessed next based on the first bait, that is, the first preset strategy. When receiving the first preset strategy, the second bait is deployed for the first control node according to the first preset strategy deployment.

[0113] In another example, the cloud server determines the second bait that the first control node needs to update based on the first bait, and sends it to the first control node. When the first control node receives the second bait, it deploys the second bait. In the above case, the first control node may store the second bait, or may not store the second bait.

[0114] In another example, the cloud server may determine a first preset strategy based on the first bait, determine a second bait based on the first preset strategy, and send both the first preset strategy and the second bait to the first control node.

[0115] Exemplarily, the cloud server may send the first preset strategy and / or the second bait to the first control node via over-the-air (OTA) technology.

[0116] In some possible implementations, after the cloud server determines the first preset strategy and / or the second bait based on the second notification, it can also send the first preset strategy and / or the second bait to other vehicles to prevent attackers from attacking other vehicles in the same way, which helps to improve vehicle safety.

[0117] In some possible implementations, a first copy is also deployed in the first control node, and the first copy is associated with at least one of the IP address, service port, and control algorithm of the first control node. The method also includes: when access to the first bait is detected, increasing the update frequency of the first copy.

[0118] Exemplarily, the first copy includes one or more of a copy of the real application, a diversified security mechanism, and multiple randomizations in the above embodiments.

[0119] The method for defending against attacks provided in the embodiment of the present application helps to detect attacks in a timely manner and reduce the false alarm rate of attacks by setting baits. After the attack is discovered, the control nodes can maintain synchronization and coordination to ensure the synchronization of the vehicle-level defense strategy, which helps to block or delay the spread of attacks against a single control node and enhance the network resilience at the vehicle level. In addition, dynamic defense management can work with the minimum system management module to prevent the vehicle control business from being affected by the attack, which helps to improve vehicle safety.

[0120] Figure 5 Another schematic flow chart of the method for defending against attacks provided in an embodiment of the present application is shown. The method 500 can be applied to Figure 1 or Figure 3 The system shown. Exemplarily, the method 500 may be performed by Figure 3 The method 500 is executed by the dynamic defense management module shown, for example, by the dynamic defense management module of the second control node. The method 500 may include:

[0121] S501: Receive a first notification from a first control node, where the first notification indicates that a first decoy in the first control node is accessed.

[0122] Exemplarily, the first notification may be the first notification in the above method 400; the first bait may be the first bait in the above method 400.

[0123] S502, execute at least one of the following according to the first notification: limit the access rights of the first control node; update or adjust the deployment of the bait associated with the second control node; or start the takeover system of the second control node, which is used for components that directly affect the safety of vehicle driving.

[0124] Exemplarily, the first control node may be the control node 310 or the gateway 320 , and the second control node may be the control node 330 .

[0125] Exemplarily, limiting the access rights of the first control node may include: limiting some or all of the access rights of the first control node. For example, limiting some or all of the access rights of the first control node according to the first bait. In one example, the function associated with the first bait does not threaten the safety of the vehicle. For example, when the function associated with the first bait is to control song playback, air conditioning on, and other functions, the access rights of the first control node to some applications and / or functions in the second control node may be limited. In another example, the function associated with the first bait threatens the safety of the vehicle. For example, when the function associated with the first bait is to control the speed of the vehicle, the access rights of the first control node to all applications and / or functions in the second control node may be limited.

[0126] In one implementation, when the function associated with the first bait threatens vehicle safety, the method includes: limiting the access rights of the first control to all applications and / or functions in the second control node according to the first notification, and starting a takeover system of the second control node.

[0127] In some possible implementations, the first decoy is accessed at a first moment, and updating or adjusting the deployment of the decoy associated with the second control node includes: determining a target that the attacker may access at a second moment based on the first decoy, and deploying a third decoy for the second control node based on the target, wherein the third decoy is associated with the target. The second moment is a moment after the first moment.

[0128] In some possible implementations, updating or adjusting the deployment of the bait associated with the second control node includes: updating or adjusting the deployment of the bait associated with the second control node according to the second preset strategy and / or the third bait sent by the cloud server. Exemplarily, the second preset strategy and the third bait can be determined by the cloud server according to the first bait.

[0129] In one example, the second control node receives a second preset policy from a cloud server, where the second preset policy is associated with an attack faced by the second control node; and a third bait is deployed for the second control node according to the second preset policy.

[0130] The second preset strategy is associated with the attack faced by the second control node, which can be understood as: the second preset strategy indicates the target that the attacker may attack next, and the target affects the security of the second control node.

[0131] In another example, the second control node receives a third bait from the cloud server and deploys the third bait.

[0132] In yet another example, the second control node receives the second preset strategy and the third bait, and deploys the third bait.

[0133] Exemplarily, associating the third decoy with the target may include: when the attacker accesses the target, the third decoy needs to be used or accessed. Deploying the third decoy for the second control node may include: deploying the second decoy in the second control node, for example, deploying the third decoy at the application layer or software system layer. Alternatively, deploying the third decoy for the second control node may also include: deploying the decoy that may be involved when the second control node implements certain functions, for example, deploying the third decoy in the network layer where the second control node communicates with other control nodes or gateways.

[0134] In some possible implementations, a second copy is also deployed in the second control node, and the second copy is associated with at least one of the IP address, service port, and control algorithm of the second control node. The method also includes: when the first notification is received, increasing the update frequency of the second copy.

[0135] Exemplarily, the second copy includes one or more of a copy of the real application, a diversified security mechanism, and multiple randomizations in the above embodiments.

[0136] Figure 6 Another schematic flow chart of the method for defending against attacks provided in an embodiment of the present application is shown. The method 600 can be applied to Figure 1 or Figure 3 The system shown. Exemplarily, the method 600 may be performed by Figure 3 The method 600 is executed by the dynamic defense management module shown, for example, by the dynamic defense management module of the second control node. The method 600 may include:

[0137] S601, monitoring the sending and receiving of periodic information.

[0138] Exemplarily, the periodic information may be a periodic message sent by the second control node to the first control node, such as a heartbeat message; or, the periodic information may be a response message received by the second control node from the first control node, such as a response message to the heartbeat message. Alternatively, the periodic message may also be a periodic message received by the second control node from the first control node, such as a heartbeat message; or, the periodic information may be a response message sent by the second control node to the first control node, such as a response message to the heartbeat message.

[0139] S602, based on the sending and receiving of periodic information, execute at least one of the following: restrict the access rights of the first control node; update or adjust the deployment of baits associated with the second control node; or start the takeover system of the second control node, which is used for components that directly affect the safety of vehicle driving.

[0140] Exemplarily, the first control node may be the control node 310 or the gateway 320 , and the second control node may be the control node 330 .

[0141] In some possible implementations, when the second control node does not receive periodic information from the first control node within a preset time period, or when the second control node does not send periodic information within a preset time period, or when the second control node fails a check of the periodic information, a check is initiated to determine whether the second control node is in the vehicle.

[0142] In some embodiments, the second control node is in the vehicle, and the second control node performs at least one of the following: ① limiting the access rights of the first control node; ② updating or adjusting the deployment of baits associated with the second control node; or ③ starting the takeover system of the second control node, which is used to directly affect the safety of vehicle driving.

[0143] It is understandable that when the second control node is in the car and the above situation occurs, it means that the first control node is attacked or removed, or the second control node is attacked.

[0144] In the above situation, limiting the access rights of the first control node may include: limiting part or all of the access rights of the first control node.

[0145] In the above situation, updating or adjusting the deployment of the bait associated with the second control node may include: updating or adjusting the deployment of the bait associated with the second control node according to the specific sending and receiving conditions of the periodic information.

[0146] In one example, when the second control node does not receive periodic information from the first control node within a preset time period, the first control node may be removed or attacked, and updating or adjusting the deployment of the decoy associated with the second control node may include: deploying a fourth decoy for the second control node. The specific process of deploying the fourth decoy can refer to the process of deploying the third decoy in method 500, which will not be repeated here.

[0147] In some implementations, the fourth bait is the same as the third bait.

[0148] In another example, when the second control node does not send periodic information within a preset time period, or when the second control node fails to check the periodic information, the second control node may be attacked, and updating or adjusting the deployment of the bait associated with the second control node may include: deleting all baits in the second control node, so as to prevent the attacker from reversing the bait deployment information and bait features.

[0149] It should be noted that when the second control node is a control node for controlling the vehicle actuator (such as control node 330), the second control node can execute the above ③. Otherwise, the second control node does not execute ③.

[0150] In some implementations of the above situation, a second copy is also deployed in the second control node, and the second copy is associated with at least one of the IP address, service port, and control algorithm of the second control node. The method also includes: increasing the update frequency of the second copy.

[0151] In some other embodiments, if the second control node is not in the vehicle, the second control node performs at least one of the following: restricting access rights of the first control node; and updating or adjusting deployment of decoys associated with the second control node.

[0152] It is understandable that when the second control node is not in the car, it means that the second control node has been removed, and the attacker may analyze the deployment of the defense technology by dismantling the car.

[0153] In the above case, limiting the access rights of the first control node may include: limiting all access rights of the first control node. In the above case, the second control node may also lock or close the external interaction interface to prevent the assets in the second control node from being leaked.

[0154] In the above situation, updating or adjusting the deployment of the decoys associated with the second control node may include: deleting all decoys in the second control node.

[0155] It should be noted that the embodiments of the present application are described with reference to the sending and receiving of periodic information. However, in the specific implementation process, the monitored information is not limited to periodic information.

[0156] The method for defending against attacks provided in the embodiment of the present application can determine whether the control node has been dismantled based on the sending and receiving of periodic information, and then take relevant measures. This can prevent attackers from analyzing the defense measures deployed in the vehicle by dismantling the vehicle, etc., and help improve the safety of the vehicle.

[0157] Combined with the above Figures 1 to 6 The method provided in the embodiment of the present application is described in detail. Figures 7 to 9 The device provided in the embodiment of the present application is described in detail. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment, so the contents not described in detail can be referred to the method embodiment above, and for the sake of brevity, they will not be repeated here.

[0158] Figure 7 A schematic block diagram of a control device 2000 provided in an embodiment of the present application is shown. The device 2000 can be used to execute Figure 4 The device 2000 includes a detection unit 2010, a transceiver unit 2020 and a processing unit 2030.

[0159] Specifically, the detection unit 2010 is used to monitor access to the first bait in the first control node; the transceiver unit 2020 is used to send a first notification to the second control node when the detection unit 2010 detects access to the first bait, the first notification instructing the second control node to perform at least one of the following: restricting access rights of the first control node, updating or adjusting the deployment of the bait associated with the second control node; and / or the processing unit 2030 is used to start the takeover system of the first control node when the detection unit detects access to the first bait, the takeover system being used to directly control components that affect the driving safety of the vehicle.

[0160] In some possible implementations, the first bait is accessed at a first moment, and the processing unit 2030 is further used to: determine a target that may be accessed at a second moment based on the first bait, the second moment being a moment after the first moment; and deploy a second bait for the first control node based on the above target, the second bait being associated with the above target.

[0161] In some possible implementations, the transceiver unit 2020 is also used to: send a second notification to the cloud server when access to the first bait is detected, the second notification indicating that the first bait has been accessed; receive a first preset strategy and / or a second bait from the cloud server, the first preset strategy being used to determine the above-mentioned target.

[0162] In some possible implementations, a first copy is also deployed in the first control node, and the first copy is associated with at least one of the IP address, service port, and control algorithm of the first control node. The processing unit 2030 is also used to: when access to the first bait is detected, increase the update frequency of the first copy.

[0163] In some possible implementations, the first bait includes at least one of the following: an application, file, account, permission, service, or message that the first control node and / or the vehicle will not access.

[0164] Figure 8 A schematic block diagram of a control device 2100 provided in an embodiment of the present application is shown. The device 2100 can be used to execute Figure 5 or Figure 6 The device 2100 includes a transceiver unit 2110 and a processing unit 2120.

[0165] When the device 2100 is applied to method 500, the transceiver unit 2110 is used to receive a first notification from a first control node, indicating that a first bait in the first control node has been accessed; the processing unit 2120 is used to perform at least one of the following according to the first notification: restricting the access rights of the first control node; updating or adjusting the deployment of the bait associated with the second control node; or starting a takeover system of the second control node, the takeover system being used to directly control components that affect the driving safety of the vehicle.

[0166] In some possible implementations, the first bait includes at least one of the following: an application, file, account, permission, service, or message that the first control node and / or the vehicle will not access.

[0167] In some possible implementations, the processing unit 2120 is used to: delete the bait associated with the second control node and / or deploy a third bait for the second control node according to a second preset strategy, where the second preset strategy is associated with the attack faced by the second control node.

[0168] In some possible implementations, the transceiver unit 2110 is further used to: receive a second preset strategy and / or a third bait from a cloud server.

[0169] In some possible implementations, a second copy is also deployed in the second control node, and the second copy is associated with at least one of the IP address, service port, and control algorithm of the second control node. The processing unit 2120 is also used to: increase the update frequency of the second copy.

[0170] When the device 2100 is applied to method 600, the transceiver unit 2110 is used to receive periodic information; the processing unit 2120 is used to execute at least one of the following according to the reception of the periodic information: restricting the access rights of the first control node; updating or adjusting the deployment of the bait associated with the second control node; or starting the takeover system of the second control node, the takeover system is used to directly control the components that affect the driving safety of the vehicle.

[0171] In some possible implementations, the processing unit 2120 is configured to: deploy a third bait for the second control node according to a second preset strategy, where the second preset strategy is associated with an attack faced by the second control node.

[0172] In some possible implementations, the transceiver unit 2110 is further used to: receive a second preset strategy and / or a fourth bait from a cloud server.

[0173] In some possible implementations, a second copy is also deployed in the second control node, and the second copy is associated with at least one of the IP address, service port, and control algorithm of the second control node. The processing unit 2120 is also used to: increase the update frequency of the second copy.

[0174] Exemplarily, the above-mentioned apparatus 2000 and apparatus 2100 may be arranged in Figure 1 In the gateway or controller shown, more specifically, the above-mentioned device 2000, device 2100 can be set in the dynamic defense management module of the gateway or controller, for example Figure 3 Any one of the dynamic defense management module 313, dynamic defense management module 321, and dynamic defense management module 333 shown. Exemplarily, the operations performed by the detection unit 2010, the transceiver unit 2020, and the processing unit 2030 can be performed by one processor, or they can also be performed by different processors; the operations performed by the transceiver unit 2110 and the processing unit 2120 can be performed by one processor, or they can also be performed by different processors. In the specific implementation process, the above-mentioned device 2000, the device 2100 can be a processor set in the vehicle; or the above-mentioned device 2000, the device 2100 can be a chip set in the vehicle.

[0175] In the embodiment of the present application, the processor is a circuit with the ability to process signals. In one implementation, the processor can be a circuit with the ability to read and run instructions, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP); in another implementation, the processor can realize certain functions through the logical relationship of the hardware circuit, and the logical relationship of the hardware circuit is fixed or reconfigurable, such as a hardware circuit implemented by a processor as an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as a field programmable gate array (FPGA). In a reconfigurable hardware circuit, the process of the processor loading a configuration document to implement the hardware circuit configuration can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

[0176] In the specific implementation process, all or part of the units in the above device can be integrated together, or can be implemented independently. In one implementation, these units are integrated together and implemented in the form of a system-on-a-chip (SoC).

[0177] Fig. 9 It is a schematic block diagram of a device for defending against attacks provided in an embodiment of the present application. Fig. 9 The device 2200 shown may include: a processor 2210, a transceiver 2220, and a memory 2230. The processor 2210, the transceiver 2220, and the memory 2230 are connected via an internal connection path, the memory 2230 is used to store instructions, and the processor 2210 is used to execute the instructions stored in the memory 2230 to implement the methods in the above embodiments. Optionally, the memory 2230 may be coupled to the processor 2210 via an interface, or may be integrated with the processor 2210.

[0178] It should be noted that the above-mentioned transceiver 2220 may include but is not limited to a transceiver device such as an input / output interface to achieve communication between the device 2200 and other devices or communication networks.

[0179] The memory 2230 may be a read only memory (ROM), a static storage device, a dynamic storage device or a random access memory (RAM).

[0180] The transceiver 2220 uses a transceiver device such as but not limited to a transceiver to implement communication between the device 2200 and other devices or a communication network to receive / send data / information used to implement the methods in the above embodiments.

[0181] An embodiment of the present application also provides a system for defending against attacks, which includes the above-mentioned device 2000 and the above-mentioned device 2100.

[0182] An embodiment of the present application also provides a vehicle, which includes the above-mentioned device 2000 and device 2100; or, the vehicle includes the above-mentioned device 2200; or, the vehicle includes the above-mentioned system for defending against attacks.

[0183] An embodiment of the present application further provides a computer program product, which includes a computer program code. When the computer program code runs on a computer, the computer implements the methods in the above embodiments of the present application.

[0184] An embodiment of the present application further provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer implements the methods in the above embodiments of the present application.

[0185] An embodiment of the present application also provides a chip, including a circuit, for executing the methods in the above embodiments of the present application.

[0186] In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in a processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or a power-on erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0187] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0188] In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is a kind of association relationship that describes associated objects, indicating that three relationships can exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In this application, "at least one" means one or more, and "multiple" means two or more. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0189] The prefixes such as "first" and "second" used in the embodiments of the present application are only used to distinguish different description objects, and have no limiting effect on the position, order, priority, quantity or content of the described objects. The use of prefixes such as ordinal numbers used to distinguish description objects in the embodiments of the present application does not constitute a limitation on the described objects. For the statement of the described objects, please refer to the description in the context of the claims or embodiments, and the use of such prefixes should not constitute an unnecessary limitation.

[0190] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0191] In the various embodiments of the present application, unless otherwise specified or logically conflicting, the terms and / or descriptions between the various embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0192] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0193] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0194] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for defending against attacks, characterized in that: The method is applied to a vehicle, the vehicle comprising a first control node and a second control node, and the method comprises: monitoring access to a first decoy in the first control node; When access to the first decoy is detected, a first notification is sent to the second control node, the first notification instructing the second control node to perform at least one of the following: restricting access rights of the first control node, updating or adjusting deployment of the decoy associated with the second control node; and / or When access to the first bait is detected, a takeover system of the first control node is started, and the takeover system is used to directly control components that affect the driving safety of the vehicle.

2. The method according to claim 1, characterized in that: The first bait is accessed at a first moment, and the method further comprises: Determine a target that may be visited at a second time according to the first bait, where the second time is a time after the first time; According to the target, a second decoy is deployed for the first control node, the second decoy being associated with the target.

3. The method according to claim 2, characterized in that The method further comprises: When an access to the first bait is detected, a second notification is sent to a cloud server, wherein the second notification indicates that the first bait has been accessed; A first preset strategy and / or the second bait are received from the cloud server, wherein the first preset strategy is used to determine the target.

4. The method according to any one of claims 1 to 3, characterized in that A first replica is also deployed in the first control node, and the first replica is associated with at least one of an Internet Protocol IP address, a service port, and a control algorithm of the first control node. The method further includes: When an access to the first bait is detected, the update frequency of the first copy is increased.

5. The method according to any one of claims 1 to 4, characterized in that The first bait includes at least one of the following: an application, a file, an account, a permission, a service, and a message that the first control node and / or the vehicle will not access.

6. A method for defending against attacks, characterized in that: The method is applied to a vehicle, the vehicle comprising a first control node and a second control node, and the method comprises: receiving a first notification from the first control node, the first notification indicating that a first decoy in the first control node is accessed; According to the first notification, at least one of the following is performed: restricting access rights of the first control node; updating or adjusting the deployment of decoys associated with the second control node; or A takeover system of the second control node is started, where the takeover system is used to directly control the components that affect the driving safety of the vehicle.

7. A method for defending against attacks, characterized in that: The method is applied to a vehicle, the vehicle comprising a first control node and a second control node, and the method comprises: Based on the sending and receiving of periodic information, perform at least one of the following: restricting access rights of the first control node; updating or adjusting the deployment of decoys associated with the second control node; or A takeover system of the second control node is started, where the takeover system is used to directly control components that affect driving safety of the vehicle.

8. The method according to claim 6, characterized in that The first bait includes at least one of the following: an application, a file, an account, a permission, a service, and a message that the first control node and / or the vehicle will not access.

9. The method according to claim 6 or 7, characterized in that: The updating or adjusting the deployment of the decoy associated with the second control node includes: The decoy associated with the second control node is deleted and / or a third decoy is deployed for the second control node according to a second preset policy, where the second preset policy is associated with an attack faced by the second control node.

10. The method according to claim 9, characterized in that The method further comprises: Receive the second preset strategy and / or the third bait from the cloud server.

11. The method according to claim 6 or 7, characterized in that: A second replica is also deployed in the second control node, and the second replica is associated with at least one of an Internet Protocol IP address, a service port, and a control algorithm of the second control node. The method further includes: Increase the update frequency of the second copy.

12. A device for defending against attacks, characterized in that: The device is applied to a vehicle, the vehicle includes a first control node and a second control node, and the device includes: a detection unit, configured to monitor access to a first decoy in the first control node; a transceiver unit, configured to send a first notification to the second control node when the detection unit detects access to the first bait, wherein the first notification instructs the second control node to perform at least one of the following: restricting access rights of the first control node, updating or adjusting the deployment of the bait associated with the second control node; and / or A processing unit is used to start a takeover system of the first control node when the detection unit detects access to the first bait, and the takeover system is used to directly control the components that affect the driving safety of the vehicle.

13. The device according to claim 12, characterized in that The first bait is accessed at a first moment, and the processing unit is further used for: Determine a target that may be visited at a second time according to the first bait, where the second time is a time after the first time; According to the target, a second decoy is deployed for the first control node, the second decoy being associated with the target.

14. The device according to claim 13, characterized in that The transceiver unit is also used for: When an access to the first bait is detected, a second notification is sent to a cloud server, wherein the second notification indicates that the first bait has been accessed; A first preset strategy and / or the second bait are received from the cloud server, wherein the first preset strategy is used to determine the target.

15. The device according to any one of claims 12 to 14, characterized in that A first replica is also deployed in the first control node, and the first replica is associated with at least one of an Internet Protocol IP address, a service port, and a control algorithm of the first control node, and the processing unit is further configured to: When an access to the first bait is detected, the update frequency of the first copy is increased.

16. The device according to any one of claims 12 to 15, characterized in that The first bait includes at least one of the following: an application, a file, an account, a permission, a service, and a message that the first control node and / or the vehicle will not access.

17. A device for defending against attacks, characterized in that: The device is applied to a vehicle, the vehicle includes a first control node and a second control node, and the device includes: a transceiver unit, configured to receive a first notification from the first control node, wherein the first notification indicates that a first decoy in the first control node is accessed; a processing unit, configured to perform at least one of the following according to the first notification: restricting access rights of the first control node; updating or adjusting the deployment of decoys associated with the second control node; or A takeover system of the second control node is started, where the takeover system is used to directly control the components that affect the driving safety of the vehicle.

18. A device for defending against attacks, characterized in that: The device is applied to a vehicle, the vehicle includes a first control node and a second control node, and the device includes: A transceiver unit, used for receiving periodic information; A processing unit, configured to perform at least one of the following according to the sending and receiving of the periodic information: restricting access rights of the first control node; updating or adjusting the deployment of decoys associated with the second control node; or A takeover system of the second control node is started, where the takeover system is used to directly control the components that affect the driving safety of the vehicle.

19. The device according to claim 17, characterized in that The first bait includes at least one of the following: an application, a file, an account, a permission, a service, and a message that the first control node and / or the vehicle will not access.

20. The device according to claim 17 or 18, characterized in that The processing unit is used for: The decoy associated with the second control node is deleted and / or a third decoy is deployed for the second control node according to a second preset policy, where the second preset policy is associated with an attack faced by the second control node.

21. The device according to claim 20, characterized in that The transceiver unit is also used for: Receive the second preset strategy and / or the third bait from the cloud server.

22. The device according to claim 17 or 18, characterized in that A second replica is also deployed in the second control node, and the second replica is associated with at least one of an Internet Protocol IP address, a service port, and a control algorithm of the second control node, and the processing unit is further used for: Increase the update frequency of the second copy.

23. A device for defending against attacks, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program stored in the memory, so that the apparatus performs the method according to any one of claims 1 to 11.

24. A system for defending against attacks, characterized in that: The system comprises the apparatus of any one of claims 12 to 16 and the apparatus of any one of claims 17 to 22.

25. A vehicle, characterized in that: The vehicle comprises the apparatus as claimed in any one of claims 12 to 16, and the apparatus as claimed in any one of claims 17 to 22; or the vehicle comprises the system as claimed in claim 24.

26. A computer-readable storage medium, characterized in that: Instructions are stored thereon, and when the instructions are executed by a processor, the processor implements the method according to any one of claims 1 to 11.

Images