Security processing method and server

Patent metadata

Field	Value
Publication number	US-11949705-B2
Application number	US-202318150898-A
Country	US
Kind code	B2
Filing date	Jan 6, 2023
Priority date	Dec 16, 2015
Publication date	Apr 2, 2024
Grant date	Apr 2, 2024

Abstract

An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

First claim

What is claimed is:

1. A security processing method, executed by a computer, for counteracting an anomalous frame transmitted on an on-board network of a single mobility entity, the on-board network of the single mobility entity joining multiple electronic control units installed inside the single mobility entity, the multiple electronic control units performing communication of a frame inside the single mobility entity, the security processing method comprising:
assessing, by the computer, based on first information about multiple frames received on one or multiple on-board networks of one or multiple mobility entities and second information about the frame received on the on-board network of the single mobility entity after the multiple frames are received on the one or more multiple on-board networks of the one or multiple mobility entities, an anomaly level of the frame received on the on-board network of the single mobility entity, the anomaly level of the received frame being a degree to which said received frame is considered to be anomalous; and
deciding whether or not to transmit a first alert to the single mobility entity based on the anomaly level, and deciding whether or not to transmit a second alert to a manufacturer of the single mobility entity or a security provider based on the anomaly level,
wherein the computer differently decides whether to transmit the first alert and the second alert for at least one anomaly level.

2. The security processing method according to claim 1 , further comprising:
deciding which mobility entities, other than the single mobility entity, to be alerted, the mobility entities being provided with an electronic control unit of a same type as one of the multiple electronic control units installed inside the single mobility entity that transmits the frame in the on-board network of the single mobility entity.

3. The security processing method according to claim 2 , wherein
the mobility entities, which have a predefined relationship with the single mobility entity and are to be alerted, are of a same configuration of the on-board network as the single mobility entity.

4. The security processing method according to claim 1 , wherein
in the deciding, content of transmission information to be transmitted to the manufacturer of the single mobility entity or the security provider is decided in accordance with the anomaly level assessed in the assessing; and
the security processing method further comprises:
transmitting the transmission information to the manufacturer of the single mobility entity or the security provider.

5. The security processing method according to claim 4 , wherein
the second information about the frame received on the on-board network of the single mobility entity includes identification information of the frame, and
in the deciding, the content of the transmission information is decided in accordance with the identification information of the frame in a case in which the anomaly level of the frame assessed in the assessing indicates that the frame is anomalous.

6. The security processing method according to claim 4 , wherein
in the transmitting, a transmission time of the transmission information to be transmit to the manufacturer of the single mobility entity or the security provider is decided in accordance with the anomaly level assessed in the assessing, and the transmission information is transmitted to the manufacturer of the single mobility entity or the security provider at the transmission time.

7. The security processing method according to claim 1 , further comprising:
receiving, from a server, the first information about the multiple frames received on the one or multiple on-board networks of the one or multiple mobility entities in real-time.

8. A computer for counteracting an anomalous frame transmitted on an on-board network of a single mobility entity, the on-board network of the single mobility entity joining multiple electronic control units installed inside the mobility entity, the multiple electronic control units performing communication of a frame inside the single mobility entity, the computer comprising:
processing circuitry; and
a storage including at least one set of instructions that, when executed by the processing circuitry, causes the processing circuitry to perform operations, the operations including:
assessing, based on first information about the multiple frames received on one or multiple on-board networks of one or multiple mobility entities and second information about the frame received on the on-board network of the single mobility entity after the multiple frames are received on the one or more multiple on-board networks of the one or multiple mobility entities, an anomaly level of the frame received on the on-board network of the single mobility entity, the anomaly level of the received frame being a degree to which said received frame is considered to be anomalous; and
deciding whether or not to transmit a first alert to the single mobility entity based on the anomaly level, and deciding whether or not to transmit a second alert to a manufacturer of the single mobility entity or a security provider based on the anomaly level,

wherein the processing circuitry differently decides whether to transmit the first alert and the second alert for at least one anomaly level.

Assignees

• Panasonic Ip Corp America

Inventors

• Haga Tomoyuki
• Matsushima Hideki
• Maeda Manabu
• Ujiie Yoshihiro
• Kishikawa Takeshi
• Tsurumi Junichi
• Anzai Jun

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G07C5/0808

  Diagnosing performance data (testing of vehicles G01M17/00; testing of electrical installation on vehicles G01R31/005) · CPC title

• H04L12/40

  Bus networks · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title