Security processing method and server

Patent metadata

Field	Value
Publication number	US-12225036-B2
Application number	US-202418590182-A
Country	US
Kind code	B2
Filing date	Feb 28, 2024
Priority date	Dec 16, 2015
Publication date	Feb 11, 2025
Grant date	Feb 11, 2025

Abstract

An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

First claim

What is claimed is:

1. A security processing method, executed by a computer, for counteracting an anomalous frame transmitted on an on-board network of a single mobility entity, the on-board network of the single mobility entity joining multiple electronic control units installed inside the single mobility entity, the multiple electronic control units performing communication of a frame inside the single mobility entity, the security processing method comprising:
assessing, by the computer, based on first information about multiple frames received on one or multiple on-board networks of one or multiple mobility entities and second information about the frame received on the on-board network of the single mobility entity after the multiple frames are received on the one or more multiple on-board networks of the one or multiple mobility entities, an anomaly level of the frame received on the on-board network of the single mobility entity, the anomaly level of the received frame being a degree to which said received frame is considered to be anomalous; and
deciding to which of decided mobility entities of the one or multiple mobility entities an alert is to be transmitted, the decided mobility entities being provided with an electronic control unit of a same type as one of the multiple electronic control units installed inside the single mobility entity that transmits the frame in the on-board network of the single mobility entity, wherein
the second information includes identification information of the frame, and
in the deciding, in a case in which the anomaly level of the frame indicates that the frame is anomalous, when the identification information of the frame is prescribed in advance for transmitting data by applying cryptographic processing technology, control information including an instruction to update a key used when applying the cryptographic processing technology is included in the alert.

2. The security processing method according to claim 1 , wherein
in the deciding, content of transmission information to be transmitted to a manufacturer of the single mobility entity or a security provider is decided in accordance with the anomaly level assessed in the assessing; and
the security processing method further comprises:
transmitting the transmission information to at least one of the manufacturer of the single mobility entity or the security provider.

3. The security processing method according to claim 2 , wherein
in the transmitting, a transmission time of the transmission information is decided in accordance with the anomaly level assessed in the assessing, and the transmission information is transmitted to the at least one of the manufacturer of the single mobility entity or the security provider at the transmission time.

4. The security processing method according to claim 1 , further comprising:
receiving, from a server, the first information about the multiple frames received on the one or multiple on-board networks of the one or multiple mobility entities in real-time.

5. A computer for counteracting an anomalous frame transmitted on an on-board network of a single mobility entity, the on-board network of the single mobility entity joining multiple electronic control units installed inside the single mobility entity, the multiple electronic control units performing communication of a frame inside the single mobility entity, the computer comprising:
processing circuitry; and
a storage including at least one set of instructions that, when executed by the processing circuitry, causes the processing circuitry to perform operations, the operations including:
assessing, based on first information about the multiple frames received on one or multiple on-board networks of one or multiple mobility entities and second information about the frame received on the on-board network of the single mobility entity after the multiple frames are received on the one or more multiple on-board networks of the one or multiple mobility entities, an anomaly level of the frame received on the on-board network of the single mobility entity, the anomaly level of the received frame being a degree to which said received frame is considered to be anomalous; and

deciding to which of decided mobility entities of the one or multiple mobility entities, other than the single mobility entity, an alert is to be transmitted, the decided mobility entities being provided with an electronic control unit of a same type as one of the multiple electronic control units installed inside the single mobility entity that transmits the frame in the on-board network of the single mobility entity, wherein
the second information about the frame received on the on-board network of the single mobility entity includes identification information of the frame, and
in the deciding, in a case in which the anomaly level of the frame indicates that the frame is anomalous, when the identification information of the frame is prescribed in advance for transmitting data by applying cryptographic processing technology, control information including an instruction to update a key used when applying the cryptographic processing technology is included in the alert.

Assignees

• Panasonic Ip Corp America

Inventors

• Haga Tomoyuki
• Matsushima Hideki
• Maeda Manabu
• Ujiie Yoshihiro
• Kishikawa Takeshi
• Tsurumi Junichi
• Anzai Jun

Classifications

• H04W4/08

  User group management · CPC title

• H04L2012/40273

  the transportation system being a vehicle · CPC title

• H04L2012/40215

  Controller Area Network CAN · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title