A vehicle end intrusion detection and prevention system and method based on modular management
By standardizing the interfaces and functional components of TBOX devices through a modular management approach, the compatibility problem between TBOX devices was solved, and the platform-based management and efficient security monitoring of the IDPS system were realized.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA AUTOMOTIVE INTELLIGENT TECHNOLOGY (TIANJIN) CO LTD
- Filing Date
- 2026-06-12
- Publication Date
- 2026-07-14
AI Technical Summary
Existing TBOX devices, due to differences in equipment suppliers and models, result in time-consuming and costly IDPS system adaptation, poor portability, and complex version management, making it difficult to achieve unified network and host security monitoring.
A modular management approach is adopted, which encapsulates the interfaces of TBOX devices according to the IDPS interface specification, selects the corresponding functional components and communication components, generates executable programs and dynamic library files through cross-compilation, and realizes platform-based management and one-click compilation of equipment for the IDPS system through OTA upgrade.
It enables platform-based management of the IDPS system, reduces adaptation workload and version management difficulty, and improves the efficiency of network and host security monitoring of TBOX devices.
Smart Images
Figure CN122394972A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of vehicle information security technology, and more specifically, to a vehicle-side intrusion detection and defense system and method based on modular management. Background Technology
[0002] The "Technical Requirements for Information Security of Automotive Vehicles" sets forth clear requirements for vehicles to identify and defend against cyberattacks. Overseas automotive information security regulations and standards such as UN / ECE-R155 and ISO / SAE 21434 also set forth relevant requirements for the level of automotive network security protection. In order to meet the requirements of domestic and foreign standards and regulations, automakers have equipped their vehicle-side TBOX devices with IDPS systems to monitor network and host intrusion events in real time, generate corresponding alarm logs, and report the alarm logs to the VSOC platform to achieve continuous monitoring of the network security status of vehicles on the road. This is supplemented by security monitoring measures during the operation and maintenance phase to improve the security level of automotive products.
[0003] In traditional methods, because the equipment suppliers or models of the TBOX devices equipped in each vehicle are different, each TBOX device needs to be adapted to IDPS in order to obtain the data required for HIDPS and NIDPS detection. This involves calling the TBOX device's log interface, network packet acquisition interface, peripheral connection status query interface, etc., to obtain the data required for HIDPS and NIDPS detection for abnormal behavior, intrusion behavior detection, and alarms.
[0004] Whether it's an existing TBOX device or a newly developed one, adaptation development and functional testing are required, which is time-consuming, costly, and results in poor product portability. Because of the differences between each TBOX device, the IDPS of the adapted device cannot be used on other devices, making version management relatively complex. Poor version management often causes many problems when adapting to new devices, greatly increasing the workload of adaptation and testing. Summary of the Invention
[0005] The purpose of this application is to provide a vehicle-side intrusion detection and prevention system and method based on modular management. For existing TBOX products, the developed device interface component encapsulates the corresponding interfaces of the TBOX into interfaces that conform to the IDPS interface specification for IDPS to call. For future TBOX devices, the IDPS interface specification will be used as a guide during the TBOX development phase. The definitions of various interfaces will be designed according to the IDPS interface specification. The final compiled IDPS product will be integrated into the device via OTA upgrade, enabling normal operation and network and host security monitoring of the device.
[0006] To achieve the above objectives, this application adopts the following technical solution: Firstly, this application provides a vehicle-side intrusion detection and defense method based on modular management, including: If the TBOX device interface does not conform to the IDPS interface specification, the TBOX device interface will be encapsulated according to the IDPS interface specification to obtain the device interface component; Select the corresponding IDPS function component based on the IDPS function requirements that need to be configured on the TBOX device; Select the appropriate vehicle-to-cloud communication component based on the communication requirements of the TBOX device; Select the cross-compilation environment for the TBOX device; The device interface component, IDPS functional component, and vehicle-to-cloud communication component are combined into a component set, and the TBOX device that needs to be equipped with the IDPS system and the corresponding configuration file are selected. The selected cross-compilation environment is used to compile the component set to generate the executable program and dynamic library files for IDPS; The OTA upgrade interface is called to install the compiled executable program and dynamic library files onto the corresponding TBOX device via OTA upgrade.
[0007] Secondly, this application provides a vehicle-side intrusion detection and defense system based on modular management, comprising: The device interface management module is used to encapsulate the TBOX device interface according to the IDPS interface specification if the TBOX device interface does not conform to the IDPS interface specification, thus obtaining a device interface component. The vehicle-to-cloud communication management module is used to manage vehicle-to-cloud communication components; The functional component management module is used to manage IDPS functional components; The compilation and file management module is used to select the corresponding vehicle-to-cloud communication component according to the communication requirements of the TBOX device, and select the corresponding IDPS function component according to the IDPS function requirements that need to be configured on the TBOX device; to form a component set by combining the device interface component, IDPS function component and vehicle-to-cloud communication component, and to select the TBOX device that needs to be equipped with the IDPS system and the corresponding configuration file; to compile the component set using the selected cross-compilation environment to generate the IDPS executable program and dynamic library file; and to call the OTA upgrade interface to equip the compiled executable program and dynamic library file to the corresponding TBOX device through OTA upgrade.
[0008] This application has the following substantial features and significant progress compared to the prior art: This application modularizes the functions of a vehicle-mounted intrusion detection and prevention system based on modular management, and separates the parts of the IDPS system that depend on device interfaces by defining IDPS interface specifications. By classifying and managing the functions, communication methods, device interfaces, and other components of the IDPS system through a modular management-based vehicle-mounted intrusion detection and prevention system, it achieves platform-based management and one-click compilation of the IDPS system, greatly reducing the workload of IDPS system adaptation and the difficulty of managing different IDPS versions. Attached Figure Description
[0009] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0010] Figure 1 This is a flowchart of a vehicle-side intrusion detection and defense method based on modular management provided in an embodiment of this application; Figure 2 This is a communication flowchart of a vehicle-side intrusion detection and prevention system based on modular management provided in an embodiment of this application; Figure 3 This is a layered architecture diagram of a vehicle-side intrusion detection and defense system based on modular management, provided in an embodiment of this application. Detailed Implementation
[0011] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.
[0012] To facilitate the introduction of the vehicle-side intrusion detection and defense method and system based on modular management provided in this application, the following explanations are given for the English abbreviations used in the text: IDPS: Intrusion Detection & Prevention System. The IDPS system consists of two parts: HIDPS and NIDPS.
[0013] HIDPS: Host-based Intrusion Detection & Prevention System.
[0014] NIDPS: Network-based Intrusion Detection & Prevention System.
[0015] TBOX: Telematics Box, a remote information processing controller.
[0016] VSOC platform: Vehicle Security Operations Center, responsible for monitoring and managing the security of intelligent connected vehicles, ensuring the security, reliability and compliance of vehicles and their network systems.
[0017] TSP platform: Telematics Service Provider, is a remote information service platform that connects multiple links such as car manufacturers, in-vehicle equipment manufacturers, network operators and content providers, and provides car owners with a variety of connected car services including navigation, entertainment and security services. Some car manufacturers' TSP platforms have dedicated TSP data transmission channels.
[0018] MQTT: Message Queuing Telemetry Transport, is a lightweight messaging protocol commonly used for device communication in the Internet of Things (IoT). Based on a publish / subscribe model, it enables devices to exchange information efficiently and reliably through a central broker.
[0019] Figure 1 This is a flowchart of a vehicle-side intrusion detection and defense method based on modular management provided in this application embodiment, which realizes automatic interface adaptation and IDPS system installation for various types of TBOX devices.
[0020] See Figure 1 The method provided in this application includes: S110. If the TBOX device interface does not conform to the IDPS interface specification, the TBOX device interface is encapsulated according to the IDPS interface specification to obtain the device interface component.
[0021] Figure 2This is a communication flowchart of a vehicle-side intrusion detection and prevention system based on modular management, provided in this application embodiment. First, all dependent interfaces of IDPS on the TBOX hardware device are identified, and IDPS interface specifications are defined to form an IDPS standard interface library. The function name, input parameter type, output parameter type, and return value type of each interface are detailed. IDPS product functions are developed based on the IDPS interface specifications. For existing TBOX devices, the TBOX device interfaces are encapsulated into interfaces that conform to the IDPS interface specifications for IDPS to call. For future TBOX devices, the IDPS interface specifications are used as a guide during the TBOX development phase, and the definitions of various interfaces are designed according to the IDPS interface specifications, enabling the TBOX device to directly interact with IDPS.
[0022] In practice, the first step is to check whether the TBOX device interface conforms to the IDPS interface specification. If it does not conform to the IDPS interface specification, the TBOX device interface is encapsulated according to the IDPS interface specification to obtain the device interface component.
[0023] Taking obtaining the VIN and SN codes as an example, the interface specification requires that an initialization operation be performed first to obtain a handle to the internal data. Subsequently, the internal state and data structures of the module are accessed through the handle. Then, the GetParamsValue interface is called. This interface accepts an enumeration type parameter `paramidx` and a character pointer `paramValue`. Based on the value of `paramidx`, the corresponding information is filled into the memory pointed to by `paramValue`. For example, if the value of `paramidx` is VIN, the interface will fill the VIN code of the device into the memory pointed to by `paramValue`. If the interface for obtaining the VIN code of the TBOX device differs from the IDPS interface specification, then the GetParamsValue interface internally calls the TBOX device interface to obtain the VIN code value, and then fills the VIN code data into the memory pointed to by `paramValue` according to the data format specified in the IDPS interface specification.
[0024] After various types of TBOX interfaces are encapsulated, corresponding device interface components are obtained. When a new TBOX is connected, it is first determined whether there is a device interface component that matches the TBOX device type. If there is, the device interface component is called directly; otherwise, the TBOX device interface needs to be encapsulated according to the IDPS interface specification to obtain a new device interface component.
[0025] The encapsulated device interface component meets the IDPS interface specification requirements and can interact seamlessly with various detection modules in the IDPS functional components. When other TBOX devices need to be equipped with the IDPS system in the future, device interface components adapted to this TBOX device can also be submitted in the device interface management module.
[0026] S120. Select the corresponding IDPS function component according to the IDPS function requirements that need to be configured on the TBOX device.
[0027] S130. Select the corresponding vehicle-to-cloud communication component according to the communication requirements of the TBOX device.
[0028] The IDPS functional components (or IDPS system) include: the HIDPS detection component and the NIDPS detection component. The HIDPS detection component obtains peripheral status, kernel logs, system logs, critical process status, and system resource usage of the TBOX device based on the device interface component. By analyzing the acquired data, it promptly detects various intrusions or dangerous behaviors on the TBOX device and generates corresponding alarm logs, which are then sent to the VSOC platform via communication protocols (including HTTPS / MQTT / TSP). The NIDPS detection component obtains network data from the TBOX device based on the device interface component. By analyzing the acquired data, it promptly detects various intrusions or dangerous behaviors on the TBOX device and generates corresponding alarm logs, which are then sent to the VSOC platform via communication protocols (including HTTPS / MQTT / TSP). Upon receiving the alarm logs, the VSOC platform analyzes them using a vulnerability database and data analysis techniques, and displays the analysis results to system operators. This allows maintenance personnel to promptly handle serious dangerous behaviors and ensure vehicle safety.
[0029] In summary, the HIDPS detection component is responsible for host-side IDPS detection on the TBOX device, including system log / kernel log analysis, system resource usage monitoring, monitoring of core system interface calls, and monitoring of key processes, among other host-related detection functions. The NIDPS detection component is responsible for network-side IDPS detection on the TBOX device, including DoS attack detection, abnormal traffic detection, and malformed packet detection. The required IDPS functionalities of the TBOX device should be identified, such as whether log analysis and abnormal traffic detection are needed, and then a detection component capable of providing these functionalities should be selected.
[0030] The vehicle-to-cloud communication components include: MQTT communication component, custom protocol component, HTTPS communication component, and TSP dedicated communication channel component. Select the appropriate vehicle-to-cloud communication component based on the resources and network support of the TBOX device. Optionally, the communication protocol can be configured through a configuration file, allowing you to specify HTTPS, MQTT, or the TSP dedicated communication channel as needed.
[0031] Optionally, when selecting the IDPS functional component and vehicle-to-cloud communication component for the TBOX device, the following situations apply: 1. If the TBOX device has no network and the logs need to be written to the local disk, select the HIDPS detection component, NIDPS detection component, and log writing module.
[0032] 2. If the TBOX device resources are insufficient and the MQTT protocol is supported, select the NIDPS detection component, the rule loading module (the rule loading module relies on the network to obtain cloud rules, and then parses and loads the cloud rules), and the MQTT communication component.
[0033] 3. If the TBOX device has sufficient resources and a custom vehicle-to-cloud communication protocol, select the custom protocol component, then select the HIDPS detection component, NIDPS detection component, log write-to-disk module, and rule loading module.
[0034] 4. If the TBOX device has sufficient resources and supports the TSP protocol, select the HIDPS detection component, NIDPS detection component, log disk writing module, rule loading module (the rule loading module relies on the network to obtain cloud rules, and then parses and loads the cloud rules) and TSP dedicated communication channel component.
[0035] 5. If the TBOX device has sufficient resources and supports the HTTPS communication protocol, select the HIDPS detection component, NIDPS detection component, log disk writing module, rule loading module (the rule loading module relies on the network to obtain cloud rules, and then parses and loads the cloud rules) and HTTPS communication component.
[0036] S140. Select the cross-compilation environment for the TBOX device.
[0037] Each type of TBOX device has its own unique operating environment. The existing IDPS development model requires configuring a corresponding cross-compilation environment for each TBOX device and cross-compiling the developed IDPS system in order to generate an output that can run on the TBOX device. Therefore, the vehicle-side intrusion detection and defense system needs to be configured with a cross-compilation environment.
[0038] Optionally, since the newly connected TBOX device does not have a corresponding cross-compilation environment, a corresponding cross-compilation environment will be configured for the newly connected TBOX device. After the cross-compilation environment is configured, select the cross-compilation environment corresponding to the TBOX device and perform one-click compilation to generate an executable program and dynamic library files adapted to the TBOX device.
[0039] It should be noted that the vehicle-to-cloud communication component and IDPS function component can be manually selected by the user on the system interface, or the system can automatically select them according to the resources, network support and functional requirements of the TBOX device based on the pre-set rules.
[0040] S150. Assemble the device interface component, IDPS function component and vehicle-to-cloud communication component into a component set, and select the TBOX device that needs to be equipped with the IDPS system and the corresponding configuration file.
[0041] S160. Compile the component set using the selected cross-compilation environment to generate the executable program and dynamic library files of IDPS.
[0042] S170: Call the OTA upgrade interface to install the compiled executable program and dynamic library files onto the corresponding TBOX device via OTA upgrade.
[0043] Specifically, on the component combination management interface, select the corresponding IDPS functional components, vehicle-to-cloud communication components, and device interface components for a certain type of TBOX device. Combine these selected components into a set, and then select the TBOX device that needs to be equipped with the IDPS system and its corresponding configuration file. The configuration file includes some configuration parameters required for IDPS runtime, such as the cloud URL address and the log storage path. Different TBOX devices require additional configuration files in the compilation and file management modules based on their specific needs. When cross-compiling IDPS, select the corresponding configuration file and package it into the generated output.
[0044] Click the "One-Click Package Upgrade" function on the system interface to compile the component set using the selected cross-compilation environment, generating the IDPS executable program and dynamic library files. Then, call the OTA upgrade interface to install the compiled IDPS executable program and dynamic library onto the corresponding TBOX device via OTA upgrade, completing the installation and operation of the IDPS system on the TBOX device.
[0045] It should be noted that this application mainly focuses on the platform-based application of IDPS system in TBOX devices. When IDPS system is installed on other devices such as vehicle infotainment systems and dashboards, the same approach can be used to expand the platform-based functions, without limiting it to TBOX devices.
[0046] This application also provides a vehicle-side intrusion detection and prevention system based on modular management, see [link to relevant documentation]. Figure 3 The system includes: The device interface management module is used to encapsulate the TBOX device interface according to the IDPS interface specification to obtain a device interface component if the TBOX device interface does not conform to the IDPS interface specification; if the TBOX device interface conforms to the IDPS interface specification, the TBOX device interface is used directly.
[0047] The vehicle-to-cloud communication management module is used to manage vehicle-to-cloud communication components and allows for the addition of new vehicle-to-cloud communication components as needed.
[0048] The functional component management module is used to manage IDPS functional components.
[0049] The compilation and file management module selects the corresponding vehicle-to-cloud communication component based on the communication requirements of the TBOX device, and selects the corresponding IDPS function component based on the IDPS function requirements that need to be configured on the TBOX device. It then assembles the device interface component, IDPS function component, and vehicle-to-cloud communication component into a component set, and selects the TBOX device that needs to be equipped with the IDPS system and the corresponding configuration file. Using the selected cross-compilation environment, it compiles the component set to generate the IDPS executable program and dynamic library file. Finally, it calls the OTA upgrade interface to equip the compiled executable program and dynamic library file to the corresponding TBOX device via OTA upgrade.
[0050] Optionally, the device interface management module includes a device interface component adapted to the interface of each TBOX device. The device interface component is the product of encapsulating the TBOX device interface according to the IDPS interface specification. If the TBOX device interface connected to the system conforms to the IDPS interface specification, the TBOX device interface is used directly. If the TBOX device interface connected to the system does not conform to the IDPS interface specification, the device interface component corresponding to the TBOX device is used.
[0051] Optionally, the functional component management module includes: The HIDPS detection component is used to obtain the peripheral status, kernel logs, system logs, critical process status, and system resource usage of the TBOX device based on the device interface component; by analyzing the acquired data, it can promptly detect various intrusions or dangerous behaviors of the TBOX device and generate corresponding alarm logs, which are then sent to the VSOC platform via a communication protocol. The NIDPS detection component is used to obtain network data of the TBOX device based on the device interface component; by analyzing the obtained data, it can promptly detect various intrusion or dangerous behaviors of the TBOX device and generate corresponding alarm logs, which are then sent to the VSOC platform via a communication protocol. The log writing module is used to collect alarm logs and write them locally to disk; the rule loading module is used to read and parse various detection rules.
[0052] Optionally, the compilation and file management module includes: a cross-compilation environment configuration component, used to configure the corresponding cross-compilation environment for each TBOX device that is connected for the first time; and the selection of the cross-compilation environment corresponding to the TBOX device.
[0053] Optionally, the compilation and file management module also includes: a file management component for managing and maintaining IDPS interface specification files, and setting and maintaining configuration files; the configuration files include configuration parameters required for IDPS runtime; and a component combination component for selecting the corresponding vehicle-to-cloud communication component according to the communication requirements of the TBOX device, and selecting the corresponding IDPS function component according to the IDPS function requirements that need to be configured on the TBOX device; combining the device interface component, IDPS function component, and vehicle-to-cloud communication component into a component set, and selecting the TBOX device that needs to be equipped with the IDPS system and the corresponding configuration file.
[0054] Optionally, the compilation and file management module also includes: one-click packaging and upgrading components, which are used to compile the component set using the selected cross-compilation environment to generate the executable program and dynamic library files of IDPS; and calling the OTA upgrade interface to equip the compiled executable program and dynamic library files to the corresponding TBOX device via OTA upgrade.
[0055] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application can be achieved, and this is not limited herein.
[0056] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.
Claims
1. A vehicle-side intrusion detection and defense method based on modular management, characterized in that, include: If the TBOX device interface does not conform to the IDPS interface specification, the TBOX device interface will be encapsulated according to the IDPS interface specification to obtain the device interface component; Select the corresponding IDPS function component based on the IDPS function requirements that need to be configured on the TBOX device; Select the appropriate vehicle-to-cloud communication component based on the communication requirements of the TBOX device; Select the cross-compilation environment for the TBOX device; The device interface component, IDPS functional component, and vehicle-to-cloud communication component are combined into a component set, and the TBOX device that needs to be equipped with the IDPS system and the corresponding configuration file are selected. The selected cross-compilation environment is used to compile the component set to generate the executable program and dynamic library files for IDPS; The OTA upgrade interface is called to install the compiled executable program and dynamic library files onto the corresponding TBOX device via OTA upgrade.
2. The method according to claim 1, characterized in that, Select the appropriate vehicle-to-cloud communication components based on the communication requirements of the TBOX device, including: Select the appropriate vehicle-to-cloud communication component based on the resources and network support of the TBOX device; The vehicle-to-cloud communication components include: an MQTT communication component, a custom protocol component, an HTTPS communication component, and a dedicated TSP communication channel component.
3. The method according to claim 2, characterized in that, Based on the IDPS functionality requirements that need to be configured on the TBOX device, select the corresponding IDPS functionality components, including: Choose either the HIDPS detection component or the NIDPS detection component based on the IDPS functionality requirements of the TBOX device.
4. The method according to claim 3, characterized in that, Select the cross-compilation environment for your TBOX device, including: Configure the corresponding cross-compilation environment for the TBOX device that is being connected for the first time; After the cross-compilation environment is configured, select the corresponding cross-compilation environment and perform one-click compilation to generate an executable program and dynamic library files adapted to the TBOX device.
5. A vehicle-side intrusion detection and prevention system based on modular management, characterized in that, include: The device interface management module is used to encapsulate the TBOX device interface according to the IDPS interface specification if the TBOX device interface does not conform to the IDPS interface specification, thus obtaining a device interface component. The vehicle-to-cloud communication management module is used to manage vehicle-to-cloud communication components; The functional component management module is used to manage IDPS functional components; The compilation and file management module is used to select the corresponding vehicle-to-cloud communication component according to the communication requirements of the TBOX device, and select the corresponding IDPS function component according to the IDPS function requirements that need to be configured on the TBOX device; to form a component set by combining the device interface component, IDPS function component and vehicle-to-cloud communication component, and to select the TBOX device that needs to be equipped with the IDPS system and the corresponding configuration file; and to compile the component set using the selected cross-compilation environment to generate the IDPS executable program and dynamic library file. The OTA upgrade interface is called to install the compiled executable program and dynamic library files onto the corresponding TBOX device via OTA upgrade.
6. The system according to claim 5, characterized in that, The device interface management module includes a device interface component adapted to the interface of each TBOX device. The device interface component is the product of encapsulating the TBOX device interface according to the IDPS interface specification. If the TBOX device interface connected to the system conforms to the IDPS interface specification, the TBOX device interface is used directly. If the TBOX device interface connected to the system does not conform to the IDPS interface specification, the device interface component corresponding to the TBOX device is used.
7. The system according to claim 6, characterized in that, The functional component management module includes: The HIDPS detection component is used to obtain the peripheral status, kernel logs, system logs, critical process status, and system resource usage of the TBOX device based on the device interface component; by analyzing the acquired data, it can promptly detect various intrusions or dangerous behaviors of the TBOX device and generate corresponding alarm logs, which are then sent to the VSOC platform via a communication protocol. The NIDPS detection component is used to obtain network data of the TBOX device based on the device interface component; by analyzing the obtained data, it can promptly detect various intrusion or dangerous behaviors of the TBOX device and generate corresponding alarm logs, which are then sent to the VSOC platform via a communication protocol. The log writing module is used to collect the alarm logs and write them locally to disk; The rule loading module is used to read and parse various detection rules.
8. The system according to claim 7, characterized in that, The compilation and file management module includes: The cross-compilation environment configuration component is used to configure the corresponding cross-compilation environment for each TBOX device that is connected for the first time; select the cross-compilation environment corresponding to the TBOX device.
9. The system according to claim 8, characterized in that, The compilation and file management module also includes: The file management component is used to manage and maintain IDPS interface specification files, and to set and maintain configuration files; the configuration files include the configuration parameters required for IDPS runtime. The component combination component is used to select the corresponding vehicle-to-cloud communication component according to the communication requirements of the TBOX device, and to select the corresponding IDPS function component according to the IDPS function requirements that need to be configured on the TBOX device; the device interface component, IDPS function component and vehicle-to-cloud communication component are combined into a component set, and the TBOX device that needs to be equipped with the IDPS system and the corresponding configuration file are selected.
10. The system according to claim 9, characterized in that, The compilation and file management module also includes: One-click package upgrade components are used to compile the component set using the selected cross-compilation environment to generate the IDPS executable program and dynamic library files; the OTA upgrade interface is called to equip the compiled executable program and dynamic library files to the corresponding TBOX device via OTA upgrade.