Network system and vehicle

Abstract

The invention relates to a network system (1) comprising at least two network devices (2) and, for each network device (2), at least one communicating device (3), wherein each network device (2) has at least two network connections (4.1, 4.2), wherein, for each network device (2), the at least one communicating device (3) is connected to a first network connection (4.1) of said same network device (2), and at least one other network device (2) is connected to a second (4.2) network connection of said same network device (2), and wherein each network device (2) has an integrated firewall functionality for filtering data packets to be transmitted via the network connections (4.1, 4.2). The network system according to the invention is characterised in that each network device (2) is designed to filter data packets received from communicating devices (3) connected to said network device (2) and to forward data packets received from other network devices (2) to a target address without filtering.

Description

[0001] Network system and vehicle

[0002] The invention relates to a network system according to the type defined in the preamble of claim 1 and to a vehicle comprising such a network system.

[0003] The proportion of electronics in vehicles is constantly increasing, particularly due to increased performance and simultaneous miniaturization. The computing units installed in vehicles can vary in complexity. Outputting control signals for actuators or reading and processing sensor values, for example, is possible using microcontrollers. Microcontrollers are often also referred to as systems-on-a-chip. For more complex tasks, particularly in connection with automated or even autonomous driving, it is necessary to integrate powerful hardware into vehicles. The tasks of multiple control units can also be performed by a central on-board computer.

[0004] The vehicle's electronic components may rely on data exchange with each other. For this purpose, the electronic components are communicatively connected via appropriate data lines. These data lines can be based on a wide variety of technologies and communication protocols. A large portion of the communication takes place via dedicated bus systems such as a CAN bus or Ethernet.

[0005] Information technology systems are always exposed to the risk of compromise. Therefore, information technology systems must be protected from attacks through appropriate security measures. To this end, well-known and proven measures from information technology can be transferred to vehicles, such as the use of firewalls, attack detection and defense systems, cryptographic encryption technologies, and the like.

[0006] To establish an Ethernet network, communicating computing units are connected via network devices. There are various types of network devices, such as repeater hubs, switches, routers, and the like. While a repeater hub distributes data packets to be transmitted to all network ports, a switch, on the other hand, is capable of examining a data packet, determining a destination address specified in the data packet, and forwarding the corresponding data packet only via the network port to which the actual destination device is connected.

[0007] It is common practice to integrate firewalls into switches. A firewall filters the data packets that make up network traffic based on predefined rules. This filtering increases the latency of data forwarding. Network systems can be arbitrarily complex. Especially when data packets have to be forwarded consecutively across multiple switches to reach a specific destination device, each switch rechecks the corresponding data packets, which further increases latency but is also unnecessary.

[0008] WO 2018 / 217143 A1 discloses a method executable by a network device for selecting forwarding tables of a rule-based routing system. The solution described in the document leads to a drastically accelerated selection of forwarding tables.

[0009] The present invention is based on the object of providing an improved network system which operates more efficiently.

[0010] According to the invention, this object is achieved by a network system having the features of claim 1. Advantageous embodiments and further developments emerge from the dependent claims.

[0011] A generic network system comprising at least two network devices and at least one communicating device for each network device, wherein each network device has at least two network connections, wherein for each network device the at least one communicating device is connected to a first network connection of the respective network device and at least one further network device is connected to a second network connection of the respective network device, and wherein each network device has an integrated firewall functionality for filtering data packets to be transmitted via the network connections, is further developed according to the invention in that a respective network device is set up to filter data packets received from communicating devices connected to the respective network device and to forward data packets received from other network devices unfiltered to a destination address.

[0012] The efficiency of the network system according to the invention is increased by the fact that the individual network devices no longer all apply the firewall functionality to the data traffic to be forwarded. Thus, the data packets sent from a communicating device to a destination address are filtered by only a single network device using the firewall functionality, and no longer by all network devices. Since the hardware resources of the respective network device are used to filter the data packets, the overall computing effort can be reduced. The respective hardware resources of the network devices are then available to perform additional tasks. This also reduces the latency when forwarding data packets via the network system according to the invention.

[0013] The core of the invention is to perform the firewall-based filtering of the data packets only in one network device of the network system. In general, the filtering of the data packets could also take place in the network device upstream of the communicating device specified by the destination address. However, this increases the turnover of data packets exchanged via the network system according to the invention, which leads to an insufficient increase in efficiency or latency reduction. It is therefore advantageous if the network device via which the communicating device is connected to the communication network filters the data packets output by the communicating device. This way, corresponding data packets are filtered particularly early in the communication line and thus, should individual data packets be discarded, the total amount of data exchanged in the network system is reduced.A network connection can also be referred to as an input connection, output connection or simply “port”.

[0014] The network devices of the network system can each have the same or different numbers of network ports. The data rate available via the respective network ports can vary for different network ports on the same network device. In particular, network devices are communicatively connected to one another via network ports that allow for particularly high data rates.

[0015] Data packets are also called frames. Each data packet, or frame, comprises different sections. A first section can contain the destination address of the communicating device. A second section can contain the source address of the communicating device sending the data packet. A third section can define a data (packet) type and is also called a type field. A fourth section can contain payload data. A fifth section can contain a checksum, which a network device can use to verify whether the respective data packet was transmitted correctly or incorrectly.

[0016] A respective network device reads a data packet to be forwarded and extracts the information described by the respective sections. The rules used by the firewall functionality are applied to this information to filter the respective data packets. For example, only those data packets that are directed to specific destination addresses, originated from specific source addresses (i.e., communicating devices), correspond to a specific data type, and so on, can be forwarded over the network.

[0017] Accordingly, a method for carrying out the method steps executable by the components of the network system according to the invention is also part of the invention.

[0018] The respective network devices are preferably designed as Ethernet switches. These are particularly established, reliable, and widely used network devices, so that the network system according to the invention can be implemented simply and cost-effectively. A switch has Ethernet sockets or ports as a network connection. The communicating devices are connected to the switches via Ethernet cables. The topology of the network system according to the invention can be arbitrary and can be implemented, for example, as a ring, mesh, star, fully connected, line, tree, bus, and the like.

[0019] At least the communicating devices have a unique identifier. This identifier can define the address of the respective device in the network system. When using Ethernet switches as network devices, this identifier is, in particular, the MAC address. Depending on which layer of the OSI model the respective switch operates on, the switches themselves may also have a MAC address.

[0020] The operation of a switch for forwarding data packets, also known as routes, based on so-called source address tables (SAT) is well known to the expert.

[0021] According to a further advantageous embodiment of the network system according to the invention, the respective network devices are configured to read a configuration file and use it to configure the firewall functionality, wherein the configuration file contains at least one unique identifier of communicating devices connected to the respective network device. Using the unique identifier, in particular a MAC address as already explained, the respective communicating devices of the network system according to the invention can be uniquely referenced. Thus, a network device can be informed which communicating devices connected to the network device are generally authorized to send data packets.For example, if an attacker connects another communicating device to a network device of the network system according to the invention, the network device filters any data packets sent by this communicating device because the unique identifier of the communicating device implemented by the attacker is not found in the configuration file. This reliably prevents compromised data from being sent via the network system according to the invention.

[0022] Additionally, the configuration file can also include the unique identifier of the other network devices connected to the network device. This allows the network device to be informed which other network devices should explicitly not filter received data packets. This allows so-called white lists, also known as positive lists, to be derived.

[0023] In the simplest case, the network system according to the invention can be implemented by ensuring that the firewall functionality of a respective network device generally does not perform any filtering. The configuration file can then be used to define so-called blacklists or negative lists that specify which communicating device receives data packets. Depending on the design of the network system according to the invention, there is a risk that some communicating devices can generally be compromised more easily, while others can be compromised only with difficulty or not at all. Accordingly, the respective network devices are informed which communicating devices transmit data packets to filter.This logic can also be implemented adaptively, so that when a new communicating device is connected to a network device, the unique identifier of the newly connected communicating device is automatically added to a corresponding blacklist.

[0024] In the simplest case, the entire network topology is transmitted equally to all network devices of the network system according to the invention. A respective configuration file describes which communicating devices are connected to which network device, for example, uniquely referenced via a MAC address, as well as which network devices themselves are connected to each other. The firewalls integrated into the network devices then filter only those data packets output by communicating devices connected to the respective network device.

[0025] The memory size of each configuration file is correspondingly large. Since it is not necessary to inform network devices which other communicating devices are connected to other network devices, an advantageous development of the network system according to the invention further provides that the firewall functionality of at least two network devices is configured using individual, network-device-specific configuration files. Thus, different configuration files tailored to the respective network device can be implemented for different network devices. In other words, each network device is only informed of which communicating devices are connected to the respective network device, in particular via a soft network connection or port.This allows each network device to quickly and easily identify which communicating devices should filter the data packets sent by them and which should not.

[0026] According to a further advantageous embodiment of the network system according to the invention, at least one communicating device has a mobile radio connection and is configured to receive configuration files via mobile radio. The corresponding communicating device can also be referred to as a telecommunications unit or telematics unit. Such a telematics unit can have one or more mobile radio connections. Updates can then be received via such a telematics unit. In the automotive sector, wirelessly sent updates are also referred to as over-the-air updates (OTA). If the network system according to the invention is changed, the respective network devices or the firewall functionalities comprised by the network devices can be reconfigured and adapted to the changed network design. Accordingly, incorrectly configured network devices can also be corrected.This allows an administrator to define new rules for filtering network traffic and thus adapt the network system according to changing requirements. Visiting a workshop to adjust the firewall configuration is then unnecessary.

[0027] A vehicle according to the invention comprises such a network system as described above. The vehicle can be any vehicle, such as a car, truck, van, bus, or the like. Generally, it could also be a rail vehicle, watercraft, or aircraft.

[0028] Preferably, at least one communicating device is formed by a microcontroller, a microprocessor, a vehicle control unit, an actuator, or a sensor. This enables efficient and secure data traffic via a network system integrated into a vehicle. A respective vehicle control unit can itself be formed by a so-called system-on-a-chip, i.e., be implemented as a microcontroller or microprocessor itself, or include such components.

[0029] The development of configuration files can therefore be carried out by a vehicle manufacturer. The vehicle manufacturer knows the topology of the network system integrated into a particular vehicle. If changes are made, the vehicle manufacturer can easily create appropriate configuration files for the various network devices using a centralized development tool and distribute them wirelessly to the vehicles.

[0030] Further advantageous embodiments of the network system according to the invention also emerge from the exemplary embodiment which is described below with reference to the figure.

[0031] Figure 1 shows a schematic view of a network system according to the invention.

[0032] Figure 1 shows a network system 1 according to the invention in a simple embodiment with only two network devices 2. In general, however, the network system 1 could also comprise more network devices 2. In the embodiment shown in Figure 1, two communicating devices 3 are connected to each network device 2. For this purpose, each network device 2 has several network ports 4. Accordingly, the communicating devices 3 also have matching network ports 4.

[0033] The communicating devices 3 are connected to a respective network device 2 via first network ports 4.1, and the respective network devices 2 are communicatively connected to one another via second network ports 4.2. A respective first network port 4.1 and a respective second network port 4.2 can be identical. However, a second network port 4.2 preferably has a higher transmittable data rate than a respective first network port 4.1.

[0034] Each network device 2 includes a firewall module 5. Using the firewall module 5, a firewall functionality can be implemented in a respective network device 2.

[0035] Typically, a firewall is deployed purely on a software basis. The firewall module 5 comprises the program code modules required to provide the firewall functionality. Additionally, a respective firewall module 5 can have dedicated hardware components, such as special memory elements or execution units, which serve exclusively to store corresponding program code modules or execute these program code modules. However, the remaining hardware components of a respective network device 2 can also be used for this purpose.

[0036] According to the invention, the respective network devices 2 are configured to filter data packets received from communicating devices 3 connected to the respective network device 2 and to forward data packets received from other network devices 2 unfiltered to a destination address. The destination address is a unique identifier of one of the communicating devices 3 of the network system 1 according to the invention. Destination addresses and source addresses can be an integral part of corresponding data packets exchanged over the network. The network devices 2 then execute corresponding method steps.

[0037] In other words, firewall module 5.1 filters data packets output by communicating devices 3.1 and 3.2, and firewall module 5.2 filters data packets output by communicating devices 3.3 and 3.4. As indicated by a large bold X, the data traffic flowing via second network ports 4.2 does not need to be monitored or filtered. This reduces the effort required to filter the data traffic exchanged via network system 1 according to the invention, allowing network system 1 according to the invention to operate more efficiently.

[0038] Accordingly, a method for filtering network traffic is part of the invention, which accordingly provides that the respective network devices 2 only filter the data packets received from the communicating devices 3 connected to the respective network device 2 and accordingly forward data packets received from other network devices 2 unfiltered to the respective destination addresses.

[0039] If the communicating device 3.1 sends data packets to the communicating device 3.4, as indicated by a black arrow, the network device 2.1 receives the data packets and filters them based on the rules set in the firewall module 5.1. The network device 2.1 sends data packets to be forwarded via the second network port 4.2 to the network device 2.2. The network device 2.2 receives the data packets and forwards them to the communicating device 3.4 without filtering them using the firewall module 5.2.

Claims

Patent claims 1. Network system (1), comprising at least two network devices (2) and for each network device (2) at least one communicating device (3), wherein each network device (2) has at least two network connections (4.1, 4.2), wherein for each network device (2) the at least one communicating device (3) is connected to a first network connection (4.1) of the respective network device (2) and at least one further network device (2) is connected to a second (4.2) network connection of the respective network device (2), and wherein each network device (2) has an integrated firewall functionality for filtering via the network connections (4.1, 4.2).2) data packets to be transmitted, characterized in that a respective network device (2) is set up to filter data packets received from communicating devices (3) connected to the respective network device (2) and to forward data packets received from other network devices (2) unfiltered to a destination address.

2. Network system (1) according to claim 1, characterized in that the respective network devices (2) are formed by an Ethernet switch.

3. Network system (1) according to claim 1 or 2, characterized in that the respective network devices (2) are configured to read in a configuration file and to use it to configure the firewall functionality, wherein the configuration file assigns at least one unique identifier to the respective Network device (2) contains connected communicating devices (3).

4. Network system (1) according to claim 3, characterized in that the firewall functionality of at least two network devices (2) is configured by individual, network device-specific configuration files.

5. Network system (1) according to claim 3 or 4, characterized in that at least one communicating device (3) has a mobile radio connection and is configured to receive configuration files via mobile radio.

6. Vehicle, characterized by a network system (1) according to one of claims 1 to 5.

7. Vehicle according to claim 6, characterized in that at least one communicating device (3) is formed by: a microcontroller, a microprocessor, a vehicle control unit, an actuator or a sensor.

Images