MOBILE WIRELESS DEVICE, METHOD FOR OPERATING MOBILE WIRELESS DEVICE, AND VEHICLE

Abstract

A particularly secure mobile radio device is provided that has an operating system and at least two SIM profiles for providing multiple mobile radio connections independent of each other. The invention relates to a mobile radio device (1) with an operating system (2) and at least two SIM profiles (SIM1, SIM2) for providing a plurality of mutually independent mobile radio connections, via which network traffic is exchanged with a mobile radio network (3.1, 3.2) and information carried by the network traffic is identified. The mobile radio device according to the invention is characterized in that it comprises an attack detection system (4.1) or an attack detection and prevention system (4.2) arranged upstream of the operating system (2) in an information flow direction of the network traffic received from the at least one mobile radio connection and configured to identify at least the information carried by the network traffic.

Description

[Technical field]

[0001] The present invention relates to a mobile radio device comprising an operating system and at least two SIM profiles for providing a plurality of mutually independent mobile radio connections of the kind as defined in detail in the preamble of claim 1, to a method for operating such a mobile radio device and to a vehicle equipped with a mobile radio device. [Background technology]

[0002] IT systems, such as computers, mobile terminal devices, high-performance computing devices, distributed systems, database systems, embedded systems, measurement systems, etc., typically have various interfaces for interaction. Communication can take place with humans and between the IT systems themselves, for example via human-machine interfaces, using communication protocols such as the Internet Protocol (IP) or the Transmission Control Protocol (TCP). Attackers can attack IT systems via such interfaces. Such attacks typically aim to affect the normal operation of the IT system, to gain unauthorized access, to destroy or paralyze the IT system, to steal or manipulate important information, etc. For this purpose, IT systems are frequently infected or attacked by malware. Malware can be, for example, viruses, spyware, adware, botnets, etc. IT system operators are typically interested in ensuring that the IT systems they operate are as protected as possible from such attacks.

[0003] Mobile radio devices are increasingly being installed in vehicles to allow data exchange with the vehicle manufacturer to transmit diagnostic data. Such mobile radio devices may also be equipped with multiple SIM profiles, for example in the form of multiple SIM cards and / or multiple SIM signatures coded and stored in a storage device. Providing additional SIM profiles allows the integration of customer or third-party SIM profiles, which can be relatively easily used to compromise the security of the mobile radio device in contrast to the trusted manufacturer's SIM profile. For example, harmful data packets can be sent to the mobile radio device via a mobile radio network operated by an attacker, for example a mobile radio network operated via a manipulated femtocell, and can be used to execute malware on the mobile radio device or other computing units of the vehicle.

[0004] From the general prior art, various hardware and / or software solutions for protecting IT systems are generally known. These include, for example, firewalls, antivirus programs, attack detection systems, also called Intrusion Detection Systems (IDS), and attack detection and prevention systems, also called Intrusion Prevention Systems (IPS). Attack detection systems or attack detection and prevention systems are used to detect and / or prevent attacks against computer systems and / or computing networks. Such systems typically run on the hardware to be monitored and / or are directly integrated into the firewall. Besides host-based and network-based attack detection systems, hybrid systems are also known. To detect attacks, the data monitored by the attack detection system or attack detection and prevention system and / or the monitored network traffic are analyzed for known attack patterns. For this purpose, the corresponding system has a pattern database which contains known attack patterns. If such an attack pattern is detected, the corresponding attack detection system issues an alarm. Heuristic methods and statistical analysis can also be used to detect previously unknown attacks. In addition, attack detection and prevention systems can discard data packets, interrupt communication connections and / or modify transmitted data.

[0005] From the patent document 1 below, a system and a method are known for correlating network information with participant information in a mobile network environment. In this case, data packets received from a network such as the Internet, an intranet, a VPN, etc. are inspected by a network security platform using deep packet inspection. Using the network security platform and deep packet inspection, the wireless network operator can create a behavioral profile of the mobile network participants and associate certain network events, such as access to a certain website, execution of a certain application, receipt and / or transmission of certain data, with a certain network participant. This allows attacks from or by the mobile radio network participants to be precisely prevented. For example, downloads of malware can be detected and prevented, or communication between a network participant and a security-critical website can be detected or stopped. The network security platform is operated by the operator of the mobile radio network environment, and therefore the individual participants of the mobile network environment do not affect the user behavior profile assigned to them. In other words, the operator of the mobile network environment can monitor and control the participants. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] International Publication No. 2014 / 105309 Summary of the Invention [Problem to be solved by the invention]

[0007] The object of the invention is to provide a particularly securely operable mobile radio device with an operating system and at least two SIM profiles for providing multiple mobile radio connections independent of one another. [Means for solving the problem]

[0008] According to the invention, this problem is solved by a mobile radio device with an operating system and at least two SIM profiles for providing a plurality of mutually independent mobile radio connections having the features of claim 1. Advantageous embodiments and developments as well as a method for operating such a mobile radio device and a vehicle equipped with such a mobile radio device emerge from the claims dependent on this independent claim.

[0009] According to the invention, in a mobile wireless device with an operating system and at least two SIM profiles for providing a plurality of mutually independent mobile wireless connections, an attack detection system or an attack detection and prevention system is provided that is configured to identify at least information carried by network traffic, the attack detection system or the attack detection and prevention system being arranged upstream of the operating system in an information flow direction of the network traffic received from the at least one mobile wireless connection.

[0010] The mobile radio device can be operated particularly securely with an attack detection system or an attack detection and prevention system arranged upstream of the operating system in the information flow direction. By being arranged upstream of the operating system in the information flow direction, the attack detection system or the attack detection and prevention system can detect attacks particularly early. It is therefore also possible to react to attacks accordingly early. This allows the mobile radio device to be protected even in the case of attacks on the network interface, the interface driver and the IP stack of the operating system. Typically, the attack detection system or the attack detection and prevention system is integrated into a firewall or into the operating system. However, such integrated attack detection or prevention has limited possibilities for monitoring and filtering the arriving data packets. Furthermore, the host operating system has to process the data packets to be analyzed in order for the attack detection or prevention system to be able to detect attacks, so that the operating system itself may be exposed to attacks. However, if the data packets contained in the network traffic are inspected upstream of the operating system in the information flow direction, the operating system cannot be attacked.

[0011] An attack detection system can be used to generate an alert if an attack is detected, but conversely, an attack detection and prevention system can also be used to directly initiate appropriate measures to contain or prevent an attack by the mobile wireless device itself.

[0012] The mobile radio device has at least two mobile radio connections. By using the attack detection system or the attack detection and prevention system, attacks on the individual mobile radio connections can be selectively detected. This allows a special response to attacks made via the respective mobile radio connections. The response to a security attack on the first mobile radio connection is different from the response to a security attack on the second mobile radio connection. Furthermore, in case of an attack via the first mobile radio connection, a secure operation of the mobile radio device can be ensured via at least one second mobile radio connection. Thus, by detecting and responding to a security attack early, it is possible to limit or prevent the operation of the mobile radio device and / or prevent switching off the mobile radio device for security reasons.

[0013] Generally, any wireless technology such as mobile radio, WiFi, etc. may be used for communication by the mobile wireless device. For this purpose, any mobile radio or communication standard such as 2G to 5G, or future communication standards may also be used. For example, WLAN telephony may be provided via at least one mobile radio connection. The corresponding wireless network may be provided by fixed base stations, for example mobile radio towers, or femtocells, and / or mobile stations such as satellites, drones, balloons, etc.

[0014] An advantageous development of the mobile radio device provides for a firewall to be arranged downstream of the attack detection system or the attack detection and prevention system in the information flow direction of the network traffic. By providing a firewall, the mobile radio device can be operated more securely. Since the firewall is arranged downstream of the attack detection system or the attack detection and prevention system and the corresponding system is not integrated into the firewall, the functions of the attack detection system or the attack detection and prevention system can be performed more comprehensively. This allows for more reliable protection of the mobile radio device.

[0015] According to another advantageous embodiment of the mobile radio device, the attack detection system or the attack detection and prevention system is configured to monitor, control and / or filter the network traffic. By monitoring the network traffic, dangerous data packets and attack patterns can be detected. In that case, individual data packets or even individual components of the network traffic can be inspected in detail, i.e. controlled, in a targeted manner. For example, individual code sections can be executed in a secure environment, such as a virtual machine, and inspected for their effects. Similarly, individual network traffic components or data packets can be prevented from being forwarded to the operating system or a firewall, i.e. the network traffic is filtered. For example, the forwarding of dangerous data packets to the operating system and / or to a computing unit arranged downstream of the mobile radio device in the information flow direction can be blocked and / or Denial of Service (DOS) attacks can be detected and prevented.

[0016] Another advantageous embodiment of the mobile radio device further provides that the attack detection system or the attack detection and prevention system is integrated into the modem. The mobile radio device establishes communication with the mobile radio network by means of the modem. The integration of the attack detection system or the attack detection and prevention system into the modem therefore allows a particularly early inspection and / or influence on the network traffic of the mobile radio device. This ensures that the mobile radio device is protected against attacks even more. To provide the attack detection system or the attack detection and prevention system in the modem, a corresponding system can be integrated into the modem exclusively by software, i.e. as a software module. It is also conceivable that the modem has additional hardware, such as a storage device and / or an execution device, such as a processor, that is exclusively assigned to the functionality of the attack detection system or the attack detection and prevention system. Furthermore, in general, a corresponding attack detection system or the attack detection and prevention system can also be provided downstream of the modem in the information flow direction.

[0017] According to another advantageous embodiment of the mobile radio device, a deep packet inspection module is integrated into the attack detection system or into the attack detection and prevention system. Deep packet inspection makes it possible to inspect the header part of data packets as well as their content. This allows a more comprehensive and therefore reliable analysis of the network traffic. Furthermore, deep packet inspection can also be used to condition the data stream. By providing additional security certificates, encrypted data streams can also be decomposed and analyzed in some cases.

[0018] Preferably, the mobile radio device is designed as a mobile terminal device or a vehicle telecommunication module. Mobile terminal devices such as smartphones, tablets, laptops, etc. are widely used today. By designing such mobile terminal devices according to the mobile radio device of the present invention, such terminal devices can be operated more securely. Due to their widespread use, a particularly large number of users can be protected. With the development of digitalization, vehicles are also increasingly networked. Using the communication module, the vehicle can, for example, transmit diagnostic parameters to the vehicle manufacturer for research and development purposes, receive data for convenience services such as traffic data and weather forecasts, receive firmware or software updates for the control device, etc. By designing such a communication module according to the mobile radio device of the present invention, such vehicles can be protected more reliably against attacks.

[0019] This is particularly important for automated or autonomously controlled vehicles, such as for example autonomous lorries. Such autonomous vehicles can receive control commands from for example a vehicle control centre. An attack on the communication module of such a vehicle could send manipulated control commands to the vehicle, causing it to be involved in an accident or to be directed to a different destination, for example to steal the cargo of the autonomous truck. However, by designing the communication module as a mobile radio device according to the invention, the probability of such an attack being successfully carried out is minimized.

[0020] For communication with the vehicle manufacturer, such a communication module has a SIM profile assigned to the vehicle manufacturer. Typically, the vehicle manufacturer then negotiates terms with the mobile radio network operator, such as one-off or regular costs, data bandwidth, maximum allowed amount of data sent and received per unit time, etc. A purchaser of a vehicle equipped with a communication module containing at least two SIM profiles can have a dedicated SIM profile in the communication unit. This allows the use of mobile radio independently of the terms negotiated by the vehicle manufacturer with the communication company. However, having a dedicated customer SIM profile allows the implementation of a tailored SIM profile in the communication unit. However, since the mobile radio device according to the invention can monitor and control multiple mobile radio connections independently of each other, the network traffic conducted via the customer SIM profile can be particularly tightly controlled and managed, while the network traffic flowing via the vehicle manufacturer's SIM profile can continue to flow unhindered.

[0021] In the above-described method of operating a mobile wireless device, after detecting a security threat to the mobile wireless device, the operating system is reconfigured to adapt system operation to the security threat and / or functionality of at least one hardware and / or software component located downstream of the mobile wireless device in the information flow direction is restricted.

[0022] By reconfiguring the operating system, the operation of the mobile radio device can be maintained even if a security threat is detected. In particular, if an attack is made via the first mobile radio connection, the network traffic can continue to flow via at least the second mobile radio connection. Corresponding measures taken in an attack scenario by the attack detection system or the attack detection and prevention system can be stored in a measures database of the attack detection system or the attack detection and prevention system. In case of an attack on the first mobile radio connection, it is also possible that new instructions for dealing with the attack appropriately are received by the mobile radio device via at least the second mobile radio connection. In this way, security gaps can be filled via the mobile radio connection that is excluded from the attack, and new previously unknown threats can be dealt with quickly. Furthermore, coordination can first be performed with a central computing unit, for example the back-end of the vehicle manufacturer, in order to select an appropriate response to the attack made.

[0023] Besides reconfiguring the operating system, it is also possible to modify the behavior of downstream hardware and / or software components. The hardware components downstream of the mobile radio device can be the computational units of the vehicle. For example, this can be a central on-board computer, a control unit of a vehicle subsystem, a telematics unit, etc. The software components can be software running on the corresponding computational units, for example a navigation app, a radio app, a program for valve control, a program for adapting the behavior of any controller, etc. This provides a more comprehensive measure to adequately deal with potential attacks.

[0024] An advantageous development of the method provides for the mobile radio device to be adapted such that events and / or information are recorded, at least one function offered by the mobile radio device is limited or disabled, and / or the path selected for forwarding the network traffic is changed. By recording or logging events and information, attacks can be reconstructed or detected from the logged data. The limited functions offered by the mobile radio can be, for example, making emergency calls, making eCalls, performing telephony, receiving or sending SMS, and / or sending and / or receiving digital data via the mobile radio. One limitation can be, for example, that the number of communication partners via telephony and / or SMS can only reach a certain number. In contrast, if the functions are disabled, it is not possible to perform telephony and / or send SMS at all. It is also conceivable to test data packets received via the mobile radio connection for correct functionality or content in a secure test environment, for example a virtual machine, before the corresponding network traffic is forwarded to hardware and / or software components arranged downstream of the mobile radio device.

[0025] The instructions to reconfigure the operating system given to the mobile radio device by the attack detection system or the attack detection and prevention system can be implemented in various ways. For example, precise measures can be taken to manipulate the network traffic at one of the seven OSI layers. In that case, precise measures can be taken by the mobile radio device at the application layer, also called the application layer. It is also possible to affect the network traffic at an OSI layer located above the application layer. For this purpose, a corresponding exchange with the mobile radio network operator takes place. For example, when the mobile radio network operator detects manipulated network traffic, it can transmit instructions to the mobile radio device via the unattacked mobile radio connection of the mobile radio device to reconfigure the operating system or to limit or disable certain functions.

[0026] According to another advantageous embodiment of the method according to the invention, after detecting a security threat to the mobile radio device, the functionality of at least one mobile radio connection is restricted. If an attack is performed via a first mobile radio connection, the mobile radio functions necessary for the attack, i.e. the transmission and / or reception of certain data packets, can be restricted or prevented. However, the mobile radio communication via at least one other mobile radio connection can continue unhindered. For example, if an attack is performed via a manipulated SIM profile, the mobile radio communication can continue unhindered via the vehicle manufacturer's SIM profile. This ensures that diagnostic data can still be transmitted to the vehicle manufacturer and / or that e.g. control commands can still be received by the vehicle. Furthermore, at least one of the functions, e.g. eCall, telephony, SMS, data exchange, etc., can be restricted via the first mobile radio connection, e.g. the customer connection, and these functions can continue via the second mobile radio connection, e.g. the manufacturer connection.

[0027] Preferably, the network traffic exchanged via the first mobile radio connection is stopped when the mobile radio device receives a trigger, in particular a trigger received via the second mobile radio connection. By stopping the network traffic in the event of an attack, the mobile radio device can be particularly reliably protected against attacks. Since the mobile radio device has multiple mobile radio connections, it can also receive a corresponding trigger for stopping the network traffic if the functionality of at least one mobile radio connection is limited or disabled via a mobile radio connection that is not yet occupied. For example, the network traffic can be stopped via the customer's SIM profile, and the network traffic can continue via the vehicle manufacturer's SIM profile. In that case, a trigger can be sent to the mobile radio device by the automobile manufacturer, the service provider, the mobile network operator, etc. For example, if an attack on the mobile radio device is confirmed by the attack detection system, this information can be shared with authorized authorities, such as the vehicle manufacturer, an IT security company, a mobile radio network operator, etc., via a mobile radio connection that is not under attack, so that the corresponding parties can analyze the supposed attack. If the confirmed attack is a mistake, also called a false positive, the network traffic can continue via the supposedly under attack mobile radio connection. On the other hand, if this is in fact an attack, a trigger to block network traffic via the mobile wireless connection under attack can be sent via a corresponding mobile wireless connection that is not under attack.

[0028] According to the invention, a vehicle is equipped with a communication module as described above. The vehicle may be any vehicle, such as a car, a truck, a transporter, a bus, etc. The vehicle may have an internal combustion engine and / or an electric motor. The vehicle may also be controlled manually, at least partially automatically or autonomously. By using the communication module according to the invention, the corresponding vehicle according to the invention can be driven particularly safely.

[0029] Further advantageous embodiments of the mobile radio device and the vehicle according to the invention are apparent from the detailed description of the embodiments which follow and are illustrated in the figures. [Brief description of the drawings]

[0030] [Figure 1] 1 is a schematic diagram of a mobile wireless device according to the present invention; [Diagram 2] 1 is a schematic diagram of a vehicle according to the invention equipped with a mobile communication device according to the invention in the form of a communication module; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0031] 1 shows a mobile radio device 1 according to the invention with multiple mobile radio connections, each assigned a separate SIM profile SIM1, SIM2. By means of the mobile radio connections the mobile radio device 1 can communicate with several mobile radio networks 3.1, 3.2. In that case, network traffic exchanged between the mobile radio device 1 and one or more mobile radio networks 3.1, 3.2 flows via an OEM data path 10.OEM and an end user data path 10.EN.

[0032] A modem 6 included in the mobile wireless device 1 receives the network traffic. The modem 6 also includes an attack detection system 4.1 or an attack detection and prevention system 4.2. The corresponding attack detection system 4.1 or attack detection and prevention system 4.2 identifies information carried by the network traffic. Furthermore, the attack detection system 4.1 or attack detection and prevention system 4.2 includes a deep packet inspection module 7 for inspecting the network traffic. Furthermore, in an advantageous embodiment, the attack detection system 4.1 or attack detection and prevention system 4.2 can not only monitor but also control and / or filter the network traffic.

[0033] The mobile radio device 1 has an operating system 2 connected downstream of the modem 6 in the information flow direction. The operating system 2 may further include a firewall 5. In the mobile radio device 1, functions such as OEM functions 11.OEM and / or end user functions 11.EN can be executed by means of the operating system 2. The OEM functions 11.OEM are computer program products for example for recording vehicle diagnostic data and possibly processing and transmitting these data to the vehicle manufacturer via one of the mobile radio connections. The end user functions 11.EN are computer program products for example for providing chat functions. The end user functions 11.EN are typically provided by software running on separate hardware such as the vehicle's computing unit 13 or the end user's mobile terminal equipment.

[0034] Upstream in the end user data path 10.EN in the information flow direction from the end user function 11.EN, a routing module 12 is provided for selecting the appropriate path for forwarding the network traffic.

[0035] If the attack detection system 4.1 or the attack detection and prevention system 4.2 detects an attack on the mobile radio device 1, the system behavior of the mobile radio device 1 or the operating system 2 is adapted to deal with the attack. This reconfiguration is illustrated by the dashed arrows in Fig. 1. For example, logging of events and / or information can be started, functions of the mobile radio device 1, in particular functions provided via the separate mobile radio connection, can be restricted or disabled, and / or the path selected for forwarding network traffic can be changed. Attributes and settings of the firewall 5, the SIM profiles SIM1, SIM2 and the OEM features 11.OEM can be adapted for this purpose.

[0036] Furthermore, a computing unit 13 may be provided downstream of the mobile radio device 1. This may for example be a personal computer, a control device, a vehicle telematics unit, etc. As with the mobile radio device 1, OEM functions 11.OEM and / or end user functions 11.EN may also be executed in the computing unit 13.

[0037] FIG. 2 shows the integration of a mobile radio device 1 according to the invention in the form of a communication module 8 into a vehicle 9 according to the invention. By providing at least two SIM profiles SIM1, SIM2, the communication module 8 operates simultaneously on both SIM profiles SIM1, SIM2 in a receiving and transmitting state. To provide the SIM profiles SIM1, SIM2, several SIM cards can be integrated into the mobile radio device 1 by means of several SIM slots. In general, several SIM profiles SIM1, SIM2 can also be provided on individual SIM cards and / or on any storage device of the communication module 8. By providing at least a second SIM profile SIM2, an end user SIM profile can be utilized in addition to the OEMSIM profile. The end user can thus provide the communication module 8 with a manipulated SIM profile. This can result in manipulated data packets being sent to the communication module 8, which can attack the vehicle, i.e. the vehicle 9. However, by using the communication module 8 designed as the mobile radio device 1 according to the invention, such attacks can be detected and, if necessary, prevented or prevented. For this purpose, the functions of the mobile radio device 1 can, for example, be limited or disabled. The entire communication may also be terminated over at least one of the mobile wireless connections.

Claims

1. A mobile radio device comprising an operating system (2) and at least two SIM profiles (SIM1, SIM2) for providing a plurality of mobile radio connections independent of each other, wherein network traffic is exchanged via at least one mobile radio connection with a mobile radio network (3.1, 3.2) and information carried by said network traffic is identified, an attack detection system (4.1) or an attack detection and prevention system (4.2) arranged upstream of said operating system (2) in an information flow direction of network traffic received from at least one mobile radio connection, and thus configured to identify at least said information transmitted by said network traffic prior to said operating system (2); A mobile wireless device comprising:

2. A firewall (5) is disposed downstream of the attack detection system (4.1) or the attack detection and prevention system (4.2) in the information flow direction, so that the firewall (5) processes the information after the attack detection system (4.1) or the attack detection and prevention system (4.2). A mobile radio device (1) according to claim 1, characterised in that

3. The attack detection system (4.1) or the attack detection and prevention system (4.2) is configured to monitor, control and / or filter the network traffic. A mobile radio device (1) according to claim 1, characterised in that

4. The attack detection system (4.1) or the attack detection and prevention system (4.2) is integrated into a modem (6). A mobile radio device (1) according to claim 1, characterised in that

5. A deep packet inspection module (7) is integrated into the attack detection system (4.1) or the attack detection and prevention system (4.2). A mobile radio device (1) according to claim 1, characterised in that

6. Designed as a mobile terminal device or communication module (8) for a vehicle (9) A mobile radio device (1) according to claim 1, characterised in that

7. A method for operating a mobile radio device (1) according to any one of claims 1 to 6, comprising: After detecting a security threat to the mobile wireless device (1), an operating system (2) is reconfigured to adapt system operation to the security threat and / or functionality of at least one hardware and / or software component of the mobile wireless device (1) is restricted.

1. A method of operating a mobile wireless device, comprising:

8. The system operations include: events and / or information are logged; at least one function provided by the mobile wireless device (1) is restricted or disabled; and / or the mobile wireless device (1) is adapted such that a selected path for forwarding network traffic is changed.

8. A method for operating a mobile wireless device according to claim 7.

9. After detecting a security threat to the mobile wireless device (1), the functionality of at least one mobile wireless connection is restricted.

8. A method for operating a mobile wireless device according to claim 7.

10. Network traffic exchanged via the first mobile radio connection is stopped when the mobile radio device (1) receives a trigger, in particular a trigger received via the second mobile radio connection. A method for operating a mobile radio device according to claim 9.

11. Equipped with a communication module (8) according to claim 6 A vehicle characterized by:

Images