Configuring a firewall system in a vehicle network

1. A computer-implemented method for configuring firewalls in a vehicle network that comprises a trusted network internal to a vehicle and an untrusted network external to the vehicle, wherein the trusted network comprises one or more functional domains for controlling functionalities of the vehicle, the computer-implemented method comprising:

receiving, by at least one hardware processor, a software code of a network node connected to the trusted network;

performing, by the at least one hardware processor, an analysis of the software code to identify connectivity of the network nodes in the vehicle network, wherein the performing the analysis comprises:

turning off one or more firewalls in the vehicle network; and

determining the connectivity paths by performing a packet sniffing;

determining, by the at least one hardware processor, connectivity information of the network nodes in the vehicle network based on the analysis, wherein the connectivity information comprises at least one of Network Layer connectivity information, Transport Layer connectivity information, or Application Layer connectivity information; and

configuring one or more firewalls in the vehicle network based on the connectivity information.

2. The method of claim 1 , wherein the software code comprises one or more of an application source code, application assembly code, application binary code, configuration file, or manifest file.

3. The method of claim 1 , wherein the one or more functional domains comprise one or more of an in-vehicle experience domain, powertrain and vehicle dynamics domain, driver replacement domain, or body and comfort domain.

4. The method of claim 1 , wherein the trusted network comprises a network on one or more of an automobile, motorbike, train, maritime transport, or airplane.

5. The method of claim 1 , wherein the trusted network comprises one or more of Ethernet, Controller Area Network (CAN), FlexRay, Media Oriented System Transport (MOST), or Local Interconnected Network (LIN).

6. The method of claim 1 , wherein performing the static code analysis comprises determining one or more of: a server software, client software, communication protocol type, communication source address, communication destination address, application content type, application layer address, or dynamic assignment of a communication parameter.

7. The method of claim 1 , wherein:

the Network Layer connectivity information comprises one or more of a type of an Network Layer protocol, a source address pursuant to the type of the Network Layer protocol, a destination address pursuant to the type of the Network Layer protocol, or a type of dynamic address allocation pursuant to the type of the Network Layer protocol;

the Transport Layer connectivity information comprises one or more of a type of Transport Layer protocol, a source address pursuant to the type of the Transport Layer protocol, or a destination address pursuant to the type of the Transport Layer protocol; and

the Application Layer connectivity information comprises one or more of a type of an Application Layer protocol, a source address pursuant to the type of the Application Layer protocol, a destination address pursuant to the type of the Application Layer protocol, a type of Service-Oriented or non-Service-Oriented connectivity, or one or more of used Uniform Resource Locators (URLs).

8. The method of claim 1 , wherein performing the analysis of the software code comprises performing one or more of a static analysis or a dynamic analysis of the software code.

9. The method of claim 1 , wherein configuring one or more firewalls in the vehicle network based on the connectivity information comprises configuring a firewall on a domain controller of the one or more functional domains in the vehicle network to secure inter-domain communications.

10. The method of claim 1 , wherein configuring one or more firewalls in the vehicle network based on the connectivity information comprises configuring a firewall on a gateway node in the vehicle network to secure intra-domain communications, inter-domain communications, or both.

11. The method of claim 1 , wherein configuring one or more firewalls in the vehicle network based on the connectivity information comprises configuring a firewall on a domain controller of the one or more functional domains in the vehicle network to secure intra-domain communications.

12. The method of claim 1 , wherein configuring one or more firewalls in the vehicle network based on the connectivity information comprises configuring a firewall on a network node within a domain in the vehicle network to secure intra-domain communications.

13. The method of claim 1 , wherein configuring one or more firewalls in the vehicle network based on the connectivity information comprises provisioning a file detailing differences between the determined connectivity information of the vehicle network and a designed connectivity of the vehicle network.

14. The method of claim 1 , wherein configuring one or more firewalls in the vehicle network based on the connectivity information comprises generating a file comprising a firewall configuration.

15. The method of claim 1 , further comprising providing a warning of a failure to obtain connectivity information of a network node in the vehicle network based on the analysis.

16. The method of claim 1 , further comprising performing intrusion detection.

17. The method of claim 16 , wherein the performing intrusion detection comprises:

identifying a packet that is not in a whitelist based on the determined connectivity information of the vehicle network;

logging characteristics of the identified packet that is not in the whitelist; and

reporting to a server the characteristics of the identified packet that is not in the whitelist.

18. The method of claim 1 , further comprising performing customization of configurations of the one or more firewalls according to the network nodes deployed on a particular vehicle.

19. The method of claim 1 , further comprising:

receiving an updated software code of a network node of the trusted network;

performing an analysis of the updated software code to identify connectivity of the network nodes in the vehicle network;

determining, by the at least one hardware processor, updated connectivity information of the network nodes in the vehicle network based on the analysis; and

updating configurations of the one or more firewalls in the vehicle network based on the updated connectivity information.

20. One or more non-transitory computer-readable media containing instructions which, when executed, cause a computing device to perform operations comprising:

receiving a software code of a network node connected to a trusted network of a vehicle network that comprises the trusted network internal to a vehicle and an untrusted network external to the vehicle, wherein the trusted network comprises one or more functional domains for controlling functionalities of the vehicle;

performing an analysis of the software code to identify connectivity of the network nodes in the vehicle network, wherein the performing the analysis comprises:

turning off one or more firewalls in the vehicle network; and

determining the connectivity paths by performing a packet sniffing;

determining connectivity information of the network nodes in the vehicle network based on the analysis, wherein the connectivity information comprises at least one of Network Layer connectivity information, Transport Layer connectivity information, or Application Layer connectivity information; and

configuring one or more firewalls in the vehicle network based on the connectivity information.

21. A device, including:

at least one hardware processor; and

one or more computer-readable storage media coupled to the at least one hardware processor and storing programming instructions for execution by the at least one hardware processor, wherein the programming instructions, when executed, cause the at least one hardware processor to perform operations including:

receiving a software code of a network node connected to a trusted network of a vehicle network that comprises the trusted network internal to a vehicle and an untrusted network external to the vehicle, wherein the trusted network comprises one or more functional domains for controlling functionalities of the vehicle;

performing an analysis of the software code to identify connectivity of the network nodes in the vehicle network, wherein the performing the analysis comprises:

turning off one or more firewalls in the vehicle network; and

determining the connectivity paths by performing a packet sniffing;

determining connectivity information of the network nodes in the vehicle network based on the analysis, wherein the connectivity information comprises at least one of Network Layer connectivity information, Transport Layer connectivity information, or Application Layer connectivity information; and

configuring one or more firewalls in the vehicle network based on the connectivity information.