Network system and vehicle

Abstract

The invention relates to a network system comprising: at least two network devices and, for each network device, at least one communicating device that is connected to one of the network devices, and an associated network device that is connected to at least one other network device in order to enable the exchange of data packets between communicating devices via the network devices, each of the network devices having an integrated firewall functionality for filtering data packets to be forwarded; and a firewall-assignment unit which is designed to monitor the network devices and, depending on a monitoring result, to determine one of the network devices for filtering the data packets for data packets to be transmitted from a source device to a target device. The network system is characterised in that the firewall-assignment unit is also designed: to determine a processing requirement for the data packets output by the source device; to determine a network-device-specific processing capability for the network devices integrated in the direct network path from the source device to the target device by monitoring the network devices; to compare the processing requirement with the processing capabilities; and to determine a network device for filtering the data packets, said network device having processing capabilities that fulfill the processing requirement.

Description

[0001] Network system and vehicle

[0002] The invention relates to a network system according to the type defined in the preamble of claim 1 and to a vehicle comprising such a network system.

[0003] The proportion of electronics in vehicles is constantly increasing, particularly due to increased performance and simultaneous miniaturization. The computing units installed in vehicles can vary in complexity. Outputting control signals for actuators or reading and processing sensor values, for example, is possible using microcontrollers. Microcontrollers are often also referred to as systems-on-a-chip. For more complex tasks, particularly in connection with automated or even autonomous driving, it is necessary to integrate powerful hardware into vehicles. The tasks of multiple control units can also be performed by a central on-board computer.

[0004] The vehicle's electronic components may rely on data exchange with each other. For this purpose, the electronic components are communicatively connected via appropriate data lines. These data lines can be based on a wide variety of technologies and communication protocols. A large portion of the communication takes place via dedicated bus systems such as a CAN bus or Ethernet.

[0005] Information technology systems are always exposed to the risk of compromise. Therefore, information technology systems must be protected from attacks through appropriate security measures. To achieve this, well-known and proven measures from information technology can be transferred to vehicles, such as the use of firewalls, attack detection and defense systems, cryptographic encryption technologies, and the like. To establish an Ethernet network, communicating computing units are connected via network devices. Various types of network devices exist, such as repeater hubs, switches, routers, and the like.While a repeater hub distributes data packets to be transmitted to all network connections, a switch, on the other hand, is able to check a data packet, determine a destination address specified in the data packet and forward the corresponding data packet only via the network connection to which the actual destination device is connected.

[0006] It is common practice to integrate firewalls into switches. A firewall filters the data packets that make up network traffic based on predefined rules. This filtering increases the latency of data forwarding. Network systems can be arbitrarily complex. Especially when data packets have to be forwarded consecutively across multiple switches to reach a specific destination device, each switch rechecks the corresponding data packets, which further increases latency but is also unnecessary.

[0007] US 2015 / 0326532 A1 discloses a method and device for providing a distributed firewall in a network. The document describes a plurality of computing nodes connected to form a network. Firewall instances are executed on some of the computing nodes to filter data packets sent over the network. The individual firewall instances executed on the computing nodes can interact as a large firewall. Data packets sent over the network are forwarded to corresponding computing nodes so that the respective firewall instances can filter the data packets. In this case, it can happen that individual computing nodes are allocated a very large amount of data, creating a bottleneck in the data line. Data packets discarded by firewall filtering are then unnecessarily transmitted through the network, thus wasting computing resources.To avoid these problems, the network includes a firewall controller. The firewall controller can instantiate new firewalls on the network's computing nodes, thus making more computing capacity available to provide firewall functionality. Data packets can be redirected to these computing nodes accordingly, thus avoiding bottlenecks in the data line. The present invention is based on the object of providing an improved network system that operates more efficiently.

[0008] According to the invention, this object is achieved by a network system having the features of claim 1. Advantageous embodiments and further developments as well as a vehicle comprising such a network system emerge from the dependent claims.

[0009] A generic network system comprising at least two network devices and at least one communicating device for each network device, wherein the communicating devices are each connected to one of the network devices and a respective network device is connected to at least one further network device in order to enable an indirect exchange of data packets between communicating devices via the network devices, wherein the respective network devices have an integrated firewall functionality for filtering data packets to be forwarded, further comprising a firewall allocation unit, wherein the firewall allocation unit is configured to monitor the network devices and, depending on a monitoring result for data packets to be transmitted from a source device to a destination device, to determine one of the network devices for filtering the data packets, is further developed according to the invention in thatthat the firewall allocation unit is further configured to determine a processing requirement for the data packets output by the source device, to determine a network device-specific processing capability by monitoring the network devices, at least for the network devices integrated in the direct network path from the source device to the destination device, to compare the processing requirement with the processing capabilities, and to determine such a network device for filtering the data packets whose processing capabilities meet the processing requirement.

[0010] The network system according to the invention prevents data packets from being repeatedly filtered by the firewalls of the respective network devices on their way from the source device to the destination device. Thus, the data packets are only filtered by the firewall of a single network device. This reduces the latency in data forwarding and saves computing resources of the network devices, which can then be used to perform additional tasks. As a result, the network system according to the invention operates more efficiently than prior art solutions.

[0011] The network system can have any topology. The network devices can be arranged in a ring, mesh, star, line, tree, bus, or fully connected configuration.

[0012] To provide firewall functionality, the respective network devices can utilize existing hardware resources for forwarding data packets, or they can utilize dedicated hardware components exclusively for providing firewall functionality. For example, existing or separately provided computer-readable storage media can be provided, which contain code modules that allow the provision of firewall functionality through execution by an existing processor or a separately provided processor.

[0013] The firewall allocation unit can also be a network device. However, it can also be a more complex computer system, such as a desktop computer, a server, or a server cluster.

[0014] Data packets are also known as frames. A data packet can consist of multiple sections. For example, a first section can contain the destination address of the destination device, and a second section can contain the source address of the source device. Further sections can contain, for example, a data type, payload, and a checksum. To determine the processing requirements, the firewall allocation unit can read in corresponding data packets and examine the individual sections. Depending on the content, different processing requirements are determined. For example, so-called lookup tables can be implemented in the firewall allocation unit. These tables describe which processing requirements should be selected for which content of the respective sections of the data packet.The processing requirement can also be determined depending on the size of the data packet, i.e., the amount of payload it contains. The network device designated for filtering the data packets is located in the direct network path from the source device to the destination device. This increases the efficiency of the network system according to the invention, as it eliminates the need to forward the data packets, i.e., route them, to network devices located outside the direct network path, which would represent a detour and thus lead to increased latency.

[0015] If several network devices meet the processing requirement, the firewall allocation unit selects the network device to filter the data packets that “best” meets the processing requirement, which will be discussed in more detail below.

[0016] An advantageous development of the network system according to the invention provides that the firewall allocation unit is further configured to configure the firewall functionalities of the network devices integrated in the direct network path from the source device to the target device by assigning rule sets as follows:

[0017] - Activating a filter logic of the firewall functionality of the network device intended to filter the data packets; and

[0018] - Deactivate the filter logic of the firewall functionalities of the other network devices.

[0019] This allows for particularly efficient control of the firewall functionality. Firewall functionality continues to run on the individual network devices. This means that firewalls do not need to be explicitly instantiated, initialized, started, or anything similar. Furthermore, firewalls or the corresponding virtual machines on which the firewalls run do not need to be terminated, deactivated, or stopped. This simply adapts the filter logic of the respective firewalls to the data packets currently being transmitted. The filter logic of the network device that is supposed to filter the data packets is adapted so that the data packets are processed by the firewall.For example, the filter logic can be adjusted so that a unique identifier of the source device, such as the MAC address, is added to a so-called blacklist, also known as a negative list, so that all data packets from the source device are filtered. Additional filter logic can also be implemented, for example, allowing some of the data packets from the source device to pass through and others to be discarded. Conversely, the firewalls of the other network devices in the direct network path are adjusted accordingly. For example, the MAC address of the source device can be added to a so-called whitelist, also known as a positive list, so that the data packets are not filtered again on the other network devices.

[0020] The transmission of firewall configuration files or rule sets is particularly fast and requires only low network throughput, i.e., a low data transfer rate. Since no firewalls or virtual machines need to be started or shut down, the associated time expenditure is eliminated. This further increases the efficiency of the network system according to the invention.

[0021] According to a further advantageous embodiment of the network system according to the invention, the processing requirement and the respective processing capabilities comprise a risk level, required hardware resources and / or required CPU performance. Depending on the content of a respective data packet to be transmitted over the network, a different risk level may exist, different hardware resources may be required and / or different CPU performance may be required. The risk level depends, for example, on the content of the payload data. If the payload data is merely information, for example the status of a sensor or a vehicle component, a low risk can be assigned. However, if it is control signals, for example for controlling an actuator, a comparatively higher risk level can be selected.The risk level can also be selected depending on the source device or the target device. For example, if the target device is a display device for presenting information, a low risk level can be selected. However, if the target device is an actuator used to operate an automated or autonomous vehicle, a high risk level can be selected.

[0022] Analogously, different requirements can be determined for the required hardware resources. For particularly large data packets or extensive rule sets, for example, it may be necessary to use a network device to filter the data packets that has a particularly large amount of memory on a computer-readable storage medium. In particular, this is an addressable memory, also known as TCAM. Analogously, different requirements are placed on the required CPU performance. For example, to process particularly large data packets, high CPU performance is required in order to process the data packet in a reasonable amount of time. Smaller data packets require correspondingly less CPU performance. “CPU performance” refers to the execution speed of a processor oran execution unit of a respective network device, for example defined by a clock rate, the number of floating point operations per second (FLOPS) or the like.

[0023] A further advantageous embodiment of the network system according to the invention further provides that the firewall allocation unit is further configured to check the risk level, required hardware resources, and required CPU performance in a staggered manner according to their relevance, with the risk level having the highest relevance and the CPU performance having the lowest relevance. Particularly if multiple network devices in the direct network path from the source device to the destination device generally meet the processing requirement, this allows for a more refined selection of the final network device to be determined. Thus, specific threshold values ​​can be set for the risk level, the hardware resources, and the CPU performance, which must at least be met. The greater the distance from these threshold values, the "better" a particular network device fulfills the processing requirement, i.e., the "better" its processing capabilities.The network device with the best processing capability is then selected, focusing particularly on the risk level, followed by the hardware resources and finally the CPU performance.

[0024] According to a further advantageous embodiment of the network system according to the invention, the firewall allocation unit is further configured to compare the processing requirements with the processing capabilities, determining the order in which the processing capabilities of the network devices are compared with the processing requirements, in accordance with the arrangement sequence of the network devices in the direct network path from the source device to the destination device. This further increases the efficiency of the network system according to the invention. The processing capability of each of the network devices in the direct network path does not necessarily have to be determined. An iterative approach can be used so that the processing capabilities of the network devices are gradually determined and checked according to the arrangement sequence.Once a first network device has been identified that generally meets the processing requirements, it can be designated to filter the data packets. The "best" network device, or firewall functionality, is then the network device located as far forward as possible in the direct network path and that first meets the processing requirements. This ensures that network devices located early in the direct network path are assigned the task of filtering the data packets. This prevents data packets that are later discarded by filtering from being forwarded through the network for longer, thus reducing network load.

[0025] A further advantageous embodiment of the network system according to the invention further provides that the firewall allocation unit is further configured to, if no suitable network device is found in a first run:

[0026] - to perform further passes until a network device is found in the direct network path from the source device to the destination device whose processing capability meets the processing requirement; or

[0027] - To determine the processing capabilities of network devices located away from the direct network path from the source device to the destination device, to compare these with the processing requirements and, if met, to determine a network device located away from the direct network path to filter the data packets.

[0028] If the first run of comparing the processing requirements with the processing capabilities of the network devices in the direct network path fails to find a suitable network device that meets the processing requirements, the question arises as to how to proceed so that the data packets can still be sent over the network's data line. Generally, it is possible that the firewall allocation unit selects a network device that does not meet the processing requirements to filter the data packets. In such a case, this can lead to the respective network device operating in an overloaded mode. Accordingly, the latency for forwarding the data packets increases.

[0029] Advantageously, the firewall allocation unit waits until one of the network devices in the direct network path fulfills the processing requirement. This allows the individual network devices to be fully utilized due to their tasks. As soon as one of the network devices has completed one or more tasks, such as forwarding and / or filtering other data packets, additional resources of that network device are available to filter the data packets from the source device to the destination device. Accordingly, the processing requirement can be fulfilled at a later time. This does increase latency, as it is necessary to wait until a suitable network device has free capacity to filter the data packets. However, the resulting increase in latency can be less than the increase in latency associated with determining an already fully utilized network device to filter the data packets.

[0030] If no suitable network device can be found along the direct network path within a reasonable amount of time, the firewall allocation unit can also select a network device located away from the direct network path to filter the data packets and redirect the data packets from the source device to the destination device over the network. While this reduces efficiency due to the redirection of the data packets, it can potentially reduce the time required to forward the data packets to the destination device, compared to having to wait a disproportionately long time for a network device with sufficient free computing resources on the direct network path.

[0031] The firewall allocation unit preferably determines such a network device away from the direct network path, which has a particularly short distance to the direct network path, so that the data packets are redirected as quickly as possible.

[0032] The respective network devices are preferably designed as Ethernet switches. These are particularly established, reliable, and widely used network devices, so that the network system according to the invention can be implemented simply and cost-effectively. A switch has Ethernet sockets or Ethernet ports as a network connection. The communicating devices are connected to the switches via Ethernet cables. As already mentioned, the topology of the network system according to the invention can be arbitrary and, for example, can be implemented as: ring, mesh, star, fully connected, line, tree, bus, and the like. At least the communicating devices have a unique identifier. This identifier can define the address of the respective device in the network system. When Ethernet switches are used as network devices, this identifier is in particular the MAC address.Depending on which layer of the OSI model the respective switch operates on, the switches themselves can also have a MAC address.

[0033] The operation of a switch for forwarding data packets, also known as routes, based on so-called source address tables (SAT) is well known to the expert.

[0034] A vehicle according to the invention comprises such a network system as described above. The vehicle can be any vehicle, such as a car, truck, van, bus, or the like. Generally, it could also be a rail vehicle, watercraft, or aircraft.

[0035] Preferably, at least one communicating device is formed by a microcontroller, a microprocessor, a vehicle control unit, an actuator, or a sensor. This enables efficient and secure data traffic via a network system integrated into a vehicle. A respective vehicle control unit can itself be formed by a so-called system-on-a-chip, i.e., be implemented as a microcontroller or microprocessor itself, or include such components.

[0036] Further advantageous embodiments of the network system according to the invention also emerge from the exemplary embodiments which are described in more detail below with reference to the figures.

[0037] Showing:

[0038] Fig. 1 is a schematic representation of a network system according to the invention;

[0039] Fig. 2 is a schematic representation of a direct network path from a

[0040] source device to a destination device in the network system; and

[0041] Fig. 3 is a flowchart of a possible embodiment of a method for filtering data packets using a firewall functionality that can be provided by the network system according to the invention. Figure 1 shows a network system 1 according to the invention. This comprises at least two network devices 2 and at least one communicating device 3 for each network device 2. The topology of the network system 1 shown in Figure 1 is to be understood purely as an example. All common network topologies are possible, such as ring-shaped, star-shaped, linear topologies and the like. The network devices 2 are, in particular, Ethernet switches. The communication lines 5 between the network devices 2 and the communicating devices 3 connected to them are then formed by Ethernet cables. The Ethernet cables are connected to respective network ports (not shown).Such a network connection is also called a port.

[0042] Furthermore, the network system 1 according to the invention comprises a firewall allocation unit (not shown in detail). The firewall allocation unit has not been shown since it can generally be integrated anywhere in the network system 1 according to the invention. The firewall allocation unit can be connected to at least one network device 2 in the network system 1. In particular, the firewall allocation unit can be connected to several or even all network devices 2. The firewall allocation unit monitors the network devices 2 and, depending on a monitoring result, determines one of the network devices 2 for filtering data packets to be transmitted from a source device 3.Q shown in Figure 2 to a destination device 3.Z.

[0043] For this purpose, the respective network devices 2 each have a firewall module 6 for providing firewall functionality. Such a firewall allows the application of predefined rules for filtering data packets. Depending on the firewall settings, the respective network devices 2 allow a subset of data packets to pass through for forwarding and discard the remaining data packets. All data packets can also be allowed through or discarded.

[0044] The respective firewall module 6 comprises program code, the execution of which by an execution unit included in the respective network device 2, such as a processor, allows the provision of the firewall functionality. Corresponding code modules can be stored together with other program code elements in a physical storage medium of the network device 2. Dedicated storage media can also be included in the network device 2 to store the program code components required to implement the firewall functionality. Other or dedicated execution units can also be used to execute the program code modules.

[0045] The network system 1 can have any number of more than two network devices 2, which is indicated by multiple dots “...”.

[0046] Figure 2 shows a direct network path 4 from the source device 3.Q to the destination device 3.Z. Any number of network devices 2 can be located in the direct network path 4, but at least one network device 2. In the embodiment shown in Figure 2, the direct network path 4 contains the network devices 2.A, 2.B and 2.X, or optionally further network devices 2, indicated by dots. The respective network devices

[0047] 2.A, 2.B, 2.X, and the source device 3.Q and the destination device 3.Z are connected by double arrows, indicating bidirectional communication. In general, communication can also be unidirectional.

[0048] By default, each of the network devices 2.A, 2.B and 2.X would use the firewall functionality provided by the respective firewall module 6 to filter the traffic from the source device

[0049] 3.Q applies to the data packets to be transmitted to the destination device 3.Z. This represents a redundancy that is not required. Filtering the data packets multiple times is unnecessary and increases the latency in data forwarding, as well as blocking the computing resources of the respective network devices 2, preventing them from being used to process other tasks.

[0050] According to the invention, the firewall allocation unit determines one of the network devices 2.A, 2B, or 2.X to apply the filter logic. In the embodiment shown in Figure 2, network device 2.A is selected for this purpose, so that the remaining network devices 2.B and 2.X allow the respective data packets to pass unfiltered to the destination device 3.Z.

[0051] To this end, the firewall allocation unit determines a processing requirement for data packets to be forwarded and, by monitoring the network devices 2, at least for the network devices 2.A, 2.B, and 2.X integrated in the direct network path 4, determines a network device-specific processing capability and compares the processing requirement with the processing capabilities. The firewall allocation unit then selects a network device 2.A for filtering the data packets whose processing capabilities meet the processing requirement.

[0052] Figure 3 shows a possible and preferred embodiment of a method sequence. The components comprised by the network system 1 according to the invention are configured to execute method steps. The methods provided by these method steps are also part of the invention.

[0053] In method step 301, the firewall allocation unit determines the respective processing requirements of the data packets to be forwarded.

[0054] In step 302, the firewall allocation unit determines the processing functionality that can be provided by the first network device 2 located in the direct network path 4—here, network device 2.A—and compares the processing requirement with the respective processing capability. This occurs in method step 303.

[0055] If the processing capability meets the processing requirement, the firewall allocation unit selects network device 2.A to filter the data packets in method step 304. If, however, the condition is not met, the firewall allocation unit proceeds with the next network devices 2.B and 2.X located in the direct network path 4 and determines the processing capabilities accordingly, checking them against the processing requirement. In method step 305, the firewall allocation unit determines the respective processing capabilities. In method step 306, the processing requirement is compared with the respective processing capability. As soon as the processing requirement is met, the method ends in method step 307, likewise with the selection of the respective network device 2.B or 2.X and the corresponding application of the filter logic to the data packets.Otherwise, the firewall allocation unit can wait until the computing resources of one of the network devices 2.A, 2.B, 2.X are sufficient to meet the processing requirement. To do so, the firewall allocation unit can return to method step 302, as indicated by a dashed arrow.

Claims

Patent claims 1. A network system (1) comprising at least two network devices (2) and at least one communicating device (3) for each network device (2), wherein the communicating devices (3) are each connected to one of the network devices (2) and a respective network device (2) is connected to at least one further network device (2) in order to enable an indirect exchange of data packets between communicating devices (3) via the network devices (2), wherein the respective network devices (2) have an integrated firewall functionality for filtering data packets to be forwarded, further comprising a firewall allocation unit, wherein the firewall allocation unit is set up to monitor the network devices (2) and, depending on a monitoring result, to determine the data packets to be forwarded from a source device (3.Q) to a destination device (3.Z) to determine data packets to be transmitted from one of the network devices (2) for filtering the data packets, characterized in that the firewall allocation unit is further configured to determine a processing requirement for the data packets output by the source device (3.Q) by monitoring the network devices (2) at least for the network devices (2.A, 2.B,. 2.X) to determine a network device-specific processing capability, to compare the processing requirement with the processing capabilities and to determine such a network device (2.A) for filtering the data packets whose processing capabilities meet the processing requirement.

2. Network system (1) according to claim 1, characterized in that the firewall allocation unit is further configured to allocate the firewall functionalities of the devices in the direct network path (4) from the source device (3.Q) to the destination device Device (3.Z) integrated network devices (2.A, 2.B, 2.X) by assigning rule sets as follows: - Activating a filter logic of the firewall functionality of the network device intended to filter the data packets (2.A); and - Deactivating the filter logic of the firewall functionalities of the other network devices (2.B, 2.X).

3. Network system (1) according to claim 1 or 2, characterized in that the processing requirement and the respective processing capabilities comprise a risk level, required hardware resources and / or required CPU power.

4. Network system (1) according to claim 3, characterized in that the firewall allocation unit is further configured to check the risk level, required hardware resources and required CPU performance in a staggered manner according to their relevance, wherein the risk level has the highest relevance and the CPU performance has the lowest relevance.

5. Network system (1) according to one of claims 1 to 4, characterized in that the firewall allocation unit is further configured to determine, for the comparison of the processing requirement with the processing capabilities, the order in which the processing capabilities of the network devices (2.A, 2.B, 2.X) are compared with the processing requirement, in accordance with the arrangement order of the network devices (2.A, 2.B, 2.X) in the direct network path (4) from the source device (3.Q) to the destination device (3.Z).

6. Network system (1) according to claim 5, characterized in that the firewall allocation unit is further configured to, if no suitable network device (2) is found in a first run: - To carry out further passes until a network device (2.A, 2.B, 2.X) is found whose processing capability meets the processing requirement; or - to determine the processing capabilities of network devices (2) located away from the direct network path (4) from the source device (3.Q) to the destination device (3.Z), to compare these with the processing requirement and, if fulfilled, to determine a network device (2) located away from the direct network path (4) for filtering the data packets.

7. Network system (1) according to one of claims 1 to 6, characterized in that the respective network devices (2) are designed as Ethernet switches.

8. Vehicle, characterized by a network system (1) according to one of claims 1 to 7.

9. Vehicle according to claim 8, characterized in that at least one communicating device (3) is formed by: a microcontroller, a microprocessor, a vehicle control unit, an actuator or a sensor.

Images