Method and system for network segment isolation with variable configurations in a vehicle

1 . A system of network segment isolation with variable configurations in a vehicle comprising:

a network within the vehicle that includes:

a microcontroller unit (MCU), located within the vehicle, which includes an internal ethernet switch and an auxiliary core manager, wherein the MCU is configured to host one or more software builds and the auxiliary core manager is configured to manage the internal ethernet switch and the one or more software builds; and

an external ethernet switch located within the vehicle configured to couple one or more ports of the internal ethernet switch to one or more devices through one or more virtual local area networks (VLANs);

wherein upon an occurrence of a reflash event the auxiliary core manager is configured to generate a VLAN configuration and filtering rule for the internal switch based on an access control policy and to identify an association of the one or more software builds to one or more MCU ports based on a MAC and IP address of each MCU port; and

wherein the auxiliary core manager is further configured to update a VLAN configuration and filtering rule on the external switch to enable one or more VLANs based on the association of the one or more software builds to the one or more MCU ports.

2 . The system of claim 1 , further comprising a second MCU, located within the vehicle, that includes a second internal ethernet switch and a second auxiliary core manager, wherein the second MCU is configured to host one or more software builds and the second auxiliary core manager is configured to manage the second internal ethernet switch.

3 . The system of claim 1 , wherein the filtering rules are applied at the external ethernet switch and wherein each of the one or more software builds are associated with a fixed IP address and a location dependent MAC address.

4 . The system of claim 3 , wherein the auxiliary core manager is configured to determine the location of the one or more software builds utilizing an Address Resolution Protocol (ARP).

5 . The system of claim 1 , wherein the filtering rules are applied at the internal ethernet switch and wherein each of the one or more software builds are associated with a fixed IP address and a location dependent MAC address.

6 . The system of claim 5 , wherein the internal ethernet switch is configured to verify communication between a software build and a device and wherein the verification includes matching configuration data including the location dependent MAC address with an associated VLAN.

7 . The system of claim 6 , wherein the configuration data is included within an auxiliary core manager build.

8 . The system of claim 1 , wherein the external switch is configured to be coupled an edge to bus device or a specialized electronic device.

9 . The system of claim 3 , wherein the auxiliary core manager is further configured to verify a configuration update at the external ethernet switch that includes receipt of a digital signature using a valid certificate.

10 . The system of claim 5 , wherein the auxiliary core manager is further configured to verify a configuration update at the internal ethernet switch that includes either a subroutine-based challenge-response or a calibration file-based method.

11 . A method for network segment isolation with variable configurations in a vehicle comprising:

hosting, within a microcontroller unit (MCU), located within the vehicle, one or more software builds, wherein the MCU further includes an internal ethernet switch and an auxiliary core manager to manage the internal ethernet switch and the one or more software builds;

coupling an external ethernet switch located within the vehicle to the internal ethernet switch, wherein the external ethernet switch couples one or more devices through one or more virtual local area networks (VLANs) to the internal ethernet switch;

generating a VLAN configuration and filtering rule for the internal switch based on an access control policy;

identifying an association of the one or more software builds to one or more MCU ports based on a MAC and IP address of each MCU port; and

updating a VLAN configuration and filtering rule on the external switch to enable one or more VLANs based on the association of the one or more software builds to the one or more MCU ports.

12 . The method of claim 11 , further comprising applying the VLAN configuration and filtering rule at the external ethernet switch and wherein each of the one or more software builds are associated with a fixed IP address and a location dependent MAC address.

13 . The method of claim 12 , further comprising determining, by the auxiliary core manager, the location of the one or more software builds utilizing an Address Resolution Protocol (ARP).

14 . The method of claim 11 , further comprising applying the VLAN configuration and filtering rule at the internal ethernet switch and wherein each of the one or more software builds are associated with a fixed IP address and a location dependent MAC address.

15 . The method of claim 14 , further comprising verifying, at the internal ethernet switch, communications between a software build and a device and wherein the verification includes matching configuration data including the location dependent MAC address with an associated VLAN.

16 . The method of claim 15 , wherein the configuration data is included within an auxiliary core manager build.

17 . The method of claim 11 , wherein the external switch is coupled to an edge to bus device or a specialized electronic device.

18 . The method of claim 12 , further comprising verifying a configuration update at the external ethernet switch that includes receipt of a digital signature using a valid certificate.

19 . The method of claim 13 , further comprising verifying, by the auxiliary core manager, a configuration update at the internal ethernet switch that includes either a subroutine-based challenge-response or a calibration file-based method.

20 . A system of network segment isolation with variable configurations in a vehicle comprising:

a network within the vehicle that includes:

a first microcontroller unit (MCU), located within the vehicle, which includes a first internal ethernet switch and a first auxiliary core manager, wherein the first MCU is configured to host one or more software builds and the first auxiliary core manager is configured to manage the first internal ethernet switch and the one or more software builds;

a second microcontroller unit (MCU), located within the vehicle, that includes a second internal ethernet switch and a second auxiliary core manager, wherein the second MCU is configured to host one or more software builds and second auxiliary core manager is configured to manage the second internal ethernet switch; and

an external ethernet switch located within the vehicle configured to couple the internal ethernet switch to one or more devices through one or more virtual local area networks (VLANs);

wherein upon an occurrence of a reflash event the auxiliary core manager is configured to generate a VLAN configuration and filtering rule for the internal switch based on an access control policy and to identify an association of the one or more software builds to one or more MCU ports based on a MAC and IP address of each MCU port;

wherein the auxiliary core manager is further configured to update a VLAN configuration and filtering rule on the external switch to enable one or more VLANs based on the association of the one or more software builds to the one or more MCU ports;

wherein the VLAN configuration and filtering rule is applied at the internal ethernet switch and at the external ethernet switch;

wherein each of the one or more software builds are associated with a fixed IP address and a location dependent MAC address;

wherein the internal ethernet switch is configured to verify communication between a software build and a device and wherein the verification includes matching configuration data including the location dependent MAC address with an associated VLAN; and

wherein the external switch is configured to be coupled to an edge to bus device or a specialized electronic device.