Scribd Logo
Upload

Welcome to Scribd!

  • A Secure Ipv6-Based Architecture For Internal Automotive Networks

    Uploaded by

    Dragos Valentin Stefan
    11 views7 pages
    This document discusses a secure IPv6-based architecture for internal automotive networks. It proposes using IP as a homogeneous solution across an Ethernet backbone to interconnect up to 70 electronic control units. The architecture defines three security zones (high, comfort, and environmental) to isolate safety-critical functions. Unique local addresses are assigned to each control unit based on a vehicle identification number and manufacturer key to allow unique addressing while avoiding internet routing. Security gateways control communication between zones according to security policies. The proposed architecture aims to provide a standardized IP solution for automotive internal networks while integrating security and supporting inter-vehicle communication for services like vehicle diagnostics.

    Original Description:

    IPV6

    Original Title

    2012-03-26-seis-kit-ietf83-its

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document discusses a secure IPv6-based architecture for internal automotive networks. It proposes using IP as a homogeneous solution across an Ethernet backbone to interconnect up to 70 electronic control units. The architecture defines three security zones (high, comfort, and environmental) to isolate safety-critical functions. Unique local addresses are assigned to each control unit based on a vehicle identification number and manufacturer key to allow unique addressing while avoiding internet routing. Security gateways control communication between zones according to security policies. The proposed architecture aims to provide a standardized IP solution for automotive internal networks while integrating security and supporting inter-vehicle communication for services like vehicle diagnostics.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    11 views7 pages

    A Secure Ipv6-Based Architecture For Internal Automotive Networks

    Uploaded by

    Dragos Valentin Stefan
    This document discusses a secure IPv6-based architecture for internal automotive networks. It proposes using IP as a homogeneous solution across an Ethernet backbone to interconnect up to 70 electronic control units. The architecture defines three security zones (high, comfort, and environmental) to isolate safety-critical functions. Unique local addresses are assigned to each control unit based on a vehicle identification number and manufacturer key to allow unique addressing while avoiding internet routing. Security gateways control communication between zones according to security policies. The proposed architecture aims to provide a standardized IP solution for automotive internal networks while integrating security and supporting inter-vehicle communication for services like vehicle diagnostics.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 7

    A Secure IPv6-based Architecture for

    Internal Automotive Networks


    Roland Bless
    Institute of Telematics
    Karlsruhe Institute of Technology (KIT)
    Joint work with members of the SEIS Project

    Seite 1

    Focus of the Project


    Modern vehicles contain up to 70+ electronic
    control units (ECUs)
    various automotive bus solution exist
    need complex gateway for interworking

    Use IP as homogeneous solution for the internal


    communications
    Mainly on top of a switched Ethernet

    Integrate security
    Identified three security zones (high, comfort,
    environment)
    high security zone contains safety relevant functions
    No direct access from environment to high security
    zone

    Vendors: Daimler, BMW, VW, Audi, Bosch, EADS,


    Continental, Infineon,
    R. Bless IETF83 ITS informal meeting

    Seite 2

    Architecture
    OBD
    WLAN
    USB CE
    LTE

    Security
    Gateway
    Ethernet/IP

    Router

    Ethernet/IP
    Switch

    Body & Cabin

    Infotainment &
    Cockpit

    Driver
    Assistance

    R. Bless IETF83 ITS informal meeting

    PSI5

    Ethernet/IP
    Switch

    Ethernet/IP

    LIN

    CAN

    LIN

    CAN

    Ethernet/IP

    Flexray

    Ethernet/IP

    Internet

    Engine & Power- Chassis


    train Manager & Safety

    Seite 3

    Addressing IP-Subnets
    IP subnet structure follows security zones
    QoS orthogonal

    Further structure according to functional domains


    Direct communication between devices with the same
    pair of (domain, security zone) possible
    Domain

    High Security

    HR

    HS

    HT

    HU

    Comfort

    CR

    CS

    CT

    CU

    Environmental

    ER

    ES

    ET

    EU

    Zone

    Net prefix

    Controlled domain- and zone traversal


    CRCS, HRCR
    Enforcement of security policies

    e.g. no route HE, explicit filtering rules


    Filtering by ECUs possible, too.

    R. Bless IETF83 ITS informal meeting

    Seite 4

    Use of IPv6 beneficial


    Solution requires several subnets and IP
    addresses per vehicle (some manufacturers
    produce more than 10M vehicles per year)
    Uniqueness (with high probability) of addresses
    may help in some situations
    BMW scheme embeds VIN7 into IPv6 prefix
    Patent application filed
    Privacy concerns?

    R. Bless IETF83 ITS informal meeting

    Seite 5

    IPv6 addressing internal networks


    Use of ULAs (Unique Local Addresses)
    [RFC 4193] for internal communications
    Prefix L
    7

    Global-ID

    40

    Subnet-ID

    Interface-ID

    16

    64

    Subnet matrix

    Bits

    per ECU i/f

    rightbits(SHA-2(VIN | OEM-specific-256bit Key), 40)

    Properties:
    Global unique with high probability, cannot be routed in
    the Internet
    Allows simple filtering according to prefix FC00::/7
    No special processing within applications
    Uniqueness simplifies communication to several
    vehicles, e.g., for diagnosis in garage
    R. Bless IETF83 ITS informal meeting

    Seite 6

    Questions
    Discussion of using ULAs?
    ULA-C useful?
    Must be prepared to handle conflicts nevertheless

    Security aspects, e.g., adapted IKE (no DH)


    BMW: Is there also interest in standardizing open
    middleware protocols?
    Service Oriented Middleware over IP
    (SOME/IP)

    R. Bless IETF83 ITS informal meeting

    Seite 7

    You might also like