System and method to detect malicious use of diagnostic state changes in a vehicle

Patent metadata

Field	Value
Publication number	US-12148253-B2
Application number	US-202117412822-A
Country	US
Kind code	B2
Filing date	Aug 26, 2021
Priority date	Aug 26, 2021
Publication date	Nov 19, 2024
Grant date	Nov 19, 2024

Abstract

A computer-implement method includes receiving one or more messages at a secure processor from a first node on a communication bus, monitoring the one or more messages from the first node, wherein the one or more messages include a request to a change a state of the one or more nodes, in response to the one or more messages including the request to the change of state, initiating a timer to initiate monitoring of the communication bus for a second sequence of messages, and in response to the second sequence of messages not being found within a database including information associated with the one or more latency values associated with the change of state, outputting a signal indicating an alert.

First claim

What is claimed is:

1. A system comprising:
memory;
a database including information indicating one or more latency values associated with a change of a state associated with one or more nodes on a communication bus, wherein the database further includes information indicative one or more messages configured to change the state of the one or more nodes and a list of packet sequences that cause state changes in the ECUs, wherein the latency values indicate latency of various state transition;
a secure processor in communication with the memory and programmed to:
monitor the one or more messages from a first node of the one or more modes on the communication bus, wherein the one or more messages include a request to a state change of the one or more nodes;
in response to the one or more messages including the request to the state change, initiate a timer to initiate monitoring of the communication bus for a second sequence of messages in a pre-defined time period;
determine whether the second sequence of messages are transmitted during a blind period; and
in response to the second sequence of messages not aligned with the database indicating packet information associated with one or more latency values associated with the change of the state and an unexpected packet sequence during the blind period, output a signal indicating an alert, and output the alert without analyzing contents of the second sequence of messages.

2. The system of claim 1 , wherein both the secure processor and the one or more nodes are on the communication bus.

3. The system of claim 1 , wherein the secure processor is programmed to receive the one or more message from a victim processor in response to commands sent from an attacker processor to the victim processor.

4. The system of claim 1 , wherein the signal indicating the alert is output to a remote cloud processing center.

5. The system of claim 1 , wherein the secure processor is configured to transmit signals to query the state of the one or more nodes.

6. The system of claim 1 , wherein the secure processor is configured to transmit signals to remove one or more unexpected messages from the bus.

7. The system of claim 1 , wherein the database including information indicating latency values includes information containing one or more values to process a reset message by a second processor, wherein the database indicating packet information contains the sequence to trigger the state change in the second processor.

8. The system of claim 7 , wherein the secure processor receives from a third processor a message indicating to reset the second processor, and initiates a time of a duration of a reset latency, and receives a message from the bus belonging to the second processor before expiration of the timer, and in response, issue an alert to a vehicle user.

9. The system of claim 1 , wherein the database including information indicating one or more latency values further includes information indicating a value to process a session change request by a second processor or the database indicating packet information includes a sequence to trigger the state change in the processor.

10. The system of claim 9 , wherein the secure processor receives, from a third processor, a request to change session from the second processor and initiates a time of a duration of an expected latency associated with the request; and the secure processor receives a second message from the third processor to change the session of the second processor before expiration of the timer and outputs an alert to a vehicle user.

11. The system of claim 10 , wherein the secure processor receives multiple message from the third processor, and in response to receiving the multiple messages sends a request to the second processor to determine the state of the second processor, wherein the secure processor is further configured to monitor one or more bus messages in response to the determination of the state of the second processor.

12. A computer-implement method, comprising:
receiving one or more messages at a processor from a first node on a communication bus;
monitoring the one or more messages from the first node, wherein the one or more messages include a request to change the state of the one or more nodes;
in response to the one or more messages including the request to change the state, initiating a timer to initiate monitoring of the communication bus for a second sequence of messages in a pre-defined time period; and
in response to the second sequence of messages not being found within the database including information associated with the one or more latency values associated with the change of state nodes and a list of packet sequences that cause state changes in the ECUs, wherein the latency values indicate latency of various state transition, outputting a signal indicating an alert, wherein the alert is output without analyzing contents of the second sequence of messages.

13. The computer-implemented method of claim 12 , wherein the alert is output to a vehicle display.

14. The computer-implemented method of claim 12 , wherein the processor is further configured to send a validation request to the one or more nodes in response to the second sequence of messages.

15. A system comprising:
a secure processor in communication with memory on a communication bus and programmed to:
receive one or more messages at a secure processor from a first node on a communication bus;
monitor the one or more messages from the first node, wherein the one or more messages include a request to change a state of the one or more nodes;
in response to the one or more messages including the request to change the state, monitor the communication bus for a second sequence of messages in a pre-defined time period; and
in response to the second sequence of messages not being aligned with packet information associated with the request to change the state of the one or more nodes, output a signal indicating an alert, wherein the packet information associated with the request to the change the state of the one or more nodes is located in the database stored in memory, and output the alert without analyzing contents of second sequence of messages.

16. The system of claim 15 , wherein the secure processor is further programmed to alert a second processor, wherein the second processor is programed to adjust communication parameters in response to the alert.

17. The system of claim 15 , wherein the secure processor is further programmed to output the alert to a cloud server.

Assignees

• Bosch Gmbh Robert

Inventors

• Kulandaivel Sekar
• Jain Shalabh
• Holle Jan

Classifications

• H04W12/122

  Counter-measures against attacks; Protection against rogue devices · CPC title

• H04L12/40 Primary

  Bus networks · CPC title

• H04L2012/40215

  Controller Area Network CAN · CPC title

• G07C5/0816

  Indicating performance data, e.g. occurrence of a malfunction · CPC title

• H04L2463/121

  Timestamp · CPC title