Systems and methods of securing vehicle services from denial-of-service attacks using dynamic signature
Systems and methods include receiving sessions associated with a communication between a client and an in-vehicle application service, assigning received sessions with a quality of service (QoS) processing priority, collecting a flow signature of the sessions, generating an expected runtime flow signature based on the collected flow signature, comparing the flow signature of sessions with the expected runtime flow signature based on a time at which each of the sessions were received, promoting a QoS processing priority of a group of the sessions, and dropping sessions based on a QoS processing priority.
1. A system in a vehicle, the system comprising:
one or more processors; and
a memory storing instructions that, when executed by the one or more processors, cause the system to:
receive a first plurality of sessions and a second plurality of sessions associated with a communication between a client and an in-vehicle application service, wherein the first plurality of sessions are authenticated sessions with a first quality of service (QOS) processing priority;
assign each of the received second plurality of sessions with a second QoS processing priority that is lower than the first QoS processing priority;
collect a flow signature of each of the first plurality of sessions and each of the second plurality of sessions associated with the communication between the client and the in-vehicle application service;
generate an expected runtime flow signature based on the collected flow signature of each of the first plurality of sessions associated with the communication between the client and the in-vehicle application service;
compare the flow signature of each of the second plurality of sessions with the expected runtime flow signature based on a time at which each of the second plurality of sessions were received;
promote the second QoS processing priority of a group of the second plurality of sessions to the first QoS processing priority; and
drop the second plurality of sessions with the second QoS processing priority.
2. The system of claim 1 , wherein the flow signature of each of the first plurality of sessions includes information on virtual local area network, source Internet Protocol (IP) address, destination IP address, source port, destination port, sequence number, acknowledgement number, window size, selection of timestamp option, current timestamp, peer's used timestamp, hash key, cookies, selection of usage of cookie, hash signature inside timestamp option, or any combination thereof.
3. The system of claim 1 , wherein the generated expected runtime flow signature includes a sequence number range, an acknowledgement number range, or a combination thereof of an expected session that is expected to be received based on the time at which each of the second plurality of sessions was received.
4. The system of claim 1 , wherein the instructions further cause the system to detect that the system is under a congestion or overload that is above a pre-determined threshold.
5. The system of claim 1 , wherein the instructions further cause the system to update the generated expected runtime flow signature.
6. The system of claim 1 , wherein the instructions further cause the system to:
write a hashed key signature to a timestamp option in a first packet;
send the first packet;
receive a second packet; and
compare an echo timestamp of the second packet with the hashed key signature.
7. The system of claim 1 , wherein the system further comprises a first system component and a second system component, wherein the first system component is configured to receive the first plurality of sessions and the second plurality of sessions and assign each of the second plurality of sessions received at the first system component with the second QoS processing priority, and wherein the second system component is configured to compare the flow signature of each of the second plurality of sessions with the expected runtime flow signature, promote the second QoS processing priority of the group of the second plurality of sessions to the first QoS processing priority, and drop the second plurality of sessions with the second QoS processing priority.
8. The system of claim 7 , wherein the system further comprises a third system component and the third system component is configured to:
collect the flow signature of each of the first plurality of sessions and each of the second plurality of sessions; and
generate the expected runtime flow signature based on the collected flow signature of each of the first plurality of sessions.
9. The system of claim 8 , wherein the first component is configured to assign each of the received second plurality of sessions with the second QoS processing priority in response to instructions from the third component.
10. The system of claim 8 , wherein the generated expected runtime flow signature is offloaded by the third component to the second component.
11. The system of claim 1 , wherein the expected runtime flow signature is expected runtime dynamic session flow signature.
12. The system of claim 1 , wherein the instructions further cause the system to detect a congestion or overload experienced by the system is under a pre-determined threshold and remove the expected runtime flow signature.
13. A computer-implemented method, the method comprising:
receiving, via one or more processors, a first plurality of sessions and a second plurality of sessions associated with a communication between a client and an in-vehicle application service, wherein the first plurality of sessions are authenticated sessions with a first quality of service (QOS) processing priority;
assigning, via the one or more processors, each of the received second plurality of sessions with a second QoS processing priority that is lower than the first QoS processing priority;
collecting, via the one or more processors, a flow signature of each of the first plurality of sessions and each of the second plurality of sessions associated with the communication between the client and the in-vehicle application service;
generating, via the one or more processors, an expected runtime flow signature based on the collected flow signature of each of the first plurality of sessions associated with the communication between the client and the in-vehicle application service;
comparing, via the one or more processors, the flow signature of each of the second plurality of sessions with the expected runtime flow signature based on a time at which each of the second plurality of sessions were received;
promoting, via the one or more processors, the second QoS processing priority of a group of the second plurality of sessions to the first QoS processing priority; and
dropping, via the one or more processors, the second plurality of sessions with the second QoS processing priority.
14. The method of claim 13 , wherein the flow signature of each of the first plurality of sessions includes information on virtual local area network, source Internet Protocol (IP) address, destination IP address, source port, destination port, sequence number, acknowledgement number, window size, selection of timestamp option, current timestamp, peer's used timestamp, hash key, cookies, selection of usage of cookie, hash signature inside timestamp option, or any combination thereof.
15. The method of claim 13 , wherein the generated expected runtime flow signature includes a sequence number range, an acknowledgement number range, or a combination thereof of an expected session that is expected to be received based on the time at which each of the second plurality of sessions were received.
16. The method of claim 13 , further comprising updating the generated expected runtime flow signature.
17. The method of claim 13 , further comprising:
detecting a congestion or overload experienced by the system is under a pre-determined threshold; and
removing the expected runtime flow signature.
18. The method of claim 13 , the method further comprising:
writing a hashed key signature to a timestamp option in a first packet;
sending the first packet;
receiving a second packet; and
comparing an echo timestamp of the second packet with the hashed key signature.
19. The method of claim 13 , wherein the method is performed by a first system component, a second system component, and a third system component, wherein the first system component is configured to receive the first plurality of sessions and the second plurality of sessions and assign each of the second plurality of sessions received at the first system component with the second QoS processing priority, wherein the third system component is configured to collect the flow signature of each of the first plurality of sessions and each of the second plurality of sessions and generate the expected runtime flow signature based on the collected flow signature of each of the first plurality of sessions, and wherein the second system component is configured to compare the flow signature of each of the second plurality of sessions with the expected runtime flow signature, promote the second QoS processing priority of the group of the second plurality of sessions to the first QoS processing priority, and drop the second plurality of sessions with the second QoS processing priority.
20. The method of claim 13 , wherein the expected runtime flow signature is expected runtime dynamic session flow signature.