Systems and methods for message assurance in vehicle systems

Patent metadata

Field	Value
Publication number	US-11423162-B2
Application number	US-202016833200-A
Country	US
Kind code	B2
Filing date	Mar 27, 2020
Priority date	Mar 27, 2020
Publication date	Aug 23, 2022
Grant date	Aug 23, 2022

Abstract

A vehicle control system, including an in-vehicle bus and a plurality of electronic control units (ECUs) coupled to the in-vehicle bus, wherein at least one ECU of the plurality of ECUs is configured to: receive, at a respective at least one ECU of the plurality of ECUs, a message in a message stream on the in-vehicle bus; evaluate the message to determine at least one of a confidence value of the security classification, a significance value of the message, or a bounds check value of the message; and determine in real-time to allow or deny the message to the vehicle control system based on at least one of the significance value of the message, the bounds check value of the message, or the confidence value of the security classification of the message, to provide a sanitized message stream to the vehicle control system.

First claim

What is claimed is:

1. A vehicle control system, the vehicle control system comprising:
an in-vehicle bus;
a plurality of electronic control units (ECUs) coupled to the in-vehicle bus, wherein at least one ECU of the plurality of ECUs is configured to:
receive, at a respective at least one ECU of the plurality of ECUs, a message in a message stream on the in-vehicle bus, wherein a content of the message includes a data sample or measurement value;
inspect, at the respective at least one ECU, the message to determine a security classification of the message, or receive, at the respective at least one ECU, the security classification of the message;
evaluate the message to determine at least one of a confidence value of the security classification, a significance value of the message, or a bounds check value of the message; and
determine in real-time to allow or deny the message to the vehicle control system based on at least one of the significance value of the message, the bounds check value of the message, or the confidence value of the security classification of the message, to provide a sanitized message stream to the vehicle control system, wherein the at least one of the ECU configured to determine in real-time to allow or deny the message to the vehicle control system is further configured to:
determine an instant-based decision to allow or deny the message to the vehicle control system based only on the significance value of the message, the bounds check value of the message, and/or the confidence value of the security classification of the message;
update memory with the significance value of the message, the bounds check value of the message, and/or the confidence value of the security classification of the message;
determine, when the instant-based decision is inconclusive, a trend-based decision based on at least two significance values, wherein the at least two significance values include the significance value of the message and a significance value of a prior message stored in memory, wherein contents of the message and the prior message correspond to a series of measured or sampled values; and
determine in real-time to allow or deny the message to the vehicle control system based on a portion of the instant-based decision and the trend-based decision.

2. The vehicle control system of claim 1 , wherein the portion of the instant-based decision is based on the confidence value and/or the bound check value.

3. The vehicle control system of claim 1 , wherein the portion of the instant-based decision is based on the security classification of the message and the confidence value of the security classification of the message.

4. The vehicle control system of claim 3 , wherein the confidence value is determined based on the security classification and a characteristic of the message, wherein the characteristic of the message includes one of an arrival time of the message, a voltage of the message, or a content of the message.

5. The vehicle control system of claim 1 , wherein the portion of the instant-based decision is based on the bounds check value of the message, wherein the bounds check value of the message is determined based on a consistency among the content of the message and the contents of a plurality of previously received messages from the message stream, wherein the content of the message and the contents of the plurality of previously received messages correspond to sequential measurement values of a series of measurement values.

6. The vehicle control system of claim 5 , wherein evaluating the content of the message to determine the bounds check value comprises:
determining whether the content of the message is consistent with the content of the plurality of previously received messages based on an indirect comparison of the content of the message and a predetermined safety threshold value based on the safety driving model.

7. The vehicle control system of claim 6 , wherein determining the bounds check value further comprises:
determining an indirect value based on the content of the message and contents of the plurality of previously received messages, wherein the content of the message and the contents of the plurality of previously received messages correspond to a progression of measurement values;
obtaining at least one predetermined safety threshold value corresponding to the indirect value; and
determining a magnitude of a difference between the indirect value and the at least one predetermined safety threshold value.

8. The vehicle control system of claim 6 , wherein determining the bounds check value further comprises:
performing a regression analysis to determine a derivative value of the content of the message and the contents of the plurality of previously received messages, wherein the content of the message and the contents of the plurality of previously received messages correspond to a progression of measurement values;
determining at least one threshold value corresponding to the derivative value based on the safety driving model and a current driving context; and
determining a magnitude of the difference between the derivative value and the at least one threshold value, wherein the bounds check value is proportional to the magnitude of said difference.

9. The vehicle control system of claim 1 , wherein the portion of the instant-based decision is
based on the confidence value of the security classification of the message, the security classification of the message, and the significance value.

10. The vehicle control system of claim 1 , wherein the portion of the instant-based decision is based on the significance value of the message, wherein the significance value of the message is based on the content of the message and a current driving context, wherein the current driving context is based on a current driving situation classification determined according to a driving safety model.

11. A vehicle control system, the vehicle control system comprising:
an in-vehicle bus;
a plurality of electronic control units (ECUs) coupled to the in-vehicle bus, wherein at least one ECU of the plurality of ECUs is configured to:
receive, at a respective at least one ECU of the plurality of ECUs, a message in a message stream on the in-vehicle bus, wherein a content of the message includes a data sample or measurement value;
inspect, at the respective at least one ECU, the message to determine a security classification of the message, or receive, at the respective at least one ECU, the security classification of the message;
evaluate the message to determine at least one of a confidence value of the security classification, a significance value of the message, or a bounds check value of the message; and
determine in real-time to allow or deny the message based on the significance value of the message, wherein the significance value of the message is based on the content of the message and a current driving context, wherein the current driving context is based on a current driving situation classification determined according to a driving safety model, wherein

the significance value is determined based on whether using the content of the message changes the current driving situation classification according to the driving safety model or violates a rule associated with the current driving situation classification.

12. The vehicle control system of claim 11 , wherein the significance value is proportional to the likelihood of a change in the current driving situation classification or a violation of the rule associated with the current driving situation.

13. The vehicle control system of claim 12 , wherein t

Assignees

• Intel Corp

Inventors

• Juliato Marcio
• Ahmed Shabbir
• Elli Maria Soledad
• Gutierrez Christopher Noe
• Lesi Vuk
• Sastry Manoj R
• Weast John Charles
• Yang Liuyang Lily

Classifications

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• B60R16/0231

  Circuits relating to the driving or the functioning of the vehicle (monitoring tyres B60C23/00; indicating overspeed B60K31/00; for dash boards B60K37/00, B60Q3/10; for indicating emergencies B60Q1/52; brake control systems B60T; registering or indicating the working of vehicles G07C5/00; measuring distance G01C, e.g. combinations of speed and distance G01C23/00; engine indicators G01L; measuring speed or acceleration G01P) · CPC title

• G06F13/38 Primary

  Information transfer, e.g. on bus (G06F13/14 takes precedence) · CPC title

• B60W2050/0043

  Signal treatments, identification of variables or parameters, parameter estimation or state estimation · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title