PCIe Hardware Filter for Automotive Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern data processing systems in vehicles face security risks due to bidirectional connections allowing access to security-critical components, making them vulnerable to manipulation from less security-critical devices, especially in scenarios like autonomous driving where direct access can lead to potential attacks.
Innovation Solution
Implementing a hardware-based filter means within the data processing device, such as a PCIe controlling chip, that assesses and filters communications data based on specified authorization conditions, ensuring only secure data is forwarded to storage or arithmetic units, while maintaining a functional feedback channel and allowing for autonomous configuration and reconfiguration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a bidirectional connection is provided between security-critical and less security-critical data processing devices, then functionality and feedback capability are improved, but security vulnerability increases due to potential manipulation from less secure devices
Solution Approach 1:
The patent introduces a hardware-based filter means as an intermediary component positioned between the communication interface and the security-critical data processing device. This filter means acts as a mediator that selectively permits or blocks communication data based on authorization conditions, thereby enabling bidirectional communication while preventing unauthorized access to security-critical components
Solution Approach 2:
The patent segments the communication path into distinct zones with different security requirements. The filter means creates a separation between the less secure communication interface and the secure internal components, allowing the system to maintain both functionality and security by processing communications through differentiated security zones
2Productivity
If direct access to storage means and arithmetic units is provided for communications partners, then communication efficiency and data processing speed are improved, but security risk increases due to potential hacking and manipulation
Solution Approach 1:
The hardware-based filter means serves as an intermediary that sits between the communication interface and the storage means/arithmetic units. It enables fast direct access for authorized communications while blocking unauthorized access attempts, thus maintaining both productivity and security
Solution Approach 2:
The filter means is configured with authorization conditions that enable it to autonomously evaluate and filter communication data without requiring external intervention. This self-service capability allows the system to maintain high data processing speeds while inherently protecting against security threats
3Reliability
If a monodirectional connection is used from security region to less security-critical partners, then security is improved, but controllability and administrability deteriorate due to lack of feedback channel
Solution Approach 1:
The filter means acts as a smart intermediary that enables bidirectional communication while maintaining security. It allows feedback channels to function properly for controllability and administrability while simultaneously protecting the security-critical device through hardware-based filtering
4Reliability
If a highly restricted feedback channel is provided with separate hardware implementation, then security is improved by limiting attack possibilities, but device complexity and functionality are reduced
Solution Approach 1:
The hardware-based filter means is designed as a multi-functional component that can handle various authorization conditions and filtering criteria within a single integrated unit. This universal design provides comprehensive security protection without requiring multiple separate hardware components, thereby reducing overall system complexity
Data Source
AI summary
A method for filtering communication data arriving from a communication partner via a communication connection, which provides access to at least one storage means of a receiving data processing device having at least one computation unit, in the data processing device, wherein PCI Express, in an interface unit, receiving the communication data, of the data processing device, a filter means, at least part of which is embodied as hardware, is used so that, according to configuration information, prescribed on the data processing device, containing at least one approval condition that rates the at least one property of the useful data contained in the communication data, only the communication data meeting at least one approval condition are forwarded from the interface unit to at least one further component of the data processing device.