Network systems and vehicles
The network system optimizes data transfer in vehicles by assigning a single firewall device for packet filtering based on processing requirements, addressing inefficiencies in existing systems and improving resource utilization.
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- MERCEDES BENZ GROUP AG
- Filing Date
- 2024-06-17
- Publication Date
- 2026-07-08
AI Technical Summary
Existing network systems in vehicles suffer from inefficient data transfer due to repeated filtering of data packets by multiple firewalls, leading to increased delay and wastage of computing resources.
A network system with integrated firewall functionality that assigns a single network device to filter data packets based on processing requirements and capabilities, eliminating redundant filtering and optimizing resource utilization.
This approach reduces data transfer delay and conserves computing resources by ensuring data packets are filtered by a single firewall, enhancing network efficiency and reducing unnecessary processing loads.
Smart Images
Figure 2026522690000001_ABST
Abstract
Description
Technical Field
[0005] ,
[0001] The present invention relates to a network system of a type more specifically defined in the generic concept of claim 1 and a vehicle including such a network system.
Background Art
[0002] Particularly due to performance improvement and miniaturization at the same time, the proportion of electronic devices in vehicles has been constantly increasing. In this case, the arithmetic units mounted on the vehicle may be configured with different complexities. For example, by using a microcontroller, it is possible to output a control signal for an actuator or read and process a sensor quantity. A microcontroller is often also called a system-on-chip. On the other hand, for more complex tasks, particularly those related to automated driving and autonomous driving, it is necessary to integrate high-performance hardware into the vehicle. It is also possible for a central on-board computer to take over the tasks of a plurality of control devices.
[0003] In this case, the electronic components of the vehicle may depend on each other for data exchange. For this purpose, the electronic components are communicatively connected to each other via appropriate data lines. The data lines can be based on different technologies and communication protocols. At this time, most of the communication is performed via a dedicated bus system such as a CAN bus or Ethernet (registered trademark).
[0004] Information technology systems are always exposed to the risk of security breaches. Therefore, information technology systems should be protected from attacks by appropriate security measures. For this purpose, it is possible to divert countermeasures known and proven from information technology, such as, for example, firewalls, attack detection and defense systems, encryption technologies and the like, for use in vehicles.
[0005] To build an Ethernet network, communicating computing units are interconnected via network devices. Various types of network devices exist, such as repeater hubs, switches, routers, and similar devices. A repeater hub distributes data packets to all network connections, while a switch checks the data packets, identifies the target address specified in the data packet, and forwards the corresponding data packet only through the network connection to which the actual target device is connected.
[0006] In this case, it is known that firewalls are integrated into switches. The corresponding firewall filters data packets that make up network traffic based on predefined rules. This filtering increases the delay in data transfer. Network systems can be arbitrarily complex. In particular, when data packets need to be transferred sequentially through multiple switches to reach each target device, each switch checks the corresponding data packet again, which further increases delay and is unnecessary.
[0007] A method and apparatus for providing a distributed firewall in a network is known from U.S. Patent Application Publication No. 2015 / 0326532. This document describes a group of compute nodes integrated into a single network. Some compute nodes run firewall instances for filtering data packets transmitted over the network. In this configuration, individual firewall instances running on the compute nodes can cooperate as a single large firewall. Since data packets transmitted over the network are forwarded to the corresponding compute nodes, each firewall instance can filter the data packets. However, this can result in a very large amount of data being allocated to individual compute nodes, potentially causing a bottleneck in the data line. In this case, data packets discarded by firewall filtering are unnecessarily transmitted over the network, wasting computing resources. To avoid these problems, the network includes a firewall controller. The firewall controller can create new firewall instances on the network's compute nodes, thus providing more computing capacity to offer firewall functionality. Therefore, data packets can be redirected to these compute nodes, thus avoiding data line bottlenecks. [Overview of the project] [Problems that the invention aims to solve]
[0008] The problem that this invention is based on is to provide an improved network system that operates more efficiently. [Means for solving the problem]
[0009] According to the present invention, this problem is solved by a network system having the features of claim 1. Advantageous embodiments and developments, as well as vehicles equipped with such network systems, will become apparent from the dependent claims.
[0010] A comprehensive network system comprising at least two network devices and at least one communication device for each network device, wherein each communication device is connected to one of the network devices, and each network device is connected to at least one other network device, and each network device has an integrated firewall function for filtering data packets to be forwarded, further comprising a firewall assignment unit, the firewall assignment unit being configured to monitor the network devices and, in accordance with the monitoring results for data packets to be transmitted from a source device to a target device, to determine one of the network devices to filter data packets, and further comprising a firewall assignment unit being configured to identify processing requirements for data packets output by a source device, to identify network device-specific processing capabilities by monitoring the network devices for network devices integrated into a direct network path from a source device to a target device, to compare processing requirements with processing capabilities, and to determine such network devices to filter data packets whose processing capabilities satisfy the processing requirements.
[0011] The network system according to the present invention makes it possible to avoid repeated filtering of data packets by firewalls of network devices along their path from source to target device. Therefore, data packets are filtered by only one network device's firewall. This reduces data transfer delay and saves computing resources on network devices, which can then be used to provide other tasks. As a result, the network system according to the present invention operates more efficiently than solutions known from the prior art.
[0012] Here, the network system can have any topology. Therefore, network equipment can be arranged as a ring, mesh, star, line, tree, or bus, or it may be fully connected.
[0013] To provide firewall functionality, each network device can either utilize existing hardware resources for data packet forwarding or utilize dedicated hardware components that exist solely for providing firewall functionality. Therefore, it is possible to provide existing or separately provided computer-readable storage media containing code blocks that enable firewall functionality to be provided through execution by an existing processor or a separately provided processor.
[0014] Firewall assignment units may also be network devices. However, they may also be more complex computer systems, such as desktop computers, servers, or server clusters.
[0015] A data packet is also called a frame. A data packet can consist of multiple sections. For example, the first section may contain the target address of the target device, and the second section may contain the source address of the source device. Another section may contain, for example, the data type, payload, and checksum. To determine the processing requirements, the firewall assignment unit can read the corresponding data packet and examine each section. Different processing requirements are identified depending on the content. Therefore, for example, the firewall assignment unit can implement a so-called lookup table that describes which processing requirements should be selected for which content in each section of the data packet. The processing requirements can also be determined depending on the size of the data packet, that is, depending on the size of the payload it contains.
[0016] Network devices designated to filter data packets are located on the direct network path from the source device to the target device. This eliminates the need to forward data packets to network devices outside the direct network path, i.e., routing, which would otherwise result in detours and increased latency, thus improving the efficiency of the network system according to the present invention.
[0017] If multiple network devices meet the processing requirements, the firewall assignment unit selects the network device that "best" meets the processing requirements for filtering data packets, which is explained in detail below.
[0018] An advantageous development of the network system according to the present invention is that the firewall assignment unit is further configured to configure the firewall function of network devices integrated into a direct network path from source devices to target devices by assigning rule sets as follows: -Activate the filtering logic of the firewall function of network equipment determined to filter data packets, and - Disable the filtering logic of the firewall function on the remaining network devices.
[0019] This results in particularly efficient operation of the firewall function. Therefore, the firewall function continues to run on individual network devices. Consequently, there is no need to explicitly instantiate, initialize, start, or perform similar operations on the firewall. There is also no need to terminate, disable, or stop the firewall, or the appropriate virtual machine on which the firewall runs. Thus, only the filtering logic of each firewall is adapted to the data packets that are currently to be transmitted. The filtering logic of network devices that should filter data packets is adapted so that the data packets are processed by the firewall. For this purpose, for example, the filtering logic can be adapted so that the unique identifier of the source device, such as the MAC address, is recorded in a so-called blacklist, also known as a negative list, so that all data packets from the source device are filtered. In this case, another filtering logic can also be implemented, for example, allowing some of the data packets from the source device to pass through while discarding others. Conversely, the firewalls of the remaining network devices in the direct network path are adapted accordingly. Therefore, for example, the MAC address of the source device can be recorded in a so-called whitelist, also known as a positive list, so that the data packets are not newly filtered by the remaining network devices.
[0020] Sending firewall configuration files or rule sets is particularly rapid and requires less network throughput, i.e., lower data transmission rates. Since there is no need to start or stop the firewall or virtual machine, the associated time consumption is eliminated. This further improves the efficiency of the network system according to the present invention.
[0021] According to another advantageous embodiment of the network system according to the present invention, the processing requirements and each processing capacity include a risk level, required hardware resources, and / or required CPU performance. Depending on the content of each data packet to be transmitted over the network, different risk levels may exist, different hardware resources may be required, and / or different CPU performance may be required. The risk level depends, for example, on the content of the payload. If the payload is simply information, such as the state of a sensor or vehicle component, a low risk level can be assigned. In contrast, if it is a control signal for operating an actuator, for example, a relatively high risk level can be selected. It is also possible to select a risk level depending on the source or target device. If the target device is a display device that shows information, for example, a low risk level can be selected. In contrast, if the target device is an actuator used for the operation of an automated or autonomous vehicle, a high risk level can be selected.
[0022] Similarly, it is possible to determine various requirements regarding the necessary hardware resources. For example, especially for large data packets or extensive rule sets, there may be a requirement to use such network equipment for filtering data packets, for instance, equipment with a particularly large amount of storage space on a computer-readable storage medium. In particular, this is an associative memory device, also known as a TCAM.
[0023] Similarly, various requirements are imposed on the necessary CPU performance. Therefore, high CPU performance is required to process data packets in a reasonable amount of time, especially for processing large data packets. Smaller data packets require correspondingly lower CPU performance. Here, "CPU performance" is understood as the execution speed of the processor or execution unit of each network device, and is defined, for example, by clock frequency, floating-point instruction executions per second (FLOPS), or similar.
[0024] Another advantageous form of the network system according to the present invention is configured such that the firewall assignment unit is further configured to check the risk level, required hardware resources, and required CPU performance in a stepwise manner according to their relevance, with the risk level having the highest relevance and the CPU performance having the lowest relevance. In particular, when multiple network devices in a direct network path from a source device to a target device generally meet the processing requirements, this makes it possible to select the network device to be ultimately determined more accurately. Thus, it is possible to set predetermined minimum thresholds that must be met for the risk level, hardware resources, and CPU performance. The further away from these thresholds, the "better" each network device meets the processing requirements, and therefore its processing capability becomes "better." Then, focusing particularly on the risk level, then hardware resources, and finally CPU performance, the network device with the best processing capability is selected.
[0025] According to another advantageous form of the network system according to the present invention, the firewall allocation unit is further configured to set the order in which the processing capabilities of network devices are compared with processing requirements according to the arrangement order of network devices in the direct network path from the source device to the target device, in order to compare the processing requirements with the processing capabilities. Thereby, the efficiency of the network system according to the present invention is further improved. At this time, it is not always necessary to specify the processing capabilities of each network device in the direct network path. Since this can be processed iteratively, the processing capabilities of network devices are specified and checked little by little according to the arrangement order. When the first network device that generally meets the processing requirements is found, it is possible to designate the network device to filter data packets. And the "best" network device or firewall function is the network device that meets the processing requirements first and is arranged as far forward as possible in the direct network path. Thereby, it can be achieved that data packet filtering is imposed on the network devices, especially those initially arranged, in the direct network path. Therefore, it is possible to avoid the situation that data packets to be discarded later by filtering are transferred through the network for a longer time, and as a result, the processing load of the network is reduced.
[0026] In another advantageous form of the network system according to the present invention, if no suitable network device is found in the first run-through, the firewall allocation unit further - execute another run-through until a network device whose processing capability meets the processing requirements is found, which is located from the source device to the target device in the direct network path, or - identify the processing capabilities of network devices located away from the direct network path from the source device to the target device, compare the processing capabilities with the processing requirements, and if the processing requirements are met, determine the network device located away from the direct network path for filtering data packets is configured as follows.
[0027] In the first pass of comparing the processing requirements with the processing capabilities of network devices located on the direct network path, if no suitable network device that meets the processing requirements is found, the question becomes how to further proceed with the processing so that data packets can be sent via the data line of the network. Generally, the firewall allocation unit may select a network device that does not meet the processing requirements in order to filter data packets. In such a case, this may cause each network device to operate in an overload mode. Consequently, the delay in transferring data packets increases.
[0028] Preferably, the firewall allocation unit waits until one of the network devices on the direct network path meets the processing requirements. Consequently, an individual network device may be fully utilized by its task. When one of the network devices completes one or more tasks, such as the transfer and / or filtering of other data packets, it is possible to use another resource of that network device to filter the data packets from the source device to the target device. Consequently, the processing requirements may be met at a later point. This requires waiting until a suitable network device can use the free capacity for filtering data packets, thus increasing the delay. However, the associated increase in delay may be less than the increase in delay associated with the decision of a network device that is already fully utilized for filtering data packets.
[0029] If a suitable network device cannot be found along the direct network path within a reasonable time, the firewall assignment unit can also select network devices located off the direct network path for filtering data packets and redirect data packets that should be sent from the source device to the target device over the network. Although this reduces efficiency due to the redirection of data packets, it can, in some cases, shorten the time required to forward data packets to the target device compared to having to wait an unreasonably long time for a network device with sufficient available computing resources along the direct network path.
[0030] In this case, preferably, the firewall assignment unit determines such network equipment to be located away from the direct network path, or at a particularly short distance from the direct network path, so that the redirection of data packets is performed as short as possible relative to the direct network path.
[0031] Preferably, each network device is configured as an Ethernet switch. Since this is a particularly well-established, reliable, and widely used network device, the network system according to the present invention can be implemented easily and inexpensively. The switch is equipped with an Ethernet socket or Ethernet port for network connectivity. Connecting communication devices to the switch is done correspondingly via an Ethernet cable. The topology of the network system according to the present invention may be arbitrary, as already described above, and can be configured as, for example, a ring, mesh, fully connected, line, tree, bus, and similar.
[0032] At least communication devices have a unique identifier. This identifier can define the address of each device in a network system. When using Ethernet switches as network devices, this identifier is specifically the MAC address. Depending on which layer (also called the OSI model) each switch operates at, the switch itself may also have a MAC address.
[0033] Here, the operation of a switch for forwarding data packets, also known as routing, based on the so-called source address table (SAT), is well known to those skilled in the art.
[0034] The vehicle according to the present invention is equipped with the network system described above. The vehicle may be any vehicle such as a passenger car, truck, transporter, or bus. In general, it may also be a railway vehicle, ship, or aircraft.
[0035] Here, preferably, at least one communication device is formed by a microcontroller, microprocessor, vehicle control device, actuator, or sensor. Thus, efficient and protected data traffic is possible via a network system integrated into the vehicle. In this case, the vehicle control device itself can be formed as a so-called system-on-a-chip, that is, it can be configured as a microcontroller or microprocessor itself, or it can include such components.
[0036] Another advantageous configuration of the network system according to the present invention will become apparent from the embodiments described below in more detail with reference to the figures. [Brief explanation of the drawing]
[0037] [Figure 1] This is a schematic diagram of the network system according to the present invention. [Figure 2]This is a schematic diagram of a direct network path from a source device to a target device in a network system. [Figure 3] This is a flowchart of a possible embodiment of a method for filtering data packets using a firewall function, which can be provided by the network system according to the present invention. [Modes for carrying out the invention]
[0038] Figure 1 shows a network system 1 according to the present invention. The network system includes at least two network devices 2 and at least one communication device 3 for each network device 2. The topology of the network system 1 shown in Figure 1 should be understood as merely illustrative. All common network topologies are possible, such as ring topology, star topology, linear topology, and similar ones. Both network devices 2 are in particular Ethernet switches. The communication lines 5 between the network devices 2 and the communication devices 3 connected to them are formed by Ethernet cables. The Ethernet cables are connected to each network connection point (not shown). Such network connection points are also called ports.
[0039] Furthermore, the network system 1 according to the present invention includes a firewall assignment unit, which is not shown in detail. The firewall assignment unit is not shown because it can generally be integrated at any point in the network system 1 according to the present invention. The firewall assignment unit can be connected to at least one arbitrary network device 2 in the network system 1. In particular, the firewall assignment unit can be connected to multiple or all of the network devices 2. The firewall assignment unit monitors the network devices 2 and, depending on the monitoring results, determines which of the network devices 2 will filter data packets that should be sent from source device 3.Q to target device 3.Z as shown in Figure 2.
[0040] For this purpose, each network device 2 is equipped with a firewall module 6 that provides firewall functionality. Such firewalls allow the application of predetermined rules for filtering data packets. Therefore, each network device 2, depending on the firewall settings, allows a subset of data packets to pass through for forwarding and discards the remaining data packets. It is also possible to allow all data packets to pass through or to discard them.
[0041] Each firewall module 6 contains program code, and the execution of this program code enables the provision of firewall functionality by an execution unit contained in each network device 2, such as a processor. The corresponding code block can be stored in the physical storage medium of the network device 2 along with other program code elements. The network device 2 may also include a dedicated storage medium to store the program code portion necessary to form the firewall functionality. Similarly, other execution units or a dedicated execution unit can be used to execute the program code block.
[0042] Network system 1 can have any number of network devices 2, which are indicated by multiple dots "...".
[0043] Figure 2 shows a direct network path 4 from source device 3.Q to target device 3.Z. The direct network path 4 can include at least one network device 2, although there may be any number of such devices. In the embodiment shown in Figure 2, the direct network path 4 includes network devices 2.A, 2.B, 2.X, or another network device 2 indicated by the dots "..." (optional). Each network device 2.A, 2.B, 2.X is connected to source device 3.Q and target device 3.Z via a bidirectional arrow, indicating bidirectional communication. Generally, communication can also be unidirectional.
[0044] Typically, each network device 2.A, 2.B, and 2.X uses the firewall functionality provided by each firewall module 6 to filter data packets sent from source device 3.Q to target device 3.Z. This is unnecessary redundancy. Filtering data packets multiple times is not only unnecessary but also increases data transfer delays and blocks the computing resources of each network device 2, preventing them from being used to process other tasks.
[0045] According to the present invention, the firewall assignment unit determines one of the network devices 2.A, 2.B, or 2.X to which the filtering logic is applied. In the embodiment shown in Figure 2, network device 2.A is selected, and as a result, the remaining network devices 2.B and 2.X allow each data packet to pass to target device 3.Z without filtering.
[0046] To this end, the firewall assignment unit identifies the processing requirements for the data packets to be forwarded and, by monitoring network device 2, identifies the specific processing capabilities of at least the network devices 2.A, 2.B, and 2.X integrated into the direct network path 4, and compares the processing requirements with the processing capabilities. The firewall assignment unit then selects such network device 2.A to filter data packets whose processing capabilities meet the processing requirements.
[0047] Here, Figure 3 shows a possible preferred embodiment of the method flow. The components included in the network system 1 according to the present invention are configured to perform method steps. The methods that can be provided by these method steps are also part of the present invention.
[0048] In step 301 of the method, the firewall assignment unit identifies the processing requirements for each data packet to be forwarded.
[0049] In step 302, the firewall assignment unit determines the processing capabilities that can be provided by each network device 2, in this case network device 2.A, located on the direct network path 4, and compares the processing requirements with the processing capabilities of each device. This is done in step 303 of the method.
[0050] If the processing capacity meets the processing requirements, the firewall allocation unit selects network device 2.A for filtering data packets in step 304. If the conditions are not met, the firewall allocation unit proceeds to the next network devices 2.B, 2.X located in the direct network path 4, where it identifies the corresponding processing capacity and compares it to the processing requirements. In this case, in step 305, the firewall allocation unit identifies each processing capacity. In step 306, the processing requirements are compared to each processing capacity. If the processing requirements are met, the method similarly terminates in step 307 by selecting network device 2.B or 2.X and applying the corresponding filtering logic to the data packets. Otherwise, the firewall allocation unit can wait until the computing resources of any of the network devices 2.A, 2.B, or 2.X are sufficient to meet the processing requirements. For this purpose, the firewall allocation unit can return to step 302, as indicated by the dashed arrow. [Prior art documents] [Patent Documents]
[0051] [Patent Document 1] U.S. Patent Application Publication No. 2015 / 0326532
Claims
1. A network system (1) comprising at least two network devices (2) and at least one communication device (3) for each network device (2), wherein each communication device (3) is connected to one of the network devices (2) to enable indirect exchange of data packets between the communication devices (3) via the network devices (2), and each network device (2) is connected to at least one other network device (2), and each network device (2) is equipped with an integrated firewall function for filtering data packets to be forwarded, and further comprises a firewall assignment unit, the firewall assignment unit is configured to monitor the network devices (2) and, in accordance with the monitoring results for data packets transmitted from a source device (3.Q) to a target device (3.Z), determines which of the network devices (2) to filter the data packets, The network system (1) is characterized in that the firewall assignment unit is further configured to identify processing requirements for data packets output by the source device (3.Q), monitor the network device (2) to identify the processing capabilities specific to at least the network devices (2.A, 2.B, 2.X) integrated into the direct network path (4) from the source device (3.Q) to the target device (3.Z), compare the processing requirements with the processing capabilities, and determine such network device (2.A) having processing capabilities that satisfy the processing requirements as the network device for filtering data packets.
2. The firewall assignment unit further assigns a rule set to the firewall functions of the network devices (2.A, 2.B, 2.X) integrated into the direct network path (4) from the source device (3.Q) to the target device (3.Z), as follows: - Activate the filtering logic of the firewall function of the network device (2.A) determined to filter data packets, and - Disable the firewall filtering logic of the remaining network devices (2.B, 2.X). The network system (1) according to claim 1, characterized in that it is configured to be configured in such a way.
3. The network system (1) according to claim 1 or 2, characterized in that the processing requirements and each processing capacity include the risk level, the required hardware resources and / or the required CPU performance.
4. The firewall assignment unit is further configured to check the risk level, the required hardware resources, and the required CPU performance according to their relationship, characterized in that the risk level has the highest relationship and the CPU performance has the lowest relationship.
5. The network system (1) according to any one of claims 1 to 4, characterized in that the firewall assignment unit is further configured to set an order in which the processing capacity of the network devices (2.A, 2.B, 2.X) is compared with the processing requirements, in accordance with the arrangement order of the network devices (2.A, 2.B, 2.X) in the direct network path (4) from the source device (3.Q) to the target device (3.Z).
6. If no suitable network device (2) is found during the initial run-through, the firewall assignment unit further: - Perform another scan until a network device (2.A, 2.B, 2.X) with processing capacity that meets the processing requirements is found, located on the direct network path (4) from the source device (3.Q) to the target device (3.Z), or - Identify the processing capacity of network equipment (2) located away from the direct network path (4) from the source equipment (3.Q) to the target equipment (3.Z), compare the processing capacity with the processing requirements, and if the processing requirements are met, designate the network equipment (2) located away from the direct network path (4) for filtering data packets. The network system (1) according to claim 5, characterized in that it is configured in such a way.
7. The network system (1) according to any one of claims 1 to 6, characterized in that each of the aforementioned network devices (2) is formed as an Ethernet switch.
8. In vehicles, A vehicle characterized by being provided with the network system (1) described in any one of claims 1 to 7.
9. The vehicle according to claim 8, characterized in that at least one communication device (3) is formed by a microcontroller, microprocessor, vehicle control device, actuator, or sensor.