Method for monitoring a vehicle computer network and corresponding computer system and vehicle
By monitoring the connection status of switches and terminal devices in real time through the vehicle network management system, the complexity and response time issues of intrusion detection in vehicle computer networks in existing technologies are solved, and fast and reliable security threat detection is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- ALSTOM HOLDINGS SA
- Filing Date
- 2025-12-05
- Publication Date
- 2026-06-05
AI Technical Summary
Existing vehicle-mounted computer network intrusion detection systems typically operate offline by the trackside, resulting in high detection complexity and long response times, making it impossible to quickly and reliably detect potential security threats.
The Network Management System (NMS) monitors the connection status of switches and terminal devices in real time, obtains and compares the current network status with the reference status, detects anomalies, and issues notifications based on the anomaly level.
It enables rapid and reliable detection of potential security threats on the vehicle side without requiring trackside contributions, simplifying the intrusion detection process and improving response speed and accuracy.
Smart Images
Figure CN122160082A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of vehicle-mounted computer networks, particularly vehicle-mounted computer networks provided on rail vehicles such as trains, trams or subways, naval vessels such as ships, submarines, floating platforms, and aircraft such as airplanes or helicopters. Background Technology
[0002] Most modern vehicles, such as rail vehicles, typically include an onboard computer network based on switched Ethernet technology, which uses network switches interconnected according to a pre-defined topology. Application computers, called terminal devices, are connected to these switches and configured to control the corresponding functions they are responsible for, such as lighting systems, air conditioning systems, door control systems, etc.
[0003] To ensure the safety of the vehicle and its passengers, it is desirable to detect any potential damage to the in-vehicle computer network resulting from intentional or unintentional computer loss or accidental device intrusion.
[0004] Intrusion Detection Systems (IDS) are a classic solution for the railway industry to perform damage assessments of onboard network computers, with the ability to analyze business processes and detect potential anomalous activity.
[0005] However, IDS typically collects data on-board and performs analysis offline by the trackside, leading to high complexity and response time issues in intrusion detection scenarios. Summary of the Invention
[0006] The purpose of this invention is to propose a method for monitoring onboard computer networks that can quickly and reliably detect potential security threats in a very simple way without any wayside contribution.
[0007] Therefore, the present invention relates to a method for monitoring a computer network located on a vehicle, such as a train, the computer network comprising multiple switches and multiple terminal devices connected together to define a network architecture, each switch comprising multiple connection ports, each switch being connected to a connection port of at least one of the multiple switches, and each terminal device being connected to a connection port of one of the switches. The method is characterized by comprising the following steps performed by the vehicle network management system (NMS): - The acquisition step is used to acquire the current network status of each of the plurality of switches. The current network status of each switch includes the connection data of each connection port of each switch, which indicates whether another switch or terminal device is connected to the connection port, and optionally the identification data of the switch or terminal device connected to the connection port. - A comparison step is used to compare the current network state with a reference network state to detect anomalies in the computer system.
[0008] According to a further advantageous aspect of the invention, the method includes one or more of the following optional features, individually or in all technically possible combinations: - The acquisition steps are repeated to continuously monitor the computer network.
[0009] - The method further includes the following steps: - A request step for requesting the primary connection status of each of the plurality of switches, the primary connection status including primary connection data for each connection port of the switch, the primary connection data indicating whether another switch or terminal device is connected to the connection port, and optionally, primary identification data of the switch or terminal device connected to the connection port during initialization; and - Establish a reference network state based on the initial connection state of each switch.
[0010] - The method includes an issuing step, which issues a notification when an anomaly is detected.
[0011] - In the issuance step, a warning notification is issued when an anomaly is detected corresponding to the first anomaly level, and an alarm notification is issued when an anomaly is detected corresponding to the second anomaly level, where the second level is higher than the first level.
[0012] - The method includes an evaluation step in which a compromise value representing the level of anomaly is calculated, and the compromise value is increased as each additional anomaly is detected.
[0013] - The identification data for each terminal device includes a fixed physical address and / or a variable identifier.
[0014] - A fixed physical address is a Media Access Control address and / or a variable identifier is an Internet Protocol address.
[0015] - In the issuing step, traffic data representing traffic data is collected via at least each connection port associated with a potential anomaly, and this traffic data is used to confirm the anomaly.
[0016] - The comparison step includes detecting modifications to the current network state relative to a reference network state, the modifications including: connecting at least one new terminal device to a connection port of one of the switches and / or disconnecting at least one terminal device from a connection port of one of the switches and / or moving at least one terminal device from one connection port of one of the switches to another connection port of another of the switches.
[0017] - The computer network is part of the Train Control and Monitoring System (TCMS).
[0018] - The network architecture can be a ring network topology, a linear network topology, or a star network topology.
[0019] The present invention also relates to a computer system mounted on a vehicle, such as a train, the computer system comprising a computer network including a plurality of switches and a plurality of terminal devices connected together and defining a network architecture, each switch including a plurality of connection ports, each switch being connected to a connection port of at least one of the plurality of switches, and each terminal device being connected to a connection port of one of the switches.
[0020] The computer system is characterized in that it includes a vehicle-mounted network management system (NMS), the NMS comprising: - An acquisition module, adapted to acquire the current network status of each of the plurality of switches. The current network status of each switch includes connection data for each connection port of the switch, which indicates whether another switch or terminal device is connected to that connection port, and identification data of the other switch or the terminal device; and - Comparison module, adapted to compare the current network state with a reference network state to detect anomalies in the computer network.
[0021] The present invention also relates to a vehicle including a computer system, particularly a rail vehicle or train including a train control and monitoring system (TCMS) that includes the aforementioned computer system. Attached Figure Description
[0022] The invention will be better understood based on the following description, given only by way of non-limiting example and with reference to the accompanying drawings, in which: - Figure 1 This is a schematic diagram of an in-vehicle computer system, in which terminal devices are not shown and should be understood as being connected to a switch; - Figure 2 yes Figure 1 A schematic diagram of the computer network of the computer system shown. - Figure 3 It means Figure 2 A table of reference network architectures for computer networks. The reference network architecture refers to the design architecture. - Figure 4 It means Figure 2 A table showing the current network architecture of a computer network, where the current network architecture is defined by the observed architecture; and - Figure 5 Is Figure 1A flowchart of a vehicle-mounted computer network monitoring method implemented in a computer system. Detailed Implementation
[0023] like Figure 1 and Figure 2 As shown, the computer system 10 is mounted on vehicle 8.
[0024] Vehicle 8 can be any type of vehicle, such as an aircraft, ship, or land vehicle, especially land-guided vehicles such as rail vehicles. In some examples, computer system 10 is mounted on a rail vehicle, particularly a train.
[0025] Vehicle 8 is configured, for example, to transport passengers and / or goods.
[0026] Computer system 10 is connected to vehicle network 11, for example, via vehicle routing switch 9. Vehicle network 11 provides communication between different computer networks or computer systems provided in vehicle 8.
[0027] When vehicle 8 is a train, the vehicle routing switch is called the Train Routing Switch (TRS), and vehicle network 11 is a train network, for example configured to allow data communication between different computer systems 10 provided in different formations, i.e., group trains.
[0028] Computer system 10 includes computer network 12 and network management system (NMS) onboard to vehicle 8.
[0029] The computer network 12 is mounted on vehicle 8 to connect a limited number of authorized terminal devices 22A-22H.
[0030] Terminal devices 22A-22H are configured, for example, to control and / or monitor the onboard functions of vehicle 8.
[0031] When vehicle 8 is provided as a train, computer network 12 is, for example, part of the Train Control and Monitoring System (TCMS).
[0032] The Train Control and Monitoring System (TCMS) is an onboard system configured to control and monitor the functions of a train.
[0033] The main functions performed by the Train Control and Monitoring System (TCMS) include control functions such as propulsion or door management, maintenance functions such as troubleshooting and status management, and driving assistance functions such as driving assistance systems.
[0034] These features are typically mission-critical for vehicle 8 and are designed to provide safe and reliable operation.
[0035] These functions are implemented, for example, by terminal devices 22A-22H connected to computer network 12 of computer system 10.
[0036] Depending on the complexity of the train configuration (multiple train sets connected together), the computer network 12 is sometimes connected to the train network 11 via one or more security gateways 14. Each security gateway 14 is configured to control and filter messages exchanged between the computer network 12 and the vehicle network 11.
[0037] Optionally, the computer system 10 includes an auxiliary computer network 16 connected to the computer network 12 and / or the vehicle network 11, preferably via a security gateway 14.
[0038] The auxiliary computer network 16 is configured, for example, to connect to terminal devices (not shown) configured to control and / or monitor the auxiliary functions of the vehicle 8.
[0039] In a railway environment, auxiliary computer networks 16 are typically dedicated to connecting devices such as monitors, screens, speakers, and cameras. These devices are grouped around different subsystems such as the Passenger Information System (PIS), Public Address System (PAS), or Closed-Circuit Television (CCTV) and are physically isolated from the TCMS due to network security restrictions.
[0040] like Figure 2 As shown, the computer network 12 includes multiple switches 20A-20F connected together and multiple terminal devices 22A-22H connected to the switches 20A-20F.
[0041] Computer network 12 may present a ring network topology, a linear network topology, or a star network topology. Preferably, such as Figure 2 As shown, computer network 12 presents a ring network topology.
[0042] exist Figure 2 In the example shown, computer network 12 includes six switches 20A-20F. In other examples, computer network 12 may have fewer or more than six switches.
[0043] Each switch 20A-20F includes multiple connection ports P1-P8. Each switch 20A-20F is connected to a connection port of at least one other switch among the multiple switches 20A-20F to form a computer network 12.
[0044] In some examples, all switches 20A-20F of computer network 12 have the same number of connection ports P1-P8. In other examples, the number of connection ports is different from eight and varies between different switches.
[0045] Each connection port P1-P8 of each switch 20A-20F has an end device connection status ECS. Each connection port P1-P8 may be in a no-connection state (0) if no end device 22A-22H or switch 20A-20F is connected to it, or in a connected state ("C") if an end device 22A-22H or switch 20A-20F is connected to it.
[0046] You cannot connect more than one terminal device 22A-22H or switch 20A-20F to the same connection port P1-P8 at the same time.
[0047] Each terminal device 22A-22H is an on-board device for vehicle 8.
[0048] Each terminal device 22A-22H is connected to a connection port P1-P8 of one of the switches 20A-20F.
[0049] The multiple switches 20A-20F connected together and the multiple terminal devices 22A-22H, together with the computer network 12, define the network architecture 24.
[0050] Terminal devices 22A-22H are monitored and / or controlled by the network management system (NMS).
[0051] The Network Management System (NMS) is connected to computer network 12 for communication with switches 20A-20F and terminal devices 22A-22H. The NMS is connected, for example, to one of the switches 20A-20F in computer network 12. The NMS is configured to communicate with switches 20A-20F and terminal devices 22A-22H by implementing a communication protocol.
[0052] The communication protocol is, for example, the Simple Network Management Protocol (SNMP). As those skilled in the art will recognize, other communication protocols may be implemented.
[0053] The Network Management System (NMS) includes an acquisition module 28, configured to acquire the current network status 30 representing the connection status of each of the plurality of switches 20A-20F.
[0054] The acquisition module 28 is configured, for example, to periodically monitor the current connection status of each switch 20A-20F, thereby continuously monitoring the computer network 12.
[0055] The acquisition module 28 is configured, for example, to monitor the connection status of switches 20A-20F according to a sequence, repeating the sequence periodically.
[0056] The connection status of each switch 20A-20F includes connection data 32 for each connection port P1-P8 of the switch 20A-20F. The connection data 32 for each connection port P1-P8 indicates whether another switch 20A-20F or terminal device 22A-22H is connected to the connection port P1-P8, and optionally indicates identification data 34 of the other switch 20A-20F or the terminal device 22A-22H connected to the connection port P1-P8.
[0057] The identification data 34 for each switch 20A-20F or terminal device 22A-22H includes, for example, a fixed physical address and / or a variable identifier.
[0058] Preferably, the fixed physical address is a media access control address or a MAC address. The MAC address of each switch 20A-20F or terminal device 22A-22H is unique for that switch 20A-20F or terminal device 22A-22H. Two different switches 20A-20F or terminal devices 22A-22H have different fixed physical addresses, specifically different MAC addresses.
[0059] Variable identifiers are, for example, Internet Protocol (IP) addresses or IP addresses. The IP addresses of switches 20A-20F or terminal devices 22A-22H are addresses that typically change each time they connect to computer network 12. This means that switches 20A-20F or terminal devices 22A-22H can change their identifiers after initialization. Initialization may occur, for example, during the installation of computer system 10 in vehicle 8 or during pre-trip checks of vehicle 8.
[0060] The network management system (NMS) includes, for example, a comparison module 36 configured to compare the current network state 30 ( Figure 4 ) and reference network state 38 ( Figure 3 ) to compare and detect anomalies in computer network 12 40 ( Figure 4 (Compare "by design" and "by observation" topologies).
[0061] Each anomaly 40 corresponds to the detection of a modification of the current network state 30 relative to the reference network state 38.
[0062] Possible modifications include, for example, connecting the intrusion terminal device 22I to one of the connection ports P1-P8 of one of the switches 20A-20F and / or disconnecting one of the terminal devices 22A-22H from one of the connection ports P1-P8 of one of the switches 20A-20F and / or moving one of the terminal devices 22A-22H from one of the connection ports P1-P8 of one of the switches 20A-20F to another connection port P1-P8 of one of the switches 20A-20F, on the same switch 20A-20F or another switch 20A-20F.
[0063] The network management system (NMS) includes, for example, an issuing module 50 configured to issue a notification based on the detection of an anomaly 40.
[0064] In some examples, the issuing module 50 is configured to issue a notification when each anomaly 40 is detected and / or based on the number of anomalies 40 detected and / or based on the anomaly level of each anomaly 40 detected.
[0065] In some examples, each anomaly 40 is classified according to one or more anomaly levels, specifically two anomaly levels. Anomaly levels may include, for example, a first anomaly level and a second anomaly level.
[0066] In some examples, the notification is issued based on the anomaly level of the detected anomaly 40.
[0067] In some examples, a warning notification is issued when an anomaly 40 corresponding to the first anomaly level is detected, and an alarm notification 48 is issued when an anomaly 40 corresponding to the second anomaly level is detected.
[0068] Preferably, the network management system (NMS) includes a calculation module 51 configured to calculate a compromise value based on the detected anomaly 40.
[0069] In some examples, the compromise value is incremented, for example, when 40 anomalies are detected.
[0070] A compromise value is, for example, to increment by the same value for every 40 anomalies detected.
[0071] Alternatively, the compromise value increases by a first increment when an anomaly of the first anomaly level 40 is detected, and by a second increment when an anomaly of the second anomaly level 40 is detected.
[0072] In some examples, a notification is issued when the compromise value is reached. In particular, a warning notification is issued when the compromise value reaches a warning compromise value and / or an alarm notification is issued when the compromise value reaches an alert compromise value.
[0073] In some examples, the first anomaly level is attributed to any anomaly 40 associated with a fixed physical address of a predefined subset 52 of secondary terminal devices 22B and 22C that are considered non-essential to the vehicle. The secondary terminal devices 22B and 22C are considered non-essential to the vehicle's operation.
[0074] In some examples, the second anomaly level is, for example, any anomaly 40 associated with a fixed physical address of a predefined subset 54 of primary terminal devices 22A that is considered necessary for the operation of the vehicle.
[0075] As another variation, the first anomaly level is attributed to any anomaly 40 associated with a subset 55 of auxiliary connection ports P1-P8 of one or more given switches 22A-22H. Auxiliary connection ports P1-P8 are, for example, ports that are easily inspected by the operator and / or considered not to pose a threat if damaged. The second anomaly level is attributed to any anomaly 40 associated with a subset 56 of required connection ports P1-P8 of one or more given switches 22A-22H. Required connection ports P1-P8 are, for example, ports that are not easily modified or accessed and / or considered critical to vehicle safety.
[0076] In some examples, NMS is configured to establish and store reference network state 38 during initialization.
[0077] The determination of reference network status 38 is performed, for example, when computer system 10 is installed in vehicle 8 or before vehicle 8 travels and / or when triggered by an operator.
[0078] Advantageously, the network management system (NMS) includes a request module 58 configured to request the initial connection status from each switch 20A-20F of the computer network 12.
[0079] The primary connection status includes primary connection data for each connection port P1-P8 of switches 20A-20F. The primary connection data indicates whether another switch 20A-20F or terminal device 22A-22H is connected to connection port P1-P8, and optionally includes primary identification data 64 of another switch 20A-20F or terminal device 22A-22H connected to the connection port P1-P8 during initialization.
[0080] Preferably, the Network Management System (NMS) includes a setup module 66, configured to establish a reference network state 38 based on the primary connection state of each switch 20A-20F, such as... Figure 3 As shown.
[0081] In some examples, reference network state 38 is predefined. The predefined reference network state 38 is associated with a vehicle. In such examples, request module 58 is configured, for example, to store reference network state 38.
[0082] Optionally, the Network Management System (NMS) includes a collection module 68 configured to collect business data.
[0083] The service data represents service data transmitted via at least each of the connection ports P1-P8 associated with the potential anomaly 40. The network management system (NMS) is configured, for example, to confirm anomaly 40 and / or determine the anomaly level based on the service data retrieved for at least each of the connection ports P1-P8 associated with the potential anomaly.
[0084] Each of the acquisition module 28, comparison module 36, issuance module 50, calculation module 51, request module 58, establishment module 66, and collection module 68 is implemented, for example, as software or software block stored in memory 70 and executable by processor 72, or as a programmable logic component, such as FPGA (Field Programmable Gate Array) or application-specific integrated circuit, such as ASIC (Application-Specific Integrated Circuit).
[0085] In some examples, Network System Management (NMS) is implemented as one or more software programs or software blocks, i.e., as a computer program. In such cases, the NMS may be documented on a computer-readable medium.
[0086] Computer-readable media are, for example, media capable of storing electronic instructions and coupled to a computer system bus. Examples of readable media include optical discs, magneto-optical discs, ROM memory, RAM memory, any type of non-volatile memory (e.g., EPROM, EEPROM, FLASH, NVRAM), magnetic cards, or optical cards. Computer programs containing software instructions are stored on readable media.
[0087] Now according to Figure 5 The invention describes a method implemented by Network System Management (NMS) for monitoring a computer network 12 located in a vehicle.
[0088] Methods for monitoring computer network 12 include: - Step 120 to obtain the current network status 30 - Step 130: Compare the current network state 30 with the reference network state 38 to detect one or more anomalies 40 of the computer network 12 based on the comparison between the current network state 30 and the reference network state 38; - Optionally, step 140 assesses the anomaly level of the detected anomaly 40; - Optionally, step 150, issuing one or more notifications when one or more anomalies 40 are detected.
[0089] Prior to step 120, which obtains the current network state 30, the method may optionally include step 100, which obtains a reference network state 38.
[0090] Step 100 of obtaining the reference network state 38 includes, for example, retrieving the pre-stored reference network state 38 from memory.
[0091] Alternatively, step 100 of obtaining the reference network state 38 may include, for example, requesting the primary connection state of each connection port P1-P8 of each switch 20A-20F, and determining the reference network state 38 based on the primary connection state of each connection port P1-P8 of each switch 20A-20F. Step 100 of determining the reference network state 38 is performed during initialization. The primary connection state of each connection port P1-P8 of the switches 20A-20F includes primary connection data and, optionally, primary identification data 64 of the switches 20A-20F or terminal device 22A connected to that connection port P1-P8 during initialization. The primary identification data 64 includes the Media Access Control (MAC) address of the switches 20A-20F or terminal device 22A connected to that connection port P1-P8 during initialization.
[0092] exist Figure 2 and Figure 3 In the example shown, computer network 12 includes switches 20A-20F with eight connection ports P1-P8. However, any number of switches and any number of ports per switch can be selected according to vehicle requirements.
[0093] Figure 3 The table in the table represents reference network state 38, indicating the connection status of each connection port P1-P8 of the terminal devices 22A-22H connected to switches 20A-20F during initialization, and includes all MAC addresses, thereby establishing reference network state 38 based on the primary connection status of each switch 20A-20F.
[0094] Switches 20A-20F are connected in series to form a ring topology, and the connection port P1 of each next switch 20A-20F is connected to the connection port P8 of the previous switch 20A-20F.
[0095] The connection port P1 of switch 20A is connected to the connection port P8 of switch 20F. Due to the ring configuration of computer network 12, switch 20F is defined as the preceding switch.
[0096] Therefore, as Figure 3 As shown in the table, the status of connection ports P1 and P8 of switch 20A-20F is "connected" (C).
[0097] The Network Management System (NMS) is connected, for example, to one of the connection ports P1-P8 of a switch 20A-20F. Figure 2 and Figure 3As shown, the Network Management System (NMS) is connected to port P7 of switch 20C.
[0098] Except for one connection port connected to another switch 20A-20F and the network management system NMS, all connection ports P1-P8 of switch 20A-20F are either in a no-connection state ("0") or connected to one of the terminal devices 22A-22H, indicating the MAC address of terminal device 22A-22H. For illustrative purposes, the terminal device is indicated as MAC#1 to MAC#8 of terminal device 22H.
[0099] If step 120 is performed without modifying computer network 12 and without disconnecting and / or connecting to intrusion device 22I and / or without changing connection ports P1-P8 of terminal devices 22A-22H, then the obtained current network state 30 is consistent with... Figure 3 The reference connection state 38 is the same. Therefore, it is determined that there is no anomaly 40 or potential anomaly 40.
[0100] If the acquisition step 120 is performed after the computer network 12 is modified due to the disconnection of terminal devices 22A-22H and / or the connection of intrusion device 22I and / or the change of terminal devices 22A-22H from connection ports P1-P8, the acquired current network state 30 is different from the reference network state 38.
[0101] As an illustrative example, if step 120 is performed after terminal device 22G is replaced by an intrusive terminal device 22I on connection port P7 of switch 20F, then the following will be obtained: Figure 4 The current network state 30 shown is different from the reference network state 38.
[0102] In step 130, which involves comparing the current network state 30 with the reference network state 38, an anomaly 40 is detected in the computer system 10.
[0103] Optional steps 140 for assessing the level of abnormality include, for example, calculating a compromise value.
[0104] For example, a compromise value can be calculated by incrementing the compromise value for each new anomaly 40 detected, optionally based on the anomaly level of the anomaly 40.
[0105] If the compromise value is lower than one or more predefined compromise values (warning compromise value or alarm compromise value), the method returns to step 120 because the comparison value has determined that the current network 30 is acceptable.
[0106] If the compromise value is higher than one or more predefined compromise values (warning compromise value or alarm compromise value), the method proceeds to step 150, which preferably issues a notification based on the compromise value.
[0107] In step 150, a notification is issued upon detection of anomaly 40 or based on a compromise value calculated based on anomaly 40. This notification may be, for example, an alarm notification or a warning notification.
[0108] In some examples, if a compromise value based on or updated based on exception 40 corresponds to a warning notification, the method may optionally include analyzing business data to confirm exception 40.
[0109] During this step, no action is taken; only the operator of vehicle 8, such as the train operator in the train case, can make a decision. If the operator assesses that anomaly 40 is not a potential intrusion, the operator chooses either to return to the request step 100 if a new initialization is required, or to return to the acquisition step 120 if the notification is a false alarm.
[0110] Due to the aforementioned characteristics, particularly the Network Management System (NMS), the computer system monitors the computer network 12. In fact, a reference network state 30 for the vehicle electronics is constructed according to the installation state and compared with the current network state 38 to assess potential intrusions.
[0111] A star topology is advantageous because it provides redundancy. In fact, if one of the switches 20 fails, the connected terminal devices 22A-22H can be easily moved to another switch 20 with available ports P for connection.
[0112] As an example, the computer network provides some unused connection ports 55. In fact, in the event of a switch 20D failure, the connected terminal devices 22D-22F can be easily moved to another switch 20E that presents ports P2, P3, or P7 available for connection of terminal devices 22D to 22F.
[0113] Using Internet Protocol (IP) and Media Control Access (MCA) addresses is particularly advantageous because it provides computer system 10 with the ability to dynamically detect potential intrusions and issue alerts.
[0114] Computer system 10 is a purely standalone technical solution that has no impact on the existing architecture because reference network state 38 does not need to be known in advance.
[0115] Using business data to confirm anomaly 40 is highly advantageous because it allows for improved accuracy in assessing potential intrusions.
[0116] Compared to a firewall (not shown), security gateway 14 provides the additional security required for operation in critical infrastructure, where a high level of security is demanded. Security gateway 14 has precise knowledge of the information exchanged between computer network 12 and auxiliary computer network 16.
Claims
1. A method for monitoring a computer network (12) located on a vehicle, such as a train, the computer network (12) comprising multiple switches (20A-20F) and multiple terminal devices (22A-22H) connected together and defining a network architecture (24), each switch comprising multiple connection ports (P1-P8), each switch being connected to a connection port (P1) of at least one of the multiple switches (20A-20F), and each terminal device (22A-22H) being connected to a connection port (P1) of one of the switches (20A-20F). Its features are, The method includes the following steps performed by the vehicle's network management system (NMS): - Obtaining step (120) is used to obtain the current network status (30) of each of the plurality of switches (20A-20F). The current network status (30) of each switch (20A-20F) includes the connection data of each connection port (P1-P8) of each switch (20A-20F). The connection data indicates whether another switch (20A-20F) or terminal device (22A-22H) is connected to the connection port and the identification data (34) of the switch (20A-) or terminal device (22A-22H) connected to the connection port (P1-P8). - Comparison step (130) is used to compare the current network state (30) with the reference network state to detect anomalies in the computer system.
2. The method according to claim 1, characterized in that, Step (120) is repeated to continuously monitor the computer network.
3. The method according to claim 1 or 2, characterized in that, The method further includes the following steps: - Request step (100) is used to request the primary connection status of each of the plurality of switches, the primary connection status including primary connection data for each connection port of the switch, the primary connection data indicating whether another switch or terminal device is connected to the connection port; and - Establish a reference network state (38) based on the primary connection state of each switch (20A-20F).
4. The method according to claim 1, characterized in that, The method includes issuing a step (150) to issue a notification when an anomaly (40) is detected.
5. The method according to claim 1, characterized in that, In the issuing step (150), a warning notification is issued when an anomaly (40) corresponding to the first anomaly level is detected, and an alarm notification (48) is issued when an anomaly (40) corresponding to the second anomaly level is detected, the second level being higher than the first level.
6. The method of claim 4 or 5, further comprising an evaluation step (140), wherein a compromise value representing the level of anomaly is calculated, and the compromise value is increased for each additional anomaly detected.
7. The method according to claim 1, characterized in that, Each terminal device's identification data includes a fixed physical address and / or a variable identifier.
8. The method according to claim 7, characterized in that, A fixed physical address is a Media Access Control address and / or a variable identifier is an Internet Protocol address.
9. The method according to claim 1, characterized in that, In the issuing step (150), business data representing business data is collected via at least each connection port associated with a potential anomaly (40), and the anomaly (40) is confirmed using the business data in the method.
10. The method according to claim 1, characterized in that, The comparison step includes detecting modifications to the current network state (30) relative to a reference network state (38), the modifications including: connecting at least one new terminal device to a connection port of one of the switches and / or disconnecting at least one terminal device from a connection port of one of the switches and / or moving at least one terminal device from one connection port of one of the switches to another connection port of another of the switches.
11. The method according to claim 1, characterized in that, The computer network is part of the Train Control and Monitoring System (TCMS).
12. The method according to claim 1, characterized in that, The network architecture (24) presents a ring network topology, a linear network topology, or a star network topology.
13. A vehicle-mounted computer system, such as on a train, comprising a computer network (12) including multiple switches (20A-20F) and multiple terminal devices (22A-22H) connected together to define a network architecture (24), each switch including multiple connection ports (P1-P8), each switch connected to a connection port of at least one of the multiple switches (20A-20F), and each terminal device connected to a connection port of one of the switches (20A-20F). Its features are, The computer system includes a vehicle-mounted network management system (NMS), which includes: - Acquisition module (28), adapted to acquire the current network status (30) of each of the plurality of switches (20A-20F), the current network status (30) of each switch including connection data of each connection port of the switch, the connection data indicating whether another switch or terminal device is connected to the connection port and the identification data of the other switch or the terminal device; and - Comparison module (36), adapted to compare the current network state (30) with the reference network state (38) to detect anomalies in the computer network.
14. The computer system according to claim 13, characterized in that, The computer network (12) is connected to the vehicle-mounted auxiliary computer network (16) via at least one security gateway (14).
15. A vehicle including the computer system according to claim 13 or 14, particularly a rail vehicle or train including a train control and monitoring system (TCMS) comprising the computer system according to claim 13 or 14.
16. The method according to claim 3, characterized in that, Primary connection data indicates the primary identification data of the switch or terminal device connected to this connection port during initialization.