Ethernet communications network with multiple security procedures

Abstract

The invention relates to a method for processing data packets in an Ethernet network. The method is implemented in a switch storing at least one first identifier of at least one virtual LAN in association with a first point-to-point security procedure, and storing a second identifier of a virtual LAN with a second end-to-end security procedure. The method comprises receiving (201) a data packet and detecting (202) an identifier of at least one virtual LAN in the received data packet. Then, a data link layer security procedure is selected (203) from the first and second procedures, depending on the determined virtual LAN identifier. The data packet is processed (204) according to the selected security procedure. FIG. 2

Description

Title of the invention: Ethernet communications network with multiple security procedures

[0001] The present invention belongs to the field of communication networks, in particular Ethernet networks.

[0002] It is particularly advantageous in the context of use in a vehicle comprising several units capable of exchanging data and associated respectively with different communication functions of the vehicle.

[0003] The term “vehicle” means any type of vehicle such as a motor vehicle, a moped, a motorcycle, a warehouse storage robot, etc.

[0004] In communication networks, it is desirable to allow at least some of the exchanges to be secured, in order to prevent their understanding by a third party who would intercept such exchanges.

[0005] For this purpose, Ethernet networks may provide cryptographic security protocols such as TLS, for "Transport Layer Protocol".

[0006] However, as its name indicates, such a protocol is associated with the transport layer, i.e. layer 4 of the OSI model, which implies that the protocol consumes a lot of computing resources and requires a delay for the establishment of a connection.

[0007] Thus, TLS is not suitable for many functions of a motor vehicle, which require real-time data exchange.

[0008] Furthermore, TLS does not protect layer 2 traffic of the data link layer, also called the MAC layer.

[0009] A Layer 2 security solution is known, and is called MACSec, or "MAC Security", corresponding to the IEEE 802.1AE standard. This solution is designed for Layer 2 encryption and ensures data confidentiality and integrity in a connectionless mode.

[0010] However, MACSec requires prior configuration according to a point-to-point or end-to-end mechanism.

[0011] However, in a vehicle, an Ethernet network can include both point-to-point links and end-to-end links, which makes it impossible to use MACSec, since the configuration according to an end-to-end mechanism or according to a point-to-point mechanism would be inoperative for some of the links.

[0012] There is therefore a need to protect layer 2 exchanges in a communication network, comprising both point-to-point and layer 2 exchanges. end-to-end, particularly in an automotive Ethernet communication network.

[0013] To this end, a first aspect of the invention relates to a method for processing data packets in an Ethernet communication network comprising communication units, the method being implemented in a switch of the communication network, the switch storing at least a first identifier of at least one virtual local area network in association with a first point-to-point data link layer security procedure, and storing at least a second identifier of at least one virtual local area network with a second end-to-end data link layer security procedure, the method comprising the following steps: - receiving a data packet; - detection of an identifier of at least one virtual local access network in the received data packet; - selection of a data link layer security procedure from the first security procedure and the second security procedure, depending on the determined virtual local access network identifier; - processing of the data packet according to the selected security procedure.

[0014] Thus, the switch is capable of applying a data link security procedure adapted to the virtual local access network in which the data packet is exchanged. This makes it possible to secure Layer 2 exchanges in a communication network hosting several virtual local access networks and implementing several types of links.

[0015] According to embodiments, the processing based on the first securing procedure may include checking a first security element of the data packet received on an input port of the switch and replacing the first security element with a second security element in the data packet before transmission to a destination unit via an output port of the switch.

[0016] Thus, the switch placed in intercept between a source unit and a destination unit makes it possible to secure a point-to-point data link. Such a security procedure can also allow for deep packet inspection (DPI).

[0017] According to embodiments, the processing according to the second securing procedure may include a transmission without modification of the data packet to a packet recipient unit by the switch.

[0018] Thus, the switch allows the data packet to be routed within the local network Virtualization is avoided when not necessary, resulting in lower latency in packet transfer and reduced switching processing resources. This optimizes data packet security within the Ethernet communication network.

[0019] According to embodiments, at least one of the first and second identifiers may include an identifier of a virtual local area network group.

[0020] A switch can indeed be responsible for forwarding packets in several virtual local area networks (VLANs) using the same Layer 2 security procedure. The same identifier can thus be used to designate a group of VLANs with the same security procedure, which simplifies the processing of the data packet by the switch. This is because switches generally have limited computing resources.

[0021] According to some embodiments, the payload of the data packet can be encrypted, and the identifier of at least one virtual local network can be detected in a header of the data packet.

[0022] Thus, the identification of the virtual local network is facilitated for the switch.

[0023] According to embodiments, the first and second security procedures may be MACSec procedures according to the IEEE 802.1AE model.

[0024] Such procedures make it possible to secure layer 2 links and are compatible with Ethernet communication networks.

[0025] In addition, the data packet header may have a format defined by a Wide Area Network, WAN, mode of the IEEE 802.1AE model.

[0026] Thus, this embodiment makes it possible to take advantage of existing security procedures, and to apply several of these procedures in a differentiated manner in the same Ethernet communication network.

[0027] According to embodiments, the Ethernet communication network may include communication units of a motor vehicle, in which the switch is integrated into one of the communication units of the Ethernet communication network.

[0028] The invention is indeed particularly advantageous in the case of an Ethernet communication network of a motor vehicle, since the control units of such a motor vehicle perform very different functions requiring links of different types, and therefore different security procedures.

[0029] A second aspect of the invention relates to a computer program comprising instructions for implementing the method according to the first aspect of the invention, when these instructions are executed by a processor.

[0030] A third aspect of the invention relates to a switch of an Ethernet communication network comprising communication units, the switch including: - a memory storing at least a first identifier of at least one virtual local area network in association with a first point-to-point data link layer security procedure, and storing at least a second identifier of at least one virtual local area network with a second end-to-end data link security procedure; - an interface for receiving a data packet; - a processor configured to detect an identifier of at least one virtual LAN in the received data packet, to select a data link layer security procedure from the first security procedure and the second security procedure, depending on the detected virtual LAN identifier and to process the data packet according to the selected security procedure.

[0031] Other features and advantages of the invention will become apparent from an examination of the detailed description below, and the accompanying drawings in which:

[0032] [Fig-1] illustrates a communication network according to one embodiment of the invention;

[0033] [Fig.2] is a diagram illustrating the steps of a data packet processing method according to embodiments of the invention;

[0034] [Fig.3] illustrates a data packet structure according to embodiments of the invention;

[0035] [Fig.4] illustrates the structure of a switch according to embodiments of the invention.

[0036] Fig. 1 presents an Ethernet 100 communication network according to an embodiment of the invention.

[0037] In the following, the network 100 is considered to be integrated into a motor vehicle, for illustrative purposes only. The network 100 can, however, be integrated into any other equipment or system comprising several communicating units.

[0038] The network 100 comprises several communication units capable of communicating with each other, in particular via Ethernet links. There are no restrictions on the number of communication units or their types.

[0039] Indeed, each communication unit can be associated with a given function, such a function implying given requirements in terms of latency in data transmission and / or in terms of criticality associated with data security.

[0040] An example with eight communication units and three types of communication units is shown in [Fig. 1], for illustrative purposes only. It will be understood that the invention applies to any communication network comprising several communication units of at least one type.

[0041] Thus, the network of [Fig. 1] may include a telematics control unit 101, or TCU, which allows, in a motor vehicle, the connection of the vehicle to remote, cloud-type servers, or to other vehicles via V2X standards on a cellular network. For example, the telematics control unit 101 may be capable of connecting network 100 to a first cloud-type server 105.1, which may be a server of the vehicle manufacturer capable of providing a first set of services. In addition, the telematics control unit 101 may be capable of connecting network 100 to a second cloud-type server 105.2, of another service provider, capable of providing a second set of services.

[0042] The network of [Fig.1] may also include high-performance computer-type electronic control units, or HPC ECU units for "High Performance Computing Electronic Control Unit", comprising a first HPC ECU unit 102.1, a second HPC ECU unit 102.2 and a third HPC ECU unit 102.3.

[0043] The first HPC unit ECU 102.1 can be connected to the TCU unit 101 by a physical Ethernet link represented by dotted lines on [Fig.1].

[0044] Each HPC ECU 102.1, 102.2, and 102.3 can also communicate with one or more zone control units, also called ZCUs (for "Zonal Control Unit"). Network 100 can, in particular, include a first ZCU 103.1, a second ZCU 103.2, a third ZCU 103.3, and a fourth ZCU 103.4.

[0045] Each ZCU unit can be located in a given area of ​​the vehicle, near sensors and actuators of the given area, so as to form a communication gateway and ensure reliable execution of certain vehicle functions.

[0046] Each ZCU unit can communicate with electronic control units 104 of the vehicle via CAN links represented in solid lines on [Fig.1].

[0047] For example, one of the ZCU units may be in charge of the ECUs of a vehicle lighting system, while another ZCU unit may be in charge of the ECUs of a vehicle airbag system. Other ZCU units may be provided to perform other vehicle functions.

[0048] In the example of [Fig.1], the first HPC ECU unit 102.1 can be connected by respective physical Ethernet links to the second ZCU unit 103.2 and to the third ZCU unit 103.3. The second HPC ECU unit 102.2 can be connected by a physical Ethernet link to the first ZCU unit 103.1 and the third HPC ECU unit 102.3 can be connected by a physical Ethernet link to the fourth ZCU unit 103.4.

[0049] In addition, the first HPC ECU unit 102.1 can be connected to the second HPC ECU unit 102.2 and to the third HPC ECU unit 102.3 by two respective physical Ethernet links.

[0050] The network 100 illustrated in [Fig.1] thus forms a centralized electronic E / E electrical architecture used in many motor vehicles.

[0051] Figure 1 thus shows the physical connections between the TCU, HPC ECU, or ZCU units. Each unit may include a processing unit, or CPU, for "Central Processing Unit," which may take the form of a microcontroller, also called an MCU, for Micro-Controller Unit. An MCU is a processing unit on a single integrated circuit that includes a processor, programmable memory, and inputs and outputs. Alternatively, the CPU of each of the TCU, HPC ECU, or ZCU units may be a system-on-chip, or SoC, which is an encapsulation of one or more CPUs, memories, microcontrollers, and / or other components. An SoC is generally used for applications too complex to be performed by a single MCU. An SoC may, in particular, include an operating system, or OS.

[0052] Alternatively, each TCU, HPC ECU or ZCU communication unit may comprise several CPUs.

[0053] The physical Ethernet links presented above are thus established between the CPUs of the TCU, HPC ECU or ZCU communication units.

[0054] In addition, the network 100 includes one or more Ethernet switches which can be integrated into one or more communication units.

[0055] In the example of [Fig.1], an Ethernet switch is integrated into each of the HPC ECU units 102.1, 102.2 and 102.3.

[0056] Thus, a first Ethernet switch 110.1 can be integrated into the first HPC ECU unit 102.1, a second Ethernet switch 110.2 can be integrated into the second HPC ECU unit 102.2 and a third Ethernet switch 110.3 can be integrated into the third HPC ECU unit 102.3.

[0057] The first switch 110.1 can be physically connected by Ethernet links to the second switch 110.2, the third switch 110.3, the CPU of the TCU unit 101, the CPU of the first HPC ECU unit 102.1 and the CPUs of the second and third ZCU units 103.2 and 103.3.

[0058] The second switch 110.2 can be physically connected by Ethernet links to the first switch 110.1, to the CPU of the second HPC unit ECU 102.2 and to the CPU of the first ZCU unit 103.1.

[0059] The third switch 110.3 can be physically connected by Ethernet links to the first switch 110.1, to the CPU of the third HPC unit ECU 102.3 and to the CPU of the fourth unit ZCU 103.4.

[0060] Furthermore, logical links can form virtual local access networks, or VLANs, the principle of which is well known and is not explained further in this detailed description. Switches 110.1 to 110.3 play a central role in the implementation of these VLANs.

[0061] By way of example, the following VLAN networks can be obtained in network 100 of [Fig. 1]: - a first VLAN 1 network linking the TCU unit 101, the first HPC ECU unit 102.1, the second HPC ECU unit 102.2 and the third HPC ECU unit 102.3; - a second VLAN 2 network linking the TCU 101 unit, the first HPC ECU 102.1 unit, the second HPC ECU 102.2 unit and the third ZCU 103.3 unit; - a third VLAN 3 network linking the second HPC ECU 102.2 unit, the third HPC ECU 102.3 unit, the first ZCU 103.1 unit and the fourth ZCU 103.3 unit. Note that data packets circulating through the VLAN 3 network can be forwarded by the first switch 110.1 located in the first HPC ECU 102.1 unit, although the first HPC ECU 102.1 unit is not part of the third VLAN 3 network; - a fourth VLAN 4 network linking the first HPC ECU unit 102.1, the second HPC ECU unit 102.2, the first ZCU unit 103.1, the second ZCU unit 103.2 and the third ZCU unit 103.3; - a fifth VLAN 5 network connecting the first HPC ECU unit 102.1, the third HPC ECU unit 102.3, the second ZCU unit 103.2, the third ZCU unit 103.3, and the fourth ZCU unit 103.4; and - a sixth VLAN 6 network linking the TCU 101 unit to the first HPC ECU 102.1 unit.

[0062] Such VLAN networks are of course given by way of illustration and can more generally link any set of at least two communication units of network 100.

[0063] Figure 2 is a diagram that illustrates the steps of a treatment process Ethernet data packets, according to embodiments of the invention.

[0064] The method is implemented in an Ethernet network switch, such as one of the 110.1 to 110.3 switches previously described with reference to [Fig.1].

[0065] The method according to the invention may include a preliminary step 200, during which the switch implementing the method may store at least one first identifier of at least one virtual local area network (VLAN) in association with a first point-to-point data link layer security procedure, and store at least one second identifier of at least one VLAN with a second end-to-end data link layer security procedure. Optionally, the switch may further store a list of at least one third identifier of at least one virtual local area network, said at least a third identifier designating one or more virtual local area networks for which no security procedure is required.

[0066] There are no restrictions on the format of the first and second identifiers. For example, they could be an alphanumeric identifier uniquely designating a VLAN, such as "VLAN 1" or "VLAN 2," in the example described with reference to [Fig. 1]. Alternatively, at least one of the first and second identifiers could include an identifier for a group of virtual local area networks (VLANs), the group comprising at least two VLANs. Such a group identifier is also called a "mask."

[0067] Storing such identifiers with dedicated security procedures advantageously allows the application of different link layer, or layer 2, security procedures in a communication network, thus enabling the security procedure to be adapted to the specific needs of the units in each virtual local access network or each group of virtual local access networks. For storing such associations, the switch may include non-volatile memory, described later.

[0068] The process then enters a current phase during which at least one data packet is exchanged in the network 100.

[0069] At a step 201, the network switch receives a data packet from a network communication unit 100.

[0070] The data packet received in step 201 may have the format shown in [Fig.3] described later.

[0071] At a step 202, the switch detects, in the received data packet, a virtual local access network identifier VLAN, the data packet being intended to be exchanged between two units of the identified virtual local network, namely a source unit and a destination unit.

[0072] At step 203, from the associations stored at step 200, the switch selects one of the security procedures from the first and second security procedures. Alternatively, the switch can optionally detect that the identified VLAN, or the identified group, corresponds to a VLAN for which no security procedure is required.

[0073] At a step 204, the switch processes the data packet according to the security procedure selected at step 203.

[0074] Thus, if the first point-to-point security procedure is selected in step 203, the processing applied in step 204 may include a check of a first security element of the data packet received on an input port of the communication The switch can perform a change and replace the first security element with a second security element in the data packet before transmission to a destination unit via a switch output port. The first and second security elements can be inserted into a MACsec header field as described later with reference to [Fig. 3]. In addition to verifying the first security element, the switch can decrypt encrypted content of the data packet, such as its payload, using, for example, a first private key shared with the source unit, and then re-encrypt the data packet payload before its transmission to the destination unit, using a second private key shared with the destination unit. Optionally, the switch can also perform a deep packet inspection (DPI) of the packet.

[0075] Conversely, if the second end-to-end security procedure is selected in step 203, the processing applied in step 204 can include unmodified transmission of the data packet to a packet recipient unit via the switch. Therefore, there is no need to verify the MACsec header field containing the security element, decrypt the contents of the data packet, or perform a deep inspection of the data packet.

[0076] Furthermore, some data packet exchanges may not require any security measures, in which case, if it is determined that no security procedure is required in step 203, the data packet is also transmitted without modification to a packet recipient unit. In this case, the data packet may then include a payload that is not encrypted.

[0077] Figure [Fig. 3] illustrates a structure of a data packet 300 according to embodiments of the invention.

[0078] Such a structure corresponds to a MACsec data packet as defined in the IEEE 802.1AE standard. Advantageously, this is the WAN (Wide Area Network) mode of the standard identified above, in which the virtual local access network is identified in clear text. Indeed, such a mode is preferred to the LAN (Local Area Network) mode, in which the VLAN identifier is encrypted with the packet payload, thus complicating the implementation of the steps of the method according to the invention by the Ethernet network switch.

[0079] Data packet 300 may include several header fields 301 to 305, such as: - a DMAC 301 field: address of the recipient unit of the data packet, in particular its MAC address; - a SMAC 302 field: address of the source unit of the data packet, in particular its MAC address; - an 802.1Q 303 field containing an identifier of a virtual local area network (VLAN) or a group of virtual local area networks. This is the field used by the switch in step 202 described previously to detect the VLAN identifier; - a header field, or header, 802.1AE 304 comprising a MAC SEC Ether Type 304.1 field which includes a security element, comprising a TCI / AN 304.2 field, an SL 304.3 field, a packet number 304.4 field and an optional SCI 304.5 field; - an ETYPE 305 field and a payload 306 field, with fields 305 and 306 being encrypted, which secures the transmitted data. Such encryption can be implemented between point-to-point units or between end-to-end units, depending on the security procedure used for the virtual local access network; - an ICV 307 field, comprising an integrity check value, or ICV, for "Identity Check Value" in English; - a CRC 308 field, for cyclic redundancy verification, allowing the detection of transmission errors.

[0080] The TCI / AN 304.2 field refers to label or tag control information of the access network, also called "Tag Control Information" in English.

[0081] The MAC SEC Ether Type 304.1 field includes the security element that is checked by the switch when the first point-to-point security procedure is applied.

[0082] The advantages of the present invention are illustrated below by an example based on the communication units of network 100 described with reference to [Fig.1].

[0083] According to one example, the TCU unit 101 sends a first data packet to the first HPC ECU unit 102.1, via the sixth virtual local access network VLAN 6, and sends a second data packet to the third ZCU unit 103.3 via the second virtual local access network VLAN 2. According to the physical architecture of [Fig. 1], the first data packet is exchanged between the TCU unit 101 and the first HPC ECU unit 102.1 via the first switch 110.1, and the second data packet is exchanged between the TCU unit 101 and the third ZCU unit 103.3 via the first HPC ECU unit 102.1, and therefore also via the first switch 110.1.

[0084] The first switch 110.1 is therefore in interception mode during the communication of the first packet and during the communication of the second packet in network 100.

[0085] In prior art systems, only one security procedure can be deployed in a given network 100, i.e. either a point-to-point security procedure or an end-to-end security procedure.

[0086] If the point-to-point procedure is applied to the entire network 100, the The transmission of the second data packet in the VLAN 2 virtual network is not protected. This is because end-to-end encryption can be performed, and the switch is unable to verify the encryption. Similarly, if end-to-end encryption is applied to the entire 100 network, the transmission of the first data packet is not protected because, in this case, the first switch, 110.1, does not perform a MACsec check of a security element.

[0087] The present invention thus makes it possible to configure each VLAN (Virtual Local Area Network) with a security procedure that is adapted to its needs in terms of latency, security, and also according to the processing capabilities of the switches involved in each VLAN. Protection is thus provided in the example considered above, both for the transmission of the first data packet and for the transmission of the second data packet.

[0088] Figure 4 shows the structure of a network switch 110 according to embodiments of the invention.

[0089] Thus, switches 110.1, 110.2 and 110.3 can correspond to the description given below of switch 110.

[0090] The switch 110 includes a processor 401 configured to communicate unidirectionally or bidirectionally, via one or more buses or via a direct wired connection, with a memory 402 such as a Read Only Memory, ROM, or any other type of memory (Flash, EEPROM, etc.). Preferably, the memory 402 is non-volatile. Alternatively, the memory 402 comprises several memories of the aforementioned types.

[0091] The memory 402 is capable of storing, permanently or temporarily, at least some of the data used and / or generated during the implementation of steps 200 to 204 of the process according to the invention illustrated with reference to [Fig. 2]. In particular, the memory 402 can be capable of storing the associations between the first, second, and optionally third identifiers, and the security procedures, including the first security procedure, the second security procedure, and the absence of a security procedure. Furthermore, the memory can store cryptographic elements such as encryption keys.

[0092] The processor 401 is capable of executing instructions, stored in memory 402, for the implementation of steps 201 to 204 of the process according to the invention, described with reference to [Fig. 2]. Alternatively, the processor 401 can be replaced by a microcontroller designed and configured to perform steps 201 to 204 of the process according to the invention, described with reference to [Fig. 4].

[0093] The switch 110 includes at least one first physical Ethernet interface 403 capable of bidirectional communication with at least one CPU of a communication unit of network 100 and at least one second physical Ethernet interface 404 capable of bidirectional communication with at least one CPU of another communication unit of network 100.

[0094] The switch 110 may further include other interfaces, such as a third physical Ethernet interface 405, capable of communicating with other communication units of the network 100. In particular, the first switch 110.1 may include five interfaces as described above.

[0095] The present invention is not limited to the embodiments described above by way of example; it extends to other variants.

Claims

Demands

1. Method for processing data packets (300) in an Ethernet communication network (100) comprising communication units (101; 102.1-102.3; 103.1-103.4), the method being implemented in a switch (110; 110.1; 110.2; 110.3) of the communication network, the switch storing at least a first identifier of at least one virtual local access network in association with a first point-to-point data link layer security procedure, and storing at least a second identifier of at least one virtual local access network with a second end-to-end data link security procedure, the method comprising the following steps: - receiving (201) a data packet; - detecting (202) an identifier of at least one virtual local access network in the received data packet; - selecting (203) a data link layer security procedure from among the first security procedure and the second security procedure, according to the determined virtual local access network identifier; - processing (204) the data packet according to the selected security procedure.

2. A method according to claim 1, wherein the processing (204) according to the first securing procedure includes a check of a first security element (304.1) of the data packet (300) received on an input port of the switch (110; 110.1; 110.2; 110.3) and a replacement of the first security element with a second security element in the data packet before transmission to a receiving unit via an output port of the switch.

3. A method according to claim 1 or 2, wherein the processing (204) according to the second securing procedure includes an unmodified transmission of the data packet to a packet recipient unit (300) via the switch (110; 110.1; 110.2; 110.3).

4. A method according to any one of the preceding claims, wherein at least one of the first and second identifiers comprises an identifier of a virtual local access network group.

5. A method according to any one of the preceding claims, wherein the payload (306) of the data packet (307) is encrypted, and wherein the identifier of at least one virtual local access network is detected in a header field (303) of the data packet (300).

6. A method according to any one of the preceding claims, wherein the first and second security procedures are MACSec procedures according to the IEEE 802.1AE model.

7. A method according to claims 5 and 6, wherein the data packet header (300) has a format defined by a Wide Area Network, WAN, model of IEEE 802.1AE.

8. A method according to any one of the preceding claims, wherein the Ethernet communication network (100) comprises communication units of a motor vehicle, wherein the switch (110; 110.1; 110.2; 110.3) is integrated into one of the communication units (102.1; 102.2; 102.3) of the Ethernet communication network.

9. Computer program comprising instructions for carrying out the method according to any one of the preceding claims, when such instructions are executed by a processor (401).

10. Switch of an Ethernet communication network (100) comprising communication units (101; 102.1-102.3; 103.1-103.4), the switch (110; 110.1; 110.2; 110.3) comprising: - a memory (402) storing at least a first identifier of at least one virtual local access network in association with a first point-to-point data link layer security procedure, and storing at least a second identifier of at least one virtual local access network with a second end-to-end data link layer security procedure; - an interface (403; 404; 405) for receiving a data packet (300); - a processor (401) configured to detect an identifier of at least one virtual local access network in the received data packet, to select a data link layer security procedure from among the first security procedure and the second security procedure, according to the determined virtual local access network identifier and to process the data packet according to the selected security procedure.

Images