Method and device for intrusion detection in a computer network

Patent metadata

Field	Value
Publication number	US-11729188-B2
Application number	US-202016922329-A
Country	US
Kind code	B2
Filing date	Jul 7, 2020
Priority date	Jul 10, 2019
Publication date	Aug 15, 2023
Grant date	Aug 15, 2023

Abstract

Device and method for intrusion detection in a computer network. A data packet is received at an input of a hardware switch unit, an actual value from a field of the data packet being compared in a comparison by a hardware filter with a setpoint value for values from the field, the field including data link layer data or network layer data, a value for a counter determined as a function of a result of the comparison being provided by the hardware switch unit, and a computing device determining a result of the intrusion detection as a function of the value of the counter in the hardware switch unit and independently of information from the data packet, in particular, without an evaluation of information from the data packet by the computing device.

First claim

What is claimed is:

1. A method for detection of an intrusion by a data packet into an automotive computer network, the method comprising the following steps:
receiving the data packet at an input of a hardware switch unit, the hardware switch unit including a hardware filter;
analyzing the data packet by the hardware switch for the detection of the intrusion by the data packet into the automotive computer network, the automotive computer network being internal to the vehicle, the analyzing including:
comparing, by the hardware filter, an actual value from a field of the data packet with a setpoint value for values from the field, the field including data link layer data or network layer data, and
determining, by the hardware switch unit, a value for a counter as a function of a result of the comparison, wherein the determining of the value includes incrementing a counter value of the counter based on a deviation between the actual value and the setpoint value being present; and

determining, by a computing device, a result of the detection of the intrusion by the data packet into the automotive computer network, the computing device determining the result of the detection as a function of the value of the counter in the hardware switch unit and independently of information from the data packet, without an evaluation of information from the data packet by the computing device.

2. The method as recited in claim 1 , wherein the value of the counter is incremented when a deviation between the actual value and the setpoint value is present.

3. The method as recited in claim 1 , wherein the counter is a hardware counter in a register of the hardware switch unit.

4. The method as recited in claim 1 , wherein the hardware filter includes a Ternary Content Addressable Memory in which a mask for the setpoint value is stored, the actual value being compared in the comparison with the mask stored in the Ternary Content Addressable Memory.

5. The method as recited in claim 1 , wherein the setpoint value characterizes a hardware address from a memory of the hardware switch unit, the actual value being determined at the input or the output as a function of data from a hardware address field of the data packet.

6. The method as recited in claim 1 , wherein the setpoint value characterizes a Medium Access Control address from a memory of the hardware switch unit, the actual value being determined at the input or the output as a function of data from a Medium Access Control address field of the data packet.

7. The method as recited in claim 1 , wherein the setpoint value characterizes a Virtual Local Area Network, the setpoint value being determined from a memory of the hardware switch unit, the actual value being determined as a function of data, which characterize an association of the data packet at the input or the output, with a Virtual Local Area Network.

8. The method as recited in claim 1 , wherein presence of a deviation is detected in the result, either when the hardware filter at the input or the output for a tagged Virtual Logical Area Network establishes an untagged Virtual Logical Area Network data packet, or when the hardware filter at the input or the output for an untagged Virtual Logical Area Network establishes a tagged Virtual Logical Area Network Data Packet.

9. The method as recited in claim 1 , wherein presence of a deviation is detected in the result when the hardware filter establishes the data packet at the input or the output has an unknown Ethertype, or a false checksum, or a false packet length, or a false packet structure.

10. The method as recited in claim 1 , wherein presence of a deviation is detected in the result, when:
(i) a Dynamic Host Configuration Protocol filter at the input or the output establishes a Dynamic Host Configuration Protocol packet for Internet Protocol Version 4 and/or for Internet Protocol Version 6 including Dynamic Host Configuration Protocol port 67 and/or port 68; or
(ii) a User Datagram Protocol filter at the input or the output establishes a User Datagram Protocol Broadcast message for Internet Protocol Version 4 and/or for Internet Protocol Version 6; or
(iii) a Precision Time Protocol filter at the input or the output establishes a Precision Time Protocol message, the content of which, including time stamp, sequence number, correction field, is stored at least temporarily in a register for context information.

11. The method as recited in claim 1 , further comprising:
analyzing a content of the data packet when a need is detected based on the value for the counter.

12. A device for detection of an intrusion by a data packet into an automotive computer network, comprising:
a system on a chip system, which includes a hardware switch unit including a hardware filter, and a computing device for the detection of the intrusion of the data packet into the automotive computer network, wherein the system on a system chip system is configured to:
receive the data packet at an input of the hardware switch unit;
analyze the data packet by the hardware switch for the detection of the intrusion by the data packet into the automotive computer network, the automotive computer network being internal to a vehicle, the system being configured to, for the analyzing:
compare, by the hardware filter, an actual value from a field of the data packet with a setpoint value for values from the field, the field including data link layer data or network layer data, and
determine, by the hardware switch unit, a value for a counter as a function of a result of the comparison, wherein the determination of the value for the counter includes incrementing a counter value of the counter based on a deviation between the actual value and the setpoint value being present; and
determine, by the computing device, a result of the intrusion detection of the intrusion by the data packet into the automotive computer network, the computing device being configured to determine the result of the detection as a function of the value of the counter in the hardware switch unit and independently of information from the data packet, without an evaluation of information from the data packet.

13. The device as recited in claim 12 , wherein the computing device is microprocessor or microcontroller.

14. The device as recited in claim 12 , wherein the device includes a counting unit, which is configured to increment the value of the counter when a deviation between the actual value and the setpoint value is present or exceeds a threshold value.

15. The device as recited in claim 12 , wherein the counter is a hardware counter in a register of the device.

16. The device as recited in claim 12 , wherein a Ternary Content Addressable Memory, and/or an Address Translation Unit, and/or a Virtual Local Area Network Translation Unit, and/or a Dynamic Host Configuration Protocol filter, and/or a User Datagram Protocol filter and/or a Precision Time Protocol filter, is provided as the hardware filter to analyze the data packet for the detection of the intrusion by the packet into the automotive computer network and to determine the result for the determination of the value of the counter.

17. A non-transitory computer-readable memory medium on which is stored a computer program for detection of an intrusion by a data packet into an automotive computer network, the computer program, when executed by a computer, causing the computer to perform or control the following steps:
receiving the data packet at an input of a hardware switch unit, the hardware switch unit including a hardware filter;

Assignees

• Bosch Gmbh Robert

Inventors

• Weber Andreas
• Wolfinger Janin
• Gramm Jens
• Herrmann Michael
• Gottschlich Wolfram

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04L61/5014

  using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title