Method for vehicle safety protection of vehicle

Abstract

The invention relates to a method for vehicle safety protection of a vehicle. The invention also relates to a computer program, a device and a storage medium for this purpose.

Description

Technical Field

[0001] The invention relates to a method for protecting a vehicle in terms of information technology, and also to a computer program, a device and a storage medium for this purpose. Background Art

[0002] In the field of IT security, host- and network-based solutions are known in particular, which, however, do not take into account, for example, personal safety. In addition, it is often the case that, for example, only detection services are promoted, or only basic prevention of IT security risks is promoted, which are, for example, also only carried out offline and not during operation of the vehicle. It can also often happen that prevention mechanisms for detected security risks are not yet available, so that the detected security risks remain until an update and, for example, the vehicle cannot be used until the detected security risks are eliminated. In the prior art, in particular, a reaction (IPS) is derived from the detection (IDS), which seems feasible and necessary at this time from the perspective of attack safety. However, in particular in the automotive environment, it may be necessary to take into account, in addition to this attack safety, personal safety and, if necessary, also other non-functional characteristics such as availability or reliability.

[0003] Within the scope of the present invention, personal safety preferably relates to avoiding personal injury, while attack safety relates to avoiding attacks on the vehicle, in particular avoiding attacks on the vehicle's software and hardware. Summary of the invention

[0004] The subject matter of the invention is a method having the features of claim 1, a computer program having the features of claim 8, a device having the features of claim 9 and a computer-readable storage medium having the features of claim 10. Further features and details of the invention are derived from the respective dependent claims, the description and the drawings. Features and details described in connection with the method according to the invention naturally also apply in connection with the computer program according to the invention, the device according to the invention and the computer-readable storage medium according to the invention, and vice versa, respectively, so that the disclosure of the individual inventive aspects always refers to one another or can refer to one another.

[0005] The subject matter of the invention is in particular a method for protecting a vehicle from vehicle safety technical aspects, the method comprising the following steps:

[0006] - detecting an attack on the vehicle by a detection module, wherein a description of the attack is provided by the detection module;

[0007] - evaluating the description of the attack by a decision module, wherein the decision module evaluates at least one measure against the attack based on the personnel safety specification and the attack safety specification,

[0008] The personal safety specification refers to the safety of at least one occupant of the vehicle or at least one traffic participant, and the attack safety specification refers to the safety against an attack on the vehicle.

[0009] to provide instructions for performing the at least one measure based on the evaluation;

[0010] - executing the at least one measure according to the provided instructions by means of an execution module, wherein the execution module coordinates the provided instructions.

[0011] The personnel safety specification can be, for example, a specification or rule specification formulated for the safety of at least one occupant of the vehicle or at least one traffic participant. Here, in simple terms, it can be ensured that the vehicle can continue to operate or travel so that the at least one occupant or the at least one traffic participant is not threatened, for example, by an accident. The at least one traffic participant can be, for example, a pedestrian or the driver of another vehicle. In addition, personnel safety can also involve aspects such as the reliability and / or availability of the vehicle, because these aspects may also affect the at least one occupant or the at least one traffic participant. Here, in general, the reliability of a technical product or system is especially the following characteristic, which indicates how reliably the function assigned to the product or system is completed within a time interval. In general, the availability of a technical system is especially the probability or degree that the system meets specific requirements at a specific time point or within an agreed time range. The attack safety specification can also be, for example, a specification or rule specification formulated for the safety relative to an attack on the vehicle. Here, for example, financial, legal or data protection-related aspects can also be considered. The combination of attack safety and personnel safety can be called vehicle safety, whereby, using the protection of the combination, the protection of the vehicle safety technology of the vehicle is especially provided. These attacks can be of information technology or electronic nature, such as hacker attacks. The measures are, for example, deactivating processes on the attacked system or reconfiguring a firewall. The instructions may include one or more of these measures, and may, for example, also indicate the target of the measures and / or the time specification for executing the measures. Advantageously, the execution module may send feedback to the decision module, for example, after executing the measures, the decision module is sent feedback. For considering not only attack security (i.e., Security) but also personnel safety (Safety) in an automotive environment, a method having at least the above steps may be advantageous. In this way, it is also advantageous to find and execute possible measures considering these targets during a function (e.g., autonomous driving). The detection module and / or the decision module and / or the execution module may advantageously call information from the vehicle state or send information to the vehicle state. The vehicle state may be regarded as a black box (Blackbox) that encapsulates the relevant state information. Time-critical information may be exchanged through a direct feedback loop available between the functional group decision module and the execution module. In addition, the detection module and / or the decision module and / or the execution module may advantageously have a connection to a vehicle security operations center (Vehicle Security Operations Center, VSOC). VSOC is preferably a backend service that can obtain information about potential attacks from the functional group detection module, information about triggered preventive measures from the functional group decision module, and information about successfully executed preventive measures from the functional group execution module. In VSOC, information about all vehicles of the fleet can be processed (e.g., it can also be processed manually by security experts).

[0012] It may be advantageous within the scope of the present invention that the detection further comprises the following steps:

[0013] The vehicle is monitored by means of at least one sensor, wherein at least events in the vehicle are recorded by means of the at least one sensor, wherein these events are specific to the possible presence of an attack on the vehicle.

[0014] The at least one sensor may be mounted on an element of the vehicle architecture, where the at least one sensor may measure the environment of the vehicle or the vehicle itself, in particular at least one functionally relevant part of the vehicle. Exemplary capabilities of the at least one sensor may be access to logs, triggering the at least one sensor by hooks or triggers, or reading network traffic of the vehicle. The at least one sensor may also detect various status information of the vehicle. By means of the at least one sensor, a large amount of data relevant to the detection and description of attacks may advantageously be collected based on these events and status information.

[0015] It is also conceivable that the detection further comprises the following steps:

[0016] - filtering the recorded events in order to provide a selection of these recorded events as qualified events, wherein the qualified events are determined by the filter using at least one defined criterion, wherein the at least one defined criterion is specific to the possible presence of an attack on the vehicle.

[0017] The at least one criterion may be a collection of events or state information which may be known from expert knowledge or from past executions of the method. It is also conceivable that an event must exceed a defined threshold or occur a defined number of times in order to be provided by the filter as a qualified event. Thus, by means of the filter, a preselection may advantageously be made in order to reduce the amount of data transmitted for further calculations and thereby, for example, to increase the computing power. Thus, real-time applications may advantageously be provided.

[0018] Optionally, it is also conceivable that the detection further comprises the following steps:

[0019] - analyzing these events, in particular qualified events, by means of a recognition module in order to classify the events, in particular qualified events, as attacks by means of the recognition module based on at least one defined attack signature and / or deviations from expected behavior.

[0020] The recognition module can use various pattern recognition techniques, for which a machine learning model can be applied. Through the recognition module, it can be advantageously determined whether there is a high probability of an attack on the vehicle that requires the implementation of measures.

[0021] It may also be feasible that the evaluation further comprises at least one of the following steps:

[0022] - providing or evaluating the at least one measure by an attack safety controller of the decision module, wherein the attack safety controller provides or evaluates the at least one measure based on the description of the attack taking into account an attack safety specification;

[0023] The at least one measure is provided or evaluated by a personal safety controller of the decision module, wherein the personal safety controller provides or evaluates the at least one measure based on the description of the attack while taking into account personal safety regulations.

[0024] By the attack safety controller and the personal safety controller providing and / or evaluating the at least one measure separately, the separate consideration of the attack safety regulations and the personal safety regulations can be advantageously improved. Within the scope of the invention, a "controller" can be designed as a software module, for example.

[0025] Another advantage within the scope of the present invention can be achieved if the evaluation also comprises the following steps:

[0026] - instructions for carrying out the at least one measure are provided by a mediator module of the decision module, wherein the mediator module communicates with an attack safety controller and a personal safety controller in order to provide the instructions taking into account the attack safety regulations and the personal safety regulations.

[0027] In simple terms, the mediator module can therefore advantageously assume a mediation function in order to take into account both the requirements of the attack safety controller and the requirements of the personnel safety controller. It can be provided that the requirements of the personnel safety controller have priority and are subordinate to the requirements of the attack safety controller only in special cases. A plurality of iterations of the communication between the attack safety controller and the personnel safety controller via the mediator module can be provided in order to find the best solution by means of the at least one measure.

[0028] A further advantage can be achieved within the scope of the present invention if the execution further comprises the following steps:

[0029] The provided instructions are monitored and coordinated by a reaction controller of the actuator module, wherein the reaction controller is connected to at least one actuator in order to execute the measure with the at least one actuator.

[0030] The reaction controller can monitor and coordinate the execution of these instructions, and can plan and coordinate the individual actions of the actuators. The reaction controller can ensure that potential prerequisites for the measure (for example related to the vehicle state) are met. The at least one actuator is particularly responsible for executing the individual parts of the measure. In an alternative, the measure can be executed by multiple distributed actuators. Exemplary measures performed by the at least one actuator are: ending a process, changing a firewall configuration, deliberate or intentional degradation of a function, restoring or ensuring a function. It can be provided that the reaction controller and / or the at least one actuator are designed to send feedback. After executing the at least one measure, feedback from the at least one actuator can be sent to the reaction controller. In addition, after executing the at least one measure, the reaction controller can send feedback from the actuator or further feedback to the decision module.

[0031] The vehicle can be designed, for example, as a motor vehicle and / or a passenger vehicle and / or an autonomous vehicle. The vehicle can have a vehicle device, for example, for providing an autonomous driving function and / or a driver assistance system. The vehicle device can be implemented to control and / or accelerate and / or brake and / or steer the vehicle at least partially automatically.

[0032] The subject of the invention is also a computer program, in particular a computer program product, which includes instructions which, when executed by a computer, cause the computer to carry out the method according to the invention. The advantages brought about by the computer program according to the invention are thus the same as those already described in detail with respect to the method according to the invention.

[0033] The subject matter of the invention is also a data processing device which is set up to carry out the method according to the invention. For example, a computer can be provided as the device, which executes the computer program according to the invention. The computer can have at least one processor for executing the computer program. A non-volatile data memory can also be provided, in which the computer program can be stored and from which the processor can read the computer program for execution.

[0034] The subject of the invention may also be a computer-readable storage medium having a computer program according to the invention and / or comprising instructions which, when executed by a computer, cause the computer to carry out the method according to the invention. The storage medium is designed, for example, as a data memory, such as a hard disk and / or a non-volatile memory and / or a memory card. The storage medium may be integrated, for example, into the computer.

[0035] Furthermore, the method according to the invention can also be implemented as a computer-implemented method. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Other advantages, features and details of the present invention are apparent from the following description, in which embodiments of the present invention are described in detail with reference to the accompanying drawings. The features mentioned in the claims and in the description may reflect the essence of the invention individually or in any combination.

[0037] in:

[0038] Figure 1 Schematic visualizations of a method, a vehicle, an apparatus, a storage medium and a computer program according to embodiments of the invention are shown;

[0039] Figure 2 A schematic diagram of an intrusion detection and prevention system (IDPS) according to an embodiment of the present invention is shown;

[0040] Figure 3 A schematic diagram of an attack prevention process according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0041] exist Figure 1 , a method 100 , a vehicle 1 , an apparatus 10 , a storage medium 15 and a computer program 20 according to an embodiment of the present invention are schematically shown.

[0042] according to Figure 1 In the embodiment of the invention, a method 100 for protecting a vehicle 1 from information technology comprises a first method step 101, in which an attack on the vehicle 1 is detected by a detection module 5. Here, a description 17 of the attack is provided by the detection module 5. In a second method step 102, the description 17 of the attack is evaluated by a decision module 8. Here, the decision module 8 evaluates at least one measure against the attack based on personal safety and attack safety. Here, personal safety refers to the safety of at least one occupant of the vehicle 1 or at least one traffic participant, and attack safety refers to safety with respect to an attack on the vehicle 1. Based on the evaluation, an instruction for executing the at least one measure is provided. In a third method step 103, the at least one measure is executed according to the provided instruction by an execution module 13, wherein the execution module 13 coordinates the provided instruction.

[0043] The following description relates in particular, at least in part, to Figure 2 and Figure 3 Embodiment of the invention.

[0044] In the scope of the present invention, the in-vehicle IDPS is particularly logically divided into three blocks, which can be further divided into various logical components, such as Figure 2As shown in . It should be noted that: this diagram preferably only shows logical connections and functional dependencies, and no restrictions are made on the number or location of individual components or functional elements. In the specific IDPS instantiation of this functional chain, a single logical component can appear in multiple (distributed) instances, and the functions of multiple logical components can be covered by a unique component. Functional elements can be connected to each other in different ways in multiple distributions and distributed on different vehicle architectures.

[0045] The functional group detection module 5 can observe, process and analyze events in order to find out whether the system is under attack. If an attack is identified, an attack report is preferably created, which can correspond to a description of the attack 17. The description of the attack 17 may also provide information about security or the probability of a potential attack, for example for a self-learning system. The functional group detection module 5 can be divided into the following functional elements:

[0046] Functional element sensor 2 preferably records all events that may contain indicators of compromise (Indicator of Compromise, IoC), i.e. events that may indicate potential harm or attack, but also other relevant status information. Sensor 2 can perform observation or monitoring of the system. The task of the sensor is in particular to collect and transmit event information.

[0047] The functional element filter 3 preferably processes events from one or more sensors and determines whether an event can be considered an IoC and should be forwarded. The filter 3 preferably performs a pre-selection of events that are relevant for this decision (i.e. minimization of information transmission and processing load). The filter 3 can also forward status information from the sensors, which are not necessarily considered IoC, but contain relevant information that the identification module 4 needs in order to find out whether the system is attacked. The term "qualified event" can be used for events processed by the filter 3. (Hint: Since the sensor 2 collects the events without filtering, the filter 3 is especially responsible for discarding irrelevant events, thereby reducing the amount of information that must be transmitted and processed in subsequent steps).

[0048] The functional element recognition module 4 preferably processes the qualifying events from one or more filters 3 and, if necessary, the current vehicle state 14 and can determine whether these observations should be classified as attacks. For this classification, various recognition methods can be used, which are generally based on matching with known attack signatures (signature-based) or on the recognition of deviations from expected behavior (anomaly-based). If the recognition module 4 ascertains that the system, i.e., in particular the vehicle 1, has been attacked, it preferably creates a description 17 of the attack with the details of the attack. For example, the recognition module 4 receives at its input an event reporting an attempt to access a restricted resource and decides to classify this as an attack. The recognition module 4 can then compile a description 17 of the attack, which contains information about the resources involved and the responsible processes.

[0049] If IDS solutions, possibly provided by third parties, are already present in the vehicle 1, these can be integrated into the IDPS architecture. It can be assumed that such a solution is like a black box, which outputs information once it has identified an attack. This information can then be converted into understandable input for the identification module 4 with the aid of an adapter.

[0050] The functional group decision module 8 preferably obtains the description 17 of the attack from the functional group detection module 5, checks the current vehicle state 14 if necessary, and decides whether a reaction is required. If a reaction is required, one or more IDPS preventive measures can be selected and their corresponding attack and personnel safety capabilities can be checked. In some cases, the best IDPS preventive measures can be selected from the perspective of attack safety, and the IDPS preventive measures can be tested from the perspective of personnel safety. If the test fails in at least one aspect, alternative IDPS preventive measures can be selected, and if possible, these IDPS preventive measures achieve the prevention goals in different ways. It is also possible that such preventive measures are not found and existing measures from the safety concept (vehicle 1 or control device) can be executed. This may also be the case if time limits must be observed, such as fault-tolerant time intervals (FTTI) related to personnel safety. This reaction especially includes a combination of IDPS preventive measures executed in a specific order. These selected measures are then preferably forwarded to the reaction controller 9 in the form of a detailed instruction sequence, which provides feedback on the IDPS preventive measures executed.

[0051] The functional group decision module 8 can be divided, for example, into the following functional elements that can agree on the measures to be taken:

[0052] Functional Element Attack Safety Controller 6 preferably decides the following task: which IDPS prevention measure or measures should be selected from an attack safety perspective, i.e. which is the most effective step to stop an attack and limit its consequences. An example is that Attack Safety Controller 6 decides to deactivate the architectural element (e.g. external communication) from which the attack comes.

[0053] The functional element personnel safety controller 7 can ensure that IDPS precautions do not endanger the safety of the vehicle 1, that is, in particular the safety of the personnel. The personnel safety controller can also suggest precautions, such as precautions from an existing safety concept. In this way, the personnel safety controller 7 in particular decides and checks which IDPS precautions form a safe environment for use, and can ultimately also block certain measures if the requirements are not met. If the attack requires a rapid safety reaction (i.e., in particular compliance with FTTI safety regulations), the personnel safety controller 7 can prioritize triggering precautions, i.e. from the perspective of the existing safety concept. An example is: assuming that the deactivation of an architectural element violates the safety concept, the personnel safety controller 7 finds accompanying or alternative steps (i.e., IDPS precautions) in order to keep the vehicle 1 in a safe state, while the architectural element is deactivated as required by the personnel safety controller 7, as long as this is ultimately feasible.

[0054] The moderator 11 of the functional element can coordinate the communication between the responsible personnel and the agencies for attack security, and is in particular responsible for the final decision on the proposed preventive measures. Within the scope of the present invention, the moderator 11 is also synonymously referred to as a moderator module. Preferably, the moderator 11 also compiles a list of IDPS preventive measures, possibly compiling multiple possible lists in parallel, wherein the moderator 11 complies with restrictions, in particular from the perspective of the security schedule. In this case, the moderator 11 can also forward parts of the list to the execution module 13, and can also take into account feedback from these parts.

[0055] Preferably, the functional group execution module 13 is responsible for executing the IDPS preventive measures that have been decided by the functional group decision module 8. The functional group execution module 13 can also provide feedback when the execution is delayed or impossible for some reason. Status feedback on the progress of the execution may also be helpful to the decision module 8. The functional group can be divided into the following functional elements:

[0056] The functional element reaction controller 9 in particular obtains the instruction sequence and can be responsible for the coordination and scheduling of the individual steps of the IDPS preventive measures with the actuators. Preferably, the reaction controller 9 ensures, taking into account the vehicle state 14, that each measure is only executed if the given prerequisites from the decision are met. Furthermore, the reaction controller 9 preferably provides feedback to the functional group detection module 5 about the measures executed. An example is that if the measures consist of a plurality of steps that must be related to each other and executed in a specific order, the reaction controller 9 can monitor the execution of the individual steps and coordinate the actions of the actuators accordingly.

[0057] The functional element executor 12 preferably receives individual instructions for preventive measures, executes these instructions accordingly and provides feedback on the execution to the reaction controller 9. An example is that the executor 12 may be instructed to end a process or reconfigure firewall settings, i.e. set an IP address to a blacklist.

[0058] In addition to the functional groups and components of the IDPS functional chain within the vehicle, Figure 2 In particular, a connection to the vehicle status 14 is also shown. The vehicle status 14 can be regarded as a black box that encapsulates the status information relevant to the IDPS system. However, all time-related information can be exchanged via a direct feedback loop available between the functional group decision module 8 and the execution module 13. The vehicle status 14 can also be used to synchronize multiple instances of the IDPS functional chain, especially when the focus is on different perspectives, such as the vehicle functional perspective, which should be considered within the IDPS chain on the vehicle architecture element and vice versa. Examples for this are in particular: current driving situation, actuator status, safety status, firewall configuration, diagnostic mode, software / firmware version.

[0059] Figure 2 In particular, a connection to the Vehicle Security Operations Center (VSOC 16) is also shown: VSOC 16 is preferably a backend service that can obtain information about potential attacks from the functional group detection module 5, information about triggered preventive measures from the functional group decision module 8, and information about successfully executed preventive measures from the functional group execution module 13. In VSOC 16, information from all vehicles 1 of the fleet can be processed (for example, it can also be processed manually by security experts). If the analysis results in an attack that requires a reaction from the entire fleet, VSOC 16 can send corresponding instructions to the functional group decision modules 8 of each vehicle 1. VSOC 16 is not, in particular, a major component of the IDPS functional chain within the vehicle, but an element of the IDPS within the framework of the entire fleet.

[0060] In practice, it is possible that a single component takes on the tasks of multiple logical components. An example is that in a network-based IDPS, sensor 2 may observe the entire network traffic. Instead of copying the entire traffic and forwarding it to filter 3, it may make sense to combine sensor 2 with filter 3 in order to reduce the number of forwarded messages.

[0061] Furthermore, there may be multiple instances of a single component in an IDPS – either as complementation, as the architecture is distributed across different physical (or virtual) components, or to provide redundancy.

[0062] If solutions already exist for individual functional elements or functional groups of a functional chain (eg stand-alone IDS solutions for AutoSAR or Linux), these solutions can be integrated with the aid of user-defined adapter elements which enable interfaces to other functional elements or functional groups of the functional chain.

[0063] As far as input is concerned, the sensor 2 is preferably mounted on an element of the vehicle architecture, where it can observe the environment. In particular, no further explicit input will be made. The output of the sensor 2 may be an event formed from the observations made by the sensor 2. The sensor 2 reports its observations, for example, in a specific format. The sensor 2 may be affected by its observations. The sensor 2 may be stateless and does not take into account the state of the vehicle 1. The sensor 2 preferably observes activities on elements of the vehicle architecture and collects information. The sensor 2 generates events that can be further processed by the filter 3 or the recognition module 4. Exemplary capabilities of the sensor 2 may be access to logs, triggering the sensor 2 by hooks or triggers, or reading network traffic.

[0064] The input to the filter 3 may be events reported by the sensor 2. The output may be a qualified event. For each received event, the filter 3 may decide, if necessary, based on the inputs from multiple sensors, whether the event can be considered an IoC or relevant state information, which is required by the identification module 4 and should therefore be forwarded as a qualified event. Otherwise, for example, when the event is considered irrelevant (i.e., not considered an IoC), the event is not forwarded. The filter 3 may be state-dependent (i.e., the filter maintains local state that may affect its decision), but preferably does not depend on the vehicle state 14. The filter 3 may also output a reliability assessment based on a self-learning algorithm. The filter 3 preferably identifies IoCs and other state information in the input, and only forwards relevant information as output. By this pre-selection, the number of qualified events forwarded to the identification module 4 for further analysis can be significantly reduced. An exemplary capability is to receive static sensor input.

[0065] Here, it can be provided that an event is forwarded as a qualified event only when a threshold value (eg n=10) is reached. In this way, the data traffic to the identification module 4 is advantageously reduced (eg to 10%).

[0066] The input of the recognition module 4 may be a qualified event from the sensor 2. The output may be a description 17 of the attack, which contains detailed information about the attack (including the architectural elements involved, the participating sensors and filters 3, and optionally the trust level). The recognition module 4 may use a combination of various recognition methods in order to find out whether the observed system is under attack, and in order to derive additional information in this case. Each recognition method may use (part of) the input, the local state of the recognition module 4 and / or the vehicle state 14. Each description 17 of the attack is output together with all relevant details about the attack, which may also contain a confidence level, so that a decision can be made as early as possible. The recognition module 4 in particular finds out whether the observed system is under attack. If an attack is found, the recognition module 4 preferably creates a description 17 of the attack, which contains all relevant details about the attack. The exemplary function in particular uses various techniques (e.g., pattern recognition, outlier / anomaly recognition, artificial intelligence) to identify attacks in the input obtained.

[0067] The inputs to the attack safety controller 6 may be a description of the attack 17, notifications from the moderator 11 (optionally, the vehicle state 14 and VSOC 16), and / or feedback from the reaction controller 9. The output may be a notification to the moderator 11 (optionally, the vehicle state 14 and VSOC 16). In the event of a reported attack, the attack safety controller 6 preferably uses information derived from the description of the attack 17, and optionally the vehicle state 14 and VSOC 16 as the basis for a decision about appropriate IDPS precautions. The attack safety controller 6 may communicate with the moderator 11, which in turn may communicate with the personnel safety controller 7. The attack safety controller 6 may preferably not pass the IDPS precautions to the execution module 13 independently, but only via the moderator 11, in order to verify personnel safety. The attack safety controller 6 preferably decides which IDPS precautions should be taken (from an attack safety perspective) in order to mitigate the reported attack and achieve a safe state. The attack safety controller 6 may collaborate with the moderator 11 to accomplish this (i.e., maintain a safe state) and repeat or alternate IDPS precautions as necessary. Exemplary capabilities are to deactivate a process on the attacked system, reconfigure a firewall (eg, blacklist), or trigger a series of individual actions.

[0068] The inputs to the personnel safety controller 7 may be: a description 17 of the attack, notifications from the moderator 11 (optionally, the vehicle state 14 and VSOC 16), feedback from the reaction controller 9, output communications to the moderator 11 (optionally, the vehicle state 14 and VSOC 16). The personnel safety controller 7 may be consulted by the moderator 11 before triggering IDPS precautions against the attack, and may suggest alternative or additional precautions for safety reasons. The personnel safety controller 7 makes its decision, for example, based on the inputs from the moderator 11 and optionally the vehicle state 14 and VSOC 16. However, the personnel safety controller 7 is preferably not able to make the final decision autonomously, but may collaborate with the moderator 11, which for its part coordinates with the attack safety controller 6. The personnel safety controller 7 is particularly responsible for ensuring a safe state with respect to the occupants of the vehicle 1, and preferably does not allow any IDPS precautions that violate the safety of the vehicle 1, in particular with respect to the safety of the occupants of the vehicle 1. If the reported attack requires time-critical IDPS precautions, the personal safety controller 7 can suggest suitable precautions to the regulator 11, which must trigger these precautions within a specified time, as long as this is feasible with respect to personal safety. The personal safety controller 7 preferably has the task of ensuring that the safety of the vehicle 1 is not compromised by the IDPS precautions, i.e. in particular ensuring that the occupants of the vehicle 1 are, for example, protected against accidents. Furthermore, the personal safety controller 7 can take measures in order to implement and / or restore the safety of the vehicle 1 or the safety of the personnel if it has been compromised by the attack. An exemplary capability is to suggest a series of accompanying IDPS precautions in order to ensure personal safety, in particular when the IDPS precautions are time-critical (i.e. FTTI).

[0069] The inputs of the moderator 11, which can also be synonymously referred to as the moderator module 11 within the scope of the present invention, can be: a description of the attack 17, a notification of the attack safety controller 6 or the personnel safety controller 7 (optionally, the vehicle state 14 and the VSOC 16) or a feedback of the reaction controller 9. The output can be a notification to the attack safety controller 6 and the personnel safety controller 7 (optionally, the vehicle state 14 and the VSOC 16) for the instruction sequence of the reaction controller 9. If a description of the attack 17 is received, the moderator 11 can communicate with the attack safety controller 6 and the personnel safety controller 7 in order to coordinate one or more IDPS prevention measures, as long as this is feasible. Based on this communication, the moderator 11 can send a corresponding instruction sequence to the reaction controller 9. If the personnel safety controller 7 requires the execution of an IDPS prevention measure within a certain time interval, the moderator 11 must preferably meet this requirement and forward this requirement to the execution module 13 as quickly as possible. The moderator 11 communicates in particular with the attack safety controller 6 and the personnel safety controller 7 and can collect possible instruction sequences, which the moderator can forward to the reaction controller 9. An exemplary capability is to collect communications between the attack safety controller 6 and the personnel safety controller 7 until a suitable sequence of measures is determined (or a temporary solution such as FTTI is prioritized for time reasons), and to output corresponding instructions.

[0070] The input to the execution module 13 may be a sequence of instructions for executing IDPS preventive measures (optionally, the vehicle state 14). The output may include instructions for the actuators, feedback to the functional group of preventive instructions (optionally, the vehicle state 14 and the VSOC 16). The reaction controller 9 may monitor and coordinate the execution of the received IDPS preventive instructions. The reaction controller 9 may plan and coordinate the actions of these actuators. The reaction controller 9 may ensure that all potential prerequisites for IDPS preventive measures (e.g. related to the vehicle state 14) are met. Once the instruction sequence is triggered, the instruction sequence may be completely abolished, or feedback about the interruption may be provided to the decision module 8 in order to resolve the problem. The reaction controller 9 is particularly responsible for coordinating the execution of IDPS preventive measures.

[0071] Exemplary capabilities are: execution of a step that triggers an IDPS precaution only after the previous step has completed, triggering and coordinating the execution of IDPS precautions (in parallel if possible).

[0072] The input to the actuator 12 may be instructions for executing IDPS preventive measures. The output may be feedback to the reaction controller 9 (optionally, the vehicle state 14 and the VSOC 16). The actuator 12 preferably executes the instructions obtained and may provide feedback to the reaction controller 9 on the completion or interruption of the action. The actuator 12 is particularly responsible for executing the various "minimal parts" of the IDPS preventive measures. Exemplary capabilities are: ending a process, changing a firewall configuration, reducing functionality, restoring or ensuring functionality.

[0073] Preferably, the vehicle 1 must always be in a safe state. Thus, a key point of the IDPS inside the vehicle may be the impact on personal safety and attack safety and therefore the interaction between personal safety and attack safety. Although both areas may ultimately have the goal of ensuring a safe and uncompromised experience for traffic participants, attack safety is particularly concerned with protecting the vehicle 1 from any type of malicious damage, while personal safety is particularly concerned with preventing any type of personal injury. Although preventing attacks on the vehicle 1 may generally be in the interests of personal safety, there may be situations in which the best response measures for IDPS prevention from an attack safety perspective cannot be immediately and safely executed, such as cutting off important and / or autonomous vehicle functions to curb attacks at high speeds, and therefore additional IDPS preventive measures are required in order to achieve a safe state related to personal safety. On the other hand, there may be situations in which IDPS preventive measures aimed at personal safety may compromise attack safety, such as by opening a backup communication channel to a damaged architectural element that has been intentionally isolated. That is, there are trade-offs, in particular, between personnel safety and attack safety, which must preferably be made very carefully within the respective scope of application, taking into account all limitations, which may result in a list of IDPS preventive measures that are ultimately implemented.

[0074] The functional element attack safety controller 6 preferably keeps track of the current attack safety state of the vehicle 1 and can ensure that the IDPS prevention measures used keep the system in a safe state relevant to attack safety in the event of an attack.

[0075] The functional element personnel safety controller 7 tracks the current personnel safety-related state of the vehicle 1 and can trigger IDPS precautions to ensure that the vehicle 1 remains in a safe state related to personnel safety. In this way, the personnel safety controller 7 can suggest IDPS precautions to create an environment in which the IDPS precautions can be safely used.

[0076] Ideally, appropriate (i.e., safe) IDPS preventive measures for certain attack scenarios and vehicle states can be statically determined, making coordination between personnel safety states and attack safety states through corresponding control devices trivial and enabling the triggering of corresponding IDPS preventive measures.

[0077] If this simple solution is not feasible, measures to prevent or protect against attacks can be dynamically determined and specified. The two parties responsible for the transaction must negotiate (hosted and supervised by the mediator 11) which mechanisms should be applied to prevent or protect against intrusion or attacks.

[0078] exist Figure 3 , a possibility of a process in the functional group decision module 8 is shown. Preferably, the functional group decision module 8 and thereby all functional elements of the group obtain a description 17 of the attack from the detection module 5, which is introduced into the decision process. The attack safety controller 6 and the personnel safety controller 7 analyze 61, 71 the description 17 of the attack respectively. If a reaction is required 18 (which may always be the case after a possible attack), the attack safety controller 6 can suggest 19 suitable IDPS precautions, which can be checked by the personnel safety controller 7 to ensure that the safety state related to personnel safety is not destroyed 22 by the execution of the selected measures. If the IDPS precautions cannot be safely executed in the current vehicle state 14, the personnel safety controller 7 can add 19 IDPS precautions related to personnel safety to enable the execution of IDPS precautions, as long as this is feasible. These additional personnel-related IDPS precautions can in turn be checked by the attack safety controller 6 to ensure that the vehicle safety state is not further destroyed 21. However, if additional IDPS precautions are subsequently added to restore the vehicle safety state, such a destruction may be tolerated. This iteration - checking by the personnel safety controller 7 - can be repeated until the personnel safety state and the vehicle safety state are no longer violated. Once such agreement exists, one or more IDPS precautions (or parts of the list) can be triggered 27.

[0079] In addition, Figure 3 The middle shows a moderator 11, which has a plurality of lists 23, 24, 25 of IDPS prevention measures. These lists can be formed by iterative communication between the attack safety controller 6 and the personal safety controller 7, wherein in particular measures are added 26 to the lists 23, 24, 25 after checking whether the vehicle safety state and the personal safety state are ensured. A decision algorithm 28 can be part of the moderator 11.

[0080] If no agreement can be reached in this way, then the IDPS preventive measures may preferably not be triggered. This situation may also be reported to the VSOC 16 in order to analyze why no feasible solution for mitigating the attack could be found based on the obtained report.

[0081] If a time-critical reaction is required, the personal safety controller 7 can trigger such an IDPS precautionary measure via the moderator 11 with the required priority.

[0082] The above description of the embodiments only describes the present invention within the framework of examples. Of course, as long as it is technically reasonable, the various features of these embodiments can be freely combined with each other without departing from the protection scope of the present invention.

Claims

1. A method (100) for protecting a vehicle (1) in terms of vehicle safety technology, the method comprising the following steps: - detecting (101) an attack on the vehicle (1) by means of a detection module (5), wherein a description (17) of the attack is provided by means of the detection module (5); - evaluating (102) the description (17) of the attack by means of a decision module (8), wherein the decision module (8) evaluates at least one measure against the attack based on personnel safety specifications and attack safety specifications, The personal safety specification refers to the safety of at least one occupant of the vehicle (1) or at least one traffic participant, and the attack safety specification refers to the safety against an attack on the vehicle (1). to provide instructions for performing the at least one measure based on the evaluation; - executing (103) the at least one measure according to the provided instructions by means of an execution module (13), wherein the execution module (13) coordinates the provided instructions.

2. The method (100) according to claim 1, It is characterized in that The detection (101) further comprises the following steps: The vehicle (1) is monitored by at least one sensor (2), wherein at least one event in the vehicle (1) is recorded by the at least one sensor (2), wherein the event is specific to the possible presence of an attack on the vehicle (1).

3. The method (100) according to claim 2, It is characterized in that The detection (101) further comprises the following steps: - filtering (3) the recorded events in order to provide a selection of the recorded events as qualified events, wherein the qualified events are determined by the filter (3) using at least one defined criterion, wherein the at least one defined criterion is specific to the possible existence of an attack on the vehicle (1).

4. The method (100) according to any one of claims 2 or 3, It is characterized in that The detection (101) further comprises the following steps: - analyzing the events, in particular the qualified events, by means of a recognition module (4) so ​​as to classify the events, in particular the qualified events, as attacks by means of the recognition module (4) based on at least one defined attack signature and / or deviations from expected behavior.

5. The method (100) according to any one of the preceding claims, It is characterized in that The evaluation (102) further comprises at least one of the following steps: - providing or evaluating the at least one measure by an attack safety controller (6) of the decision module (8), wherein the attack safety controller (6) provides or evaluates the at least one measure based on the description (17) of the attack while taking into account the attack safety specification; - providing or evaluating the at least one measure by a personnel safety controller (7) of the decision module (8), wherein the personnel safety controller (7) provides or evaluates the at least one measure based on the description (17) of the attack while taking into account the personnel safety regulations.

6. The method (100) according to claim 5, It is characterized in that The identifying (102) further comprises the following steps: - providing instructions for executing at least one of the measures via a moderator module (11) of the decision module (8), wherein the moderator module (11) communicates with the attack safety controller (6) and the personnel safety controller (7) in order to provide the instructions taking into account the attack safety regulations and the personnel safety regulations.

7. The method (100) according to any one of the preceding claims, It is characterized in that The execution (103) further comprises the following steps: - monitoring and coordinating the provided instructions by means of a reaction controller (9) of the execution module (13), wherein the reaction controller (9) is connected to at least one actuator (12) in order to execute the measures using the at least one actuator (12).

8. A computer program (20) comprising instructions which, when executed by a computer (10), cause the computer to perform the method (100) according to any one of the preceding claims.

9. A data processing device (10) configured to carry out the method (100) according to any one of claims 1 to 7.

10. A computer-readable storage medium (15) comprising instructions which, when executed by a computer (10), cause the computer to perform the steps of the method (100) according to any one of claims 1 to 7.

Images