AUTOSAR IDS event simplified reporting method based on IDSM Lib

Abstract

The application discloses an AUTOSAR IDS event simplified reporting method based on IDSM Lib, an IDSM Lib module is configured between a third-party IDS / IDPS sensor and an AUTOSAR IDSM, the third-party IDS / IDPS sensor constructs safety event information according to detected safety event data and reports the safety event information to the IDSM Lib module, the safety event information comprises a safety event ID, optional context data and context data length, the IDSM Lib module supplements the received safety event information, and then reports the safety event information to the AUTOSAR IDSM. The application configures the IDSM Lib module between the third-party IDS / IDPS sensor and the AUTOSAR IDSM, provides a simplified event reporting mode for the third-party IDS / IDPS sensor without changing an AUTOSAR intrusion detection protocol and an IDSM working mechanism, so that the implementation difficulty and system integration cost of the third-party safety module accessing the AUTOSAR IDS architecture are reduced.

Description

Technical Field

[0001] This invention belongs to the field of automotive network security technology, and more specifically, relates to a simplified AUTOSAR IDS event reporting method based on IDSM Lib. Background Technology

[0002] As automotive electronic and electrical architecture evolves towards centralization, domain control, and connectivity, in-vehicle Ethernet, remote communication interfaces, and various external connectivity capabilities are gradually being introduced into vehicles. This leads to a continuous increase in network attack and system security risks faced by vehicles during operation. To promptly detect and respond to abnormal communication behavior, unauthorized access, and potential attacks, in-vehicle intrusion detection systems (IDS) are gradually becoming one of the important security mechanisms for intelligent connected vehicles.

[0003] AUTOSAR (Automotive Open System Architecture) is a standardized and open automotive electronic software architecture and development standard jointly developed by the global automotive industry. It includes specifications for intrusion detection systems specifically for in-vehicle cybersecurity scenarios, primarily comprising two categories:

[0004] Specification of Intrusion Detection System Protocol (PRS): Defines the communication protocol and data format for security events within and between vehicle systems;

[0005] Specification of Intrusion Detection System Manager (SWS): Defines the behavior of the Intrusion Detection Management System (IDSM) in receiving, managing, filtering, caching, and reporting security events.

[0006] According to the AUTOSAR specification, an automotive IDS architecture typically consists of a security event generator (IDS Sensor), a security event management unit (IDSM), and an event reporting unit. The IDS sensor is responsible for detecting security anomalies and generating security events, while the IDSM manages the events uniformly and sends the processed events to the backend system according to the protocol format.

[0007] However, in practical engineering applications, the sources of IDS sensors are significantly diverse. Besides the software components running within the AUTOSAR platform, a large number of security detection functions are implemented by third-party IDS or IDPS (Intrusion Detection and Prevention System) modules, such as network intrusion prevention systems, communication firewalls, and abnormal traffic detection modules. These third-party security modules typically run in independent environments, lacking the AUTOSAR basic software environment and not directly supporting the IDSM interface and intrusion detection protocols defined by AUTOSAR.

[0008] According to the AUTOSAR standard, when reporting security events to the IDSM, IDS sensors need to provide or cooperate in generating multiple pieces of information, including security event identifiers, instance identifiers, event counts, timestamps, context data, and protocol control fields. The event structure is complex, and the interface implementation requirements are high. For third-party IDS sensors that do not run AUTOSAR, directly implementing the above interfaces is not only costly to develop, but also involves high system integration complexity, making it difficult to implement quickly in engineering projects. Summary of the Invention

[0009] The purpose of this invention is to overcome the shortcomings of the prior art and provide a simplified event reporting method for AUTOSAR IDS based on IDSM Lib. By configuring an IDSM Lib module between third-party IDS / IDPS sensors and AUTOSAR IDSM, a simplified event reporting method is provided for third-party IDS / IDPS sensors without changing the AUTOSAR intrusion detection protocol and IDSM working mechanism. This reduces the implementation difficulty and system integration cost of third-party security modules accessing the AUTOSAR IDS architecture.

[0010] To achieve the above-mentioned objectives, the simplified AUTOSAR IDS event reporting method based on IDSM Lib of this invention includes the following steps:

[0011] S1: Configure the IDSM Lib module between the third-party IDS / IDPS sensor and AUTOSAR IDSM to collect in-vehicle safety events sent by the third-party IDS / IDPS sensor and report them to AUTOSAR IDSM after simplification;

[0012] S2: The third-party IDS / IDPS sensor constructs security event information based on the detected security event data, including security event ID, context data and context data length. The security event ID is a required parameter, while the context data and context data length are optional parameters. Then, the event information is reported to the IDSM Lib module.

[0013] S3: After receiving security event information sent by a third-party IDS / IDPS sensor, the IDSM Lib module completes the security event information according to the interface requirements of AUTOSAR IDSM.

[0014] S4: The IDSM Lib module will report the completed security event information to AUTOSAR IDSM.

[0015] This invention provides a simplified AUTOSAR IDS event reporting method based on IDSM Lib. An IDSM Lib module is configured between a third-party IDS / IDPS sensor and AUTOSAR IDSM. The third-party IDS / IDPS sensor constructs security event information based on the detected security event data and reports it to the IDSM Lib module. The security event information includes the security event ID, context data, and context data length. The IDSM Lib module completes the received security event information and then reports it to AUTOSAR IDSM.

[0016] The present invention has the following beneficial effects:

[0017] 1) In this invention, the IDSM Lib module provides a simplified security event reporting interface for third-party IDS / IDPS sensors, which can avoid third-party components from directly relying on the AUTOSAR IDSM interface and effectively reduce transmission overhead and reduce the access cost of third-party IDS / IDPS sensors;

[0018] 2) In this invention, the IDSM Lib module automatically completes the security event information fields required by AUTOSAR IDSM before reporting them to AUTOSAR IDSM, ensuring that the final event format fully complies with the requirements of the AUTOSAR IDS Protocol and IDSM specification.

[0019] 3) This invention achieves centralized protocol management through the IDSM Lib module, which can effectively improve the system consistency of security incident reporting;

[0020] 4) This invention can be widely applied to systems such as vehicle network IDPS, domain controller security monitoring modules, smart gateway security protection modules, AUTOSAR and non-AUTOSAR hybrid systems, and OEM / Tier-1 security architecture integration sites, and has significant engineering application value. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating a specific implementation of the simplified AUTOSAR IDS event reporting method based on IDSM Lib according to the present invention.

[0022] Figure 2 This is a system architecture diagram of the present invention;

[0023] Figure 3 This is a flowchart for completing security event information in this embodiment. Detailed Implementation

[0024] The specific embodiments of the present invention will now be described with reference to the accompanying drawings to enable those skilled in the art to better understand the invention. It should be particularly noted that in the following description, detailed descriptions of known functions and designs that might obscure the main content of the invention will be omitted here.

[0025] Example

[0026] Figure 1 This is a flowchart illustrating a specific implementation of the simplified AUTOSAR IDS event reporting method based on IDSM Lib according to the present invention. Figure 1 As shown, the simplified AUTOSAR IDS event reporting method based on IDSM Lib of this invention includes the following steps:

[0027] S101: Configure the IDSM Lib module:

[0028] Configure the IDSM Library module between the third-party IDS / IDPS sensors and AUTOSAR IDSM to collect in-vehicle safety events sent by the third-party IDS / IDPS sensors and report them to AUTOSAR IDSM after simplification.

[0029] Figure 2 This is a system architecture diagram of the present invention. For example... Figure 2 As shown, this invention employs a three-layer architecture. The third-party IDS / IDPS sensor layer contains multiple independent IDS / IDPS sensors responsible for collecting vehicle network / ECU security events (such as attack detection, abnormal traffic, and protocol errors). The IDSM Lib module serves as an adaptation layer connecting the third-party IDS / IDPS sensors and the AUTOSAR IDSM. The AUTOSAR IDSM is the central hub of the entire architecture, receiving and processing security event information. This architecture effectively achieves compatible integration between non-AUTOSAR third-party sensors and the AUTOSAR standard security system, retaining the detection capabilities of third-party sensors while complying with AUTOSAR security event processing specifications.

[0030] S102: Third-party IDS / IDPS sensors send security event information:

[0031] Third-party IDS / IDPS sensors construct security event information based on the detected security event data, including security event ID, context data, and context data length. The security event ID is a required parameter, while the context data and context data length are optional parameters. The event information is then reported to the IDSM Lib module.

[0032] Compared to the native AUTOSAR interface, the security event information sent by third-party IDS / IDPS sensors in this invention does not include the sensor instance ID, event count, timestamp, protocol header field, or signature, thus simplifying the structure of the security event information and effectively reducing communication overhead.

[0033] S103: The IDSM Lib module completes security event information.

[0034] In this invention, due to the simplification of security event information sent by third-party IDS / IDPS sensors, in order to adapt to the interface requirements of AUTOSAR IDSM, the IDSM Lib module completes the security event information according to the interface requirements of AUTOSAR IDSM after receiving the security event information sent by the third-party IDS / IDPS sensors.

[0035] Figure 3 This is a flowchart for completing security event information in this embodiment. For example... Figure 3 As shown, the specific method for the IDSM Lib module to complete security event information in this embodiment is as follows:

[0036] S301: Mapped sensor identifier:

[0037] The IDSM Lib module uses a pre-defined algorithm to map and obtain the sensor identifier (SensorInstanceID) of third-party IDS / IDPS sensors. This avoids third-party IDS / IDPS sensors directly managing AUTOSAR instance numbers, improving system security. In practical applications, the IDSM Lib module can set up a sensor identifier mapping table. For each newly connected third-party IDS / IDPS sensor, a sensor identifier is assigned and recorded in the sensor identifier mapping table. After receiving security event information from a third-party IDS / IDPS sensor, the IDSM Lib module retrieves the corresponding sensor identifier from the sensor identifier mapping table.

[0038] S302: Generate event count value:

[0039] The IDSM Lib module maintains an event counter for each security event ID. Each time a security event with the same security event ID is received, the count value of the corresponding event counter is incremented by 1.

[0040] S303: Generate timestamp:

[0041] Determine whether timestamps are enabled in AUTOSAR IDSM. If not, do nothing. Otherwise, the IDSM Lib module generates a timestamp each time it receives a security event message. The timestamp can be generated based on the system clock or the synchronization clock, depending on the actual situation.

[0042] S304: Context data encapsulation:

[0043] The IDSM Lib module extracts the context data length from the received security event information. If the value is greater than 0, a context data frame is generated; otherwise, no action is taken. This operation allows the completed security event information symbols to meet the AUTOSAR IDS Protocol's requirements for event data length and format.

[0044] S305: Complete other information:

[0045] The IDSM Lib module generates protocol header fields and a signature based on the received security event information, thereby obtaining the completed security event information.

[0046] S104: The IDSM Lib module reports security incident information:

[0047] The IDSM Lib module reports the completed security event information to AUTOSAR IDSM.

[0048] In practical applications, the IDSM Lib module can report security event information via UDP or internal communication. Specifically, the IDSM Lib module writes the completed security event information into the security event circular buffer, then periodically schedules the processing of the security event circular buffer, converts the events into qualified / processed security events (QSEvs), and then reports them to AUTOSAR IDSM via the standard IDS Protocol.

[0049] Although the illustrative specific embodiments of the present invention have been described above to enable those skilled in the art to understand the invention, it should be understood that the invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the invention as defined and determined by the appended claims, and all inventions utilizing the concept of the present invention are protected.

Claims

1. A simplified AUTOSAR IDS event reporting method based on IDSM Lib, characterized in that, Includes the following steps: S1: Configure the IDSM Lib module between the third-party IDS / IDPS sensor and AUTOSAR IDSM to collect in-vehicle safety events sent by the third-party IDS / IDPS sensor and report them to AUTOSAR IDSM after simplification; S2: The third-party IDS / IDPS sensor constructs security event information based on the detected security event data, including security event ID, context data and context data length. The security event ID is a required parameter, while the context data and context data length are optional parameters. Then, the event information is reported to the IDSM Lib module. S3: After receiving security event information sent by a third-party IDS / IDPS sensor, the IDSM Lib module completes the security event information according to the interface requirements of AUTOSAR IDSM. S4: The IDSM Lib module will report the completed security event information to AUTOSAR IDSM.

2. The simplified AUTOSAR IDS event reporting method according to claim 1, characterized in that, The specific method for completing the security event information in step S3 is as follows: S3.1: The IDSM Lib module uses a preset algorithm to map and obtain the sensor identifier SensorInstanceID of the third-party IDS / IDPS sensor; S3.2: The IDSM Lib module maintains an event counter for each security event ID. Each time a security event with the same security event ID is received, the count value of the corresponding event counter is incremented by 1. S3.3: Determine whether timestamps are enabled in AUTOSAR IDSM. If not, do nothing. Otherwise, the IDSMLib module will generate a timestamp each time it receives a security event message. S3.4: The IDSM Lib module extracts the context data length from the received security event information. If its value is > 0, a context data frame is generated; otherwise, no operation is performed. S3.5: The IDSM Lib module generates protocol header fields and a signature based on the received security event information, thereby obtaining the completed security event information.

3. The simplified AUTOSAR IDS event reporting method according to claim 2, characterized in that, The specific method for sensor identifier mapping in step S3.1 is as follows: the IDSM Lib module sets up a sensor identifier mapping table. For each newly connected third-party IDS / IDPS sensor, a sensor identifier is assigned to it and recorded in the sensor identifier mapping table. After receiving security event information from a third-party IDS / IDPS sensor, the IDSM Lib module retrieves the corresponding sensor identifier from the sensor identifier mapping table.

4. The simplified AUTOSAR IDS event reporting method according to claim 1, characterized in that, The specific method for the IDSM Lib module to report security event information in step S4 is as follows: the IDSM Lib module writes the completed security event information into the security event circular buffer, then periodically schedules and processes the security event circular buffer, converts the event into a qualified / processed security event, and then reports it to AUTOSAR IDSM through the standard IDS Protocol.

Images