System and method for dynamically updating firewall rules for a vehicle network of a vehicle
Systems and methods for dynamically updating firewall rules for a vehicle network are disclosed herein. In one example, a system includes a processor and a memory in communication with the processor having a cyber health engine module. The cyber health engine module includes instructions that, when executed by the processor, cause the processor to receive health status information from one or more nodes of the vehicle network, calculate a risk factor for the one or more nodes of the vehicle network based on the health status information, and in response to determining that the risk factor for the one or more nodes of the vehicle network indicates increased risk, update the firewall rules to address the increased risk.
1. A system for dynamically updating firewall rules for a vehicle network, the system comprising:
a processor; and
a memory in communication with the processor, the memory having a cyber health engine module including instructions that, when executed by the processor, cause the processor to:
request health status information from one or more nodes of the vehicle network when at least one of the following occurs: booting of the system, periodically determined by timer and/or event, and after observing an anomaly by the system or any other intrusion detection system,
receive the health status information from the one or more nodes of the vehicle network,
calculate a risk factor for the one or more nodes of the vehicle network based on the health status information, and
in response to determining that the risk factor for the one or more nodes of the vehicle network indicates increased risk, update the firewall rules to address the increased risk.
2. The system of claim 1 , wherein the health status information includes one or more of:
a list of software running on the one or more nodes;
external interfaces connected to the one or more nodes;
last configuration for the one or more nodes;
anomalies detected by the one or more nodes; and
a bill of material for the one or more nodes.
3. The system of claim 1 , wherein the cyber health engine module further includes instructions that, when executed by the processor, cause the processor to calculate the risk factor for the one or more nodes of the vehicle network by comparing the health status information to threat information, the threat information having information related to capabilities of the node to affect vehicle network and/or information related to network-related threats.
4. The system of claim 3 , wherein the threat information originated from at least one of the following:
a cloud-based server;
another vehicle; and
a security vulnerability identified by one or more nodes of the vehicle.
5. The system of claim 1 , wherein the cyber health engine module further includes instructions that, when executed by the processor, cause the processor to:
update a block list and/or an allow list of the vehicle network;
block all messages coming from the one or more nodes;
block a subset of the messages coming from the one or more nodes based on criticality;
send rebooting commands to the one or more nodes;
send an update request to the one or more nodes;
flood the one or more nodes with error messages; and
disconnect the one or more nodes from the vehicle network.
6. The system of claim 1 , wherein the cyber health engine module further includes instructions that, when executed by the processor, cause the processor to:
compare the risk factor to a threshold factor; and
determine that the risk factor indicates increased risk when the risk factor exceeds the threshold factor.
7. A method for dynamically updating firewall rules for a vehicle network of a vehicle using a cyber-health engine, the method comprising steps of:
requesting health status information from one or more nodes of the vehicle network when at least one of the following occurs: booting of a system, periodically determined by timer and/or event, and after observing an anomaly by the system or any other intrusion detection system;
receiving the health status information from the one or more nodes of the vehicle network;
calculating a risk factor for the one or more nodes of the vehicle network based on the health status information; and
in response to determining that the risk factor for the one or more nodes of the vehicle network indicates increased risk, updating the firewall rules to address the increased risk.
8. The method of claim 7 , wherein the health status information includes one or more of:
a list of software running on the one or more nodes;
external interfaces connected to the one or more nodes;
last configuration for the one or more nodes;
anomalies detected by the one or more nodes; and
a bill of material for the one or more nodes.
9. The method of claim 7 , further comprising the step of calculating the risk factor for the one or more nodes of the vehicle network by comparing the health status information to threat information, the threat information having information related to capabilities of the node to affect the vehicle network and/or information related to network-related threats.
10. The method of claim 9 , wherein the threat information originated from at least one of the following:
a cloud-based server;
another vehicle; and
a security vulnerability identified by one or more nodes of the vehicle.
11. The method of claim 7 , wherein the step of updating the firewall rules includes at least one of the following:
updating a block list and/or an allow list of the vehicle network;
blocking all messages coming from the one or more nodes;
blocking a subset of the messages coming from the one or more nodes based on criticality;
sending rebooting commands to the one or more nodes;
sending an update request to the one or more nodes;
flooding the one or more nodes with error messages; and
disconnecting the one or more nodes from the vehicle network.
12. The method of claim 7 , further comprising the steps of:
comparing the risk factor to a threshold factor; and
determining that the risk factor indicates increased risk when the risk factor exceeds the threshold factor.
13. A non-transitory computer-readable medium storing instructions for dynamically updating firewall rules for a vehicle network of a vehicle, the instructions, when executed by a processor, cause the processor to:
request health status information from one or more nodes of the vehicle network when at least one of the following occurs: booting of a system, periodically determined by timer and/or event, and after observing an anomaly by the system or any other intrusion detection system,
receive the health status information from the one or more nodes of the vehicle network,
calculate a risk factor for the one or more nodes of the vehicle network based on the health status information, and
in response to determining that the risk factor for the one or more nodes of the vehicle network indicates increased risk, update the firewall rules to address the increased risk.
14. The non-transitory computer-readable medium of claim 13 , wherein the health status information includes one or more of:
a list of software running on the one or more nodes;
external interfaces connected to the one or more nodes;
last configuration for the one or more nodes;
anomalies detected by the one or more nodes; and
a bill of material for the one or more nodes.
15. The non-transitory computer-readable medium of claim 13 , further comprising instructions that, when executed by the processor, cause the processor to calculate the risk factor for the one or more nodes of the vehicle network by comparing the health status information to threat information, the threat information having information related to capabilities of the node to affect the vehicle network and/or information related to network-related threats.
16. The non-transitory computer-readable medium of claim 15 , wherein the threat information originated from at least one of the following:
a cloud-based server;
another vehicle; and
a security vulnerability identified by one or more nodes of the vehicle.
17. The non-transitory computer-readable medium of claim 13 , further comprising instructions that, when executed by the processor, cause the processor to:
update a block list and/or allow list of the vehicle network;
block all messages coming from the one or more nodes;
block a subset of the messages coming from the one or more nodes based on criticality;
send rebooting commands to the one or more nodes;
send an update request to the one or more nodes;
flood the one or more nodes with error messages;
and disconnect the one or more nodes from the vehicle network.