Advanced intrusion prevention manager
The present invention is related to the prevention of intrusions on an in-vehicle network.
1 . An Advanced Intrusion Prevention Manager comprising:
a trigger communication channel that receives intrusion information from an automotive Ethernet in-vehicle network,
a system-and-environmental-information communication channel that receives system and environmental information from a vehicle, wherein the environmental information specifies information about an external environment of the vehicle,
a vehicle-component Communication channel to vehicle components,
a non-transitory computer-readable data storage that stores information comprising network security policies, and
a data-storage communication channel to and from the data storage,
the Advanced Intrusion Prevention Manager performing operations, by a processor executing computer-executable instructions, the operations comprising:
analyze the received intrusion information,
based on the analyzed intrusion information and depending on received system and environmental information select a network security policy stored in the data storage,
communicate the selected network security policy via the vehicle-component communication channel to at least one vehicle component in the automotive Ethernet in-vehicle network, and
activate the communicated network security policy in dependency on the received system and environmental information, wherein the automotive Ethernet in-vehicle network comprises a plurality of network components that form a network structure having a plurality of network segments, the network components comprising at least one electronic control unit (ECU) and at least one automotive Ethernet switch, and wherein the activated and communicated network security policy specifies different segment-specific security states for a respective plurality of the network segments of the network structure.
2 . The Advanced Intrusion Prevention Manager according to claim 1 , the Advanced Intrusion Prevention Manager being configured to communicate via the vehicle-component communication channel to vehicle components in a secure manner.
3 . The Advanced Intrusion Prevention Manager according to claim 2 , the Advanced Intrusion Prevention Manager being located inside or outside the vehicle.
4 . The Advanced Intrusion Prevention Manager according to claim 3 , the Advanced Intrusion Prevention Manager comprising a Communication channel to and from a backend.
5 . The Advanced Intrusion Prevention Manager according to claim 4 , the Advanced Intrusion Prevention Manager being configured to
receive information about the network structure of the in-vehicle network,
store the information about the network structure in the storage device.
6 . The Advanced Intrusion Prevention Manager according to claim 5 , the Advanced Intrusion Prevention Manager being configured to maintain different network security states with regard to the network structure and to select, communicate and activate different network security policies in dependency on the security states.
7 . A system to prevent intrusions in an in-vehicle network, the system comprising at least two Advanced Intrusion Prevention Managers, each of the at least two Advanced Intrusion Prevention Managers comprising:
a trigger communication channel that receives intrusion information from an automotive Ethernet in-vehicle network,
a system-and-environmental-information communication channel that receives system and environmental information from a vehicle, wherein the environmental information specifies information about an external environment of the vehicle,
a vehicle-component communication channel to vehicle components,
a non-transitory computer-readable data storage that stores information comprising network security policies, and
a data-storage communication channel to and from the data storage,
the Advanced Intrusion Prevention Manager performing operations, by a processor executing computer-executable instructions, the operations comprising:
analyze the received intrusion information,
based on the analyzed intrusion information and depending on the received system and environmental information select a network security policy stored in the data storage,
communicate the selected network security policy via the vehicle-component communication channel to at least one vehicle component in the automotive Ethernet in-vehicle network, and
activate the communicated network security policy in dependency on the received system and environmental information, wherein the automotive Ethernet in-vehicle network comprises a plurality of network components that form a network structure having a plurality of network segments, the network components comprising at least one electronic control unit (ECU) and at least one automotive Ethernet switch, and wherein the activated and communicated network security policy specifies different segment-specific security states for a respective plurality of the network segments of the network structure.
8 . The system according to claim 7 , wherein at least one of the at least two Advanced Intrusion Prevention Managers is installed inside the vehicle.
9 . The system according to claim 8 , wherein at least one of the at least two Advanced Intrusion Prevention Managers is installed outside the vehicle.
10 . The system according to claim 7 , the at least two Advanced Intrusion Prevention Managers comprising a communication channel to operatively communicate with each other.
11 . The system according to claim 10 , the at least two Advanced Intrusion Prevention Managers being configured to locally store, inside the vehicle, policies such that a first Advanced Intrusion Prevention Manager comprises a first set of policies and a second Advanced Intrusion Prevention Manager comprises a second set of policies and wherein the first set of policies is different to the second set of policies.
12 . The system according to claim 11 , the system comprising an Intrusion detection system and/or an Intrusion detection system sensor installed inside the in-vehicle network.
13 . A method for preventing intrusions in an automotive Ethernet in-vehicle network by an Advanced Intrusion Prevention Manager, comprising:
receiving intrusion information,
receiving system and environmental information, wherein the environmental information specifies information about an external environment of the vehicle,
analyzing the received intrusion information,
selecting, based on the analyzed intrusion information and the received system and environmental information at least one network security policy from a set of network security policies,
communicating the selected network security policy to at least one vehicle component in the in-vehicle network and
activating the communicated network security policy in dependency on the received system and environmental information, wherein the automotive Ethernet in-vehicle network comprises a plurality of network components that form a network structure having a plurality of network segments, the network components comprising at least one electronic control unit (ECU) and at least one automotive Ethernet switch, and wherein the activated and communicated network security policy specifies different segment-specific security states for a respective plurality of the network segments of the network structure.