Security apparatus, attack detection method, and storage medium

Patent metadata

Field	Value
Publication number	US-11336618-B2
Application number	US-202117152286-A
Country	US
Kind code	B2
Filing date	Jan 19, 2021
Priority date	Oct 9, 2015
Publication date	May 17, 2022
Grant date	May 17, 2022

Abstract

A security apparatus includes a receiver that receives a frame front at least one network, a parameter storage that stores at least one examination parameter defining a content of an examination on a frame, and processing circuitry that performs operations. The operations include judging whether a predetermined condition is satisfied for the frame received by the receiver. When the predetermined condition is satisfied, updating the stored at least one examination parameter, and when the predetermined condition is not satisfied, not updating the stored at least one examination parameter. The operations also include executing an examination, based on the stored at least one examination parameter, as to whether the frame received by the receiver is an attack frame, and performing a process depending on a result of the execution of the examination such that an influence of an attack frame on at least one electronic control unit is suppressed.

First claim

What is claimed is:

1. A security apparatus connected to at least one network, comprising:
a receiver that receives a frame from the at least one network;
a parameter storage that stores at least one examination parameter defining a content of an examination on a frame;
processing circuitry that, in operation, performs operations including
judging whether a predetermined condition is satisfied for the frame received by the receiver,
in a case where the predetermined condition is judged to be satisfied for the frame received by the receiver, updating the at least one examination parameter stored in the parameter storage;
in a case where the predetermined condition is judged not to be satisfied for the frame received by the receiver, not updating the at least one examination parameter stored in the parameter storage;
executing an examination, based on the at least one examination parameter stored in the parameter storage after the judging, as to whether the frame received by the receiver is an attack frame; and
performing a process depending on a result of the execution of the examination such that an influence of an attack frame on at least one electronic control unit is suppressed.

2. The security apparatus according to claim 1 ,
wherein the at least one examination parameter includes a plurality of examination parameters defining contents of examinations on a frame, the contents being different from each other, and
the operations further include
judging whether each of a plurality of predetermined conditions is satisfied for the frame received by the receiver, and
depending on a result of the judgment, determining an examination parameter to be subjected to updating from the plurality of examination parameters,

wherein the updating updates the determined examination parameter.

3. The security apparatus according to claim 2 ,
wherein the operations further include
at a point of time when judgment results are obtained for the respective predetermined conditions, determining whether the plurality of examination parameters includes an examination parameter that is to be updated depending on the judgment results,
in the updating, in a case where it is determined that updating is to be performed, updating the examination parameter determined to be updated, and
performing the executing of the examination depending on a state of updating of each of the plurality of examination parameters.

4. The security apparatus according to claim 1 ,
wherein in the executing of the examination, in a ease where the predetermined condition is satisfied for the frame received by the receiver, it is judged that the frame is an attack frame, and
in the executing of the process, the process is performed on the frame judged as the attack frame such that an influence of the attack frame on at least one electronic control unit is suppressed.

5. A method for an on-board network system in which a plurality of electronic control units transmit and receive a frame via & least one network, the method comprising:
receiving, by a receiver, a frame from the at least one network;
judging whether a predetermined condition is satisfied for the frame received by the receiver;
in a case where the predetermined condition is judged to be satisfied for the frame received in the receiving, updating an examination parameter defining a content of a frame examination;
in a case where the predetermined condition is judged not to be satisfied for the frame received by the receiver, not updating the at least one examination parameter stored in the parameter storage;
executing an examination, based on the updated examination parameter after the judging, as to whether the frame received in the receiving is an attack frame or not; and
performing a process depending on a result of the execution of the examination such that an influence of an attack frame on at least one electronic control unit is suppressed.

6. A computer-readable non-transitory storage medium storing a program,
the program causing, when executed by a processor disposed in a security apparatus connected to least one network, the processor to execute a method, the method comprising:
receiving, by a receiver, a frame from the at least one network;
judging whether a predetermined condition is satisfied for the frame received by the receiver;
in a case where the predetermined condition is judged to be satisfied for the frame received in the receiving, updating an examination parameter defining a content of a frame examination;
in a case where the predetermined condition is judged not to be satisfied for the frame received by the receiver, not updating the at least one examination parameter stored in the parameter storage;
executing an examination, based on the updated examination parameter after die judging, as to whether the frame received in the receiving is an attack frame or not; and
performing a process depending on a result of the execution of the examination such that an influence of an attack frame on at least one electronic control unit is suppressed.

Assignees

• Panasonic Ip Corp America
• Panasonic Iniellectual Property Corp Of America

Inventors

• Maeda Manabu
• Anzai Jun
• Ujiie Yoshihiro
• Tanabe Masato
• Kishikawa Takeshi

Classifications

• G06F21/85 Primary

  interconnection devices, e.g. bus-connected or in-line devices · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• B60R16/023 Primary

  for transmission of signals between vehicle parts or subsystems · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title