Computer-implemented method for configuring a firewall, computer program product, computer-readable storage medium, and vehicle

Abstract

The invention relates to a computer-implemented method for configuring a firewall (1). The firewall (1) filters the network traffic in a computer-supported communication network (2) on the basis of a set of rules defined by the configuration, and the rules in the set of rules are defined on the basis of information relating to at least one computing unit (3) connected to the communication network (2). The firewall (1) is provided by a computing unit (3) connected to the communication network (2). The method according to the invention is characterized by the following steps: a) obtaining network design information (NDI) from at least two computing units (3) connected to the communication network (2), said information describing a permissible network communication within the communication network (2); b) forming a network design summary (NDZ) from a union of the content of at least two pieces of information of the related network design information (NDI); c) deriving the rules from the network design summary (NDZ) in accordance with the permissible network communication and combining the rules in order to form the set of rules; and d) configuring the firewall (1) using the set of rules.

Description

[0001] Computer-implemented method for configuring a firewall, computer program product, computer-readable storage medium and vehicle

[0002] The invention relates to a computer-implemented method for configuring a firewall according to the type defined in more detail in the preamble of claim 1, a computer program product, a computer-readable storage medium storing such a computer program product, and a vehicle.

[0003] With increasing digitalization, the proportion of computer systems in vehicles is also growing. In addition to sensors and actuators, on-board electronics includes a wide variety of computing units for processing corresponding sensor signals, generating control signals, or providing functions. The respective components of the on-board electronics can communicate with each other via a communications network. This involves one or more bus systems, such as a CAN bus, an Ethernet data line, or the like. An in-vehicle computing unit is understood to include, in particular, control units, particularly in the form of a system-on-a-chip (SoC), network devices such as a switch, a central on-board computer, a telecommunications unit, and the like.

[0004] Like any computer-based communications network, in-vehicle communications networks must also be protected against cyberattacks. A first and central component for increasing cybersecurity is the integration of one or more firewalls into the communications network to filter communications. Data packets sent over the communications network are examined by the firewall before being forwarded to a destination address. The firewall then decides, based on defined rules, whether or not the respective data packets should be allowed to pass to the destination address. Data packets to be blocked are discarded by the firewall. Rules used by the firewall can be implemented in the form of a whitelist or blacklist. The whitelist can specify trusted destination addresses, source addresses, data packet contents, services, and the like, in connection with which transmitted data packets are forwarded (routed) by the firewall.Accordingly, the blacklist contains information describing the contexts in which data packets should be prevented from being forwarded to the destination address and discarded. This prevents unauthorized network access.

[0005] A firewall can employ various filtering techniques, such as packet filtering, stateful packet inspection, proxy filtering, content filtering, deep packet inspection, and the like. A firewall can not only monitor communication between the communications network and external devices, such as a mobile network, the Internet, or any wide area network (WAN) other than the communications network, but can also filter communication within the communications network. External communication is possible, for example, via a mobile connection provided by the telecommunications unit or via Bluetooth, Wi-Fi, NFC, and the like. Typically, a separate firewall is implemented in such a telecommunications unit to filter data exchanged via mobile networks.Vehicles can also exchange information with each other via a so-called vehicle-to-vehicle communication interface, or with infrastructure objects via a vehicle-to-X communication interface.

[0006] The topography of in-vehicle communication networks can vary between different vehicles, for example, depending on the vehicle model, the vehicle configuration, particularly taking into account special equipment, the vehicle's production period, and the like. Typically, the network topography is described by the vehicle manufacturer using so-called network design information, also known as "Network Communication Design" (NCD). The NCD defines all communication traffic permitted within the vehicle. Typically, the NCD can be stored in the form of a computer-readable file in every computing unit installed in the vehicle. With advancing development, this inevitably leads to different versions of the NCD being available on the various computing units in the vehicle, each of which differs in its content.

[0007] To define the set of rules to be applied by a firewall, particularly in the form of whitelists or blacklists, the information described by the NCD is typically used. This allows the rules for the firewall to be defined automatically with little human effort. Typically, the set of rules is generated based on the latest version of the NCD. The latest version or newer versions of the NCD do not necessarily have to be compatible with older versions of the NCD. This can lead to a situation where, if only the latest NCD is taken into account to define the set of rules to be used by the firewall, processing units with a communication process based on an older version of the NCD cannot communicate with each other because messages to be exchanged between the processing units were not included in a resulting whitelist.a corresponding entry was incorrectly created in a blacklist.

[0008] If the latest version of the NCD also describes communication that is not actually performed in the vehicle, this can reduce the security of the in-vehicle communication network. This would result in network communication being tolerated that is not actually performed in the vehicle during normal operation. This portion of the unnecessarily permitted network communication could potentially be used for attacks. Furthermore, more hardware resources are required to include larger rule sets in the whitelist, which is inefficient.

[0009] EP 1 615 386 B1 discloses a firewall system, devices integrated into the firewall system, and a method for updating the rules applied by the firewall. The firewall is used to monitor network traffic within a home network. End devices such as a television, a hi-fi system, a smartphone, a desktop computer, and the like are integrated into the home network. Mobile devices, such as the aforementioned smartphone, can also be operated at a distance from the home network. The firewall is integrated into the home network and, if implemented centrally, runs the risk of not being able to monitor the aforementioned mobile device. The firewall system disclosed in the document provides for the provision of a distributed firewall so that a corresponding firewall component can also be executed on the mobile device in order to protect it when operated outside the home network.To generate these firewall rules, security policies are stored on each device. These security policies include global security rules, a list of members of the communication network and their connection status, and a list of locally connected services. If changes occur in the communication network, these security policies can be updated, thus adapting the respective filter created by the firewall.

[0010] A method for updating the rules applied by a firewall is also known from US 8,549,609 B2. The method disclosed in this document addresses the problem that when using IPv6 addresses, the IP address of a device can change dynamically, whereas with IPv4 addresses they are static. This leads to the risk that an unauthorized device could assume the IP address of an authorized device, which would enable extensive network communication with the unauthorized device. To prevent this, the document describes the dynamic adaptation of the IP addresses stored in the firewall's rules. If a corresponding address change occurs in the underlying communications network, this is automatically detected and the rules adjusted accordingly.

[0011] The present invention is based on the object of providing an improved computer-implemented method for configuring a firewall, which involves little effort and at the same time enables the maintenance of cyber security while ensuring reliable communication between the participants of the communication network.

[0012] A generic computer-implemented method for configuring a firewall, wherein the firewall filters the network traffic in a computer-supported communications network based on a set of rules defined by the configuration, wherein rules for the set of rules are determined as a function of information held on at least one computing unit connected to the communications network, and wherein the firewall is provided by a computing unit connected to the communications network, is further developed according to the invention by the following method steps: a) obtaining network design information introduced into at least two computing units connected to the communications network, describing a permissible network communication within the communications network; b) forming a network design summary from a union of the content of at least two of the obtained network design information items;c) Deriving the rules from the network design summary in accordance with the permitted network communication and aggregating the rules into the rule set; and d) Configuring the firewall with the rule set.

[0013] The network design information stored on the various computing units connected to the communications network may differ in version and thus contain different content. By forming the union of the respective contents of the considered network design information, it is possible to combine the content of differently versioned network design information. Content is included in the network design summary as soon as it appears in at least one of the considered network design information or in several network design information items. This prevents the rules required to maintain communication between the computing units in the communications network from being ignored, as would be the case if only the most recent version of the network design information were considered.This allows the communication network to be secured through the use of the firewall, while at the same time ensuring reliable network communication.

[0014] The network design information can be retrieved from the other computing units by a computing unit integrated into the communications network. This computing unit can also be a network device such as a switch. To address the respective computing units, connection information may be required that describes which computing unit can be contacted and how, for example, including a network address, a port number, and the like. The connection information can be implemented in the form of a computer-readable file in a respective computing unit. The connection information can also be derived from the network design information itself. A network device can, for example, use a port scan to determine which computing units are connected to which network port.The network design information can also be combined externally to the communications network to create a network design summary. For this purpose, the respective differently versioned network design information implemented on the computing units can be stored on a central data storage device, for example, a hard disk or SSD in a server network. An assignment can also be retrieved by the server network or a developer computer connected to the server network, describing which computing unit integrated into the communications network has which version of the network design information. A server or developer computer can then form the union of the respective network design information, generate the network design summary from it, and also store this in the central data storage device.Such a file can then be made accessible to a processing unit in the communications network, for example, the processing unit providing the firewall in the communications network, so that the processing unit can derive the corresponding rules and thus configure the firewall. It is also conceivable to generate the rules outside the communications network and only introduce the completed rule set into the communications network.

[0015] The network design information describes the permissible network communication, i.e. at least which computing unit is allowed to exchange information with which computing unit, in particular taking into account a port used for communication, a data packet content, a service executed by a computing unit and the like.

[0016] Not all network design information obtained from the respective computing units necessarily needs to be considered to form the network design summary, but at least two. For example, a selection can be made based on a criterion such as the version.

[0017] An advantageous development of the method according to the invention further provides that at least one of the method steps a) to d), preferably all method steps, are carried out by the same processing unit that also provides the firewall. In general, it is possible for different processing units to provide the firewall and execute the method steps a) to d). Individual method steps a) to d) can also be carried out by different processing units, even by one or more processing units external to the communications network, as already explained above. However, in order for the firewall to be able to filter network traffic, a processing unit providing the firewall must necessarily be connected to the communications network.If the computing unit that also provides the firewall carries out the method steps a) to d), the generated rule set does not have to be sent to the respective computing unit via the communication network, which reduces the latencies when executing the method according to the invention.

[0018] A firewall can generally be implemented using dedicated hardware and / or software components. It can also be a pure software solution. Such a firewall program can even run in a virtual machine.

[0019] A program used to configure the firewall can also be programmed on a processing unit external to the communications network based on the rule set, and the finished program can then be uploaded to a processing unit internal to the communications network. In a broader sense, this would configure the firewall outside the communications network. Performing steps a) to d) also allows for subsequent reconfiguration of the firewall.

[0020] According to a further advantageous embodiment of the method according to the invention, properties of the respective network design information obtained from the computing units are determined, and only such network design information whose properties meet a specified criterion is used to form the network design summary. This ensures that only the content of network design information that is actually desired is used to derive the rules. In particular, outdated network design information could describe network communication that is no longer permissible at the current time. Accordingly, it must be prevented that such impermissible network communication processes are used to configure the firewall. This is possible by taking the properties of the network design information into account.The properties of the network design information can be described, for example, in the metadata of a respective file. These properties can include, for example, a file size, a file type, a timestamp, a version number, a developer, a computer system or computer network in which the respective file was created, and the like.

[0021] Different boundary conditions can then be defined for different properties, which specify under which conditions a particular network design information should or should not be considered when forming the union. To verify this, a particular property is compared with a predefined criterion for that property.

[0022] Preferably, network design information is used to form the network design summary if:

[0023] - a version of the respective network design information is more recent than a specified version threshold; or

[0024] - an implementation timestamp of the respective network design information, describing a time of introduction of the network design information on the computing unit, is younger than a specified implementation timestamp threshold.

[0025] By considering a specific version or version number of the network design information, it is particularly easy, reliable, and easily traceable to determine which network communication is permitted and which is not in the underlying communication network. This allows developers to check the content of the different versions of the network design information and compare them with the topography or intended use of the underlying communication network. This allows developers to decide which network design information is suitable for the communication network and which is not. Accordingly, developers can manually set the version threshold for the respective application and transmit it accordingly to the processing unit that executes at least process step b).

[0026] Instead of the version number or a version identifier, a time factor can also be used to differentiate between network design information to be considered and network design information to be ignored. For example, an entry can be added to the metadata of the network design information that describes the current point in time at which the respective network design information was introduced into the respective computing unit. The introduction time can be a date, for example. The introduction time can also include a time. This can reduce the effort required by developers. For example, it can be the case that respective developers know that only network design information that was released after the introduction time should be considered. This saves developers the time and effort of first comparing the contents of differently insured network design information.

[0027] Preferably, the specified version threshold is determined by:

[0028] - a fixed number of versions to be considered, starting with the current version and counting backwards depending on the version; or

[0029] - the versions of the network design information released within a specified period, in particular a rolling period running backwards from the current point in time with a specified period of consideration.

[0030] This makes it particularly easy for developers to specify which past versions of the network design information should be considered when deriving firewall rules, if the selection of the respective network design information is based on the version. In the simplest case, developers can, for example, specify that the most recent two, three, or four versions of the network design information should be considered. This is a "first in, first out" approach.

[0031] It is also possible to specify the network design information to be considered based on a time frame. This allows all versions released or published within the specified period, for example, within the last quarter of the previous year, to be considered for the network design summary. A rolling period is preferably defined, starting with the current time and running backward, taking into account all versions of the network design information released within the period.

[0032] A further advantageous embodiment of the method according to the invention further provides that, if two pieces of network design information considered to form the network design summary contradict each other in at least one aspect of the permissible network communication, a rule relating to the aspect is determined in agreement with a standard response. Generally, it is possible that network design summaries of different versions may also contradict each other. For example, two differently versioned network design summaries for a specific computing unit may contain a different communication destination for a specific message. Furthermore, a specific message type could be enabled for data forwarding in one network design summary and prohibited in another version of a network design summary.

[0033] If such inconsistencies are discovered, there are generally various ways to handle them. For example, all aspects of permissible or impermissible network communication for which a contradiction is identified can be discarded. This means that no rules for the corresponding aspect are included in the network design summary. Alternatively, the specification of the network design summary with the most recent version could be considered, and statements from older versions could be ignored. Instead of using the most recent version of a network design summary, it is also conceivable for a developer to manually specify which version of the network design summary should take precedence.In order to ensure maximum cybersecurity, it may also be possible to implement the strictest rules that arise in each case, i.e. in case of doubt, if there is a contradiction, the corresponding network communication is blocked instead of being released.

[0034] Taking into account the operational constraints of the communication network, such as the network topography or the context in which the communication network is embedded, different standard reactions can also be defined for different cases.

[0035] According to a further advantageous embodiment of the method according to the invention, the firewall filters network traffic in a vehicle-integrated communications network based on the configuration with the rule set. This allows the compliant operation of the vehicle to be reliably maintained while maintaining cybersecurity.

[0036] According to the invention, a computer program product comprises computer-interpretable instructions which, when executed by a processor, enable a computing unit to execute a method described above. The computer program product can be a standalone program or embedded in a program, for example, in firewall software, firmware, a BIOS, an application program, or the like.

[0037] According to the invention, a computer-readable storage medium comprises said computer program product. The computer-readable storage medium is preferably integrated into a processing unit of the communications network. The firewall can be executed on a first processing unit and configured by a second processing unit. The firewall and the firewall configuration can also be implemented by one and the same processing unit, particularly in the form of a network device.

[0038] According to the invention, a vehicle comprises at least one computing unit having at least read access to a computer-readable storage medium described above. The vehicle can be any road vehicle such as a car, truck, van, bus, or the like. Generally, it could also be a rail vehicle, watercraft, or aircraft. Through read access to the computer-readable storage medium, the computing unit is able to provide the method according to the invention, i.e., to generate the said rule set from the network design summary and thus to configure the firewall.

[0039] Further advantageous embodiments of the method according to the invention for configuring the firewall also emerge from the exemplary embodiments which are described in more detail below with reference to the figures.

[0040] Showing:

[0041] Fig. 1 is a schematic representation of a computer-based communication network whose network traffic is filtered by a firewall configured according to a method according to the invention;

[0042] Fig. 2 is a schematic representation of the overlapping content of differently versioned network design information; and

[0043] Fig. 3 is a schematic representation of a selection process of the network design information to be considered to generate a network design summary.

[0044] Figure 1 shows a highly schematic representation of a communications network 2 comprising multiple computing units 3 that are communicatively interconnected via a data line 5. A firewall 1 is implemented on or provided by one of these computing units 3, particularly in the form of a network device. The communications network 2 is particularly preferably integrated into the vehicle. The computing units 3 can be, for example, the control units of vehicle subsystems, a central on-board computer, a telecommunications unit, and the like. Such a computing unit 3 can, for example, be embodied by a system-on-a-chip (SoC).

[0045] As the development of the vehicle or the on-board electronics progresses, the topography of the communication network 2 or the communication flow via the communication network 2 may change. Depending on the type and nature of the functionalities provided by the computing units 3 and the services used, it may be necessary to adapt the communication between the computing units 3. The permissible network communication is described by so-called network design information NDI. The network design information NDI can, for example, have been specified by the vehicle manufacturer during development and implemented in the form of a computer-readable file in the respective computing units 3. Due to said changes, the network design information NDI is versioned. Different computing units 3 may have different versions of the network design information NDI, which is indicated by different hatching.

[0046] To configure the firewall 1, the network communication described by the network design information NDI is automatically read by a program and rules are derived therefrom to determine a rule set for configuring the firewall 1. However, considering only the most current version of the network design information NDI, this could result in at least some messages exchanged between the computing units 3 not reaching their actual intended destination, since a desired network communication is missing in the most current version of the network design information NDI. To solve this problem, a computer-implemented method according to the invention is used for configuring the firewall 1.The idea is to compare the respective differently insured network design information NDIs from the respective computing units 3 and to form a network design summary NDZ from a union of the contents of the network design information NDIs. Figure 2 shows the corresponding overlap set of the differently insured network design information NDIs for four differently insured network design information NDI-1 to NDI-4. Thus, the network design summary NDZ incorporates all contents of the respective network design information NDI-1 to NDI-4 that appear in at least one of these network design information NDIs. This reliably ensures that all relevant permissible network communications are taken into account for deriving the rules for Firewall 1.

[0047] This raises the question of how many or which of the different versions of the network design information (NDI) should be considered when generating the network design summary (NDZ). For example, a certain number of different versions of the network design information (NDI) can be considered. A time aspect could also be considered, such as the number of network design information (NDI) released within a specific period.

[0048] Figure 3 shows a preferred embodiment in which all network design information NDI released within a sliding consideration period 4 is taken into account, in this case the network design information NDI-2, NDI-3, NDI-4, and NDI-5. The sliding consideration period 4 begins at the current time t and extends back into the past with a situation-specifically definable consideration period Δt.

[0049] If no new version of the Network Design Information (NDI) has been released within rolling consideration period 4, the most recent version can be used.

[0050] It may also happen that contradictions occur in different versions of the network design information (NDI). In this case, a standard response can be performed to derive rules for Firewall 1, such as considering the content of the network design information (NDI) with the most recent version, preventing the network communication described by the respective aspect, ignoring the respective aspect, and the like.

[0051] Using the method according to the invention, the firewall 1 can be configured particularly reliably, quickly, and easily. Using the firewall 1 improves the cybersecurity of the communications network 2. At the same time, reliable data exchange between the computing units 3 is ensured, since even older, approved network communications are implemented using appropriate rules.

Claims

Patent claims 1. A computer-implemented method for configuring a firewall (1), wherein the firewall (1) filters the network traffic in a computer-supported communications network (2) based on a set of rules defined by the configuration, and wherein rules for the set of rules are defined as a function of information held on at least one computing unit (3) connected to the communications network (2), and wherein the firewall (1) is provided by a computing unit (3) connected to the communications network (2), characterized by the following method steps: a) obtaining network design information (NDI) introduced into at least two computing units (3) connected to the communications network (2), describing a permissible network communication within the communications network (2);b) forming a network design summary (NDZ) from a union of the contents of at least two of the obtained network design information (NDI); c) deriving the rules from the network design summary (NDZ) in accordance with the permitted network communication and summarizing the rules to form the rule set; and d) configuring the firewall (1) with the rule set.

2. Method according to claim 1, characterized in that at least one of the method steps a) to d), preferably all method steps, are carried out by the same computing unit (3) which also provides the firewall (1).

3. Method according to claim 1 or 2, characterized in that properties of the respective network design information (NDI) obtained from the computing units (3) are determined, and only such network design information (NDI) whose properties meet a specified criterion is used to form the network design summary (NDZ).

4. Method according to claim 3, characterized in that a network design information (NDI) for forming the Network Design Summary (NDZ) is used when: - a version of the respective Network Design Information (NDI) is more recent than a specified version threshold; or - an implementation timestamp of the respective network design information (NDI), describing a time of introduction of the network design information (NDI) on the computing unit (3), is more recent than a specified implementation timestamp threshold.

5. Method according to claim 4, characterized in that the specified version threshold is determined by: - a fixed number of versions to be considered, starting with the current version and counting backwards depending on the version; or - the versions of the Network Design Information (NDI) released within a specified period, in particular a rolling period (4) running backwards from the current point in time (to) with a specified consideration period (at).

6. The method according to any one of claims 1 to 5, characterized in that, if two items of network design information (NDI) taken into account to form the network design summary (NDZ) contradict each other in at least one aspect of the permissible network communication, a rule relating to the aspect is determined in agreement with a standard response.

7. Method according to one of claims 1 to 6, characterized in that the firewall (1) filters the network traffic in a vehicle-integrated communication network (2) based on the configuration with the rule set.

8. Computer program product, characterized by computer-interpretable instructions which, when executed by a processor, enable a computing unit (3) to carry out a method according to one of claims 1 to 7.

9. A computer-readable storage medium characterized by a computer program product according to claim 8.

10. Vehicle, characterized by at least one computing unit (3) having at least read access to a computer-readable storage medium according to claim 9.

Images