Method for managing messages in a data processing unit in a network

Abstract

The present invention relates to a method for managing messages (340, 350) in a data processing unit (300) in a network, in particular in a vehicle, wherein the data processing unit (300) comprises an interface unit (360), wherein the data processing unit (300) is connected to the network via the interface unit (360); wherein the data processing unit (300) comprises a first storage unit (310) and a second storage unit (320); wherein the data processing unit (300) comprises a first DMA channel (315) for accessing the first storage unit (310) and a second DMA channel (325) for accessing the second storage unit (320); wherein the method comprises the following steps: receiving messages (340, 350, 440) via the interface unit (360); determining source information relating to a source (240, 250) of each of the received messages (340, 350); and storing the individual received messages (340, 350), depending on the source information determined for the message (340, 350), either in the first storage unit (310) by means of the first DMA channel (315) for further processing by means of the first execution environment, or in the second storage unit (320) by means of the second DMA channel (325) for further processing by means of the second execution environment.

Description

[0001] R. 413774

[0002] - 1 -

[0003] Description

[0004] title

[0005] Method for managing messages in a data processing unit in a network

[0006] Technical field

[0007] The present invention relates to a method for managing messages in a data processing unit in a network, in particular in a vehicle, and to a data processing unit for executing the method.

[0008] State of the art

[0009] Data processing units can be connected via networks in a wide variety of technical applications, such as smartphones, smart homes, connected cars, etc. In such a network, trusted, secure network participants, which can be protected by specific security mechanisms, can be connected to untrusted, insecure, and unprotected network participants, potentially creating a security risk and vulnerability to cybersecurity attacks.

[0010] For example, in the automotive sector, connected cars could make commuting more convenient, but they also expose the car to various cybersecurity attacks. It can be crucial to ensure that a car can connect to the outside world via various interfaces, yet still securely provide essential vehicle functions such as engine control, braking, and so on. The security implications of a smart car can be far greater than those of, say, a smartphone, since the consequences of a system failure in a car can be much more severe than in a phone. R. 413774

[0011] - 2 -

[0012] To make a connected car safe, the car can be divided into safety zones by, for example, isolating parts of the vehicle that provide essential vehicle functions (brakes, etc.) from parts of the car with interfaces to the outside world (e.g., infotainment systems). The exchange of information between safety zones could be strictly monitored by, for example, scanning all incoming and outgoing traffic between them and filtering out any harmful or suspicious content.

[0013] An important component of such a vehicle architecture based on security zones can be an ECU (electronic control unit), such as a gateway ECU, which sits between the security zones and enables information exchange between them. With such ECUs, the software components that communicate directly with the vehicle's insecure zones may need to be isolated from those communicating with the secure zones. Furthermore, since this ECU is also where information is exchanged between the vehicle's secure and insecure zones, security functions such as firewalls, intrusion detection, etc., may be important to filter the traffic exchanged between zones.

[0014] For the design of such an ECU, interfaces to the car's untrusted zones can be isolated from interfaces communicating with the car's trusted zones. For this purpose, two different data processing units, e.g., two different microcontrollers, can be provided. One microcontroller can host an execution environment for processing information from trusted zones, and the other can host an execution environment for processing information from untrusted zones. These different microcontrollers can each be connected to different ports of an on-board Ethernet switch. The exchange of information between the execution environments processing data from trusted zones and data from untrusted zones can be filtered and can take place via shared memory or any other interface.413774.

[0015] - 3 -

[0016] However, zonal isolation using hardware of this kind, by providing two separate data processing units, can lead to high costs, significant effort, and additional hardware resources, such as an extra port on a switch. Zonal isolation could also be implemented in software. However, software isolation can be violated by various means, such as the execution of arbitrary code over a network.

[0017] Summary of the invention

[0018] The present invention relates to a method for managing messages in a data processing unit in a network, and to a data processing unit for executing the method with the features of the independent claims. Advantageous further developments are the subject of the dependent claims and the following description.

[0019] The data processing unit can be provided, for example, as a microcontroller, a control unit or electronic control unit, a gateway, a network manager, and / or a network controller, such as an Ethernet controller. In particular, the data processing unit can be provided as a microcontroller used in an electronic control unit, a gateway, a network manager, and / or a network controller. Advantageously, the data processing unit can be provided to receive messages from network participants or network units and to manage these messages so that they can be further processed. In particular, the data processing unit can be provided to connect different networks or different zones within a network.

[0020] The data processing unit comprises an interface unit, and the data processing unit is connected to the network via this interface unit. It is also possible for the data processing unit to be connected to multiple networks via this interface unit. The interface unit can, for example, be provided as a switch with multiple ports, connecting different network participants or different networks. R. 413774

[0021] - 4 - these ports can be connected. It is also possible that the interface unit is connected to a switch of this type.

[0022] The data processing unit further comprises a first storage unit and a second storage unit. For example, these storage units can be provided as RAM units or buffer units. Advantageously, the first and second storage units can be provided as descriptor rings, ring buffers, ring queues, cyclic buffers, or ring buffers, e.g., of an Ethernet controller.

[0023] The data processing unit further comprises a first direct storage access (DMA) channel for accessing the first storage unit, e.g., for transferring data between the interface unit and the first storage unit, and a second DMA channel for accessing the second storage unit, e.g., for transferring data between the interface unit and the first storage unit. These DMA channels allow access to the respective storage unit, in particular independently of a CPU (central processing unit) of the data processing unit, and especially independently of any software executed by the CPU.

[0024] The procedure includes the step of receiving messages via the interface unit. These messages can be sent by various network participants connected to the data processing unit via the interface unit, in particular from both trusted secure sources and untrusted insecure sources. The messages can be, for example, data messages, frames, or a data frame, especially an Ethernet frame.

[0025] The procedure further includes the step of determining source information about the respective source or sender of each received message. Advantageously, the respective source information uniquely identifies the respective network participant who sent the respective message. For example, the various messages can contain the respective source information themselves, and upon receipt of the respective messages, the corresponding source information can be extracted or R. 413774

[0026] - 5 - can be read. Alternatively or additionally, the source information can be determined depending on the port to which the source is connected.

[0027] The process further includes the step of storing or buffering each received message in the first storage unit using the first DMA channel or in the second storage unit using the second DMA channel, depending on the specific source information of the respective message. Therefore, depending on the source that sent the message, it is transferred to either the first or the second storage unit.

[0028] Using DMA channels, two different preconfigured channels—message channels, storage channels, or memory allocation channels—can be provided in the data processing unit. These channels allow received messages to be automatically and dynamically allocated to the respective storage unit, depending on the message's source. In particular, DMA channels enable message allocation to the data processing unit independently of the CPU (central processing unit). The invention therefore allows the use of multiple DMA channels to separate traffic in hardware or at the hardware level, rather than in software.

[0029] Source information can be used, for example, to evaluate whether a received message originated from a secure, trusted source or an untrusted, insecure source. Using DMA channels, received messages can be transferred at the hardware level, depending on whether the message originated from a trusted or untrusted source, to either the first or second storage unit. For example, one DMA channel can be dedicated to allocating messages received from trusted sources to the appropriate storage unit for buffering, while the other DMA channel can be dedicated to allocating messages from untrusted sources. (R. 413774)

[0030] - 6 - to allocate to a respective storage unit to buffer these untrusted messages. For example, one of the first storage unit and the second storage unit can be used to store only messages sent from trusted sources, while the other of the first storage unit and the second storage unit can be used to store only messages sent from untrusted sources. In this way, the received messages, particularly in the data processing unit, can be separated or isolated depending on whether the messages were sent from trusted or untrusted sources.

[0031] The invention therefore allows, in particular, zonal isolation, especially between a secure trusted zone and an insecure untrusted zone, by providing the first and second DMA channels, in order to allow respective memory management or allocation of incoming messages to these storage units in hardware or at a hardware level, e.g., by configuring multiple descriptor rings of an Ethernet controller. The invention provides, in particular, a way to separate and isolate mixed messages originating from trusted and untrusted sources and to manage these separated messages independently for further processing by different execution environments.

[0032] The invention particularly enables zonal isolation using only one data processing unit, e.g., only one microcontroller, and with only a single physical connection between the network and the data processing unit. Therefore, the invention allows zonal isolation with low costs, minimal effort, and fewer hardware resources, especially compared to zonal isolation in hardware using different data processing units, e.g., using two different microcontrollers.

[0033] The invention can further enable zonal isolation independent of the CPU and independent of software executed by the CPU, in particular even before initial software processing takes place in the data processing unit. The invention thus allows for better, more secure isolation of R. 413774

[0034] - 7 -

[0035] Messages as a zonal isolation in software. The zonal isolation provided by the invention is advantageously not susceptible to violations by the execution of arbitrary code over the network.

[0036] The invention can also enable interference-free operation. For example, messages from sources with different security levels can be separated and stored in different storage units. This prevents systems with different security levels from interfering with each other when accessing their respective messages.

[0037] According to one embodiment, the steps of receiving messages via the interface unit, determining the source information, and storing each received message in the first storage unit using the first DMA channel or in the second storage unit using the second DMA channel are performed by hardware mechanisms. The received messages can therefore be separated at the hardware level.

[0038] According to one embodiment, the steps of receiving messages via the interface unit, determining the source information, and storing each received message in the first storage unit using the first DMA channel or in the second storage unit using the second DMA channel are performed independently of any software executed by a processing unit, such as the CPU, of the data processing unit. This advantageously reduces network-based arbitrary code execution attacks that are possible with software-based isolation. In particular, the received messages can be separated using the DMA channels before the CPU executes any software, for example, before the first software execution after a boot process, after waking up, etc.

[0039] According to one embodiment, the step of storing the individual received messages in the first storage unit using the first DMA channel or in the second storage unit using the second DMA channel comprises R. 413774

[0040] - 8 -

[0041] Channel storage of each received message in the first storage unit via the first DMA channel occurs when the respective specific source information of the respective message matches predetermined first reference information about a first type of source. If the respective specific source information of the respective message matches predetermined second reference information about a second type of source, the respective message is stored in the second storage unit via the second DMA channel. For example, for zonal isolation, one of the first and second type of sources might correspond to trusted sources, while the other of the first and second type of sources might correspond to untrusted sources. For interference-free operation, the different types of sources might, for example, correspond to sources with different security levels.The first and second predetermined reference information can each be stored in the data processing unit, for example, in a respective list or lookup table. Therefore, the respective memory allocation channels for automatically forwarding received messages to the respective storage units can be implemented.

[0042] According to one embodiment, the respective source information of each received message is determined based on the header of that message. The header of each message includes, in particular, various pieces of information, especially information about the source and recipient of the message. The respective source information is extracted or read in upon receipt of the respective message.

[0043] According to one embodiment, the step of determining the source information of each received message includes determining the address of the respective source of that message. For example, the source information can be determined to be a MAC (Media Access Control) address of the respective source. The different sources can therefore be uniquely identified. Advantageously, the first and second reference information about the first and second types of sources includes the respective addresses of the respective sources, in particular, trusted and untrusted sources. R. 413774

[0044] - 9 -

[0045] According to one embodiment, the first storage unit and the second storage unit are separated from each other, in particular physically separated and isolated, e.g., by a suitable hardware mechanism. Specifically, each of the first and second storage units is protected by a respective protection unit, in particular a hardware protection unit, especially a MPU (memory protection unit). In this way, trusted and untrusted messages can be reliably separated and isolated from each other, and it can be prevented that messages from untrusted sources enter a secure execution environment.

[0046] According to one embodiment, the data processing unit further comprises a third storage unit, or at least one third storage unit. This third storage unit is provided, in particular, as a buffer unit, e.g., for buffering received messages in one or more queues, e.g., for processing according to the FIFO (first in, first out) principle. The method further comprises, after the step of receiving the messages via the interface unit, buffering the individual received messages in the third storage unit.The source information of each individual message buffered in the third storage unit is determined, and depending on this source information, the individual messages buffered in the third storage unit are forwarded to the first storage unit via the first DMA channel or to the second storage unit via the second DMA channel. Therefore, the messages can be buffered upon arrival and then processed sequentially and assigned to either the first or the second storage unit.

[0047] According to one embodiment, the third storage unit comprises a plurality of storage areas. It is also possible for different storage areas to be implemented in different third storage units. For example, each storage area can correspond to a specific queue, e.g., for processing according to the FIFO principle. The method further comprises, after the step of receiving the messages via the interface unit, determining priority information via an R. 413774

[0048] - 10 - The respective priority of each received message and the buffering of each received message in a specific storage area of ​​the multitude of storage areas depends on the respective priority information of the respective message. For example, the respective priority information can be determined depending on the header of the respective message. Each storage area can, for example, be provided for buffering messages with a specific priority. The storage areas can then be processed in order of their respective priorities, with the storage area containing the highest priority messages being processed first.

[0049] According to one embodiment, the step of determining the priority information for each received message and the step of buffering each received message in the specific storage area of ​​the plurality of storage areas are performed by hardware mechanisms, depending on the priority information of each message. This is done independently of any software execution by the processing unit of the data processing unit, and in particular before any software execution by the processing unit of the data processing unit. Therefore, the processing of received messages in the third storage unit by sorting them according to priorities can advantageously be implemented entirely in hardware, especially independently of any software executed by the CPU.In particular, the handling of received messages in the third storage unit and the separation of received messages using the DMA channels can advantageously be performed using only hardware resources, thereby eliminating the risk of arbitrary code execution.

[0050] According to one embodiment, the first storage unit is designed to be accessed by a first execution environment, and the second storage unit is designed to be accessed by a second execution environment. In particular, only the first execution environment is permitted to access the first storage unit, but the second execution environment is advantageously not permitted to access the first storage unit. R. 413774

[0051] - 11 - fen. Conversely, only the second execution environment is allowed to access the second storage unit, while the first execution environment is not allowed to access the second storage unit. The first and second execution environments can be implemented, for example, within the data processing unit itself, such as in a processing unit of the data processing unit. It is also possible for the first and second execution environments to be implemented outside the data processing unit in other network participants to which the data processing unit is connected. For example, each of the first and second execution environments can be implemented in a separate network participant.

[0052] The first and second execution environments can advantageously be physically separated from each other, for example, by a suitable hardware mechanism. One of the first and second execution environments can, in particular, be a secure execution environment for executing processes securely, for example, protected by security mechanisms or safeguards implemented in hardware and / or software. The other of the first and second execution environments can, in particular, be an insecure execution environment, which is not protected by specific security or safeguards. The corresponding secure execution environment can, in particular, access the respective storage unit in which messages sent from trusted sources are buffered.Accordingly, the respective non-secure execution environment can access, in particular, the storage unit where messages sent from untrusted sources are buffered. Therefore, by separating and isolating messages across the various DMA channels, it can be ensured that the secure execution environment can only access messages from secure sources and, in particular, that messages from insecure sources cannot enter the secure execution environment.

[0053] According to one embodiment, the method further comprises the step of processing the respective individual messages stored in the first storage unit using the first execution environment and processing the respective individual messages stored in the second storage unit. R. 413774

[0054] - 12 - using the second execution environment. If the execution environments are implemented within the data processing unit itself, the data processing unit can process trusted and untrusted messages completely isolated and separately. If the execution environments are implemented outside the data processing unit in other network participants, the data processing unit can manage communication and data exchange between different security zones, thereby preventing untrusted messages from being transferred to secure zones.

[0055] The invention is suitable for countless different technical applications, e.g. for smartphones, smart homes, etc., in particular for connecting a device to trusted and untrusted zones.

[0056] The invention can be used in particular to reduce attack surfaces and close vulnerabilities to cybersecurity attacks or to ensure freedom from disruption.

[0057] The invention is particularly suitable for use in the automotive sector, e.g., for connected cars. The data processing unit can be provided, in particular, as a microprocessor or as an ECU (electronic control unit) of a vehicle. Specifically, the data processing unit can be provided or implemented as a gateway or gateway ECU, a network manager, and / or a network controller of a vehicle, e.g., an Ethernet controller located between different security zones and enabling information exchange between these security zones.

[0058] A data processing unit according to the invention, e.g. a control unit of a vehicle, is in particular designed by a computer program to execute a method according to the invention.

[0059] Further advantages and developments of the invention are specified in the description and in the accompanying drawings. R. 413774

[0060] - 13 -

[0061] It is understood that the features mentioned above and to be explained below can be used not only in the combination specified, but also in other combinations or independently, without leaving the scope of protection of the present invention.

[0062] The invention is schematically illustrated in the drawings on the basis of exemplary embodiments and is described in detail below with reference to the drawings.

[0063] Description of the drawings

[0064] Fig. 1 schematically shows data processing units for managing messages in a network according to the state of the art.

[0065] Fig. 2 schematically shows a data processing unit for managing messages in a network according to the state of the art.

[0066] Fig. 3 schematically shows a data processing unit for managing messages, designed to execute a method according to an embodiment of the present invention.

[0067] Fig. 4 schematically shows a data processing unit for managing messages, designed to execute a method according to an embodiment of the present invention.

[0068] Detailed description of the drawings

[0069] Fig. 1 schematically shows data processing units for managing messages in a network according to the state of the art.

[0070] A Gateway 100 is provided, e.g., for managing messages in a vehicle network, such as in a smart car or a connected car.

[0071] The Gateway 100 comprises two data processing units, specifically a first microcontroller 110 and a second microcontroller 120. The Ga- R. 413774

[0072] - 14 - teway 100 further includes a switch 130, e.g. an Ethernet switch, with a number of ports 131 , 132.

[0073] A first electronic control unit (ECU) 140 is connected to a first port 131 of the switch 130. This first ECU 140 can be, for example, an untrusted ECU in an unsecured, untrusted zone, such as in a first network or a first subnetwork. For example, the untrusted ECU 140 can be an ECU that can communicate with the outside world, such as an ECU for controlling an infotainment system.

[0074] A second electronic control unit (ECU) 150 is connected to a second port 132 of the switch 130. This second ECU 150 can, for example, be a trusted ECU in a secure, trusted zone, such as in a second network or subnetwork. For instance, the trusted ECU 150 could be an ECU for controlling an essential vehicle function, such as controlling the vehicle's brakes.

[0075] The first microcontroller, 110, communicates with the first switch port, 131. The second microcontroller, 120, communicates with the second switch port, 132. Messages sent by the first, untrusted ECU, 140, and received via the first port, 131, of switch 130 are forwarded only to the first microcontroller, 110, and not to the second microcontroller, 120. Conversely, messages sent by the second, trusted ECU, 150, and received via the second port, 132, of the switch are forwarded only to the second microcontroller, 120, and not to the first microcontroller, 110. The first microcontroller, 110, hosts an execution environment for processing information from the untrusted ECU, 140. The second microcontroller, 120, hosts an execution environment for processing information from the trusted ECU, 150.

[0076] In this way, zonal isolation of the trusted zone 150 and the untrusted zone 140 can be provided by hardware, i.e., by providing two different microcontrollers 110 and 120. R. 413774

[0077] - 15 -

[0078] However, zonal isolation using hardware of this kind can lead to high costs, significant effort, and additional hardware resources.

[0079] Fig. 2 schematically shows a gateway 100' according to the prior art as shown in Fig. 1. The gateway 100' comprises only one data processing unit 110', in particular a microcontroller 110'. The gateway 100' further comprises an Ethernet switch 130' with a number of ports 131', 132', wherein a first, untrusted ECU 140' is connected to a first port 131', and a second, trusted ECU 150' is connected to a second port 132'. The microcontroller 110' communicates with the switch 130' via an interface 160'.

[0080] In contrast to the gateway 100 of Fig. 1, zonal isolation of the trusted zone 150' and the untrusted zone 140' is provided in the gateway 100' in software, specifically by means of software executed on the microcontroller 110'. However, such software-based zonal isolation could be violated by various means, such as the execution of arbitrary code over the network.

[0081] In contrast to zonal isolation in hardware or software, as shown in Figs. 1 and 2, the present invention allows zonal isolation by providing different storage units and by automatically and dynamically assigning messages to these storage units.

[0082] The invention allows, in particular, zonal isolation with only one data processing unit, e.g., only one microprocessor, using existing hardware resources and without the use of software, as explained below with reference to Figs. 3 and 4.

[0083] In Figs. 3 and 4, identical reference numbers refer to identical or equivalent elements.

[0084] Fig. 3 schematically shows a gateway 200 for a network, e.g., a vehicle network, such as in a smart car or connected car. The gateway 200 includes a data processing unit 300, e.g., a microcontroller 300. The gateway 200 also includes a switch 230, e.g., an Ethernet switch R. 413774

[0085] - 16 - with a number of ports 231, 232. For simplicity, only two ports 231 and 232 are shown. However, the switch 230 can also include a larger number of ports.

[0086] The first switch port 231 is connected to a first untrusted, non-secure electronic control unit (ECU) 240, for example, for communication with the outside world, such as controlling an infotainment system. This first ECU 240 can be deployed in a non-secure, non-trusted zone, such as a first network or subnetwork. The second switch port 232 is connected to a second trusted, secure electronic control unit (ECU) 250, for example, for controlling the vehicle's brakes. This second ECU 250 can be deployed in a secure, trusted zone, such as a second network or subnetwork.

[0087] The microcontroller 300 is connected to the switch 230 via an interface unit 360. Through this interface unit 360, the microcontroller 300 communicates with both the first port 231 and the second port 232. Therefore, the microcontroller 300 receives messages from both the first untrusted ECU 240 and the second trusted ECU 250. The microcontroller 300 is designed to manage the received messages and to separate and isolate them from the messages sent by the trusted ECU 250 and the untrusted ECU 240. For this purpose, the microcontroller 300 is designed to execute an embodiment of a method according to the invention.

[0088] For this purpose, the microcontroller 300 includes a first storage unit 310, a second storage unit 320, a first direct memory access or DMA channel 315 for accessing the first storage unit 310, and a second DMA channel 325 for accessing the second storage unit 320. The microcontroller 300 may further include a memory controller 330, e.g., a medium access controller or DMA controller, for implementing these DMA channels 315 and 325. R. 413774

[0089] - 17 -

[0090] Each of the first storage unit 310 and the second storage unit 320 is provided, for example, as a RAM unit or a buffer unit, such as a descriptor ring, ring buffer, ring queue, cyclic buffer, or ring buffer. The first and second storage units 310 and 320 are physically separated from each other, and each storage unit 310 and 320 is protected by a memory protection unit (MPU) 370.

[0091] The untrusted ECU 240 sends untrusted messages 340 to the switch 230, and the trusted ECU 250 sends trusted messages 350 to the switch. Since the trusted ECU 250 and the untrusted ECU 240 are connected to different ports 231 and 232 of the switch 230, there is traffic isolation for incoming messages at the switch 230. However, because the switch 230 is connected to the microcontroller 300 via the interface unit 360, the previously isolated untrusted and trusted messages 340 and 350 are mixed and forwarded in a single message stream from the switch 230 to the microcontroller 300 via the interface unit 360. At the microcontroller 300, these mixed trusted and untrusted messages are separated and isolated from each other.For this purpose, the microcontroller 300 executes an embodiment of a method according to the invention.

[0092] According to this embodiment of the present invention, the stream of various messages 340, 350 is received via the interface unit 330 in the microcontroller 300. Source information about the respective source of each of the received messages 340, 350 is determined. In particular, the source information characterizes whether the respective received message was sent by the trusted ECU 250 or by the untrusted ECU 240. Depending on the source information, the individual messages are stored either by means of the first DMA channel 315 in the first storage unit 310 or by means of the second DMA channel 325 in the second storage unit 320. In particular, messages 340 sent by the untrusted ECU 340 are stored in the first storage unit 310 and messages sent by the trusted ECU 350 are stored in the second storage unit 320. (See R. 413774)

[0093] - 18 - the respective messages are buffered in storage units 310, 320 for further processing.

[0094] Therefore, two different channels can be provided, in particular two Direct Memory Access (DMA) channels 315, 325, for automatically and dynamically allocating the received messages 340, 350 to the corresponding storage unit 310, 320. Specifically, the first DMA channel 315 is provided to allocate messages 340 from the untrusted ECU 240 to the first storage unit 310, and the second DMA channel 325 is provided to allocate messages 350 from the trusted ECU 250 to the second storage unit 320. In this way, multi-channel DMA can be used to isolate traffic independently of the microcontroller 300's CPU and independently of any software running on the microcontroller 300, especially even before the first software processing takes place.

[0095] This isolation of the received message can be carried out using predetermined reference information about the various sources, as will be explained with reference to Fig. 4.

[0096] Figure 4 schematically shows the microcontroller 300 with the interface unit 360, the memory controller 330, and the first and second memory units 310 and 320. Incoming messages in the message stream forwarded from the switch 230 via the interface 330 to the microcontroller 300 are assigned the reference number 440. As explained above, these messages 440 are mixed messages sent by both the trusted ECU 250 and the untrusted ECU 240. Each message 440 can, for example, be an Ethernet frame containing a header with a plurality of header fields 441 and 442 according to the IEEE 802.1Q standard. For simplicity, each message 440 in Figure 4 is shown with only two header fields, but the messages 440 can also contain more than these two header fields. A first header field 441 contains an address of the source of the respective message 440, e.g. a MAC address.The MAC address can be considered locally administered, so the MAC address of a specific ECU in every car manufactured by the same OEM will have the same address R. 413774.

[0097] - 19 - can. A second header field 442 can contain a priority of the respective message 440, e.g. a PCP (Priority Code Point) which is a 3-bit field that contains the priority of the respective frame 440.

[0098] The microcontroller 300 further includes a third storage unit 430, e.g., a buffer unit for buffering received messages 440. This third storage unit 430 can be implemented, for example, in the memory controller 330. For instance, the third storage unit 430 can comprise a plurality of storage areas 431, 432, 433, 434. Each of these storage areas 431, 432, 433, 434 can be provided as a specific queue for processing according to the FIFO (first in, first out) principle.

[0099] After a corresponding message 440 is received via the switch 230 and forwarded by the switch 230 to the microcontroller 300 via the interface unit 360, information about the priority of the respective message 440 is determined by reading the second header field 442. Depending on the priority of the respective message 440, the message 440 is buffered in a specific storage area of ​​the third storage unit 430. For example, messages 440 can have either a first, higher priority or a second, lower priority. Messages 440 with the first, higher priority can, for example, be buffered in a first queue or a first storage area 431 of the third storage unit 430. Messages 440 with the second, lower priority can, for example, be buffered in a second queue or a second storage area 432.Queues 431, 432, 433, and 434 can then be processed in the order of the priority of the buffered messages 440; that is, the first queue, 431, can be processed first, followed by the second queue, 432. If QoS handling is disabled, the received messages 440 could also be placed in the same queue.

[0100] The source information of each buffered message 440 is determined, and the messages are transferred, depending on the respective source information, either via the first DMA channel 315 to the first storage unit 310 or via the second DMA channel 325 to the second storage unit. R. 413774

[0101] - 20 - forwarded to the fuse unit 320. For this purpose, the microcontroller 300 can further include predetermined first reference information 410 about a first type of source and predetermined second reference information 420 about a second type of source. The first reference information 410 can include a list of MAC addresses assigned to untrusted ECUs in the vehicle. The second reference information 420 can include a list of MAC addresses assigned to trusted ECUs in the vehicle. For example, the first reference information 410 and the second reference information 420 can each be stored as a corresponding list or lookup table in the microcontroller 300.

[0102] To process the individual messages 440 buffered in the third storage unit 430, the source information of each message 440 is determined by reading the source MAC address from the respective first header field 441. If the source MAC address of the respective message 440 is present in the first list 410 of reference information about untrusted ECUs, the respective message is forwarded to the first storage unit 310 via the first DMA channel 315. If the source MAC address of the respective message 440 is present in the second list 420 of reference information about untrusted ECUs, the respective message 440 is forwarded to the second storage unit 320 via the second DMA channel 325.

[0103] Since MAC addresses are administered locally, the source MAC address reveals the origin of each frame 440 and therefore whether the frame comes from a trusted ECU or not. Although the source MAC address could be spoofed, for example, by using security mechanisms such as a static firewall where an Ethernet switch port is mapped only to a specific list of MAC addresses, such spoofed frames could be dropped and not processed further.

[0104] Therefore, by appropriately configuring the MAC control registers of the microcontroller 300, each DMA channel 315, 325 can be assigned to one or more source MAC addresses on the input side and to a single storage unit or descriptor ring 310, 320 on the output side. R. 413774

[0105] - 21 - can be mapped. Each descriptor in the descriptor ring can point to a specific buffer into which data could be copied or from which it could be read. Each of the first storage unit 310 and the second storage unit 320 can be provided as a buffer pool, which comprises a group of buffers.

[0106] The first storage unit 310 is designed so that only a first execution environment 450 can access it, and the second storage unit 320 is designed so that only a second execution environment 460 can access it. These execution environments 450 and 460 can be implemented in the microcontroller 300 itself, for example, in its CPU. The execution environments 450 and 460 are advantageously separated from each other, for example, physically by a suitable hardware mechanism. The first execution environment 450 is provided for handling traffic from an untrusted zone and processes the messages 440 sent by the untrusted ECU 240, which are stored in the first storage unit 310.The second execution environment 460 is provided for handling traffic from a trusted zone and processes the messages 440 sent by the trusted ECU 250, which are stored in the second storage unit 320. Since the first execution environment 450 only has access to the first buffer pool 310, and since the second execution environment 460 only has access to the second buffer pool 320, messages from trusted and untrusted sources can be separated and isolated by the software in the microcontroller 300 even before the first access to the Ethernet frame data.

[0107] The present invention therefore provides a means of reducing the attack surface through information isolation using multiple DMA channels in a peripheral device that handles network traffic from different security zones. The invention allows the separation of mixed information originating from trusted and untrusted sources by configuring multiple descriptor rings to achieve information separation before the first software processing takes place, thereby enabling more secure isolation of trusted information. R. 413774

[0108] - 22 - to guarantee the separation of trustworthy information from untrusted information as with a software-based separation.

Claims

R. 413774 - 23 - Claims 1. A method for managing messages (340, 350, 440) in a data processing unit (300) in a network, in particular in a vehicle, wherein the data processing unit (300) comprises an interface unit (360), the data processing unit (300) being connected to the network via the interface unit (360); wherein the data processing unit (310) comprises a first storage unit (310) and a second storage unit (320); wherein the data processing unit (300) comprises a first direct memory access or DMA channel (315) for accessing the first storage unit (310) and a second DMA channel (325) for accessing the second storage unit (320); wherein the method comprises the following steps: Receiving messages (340, 350, 440) via the interface unit (360); Determining source information about each source (240, 250) of each of the received messages (340, 350, 440); and Storing the individual received messages (340, 350, 440) depending on the respective specific source information of the respective message (340, 350, 440) in the first storage unit (310) using the first DMA channel (315) or in the second storage unit (320) using the second DMA channel (325).

2. Method according to claim 1, wherein the step of receiving the messages (340, 350, 440) via the interface unit (360), the step of determining the source information and the step of storing the individual received messages (340, 350, 440) in the first storage unit (310) by means of the first DMA channel or in the second storage unit R. 413774 - 24 - rung unit (320) via the second DMA channel (325) by means of hardware mechanisms.

3. Method according to claim 1 or 2, wherein the step of receiving the messages (340, 350, 440) via the interface unit (360), the step of determining the source information and the step of storing the individual received messages (340, 350, 440) in the first storage unit (310) by means of the first DMA channel (315) or in the second storage unit (320) by means of the second DMA channel (325) are performed independently of any software executed by a processing unit of the data processing unit, in particular before any software is executed by the processing unit of the data processing unit.

4. A method according to any of the preceding claims, wherein the step of storing the individual received messages (340, 350, 440) in the first storage unit (310) by means of the first DMA channel (315) or in the second storage unit (320) by means of the second DMA channel (325) comprises the following: Storing a respective message (340, 440) of the received messages in the first storage unit (310) using the first DMA channel (315) if the respective specific source information of the respective message (340, 440) corresponds to predetermined first reference information (410) about a first type of source (240); or storing a respective message (350, 440) of the received messages in the second storage unit (320) using the second DMA channel (325) if the respective specific source information of the respective message (350, 440) corresponds to predetermined second reference information (420) about a second type of source (250).

5. Method according to any of the preceding claims, wherein the step of determining source information of each of the received messages (340, 350, 440) comprises the following: Determining the respective source information depending on a header (441) of the respective message (340, 350, 440). R. 413774 - 25 - 6. A method according to any of the preceding claims, wherein the step of determining source information of each of the received messages (340, 350, 440) comprises the following: Determining an address of the respective source (240, 250) of the respective message (340, 350, 440).

7. Method according to any of the preceding claims, wherein the first storage unit (310) and the second storage unit (320) are separate from each other.

8. Method according to any of the preceding claims, wherein the data processing unit (300) further comprises a third storage unit (430), wherein the method further comprises: Buffering of the individual received messages (340, 350, 440) in the third storage unit (430); Determining the respective source information of the individual messages (340, 350, 440) buffered in the third storage unit (430); and forwarding the individual messages (340, 350, 440) buffered in the third storage unit (430) to the first storage unit (310) via the first DMA channel (315) or to the second storage unit (320) via the second DMA channel (325) depending on the respective determined source information of the respective message (340, 350, 440).

9. The method of claim 8, wherein the third storage unit (430) comprises a plurality of storage areas (431, 432, 433, 434), the method further comprising: Determining priority information about the respective priority of each of the respective received messages (340, 350, 440); and buffering the individual received messages (340, 350, 440) in a specific storage area of ​​the multitude of storage areas (431, 432, 433, 434) depending on the respective priority information of the respective message (340, 350, 440). R. 413774 - 26 - 10. The method of claim 9, wherein the step of determining the priority information about the respective priority of each of the respective received messages (340, 350, 440) and the step of buffering the individual received messages (340, 350, 440) in the specific storage area of ​​the plurality of storage areas (431, 432, 433, 434) depending on the respective priority information of the respective message (340, 350, 440) are performed by hardware mechanisms, in particular independently of any software executed by a processing unit of the data processing unit, and in particular before any software is executed by the processing unit of the data processing unit.

11. Method according to any of the preceding claims, wherein the first storage unit (310) is designed to be accessed by a first execution environment (450), and wherein the second storage unit (320) is designed to be accessed by a second execution environment (460).

12. The method of claim 10, further comprising: Processing the respective messages (340, 440) stored in the first storage unit (310) using the first execution environment (450) and processing the respective messages (350, 440) stored in the second storage unit (320) using the second execution environment (460).

13. Data processing unit (300) designed to perform all process steps of a process according to any of the preceding claims.

Images