Method and device for anomaly detection in a vehicle

Patent metadata

Field	Value
Publication number	US-11277299-B2
Application number	US-201916568706-A
Country	US
Kind code	B2
Filing date	Sep 12, 2019
Priority date	Sep 19, 2018
Publication date	Mar 15, 2022
Grant date	Mar 15, 2022

Abstract

In a method and a device for detecting anomalies in data in data traffic across a communication network in a vehicle, the device encompasses a plurality of hardware interfaces and a monolithic coupling element designed for transmitting data arriving at one of the hardware interfaces in a data packet via at least one of the hardware interfaces and analyzing the data packet or a copy of the data packet for a detection of anomalies in the data of the communication network or of a subsystem of the communication network connected to one of the hardware interfaces.

First claim

What is claimed is:

1. A device comprising:
a plurality of hardware interfaces configured to interface with a communication network in a vehicle; and
a monolithic coupling element, wherein the monolithic coupling element is configured to:
receive data in data packets from one of the hardware interfaces;
transmit the data in the data packets via at least one of the hardware interfaces; and
analyze a selected subset of the received data packets or copies of the data packets and thereby detect an anomaly in data of data traffic of the communication network of the vehicle or of a subsystem of the communication network connected to one of the hardware interfaces;
wherein the monolithic coupling element includes a distributor, a computer, and an internal interface located between the computer and the distributor, the distributor is configured to provide the selected subset of the data packets or copies of the data packets to the computer via the internal interface for the detection of the anomaly, the distributor including a filter that is configured to select the subset of the received data packets in order to regulate a data volume for the anomaly detection in the computer.

2. The device of claim 1 , wherein:
the internal interface is independent of the plurality of hardware interfaces; and
the computer is configured to establish the at least one of the hardware interfaces via the internal interface, across which the distribution unit transmits the data.

3. The device of claim 2 , wherein the distributor, the computer, and the internal interface are designed as a one-chip system.

4. The device of claim 1 , wherein the distributor includes a message buffer configured to store the data packet or copy of the data packet.

5. The device of claim 1 , further comprising a host controller or domain controller that is connected to the monolithic coupling element via an interface and that is configured to centrally administer the subsystem as a local security area of the communication network.

6. A communication network for a vehicle, the communication network comprising:
a gateway;
at least one domain controller communicatively connected to the gateway; and
at least one controller connected to the at least one domain controller for communication;
wherein:
the at least one domain controller or the gateway includes:
a plurality of hardware interfaces to the communication network; and
a monolithic coupling element; and

the monolithic coupling element is configured to:
receive data in data packets from one of the hardware interfaces;
transmit the data in the data packets via at least one of the hardware interfaces; and
analyze a selected subset of the received data packets or copies of the data packets and thereby detect an anomaly in data of data traffic of a communication network of a vehicle or of a subsystem of the communication network connected to one of the hardware interfaces, the communication network or subsystem including the at least one domain controller and the at least one controller;
wherein the monolithic coupling element includes a distributor, a computer, and an internal interface located between the computer and the distributor, the distributor is configured to provide the selected subset of the data packets or copies of the data packets to the computer via the internal interface for the detection of the anomaly, the distributor including a filter that is configured to select the subset of the received data packets in order to regulate a data volume for the anomaly detection in the computer.

7. A method for detecting an anomaly in data of data traffic across a communication network in a vehicle, the method comprising:
a monolithic coupling element:
receiving data in data packets from one of a plurality of hardware interfaces to the communication network in the vehicle;
transmitting the data in the data packets via at least one of the hardware interfaces; and
analyzing a selected subset of the data packets or copies of the data packets and thereby detect the anomaly in data of the communication network or of a subsystem of the communication network connected to one of the hardware interfaces;
wherein the monolithic coupling element includes a distributor, a computer, and an internal interface located between the computer and the distributor, the distributor providing the selected subset of the data packets or copies of the data packets to the computer via the internal interface for the detection of the anomaly, the distributor including a filter that selects the subset of the received data packets in order to regulate a data volume for the anomaly detection in the computer.

8. The method of claim 7 , further comprising:
the computer of the monolithic coupling element establishing, via the internal interface, which is independent of the hardware interfaces to the communication network, the at least one of the hardware interfaces via which the distributor transmits the data in the transmitting step.

9. The method of claim 8 , further comprising storing the data packet or copy of the data packet in a message buffer of the distributor.

10. The method of claim 7 , further comprising a host controller or a domain controller communicating via an interface with the monolithic coupling element, in order to centrally administer the subsystem as a local security area of the communication network.

11. A non-transitory computer-readable medium on which are stored instructions that ae executable by a processor of a monolithic coupling element and that, when executed by the processor, cause the processor to perform a method for detecting an anomaly in data of data traffic across a communication network in a vehicle, the method comprising:
the monolithic coupling element:
receiving data in data packets from one of a plurality of hardware interfaces to the communication network in the vehicle;
transmitting the data in the data packets via at least one of the hardware interfaces; and
analyzing a selected subset of the data packets or copies of the data packets and thereby detect the anomaly in data of the communication network or of a subsystem of the communication network connected to one of the hardware interfaces;
wherein the monolithic coupling element includes a distributor, a computer, and an internal interface located between the computer and the distributor, the distributor providing the selected subset of the data packets or copies of the data packets to the computer via the internal interface for the detection of the anomaly, the distributor including a filter that selects the subset of the received data packets in order to regulate a data volume for the anomaly detection in the computer.

Assignees

• Bosch Gmbh Robert

Inventors

• Weber Andreas
• Holle Jan
• Wolfinger Janin
• Gramm Jens

Classifications

• H04L49/111

  Switch interfaces, e.g. port details · CPC title

• H04L41/06 Primary

  Management of faults, events, alarms or notifications · CPC title

• H04L67/12 Primary

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L1/004

  by using forward error control (H04L1/0618 takes precedence; coding, decoding or code conversion, for error detection or correction H03M13/00) · CPC title