Disclosure of Invention
The invention aims to overcome the defects of the prior art and provide an in-vehicle safety signal screening method based on functional threat analysis, which screens in-vehicle signals based on threat analysis and risk assessment so as to more efficiently carry out safety reinforcement on the in-vehicle signals.
In order to achieve the above object, the method for screening the safety signal in the vehicle based on the function threat analysis comprises the following steps:
s1, firstly, determining a service set related to signals in an intelligent network-connected vehicle according to the actual condition of the intelligent network-connected vehicle, and determining the service information security level of each service, wherein the specific method comprises the following steps:
If a certain business is controlled by a computer and affects driving control and safety protection, setting the safety threat level of the business as 'danger';
if a certain business is communicated with external access, or the business can cause execution change of the business with the security threat level of 'danger', or the business relates to property, setting the security threat level of the business to 'high';
if a certain business relates to vehicle body control or sensitive information preset by a user, setting the security threat level of the business as 'medium';
if a certain business does not meet the requirements of the security threat level of ' danger ', ' high ', ' medium ', setting the security threat level of the business to ' low ', ';
S2, setting the service function security level of each service of the service set according to the service function of each service, wherein the service function security level is 'not affected', 'A', 'B', 'C', 'D' from low to high;
s3, according to the information security level and the function security level of the service, determining the service screening identification of the service, wherein the specific method comprises the following steps:
When the service function security level of the service is 'no influence' or 'A' or 'B', if the service information security level is 'no influence' or 'low', the service screening mark is 'non-selection', if the service information security level is 'medium', the service screening mark is 'optional', and if the service information security level is 'high' or 'dangerous', the service screening mark is 'necessary selection';
when the service function security level of the service is C or D, if the service information security level is not affected or low or medium, the service screening mark is optional, and if the service information security level is high or dangerous, the service screening mark is necessary;
Dividing the service into a mandatory service set B 1, an optional service set B 2 and an unselected service set B 3 according to the screening identification of the service, then acquiring an in-vehicle signal set S 1 related to the service in the mandatory service set B 1 and an in-vehicle signal set S 2 related to the optional service set B 2, and taking the two in-vehicle signal sets as alternative in-vehicle signal sets;
S4, for each in-vehicle signal set S 1 and in-vehicle signal set S 2, determining the signal information security level according to the key degree of the related information, wherein the signal information security level is 'not affected', 'low', 'medium', 'high', 'serious' from low to high respectively:
When the information security level of the signal is 'no influence', the comprehensive security level of the signal is 'no influence';
When the information security level of the signal is 'low', if the service information security level of the service corresponding to the signal is 'no influence', the signal comprehensive security level is 'no influence', otherwise, the signal comprehensive security level is 'low';
when the information security level of the signal is 'middle', if the service information security level of the service corresponding to the signal is 'no influence', the signal comprehensive security level is 'no influence', if the service information security level of the service corresponding to the signal is 'low', the signal comprehensive security level is 'low', and if the service information security level of the service corresponding to the signal is 'middle', or 'high', or 'danger', the signal comprehensive security level is 'middle';
When the information security level of the signal is 'high', if the service information security level of the service corresponding to the signal is 'not affected', the signal comprehensive security level is 'not affected', if the service information security level of the service corresponding to the signal is 'low' or 'medium', the signal comprehensive security level is 'medium', and if the service information security level of the service corresponding to the signal is 'high' or 'dangerous', the signal comprehensive security level is 'high';
When the information security level of the signal is serious, if the service information security level of the service corresponding to the signal is not influenced, the signal comprehensive security level is not influenced, if the service information security level of the service corresponding to the signal is low, medium or high, the signal comprehensive security level is high, and if the service information security level of the service corresponding to the signal is dangerous, the signal comprehensive security level is critical;
S5, regarding an in-vehicle signal set S 1, taking in-vehicle signals with the signal comprehensive safety level of high and key as safety signals, and regarding an in-vehicle signal set S 2, taking in-vehicle signals with the signal comprehensive safety level of key as safety signals, so as to form a safety signal set.
The invention relates to an in-vehicle safety signal screening method based on function threat analysis, which comprises the steps of firstly determining a service set related to in-vehicle signals of an intelligent network vehicle according to the actual condition of the intelligent network vehicle, determining the service information safety level of each service, then determining the service function safety level, determining the screening identification of the service according to the information safety level and the function safety level of the service by adopting a service screening identification mapping table, thereby obtaining an alternative in-vehicle signal set, carrying out signal comprehensive safety level on in-vehicle signals in the alternative in-vehicle signal set, and finally screening from the alternative in-vehicle signal set according to the signal comprehensive safety level to obtain a safety signal set.
The invention screens the in-vehicle signals based on threat analysis and risk assessment so as to more efficiently secure the in-vehicle signals.
Detailed Description
The following description of the embodiments of the invention is presented in conjunction with the accompanying drawings to provide a better understanding of the invention to those skilled in the art. It is to be expressly noted that in the description below, detailed descriptions of known functions and designs are omitted here as perhaps obscuring the present invention.
Examples
FIG. 2 is a flow chart of an embodiment of the in-vehicle security signal screening method based on functional threat analysis of the present invention. As shown in fig. 2, the method for screening the safety signal in the vehicle based on the function threat analysis comprises the following specific steps:
S201, determining the security level of service information:
Based on the analysis, the invention firstly determines the service set related to the in-car signal according to the actual condition of the intelligent network-connected vehicle, and determines the service information security level of each service, and the specific method is as follows:
if a certain service is controlled by a computer and affects driving control and safety protection, setting the service information safety level of the service as 'danger';
If a certain service is communicated with external access, or the service can cause the execution change of the service with the service information security level of 'danger', or the service relates to property, setting the service information security level of the service to 'high';
if a certain service does not influence the running safety of the service or relates to property, but relates to vehicle body control or relates to sensitive information preset by a user, setting the service information safety level of the service as 'medium';
if a service involves an auxiliary function for information display, the security threat level of the service is set to "low". Such a service generally does not affect the running safety of itself nor involves control of the vehicle body and properties, and therefore the service information security level is set to "low".
If a certain service does not meet the requirements of the service information security level of 'danger', 'high', 'medium', 'low', the service information security level of the service is set to 'no influence'.
According to the service composition of the existing intelligent automobile, the service with the security threat level of 'danger' in the embodiment comprises a service related to longitudinal control right of vehicle movement, a service related to transverse control right of vehicle movement, a service related to vehicle movement stopping control right, a service related to anti-collision radar, a service related to Doppler radar, a service related to infrared radar, an active braking system service, a lane keeping system service, a lane changing early warning system service, a traction control system service, an electronic stabilizing device system service, a brake anti-locking system service and an electronic brake control system service.
The services with the high security threat level in the embodiment comprise a service communicated with Bluetooth, a service communicated with 4G and 5G, an infrared data service, a radar data service, a vehicle window control service, a vehicle door control service, a service related to financial payment, a power control battery service and a power battery temperature control service.
The services with the security threat level of 'medium' in the embodiment comprise services related to parking information, services related to driving tracks, wiper control services, car light control services and rearview mirror automatic control services.
The service with the low security threat level in the embodiment comprises a tire pressure feedback service, a temperature feedback service, an oil feedback service and a water quantity feedback service.
And screening out the message ID and ECU (sending/receiving) list which need to be reinforced by SecOC according to the service.
S202, determining the security level of the service function:
In terms of the impact level of business functions, in security (security), finance (financial), operation (operation), privacy (privacy), the impact level of operation and privacy is mainly dependent on security and finance, with a small impact weight. Whereas for business functions the financial level is mainly dependent on the level of security. Therefore, the invention is simplified to mainly consider the security elements of the business functions when considering the influence level of the business. Functional safety level (ASIL) is the result of hazard analysis and risk assessment of automotive electronics systems. The functional security levels are four levels, A, B, C, D each, where A is the lowest level and D is the highest level. The functional level is divided mainly by three criteria, severity (Severity), exposure rate (Exposure) and controllability (Controllability). The higher the level of functionality, the higher the security requirements, and the higher the cost 2 for implementing security. The functional security level may be broken down and assigned according to different uses and security objectives, and may be determined in advance by professional evaluation.
In the invention, for each service of the service set, the security level of the service function is set according to the service function, and the security level is 'not affected', 'A', 'B', 'C', 'D' from low to high.
S203, screening a candidate in-vehicle signal set:
and determining the service screening identification of the service by adopting a service screening identification mapping table according to the information security level and the functional security level of the service. Table 1 is a service screening identity mapping table in the present invention.
TABLE 1
As can be seen from table 1, the method for determining the service screening identifier in the present invention is as follows:
When the service function security level of the service is 'no influence' or 'A' or 'B', if the service information security level is 'no influence' or 'low', the service screening mark is 'non-selection', if the service information security level is 'medium', the service screening mark is 'optional', and if the service information security level is 'high' or 'dangerous', the service screening mark is 'necessary selection';
When the service function security level of the service is ' C ' or ' D ', if the service information security level is ' no influence ' or ' low ' or ' medium ', the service screening identification is ' optional ', and if the service information security level is ' high ' or ' dangerous ', the service screening identification is ' necessary.
The service is divided into a mandatory service set B 1, an optional service set B 2 and an unselected service set B 3 according to the screening identification of the service. Then, an in-vehicle signal set S 1 related to the service in the mandatory service set B 1 and an in-vehicle signal set S 2 related to the optional service set B 2 are acquired, and the two in-vehicle signal sets are used as alternative in-vehicle signal sets.
S204, determining the comprehensive security level of the signal:
For the existing intelligent network-connected automobile, the signal in the automobile is transmitted through a CAN bus. In terms of threat level, no matter what attack means is adopted for the bus signal in the vehicle, the influence signal finally needs to be attacked by a physical contact mode. Thus, all communication channels within the vehicle have substantially identical threat levels, and the security signal may be simply considered to have substantially identical threat levels. Therefore, the signal in the vehicle only considers the signal information security level of the signal in the vehicle.
For each in-vehicle signal set S 1 and in-vehicle signal set S 2, the signal information security level is determined according to the key degree of the related information, and the signals are respectively "unaffected", "low", "medium", "high" and "serious" from low to high. The information criticality can be assessed in advance by a professional. And then determining the signal comprehensive security level of the in-vehicle signal by adopting a signal comprehensive security mapping table according to the information security level of the in-vehicle signal and the information security level of the corresponding service of the in-vehicle signal. Table 2 is a signal comprehensive security mapping table in the present invention.
TABLE 2
As can be seen from table 2, the method for determining the comprehensive security level of the signal in the present invention is as follows:
When the information security level of the signal is 'no influence', the comprehensive security level of the signal is 'no influence';
When the information security level of the signal is 'low', if the service information security level of the service corresponding to the signal is 'no influence', the signal comprehensive security level is 'no influence', otherwise, the signal comprehensive security level is 'low';
when the information security level of the signal is 'middle', if the service information security level of the service corresponding to the signal is 'no influence', the signal comprehensive security level is 'no influence', if the service information security level of the service corresponding to the signal is 'low', the signal comprehensive security level is 'low', and if the service information security level of the service corresponding to the signal is 'middle', or 'high', or 'danger', the signal comprehensive security level is 'middle';
When the information security level of the signal is 'high', if the service information security level of the service corresponding to the signal is 'not affected', the signal comprehensive security level is 'not affected', if the service information security level of the service corresponding to the signal is 'low' or 'medium', the signal comprehensive security level is 'medium', and if the service information security level of the service corresponding to the signal is 'high' or 'dangerous', the signal comprehensive security level is 'high';
when the information security level of the signal is 'serious', if the service information security level of the service corresponding to the signal is 'not affected', the signal comprehensive security level is 'not affected', if the service information security level of the service corresponding to the signal is 'low', or 'medium', or 'high', the signal comprehensive security level is 'high', and if the service information security level of the service corresponding to the signal is 'dangerous', the signal comprehensive security level is 'critical'.
S205, screening to obtain a safety signal set:
for the in-vehicle signal set S 1, the in-vehicle signal in which the signal comprehensive security level is "high" and "critical" is used as a security signal, and for the in-vehicle signal set S 2, the in-vehicle signal in which the signal comprehensive security level is "critical" is used as a security signal, so as to constitute a security signal set.
And for the in-car signals in the safety signal set, the message ID and the sending/receiving ECU list of the in-car signals are obtained for SecOC reinforcement, so that the safety of the intelligent network-connected car can be effectively improved.
While the foregoing describes illustrative embodiments of the present invention to facilitate an understanding of the present invention by those skilled in the art, it should be understood that the present invention is not limited to the scope of the embodiments, but is to be construed as protected by the accompanying claims insofar as various changes are within the spirit and scope of the present invention as defined and defined by the appended claims.