System and method for detecting attack when sensor and traffic information are inconsistent

Patent metadata

Field	Value
Publication number	US-10397244-B2
Application number	US-201615210392-A
Country	US
Kind code	B2
Filing date	Jul 14, 2016
Priority date	Jul 30, 2015
Publication date	Aug 27, 2019
Grant date	Aug 27, 2019

Abstract

Disclosed is a system for detecting an attack, which includes a server and a plurality of vehicles capable of wirelessly communicating with each other. Each of the vehicles has a sensor, a sensor information acquisition unit, a traffic information reception unit, and a transmission unit that transmits the sensor information and the traffic information to the server. The server has a reception unit that receives the sensor information and the traffic information from the vehicles, a verification unit that verifies whether the sensor information and the traffic information are inconsistent with each other, and a notification unit that notifies, when the sensor information and the traffic information are inconsistent with each other, the vehicles of the inconsistency.

First claim

What is claimed is:

1. A system for detecting an attack, comprising a server and a plurality of vehicles capable of wirelessly communicating with each other,
each of the plurality of vehicles including:
a sensor; and
a vehicle processor configured to act as:
a sensor information acquisition interface adapted to acquire sensor information from the sensor; and
a traffic information reception interface adapted to receive traffic information through wireless communication, wherein the traffic information is information that describes a road condition around the vehicle and is sent from an outside of the vehicle,
wherein a cryptographic processor is configured to verify electronic signature data of the received traffic information and detect invalid traffic information using signature information notified from the server; and

a transmitter adapted to transmit the sensor information and the traffic information to the server, and
the server including:
a server processor configured to act as:
a specification controller to specify to at least any of the plurality of vehicles signature information indicating the characteristics of the invalid traffic information
a reception controller adapted to receive the sensor information and the traffic information from at least any of the plurality of vehicles;
a verification controller adapted to verify whether the sensor information and the traffic information are inconsistent with each other, the sensor information and the traffic information determined to be inconsistent with each other when the road condition indicated by the traffic information and a road condition derived from the sensor information do not match; and
a notification controller adapted to notify, when the sensor information and the traffic information are inconsistent with each other, at least any of the plurality of vehicles of the inconsistency between the sensor information and the traffic information.

2. The system according to claim 1 , wherein the notification controller is adapted to notify at least any of the plurality of vehicles of signature information indicating a characteristic of the traffic information inconsistent with the sensor information, and each of the plurality of vehicles has a storage unit adapted to store the signature information received from the server and does not rely on the traffic information consistent with the signature information notified from the notification controller.

3. The system according to claim 2 , wherein, when the traffic information includes an identifier of a transmitter of the traffic information, the identifier of the transmitter of the traffic information is used as the signature information on the traffic information.

4. The system according to claim 1 , wherein the traffic information includes a position of an object existing on a road, and the verification controller is adapted to determine the inconsistency between the sensor information and the traffic information when being able to estimate from the sensor information that the object does not exist at the position of the object indicated by the traffic information.

5. The system according to claim 4 , wherein the traffic information further includes at least any of a movement speed and a movement direction of the object, and the verification controller is adapted to determine the inconsistency between the sensor information and the traffic information when being able to estimate from the sensor information that one of a movement speed and a movement direction of the object existing at the position of the object indicated by the traffic information is inconsistent with one of the movement speed and the movement direction indicated by the traffic information.

6. An system for detecting an attack, comprising:
a processor configured to act as: a first acquisition controller adapted to acquire sensor information acquired from a sensor of a vehicle;
a second acquisition controller adapted to acquire traffic information received by the vehicle through wireless communication, wherein the traffic information is information that describes a road condition around the vehicle and is sent from an outside of the vehicle wherein a cryptographic processor is configured to verify electronic signature data of the received traffic information and detect invalid traffic information using signature information notified from the server;
and a verification controller adapted to verify whether the sensor information and the traffic information are inconsistent with each other, the sensor information and the traffic information determined to be inconsistent with each other when the road condition indicated by the traffic information and a road condition derived from the sensor information do not match and wherein the server specifies the vehicle signature information indicating the characteristics of the invalid traffic information.

7. A method for detecting an attack, executed by a system comprising a server and a plurality of vehicles capable of wirelessly communicating with each other, at least one of the plurality of vehicles being a target vehicle and performing:
a sensor information acquisition step of acquiring sensor information from a sensor wherein a cryptographic processor is configured to verify electronic signature data of the received traffic information and detect invalid traffic information using signature information notified from a server;
a traffic information reception step of receiving traffic information through wireless communication, wherein the traffic information is information that describes a road condition around the vehicle and is sent from an outside of the target vehicle;
and a transmission step of transmitting the sensor information and the traffic information to the server, and the server performing: a reception step of receiving the sensor information and the traffic information from the target vehicle;
a verification step of verifying whether the sensor information and the traffic information are inconsistent with each other,
the sensor information and the traffic information determined to be inconsistent with each other when the road condition indicated by the traffic information and a road condition derived from the sensor information do not match; and wherein the server specifies the vehicle signature information indicating the characteristics of the invalid traffic information;
and a notification step of notifying, when the sensor information and the traffic information are inconsistent with each other, at least one of the plurality of vehicles of the inconsistency between the sensor information and the traffic information.

8. A method for detecting an attack performed by a computer, the method comprising:
a first acquisition step of acquiring sensor information acquired from a sensor of a vehicle wherein a cryptographic processor is configured to verify electronic signature data of the received traffic information and detect invalid traffic information using signature information notified from a server,
a second acquisition step of acquiring traffic information received by the vehicle through wireless communication, wherein the traffic information is information that describes a current road condition around the vehicle and is sent from an outside of the vehicle;
and a verification step of verifying whether the sensor information and the traffic information are inconsistent with each other, the sensor information and the traffic information determined to be inconsistent with each other when the road condition indicated by the traffic information and a road condition derived from the sensor information do not match and wherein the server specifies the vehicle signature information indicating the characteristics of

Assignees

• Toyota Motor Co Ltd
• Nat Univ Corp Yokohama Nat Univ

Inventors

• Toyama Tsuyoshi
• Oguma Hisashi
• Matsumoto Tsutomu
• Gotoh Hideki
• Moriya Tomokazu

Classifications

• G08G1/0112

  from the vehicle, e.g. floating car data [FCD] · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• G08G1/096716

  where the received information does not generate an automatic action on the vehicle control · CPC title