CN115333791A

CN115333791A - Cloud-based vehicle safety protection method and related equipment

Info

Publication number: CN115333791A
Application number: CN202210858583.6A
Authority: CN
Inventors: 汪涛; 李家平; 司华超; 张贵海; 武亭
Original assignee: Lantu Automobile Technology Co Ltd
Current assignee: Lantu Automobile Technology Co Ltd
Priority date: 2022-07-20
Filing date: 2022-07-20
Publication date: 2022-11-11

Abstract

The invention discloses a cloud-based vehicle safety protection method and related equipment, relates to the field of vehicle control, and mainly aims to solve the problems that a vehicle manufacturer cannot sense the safety trend of a vehicle in the operation process and face potential threats. The method comprises the following steps: a data acquisition system of a VSOC cloud platform acquires target vehicle data sent by an IDPS component of a target vehicle ECU in real time, wherein the target vehicle data comprises communication data of a target vehicle and file data of the target vehicle; the VSOC management system of the VSOC cloud platform determines a target strategy corresponding to the target vehicle data based on a preset third party database, wherein the preset third party database comprises: an internal vulnerability database and an external threat intelligence database. The method is used for the vehicle safety protection process based on the cloud.

Description

Cloud-based vehicle safety protection method and related equipment

Technical Field

The invention relates to the field of vehicle control, in particular to a vehicle safety protection method based on a cloud end and related equipment.

Background

With the introduction of the concept of the SOA into the design of automobile software, the vehicle function can be split into different service components according to the service-oriented design concept, a unique identity is distributed to each service, each service can complete the release of the service, other services can be subscribed and communicated with other services, and different services are combined according to the actual use scene to form a new service function so as to meet the service requirement. The flexible combination and communication among the services depend on a complex network architecture and service layering, flexible and easily-integrated open features and advantages are established, functional convenience is brought, and meanwhile, more attack surfaces are exposed to external potential malicious attackers.

The vehicle ECU is an electronic control unit, wherein the core functions of the IDPS components of the ECU are intrusion detection and response prevention, detection and defense against security threats of the entire vehicle. However, for the intelligent networked automobile based on the SOA architecture, a plurality of potential information security risks are faced, and for massive communication data, a host factory cannot sense the security trend of each vehicle in the operation process and the facing potential threats.

Disclosure of Invention

In view of the above problems, the present invention provides a cloud-based vehicle security protection method and related devices, and mainly aims to solve the problem that a vehicle manufacturer cannot perceive the security trend of a vehicle in the operation process and face the potential threat.

In order to solve at least one technical problem, in a first aspect, the present invention provides a cloud-based vehicle security protection method, including:

a data acquisition system of a VSOC cloud platform acquires target vehicle data sent by an IDPS component of a target vehicle ECU in real time, wherein the target vehicle data comprises communication data of a target vehicle and file data of the target vehicle;

the VSOC management system of the VSOC cloud platform determines a target policy corresponding to the target vehicle data based on a preset third-party database, wherein the preset third-party database includes: an internal vulnerability database and an external threat intelligence database.

Optionally, the acquiring, by the data acquisition system of the VSOC cloud platform, target vehicle data sent by an IDPS component of the target vehicle ECU in real time includes:

the data acquisition system of the VSOC cloud platform acquires target vehicle data in real time through a data center station of a host factory cloud platform, wherein the data center station is used for reporting the target vehicle data to the VSOC cloud platform and issuing the target strategy to an IDPS component of the target vehicle ECU.

Optionally, the method further includes:

and the data acquisition system of the VSOC cloud platform stores the target vehicle data into a detail data storage module and sends the target vehicle data to the data analysis system of the VSOC cloud platform.

Optionally, the determining, by the VSOC management system of the VSOC cloud platform, a target policy corresponding to the target vehicle data based on a preset third-party database includes:

the data analysis system determines an analysis result of the target vehicle data and a target vehicle safety state corresponding to the analysis result from the preset third-party database based on the target vehicle data;

and the data analysis system stores the analysis result of the target vehicle data and the target vehicle safety state corresponding to the analysis result to a statistical data storage module and sends the statistical data storage module to the VSOC management system.

determining, by the VSOC management system controlling the VSOC cloud platform, a target policy corresponding to an analysis result of the target vehicle data from the preset third-party database based on an analysis result of the target vehicle data when the security status of the target vehicle is not secure;

and the VSOC management system of the VSOC cloud platform issues the target strategy to the IDPS component of the target vehicle ECU through a data center station.

Optionally, the method further includes:

and controlling a digital billboard system of the VSOC cloud platform to acquire all data information in the statistical data storage module and the VSOC management system, so that the digital billboard system can display and query data information and safety states of all vehicles related to the VSOC cloud platform.

Optionally, the method further includes:

the VSOC management system of the VSOC cloud platform acquires the vehicle identification code and the basic information of the target vehicle, which are sent by the vehicle management platform of the host factory cloud platform;

the VSOC management system may determine a statistical result based on the vehicle identification codes of all vehicles, the basic information, and the target vehicle data.

In a second aspect, an embodiment of the present invention further provides a cloud-based vehicle safety protection device, including:

the system comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring target vehicle data sent by an IDPS component of a target vehicle ECU (electronic control unit) in real time by a data acquisition system of a VSOC (vehicle on vehicle) cloud platform, and the target vehicle data comprises communication data of a target vehicle and file data of the target vehicle;

a determining unit, configured to determine, by the VSOC management system of the VSOC cloud platform, a target policy corresponding to the target vehicle data based on a preset third-party database, where the preset third-party database includes: an internal vulnerability database and an external threat intelligence database.

In order to achieve the above object, according to a third aspect of the present invention, there is provided a computer-readable storage medium including a stored program, wherein the steps of the cloud-based vehicle security protection method are implemented when the program is executed by a processor.

In order to achieve the above object, according to a fourth aspect of the present invention, there is provided an electronic device comprising at least one processor, and at least one memory connected to the processor; the processor is used for calling the program instructions in the memory and executing the steps of the cloud-based vehicle safety protection method.

By means of the technical scheme, the cloud-based vehicle safety protection method and the related equipment provided by the invention have the advantages that for the problem that a vehicle manufacturer cannot perceive the safety trend of a vehicle in the running process and the potential threat, the data acquisition system of the VSOC cloud platform is used for acquiring target vehicle data sent by an IDPS component of an ECU (electronic control unit) of the target vehicle in real time, wherein the target vehicle data comprises communication data of the target vehicle and file data of the target vehicle; the VSOC management system of the VSOC cloud platform determines a target policy corresponding to the target vehicle data based on a preset third party database, wherein the preset third party database includes: an internal vulnerability database and an external threat intelligence database. In the scheme, the communication data and the file data of the vehicle are obtained in real time, the communication data and the file data of the vehicle are analyzed, if data security problems occur, corresponding strategies are determined for the vehicle based on the support of a huge database, and the information security of the vehicle is ensured.

Accordingly, the cloud-based vehicle safety protection device, the cloud-based vehicle safety protection equipment and the computer-readable storage medium provided by the embodiment of the invention also have the technical effects.

The above description is only an overview of the technical solutions of the present invention, and the present invention can be implemented in accordance with the content of the description so as to make the technical means of the present invention more clearly understood, and the above and other objects, features, and advantages of the present invention will be more clearly understood.

Drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:

fig. 1 is a schematic flowchart illustrating a cloud-based vehicle security protection method according to an embodiment of the present invention;

fig. 2 is a diagram illustrating an organization architecture among a vehicle-end device, a mainframe factory cloud platform, and a VSOC cloud platform according to an embodiment of the present invention;

FIG. 3 is a diagram illustrating a display effect of a large-screen display front end according to an embodiment of the present invention;

fig. 4 is a block diagram illustrating a cloud-based vehicle safety device according to an embodiment of the present invention;

fig. 5 is a block diagram schematically illustrating a cloud-based vehicle safety protection electronic device according to an embodiment of the present invention.

Detailed Description

Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

Illustratively, with the development of SOA related standards and technologies and the rapid emergence and iteration of domestic and foreign intelligent networking automobile technologies, the traditional signal-based architecture cannot meet the requirements of numerous domestic and foreign manufacturers, more and more automobile enterprises begin to adopt SOA related technologies and products to build applications in various aspects of enterprises, and the SOA gradually appears in the public visual field and is promoted to popularization and application of real products from concept propaganda. The SOA is introduced into the design of the automobile software, the vehicle function can be split into different service components according to a service-oriented design concept, a unique identity is distributed to each service component, each service component can complete the release of the service component, other service components can be subscribed and communicated with other service components, and different service components are combined according to actual use scenes to form a new service function so as to meet the service requirement. The flexible combination and communication among the service components are based on a complex network architecture and service layering, open features and advantages which are flexible and easy to integrate are established, functional convenience is brought, and meanwhile, more attack surfaces are exposed to external potential malicious attackers. How to call the service components for identity authentication and authorization and how to protect the complex data interface API are key problems which need to be considered urgently at present. Aiming at the problems that an intelligent internet automobile based on an SOA framework faces a plurality of potential information Security risks and a host factory or a Vehicle factory cannot sense the Security trend of each Vehicle in the Operation process and the facing potential threats, the scheme is characterized in that Vehicle end IDPS (Intrusion Detection and Prevention System) components (including HIDS, NIDS and the like) and a VSOC (Vehicle Security Operation Center) are deployed, real-time communication data of all associated vehicles are monitored, the interaction behavior of key data is concerned according to a service scene and actual requirements, and the information attack behaviors are comprehensively researched and judged in combination with preset rules of the Vehicle end, cloud data behavior analysis and threat information judgment, so that the technical scheme from Vehicle end data acquisition to cloud whole Vehicle level Security posture presentation is realized.

In order to solve the problem that a car manufacturer cannot perceive the safety trend of a vehicle in the running process and the potential threats to the vehicle, the embodiment of the invention provides a cloud-based vehicle safety protection method, as shown in fig. 1, the method comprises the following steps:

s101, a data acquisition system of a VSOC cloud platform acquires target vehicle data sent by an IDPS component of a target vehicle ECU in real time, wherein the target vehicle data comprises communication data of a target vehicle and file data of the target vehicle;

illustratively, the vehicle-end IDPS component is mainly deployed in a vehicle-end ECU, and is used for monitoring network communication data and important files in real time, and is integrally divided into two types, namely HIDS (host intrusion detection) and NIDS (network intrusion detection), wherein the network intrusion detection system realizes functions of acquisition, analysis, anomaly detection, traffic statistics, anomaly reporting and the like of network data packets; the host intrusion detection system realizes the functions of host data acquisition, data analysis, exception reporting and the like. The vehicle end IDPS component monitors and intercepts vehicle end real-time communication data and file data, and performs data monitoring and data reporting (reporting to a data acquisition system of a cloud VSOC cloud platform) according to preset protection rules.

S102, the VSOC management system of the VSOC cloud platform determines a target strategy corresponding to the target vehicle data based on a preset third-party database, wherein the preset third-party database comprises: an internal vulnerability database and an external threat intelligence database.

Illustratively, the VSOC cloud platform analyzes and judges data behaviors through a data acquisition system, a VSOC management system and the like, focuses on key data interaction behaviors according to service scenes and actual requirements, comprehensively judges attack behaviors in multiple angles by combining preset protection rules, an internal vulnerability database and an external threat information database, and determines a target strategy corresponding to a vehicle, so that the technical effect of displaying the safety situation of the cloud whole vehicle from vehicle-side data acquisition is realized.

For example, due to the special structure of the vehicle end and the bottleneck of the ECU performance, and the like, in combination with the actual situation of the current network structure, the IDPS components are deployed in the controllers such as the gateway and the key ECU to collect and monitor data, the vehicle end only performs data collection and monitoring engine processing, and transfers the data analysis work to the cloud centralized processing, so that the whole vehicle has the capabilities of intrusion detection and defense and the capability of managing and controlling the security situation of the vehicle.

Illustratively, after target vehicle data are uploaded, the VSOC management system of the VSOC cloud platform carries out comprehensive analysis, combines databases such as an internal vulnerability database and an external threat information database, monitors the running environment of the vehicle in real time through technologies such as feature analysis and artificial intelligence, and can accurately position unknown attack information. Because the VSOC cloud platform acquires the data information of all the associated vehicles, the method can realize the presentation of the overall safety situation of the running states of all the vehicles in a vehicle factory.

For example, the internal vulnerability database is generally a third-party authority platform (such as a national vulnerability database) or a self-built vulnerability database (for example, vulnerability data published by platforms such as CVE, CNNVD, CNVD and the like are imported), and vulnerability influence product range and attack characteristics (such as version number, name, payload and the like) are extracted through synchronization of vulnerability information, so that potential safety risks of vehicles are monitored. The external threat information library takes threat information data as a core, and can accurately find a controlled host in a network by utilizing characteristic analysis and artificial intelligence technology; whether the attack is successful or not is automatically judged, and manual intervention is reduced; automatically identifying the purposeful attack and knowing the attack intention of the hacker; meanwhile, the VSOC management system combined with the VSOC cloud platform and the local strategy of the vehicle are linked to perform defense, so that the vehicle security system can be changed from passive defense to information-driven continuous detection and response direction, the identification accuracy of the aggressive behavior can be improved, and the accurate positioning or the prevention of the unknown or the aggressive behavior with strong concealment can be achieved.

By means of the technical scheme, the cloud-based vehicle safety protection method provided by the invention has the advantages that for the problem that a vehicle manufacturer cannot sense the safety trend of a vehicle in the operation process and the potential threat, the target vehicle data sent by an IDPS component of an ECU (electronic control unit) of a target vehicle is obtained in real time through a data acquisition system of a VSOC (vehicle stability component) cloud platform, wherein the target vehicle data comprises the communication data of the target vehicle and the file data of the target vehicle; the VSOC management system of the VSOC cloud platform determines a target policy corresponding to the target vehicle data based on a preset third party database, wherein the preset third party database includes: an internal vulnerability database and an external threat intelligence database. In the scheme, the communication data and the file data of the vehicle are obtained in real time, the communication data and the file data of the vehicle are analyzed, if data security problems occur, corresponding strategies can be determined for the vehicle based on huge database support, the information security of the vehicle is ensured, and on a macroscopic level, the VSOC cloud platform obtains the vehicle data of all vehicles related to the VSOC cloud platform in real time, and the information security tendency and the potential information security threat possibly faced by the vehicle in the running process are predicted and determined by analyzing and counting the vehicle data of all vehicles.

In one embodiment, the acquiring, by the data acquisition system of the VSOC cloud platform, target vehicle data sent by an IDPS component of the target vehicle ECU in real time includes:

Illustratively, the host plant cloud platform includes a data center, which is generally an information system for performing data communication interaction on vehicles directly by a host plant or a vehicle plant, and is responsible for synchronizing vehicle service data (e.g., operating condition data, etc.) between operating vehicles and a host plant private cloud, such as: the vehicle-mounted intelligent control system comprises a vehicle-side forwarding component, a data acquisition system, a vehicle-side forwarding platform, a vehicle-side data transmission platform, a data transmission system and a data transmission system, wherein the vehicle-side forwarding component forwards reported data of the vehicle-side forwarding component, the data transmission system forwards data issued by a cloud end, and the like, so that target vehicle data sent by an IDPS component of a target vehicle ECU need to pass through the data transmission platform of the host factory cloud platform and then are sent to the data acquisition system of the VSOC cloud platform, a transfer station of a third party is arranged between the vehicle and the VSOC cloud platform, direct interaction between the vehicle and the VSOC cloud platform is prevented, and the safety of information transmission can be ensured.

In one embodiment, the method further comprises:

Illustratively, the data acquisition system of the VSOC cloud platform is mainly responsible for collecting data forwarded by a data center, verifying the validity, validity and integrity of the data, analyzing and identifying the data (data decryption, data header analysis, data classification, and the like), classifying and storing the data to be processed, and meanwhile, sending the data to the data analysis system of the VSOC cloud platform.

In an embodiment, the determining, by the VSOC management system of the VSOC cloud platform, a target policy corresponding to the target vehicle data based on a preset third party database includes:

Illustratively, the data analysis system is responsible for processing data sent by the data acquisition system, the data form a message queue, and specific contents may include data format, detail data record, data aggregation, data classification statistics, vehicle equipment version vulnerability detection, alarm, emergency response data analysis, and the like. The data analysis system can comprehensively judge the data reported by the vehicle end according to the preset protection rules by combining the internal vulnerability database and the external threat information database to determine whether the data is an attack behavior, and the data analysis system can support transverse expansion according to the actual scene and the data volume of the service.

Illustratively, the data analysis system of the VSOC cloud platform is mainly configured to analyze the target vehicle data to determine the security state of the target vehicle, so that the data analysis system determines the analysis result and the security state of the target vehicle corresponding to the analysis result based on the target vehicle data (i.e., whether the vehicle is attacked or not and whether the vehicle is secure or not), stores the analysis result and the security state in the statistical data storage module to continuously expand the database supporting the solution, and sends the analysis result and the security state to the VSOC management system to perform the next determination.

Illustratively, the VSOC management system has the functions of policy management, vulnerability management, vehicle information management, alarm management, emergency response management, work order management, user information management, system management, log audit and the like. Meanwhile, the docking of the stations in the data and the docking and importing of authority vulnerability databases such as CVE, CNNVD and CNVD and threat information databases are supported.

For example, if it is determined that the safety state of the target vehicle is unsafe, the target policy corresponding to the analysis result of the target vehicle data is determined based on the analysis result of the target vehicle data and the preset third-party database, and is issued to the IDPS component of the vehicle ECU, so that the information safety of the vehicle can be determined based on a huge database and an analysis system.

In one embodiment, the method further comprises:

For example, the digital billboard system can provide data statistics APIs (such as vehicle real-time information query, vehicle statistics data query, alarm information query and other statistics data query, notification push and the like) required by large-screen security situation display for users of enterprises and vehicle factories, collects vehicle-end alarm information, displays vehicle security states of different areas in a regional range by combining a map, and clearly and definitely reflects all and vehicle security situation trends under a VSOC cloud platform by supporting the vehicle security situations of time TOP10 display, key event early warning and the like on a large-screen display module.

In one embodiment, the method further comprises:

For example, the IDPS component of the ECU of the target vehicle may send the vehicle identification code of the target vehicle while sending the data of the target vehicle, and the vehicle management platform of the factory cloud platform of the host computer may also carry the vehicle identification code when sending the basic information to the VSOC management system of the VSOC cloud platform, so that when the data flow of the target vehicle is transferred to the VSOC management system, the VSOC management system may combine and match the basic information sent by the vehicle management platform and the data of the target vehicle sent by the console in the data based on the vehicle identification code, and perform comprehensive determination, thereby providing a more precise and accurate statistical result for the digital billboard system.

Further, the method shown in fig. 2 provides an organizational structure diagram among the vehicle-end device, the mainframe factory cloud platform, and the VSOC cloud platform. As shown in fig. 2, an IDPS component of an ECU of a vehicle-end device transmits target vehicle data (including a vehicle identification code) to a data center of a cloud platform of a host factory, the data center transmits the target vehicle data to a data acquisition system of a VSOC cloud platform through data reporting, the data acquisition system stores the target vehicle data in a detail data storage module for a data analysis system to acquire and analyze, the data analysis system stores a statistical analysis result in a statistical data storage module and sends a corresponding alarm notification to the VSOC management system when the statistical analysis result shows that the data is unsafe, the VSOC management system may acquire an analysis result based on the alarm notification or real-time query, further analyze the analysis result based on an internal vulnerability database and an external threat information database to determine a corresponding target policy, and after determining the target policy, transmit the analysis result to the data center of the cloud platform of the host factory, and the data center transmits the corresponding target policy back to the target vehicle. The digital billboard system is connected with the statistical data storage module and the VSOC management system, information stored in the digital billboard system can be called in real time and displayed at the front end of a large-screen display (the display effect is shown in fig. 3), meanwhile, the vehicle management platform of the host factory cloud platform can also directly provide information (including a vehicle identification code) of vehicles, parts and the like for the VSOC management system, the VSOC management system can combine the information transmitted by the vehicle management platform and the middle station based on the vehicle identification code to determine the vehicles to which the information sent by the vehicle management platform and the middle station belongs, and the VSOC authentication provides an authentication function and a login entrance of a VSOC cloud platform framework.

Illustratively, the VSOC management system has a function of synchronizing basic information of a model, a device, a role, a user, and the like of a target vehicle. The XML format file import function of the cave libraries such as CVE, CNNVD, CNVD and the like can be provided, the information of the bugs in the files is analyzed, put in storage and scanned, meanwhile, a third-party database can be connected in an online API mode, and analysis, storage and scanning are carried out according to the details of the bugs.

Illustratively, the VSOC cloud platform includes a data acquisition system, a detailed data storage module, a data analysis system, a VSOC management system, and the like, wherein all the systems and modules support dynamic horizontal capacity expansion, and can be uniformly hosted and maintained by a service registry. The external access part can be provided with reverse proxy or load balance to realize the functions of speed limit, load, filtering, safety authentication and the like of the inlet flow, the main basic service can adopt a cluster deployment mode and can also adopt a docker containerization deployment mode, and the effects of convenient and quick transplantation and deployment can be realized.

Illustratively, an access gateway in the VSOC cloud platform architecture is responsible for establishing a secure channel for access of a data center station, a digital signage system and a management end user, and the access gateway has functions of ingress flow control, upstream service load, session authentication, secure channel (docking PKI), and the like.

Illustratively, the VSOC authentication module provides an authentication function and a login entry of a VSOC cloud platform architecture, and serves as an authentication entry of the VSOC management system to be responsible for realizing identity authentication and identification of a login VSOC user.

Exemplarily, an IDPS component deployed in a vehicle-side ECU uploads data (a traffic analysis log, a system analysis log, and a security event record log) collected or generated by a vehicle side to a data center station, the data center station forwards the data, a data format reported by the IDPS component includes a data header and a data body, wherein the data header includes information such as a start-stop position of the data body, a check code, a data type version, a data timestamp, a data level, and an equipment ID, and after receiving the data, a data acquisition system needs to check the integrity of the data and classify and reassemble the data according to an analysis result of the data header; and storing the classification structure data into a corresponding detail data table, namely a detail data storage module.

Taking flow data as an example, the flow data is dispersedly stored in the detail data storage module, the data analysis system can count the flow data stored by all the acquisition servers within 24 hours of the previous day at 1 point every day, the counted dimensions include equipment types, flow data sources, flow data targets and the like, and the data counting result can be stored in the statistical data storage module. And if the statistical result of the data analysis system reaches the alarm configuration threshold value, carrying out alarm flow processing. Before generating new alarm information, it will inquire whether there is the same alarm information that is not processed according to the alarm event characteristics. If not, generating a new alarm; if the alarm information is already in existence but is not processed, only the alarm information is updated.

Taking the system log as an example, the system log is dispersedly stored in the detail data storage module, and the data analysis system will count the system logs of all the detail data storage units within 24 hours of the previous day at 1 point every day. The dimensions of the statistics include device type, question type, number of questions, etc. The statistical result is stored in the statistical data storage unit. The system log statistics will check if there is a device or software version update to report. If the new version exists, vulnerability scanning is triggered; if the version is not used any more, the scanning result corresponding to the version is deleted, and if the statistical result of the data analysis system reaches the threshold value of the alarm configuration, the alarm flow process is carried out. Before generating new alarm information, it will inquire whether there is the same alarm information that is not processed according to the alarm event characteristics.

Taking the network security logs as an example, the network security logs are dispersedly stored in the detail data storage module, and the data analysis system counts the network security logs stored in the detail data storage module every 30 s. The dimensions of the statistics include device type, question type, number of questions, etc. The data statistics result is stored in the statistics data storage module. And if the statistical result of the data analysis system reaches the alarm configuration threshold value, carrying out alarm flow processing. Before generating new alarm information, it will inquire whether there is the same alarm information that is not processed according to the alarm event characteristics. If not, generating a new alarm; if the alarm information is already processed, only the alarm information is updated.

Illustratively, the VSOC management system synchronizes vehicle-related information from the vehicle management platform, such as: vehicle information (such as part information, vin code, vehicle type, etc.), equipment information, role information, user information, vehicle position information; the vehicle information uploaded by the vehicle end IDPS component corresponds to the vehicle information through a vehicle identification code (frame number) or an ECU SN code (ECU equipment serial number), and then the vehicle information is bound and put in storage through a vin code and the like to form complete vehicle information which is stored in a statistical data storage module so as to be convenient for other modules to call. The VSOC management system has an acquisition strategy and an alarm strategy, and the main content of the acquisition strategy is maintenance of information such as strategy details, vehicle types, equipment and the like and the relation of the information; meanwhile, strategy information can be issued to corresponding vehicles through API parameters provided by a data center, and the alarm strategy mainly comprises a system log alarm, a security event alarm, a flow data alarm, a vulnerability alarm and the like. The main contents are the levels of system log alarm, security event alarm, vulnerability alarm trigger, and the threshold configuration of flow alarm trigger. And issuing and managing the strategy according to the user requirement and the actual situation. Meanwhile, the VSOC management system supports the connection of a vulnerability database and a threat information database, and can perform early warning, scanning and the like by combining multi-party information or information during warning and vulnerability scanning through synchronizing external resource information.

Illustratively, the digital billboard system provides data statistics API parameters and related display interfaces required by a large-screen display front end, and mainly comprises parts such as vehicle real-time information pulling, vehicle statistics information pulling, alarm information displaying and the like; the vehicle real-time information is pulled by an interface provided by a digital billboard system, and the interior of the interface can transmit a real-time data part request to a vehicle management platform to acquire the latest information; and when the real-time information acquisition fails, the latest information content cached locally is returned. The vehicle statistical information is pulled by an interface provided by a digital billboard system, statistical result information stored in a database can be preferentially inquired in the interface, and when the statistical information cannot meet the display requirement under extreme conditions, a request can be sent to a data analysis system to perform real-time data statistics and return data.

Further, as an implementation of the method shown in fig. 1, an embodiment of the present invention further provides a vehicle safety protection device based on a cloud, which is used for implementing the method shown in fig. 1. The embodiment of the apparatus corresponds to the embodiment of the method, and for convenience of reading, details in the embodiment of the apparatus are not repeated one by one, but it should be clear that the apparatus in the embodiment can correspondingly implement all the contents in the embodiment of the method. As shown in fig. 4, the apparatus includes: an acquisition unit 21 and a determination unit 22, wherein

The acquiring unit 21 is used for acquiring target vehicle data sent by an IDPS component of a target vehicle ECU in real time by a data acquisition system of the VSOC cloud platform, wherein the target vehicle data includes communication data of a target vehicle and file data of the target vehicle;

a determining unit 22, configured to determine, by the VSOC management system of the VSOC cloud platform, a target policy corresponding to the target vehicle data based on a preset third-party database, where the preset third-party database includes: an internal vulnerability database and an external threat intelligence database.

Illustratively, the data acquisition system of the VSOC cloud platform acquires, in real time, target vehicle data sent by an IDPS component of a target vehicle ECU, and includes:

Exemplarily, the above unit is further configured to:

For example, the determining, by the VSOC management system of the VSOC cloud platform, a target policy corresponding to the target vehicle data based on a preset third-party database includes:

and the data analysis system stores the analysis result of the target vehicle data and the target vehicle safety state corresponding to the analysis result into a statistical data storage module and sends the statistical data storage module to the VSOC management system.

Exemplarily, the above unit is further configured to:

Exemplarily, the unit is further configured to:

By means of the technical scheme, the cloud-based vehicle safety protection device provided by the invention has the advantages that for the problem that a vehicle manufacturer cannot perceive the safety trend of a vehicle in the running process and the potential threat, the data acquisition system of the VSOC cloud platform is used for acquiring target vehicle data sent by an IDPS component of an ECU (electronic control unit) of a target vehicle in real time, wherein the target vehicle data comprises communication data of the target vehicle and file data of the target vehicle; the VSOC management system of the VSOC cloud platform determines a target policy corresponding to the target vehicle data based on a preset third party database, wherein the preset third party database includes: an internal vulnerability database and an external threat intelligence database. In the scheme, the communication data and the file data of the vehicle are acquired in real time and are analyzed, and if the data safety problem occurs, the corresponding strategy can be determined for the vehicle based on huge database support, so that the information safety of the vehicle is ensured. On a macroscopic level, the VSOC cloud platform acquires vehicle data of all vehicles related to the VSOC cloud platform in real time, analyzes and statistically predicts the vehicle data of all vehicles, and determines information security trends and potential information security threats possibly faced by the vehicles in the running process.

The processor comprises a kernel, and the kernel calls the corresponding program unit from the memory. The kernel can be set to be one or more than one, the vehicle safety protection method based on the cloud is realized by adjusting kernel parameters, and the problems that a vehicle manufacturer cannot perceive the safety trend of the vehicle in the operation process and the potential threat can be solved.

The embodiment of the invention provides a computer-readable storage medium, which comprises a stored program, wherein the program is executed by a processor to realize the vehicle safety protection method based on the cloud.

The embodiment of the invention provides a processor, which is used for running a program, wherein the vehicle safety protection method based on a cloud end is executed when the program runs.

The embodiment of the invention provides electronic equipment, which comprises at least one processor and at least one memory connected with the processor; the processor is used for calling the program instructions in the memory and executing the cloud-based vehicle safety protection method

An embodiment of the present invention provides an electronic device 30, as shown in fig. 5, the electronic device includes at least one processor 301, at least one memory 302 connected to the processor, and a bus 303; wherein, the processor 301 and the memory 302 complete the communication with each other through the bus 303; the processor 301 is configured to call the program instructions in the memory to execute the cloud-based vehicle security method.

The intelligent electronic device herein may be a PC, PAD, mobile phone, etc.

The present application further provides a computer program product adapted to perform a program for initializing the following method steps when executed on a flow management electronic device:

a data acquisition system of the VSOC cloud platform acquires target vehicle data sent by an IDPS component of a target vehicle ECU in real time, wherein the target vehicle data comprises communication data of a target vehicle and file data of the target vehicle;

the VSOC management system of the VSOC cloud platform determines a target policy corresponding to the target vehicle data based on a preset third party database, wherein the preset third party database includes: an internal vulnerability database and an external threat intelligence database.

Further, the step of acquiring, by the data acquisition system of the VSOC cloud platform, target vehicle data sent by an IDPS component of the target vehicle ECU in real time includes:

Further, the method further comprises:

Further, the VSOC management system of the VSOC cloud platform determines a target policy corresponding to the target vehicle data based on a preset third-party database, and includes:

determining, by a VSOC management system controlling the VSOC cloud platform, a target policy corresponding to an analysis result of the target vehicle data from the preset third-party database based on the analysis result of the target vehicle data, when the security status of the target vehicle is not secure;

Further, the method further comprises:

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, electronic devices (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable flow management electronic device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable flow management electronic device, create means for implementing the functions specified in the flow diagram flow or flows and/or block diagram block or blocks.

In a typical configuration, an electronic device includes one or more processors (CPUs), memory, and a bus. The electronic device may also include input/output interfaces, network interfaces, and the like.

The memory may include volatile memory in a computer readable medium, random Access Memory (RAM) and/or nonvolatile memory such as Read Only Memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip. The memory is an example of a computer-readable medium.

Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer-readable storage media include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage electronic devices, or any other non-transmission medium that can be used to store information that can be accessed by computing electronic devices. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or electronic device that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or electronic device. Without further limitation, an element defined by the phrase "comprising a … …" does not exclude the presence of another identical element in a process, method, article, or electronic device that comprises the element.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The above are merely examples of the present application and are not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A cloud-based vehicle safety protection method is used for a VSOC cloud platform and is characterized by comprising the following steps:

the VSOC management system of the VSOC cloud platform determines a target strategy corresponding to the target vehicle data based on a preset third party database, wherein the preset third party database comprises: an internal vulnerability database and an external threat intelligence database.

2. The method of claim 1, wherein the step of acquiring, by the data acquisition system of the VSOC cloud platform, the target vehicle data sent by the IDPS component of the target vehicle ECU in real time comprises:

the data acquisition system of the VSOC cloud platform acquires target vehicle data in real time through a data center station of a host factory cloud platform, wherein the data center station is used for reporting the target vehicle data to the VSOC cloud platform and issuing the target strategy to an IDPS component of an ECU (electronic control unit) of the target vehicle.

3. The method of claim 1, further comprising:

4. The method of claim 3, wherein the VSOC management system of the VSOC cloud platform determines a target policy corresponding to the target vehicle data based on a preset third party database, comprising:

and the data analysis system stores the analysis result of the target vehicle data and the safety state of the target vehicle corresponding to the analysis result to a statistical data storage module and sends the statistical data storage module to the VSOC management system.

5. The method of claim 4, wherein the VSOC management system of the VSOC cloud platform determines a target policy corresponding to the target vehicle data based on a preset third party database, comprising:

under the condition that the safety state of the target vehicle is unsafe, controlling a VSOC management system of the VSOC cloud platform to determine a target strategy corresponding to the analysis result of the target vehicle data from the preset third-party database based on the analysis result of the target vehicle data;

and the VSOC management system of the VSOC cloud platform issues the target strategy to an IDPS component of the target vehicle ECU through a data center station.

6. The method of claim 5, further comprising:

and controlling a digital billboard system of the VSOC cloud platform to acquire all data information in the statistical data storage module and the VSOC management system, so that the digital billboard system can display and inquire all data information and safety states of vehicles related to the VSOC cloud platform.

7. The method of claim 2, further comprising:

the VSOC management system may determine a statistical result based on the vehicle identification codes, the base information, and the target vehicle data of all vehicles.

8. A vehicle safety protection device based on cloud is characterized in that,

9. A computer-readable storage medium comprising a stored program, wherein the program when executed by a processor implements the steps of the cloud-based vehicle security method of any of claims 1-7.

10. An electronic device, comprising at least one processor, and at least one memory coupled to the processor; wherein the processor is configured to invoke program instructions in the memory to perform the steps of the cloud-based vehicle security method of any of claims 1 to 7.