Network system and vehicle

Abstract

The invention relates to a network system (1) comprising at least two network devices (2) and at least one communication device (3) for each network device (2), each network device (2) having at least two network ports (4.1, 4.2), the at least one communication device (3) being connected to a first network port (4.1) of the respective network device (2) for each network device (2), and the at least one communication device (3) being connected to a second network port (4.2) of the respective network device (2) for each network device (2). At least one network device (2) is connected to a first network port (4.1) of the respective network device (2) and at least one further network device (2) is connected to a second network port (4.2) of the respective network device (2), and wherein each network device (2) has an integrated firewall function for filtering data packets to be transmitted through the network ports (4.1, 4.2). The network system according to the invention is characterized in that a respective network device (2) is arranged to filter data packets received from a communication device (3) connected to the respective network device (2) and to forward data packets received from other network devices (2) to a target address without filtering.

Description

Technical Field

[0001] The present invention relates to a network system of the type defined in more detail in the preamble of claim 1, and a vehicle including such a network system. Background Technology

[0002] The number of electronic components in vehicles is steadily increasing, particularly due to improved performance and miniaturization. In this context, the computing units installed in vehicles can vary in complexity. For example, a microcontroller can output control signals to actuators or read and process sensor variables. Microcontrollers are often referred to as systems-on-a-chip (SoCs). However, for more complex tasks, especially those related to autonomous or even self-driving vehicles, it is necessary to integrate powerful hardware into the vehicle. The tasks of multiple control devices can also be taken over by a central onboard computer.

[0003] In this scenario, the vehicle's electronic components can rely on data exchange with each other. To this end, the electronic components are interconnected communicatively via corresponding data lines. These data lines can be based on various technologies and communication protocols. Most communication is conducted through dedicated bus systems, such as CAN bus or Ethernet.

[0004] Information technology systems are always at risk of being compromised. Therefore, appropriate security measures must be taken to protect them from attacks. Known and proven security measures for vehicles can be used for this purpose, such as firewalls, attack detection and defense systems, and cryptographic encryption techniques.

[0005] To establish an Ethernet network, interconnected computing units are linked together through network devices. Various types of network devices exist, such as repeaters / hubs, switches, and routers. Repeaters / hubs distribute data packets to all network ports, while switches inspect data packets, determine the destination address specified in the packet, and forward the appropriate packet only through the network port to which the actual destination device is connected.

[0006] It is known that firewalls are integrated into switches. The firewall filters data packets that constitute network traffic according to predefined rules. This filtering increases latency during data forwarding. Network systems can be arbitrarily complex. In particular, if data packets must be forwarded one after another through multiple switches to reach their destination devices, each switch checks the corresponding data packets again, which further increases latency, but is also unnecessary.

[0007] WO 2018 / 217143 A1 discloses a method for selecting a forwarding table for a rule-based routing system, which can be performed by a network device. The solution described in the document results in a significant acceleration of the forwarding table selection. Summary of the Invention

[0008] The purpose of this invention is to provide an improved network system that works more efficiently.

[0009] According to the invention, this objective is achieved by a network system having the features of claim 1. Advantageous designs and improvements are given in the dependent claims.

[0010] A general-purpose network system includes at least two network devices and at least one communication device for each network device, wherein each network device has at least two network ports, wherein for each network device, at least one communication device is connected to a first network port of the corresponding network device, and at least one other network device is connected to a second network port of the corresponding network device, and wherein each network device has an integrated firewall function for filtering data packets to be transmitted through the network ports. An improvement according to the invention is that the corresponding network device is configured to filter data packets received from the communication device connected to the corresponding network device and forward data packets received from other network devices to a destination address without filtering.

[0011] The efficiency of the network system according to the invention is thus improved because individual network devices no longer apply firewall functionality to data transmissions to be forwarded. Therefore, data packets output from communication devices to the destination address are now filtered by only a single network device using firewall functionality, instead of by all network devices. Since filtering data packets requires the hardware resources of the respective network devices, the overall computational workload can be reduced. The corresponding hardware resources of the network devices can then be used for further tasks. Therefore, latency when forwarding data packets via the network system according to the invention can also be reduced.

[0012] The core of this invention is to perform firewall-based packet filtering only in network devices within a network system. Typically, packet filtering can also be performed in network devices upstream of the communication device indicated by the destination address. However, this increases the amount of packet conversion / turnaround time exchanged through the network system according to the invention, resulting in insufficient efficiency gains or insufficient latency reductions. Therefore, it is advantageous to filter packets output by the communication device from the network device connected to the communication network. Consequently, corresponding packets in the communication line are filtered particularly early, thus reducing the total amount of data exchanged in the network system if individual packets are discarded.

[0013] A network port can also be called an input port, an output port, or simply a "port".

[0014] Network devices in a network system can have the same or different numbers of network ports. On the same network device, different network ports may provide different data rates. Specifically, network devices communicate with each other through network ports that allow for particularly high data rates.

[0015] A data packet is also called a frame. In this context, a data packet or frame consists of different parts. The first part may contain the destination address of the communication device. The second part may contain the source address of the communication device that sent the data packet. The third part may define the data (packet) type, also known as the type field. The fourth part may contain the valid data. The fifth part may contain a checksum, which allows the network device to check whether the data packet was transmitted correctly or incorrectly.

[0016] The corresponding network device reads further packets to be forwarded and extracts information described by the relevant sections. Firewall rules for filtering these packets are applied to this information. Thus, for example, only packets directed to a specific destination address, originating from a specific source address (i.e., the communication device), and corresponding to a specific data type can be forwarded through the network.

[0017] Accordingly, methods for performing method steps that can be executed by components of the network system according to the present invention are also part of the present invention.

[0018] In this configuration, the network device is preferably configured as an Ethernet switch. These are particularly mature, reliable, and widely used network devices, making the network system according to the invention simple and economical to implement. The switch has Ethernet sockets or Ethernet ports as network ports. Communication devices are connected to the switch accordingly via Ethernet cables. The topology of the network system according to the invention can be arbitrary and can be implemented, for example, as: ring, mesh, star, fully connected, linear, tree, bus, etc.

[0019] At a minimum, every communication device has a unique identifier. This identifier defines the address of the corresponding device within the network system. When an Ethernet switch is used as a network device, this identifier is specifically a MAC address. Depending on which layer (also called layer 1) of the OSI model the switch operates at, the switch itself may also have a MAC address.

[0020] The working principle of switches that forward packets based on the so-called source address table (SAT) (also known as routing) is well known to those skilled in the art.

[0021] According to another advantageous design of the network system according to the invention, the corresponding network device is configured to read a configuration file and apply it to configure firewall functions, wherein the configuration file includes at least one unique identifier of a communication device connected to the corresponding network device. By means of the unique identifier, particularly the MAC address as described above, the corresponding communication device in the network system according to the invention can be uniquely referenced. Therefore, it can be conveyed to the network device which communication devices connected to the network device are typically authorized to send data packets. For example, if an attacker connects another communication device to the network device in the network system according to the invention, the network device filters any data packets sent by that communication device because the unique identifier of the communication device used by the attacker cannot be found in the configuration file. This reliably prevents the transmission of compromised data through the network system according to the invention.

[0022] Furthermore, the configuration file can also include unique identifiers of other network devices connected to the network device. Therefore, the network device can be explicitly informed which other network devices it should not filter packets received from. In this way, a so-called whitelist, also known as a positive list, can be derived.

[0023] In its simplest form, the network system according to the invention can be implemented by the firewall function of the corresponding network device, which typically does not perform filtering. Therefore, a so-called blacklist or negative list can be defined through a configuration file, indicating which communication device's data packets should be filtered. According to an embodiment of the network system according to the invention, there is a risk that some communication devices are generally more vulnerable to intrusion, while others are difficult or not vulnerable at all. Therefore, the corresponding network device is instructed to filter data packets sent from which communication devices. This logic can also be executed adaptively, such that when a new communication device connects to the network device, the unique identifier of the newly connected communication device is automatically added to the corresponding negative list.

[0024] In its simplest case, the entire network topology is transmitted equally to all network devices in the network system according to the invention. Therefore, the corresponding configuration file describes which communication devices, explicitly referenced by MAC addresses, are connected to which network device, and which network devices are themselves connected to each other. The firewall integrated into the network devices then filters only those packets originating from communication devices connected to their respective network devices.

[0025] The storage size of the corresponding configuration files is correspondingly large. Since it is not necessary to inform the network devices which other communication devices are connected to other network devices, an advantageous improvement to the network system according to the invention further proposes that the firewall functions of at least two network devices are configured by their respective separate network device-specific configuration files. Therefore, different configuration files tailored to each network device can be implemented for different network devices. In other words, each network device is only informed which communication devices are connected to it, specifically through which network interface or port. Thus, each network device can quickly and easily identify which data packets sent by which communication devices need to be filtered and which do not.

[0026] According to another advantageous design of the network system according to the invention, at least one communication device has a mobile communication port and is configured to receive configuration files via mobile communication. The corresponding communication device may also be referred to as a telecommunications unit or a telematics unit. Such a telematics unit may have one or more mobile communication ports. Updates, also known as updates, can then be received through this telematics unit. In the automotive field, wirelessly transmitted updates are also called over-the-air (OTA) updates. If the network system according to the invention is modified, the corresponding network devices or the firewall functions included in the network devices can be reconfigured and adapted to the changed network design. Accordingly, misconfigured network devices can also be corrected. Therefore, the administrator can define new rules for filtering network traffic, thereby adapting the network system according to the invention to changing needs. Then, there is no need to go to the workshop to adjust the firewall configuration.

[0027] The vehicle according to the present invention has the network system described above. The vehicle can be any type of vehicle, such as a car, truck, van, bus, etc. Generally, the vehicle can also be a rail vehicle, ship, or aircraft.

[0028] In this configuration, at least one communication device preferably comprises a microcontroller, microprocessor, vehicle control equipment, actuator, or sensor. Therefore, efficient and secure data transmission can be achieved through a network system integrated into the vehicle. In this case, the corresponding vehicle control equipment itself can be constituted as a so-called system-on-a-chip, meaning it can be designed as a microcontroller or microprocessor, or may include such a component.

[0029] The development of configuration files can be performed by the vehicle manufacturer. The vehicle manufacturer understands the topology of the network system integrated into the respective vehicle. If changes are made, the vehicle manufacturer can easily create appropriate configuration files for different network devices using centralized development tools and wirelessly distribute them to the vehicles.

[0030] Other advantageous designs of the network system according to the invention can also be obtained from the embodiments described below with reference to the accompanying drawings. Attached Figure Description

[0031] Figure 1 A schematic diagram of a network system according to the present invention is shown. Detailed Implementation

[0032] Figure 1 A simplified embodiment of the network system 1 according to the invention is shown, featuring only two network devices 2. However, network system 1 can typically include more network devices 2. Figure 1 In the illustrated embodiment, each network device 2 is connected to two communication devices 3. Therefore, each network device 2 has multiple network ports 4. Correspondingly, each communication device 3 also has suitable network ports 4.

[0033] In this configuration, communication device 3 connects to corresponding network device 2 via a first network port 4.1, and corresponding network devices 2 communicate with each other via corresponding second network ports 4.2. The corresponding first network port 4.1 and the corresponding second network port 4.2 can be the same. However, the second network port 4.2 preferably has a higher data transmission rate than the corresponding first network port 4.1.

[0034] Each network device 2 includes a firewall module 5. The firewall module 5 allows firewall functionality to be implemented within the corresponding network device 2. Typically, firewall deployment is entirely software-based. The firewall module 5 includes the corresponding program code blocks required to provide firewall functionality. Furthermore, the corresponding firewall module 5 may have dedicated hardware components, such as dedicated storage elements or execution units, specifically for storing or executing the corresponding program code blocks. However, other hardware components of the corresponding network device 2 may also be used for this purpose.

[0035] According to the present invention, a corresponding network device 2 is configured to filter data packets received from communication devices 3 connected to the corresponding network device 2, and to forward data packets received from other network devices 2 unfiltered to a destination address. The destination address is a unique identifier of one of the communication devices 3 in the network system 1 according to the present invention. The destination address and source address may be components of the corresponding data packets exchanged over the network. The network device 2 then performs the corresponding method steps.

[0036] In other words, firewall module 5.1 filters data packets output from communication devices 3.1 and 3.2, and firewall module 5.2 filters data packets output from communication devices 3.3 and 3.4. As shown in bold X, there is therefore no need to monitor or filter data transmission via the second network port 4.2. Thus, the overhead of filtering data transmissions exchanged via the network system 1 according to the invention is reduced, resulting in more efficient operation of the network system 1 according to the invention.

[0037] Therefore, the method for filtering network traffic is part of the present invention, which accordingly provides that the respective network device 2 filters only the data packets received from the communication device 3 connected to the respective network device 2, and accordingly forwards the data packets received from other network devices 2 unfiltered to the respective destination address.

[0038] Therefore, if communication device 3.1 sends a data packet to communication device 3.4, as shown by the black arrow, network device 2.1 receives the data packet and filters it based on the rules set in firewall module 5.1. Network device 2.1 then sends the data packet to be forwarded to network device 2.2 through the second network port 4.2. Network device 2.2 receives the data packet and forwards it to communication device 3.4 without requiring filtering by firewall module 5.2.

Claims

1. A network system (1) comprising at least two network devices (2) and for each network device (2) at least one communication device (3), wherein, Each network device (2) has at least two network ports (4.1, 4.2), wherein, for each network device (2), the at least one communication device (3) is connected to a first network port (4.1) of the respective network device (2) and at least one other network device (2) is connected to a second network port (4.2) of the respective network device (2), and wherein each network device (2) has an integrated firewall function for filtering data packets to be transmitted through the network ports (4.1, 4.2), characterized in that the respective network device (2) is set up to filter data packets received from the communication device (3) connected to the respective network device (2) and to forward data packets received from other network devices (2) unfiltered to the target address.

2. Network system (1) according to claim 1, characterized in that the respective network device (2) consists of an Ethernet switch.

3. Network system (1) according to claim 1 or 2, characterized in that the respective network device (2) is set up to read a configuration file and to apply it for configuring the firewall function, wherein the configuration file comprises at least one unique identifier of the communication device (3) connected to the respective network device (2).

4. Network system (1) according to claim 3, characterized in that the firewall functions of at least two network devices (2) are configured by a respective separate network device-specific configuration file.

5. Network system (1) according to claim 3 or 4, characterized in that the at least one communication device (3) has a mobile communication port and is set up to receive a configuration file by mobile communication.

6. Vehicle, characterized in that a network system (1) according to any one of claims 1 to 5.

7. Vehicle according to claim 6, characterized in that the at least one communication device (3) consists of a microcontroller, a microprocessor, a vehicle control device, an actuator or a sensor.

Images