Vehicle cabin domain message processing method and device, vehicle and computer program product

Abstract

The invention discloses a vehicle cabin domain message processing method and device, a vehicle and a computer program product, and relates to the technical field of vehicle-mounted network security. The method comprises the following steps: determining a to-be-detected message corresponding to a vehicle cabin domain from a whole vehicle local area network; based on the message type of the to-be-detected message, determining a to-be-adopted message detection mode for the to-be-detected message, and obtaining a detection result; and determining a processing mode of the to-be-detected message according to the detection result, the processing mode including one of releasing the to-be-detected message and discarding the to-be-detected message. According to the invention, the technical problem of poor vehicle cabin domain network security caused by low accuracy of a vehicle message processing scheme provided by a related technology is solved.

Description

Technical Field

[0001] The present application relates to the field of vehicle-mounted network security, and more specifically, to a vehicle cockpit domain message processing method, device, vehicle and computer program product. Background Art

[0002] Currently, the network security of vehicles usually relies solely on border firewalls to manage the security of the vehicle network domain. Border firewalls mainly target attacks from external networks, but cannot effectively control or detect threats from internal networks. For example, if a component inside the vehicle is infected with malware, the border firewall may not be able to prevent the internal threat from spreading to other components.

[0003] With the development of intelligent network technology, smart cockpits are increasingly valued by automobile manufacturers. Smart cockpits integrate functions such as entertainment systems, information display systems, navigation systems, and intelligent human-computer interaction systems. The smart cockpit domain is connected to multiple other in-vehicle network domains, and the communication unit of the smart cockpit domain needs to forward, receive, or retransmit messages. Due to the lack of a security processing solution for smart cockpit domain messages, messages sent, received, or forwarded by the smart cockpit domain may be tampered with by attackers, resulting in the invasion of the entire vehicle network domain, resulting in the privacy of passengers in the vehicle being leaked, and the vehicle cockpit domain network security is poor.

[0004] As can be seen from the above, how to improve the accuracy of vehicle message processing methods and improve vehicle network security has become one of the important technical issues in the relevant technical field. Currently, no effective solution has been proposed for the above problems. Summary of the invention

[0005] The embodiments of the present application provide a vehicle cockpit domain message processing method, device, vehicle and computer program product to at least solve the technical problem that the vehicle cockpit domain network security is poor due to the low accuracy of the vehicle message processing solution provided by the related technology.

[0006] According to one aspect of an embodiment of the present application, a vehicle cockpit domain message processing method is provided, including: determining a message to be detected corresponding to the vehicle cockpit domain from a vehicle local area network; based on the message type of the message to be detected, determining a message detection method to be adopted for the message to be detected, and obtaining a detection result; determining a processing method for the message to be detected according to the detection result, wherein the processing method includes one of the following: releasing the message to be detected and discarding the message to be detected.

[0007] Furthermore, based on the message type of the message to be detected, a message detection method to be adopted for the message to be detected is determined, and the detection results obtained include: in response to the message to be detected being a message to be received in the vehicle cockpit domain, the message to be detected is detected based on the address whitelist corresponding to the vehicle local area network, and the detection result is obtained; in response to the message to be detected being a message to be sent generated within the vehicle cockpit domain, the message to be detected is detected based on the target application installed in the vehicle cockpit domain, and the detection result is obtained; in response to the message to be detected being a message to be forwarded received from the outside by the vehicle cockpit domain, the message to be detected is detected based on the local area network address of other network domains, and the detection result is obtained, wherein the other network domains are some network domains in the vehicle local area network except the vehicle cockpit domain.

[0008] Furthermore, a firewall chain is configured in the kernel space corresponding to the vehicle cockpit domain, and the firewall chain includes a preprocessing unit, an input detection unit, a forwarding processing unit, an output detection unit and a post-processing unit; the user space corresponding to the vehicle cockpit domain includes a target application; the vehicle cockpit domain and other network domains realize message interaction through the Ethernet port, among which other network domains are some network domains in the vehicle local area network except the vehicle cockpit domain.

[0009] Furthermore, determining the messages to be detected corresponding to the vehicle cockpit domain from the vehicle local area network includes: determining the messages sent from other network domains to the vehicle cockpit domain through the Ethernet port as messages to be received; determining the messages sent by the target application with the Ethernet port as the exit network port as messages to be sent; and determining the messages sent from the external device to the forwarding processing unit through the hotspot address in the local area network address as messages to be forwarded.

[0010] Furthermore, the message to be detected is detected based on the address whitelist corresponding to the vehicle local area network, and the detection results include: according to the preset address corresponding to the vehicle local area network, the address whitelist is obtained, wherein the address whitelist is used to determine multiple target addresses corresponding to the receivable messages; in response to the source address of the message to be detected belonging to multiple target addresses, the detection result is to determine that the message to be detected is a receivable message; in response to the source address of the message to be detected not belonging to multiple target addresses, the detection result is to determine that the message to be detected is a message to be discarded.

[0011] Furthermore, based on the target application installed in the vehicle cockpit domain, the message to be detected is detected, and the detection result obtained includes: obtaining the target range of the unique identifier corresponding to the application message of the target application; in response to the message identifier of the message to be detected belonging to the target range, the detection result is to determine that the message to be detected is a message to be discarded.

[0012] Furthermore, based on the target application installed in the vehicle cockpit domain, the message to be detected is detected, and the detection result obtained includes: obtaining the network address of the access object of the message to be detected; in response to the network address belonging to the local area network address, using the message identifier of the message to be detected, adding a discard tag corresponding to the target application to the message to be detected, and the detection result is to determine that the message to be detected is a message to be discarded.

[0013] Furthermore, the message to be detected is detected based on the LAN address, and the detection result obtained includes: obtaining the network address of the access object of the message to be detected; in response to the network address and the LAN address not being successfully matched and the network address belonging to other network domains, the detection result is determining that the message to be detected is a message to be discarded, wherein the LAN address at least includes a hotspot address.

[0014] Further, determining a processing method for the message to be detected according to the detection result includes: in response to the message to be detected being determined as a message to be discarded, determining a processing method to discard the message to be detected.

[0015] According to another aspect of an embodiment of the present application, a vehicle cockpit domain message processing device is also provided, including: a determination module, used to determine the message to be detected corresponding to the vehicle cockpit domain from the vehicle local area network; a detection module, used to determine the message detection method to be adopted for the message to be detected based on the message type of the message to be detected, and obtain a detection result; a processing module, used to determine the processing method of the message to be detected according to the detection result, wherein the processing method includes one of the following: releasing the message to be detected and discarding the message to be detected.

[0016] According to another aspect of an embodiment of the present application, a vehicle is also provided, including an on-board memory and an on-board processor, wherein a computer program is stored in the on-board memory, and the on-board processor is configured to run the computer program to execute any one of the above-mentioned vehicle cockpit domain message processing methods.

[0017] According to another aspect of an embodiment of the present application, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored executable program, wherein when the executable program is running, the device where the storage medium is located is controlled to execute any one of the above-mentioned vehicle cockpit domain message processing methods.

[0018] According to another aspect of an embodiment of the present application, a computer program product is also provided, including a computer program, which, when executed by a processor, implements the vehicle cockpit domain message processing method according to any one of the above items.

[0019] In an embodiment of the present application, a message to be detected corresponding to the vehicle cabin domain is determined from the vehicle local area network; based on the message type of the message to be detected, a message detection method to be adopted for the message to be detected is determined to obtain a detection result; and a processing method for the message to be detected is determined according to the detection result, wherein the processing method includes one of the following: releasing the message to be detected and discarding the message to be detected.

[0020] It is easy to notice that the embodiments of the present application distinguish the message types of the messages to be detected and adopt different message detection methods. In the process of detecting the messages, a more targeted message detection method can be adopted, and the detection results obtained are more accurate. Therefore, by selecting the processing scheme for the messages to be detected according to the detection results, potential malicious messages can be accurately filtered out, while ensuring the smooth transmission of normal messages. The accuracy and security of the vehicle cockpit domain message processing method are higher, and the vehicle cockpit domain network security is higher. From the above, the present application achieves the purpose of flexibly selecting the message detection method according to the message type to detect the messages to be detected and determining the processing method of the messages to be detected according to the detection results, thereby achieving the technical effect of improving the accuracy of the vehicle cockpit domain message processing method and improving the security of the vehicle cockpit domain network, and then solving the technical problem that the vehicle cockpit domain network security is poor due to the low accuracy of the vehicle message processing scheme provided by the relevant technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and the related descriptions of the embodiments are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0022] Figure 1 It is a hardware structure block diagram of an optional computing terminal for implementing a vehicle cockpit domain message processing method according to an embodiment of the present application;

[0023] Figure 2 is a flow chart of a vehicle cockpit domain message processing method according to an embodiment of the present application;

[0024] Figure 3 A schematic diagram of an optional firewall chain architecture according to an embodiment of the present application;

[0025] Figure 4 It is a structural schematic diagram of a vehicle cockpit domain message processing device according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments only include a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] According to an embodiment of the present application, a method embodiment of a vehicle cockpit domain message processing method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.

[0029] First, the operating environment of the above method embodiment is exemplarily described. Figure 1 is a hardware structure block diagram of a computing terminal for implementing a vehicle cockpit domain message processing method according to an optional embodiment of the present application, such as Figure 1 As shown, a computing terminal 10 (for example, a computer terminal, a mobile smart terminal, a vehicle terminal, or a cloud computing virtual terminal, etc.) may include: one or more processors 102, a memory 104 for storing data, and a transmission device 106 for implementing a communication function, wherein each processor 102 may include but is not limited to a processing component such as a microprocessor (Microcontroller Unit, referred to as MCU) or a programmable logic device (Field Programmable Gate Array, referred to as FPGA).

[0030] The computing terminal 10 may further include: a display device 110, an input / output device 108, a Universal Serial Bus (USB) port (the USB port may be used as one of the ports of a computer bus, not shown in the figure), a network interface (not shown in the figure), a power supply (not shown in the figure) and a camera (not shown in the figure). A person skilled in the art may understand that Figure 1 The structure of the computing terminal 10 shown is only for illustration and does not impose a strict limitation on the structure of the computing terminal 10. For example, the computing terminal 10 may also include Figure 1 More or fewer components than those shown in FIG. 1 , or computing terminal 10 may have the same components as those shown in FIG. Figure 1 Different categories of components are shown.

[0031] It should be noted that the one or more processors 102 and / or other data processing circuits in the computing terminal 10 may be embodied in whole or in part as software, hardware, firmware or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the vehicle terminal 10 (or mobile device).

[0032] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the vehicle cockpit domain message processing method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the above-mentioned vehicle cockpit domain message processing method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the vehicle terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0033] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the vehicle terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0034] Under the above operating environment, an embodiment of the present application provides a vehicle cockpit domain message processing method. The vehicle cockpit domain message processing method can be used to provide security for the vehicle network domain of the preset application scenario. The above preset application scenarios may include the following scenarios in the field of household cars: in-vehicle network domain communication scenarios of household cars, vehicle remote service security scenarios of household cars (such as vehicle remote upgrades, vehicle remote diagnosis, etc.), vehicle third-party application security management scenarios of household cars, and vehicle wireless local area network (Wireless Fidelity, referred to as WIFI) hotspot security protection scenarios of household cars. In addition, the above preset application scenarios may also include but are not limited to: network domain communication scenarios of smart driving trucks or unmanned trucks in the field of logistics and transportation, network domain communication scenarios of self-driving agricultural vehicles in the field of agricultural machinery, network domain communication scenarios of drones, and network domain communication scenarios of intelligent robots (such as cleaning robots, service robots, delivery robots, etc.).

[0035] When the above-mentioned preset application scenarios are scenarios in fields other than the field of household cars, those skilled in the art should be able to understand that the vehicle cockpit in the above-mentioned vehicle cockpit domain message processing method is replaced with other objects (such as vehicle power systems, vehicle sensor systems, etc.), and correspondingly, the vehicle cockpit domain is replaced with network domains related to other objects, and the vehicle cockpit domain messages are replaced with messages related to other objects (for example, vehicle cockpit domain messages are replaced with drone power system network domain messages, etc.). On this basis, in the embodiments of this application, the specific implementation methods of the above-mentioned path planning method are exemplified by taking the field of household cars as an example.

[0036] Under the above operating environment, the embodiment of the present application provides the following Figure 2 The vehicle cockpit domain message processing method shown, Figure 2 is a flow chart of a vehicle cockpit domain message processing method according to an embodiment of the present application, such as Figure 2 As shown, the method includes the following implementation steps S201 to S203.

[0037] Step S201, determining the to-be-detected message corresponding to the vehicle cockpit domain from the vehicle local area network.

[0038] The above-mentioned vehicle local area network can be a network established inside the vehicle, and the vehicle local area network can be used for communication between various components in the vehicle (such as the engine control unit, body control module, infotainment system, automatic driving module, etc.). The above-mentioned vehicle cockpit domain can be a local area network related to the passenger-oriented service system inside the vehicle, and the vehicle cockpit domain can include but is not limited to a local area network related to the in-vehicle entertainment system, a local area network related to the information display system, a local area network related to the voice recognition system, etc. The above-mentioned message to be detected can be data information to be transmitted in the local area network, but has not yet been security tested or filtered.

[0039] The specific implementation method of determining the messages to be detected corresponding to the vehicle cockpit domain from the vehicle local area network can be: through the on-board network monitoring system, the data information belonging to the vehicle cockpit local area network in the vehicle local area network is identified, and then the data information to be transmitted in the vehicle cockpit local area network but not yet subjected to security testing is standardized as the messages to be detected.

[0040] It is easy to understand that, due to the large number of messages in a complex vehicle local area network, if all messages are detected, the speed and accuracy of the vehicle cockpit domain message processing method will be reduced. Therefore, in the embodiment of the present application, the to-be-detected messages corresponding to the vehicle cockpit domain are determined from the vehicle local area network, and the to-be-detected messages corresponding to the vehicle cockpit domain can be monitored and analyzed in a targeted manner, thereby improving the speed and accuracy of the vehicle cockpit domain message processing method.

[0041] Step S202: based on the message type of the message to be detected, determine the message detection method to be adopted for the message to be detected, and obtain a detection result.

[0042] The above message types can be divided according to at least one of the following classification conditions: the transmission protocol of the message, the source address of the message, and the target address of the message.

[0043] It should be noted that different types of messages may carry different types of data and information.

[0044] The above-mentioned message detection method can be a variety of message detection methods set in the vehicle cockpit domain message detection system. The message detection method can be used to evaluate the security of the message, including but not limited to checking the source physical (Media Access Control, referred to as MAC) address, Internet Protocol (Internet Protocol, referred to as IP) address, destination address, port number, payload content, etc. of the message. The above-mentioned detection results can be used to evaluate the security of the message to be detected.

[0045] Based on the message type of the message to be detected, the message detection method to be adopted for the message to be detected is determined, and the specific implementation method of obtaining the detection result can be: when a message is marked as a message to be detected by the system, the detection method to be adopted is determined according to the message type of the message, and the vehicle cabin domain message detection system will execute a specific detection procedure according to the detection method to determine whether the message contains potential threat data.

[0046] It is easy to understand that in the embodiments of the present application, based on the message type of the message to be detected, a message detection method for the message is selected to obtain a detection result. Compared with the solution of using only a border firewall to manage vehicle network security, the present application can determine a more targeted message detection method for different types of messages in the vehicle cockpit domain, obtain more accurate detection results, enhance the network security of the vehicle cockpit local area network, thereby improving the security of the entire vehicle local area network and protecting in-vehicle data from potential network attacks.

[0047] Step S203, determining a processing method for the message to be detected according to the detection result, wherein the processing method includes one of the following: releasing the message to be detected, and discarding the message to be detected.

[0048] The specific implementation method of determining the processing method of the message to be detected based on the detection results can be: based on the information in the detection results, the detection results are analyzed and logical judgments are performed according to the detection algorithm corresponding to the detection method to determine the security status of the message, and then according to the security status of the message, a processing method of releasing the message to be detected or discarding the message to be detected is selected.

[0049] It is easy to understand that in the embodiments of the present application, the present application determines the processing method of the message to be detected based on the detection results, and can effectively and automatically and accurately decide to release the message or discard the message based on the detection results, thereby enhancing the security of the vehicle cabin network without affecting the normal vehicle cabin network communication.

[0050] Through the technical solutions provided by the above steps S201 to S203, in the embodiment of the present application, the to-be-detected message corresponding to the vehicle cockpit domain is determined from the vehicle local area network; based on the message type of the to-be-detected message, the message detection method to be adopted for the to-be-detected message is determined to obtain the detection result; the processing method of the to-be-detected message is determined according to the detection result, wherein the processing method includes one of the following: releasing the to-be-detected message and discarding the to-be-detected message. It is easy to notice that in the embodiment of the present application, by distinguishing the message type of the to-be-detected message and adopting different message detection methods, a more targeted message detection method can be adopted in the process of detecting the message, and the detection result obtained is more accurate. Therefore, by selecting the processing scheme of the to-be-detected message according to the detection result, potential malicious messages can be accurately filtered out, while ensuring the smooth transmission of normal messages, the vehicle cockpit domain message processing method has higher accuracy and security, and the vehicle cockpit domain network has better security. Therefore, the purpose of obtaining the detection result by using the message detection method to be adopted corresponding to the message type of the message to be detected and determining the processing method of the message to be detected is achieved, thereby achieving the technical effect of improving the accuracy and safety of the vehicle cockpit domain message processing method and improving the security of the vehicle cockpit domain network, and further solving the technical problem of poor vehicle cockpit domain network security caused by the low accuracy of the vehicle message processing solution provided by the relevant technology.

[0051] As an optional implementation, in the above step S202, based on the message type of the message to be detected, determining the message detection method to be adopted for the message to be detected, and obtaining the detection result, may also include the following execution steps:

[0052] Step S221, in response to the message to be detected being a message to be received in the vehicle cockpit domain, the message to be detected is detected based on the address whitelist corresponding to the vehicle local area network to obtain a detection result;

[0053] Step S222, in response to the message to be detected being a message to be sent generated within the vehicle cockpit domain, detecting the message to be detected based on a target application installed in the vehicle cockpit domain to obtain a detection result;

[0054] Step S223, in response to the message to be detected being a message to be forwarded received from the outside by the vehicle cockpit domain, the message to be detected is detected based on the local area network address of other network domains to obtain a detection result, wherein the other network domains are some network domains in the vehicle local area network except the vehicle cockpit domain.

[0055] The above-mentioned message to be received may be a data packet that is about to enter the vehicle cockpit domain in the vehicle local area network. The message to be received may come from other network domains of the vehicle (such as T-BOX domain, autonomous driving domain, etc.) or from the network interface of the cockpit domain (such as the vehicle Ethernet interface). The above-mentioned address whitelist may be a set address list that is allowed to connect to the vehicle cockpit domain. The address whitelist may be obtained through the vehicle local area network address allocation, and the address whitelist may be stored in the storage hard disk partition corresponding to the vehicle cockpit.

[0056] The specific implementation method of detecting the message based on the address whitelist may be: the cockpit domain message detection system checks the address of the message to be received, and determines whether the address of the message to be received exists in the whitelist.

[0057] The above-mentioned message to be sent may be a data packet generated in the vehicle cockpit domain and to be sent to other network domains of the vehicle or an external network. The message to be sent may be generated by an application installed in the cockpit domain. The above-mentioned target application may be a third-party application. The target application may be determined by the relevant information of the application package (such as the packageInfo field in the application data). The relevant information of the application package may include but is not limited to: package name, version name, version code, signature information, etc. The above-mentioned package name may be used to represent the unique mark of the application. The above-mentioned version name may be used to represent the version label of the application, the above-mentioned version code may be used to represent the version number of the application, and the above-mentioned signature information may be used to represent the digital signature information of the source of the application. The signature information may be used to verify the source of the application.

[0058] The specific implementation method of detecting messages based on target applications may be: the cockpit domain message detection system checks the relevant information of the application package to determine the target application. Further, the cockpit domain message detection system checks the message to be sent according to the target application message identification method to determine whether the message to be sent is generated by the target application. The above-mentioned target application message identification method may include but is not limited to: an identification method through the port number of the message, an identification method through the protocol characteristics of the message, an identification method by analyzing the content of the data packet, and an identification method by training a machine learning model to identify the target application message. The embodiment of the present application does not limit the specific method of the above-mentioned target application message identification.

[0059] The message to be forwarded may be a data packet to be forwarded that enters the cockpit domain through a hotspot address in the local area network address. The hotspot address may be created by a hotspot device in the vehicle cockpit.

[0060] The specific implementation method of detecting messages based on the LAN addresses of other network domains can be: the cockpit domain message detection system checks all messages that enter the cockpit domain through the LAN addresses of other network domains to be forwarded, and determines whether the destination address of the message belongs to the LAN address corresponding to other network domains in the car (for example, a hotspot address). If so, the detection result is determined to be that the message to be detected is a message to be discarded, so as to prevent these messages from being forwarded to other network domains in the car.

[0061] Through the technical solutions provided by the above steps S221 to S223, in the embodiment of the present application, different detection methods are considered for different types of messages. This type-based detection method in the embodiment of the present application can more accurately identify and process different types of vehicle cockpit messages, effectively prevent the intrusion of malicious messages, and ensure the network security of the vehicle cockpit domain. Therefore, the detection results of the vehicle cockpit messages in the present application are more accurate.

[0062] As an optional implementation, in the above-mentioned vehicle cockpit domain message processing method, a firewall chain is configured in the kernel space corresponding to the vehicle cockpit domain, and the firewall chain includes a preprocessing unit, an input detection unit, a forwarding processing unit, an output detection unit and a post-processing unit; the user space corresponding to the vehicle cockpit domain includes a target application; message interaction is achieved between the vehicle cockpit domain and other network domains through the Ethernet port, wherein the other network domains are some network domains in the vehicle local area network except the vehicle cockpit domain.

[0063] The above-mentioned kernel space can be the environment in which the operating system kernel corresponding to the vehicle cockpit domain runs and is managed. The above-mentioned firewall chain can be a collection of a series of rules, and the firewall chain can be used to control the reception, issuance and forwarding of network data packets. The firewall chain can be configured in the kernel space corresponding to the vehicle cockpit domain to achieve security detection and control of vehicle cockpit domain messages. The above-mentioned preprocessing unit can process all data packets that are about to enter the vehicle cockpit domain. The above-mentioned data packets that are about to enter the vehicle cockpit domain may include: data packets transmitted to the vehicle cockpit domain from other vehicle network domains through the Ethernet port, and data packets transmitted to the vehicle cockpit domain through the vehicle cockpit hotspot. The above-mentioned input detection unit can be used to detect data packets whose target address is the cockpit domain. The above-mentioned output detection unit can be used to detect data packets generated inside the cockpit domain and to be issued. The above-mentioned user space can be the environment in which the application runs, and the user space can also include a variety of applications other than the target application.

[0064] In an exemplary application scenario, the firewall chain includes: a link for messages to enter the vehicle cockpit domain, a link for messages to be sent from the vehicle cockpit domain, and a link for message forwarding. Figure 3The figure shows a schematic diagram of a firewall chain architecture determined according to the above method steps provided in an embodiment of the present application. The link for the above message to enter the vehicle cockpit domain includes: a pre-processing unit and an input detection unit. The link for the above message to be sent out from the vehicle cockpit domain includes: an output detection unit and a post-processing unit. The above message forwarding link includes: an input detection unit, a forwarding processing unit, and a post-processing unit. By using this firewall chain architecture, the message type of the message to be detected can be identified, the message detection method can be determined, and the detection result can be obtained.

[0065] The specific implementation method of configuring the firewall chain in the kernel space corresponding to the vehicle cockpit domain may be: in the kernel space of the vehicle cockpit domain, a firewall rule setting tool (e.g., iptables command set) is used to create and customize the firewall chain to achieve security control of messages. The firewall chain may include but is not limited to filtering message rules, detecting message rules, marking message rules, discarding message rules, etc.

[0066] Through the technical solution provided above, in the embodiment of the present application, a multi-level protection system is formed by configuring a firewall chain in the kernel space, which can finely control and manage the message interaction between the vehicle cockpit domain and other network domains, ensure the security of all network communications, prevent illegal access and potential network attacks, and enhance the security of the cockpit domain.

[0067] As an optional implementation, in the above step S201, determining the to-be-detected message corresponding to the vehicle cockpit domain from the vehicle local area network may further include the following execution steps:

[0068] Step S211, determining the message sent from other network domains to the vehicle cockpit domain through the Ethernet port as a message to be received;

[0069] Step S212, determining the message sent by the target application with the Ethernet port as the egress network port as the message to be sent;

[0070] Step S213: determine the message sent by the external device to the forwarding processing unit through the hotspot address in the local area network address as a message to be forwarded.

[0071] The above-mentioned external device can be a mobile device (such as a mobile phone, tablet computer, laptop computer, etc.) connected to the vehicle cabin WIFI hotspot.

[0072] The specific implementation method of determining the message as the message to be received can be: when the message enters the cockpit domain from other network domains through the Ethernet port, the pre-processing unit of the firewall chain will automatically capture these data packets and mark them as messages to be received.

[0073] The specific implementation method of determining a message as a message to be sent can be: when an application in the cockpit domain (such as a target application) generates network data packets and prepares to send them through the Ethernet port, the output detection unit of the firewall chain will automatically capture these data packets and mark them as messages to be sent.

[0074] The specific implementation method of determining a message as a message to be forwarded can be: when an external device sends data packets to the forwarding processing unit of the firewall chain through the WIFI hotspot service in the local area network, the forwarding processing unit of the firewall chain will automatically capture these data packets and mark them as messages to be forwarded.

[0075] Through the technical solutions provided by the above steps S211 to S213, in the embodiment of the present application, by utilizing the firewall chain, different types of data packets can be effectively identified and classified to ensure that all messages entering, leaving and forwarded within the cockpit domain will undergo security detection, which can effectively identify potential network attacks and improve the security of the entire vehicle network domain.

[0076] As an optional implementation, in the above step S221, the message to be detected is detected based on the address whitelist corresponding to the vehicle local area network to obtain the detection result, and the following execution steps may also be included:

[0077] Step S2211, obtaining an address whitelist according to a preset address corresponding to the vehicle local area network, wherein the address whitelist is used to determine a plurality of target addresses corresponding to which messages can be received;

[0078] Step S2212, in response to the source address of the message to be detected belonging to multiple target addresses, the detection result is to determine that the message to be detected is a receivable message;

[0079] Step S2213: In response to the source address of the message to be detected not belonging to multiple target addresses, the detection result is to determine that the message to be detected is a message to be discarded.

[0080] The above-mentioned preset address can be a fixed address assigned by the vehicle local area network to each network domain in the vehicle, and the preset address can be used to identify and verify the source of the data packet.

[0081] The specific implementation method of obtaining the address whitelist according to the preset address corresponding to the vehicle local area network and detecting the source address of the message to be detected to determine the detection result can be: according to the address allocation result of the vehicle network domain, create an address whitelist that can enter the vehicle cockpit domain. When a message enters the cockpit domain from other network domains through the Ethernet port, the vehicle cockpit domain detection system checks its source address to determine whether the source address of the message belongs to multiple target addresses in the address whitelist. If the source address of the message belongs to multiple target addresses, the detection result shows that the message is a receivable message; if the source address of the message does not belong to multiple target addresses, the detection result shows that the message is a message to be discarded.

[0082] In an exemplary application scenario, the above-mentioned message to be detected is a message to be received. The MAC address and IP address of the vehicle local area network are set as fixed addresses to obtain an address whitelist, and the interception rules for the message to be received are set according to the address whitelist. The interception rules for the message to be received may include multiple interception rules, and the specific implementation method of the interception rules for the message to be received may be: when a message enters the cockpit domain through the Ethernet port, check the source MAC address and source IP address of the message, and determine whether the source MAC address and source IP address of the message belong to the address whitelist. If the source MAC address and source IP address of the message belong to the address whitelist, determine that the message is an acceptable message and release the message; if the source MAC address and source IP address of the message do not belong to the address whitelist, discard the message.

[0083] It should be noted that the above-mentioned rules for intercepting messages to be received can be implemented through the following three codes:

[0084] Code 1: iptables-A INPUT-s xx.xx.xx.xx-m mac--mac-source xx:xx:xx:xx:xx:xx-i eth0-j ACCEPT;

[0085] Code 2: iptables-A INPUT-i eth0-m state--state RELATED,ESTABLISHED-jACCEPT;

[0086] Code three: iptables -A INPUT -i eth0 -j DROP.

[0087] In the above code 1, "xx.xx.xx.xx" represents the source IP address of the message; "xx:xx:xx:xx:xx:xx:xx" represents the source MAC address of the message.

[0088] Through the technical solutions provided by the above steps S2211 to S2213, in the embodiment of the present application, the address whitelist is used to efficiently and accurately identify data packets entering the cockpit domain, ensuring that only messages belonging to the address whitelist can be received and processed, which can effectively prevent the vehicle cockpit domain from being illegally accessed or attacked.

[0089] As an optional implementation, in the above step S222, the target application installed in the vehicle cockpit domain detects the message to be detected to obtain the detection result, which may also include the following execution steps:

[0090] Step S2221, obtaining a target range of a unique identifier corresponding to an application message of a target application;

[0091] Step S2222: In response to the message identifier of the message to be detected belonging to the target range, the detection result is that the message to be detected is determined to be a message to be discarded.

[0092] The above application message may be a data packet generated by the target application, which may include application requests, data updates, user interaction information, etc. The above unique identifier is used to distinguish and manage resource access rights of different applications. The above target range may be a user identification (UID) range corresponding to the set application message.

[0093] The specific implementation method of obtaining the target range, detecting the message identifier of the message to be detected, and determining the detection result can be: obtaining the target range set in the vehicle cockpit domain message detection system, when a message generated by an application in the cockpit domain is ready to be sent through the Ethernet port, the vehicle cockpit domain message detection system will automatically capture and check the message identifier of the message, if the message identifier of the message belongs to the target range, it is determined that the message is a message to be discarded.

[0094] In an exemplary application scenario, the above-mentioned message to be detected is a message to be sent. Obtain the UID range (such as 18000-20000) corresponding to the application message of the target application, set the UID range as the target range, and set the interception rule of the message to be sent. The interception rule of the message to be sent may include multiple interception rules, and the specific implementation method of the interception rule of the message to be sent may be: when a message generated by an application in the cockpit domain is ready to be sent through the Ethernet port, jump to the first data packet rule chain for preliminary filtering of the message, and determine whether the target network address of the message belongs to the local area network address. If it is determined that the target network address of the message belongs to the local area network address, jump from the first data packet rule chain to the second data packet rule chain, obtain the message identifier of the message, check the UID range of the message, and determine whether the UID range of the message belongs to the target range. If the UID range of the message belongs to the target range, determine that the message is a message to be discarded.

[0095] It should be noted that the above-mentioned rules for intercepting outgoing messages can be implemented through the following four codes:

[0096] Code 4: iptables-t filter-A bw_OUTPUT-d xx.xx.xx.xx / xx-o eth0-jchain1;

[0097] Code 5: iptable -t filter -A chain1 -j bw_lanpenalty;

[0098] Code six: iptables-t filter-A bw_lanpenalty-m owner--uid-owner 18000-20000-j REJECT--reject-with icmp-port-unreachable;

[0099] Code seven: iptables -t filter -A bw_lanpenalty -j return.

[0100] In the above code 4, "xx.xx.xx.xx / xx" represents all vehicle LAN IP addresses.

[0101] Through the technical solutions provided by the above steps S2221 to S2222, in the embodiment of the present application, the UID range of the target application can be utilized to effectively control the network access rights of third-party applications, ensure the security and stability of the vehicle network, and at the same time allow these applications to access the Internet normally to meet the daily usage needs of users.

[0102] As an optional implementation, in the above step S222, the target application installed in the vehicle cockpit domain detects the message to be detected to obtain the detection result, which may also include the following execution steps:

[0103] Step S2223, obtaining the network address of the access object of the message to be detected;

[0104] Step S2224, in response to the network address belonging to the local area network address, using the message identifier of the message to be detected, adding a discard label corresponding to the target application to the message to be detected, and the detection result is to determine that the message to be detected is a message to be discarded.

[0105] The network address of the access object mentioned above may be the address of the network resource that the message attempts to access, and the network address of the access object may include but is not limited to the address of the vehicle power control domain, the address of the automatic driving domain, etc.

[0106] The specific implementation method of using the message identifier of the message to be detected, adding a discard label corresponding to the target application to the message to be detected, and the detection result is to determine that the message to be detected is a message to be discarded can be: after confirming that the target address of the message to be detected belongs to other network domains, the system will check the message identifier (i.e., UID) of the message. If the message identifier of the message corresponds to the target application, a discard label is added to the message, and a detection result is obtained to determine that the message to be detected is a message to be discarded.

[0107] In an exemplary application scenario, the message to be detected is a message to be sent. Set a message to be sent interception rule. The message to be sent interception rule may include multiple interception rules, and the specific implementation method of the message to be sent interception rule may be: if the network address of the message belongs to a local area network address, according to the message identifier of the message, add a discard label to the message, and discard the message according to the discard label.

[0108] In another exemplary application scenario, the above-mentioned message interception rule to be sent can be implemented by the following two codes:

[0109] Code 8: iptables-t filter-A OUTPUT-d xx.xx.xx.xx-o eth0-m owner--uid-owner xxx-j MARK--set-xmark 2000;

[0110] Code nine: iptables -t filter -A OUTPUT -o eth0 -d xx.xx.xx.xx -m mark --mark2000 -j DROP.

[0111] In the above code 8, "xx.xx.xx.xx" represents the vehicle LAN IP address, and "xxx" represents the UID value of the message. In the above code 9, "xx.xx.xx.xx" represents the vehicle LAN IP address.

[0112] It should be noted that, through the above code eight, the label "2000" can be added to the message whose message identifier belongs to the UID range of the target application and the target address belongs to the LAN address; through the above code nine, the message whose label is "2000" and the target address belongs to the LAN address can be discarded.

[0113] Through the technical solutions provided by the above steps S2223 to S2224, in the embodiment of the present application, by utilizing the message identifier of the message to be detected, the network access rights of the target applications in the cockpit domain can be effectively controlled and restricted, ensuring that they can only communicate with the Internet and cannot access other local area network systems in the vehicle, thereby improving the security of the entire vehicle network domain.

[0114] As an optional implementation, in the above step S223, the message to be detected is detected based on the local area network address to obtain the detection result, and the following execution steps may also be included:

[0115] Step S2231, obtaining the network address of the access object of the message to be detected;

[0116] Step S2232, in response to the network address and the LAN address not being successfully matched and the network address belonging to other network domains, the detection result is determining that the message to be detected is a message to be discarded, wherein the LAN address at least includes a hotspot address.

[0117] The specific implementation method of obtaining the network address of the access object of the message to be detected, checking the network address information, and determining the detection result can be: when an external device attempts to send a message through the WIFI hotspot service in the cockpit domain, the vehicle cockpit detection system will analyze the network address information of the message, determine whether the network address of the message matches the preset hotspot address and whether the network address of the message belongs to other network domains. If the network address of the message does not successfully match the hotspot address and the network address belongs to other network domains, the message is determined to be a message to be discarded.

[0118] In an exemplary application scenario, the above-mentioned message to be detected is a message to be forwarded. Obtain the hotspot address of the vehicle cockpit domain (such as 192.168.1.1), and set the message to be forwarded interception rule. The message to be forwarded interception rule may include multiple interception rules, and the specific implementation method of the message to be forwarded interception rule may be: in the input detection unit of the vehicle cockpit domain firewall chain, set an interception rule that only allows messages matching the hotspot network address to enter the vehicle cockpit domain, and in the forwarding processing unit of the vehicle cockpit domain firewall chain, set an interception rule that denies the message to be forwarded whose network address belongs to other network domains from entering other network domains.

[0119] It should be noted that the above-mentioned rules for intercepting messages to be forwarded can be implemented by the following two codes:

[0120] Code 10: iptables -t filter -A fw_INPUT! -d 192.168.1.1 -i wlan0 -j REJECT;

[0121] Code 11: iptables -t filter -A FORWARD -i wlan1 -d xx.xx.xx.xx / xx -jREJECT.

[0122] In the above code 11, "xx.xx.xx.xx / xx" represents all vehicle LAN IP addresses.

[0123] Through the technical solution provided by the above steps S2231 to S2232, in the embodiment of the present application, the network address and the hotspot address are utilized to effectively control the forwarded messages entering the cockpit domain through the WIFI hotspot, thereby ensuring the communication security between the cockpit domain and external devices, preventing the intrusion of illegal devices, and enhancing the security of the entire vehicle network domain.

[0124] As an optional implementation, in the above step S203, determining the processing method of the message to be detected according to the detection result may also include the following execution steps:

[0125] Step S2031: In response to the message to be detected being determined as a message to be discarded, a processing method is determined to discard the message to be detected.

[0126] It should be noted that if the message to be detected is not determined as a message to be discarded, the processing method is determined to release the message to be detected.

[0127] In response to the message to be detected being determined as a message to be discarded, the specific implementation method of determining the processing method as discarding the message to be detected can be: the message to be detected fails to pass the security check of the vehicle cockpit message detection system, the vehicle cockpit message detection system marks the message to be detected as a message to be discarded, determines to discard the message, does not forward the message to its target network, and does not allow the message to enter the vehicle network domain.

[0128] Through the above step S2031, the embodiment of the present application can timely and effectively prevent the spread of illegal messages, thereby improving the security of the vehicle network.

[0129] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0130] It should be noted that, for the above method embodiments, for the sake of simplicity, the technical solutions in the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of actions in the described action combinations, because according to the present application, some of the above steps can be performed in other orders or simultaneously. In addition, those skilled in the art should also be aware that the embodiments described in the specification of this application belong to preferred embodiments, and the actions and modules involved are not necessarily necessary to implement the technical solutions of the present application.

[0131] According to an embodiment of the present invention, a device embodiment of a vehicle cockpit domain message processing device is also provided, and the vehicle cockpit domain message processing device is used to implement the above method embodiment and various optional implementation methods of the method embodiment, and the technical content that has been described in the previous text is no longer repeated in the device embodiment. It should be noted that in the following related descriptions of the device embodiment, a "module" can be software, hardware, or a combination of software and hardware for implementing a specified function.

[0132] Figure 4 is a structural diagram of a vehicle cockpit domain message processing device according to an embodiment of the present application, such as Figure 4 As shown, the vehicle cockpit domain message processing device includes:

[0133] A determination module 401 is used to determine the message to be detected corresponding to the vehicle cockpit domain from the vehicle local area network;

[0134] The detection module 402 is used to determine the message detection method to be adopted for the message to be detected based on the message type of the message to be detected, and obtain a detection result;

[0135] The processing module 403 is used to determine a processing method for the message to be detected according to the detection result, wherein the processing method includes one of the following: releasing the message to be detected, and discarding the message to be detected.

[0136] Optionally, the above-mentioned detection module 402 is also used for: in response to the message to be detected being a message to be received in the vehicle cockpit domain, detecting the message to be detected based on the address whitelist corresponding to the vehicle local area network to obtain a detection result; in response to the message to be detected being a message to be sent generated inside the vehicle cockpit domain, detecting the message to be detected based on the target application installed in the vehicle cockpit domain to obtain a detection result; in response to the message to be detected being a message to be forwarded received from the outside by the vehicle cockpit domain, detecting the message to be detected based on the hotspot address of the vehicle cockpit domain to obtain a detection result.

[0137] Optionally, in the above-mentioned vehicle cockpit domain message processing device, a firewall chain is configured in the kernel space corresponding to the vehicle cockpit domain, and the firewall chain includes a preprocessing unit, an input detection unit, a forwarding processing unit, an output detection unit and a post-processing unit; the user space corresponding to the vehicle cockpit domain includes a target application; message interaction is achieved between the vehicle cockpit domain and other network domains through the Ethernet port, wherein other network domains are some network domains in the vehicle local area network except the vehicle cockpit domain.

[0138] Optionally, the above-mentioned determination module 401 is also used to: determine the messages sent from other network domains to the vehicle cabin domain through the Ethernet port as messages to be received; determine the messages sent by the target application with the Ethernet port as the exit network port as messages to be sent; and determine the messages sent from the external device to the forwarding processing unit through the hotspot address as messages to be forwarded.

[0139] Optionally, the above-mentioned detection module 402 is also used to: obtain an address whitelist according to a preset address corresponding to the vehicle local area network, wherein the address whitelist is used to determine multiple target addresses corresponding to receivable messages; in response to the source address of the message to be detected belonging to multiple target addresses, the detection result is to determine that the message to be detected is a receivable message; in response to the source address of the message to be detected not belonging to multiple target addresses, the detection result is to determine that the message to be detected is a message to be discarded.

[0140] Optionally, the detection module 402 is further used to: obtain a target range of unique identifiers corresponding to application messages of the target application; in response to the message identifier of the message to be detected belonging to the target range, the detection result is to determine that the message to be detected is a message to be discarded.

[0141] Optionally, the above-mentioned detection module 402 is also used to: obtain the network address of the access object of the message to be detected; in response to the network address belonging to other network domains, use the message identifier of the message to be detected and, add a discard label corresponding to the target application to the message to be detected, and determine the detection result to determine that the message to be detected is a message to be discarded.

[0142] Optionally, the detection module 402 is further used to: obtain the network address of the access object of the message to be detected; in response to the network address not being successfully matched with the hotspot address and the network address belonging to other network domains, the detection result is to determine that the message to be detected is a message to be discarded.

[0143] Optionally, the processing module 403 is further configured to: in response to the message to be detected being determined as a message to be discarded, determine a processing method of discarding the message to be detected.

[0144] It should be noted that the above-mentioned determination module 401, detection module 402 and processing module 403 correspond to steps S201 to S203 in the method embodiment. The three modules have the same instances and application scenarios as the corresponding steps, but are not limited to the contents disclosed in the above-mentioned method embodiment.

[0145] It should be noted that the various modules mentioned in the above device embodiments can be implemented by software, hardware, or a combination of software and hardware. For example, when hardware is used to implement the above modules, the various modules can be set in the same processor, or the various modules can be set in different processors in any combination. For another example, the above modules can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the above modules can also be run as part of the device on a processor such as Figure 1 In the computing terminal 10 shown.

[0146] Through the device technical solutions corresponding to the above-mentioned determination module, detection module and processing module, the embodiment of the present application determines the message to be detected corresponding to the vehicle cabin domain from the vehicle local area network through the determination module; determines the message detection method to be adopted for the message to be detected based on the message type of the message to be detected through the detection module, and obtains the detection result; adopts the processing module to determine the processing method of the message to be detected according to the detection result, wherein the processing method includes one of the following: releasing the message to be detected and discarding the message to be detected.

[0147] It is easy to notice that in the above-mentioned vehicle cockpit domain message processing device provided by the embodiment of the present application, by distinguishing the message type of the message to be detected and adopting different message detection methods, it is possible to adopt a more targeted message detection method in the process of detecting the message, and the obtained detection result is more accurate. Therefore, by selecting the processing scheme of the message to be detected according to the detection result, it is possible to accurately filter out potential malicious messages, while ensuring the smooth transmission of normal messages, and the vehicle cockpit domain message processing method has higher accuracy and security, and the vehicle cockpit domain network security is better. Therefore, the purpose of obtaining the detection result by the message detection method to be adopted corresponding to the message type of the message to be detected and determining the processing method of the message to be detected is achieved, thereby achieving the technical effect of improving the accuracy and security of the vehicle cockpit domain message processing method and improving the security of the vehicle cockpit domain network, and then solving the technical problem that the vehicle cockpit domain network security is poor due to the low accuracy of the vehicle message processing scheme provided by the relevant technology.

[0148] According to an embodiment of the present invention, an embodiment of a vehicle is also provided, which includes an on-board memory and an on-board processor, wherein a computer program is stored in the on-board memory, and the on-board processor is configured to run the computer program to implement the above-mentioned vehicle cabin domain message processing method.

[0149] According to an embodiment of the present invention, a computer program product is also provided. The computer program product includes a computer program, and when the computer program is executed by a processor, the vehicle cockpit domain message processing method described above can be implemented.

[0150] Optionally, the above-mentioned computer program product can provide vehicle cockpit domain message processing services based on the above-mentioned vehicle cockpit domain message processing method.

[0151] Optionally, in this embodiment, the computer program product may be a set of instructions and codes pre-written according to the vehicle cockpit domain message processing method. The computer program product may run on various computer platforms, including personal computers, servers, mobile devices, etc.

[0152] Optionally, in this embodiment, the instructions and codes corresponding to the computer program product are used to implement the following method steps: determining the message to be detected corresponding to the vehicle cabin domain from the vehicle local area network; based on the message type of the message to be detected, determining the message detection method to be adopted for the message to be detected, and obtaining the detection result; determining the processing method of the message to be detected according to the detection result, wherein the processing method includes one of the following: releasing the message to be detected and discarding the message to be detected.

[0153] In the above-mentioned multiple embodiments of the present application, the description of each embodiment has different emphases. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0154] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of multiple modules can be a logical function division, and there can be any other possible division methods when actually implemented in the application scenario; for another example, multiple modules (or units or components in the modules) can be combined with each other and can be integrated into another system. For example, some features of the method embodiments described above can be ignored or skipped.

[0155] It should be noted that in the above-mentioned embodiments, the modules, components or units described as separate parts can be physically separated or physically integrated. The parts displayed as modules or units can be physical modules or physical units, or virtual modules or virtual units, that is, multiple modules or multiple units can be in the same position, or distributed in multiple positions or multiple spaces. In the application scenario, according to the actual needs of the scenario, some or all of the multiple modules or multiple units can be selected to implement the technical solutions of the embodiments of the present application, thereby achieving the corresponding technical objectives.

[0156] In particular, for an integrated functional module or functional unit, if it is implemented in the form of a software functional unit and sold or used as an independent product, the module or functional unit can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application.

[0157] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A vehicle cockpit domain message processing method, characterized in that: include: Determine the message to be detected corresponding to the vehicle cockpit domain from the vehicle local area network; Based on the message type of the message to be detected, determine the message detection method to be adopted for the message to be detected, and obtain a detection result; A processing method for the message to be detected is determined according to the detection result, wherein the processing method includes one of the following: releasing the message to be detected, and discarding the message to be detected.

2. The vehicle cockpit domain message processing method according to claim 1, characterized in that: Determining the message detection method to be adopted for the message to be detected based on the message type of the message to be detected, and obtaining the detection result includes: In response to the message to be detected being a message to be received in the vehicle cockpit domain, detecting the message to be detected based on the address whitelist corresponding to the vehicle local area network to obtain the detection result; In response to the message to be detected being a message to be sent generated within the vehicle cockpit domain, detecting the message to be detected based on a target application installed in the vehicle cockpit domain to obtain the detection result; In response to the fact that the message to be detected is a message to be forwarded received from the outside by the vehicle cockpit domain, the message to be detected is detected based on the local area network address of other network domains to obtain the detection result, wherein the other network domains are some network domains in the whole vehicle local area network except the vehicle cockpit domain.

3. The vehicle cockpit domain message processing method according to claim 2, characterized in that: A firewall chain is configured in the kernel space corresponding to the vehicle cockpit domain, and the firewall chain includes a preprocessing unit, an input detection unit, a forwarding processing unit, an output detection unit and a post-processing unit; the user space corresponding to the vehicle cockpit domain includes the target application; and message interaction is achieved between the vehicle cockpit domain and the other network domains through an Ethernet port.

4. The vehicle cockpit domain message processing method according to claim 3, characterized in that: Determining the message to be detected corresponding to the vehicle cockpit domain from the vehicle local area network includes: Determine the message sent by the other network domain to the vehicle cockpit domain through the Ethernet port as the to-be-received message; Determine the message sent by the target application with the Ethernet port as the egress network port as the message to be sent; A message sent by an external device to the forwarding processing unit through a hotspot address in the local area network address is determined as the message to be forwarded.

5. The vehicle cockpit domain message processing method according to any one of claims 2 to 4, characterized in that: The message to be detected is detected based on the address whitelist corresponding to the vehicle local area network, and the detection result obtained includes: According to the preset address corresponding to the vehicle local area network, the address whitelist is obtained, wherein the address whitelist is used to determine multiple target addresses corresponding to the receivable message; In response to the source address of the message to be detected belonging to the multiple target addresses, the detection result is determining that the message to be detected is a receivable message; In response to the source address of the message to be detected not belonging to the multiple target addresses, the detection result is determining that the message to be detected is a message to be discarded.

6. The vehicle cockpit domain message processing method according to any one of claims 2 to 4, characterized in that: The message to be detected is detected based on the target application installed in the vehicle cockpit domain, and the detection result obtained includes: Obtain a target range of a unique identifier corresponding to an application message of the target application; In response to the message identifier of the message to be detected belonging to the target range, the detection result is determining that the message to be detected is a message to be discarded.

7. The vehicle cockpit domain message processing method according to any one of claims 2 to 4, characterized in that: The message to be detected is detected based on the target application installed in the vehicle cockpit domain, and the detection result obtained includes: Obtaining the network address of the access object of the message to be detected; In response to the network address belonging to the local area network address, a discard label corresponding to the target application is added to the message to be detected using a message identifier of the message to be detected, and the detection result is determining that the message to be detected is a message to be discarded.

8. The vehicle cockpit domain message processing method according to any one of claims 2 to 4, characterized in that: The message to be detected is detected based on the local area network address, and the detection result obtained includes: Obtaining the network address of the access object of the message to be detected; In response to the network address and the local area network address not being successfully matched, the detection result is determining that the message to be detected is a message to be discarded, wherein the local area network address at least includes a hotspot address.

9. The vehicle cockpit domain message processing method according to claim 1, characterized in that: Determining the processing method of the message to be detected according to the detection result includes: In response to the message to be detected being determined as a message to be discarded, the processing manner is determined to be discarding the message to be detected.

10. A vehicle cockpit domain message processing device, characterized in that: include: A determination module, used to determine the message to be detected corresponding to the vehicle cockpit domain from the vehicle local area network; A detection module, used to determine a message detection method to be adopted for the message to be detected based on the message type of the message to be detected, and obtain a detection result; A processing module is used to determine a processing method for the message to be detected according to the detection result, wherein the processing method includes one of the following: releasing the message to be detected, and discarding the message to be detected.

11. A vehicle, characterized in that: It includes an on-board memory and an on-board processor, wherein the on-board memory stores a computer program, and the on-board processor is configured to run the computer program to execute the vehicle cockpit domain message processing method as described in any one of claims 1 to 9.

12. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the vehicle cockpit domain message processing method according to any one of claims 1 to 9.

Images