Patent EP-4096168-A1 (EP)
Inventor: ROSADINI MR CHRISTIAN
IPC: H04L9/40
Filed: 2022-05-25
Abstract: Described herein is a method for protection from cyber attacks in a communication network, in particular a CAN (Controller Area Network), of a vehicle, that comprises:a communication bus (10), in particular a CAN-bus, comprising a high bus line (10H), on which high logic voltages pass, and a low bus line, on which low logic voltages pass (10L); anda plurality of nodes (11) associated to said communication bus (10) in a signal-exchange relationship and associated at least in part to control units for controlling functions of the vehicle,said nodes (11) exchanging messages (M) passing between nodes of said plurality of nodes (11) to identify illicit messages (MF), said messages (M) being coded in data frames through dominant and recessive bits,said method comprising:acquiring (130) dominant voltage measurements (NV<sub>i,k</sub>);obtaining (170) an electrical characteristic (VP) of nodes that transmit messages (M) via the steps of:acquiring (171) consecutive groups (k) of voltage measurements (VL) on the high bus line (10H) and on the low bus line (10L) during reception of messages (M) at receiving nodes and calculating a distribution thereof;calculating (172) values of distribution statistics;calculating (173) a cumulative voltage deviation for each value of statistic; andobtaining a voltage profile (VP) by adding the cumulative voltage deviations of each statistic, wherein:said consecutive groups (k) are formed via a sliding window of voltage measurements in which one or more older voltage measurements are replaced with corresponding new voltage measurements;said method then comprising execution of a malicious-node detection procedure (200), which comprises:extracting (210) at least one characteristic parameter (m; q) of said voltage profile (VP) for each group;comparing (220) said at least one characteristic parameter (m; q) of a current group with a corresponding characteristic parameter extracted from a previous group; andif said comparison operation (220) indicates that said at least one characteristic parameter (m; q) of the current group differs from the at least one characteristic parameter of the previous group by at least one given difference value, supplying an identifier (ID) of the corresponding message and calculating a time of settling (k<sub>st</sub>) of the at least one characteristic parameter on a constant value;said method then comprising execution of a transmitting-node identification procedure (300), which comprises:comparing said at least one characteristic parameter (m; q) evaluated at the settling time (k<sub>st</sub>) against all the corresponding characteristic parameters of all the messages (m<sub>i</sub>) received up to said settling time (k<sub>st</sub>), said identification procedure (300) comprising:defining (310) for each of said messages received (mi) a range of variation (limsup, liminf) of said at least one characteristic parameter (m; q) with respect to a given number of previous samples (k<sub>past</sub>); andevaluating (320) whether the value of said at least one characteristic parameter (m; q) falls within the range of variation of one of said messages and, if so (321; 322), identifying as malicious node the node that transmits said message.