CN111447167A - Safety protection method and device for vehicle-mounted system - Google Patents

Abstract

The invention discloses a safety protection method and device for a vehicle-mounted system. The method includes: S1, generating corresponding vehicle-machine defense rules according to the obtained vulnerability information and the defense strategy corresponding to the obtained vulnerability information; S2, delivering the vehicle-machine defense rules to the vehicle-machine terminal for the vehicle-machine terminal Vulnerability defense is performed according to the vehicle-machine defense rules; S3, the vulnerability information fed back by the vehicle-machine terminal through self-attack detection is obtained, and a defense strategy corresponding to the feedback vulnerability information is generated; and step S1 is further performed. This solution can realize vulnerability prediction, defense against predicted vulnerabilities, terminal self-attack detection, and rapid response to terminal self-attack detection, and provides vulnerability prediction for another terminal according to the terminal's own vulnerability detection and response results, and loops in turn to form Aiming at the complete protection ecological cycle of the on-board system, it can realize the safety protection of the on-board system in a multi-directional and integrated manner, and has an excellent protective effect.

Description

Vehicle system safety protection method and device

technical field

The invention relates to the technical field of vehicle safety, in particular to a safety protection method and device for a vehicle-mounted system.

Background technique

With the continuous development of technology and society, the emergence of various types of intelligent and automated vehicles has greatly facilitated people's work and life, but at the same time, it has also spawned many security threats to vehicles. For example, the programmable or remotely controllable in-vehicle systems in vehicles provide new intrusion channels for illegal intruders, thus posing a great threat to people's property and life.

In order to ensure the normal operation of the in-vehicle system, in the prior art, methods such as hot patches are usually used to protect the in-vehicle system. However, the current security protection for in-vehicle systems is often a single-point protection method, that is, a certain defense method is adopted for the vulnerabilities existing in the system. How to fix big hot patches etc. It can be seen that the use of this single-point protection method not only has poor protection effect, but also further reduces the stability of the vehicle.

SUMMARY OF THE INVENTION

In view of the above problems, the present invention is proposed to provide a vehicle system security protection method and device that overcomes the above problems or at least partially solves the above problems.

According to one aspect of the present invention, a method for safety protection of a vehicle-mounted system is provided, comprising:

S1, according to the acquired vulnerability information and the defense strategy corresponding to the acquired vulnerability information, generate corresponding vehicle-machine defense rules;

S2, delivering the vehicle-machine defense rule to the vehicle-machine terminal, so that the vehicle-machine terminal can perform vulnerability defense according to the vehicle-machine defense rule;

S3: Obtain vulnerability information fed back by the vehicle-machine terminal through self-attack detection, and generate a defense strategy corresponding to the feedback vulnerability information; and further perform step S1.

According to another aspect of the present invention, a vehicle-mounted system safety protection device is provided, comprising:

The defense rule generation module is adapted to generate corresponding vehicle and machine defense rules according to the acquired vulnerability information and the defense strategy corresponding to the acquired vulnerability information;

a delivery module, adapted to deliver the vehicle-machine defense rule to the vehicle-machine terminal, so that the vehicle-machine terminal can perform vulnerability defense according to the vehicle-machine defense rule;

The response module is adapted to obtain the vulnerability information fed back by the vehicle-machine terminal through self-attack detection, and generate a defense strategy corresponding to the feedback vulnerability information; and further execute the defense rule generation module.

According to yet another aspect of the present invention, a computing device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, and the processor, the memory, and the communication interface complete mutual communication through the communication bus. communication;

The memory is used for storing at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the above-mentioned vehicle system security protection method.

According to yet another aspect of the present invention, a computer storage medium is provided, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to perform operations corresponding to the above-mentioned method for security protection of an in-vehicle system.

According to the vehicle system security protection method and device provided by the present invention, according to the acquired vulnerability information and the defense strategy corresponding to the acquired vulnerability information, corresponding vehicle defense rules are generated; and the vehicle vehicle defense rules are sent to the vehicle terminal, It is used for the vehicle-machine terminal to perform vulnerability defense according to the vehicle-machine defense rules; and, the vulnerability information fed back by the vehicle-machine terminal through self-attack detection is obtained, and a defense strategy corresponding to the feedback vulnerability information is generated. This solution can realize vulnerability prediction, defense against predicted vulnerabilities, terminal self-attack detection, and rapid response to terminal self-attack detection, and provides vulnerability prediction for another terminal according to the terminal's own vulnerability detection and response results, and loops in turn to form Aiming at the complete protection ecological cycle of the on-board system, it can realize the safety protection of the on-board system in a multi-directional and integrated manner, and has an excellent protective effect.

The above description is only an overview of the technical solutions of the present invention, in order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand , the following specific embodiments of the present invention are given.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are for the purpose of illustrating preferred embodiments only and are not to be considered limiting of the invention. Also, the same components are denoted by the same reference numerals throughout the drawings. In the attached image:

FIG. 1 shows a schematic flowchart of a method for safety protection of an in-vehicle system provided according to an embodiment of the present invention;

FIG. 2 shows a schematic flowchart of a vehicle-mounted system security protection method provided according to another embodiment of the present invention;

3 shows a schematic structural diagram of a vehicle-mounted system safety protection device provided according to an embodiment of the present invention;

FIG. 4 shows a schematic structural diagram of a computing device according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be more thoroughly understood, and will fully convey the scope of the present disclosure to those skilled in the art.

Business Scope

FIG. 1 shows a schematic flowchart of a method for safety protection of an in-vehicle system according to an embodiment of the present invention.

The in-vehicle system described in this embodiment may be an in-vehicle T-box (Telematics Box) system, an in-vehicle infotainment system (IVI, In-Vehicle Infotainment), and/or a head-up display system (HUD, Head Up Display) and the like. This embodiment does not limit the specific type and the like of the in-vehicle system. This embodiment may be specifically executed on the server side. As shown in Figure 1, the method includes:

Step S110, according to the acquired vulnerability information and the defense strategy corresponding to the acquired vulnerability information, generate corresponding vehicle-machine defense rules.

In the specific implementation process, the vulnerability information fed back from at least one vehicle terminal in the Internet of Vehicles and/or the vulnerability information obtained from the security forum or website can be analyzed, and the vehicle terminal in the Internet of Vehicles may be determined according to the analysis results. Existing security vulnerabilities. And further combined with the defense strategy corresponding to the acquired vulnerability information, the corresponding vehicle-machine defense rules are generated, so as to realize the prediction of vulnerabilities in the Internet of Vehicles.

In an optional implementation manner, corresponding vehicle defense rules can be formulated for different types of vehicle terminals according to the vehicle categories corresponding to different vulnerabilities, so as to realize the customized vulnerability of the vehicle system in the vehicle terminal. defense. For example, if a certain vulnerability bug1 is an attack against a type A vehicle, the vehicle-machine defense rules formulated for each vehicle-machine terminal of the A-type vehicle include the defense rule of the vulnerability bug1.

Step S120, delivering the vehicle-machine defense rule to the vehicle-machine terminal, so that the vehicle-machine terminal can perform vulnerability defense according to the vehicle-machine defense rule.

After the corresponding vehicle-machine defense rules are generated, the vehicle-machine defense rules are further issued to the vehicle-machine terminal. Optionally, if corresponding vehicle-machine defense rules are formulated for different types of vehicle-machine terminals in step S110, in this step, the vehicle-machine defense rules may be issued to the vehicle-machine terminals corresponding to the vehicle-machine defense rules, thereby While realizing the customized security defense of the vehicle system in the vehicle terminal, it saves system resources.

After receiving the issued car-machine defense rules, the car-machine terminal performs vulnerability defense according to the issued car-machine defense rules, so as to achieve the purpose of defending the predicted loopholes.

Step S130, acquiring vulnerability information fed back by the vehicle-machine terminal through self-attack detection, and generating a defense strategy corresponding to the feedback vulnerability information.

In addition to defending against the predicted vulnerabilities according to the vehicle-machine defense rules, the vehicle-machine terminal can further detect attacks on itself according to the corresponding attack detection methods. When the vehicle-mounted terminal determines that the vehicle-mounted system in the vehicle-mounted terminal is attacked through self-attack detection, it can feed back vulnerability information corresponding to the attack.

Further, the vulnerability information fed back by the vehicle terminal through its own attack detection can be obtained, and the vulnerability information fed back by the vehicle terminal can be quickly responded to, and a defense strategy corresponding to the feedback vulnerability information can be generated and sent to the vehicle terminal for use. The vehicle-machine terminal performs attack blocking or vulnerability repair according to the defense strategy corresponding to the feedback vulnerability information.

The vulnerability information fed back by the vehicle terminal and the generated vulnerability information related to the feedback information may further provide a basis for generating the vehicle defense rules in step S110. Therefore, after this step is performed, step S110 is further performed, thereby forming a complete protection ecological cycle for the vehicle-mounted system.

The following describes the implementation process of this embodiment in detail with a specific example:

After analyzing the vulnerability information fed back by the car-machine terminal 1 and the car-machine terminal 2 and the vulnerability information obtained from the preset security forum, it is determined that there may be a vulnerability bug1 in the car-machine terminal of the Internet of Vehicles. According to the defense strategy corresponding to bug1, corresponding vehicle-machine defense rules are generated (corresponding to step S110); further, the generated vehicle-machine defense rules are sent to other vehicle-machine terminals in the vehicle network, and the vehicle-machine terminal 3 in the vehicle network is based on the following The issued vehicle defense rule defends the vulnerability bug1 in the vehicle terminal 3; and the vehicle terminal 3 can also detect whether the current vehicle system is attacked through the corresponding attack detection method, and if so, the detected attack corresponds to the attack detection method. The vulnerability information bug2 is fed back (corresponding to step S120); a quick response can be made according to the vulnerability information fed back by the vehicle terminal, a defense strategy for the vulnerability bug2 is generated, and the defense strategy is quickly fed back to the vehicle terminal 3 for use in the vehicle terminal 3. The vehicle terminal 3 performs attack blocking or repair on the vulnerability bug2 (corresponding to step S130 ); and the vulnerability bug2 and its defense strategy can further provide a basis for generating new vehicle defense rules (corresponding to step S110 ).

It can be seen that, according to the obtained vulnerability information and the defense strategy corresponding to the obtained vulnerability information, this embodiment generates corresponding vehicle-machine defense rules, so as to predict the possible vulnerabilities of the vehicle-machine terminal in the Internet of Vehicles; and further The vehicle-machine defense rules are sent to the vehicle-machine terminal, so that the vehicle-machine terminal can defend against the predicted vulnerabilities according to the vehicle-machine defense rules; in addition, the vehicle-machine terminal can also perform attack detection on itself, and feedback the vulnerabilities corresponding to the attack. information, so that the defense strategy corresponding to the feedback vulnerability information can be quickly generated, so that the vehicle terminal can block the current attack and repair the vulnerability, and can provide a vulnerability for another terminal according to the terminal's own attack detection and response results. Prediction and realize security protection from point to surface. Therefore, this solution can realize vulnerability prediction, defense against predicted vulnerabilities, terminal self-attack detection, and rapid response to terminal self-attack detection, thus forming a complete protection ecological cycle for vehicle-mounted systems, which can be integrated in all directions. In addition, the solution can realize the multi-point protection of the in-vehicle system, which is beneficial to the further improvement of the safety and stability of the in-vehicle system.

FIG. 2 shows a schematic flowchart of a method for safety protection of an in-vehicle system according to another embodiment of the present invention. As shown in Figure 2, the method includes:

Step S210, according to the acquired first type of vulnerability information and/or second type of vulnerability information, and the defense strategy corresponding to the first type of vulnerability information and/or the second type of vulnerability information, generate corresponding vehicle and machine defense rules.

In this embodiment, in the process of predicting vulnerabilities and generating vehicle-machine defense rules, at least one type of vulnerability information is specifically obtained. The vulnerability information includes the first type of vulnerability information and the second type of vulnerability information. The first type of vulnerability information is the vulnerability information fed back by the vehicle terminal, and the second type of vulnerability information is the vulnerability information obtained from a preset vulnerability database. The preset vulnerability library can be a preset website, a preset forum, a preset communication platform, etc. that contain vulnerability information; or the vulnerability information can be obtained from a preset website, a preset forum, a preset communication platform, etc., and then stored in a preset In the information database, which is the default vulnerability database.

Further, according to the acquired first type of vulnerability information and/or the second type of vulnerability information, and the defense strategy corresponding to the first type of vulnerability information and/or the second type of vulnerability information, a corresponding vehicle-machine defense rule is generated.

Among them, the vehicle-machine defense rules at least include reinforcement isolation rules, vulnerability investigation rules and/or vulnerability blocking and repairing rules. Among them, the reinforcement isolation rules are used to reinforce and reinforce the in-vehicle system in the vehicle terminal to improve the overall anti-attack capability of the in-vehicle system; the vulnerability inspection rules are used to check the vulnerabilities of the in-vehicle system to determine whether there is a predicted vulnerability in the in-vehicle system. Vulnerability; Vulnerability blocking and repairing rules are used to block and repair the identified vulnerabilities.

In an optional implementation manner, the corresponding vulnerability to be defended may be determined by analyzing the acquired vulnerability information of the first type and/or the vulnerability information of the second type. Wherein, the to-be-defended vulnerability is a possible vulnerability existing in the in-vehicle system in the Internet of Vehicles, that is, a predicted vulnerability existing in the in-vehicle system. In order to facilitate the rapid and accurate inspection of vulnerabilities by the vehicle terminal, the vehicle defense rules generated in this step also include priority information of the vulnerabilities to be defended and/or location information of the vulnerabilities to be defended. That is, define the corresponding danger level for the vulnerabilities to be defended, such as high-risk vulnerabilities, general vulnerabilities, low-risk vulnerabilities, etc.; and/or, determine the layers where the vulnerabilities to be defended are prone to occur (such as application layer, framework layer, and/or kernel layer, etc. etc.) and specific modules, etc.

In step S220, the vehicle-machine defense rule is issued to the vehicle-machine terminal, so that the vehicle-machine terminal can perform vulnerability investigation according to the vulnerability checking rule in the vehicle-machine defense rule; The vulnerability is blocked and repaired.

Specifically, the generated vehicle-machine defense rule can be delivered to the vehicle-machine terminal, so that the vehicle-machine terminal can perform security defense according to the issued vehicle-machine defense rule. Here, those skilled in the art should understand that the reinforcement isolation rules, vulnerability checking rules and/or vulnerability blocking and repairing rules included in the vehicle-machine defense rules in this embodiment may be delivered to the vehicle-machine terminal at one time, or may be divided into two groups. to be issued. For example, after the vulnerability inspection rules are issued, according to the feedback of the vehicle terminal, the vulnerability blocking repair can be issued, thereby saving bandwidth resources, reducing costs, and facilitating timely protection of the vehicle system.

In an optional implementation manner, the vehicle-mounted terminal can perform system reinforcement and system isolation on the vehicle-mounted system in the vehicle-mounted terminal according to the reinforcement and isolation rules in the vehicle-mounted defense rule. For example, the reinforcement of the system can be achieved by means of corresponding program reinforcement methods, modification of security configurations, etc.; the Internet of Vehicles and mobile phone networks can also be isolated. Wherein, this embodiment does not limit the specific reinforcement and isolation method of the system, and those skilled in the art can set it by themselves according to the actual situation.

In yet another optional implementation, the on-board terminal may first use the vulnerability checking rules in the on-board defense rules to perform vulnerability checking on the on-board terminal, and determine whether the on-board terminal includes the vulnerability checking rules according to the checking result. of pending vulnerabilities. Specifically, whether there is a to-be-defended vulnerability in the vehicle terminal can be quickly determined according to the location information of the to-be-defended vulnerability. Optionally, the vulnerability checking rules include file monitoring rules and/or intrusion monitoring rules. Then, in the specific vulnerability inspection process, the vehicle terminal can be inspected for vulnerabilities according to the file monitoring rules and/or the intrusion monitoring rules. In addition, the preset penetration testing method can also be used to check the vulnerabilities of the vehicle terminal.

When it is determined that there is a to-be-defended vulnerability in the vehicle-mounted terminal, a vulnerability blocking and repair rule corresponding to the to-be-defended vulnerability in the vehicle-mounted terminal is further issued, so that the vehicle-mounted terminal can utilize the vulnerability blocking in the vehicle-mounted defense rule. The repair rules block and repair the vulnerabilities to be defended in the car terminal. Specifically, according to the category and/or priority of the to-be-defended vulnerability existing in the vehicle terminal, corresponding vulnerability blocking and repairing rules can be used to block and repair the to-be-defended vulnerability. In addition, the file blocking rules, intrusion blocking rules and/or hot patch repair rules included in the vulnerability blocking and repairing rules can be used to block and repair the to-be-defended vulnerabilities.

Optionally, in the process of checking and blocking and repairing the vulnerability to be defensed, this embodiment adopts a hierarchical defense method to ensure the security and stability of the vehicle-mounted system. Specifically, firstly, the method of monitoring files with low accuracy but less impact on the system is used to check the vulnerabilities to be defended. When it is determined that there are vulnerabilities to be defended, methods such as file freezing or deletion are used to block the vulnerabilities. The file monitoring may specifically be payload file monitoring, and this embodiment does not limit the specific file monitoring method. For example, the vulnerability to be defended may be monitored by malicious attack file monitoring, file feature string matching, and/or file calling sequence matching, etc. Investigation; further, the intrusion detection method with high detection accuracy and less impact on the vehicle system is used to investigate the to-be-defended vulnerabilities. For example, the to-be-defended vulnerabilities can be inspected by means of interface parameter malicious data monitoring, root privilege escalation method monitoring, etc. , and use corresponding path blocking and other methods to block. Likewise, this embodiment does not limit the specific intrusion detection method; finally, hot patch repair can be performed for some specific vulnerabilities to be defended, so as to achieve the effect of making the vehicle system immune to the vulnerabilities.

Step S230, acquiring vulnerability information fed back by the vehicle-machine terminal through self-attack detection, and generating a defense strategy corresponding to the feedback vulnerability information.

In addition to defending against the predicted vulnerabilities according to the vehicle-machine defense rules, the vehicle-machine terminal can further detect the attack on itself according to the corresponding attack detection method, so as to determine the current attack on the vehicle-mounted system in the vehicle-machine terminal.

Specifically, the self-attack detection of the vehicle terminal can be performed by means of file monitoring and/or behavior monitoring. This embodiment does not limit the specific file monitoring and/or behavior monitoring manner. For example, static file monitoring for signature matching and dynamic malicious behavior monitoring for malicious attack data or exploit means can be implemented.

Optionally, in order to further improve the security of the in-vehicle system and reduce the false alarm rate of attack detection, this embodiment may perform attack detection for at least one level in the in-vehicle system. For example, attack detection can be performed at the application layer, framework layer and kernel layer in the vehicle system, which can greatly improve the coverage of attack detection and reduce the false negative rate of attack detection. Further optionally, in order to improve the attack detection effect, this embodiment may adopt corresponding attack detection methods for different levels. For example, at the kernel layer, the attack behavior on the kernel layer can be detected by the method of burying points, while at the framework layer, the attack behavior can be determined by the method of burying points and intelligent judgment in the cloud.

After passing the self-attack detection, the vehicle terminal can feed back the corresponding vulnerability information according to the detected attack behavior. In this step, after receiving the vulnerability information fed back by the vehicle terminal, a quick response can be performed, so as to formulate a defense strategy corresponding to the feedback vulnerability information. Thereby, the vulnerabilities detected by the vehicle terminal itself can be repaired and blocked.

In addition, the vulnerability information and response information fed back by the vehicle terminal can be used as the first type of vulnerability information for step S210 to issue a new vehicle defense rule.

It can be seen that, according to the obtained vulnerability information and the defense strategy corresponding to the obtained vulnerability information, this embodiment generates corresponding vehicle-machine defense rules, so as to predict the possible vulnerabilities of the vehicle-machine terminal in the Internet of Vehicles; and further The vehicle-machine defense rules are sent to the vehicle-machine terminal, so that the vehicle-machine terminal can defend against the predicted vulnerabilities according to the vehicle-machine defense rules; in addition, the vehicle-machine terminal can also perform attack detection on itself, and feedback the vulnerabilities corresponding to the attack. information, so that the defense strategy corresponding to the feedback vulnerability information can be quickly generated, so that the vehicle terminal can block the current attack and repair the vulnerability, and can provide a vulnerability for another terminal according to the terminal's own attack detection and response results. Prediction and realize security protection from point to surface. Therefore, this solution can realize vulnerability prediction, defense against predicted vulnerabilities, terminal self-attack detection, and rapid response to terminal self-attack detection, thus forming a complete protection ecological cycle for vehicle-mounted systems, which can be integrated in all directions. The security protection of the vehicle-mounted system can be realized comprehensively; and this solution can realize the multi-point protection of the vehicle-mounted system, which is beneficial to the further improvement of the security and stability of the vehicle-mounted system; and, in the process of defending the vehicle-machine terminal in this embodiment By adopting the method of hierarchical defense, the stability of the in-vehicle system can be further improved while the security of the in-vehicle system is improved.

FIG. 3 shows a schematic structural diagram of a vehicle-mounted system safety protection device according to an embodiment of the present invention. As shown in FIG. 3 , the device includes: a defense rule generation module 31 issuing module 32 and a response module 33 .

The defense rule generation module 31 is adapted to generate corresponding vehicle and machine defense rules according to the acquired vulnerability information and the defense strategy corresponding to the acquired vulnerability information;

The issuing module 32 is adapted to issue the vehicle-machine defense rule to the vehicle-machine terminal, so that the vehicle-machine terminal can perform vulnerability defense according to the vehicle-machine defense rule;

The response module 33 is adapted to obtain vulnerability information fed back by the vehicle terminal through self-attack detection, and generate a defense strategy corresponding to the feedback vulnerability information; and further execute a defense rule generation module.

Optionally, the defense rule generation module 31 is further adapted to: based on the acquired first-type vulnerability information and/or second-type vulnerability information, and the defense corresponding to the first-type vulnerability information and/or the second-type vulnerability information. strategy, and generate corresponding vehicle and machine defense rules;

Wherein, the first type of vulnerability information is the vulnerability information fed back by the vehicle terminal; the second type of vulnerability information is the vulnerability information obtained from a preset vulnerability database.

Optionally, the vehicle and machine defense rules include: reinforcement isolation rules, vulnerability investigation rules, and/or vulnerability blocking and repairing rules.

Optionally, the vehicle-machine defense rule further includes priority information of the vulnerability to be defended and/or location information of the vulnerability to be defended.

Optionally, the vulnerability checking rules include: file monitoring rules and/or intrusion monitoring rules;

The vulnerability blocking and repairing rules include: file blocking rules, intrusion blocking rules and/or hot patch repairing rules.

Optionally, the issuing module 32 is further adapted to: issue the vehicle-machine defense rule to the vehicle-machine terminal, so that the vehicle-machine terminal can perform vulnerability checking on the vehicle-machine terminal according to the vulnerability checking rule in the vehicle-machine defense rule, and According to the inspection results, determine whether there are any vulnerabilities to be defended in the vehicle terminal that are included in the vulnerability inspection rules; if so, the vehicle terminal uses the vulnerability blocking and repair rules in the vehicle defense rules to block the to-be-defended loopholes in the vehicle terminal. repair.

Optionally, the issuing module 32 is further adapted to: issue the on-board defense rules to the on-board terminal, so that the on-board terminal can adopt the corresponding defense rules according to the category and/or priority of the vulnerabilities to be defended existing in the on-board terminal. The corresponding vulnerability blocking and repairing rules block and repair the to-be-defended vulnerability.

Optionally, the response module 33 is further adapted to: acquire vulnerability information fed back by the vehicle terminal through file monitoring and/or behavior monitoring.

For the specific implementation process of each module in the vehicle-mounted system safety protection device provided in this embodiment, reference may be made to the description of the corresponding steps in the embodiment shown in FIG. 1 and/or FIG. 2 , which will not be repeated in this embodiment.

It can be seen that, according to the obtained vulnerability information and the defense strategy corresponding to the obtained vulnerability information, this embodiment generates corresponding vehicle-machine defense rules, so as to predict the possible vulnerabilities of the vehicle-machine terminal in the Internet of Vehicles; and further The vehicle-machine defense rules are sent to the vehicle-machine terminal, so that the vehicle-machine terminal can defend against the predicted vulnerabilities according to the vehicle-machine defense rules; in addition, the vehicle-machine terminal can also perform attack detection on itself, and feedback the vulnerabilities corresponding to the attack. information, so that the defense strategy corresponding to the feedback vulnerability information can be quickly generated, so that the vehicle terminal can block the current attack and repair the vulnerability, and can provide a vulnerability for another terminal according to the terminal's own attack detection and response results. Prediction and realize security protection from point to surface. Therefore, this solution can realize vulnerability prediction, defense against predicted vulnerabilities, terminal self-attack detection, and rapid response to terminal self-attack detection, thus forming a complete protection ecological cycle for vehicle-mounted systems, which can be integrated in all directions. In addition, the solution can realize the multi-point protection of the in-vehicle system, which is beneficial to the further improvement of the safety and stability of the in-vehicle system.

According to an embodiment of the present invention, a non-volatile computer storage medium is provided. The computer storage medium stores at least one executable instruction, and the computer executable instruction can execute the vehicle system security protection method in any of the above method embodiments. .

FIG. 4 shows a schematic structural diagram of a computing device according to an embodiment of the present invention. The specific embodiment of the present invention does not limit the specific implementation of the computing device.

As shown in FIG. 4 , the computing device may include: a processor (processor) 402 , a communications interface (Communications Interface) 404 , a memory (memory) 406 , and a communication bus 408 .

in:

The processor 402 , the communication interface 404 , and the memory 406 communicate with each other through the communication bus 408 .

The communication interface 404 is used for communicating with network elements of other devices such as clients or other servers.

The processor 402 is configured to execute the program 410, and specifically may execute the relevant steps in the foregoing embodiments of the vehicle-mounted system security protection method.

Specifically, the program 410 may include program code including computer operation instructions.

The processor 402 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The one or more processors included in the computing device may be the same type of processors, such as one or more CPUs; or may be different types of processors, such as one or more CPUs and one or more ASICs.

The memory 406 is used to store the program 410 . Memory 406 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk memory.

The program 410 can specifically be used to cause the processor 402 to perform the following operations:

S1, according to the acquired vulnerability information and the defense strategy corresponding to the acquired vulnerability information, generate corresponding vehicle-machine defense rules;

S2, delivering the vehicle-machine defense rule to the vehicle-machine terminal, so that the vehicle-machine terminal can perform vulnerability defense according to the vehicle-machine defense rule;

S3: Obtain vulnerability information fed back by the vehicle-machine terminal through self-attack detection, and generate a defense strategy corresponding to the feedback vulnerability information; and further perform step S1.

In an optional implementation manner, the program 410 may specifically be used to cause the processor 402 to perform the following operations:

According to the obtained first-type vulnerability information and/or second-type vulnerability information, and the defense strategy corresponding to the first-type vulnerability information and/or the second-type vulnerability information, corresponding vehicle-machine defense rules are generated;

Wherein, the first type of vulnerability information is the vulnerability information fed back by the vehicle terminal; the second type of vulnerability information is the vulnerability information obtained from a preset vulnerability database.

In an optional implementation manner, the vehicle and machine defense rules include: reinforcement isolation rules, vulnerability investigation rules, and/or vulnerability blocking and repairing rules.

In an optional implementation manner, the vehicle-machine defense rule further includes priority information of the vulnerability to be defended and/or location information of the vulnerability to be defended.

In an optional implementation manner, the vulnerability checking rules include: file monitoring rules and/or intrusion monitoring rules;

The vulnerability blocking and repairing rules include: file blocking rules, intrusion blocking rules and/or hot patch repairing rules.

In an optional implementation manner, the program 410 may specifically be used to cause the processor 402 to perform the following operations:

The in-vehicle terminal conducts vulnerability inspection on the in-vehicle terminal according to the vulnerability inspection rules in the in-vehicle defense rules, and judges whether there are any vulnerabilities to be defended contained in the vulnerability inspection rules in the in-vehicle terminal according to the inspection results;

If so, the vehicle terminal uses the vulnerability blocking and repairing rule in the vehicle defense rule to block and repair the to-be-defended vulnerability existing in the vehicle terminal.

In an optional implementation manner, the program 410 may specifically be used to cause the processor 402 to perform the following operations:

According to the category and/or priority of the to-be-defended vulnerability existing in the vehicle terminal, the corresponding vulnerability blocking and repairing rule is used to block and repair the to-be-defended vulnerability.

In an optional implementation manner, the program 410 may specifically be used to cause the processor 402 to perform the following operations:

Obtain the vulnerability information fed back by the vehicle terminal through file monitoring and/or behavior monitoring.

The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used with teaching based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not directed to any particular programming language. It is to be understood that various programming languages may be used to implement the inventions described herein, and that the descriptions of specific languages above are intended to disclose the best mode for carrying out the invention.

In the description provided herein, numerous specific details are set forth. It will be understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it is to be understood that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or its description. This disclosure, however, should not be construed as reflecting an intention that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and further they may be divided into multiple sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination, unless at least some of such features and/or procedures or elements are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that although some of the embodiments described herein include certain features, but not others, included in other embodiments, that combinations of features of different embodiments are intended to be within the scope of the invention within and form different embodiments. For example, in the claims, any of the claimed embodiments may be used in any combination.

Various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components of the vehicle-mounted system safety protection device according to the embodiments of the present invention. The present invention can also be implemented as apparatus or apparatus programs (eg, computer programs and computer program products) for performing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such signals may be downloaded from Internet sites, or provided on carrier signals, or in any other form.

It should be noted that the above-described embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by those skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. do not denote any order. These words can be interpreted as names.

The invention discloses: A1. A vehicle-mounted system safety protection method, comprising:

S1, according to the acquired vulnerability information and the defense strategy corresponding to the acquired vulnerability information, generate corresponding vehicle-machine defense rules;

S2, delivering the vehicle-machine defense rule to the vehicle-machine terminal, so that the vehicle-machine terminal can perform vulnerability defense according to the vehicle-machine defense rule;

S3: Obtain vulnerability information fed back by the vehicle-machine terminal through self-attack detection, and generate a defense strategy corresponding to the feedback vulnerability information; and further perform step S1.

A2. The method according to A1, wherein generating the corresponding vehicle-machine defense rules according to the acquired vulnerability information and the defense strategy corresponding to the acquired vulnerability information further includes:

According to the obtained first-type vulnerability information and/or second-type vulnerability information, and the defense strategy corresponding to the first-type vulnerability information and/or the second-type vulnerability information, corresponding vehicle-machine defense rules are generated;

Wherein, the first type of vulnerability information is the vulnerability information fed back by the vehicle terminal; the second type of vulnerability information is the vulnerability information obtained from a preset vulnerability database.

A3. The method according to A1 or A2, wherein the vehicle-machine defense rules include: reinforcement isolation rules, vulnerability inspection rules and/or vulnerability blocking and repairing rules.

A4. The method according to A3, wherein the vehicle-machine defense rule further includes priority information of the vulnerability to be defended and/or location information of the vulnerability to be defended.

A5. The method according to A4, wherein the vulnerability checking rules include: file monitoring rules and/or intrusion monitoring rules;

The vulnerability blocking and repairing rules include: file blocking rules, intrusion blocking rules and/or hot patch repairing rules.

A6. The method according to A5, wherein the vulnerability defense performed by the vehicle-machine terminal according to the vehicle-machine defense rule further comprises:

The in-vehicle terminal conducts vulnerability inspection on the in-vehicle terminal according to the vulnerability inspection rules in the in-vehicle defense rules, and judges whether there are any vulnerabilities to be defended contained in the vulnerability inspection rules in the in-vehicle terminal according to the inspection results;

If so, the vehicle terminal uses the vulnerability blocking and repairing rule in the vehicle defense rule to block and repair the to-be-defended vulnerability existing in the vehicle terminal.

A7. The method according to A6, wherein, using the vulnerability repair rules in the vehicle-machine defense rules to repair the to-be-defended vulnerability existing in the vehicle-machine terminal further comprises:

According to the category and/or priority of the to-be-defended vulnerability existing in the vehicle terminal, the corresponding vulnerability blocking and repairing rule is used to block and repair the to-be-defended vulnerability.

A8. The method according to any one of A1-A7, wherein the acquiring the vulnerability information fed back by the vehicle terminal through self-attack detection further includes:

Obtain the vulnerability information fed back by the vehicle terminal through file monitoring and/or behavior monitoring.

The invention also discloses: B9. A vehicle-mounted system safety protection device, comprising:

The defense rule generation module is adapted to generate corresponding vehicle and machine defense rules according to the acquired vulnerability information and the defense strategy corresponding to the acquired vulnerability information;

a delivery module, adapted to deliver the vehicle-machine defense rule to the vehicle-machine terminal, so that the vehicle-machine terminal can perform vulnerability defense according to the vehicle-machine defense rule;

The response module is adapted to obtain the vulnerability information fed back by the vehicle-machine terminal through self-attack detection, and generate a defense strategy corresponding to the feedback vulnerability information; and further execute the defense rule generation module.

B10. The device according to B9, wherein the defense rule generation module is further adapted to: based on the acquired first-type vulnerability information and/or second-type vulnerability information, and a combination with the first-type vulnerability information and/or The defense strategy corresponding to the second type of vulnerability information, and the corresponding vehicle and machine defense rules are generated;

Wherein, the first type of vulnerability information is the vulnerability information fed back by the vehicle terminal; the second type of vulnerability information is the vulnerability information obtained from a preset vulnerability database.

B11. The device according to B9 or B10, wherein the vehicle and machine defense rules include: reinforcement isolation rules, vulnerability checking rules and/or vulnerability blocking and repairing rules.

B12. The device according to B11, wherein the vehicle-machine defense rule further includes priority information of the vulnerability to be defended and/or location information of the vulnerability to be defended.

B13. The device according to B11, wherein the vulnerability checking rules include: file monitoring rules and/or intrusion monitoring rules;

The vulnerability blocking and repairing rules include: file blocking rules, intrusion blocking rules and/or hot patch repairing rules.

B14. The apparatus according to B13, wherein the issuing module is further adapted to:

Sending the vehicle-machine defense rule to the vehicle-machine terminal, so that the vehicle-machine terminal can perform vulnerability investigation on the vehicle-machine terminal according to the vulnerability investigation rule in the vehicle-machine defense rule, and judge whether there is a vulnerability investigation in the vehicle-machine terminal according to the inspection result. The loopholes to be defended contained in the rules; if so, the on-board terminal uses the loophole blocking and repair rules in the on-board defense rules to block and repair the to-be-defended loopholes existing in the onboard terminal.

B15. The apparatus according to B14, wherein the issuing module is further adapted to:

Sending the vehicle-machine defense rules to the vehicle-machine terminal, so that the vehicle-machine terminal can adopt the corresponding vulnerability blocking and repairing rules according to the category and/or priority of the to-be-defended vulnerability existing in the vehicle-machine terminal. Vulnerabilities are blocked and repaired.

B16. The apparatus according to any one of B9-B15, wherein the response module is further adapted to: acquire vulnerability information fed back by the vehicle terminal through file monitoring and/or behavior monitoring.

The present invention also discloses: C17. A computing device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus;

The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the vehicle-mounted system security protection method described in any one of A1-A8.

The present invention also discloses: D18. A computer storage medium, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to execute the in-vehicle system security according to any one of A1-A8 Action corresponding to the protection method.

Claims (10)

1. A safety protection method for an on-board system comprises the following steps:

s1, generating a corresponding vehicle defense rule according to the acquired vulnerability information and a defense strategy corresponding to the acquired vulnerability information;

s2, issuing the vehicle defense rule to a vehicle terminal for the vehicle terminal to defend the vulnerability according to the vehicle defense rule;

s3, acquiring vulnerability information fed back by the vehicle terminal through self attack detection, and generating a defense strategy corresponding to the fed vulnerability information; and further performs step S1.

2. The method of claim 1, wherein generating the corresponding in-vehicle defense rule according to the obtained vulnerability information and a defense policy corresponding to the obtained vulnerability information further comprises:

generating a corresponding vehicle-mounted defense rule according to the acquired first-type vulnerability information and/or second-type vulnerability information and a defense strategy corresponding to the first-type vulnerability information and/or the second-type vulnerability information;

the first type of vulnerability information is vulnerability information fed back by the vehicle terminal; the second type of vulnerability information is vulnerability information obtained from a preset vulnerability database.

3. The method of claim 1 or 2, wherein the car defense rules include: reinforcement isolation rules, vulnerability troubleshooting rules, and/or vulnerability blocking repair rules.

4. The method according to claim 3, wherein the in-vehicle defense rules further include priority information of vulnerabilities to be defended and/or location information of vulnerabilities to be defended.

5. The method of claim 4, wherein the vulnerability troubleshooting rules include: file monitoring rules and/or intrusion monitoring rules;

the bug blocking and repairing rule comprises the following steps: file blocking rules, intrusion blocking rules, and/or hot patch repair rules.

6. The method of claim 5, wherein the in-vehicle terminal defending against vulnerabilities according to the in-vehicle defense rules further comprises:

the vehicle-mounted terminal carries out vulnerability investigation on the vehicle-mounted terminal according to vulnerability investigation rules in the vehicle-mounted defense rules, and judges whether vulnerabilities to be defended contained in the vulnerability investigation rules exist in the vehicle-mounted terminal or not according to investigation results;

if so, the vehicle-mounted terminal blocks and repairs the to-be-defensive loopholes existing in the vehicle-mounted terminal by using a loophole blocking and repairing rule in the vehicle-mounted defense rule.

7. The method of claim 6, wherein the repairing the vulnerability to be defended existing in the car machine terminal by using the vulnerability repairing rule in the car machine defense rule further comprises:

and adopting a corresponding bug blocking and repairing rule to block and repair the to-be-defended bug according to the category and/or priority of the to-be-defended bug existing in the vehicle terminal.

8. An on-board system safety shield, comprising:

the defense rule generating module is suitable for generating a corresponding vehicle-mounted defense rule according to the acquired vulnerability information and a defense strategy corresponding to the acquired vulnerability information;

the issuing module is suitable for issuing the vehicle-mounted defense rule to a vehicle-mounted terminal so that the vehicle-mounted terminal can defend the vulnerability according to the vehicle-mounted defense rule;

the response module is suitable for acquiring vulnerability information fed back by the vehicle-mounted terminal through self attack detection and generating a defense strategy corresponding to the fed-back vulnerability information; and further executing a defense rule generating module.

9. A computing device, comprising: the system comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete mutual communication through the communication bus;

the memory is used for storing at least one executable instruction, and the executable instruction causes the processor to execute the operation corresponding to the vehicle-mounted system safety protection method according to any one of claims 1-7.

10. A computer storage medium having at least one executable instruction stored therein, the executable instruction causing a processor to perform operations corresponding to the in-vehicle system safeguard method according to any one of claims 1-7.

Images