Detection of abnormal operations in connected vehicles
A connected vehicle has several electronic control units (ECUs). Entities running in different ECUs are constrained in corresponding security boundaries. Messages across security boundaries are transmitted over a connection that is not directly available to entities constrained in security boundaries. Messages across security boundaries between entities are inspected. A message from an entity in one security boundary to another entity in another security boundary is inspected by normalizing a content of the message, and comparing the normalized content to a baseline. A corrective action is performed against the message in response to determining that a difference between the normalized content and the baseline indicates a change that is prohibited by a security policy.
1. A connected vehicle comprising:
a first electronic control unit (ECU) of a plurality of ECUs of the connected vehicle, the first ECU comprising a processor and a memory, the memory of the first ECU storing instructions that when executed by the processor of the first ECU cause the first ECU to constrain a first set of entities that are running in the first ECU to within a first security boundary that includes a first security gateway; and
a second ECU of the plurality of ECUs of the connected vehicle, the second ECU comprising a processor and a memory, the memory of the second ECU storing instructions that when executed by the processor of the second ECU cause the second ECU to:
constrain a second set of entities that are running in the second ECU to within a second security boundary that includes a second security gateway;
receive all messages between entities that are transmitted across the first and second security boundaries over a connection that is not directly accessible to any entity of the first and second sets of entities, wherein the connection is between the first and second security gateways;
receive over the connection a target message for inspection, the target message being sent by a first entity of the first set of entities to a second entity of the second set of entities;
normalize a content of the target message to a target posture vector, the target posture vector indicating a current operation involving the second entity;
compare the target posture vector to a corresponding baseline posture vector, wherein the corresponding baseline posture vector indicates a known good operation involving the second entity;
determine a difference between the target posture vector and the corresponding baseline posture vector; and
take a corrective action against the target message in response to determining that the difference between the target posture vector and the corresponding baseline posture vector indicates a change in cybersecurity posture that is prohibited by a security policy.
2. The connected vehicle of claim 1 , wherein entities of the first set of entities communicate with each other over an internal network of the first ECU.
3. The connected vehicle of claim 1 , wherein the first security boundary is a first virtual machine that is hosted by the first ECU, and each of the first set of entities is a process that is running in the first virtual machine.
4. The connected vehicle of claim 3 , wherein entities of the first set of entities communicate with each other over a virtual network.
5. The connected vehicle of claim 3 , wherein the second security boundary is a second virtual machine that is hosted by the second ECU, and each of the second set of entities is a process that is running in the second virtual machine.
6. The connected vehicle of claim 3 , wherein the second security boundary is a software container, and each of the second set of entities is a process that is running in the software container.
7. A method of detecting abnormal operations in connected vehicles, the method comprising:
constraining a first entity in a first security boundary that includes a first security gateway, the first entity being executed in a first electronic control unit (ECU) of a plurality of ECUs of a connected vehicle;
constraining a second entity in a second security boundary that includes a second security gateway, the second entity being executed in a second ECU of the plurality of ECUs of the connected vehicle;
routing all messages that are transmitted across the first and second security boundaries between entities over a connection that is not directly accessible to all entities constrained in the first and second security boundaries, wherein the connection is between the first and second security gateways;
receiving, over the connection, a target message in the second security boundary for inspection, the target message being sent by the first entity to the second entity;
normalizing a content of the target message to a target posture vector, the target posture vector indicating a current operation involving the second entity;
comparing the target posture vector to a corresponding baseline posture vector, wherein the corresponding baseline posture vector indicates a known good operation involving the second entity; and
taking a corrective action against the target message in response to determining that a difference between the target posture vector and the corresponding baseline posture vector indicates a change that is prohibited by a security policy.
8. The method of claim 7 , wherein the first security boundary is a first virtual machine that is hosted by the first ECU, and the first entity is a process running in the first virtual machine.
9. The method of claim 8 , wherein the second security boundary is a second virtual machine that is hosted by the second ECU, and the second entity is a process running in the second virtual machine.
10. The method of claim 7 , wherein the first security boundary is a software container, and the first entity is a process running in the software container.
11. The method of claim 7 , wherein the first entity and other entities constrained in the first security boundary communicate with each other over an internal network of the first ECU.
12. A method of detecting abnormal operations in connected vehicles, the method comprising:
constraining a first entity in a first virtualized environment that is hosted by a first electronic control unit (ECU) of a plurality of ECUs of a connected vehicle, wherein messages entering or exiting the first virtualized environment are inspected by a first security gateway process;
constraining a second entity in a second virtualized environment that is hosted by a second ECU of the plurality of ECUs of the connected vehicle, wherein messages entering or exiting the second virtualized environment are inspected by a second security gateway process;
routing all messages that are transmitted across the first and second virtualized environments between entities over a connection that is not directly accessible to any entity that is constrained in the first virtualized environment or the second virtualized environment, wherein the connection is between the first and second security gateway processes;
receiving, over the connection, a target message in the second virtualized environment for inspection, the target message being sent by the first entity to the second entity;
normalizing a content of the target message to a target posture vector, the target posture vector indicating a current operation involving the second entity;
comparing the target posture vector to a corresponding baseline posture vector, wherein the corresponding baseline posture vector indicates a known good operation involving the second entity; and
taking a corrective action against the target message in response to determining that a difference between the target posture vector and the corresponding baseline posture vector indicates a change that is prohibited by a security policy.
13. The method of claim 12 , wherein the first virtualized environment is a first virtual machine that is hosted by the first ECU, and the first entity is a process running in the first virtual machine.
14. The method of claim 13 , wherein the second virtualized environment is a second virtual machine that is hosted by the second ECU, and the second entity is a process running in the second virtual machine.
15. The method of claim 13 , wherein the second virtualized environment is a software container that is hosted by the second ECU, and the second entity is a process running in the software container.