Lightweight electronic control unit fingerprinting

Patent metadata

Field	Value
Publication number	US-12111908-B2
Application number	US-202318215924-A
Country	US
Kind code	B2
Filing date	Jun 29, 2023
Priority date	Aug 14, 2020
Publication date	Oct 8, 2024
Grant date	Oct 8, 2024

Abstract

Systems, apparatuses, and methods to identify an electronic control unit transmitting a message on a communication bus, such as an in-vehicle network bus, are provided. ECUs transmit messages by manipulating voltage on conductive lines of the bus. Observation circuitry can observe voltage signals associated with the transmission at a point on the in-vehicle network bus. A distribution can be generated from densities of the voltage signals. ECUs can be identified and/or fingerprinted based on the distributions.

First claim

What is claimed is:

1. An apparatus, comprising:
processing circuitry; and
memory coupled to the processing circuitry, the memory comprising instructions that when executed by the processing circuitry cause the processing circuitry to:
process a voltage waveform of a message from a communication bus;
determine a message identification (MID) from the message;
determine if the memory comprises a fingerprint associated with the MID;
generate a set of histograms from the voltage waveform after a failure to find the fingerprint associated with the MID in the memory;
generate a density from the set of histograms with a kernel based density function, the kernel based density function to fit the set of histograms as a sum of kernels;
generate an observed distribution from the density of the voltage waveform with a cumulative distribution function (CDF); and
store the fingerprint with an indicator of the MID in the memory to associate the MID with the fingerprint, wherein the fingerprint comprises an indication of the observed distribution.

2. The apparatus of claim 1 , the instructions when executed by the processing circuitry cause the processing circuitry to further:
determine an electronic control unit (ECU) identification (ID) from the message; and
determine if the ECU ID is profiled in the memory;
wherein storage of the fingerprint with the indicator of the MID further comprises associating the fingerprint in the memory with the ECU ID after a failure to determine that the ECU ID is profiled in the memory.

3. The apparatus of claim 1 , the instructions when executed by the processing circuitry cause the processing circuitry to further:
identify the message on the communication bus;
observe voltage signals on the communication bus associated with transmission of the message; and
generate the voltage waveform based on the voltage signals.

4. The apparatus of claim 1 , wherein the communication bus is an in-vehicle network.

5. The apparatus of claim 1 , wherein the processing circuitry further comprises observation circuitry arranged to observe the voltage signals at a point on the communication bus.

6. The apparatus of claim 1 , the memory comprising a plurality of fingerprints, wherein ECU IDs, MIDs, or a combination thereof are associated with the plurality of fingerprints.

7. The apparatus of claim 6 , the memory comprising a data structure comprising the plurality of fingerprints, wherein each entry in the data structure comprises one of the plurality of fingerprints, one of the ECU IDs, and one of the MIDs.

8. The apparatus of claim 6 , the memory pre-populated with ECU IDs.

9. The apparatus of claim 8 , the instructions when executed by the processing circuitry cause the processing circuitry to further determine whether any ECU IDs in the memory remain to profile.

10. A system, comprising:
at least one electronic control unit (ECU); and
an ECU identification sub-system coupled to the at least one ECU via an in-vehicle network (IVN), the ECU identification sub-system comprising:
processing circuitry; and
memory coupled to the processing circuitry, the memory comprising instructions that when executed by the processing circuitry cause the processing circuitry to:
process a voltage waveform of a message from a communication bus of the IVN;
determine a message identification (MID) from the message;
determine if the memory comprises a fingerprint associated with the MID;
generate a set of histograms from the voltage waveform after a failure to find the fingerprint associated with the MID in the memory;
generate a density from the set of histograms with a kernel based density function, the kernel based density function to fit the set of histograms as a sum of kernels;
generate an observed distribution from the density of the voltage waveform with a cumulative distribution function (CDF); and
store the fingerprint with an indicator of the MID in the memory to associate the MID with the fingerprint, wherein the fingerprint comprises an indication of the observed distribution.

11. The system of claim 10 , the instructions when executed by the processing circuitry cause the processing circuitry to further:
determine an ECU identification (ID) from the message; and
determine if the ECU ID is profiled in the memory;
wherein storage of the fingerprint with the indicator of the MID further comprises associating the fingerprint in the memory with the ECU ID after a failure to determine that the ECU ID is profiled in the memory.

12. The system of claim 10 , the instructions when executed by the processing circuitry cause the processing circuitry to further:
identify the message on the communication bus;
observe voltage signals on the communication bus associated with transmission of the message; and
generate the voltage waveform based on the voltage signals.

13. The system of claim 10 , wherein the processing circuitry further comprises observation circuitry arranged to observe the voltage signals at a point on the communication bus.

14. The system of claim 10 , the memory comprising a plurality of fingerprints, wherein ECU IDs, MIDs, or a combination thereof are associated with the plurality of fingerprints.

15. The system of claim 14 , the memory comprising a data structure comprising the plurality of fingerprints, wherein each entry in the data structure comprises one of the plurality of fingerprints, one of the ECU IDs, and one of the MIDs.

16. The system of claim 15 , the instructions when executed by the processing circuitry cause the processing circuitry to further determine whether any ECU IDs in the memory remain to profile.

17. At least one non-transitory computer-readable storage device comprising instructions that when executed by processing circuitry cause the processing circuitry to:
process a voltage waveform of a message from a communication bus;
determine a message identification (MID) from the message;
determine if the memory comprises a fingerprint associated with the MID;
generate a set of histograms from the voltage waveform after a failure to find the fingerprint associated with the MID in the memory;
generate a density from the set of histograms with a kernel based density function, the kernel based density function to fit the set of histograms as a sum of kernels;
generate an observed distribution from the density of the voltage waveform with a cumulative distribution function (CDF); and
store the fingerprint with an indicator of the MID in the memory to associate the MID with the fingerprint, wherein the fingerprint comprises an indication of the observed distribution.

18. The non-transitory computer-readable storage device of claim 17 , comprising instructions that when executed by the processing circuitry cause the processing circuitry to further:
determine an electronic control unit (ECU) identification (ID) from the message; and
determine if the ECU ID is profiled in the memory;
wherein storage of the fingerprint with the indicator of the MID further comprises associating the fingerprint in the memory with the ECU ID after a failure to determine that the ECU ID is profiled in the memory.

19. The non-transitory computer-readable storage device of claim 17 , comprising instructions that when executed by the processing circuitry cause the processing circuitry to further:
identify the message on the communication bus;
observe voltage signals on the communication bus associated with transmission of the message; and
generate the voltage waveform based on the v

Assignees

• Intel Corp

Inventors

• Alban Eduardo
• Ahmed Shabbir
• Juliato Marcio
• Gutierrez Christopher
• Wang Qian
• Lesi Vuk
• Sastry Manoj

Classifications

• G06F13/20 Primary

  for access to input/output bus · CPC title

• H04L2012/40215

  Controller Area Network CAN · CPC title

• H04L12/40

  Bus networks · CPC title

• H04L2012/40273

  the transportation system being a vehicle · CPC title

• G06F21/85

  interconnection devices, e.g. bus-connected or in-line devices · CPC title