Method and device for analyzing service-oriented communication

Patent metadata

Field	Value
Publication number	US-11533388-B2
Application number	US-202016919064-A
Country	US
Kind code	B2
Filing date	Jul 1, 2020
Priority date	Jul 10, 2019
Publication date	Dec 20, 2022
Grant date	Dec 20, 2022

Abstract

A device and a method for analyzing service-oriented communication in a communications network. A data packet includes a first header of an application layer for service-oriented communication, and a second header of a presentation layer, a session layer, a transport layer, a network layer, a data link layer, or a physical layer. The data packet is analyzed based on information concerning a sender and/or receiver of the data packet from the first header and as a function of information concerning a sender and/or receiver from the second header, for whether or not the data packet meets a criterion, the criterion defining a setpoint value for the sender and/or receiver in the first header as a function of the content of the second header, and/or the criterion defining a setpoint value for the sender and/or receiver in the second header as a function of the content of the first header.

First claim

What is claimed is:

1. A method for analyzing service-oriented communication in a communications network, wherein a data packet includes a first header of an application layer for service-oriented communication, and a second header of a protocol layer which is different from the application layer, for communication in the communications network, the protocol layer which is different from the application layer being of a presentation layer, or a session layer, or a transport layer, or a network layer, or a data link layer, or a physical layer, the method comprising:
analyzing the data packet of the communications network, as a function of information concerning a sender and/or receiver of the data packet from the first header and as a function of information concerning a sender and/or receiver from the second header, for whether or not the data packet meets a criterion, the criterion defining a setpoint value for the sender and/or receiver in the first header as a function of content of the second header, and/or the criterion defining a setpoint value for the sender and/or receiver in the second header as a function of content of the first header, wherein the communications network is an automotive communications network internal to a vehicle;
wherein the data packet includes information concerning a message type of the data packet, and wherein the analyzing step includes checking whether the data packet is being exchanged between a service user and a service provider in a direction corresponding to the message type of the data packet, and detecting an anomaly or an intrusion in the communications network based on the checking.

2. The method as recited in claim 1 , wherein the setpoint value defines at least one registered end point, and wherein the checking step includes checking a header, as a function of content of the header, whether the data packet is sent from a registered end point and/or whether the data packet is sent to a registered end point, the header being the first header and/or the second header.

3. The method as recited in claim 1 , wherein the setpoint value defines registered end points, and wherein the checking step includes checking a header, as a function of content of the header, whether the data packet is exchanged between end points that are registered for the service-oriented communication, the header being the first header and/or the second header.

4. The method as recited in claim 1 , wherein the setpoint value defines at least one registered end point, and the data packet includes an identification of a service, wherein for a sender end point of the data packet, in the analyzing step, it is checked whether the sender end point corresponds to a service provider designated in the data packet, identified by the identification of the service, and wherein for a receiver end point of the data packet, in the checking step, it is checked whether the receiver end point corresponds to a service user designated in the data packet, identified by an identification of a client.

5. The method as recited in claim 1 , wherein the setpoint value defines at least one registered end point, and the data packet includes an identification of a client, wherein for a sender end point of the data packet, in the analyzing step, it is checked whether the sender end point corresponds to a service user designated in the data packet, identified by the identification of the client, and wherein for a receiver end point of the data packet, in the checking step, it is checked whether the receiver end point corresponds to a service provider designated in the data packet, identified by an identification of a service.

6. The method as recited in claim 1 , wherein the setpoint value defines registered end points, and the data packet includes an identification of a service and an identification of a client, wherein in the checking step, it is checked whether the data packet is exchanged between end points that are registered for the identification of the service identified in the data packet and the identification of the client identified in the data packet.

7. The method as recited in claim 6 , wherein, in the checking step, it is checked whether a sender end point and a receiver end point of the data packet form a registered combination.

8. The method as recited in claim 1 , wherein during a service discovery phase, it is checked whether for a data packet via which information concerning an end point that offers a service is transmitted, the end point that offers the service is an end point that is registered as a service provider and/or is an end point that is registered for the offered service as a service provider.

9. The method as recited in claim 1 , wherein during a service discovery phase, it is checked whether for a data packet via which information concerning an end point that queries a service is transmitted, the end point that queries the service is an end point that is registered as a service user and/or is an end point that is registered for the queried service as a service user.

10. The method as recited in claim 1 , wherein before checking the criterion, it is checked whether the data packet is part of a service-oriented communication, the check of the criterion being carried out when the data packet is part of a service-oriented communication, and otherwise the check not taking place.

11. A device for analyzing service-oriented communication in a communications network, comprising:
an analysis device situated in a connecting element which connects data lines in the communications network for transmitting data packets, or is connected or connectable to the connecting element for communication, the analysis device being configured to analyze service-oriented communication in a communications network, wherein a data packet includes a first header of an application layer for service-oriented communication, and a second header of a protocol layer which is different from the application layer, for communication in the communications network, the protocol layer which is different from the application layer being of a presentation layer, or a session layer, or a transport layer, or a network layer, or a data link layer, or a physical layer, the analysis device being configured to:
analyze the data packet, as a function of information concerning a sender and/or receiver of the data packet from the first header and as a function of information concerning a sender and/or receiver from the second header, for whether or not the data packet meets a criterion, the criterion defining a setpoint value for the sender and/or receiver in the first header as a function of content of the second header, and/or the criterion defining a setpoint value for the sender and/or receiver in the second header as a function of content of the first header, wherein the data packet includes information concerning a message type of the data packet, and wherein the analysis of the data packet by the analysis device includes checking whether the data packet is being exchanged between a service user and a service provider in a direction corresponding to the message type of the data packet, and detecting an anomaly or an intrusion in the communications network based on the checking;
wherein the communications network is an automotive communications network internal to a vehicle.

12. The device as recited in claim 11 , wherein the connecting element is an automotive Ethernet switch.

13. A non-transitory computer-readable memory medium on which is stored a computer program analyzing service-oriented communication in a communications network, wherein a data packet includes a first header of an application layer for

Assignees

• Bosch Gmbh Robert

Inventors

• Weber Andreas
• Wolfinger Janin
• Gramm Jens
• Herrmann Michael

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04L45/74 Primary

  Address processing for routing · CPC title