Serial network communication using intelligent access policies
In one embodiment, a device of a vehicle receives a packet comprising a source address, a destination address, an internet protocol (IP) encapsulated controller area network (CAN) message, and CAN message identifier information. The device compares the source address, the destination address, and the CAN message identifier information to an access control list (ACL). The device makes a determination that delivery of the CAN message to the destination address would be a policy violation based on the comparison. The device drops the packet based on the determination that delivery of the CAN message to the destination address would be a policy violation.
1. A method, comprising:
receiving, by a device of a vehicle, a packet comprising a source address, a destination address, an internet protocol (IP) encapsulated controller area network (CAN) message, and CAN message identifier information;
comparing, by the device and based on an access control list (ACL), a) a range of prefixes associated with the source address or the destination address and b) a prefix mask of the CAN message identifier information, wherein the comparing comprises determining that the prefix mask of the CAN message identifier information is not a match in the range of prefixes associated with the source address or the destination address;
making, by the device and based on the comparing, a determination that delivery of the CAN message to the destination address would be a policy violation; and
dropping, by the device, the packet based on the determination that delivery of the CAN message to the destination address would be a policy violation.
2. The method of claim 1 , wherein the device is an ethernet switch unit (ESU).
3. The method of claim 1 , wherein the packet is sent by an in-vehicle control unit (ICU) of the vehicle that encapsulates the CAN message with an IP header.
4. The method of claim 1 , the packet further comprising a user datagram protocol (UDP) source port and a UDP destination port.
5. The method of claim 1 , wherein the prefix mask of the CAN message identifier information does not share common bits with the range of prefixes associated with the source address and the destination address.
6. The method of claim 1 , wherein comparing a) the range of prefixes associated with the source address or the destination address and b) the prefix mask of the CAN message identifier information comprises further comprises determining, by the device, that the destination address does not share common bits with a range of destination addresses associated with the source address.
7. The method of claim 1 , wherein the IP encapsulated CAN message comprises an Autosar header.
8. The method of claim 1 , wherein the device is part of an advanced driver assistance system (ADAS) of the vehicle.
9. An apparatus, comprising:
one or more physical network interfaces to communicate with a network;
a physical processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store instructions executable by the processor, the instructions, when executed by the processor, configured to cause a device of a vehicle to:
receive, by the device, a packet comprising a source address, a destination address, an Internet protocol (IP) encapsulated controller area network (CAN) message, and CAN message identifier information;
compare, by the device and based on an access control list (ACL), a) a range of prefixes associated with the source address or the destination address and b) a prefix mask of the CAN message identifier information, wherein the comparing comprises determining that the prefix mask of the CAN message identifier information is not a match in the range of prefixes associated with the source address or the destination address;
make, by the device and based on the comparison, a determination that delivery of the CAN message to the destination address would be a policy violation; and
drop, by the device, the packet based on the determination that delivery of the CAN message to the destination address would be a policy violation.
10. The apparatus as in claim 9 , wherein the device is an ethernet switch unit (ESU).
11. The apparatus as in claim 9 , wherein the packet is sent by an in-vehicle control unit (ICU) of the vehicle that encapsulates the CAN message with an IP header.
12. The apparatus as in claim 9 , the packet further comprising a user datagram protocol (UDP) source port and a UDP destination port.
13. The apparatus as in claim 9 , wherein the prefix mask of the CAN message identifier information does not share common bits with the range of prefixes associated with the source address and the destination address.
14. The apparatus as in claim 9 , wherein the a) the range of prefixes associated with the source address or the destination address and b) the prefix mask of the CAN message identifier information further comprises determining that the destination address does not share common bits with a range of destination addresses associated with the source address.
15. The apparatus as in claim 9 , wherein the IP encapsulated CAN message comprises an Autosar header.
16. The apparatus as in claim 9 , wherein the device is part of an advanced driver assistance system (ADAS) of the vehicle.
17. A tangible, non-transitory, computer-readable medium storing program instructions that, when executed by a processor of a device of a vehicle, cause the processor to performs steps, comprising:
receiving, by the device, a packet comprising a source address, a destination address, an internet protocol (IP) encapsulated controller area network (CAN) message, and CAN message identifier information;
comparing, by the device and based on an access control list (ACL), a) a range of prefixes associated with the source address or the destination address and b) a prefix mask of the CAN message identifier information, wherein the comparing comprises determining that the prefix mask of the CAN message identifier information is not a match in the range of prefixes associated with the source address or the destination address;
making, by the device and based on the comparing, a determination that delivery of the CAN message to the destination address would be a policy violation; and
dropping, by the device, the packet based on the determination that delivery of the CAN message to the destination address would be a policy violation.
18. The tangible, non-transitory, computer-readable medium as in claim 17 , wherein the prefix mask of the CAN message identifier information does not share common bits with the range of prefixes associated with the source address and the destination address.
19. The tangible, non-transitory, computer-readable medium as in claim 17 , wherein the a) the range of prefixes associated with the source address or the destination address and b) the prefix mask of the CAN message identifier information further comprises determining that the destination address does not share common bits with a range of destination addresses associated with the source address.