Abstract:
A method and system for securing a controlled area network (CAN) of a vehicle is disclosed, where the CAN has a number of electronic control units (ECUs) that control vehicular systems. An on-board diagnostic port of the vehicle is monitored for suspicious activity which does not fit within the baseline profile of the destination ECU. If suspicious activity is detected, countermeasures are taken to minimize harm, such as placing the vehicle in safe mode, reducing the functionality or disabling non-critical ECUs, resetting the targeted ECU, and notifying the driver and non-targeted ECUs.

Description:
RELATED APPLICATIONS 
       [0001]    This non-provisional application claims priority from U.S. provisional application Ser. No. 62/209,432 filed on Aug. 25, 2015, the entire contents of which are hereby incorporated by reference. 
     
    
     BACKGROUND 
       [0002]    Embodiments of the invention relate to the field of vehicle security systems. 
         [0003]    It is possible for Electronic Control Units (ECUs) of vehicles to experience unauthorized access or tampering activities. Such unauthorized access could result in a loss of control of some vehicle systems, including critical systems like braking and steering. Since the ECUs that control vehicle systems may be interconnected in a Controlled Area Network (CAN), it is possible that an unauthorized access to one system ECU could pivot into an attack on other networked ECUs. 
       SUMMARY 
       [0004]    In one embodiment, the invention provides a method of securing a controlled area network (CAN) of a vehicle, the CAN having a. plurality of electronic control units (ECUs) for controlling electronically-controlled vehicular systems. The method comprises monitoring an on-board diagnostic (OBD or OBDII) port of the vehicle for activity, generating an alert when any monitored activity is suspicious activity, and counteracting the suspicious activity to minimize potential harm resulting from the suspicious activity. The method includes notifying the driver of any suspicious activity. In some embodiments, the method includes counteracting the attack by shutting off power, placing the vehicle in safe mode, flooding the Controlled Area Network (CAN) bus so that some of the electronic control units (ECUs) in the CAN operate at a reduced level of functionality and others are disabled, or sending a reset command to the ECU module being attacked. 
         [0005]    A method according to the invention includes at least one physical computer storage medium including stored instructions. The stored instructions, when executed, perform operations to monitor the OBDII port security. The operations include monitoring the OBDII port for suspicious activity, such as an attack, and notifying the driver of any suspicious activity. The operations also include counteracting the attack including shutting off power, placing the vehicle in safe mode, flooding the CAN bus so that some of the ECUs operate at a reduced level of functionality and others are disabled, or sending a reset command to the module being attacked. 
         [0006]    Another embodiment of the invention provides a system for securing a controlled area network (CAN) of a vehicle, the CAN having a. plurality of electronic control units (ECUs) for several electronically-controlled vehicular systems. The system includes a security monitoring device configured to be connected to an on-board diagnostic port (OBD) of a vehicle, and includes a processing unit configured to monitor the OBD port for activity, determine whether any monitored activity includes suspicious activity, generate an alert when suspicious activity is detected, and generate a message to counteract the suspicious activity to minimize harm resulting from the suspicious activity. 
         [0007]    In some embodiments, the security monitoring device includes a Controller Area Network (CAN) driver, at least one processing unit, and at least one physical computer storage medium. The at least one physical computer storage medium includes stored executable instructions that, when executed by the at least one processing unit, cause the at least one processing unit to perform operations to monitor the OBDII port. The stored instructions relate to operations for monitoring the OBD port for suspicious activity, such as an attack, and notifying the driver of any suspicious activity. In some embodiments, the operations include counteracting the attack by shutting off power, placing the vehicle in safe mode, flooding the CAN bus so that some of the ECUs operate at a reduced level of functionality and others are disabled, or sending a reset command to the ECU being attacked. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0008]      FIG. 1  depicts a security monitoring device coupled to a vehicle. 
           [0009]      FIG. 2  is a schematic of a security monitoring device incorporating the invention. 
           [0010]      FIG. 3  is a pinout diagram of a typical motor vehicle OBDII connector port. 
       
    
    
     DETAILED DESCRIPTION 
       [0011]    Before any embodiments of the invention are explained in detail, it is to be understood that the invention is not limited in its application to the details of construction and the arrangement of components set forth in the following description or illustrated in the following drawings. The invention is capable of other embodiments and of being practiced or of being carried out in various ways. 
         [0012]    Also, it is to be understood that the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. The use of “including,” “comprising” or “having” and variations thereof herein is meant to encompass the items listed thereafter and equivalents thereof as well as additional items. The terms “mounted,” “connected” and “coupled” are used broadly and encompass both direct and indirect mounting, connecting and coupling. Further, “connected” and “coupled” are not restricted to physical or mechanical connections or couplings, and can include electrical connections or couplings, whether direct or indirect. Also, electronic communications and notifications may be performed using any known means including wired connections, wireless connections, etc. 
         [0013]    It should also be noted that a plurality of hardware and software based devices, as well as a plurality of different structural components may be used to implement the invention. In addition, it should be understood that embodiments of the invention may include hardware, software, and electronic components or modules that, for purposes of discussion, may be illustrated and described as if the majority of the components were implemented solely in hardware. However, one of ordinary skill in the art, and based on a reading of this detailed description, would recognize that, in at least one embodiment, the electronic based aspects of the invention may be implemented in software (e.g., stored on non-transitory computer-readable medium) executable by one or more processors. As such, it should be noted that a plurality of hardware and software based devices, as well as a plurality of different structural components may be utilized to implement the invention. For example, “control units” and “controllers” described in the specification can include standard processing components, such as one or more processors, one or more memory modules including non-transitory computer-readable medium, one or more input/output interfaces, and various connections (e.g., a system bus) connecting the components. 
         [0014]      FIG. 1  depicts an on-board diagnostic type II (OBDII) port security monitoring device  100  coupled to an OBDII port  300  (see  FIG. 3 ) of the vehicle  105 , although the invention can be used with other types of ports. The security monitoring device  100  contains a connector  102  that couples the security monitoring device  100  to OBDII port  300 . In another embodiment, the security monitor  100  and OBDII could be coupled using wireless adapters or transceivers. The security monitoring device  100  may be configured for the specific type of vehicle  105  to which it is coupled. Connecting the security monitoring device  100  to the vehicle  105  allows the security monitoring device to monitor the OBDII port security and to alert the driver of an attack or suspicious activity. The alert may be an LED turning ON, a warning buzzer, or another type of warning. The warning allows the driver to stop driving the vehicle  105  before the attack causes harm. When a vehicle diagnostic test is performed by a service technician or other entity, the security monitoring device is disconnected from the vehicle  105  so that the security monitoring device does not detect the vehicle diagnostic test as an attack or suspicious activity. 
         [0015]      FIG. 2  depicts the security monitoring device  100 . The security monitoring device  100  includes a microcontroller  200 . The microcontroller includes a Controlled Area Network (CAN) driver  205 , output drivers  210 , a flash signature  215 , a code memory  220 , a Universal Serial Bus (USB) interface  225 , and a Bluetooth interface  230 . 
         [0016]    CAN driver  205  is coupled to a CAN driver  245  with a CAN transmission line  235  and a CAN receiver line  240 . The CAN transmission line  235  can be opened or closed with a switch. The CAN driver is coupled to the Electrostatic Discharge (ESD) protection  250 . The ESD protection  250  is coupled to the OBD II port  255  with both a CAN high and CAN low connection for communication. The OBDII port  300  is coupled to the vehicle  105  ( FIG. 1 ). As shown in  FIG. 3 , OBDII port  300  includes a signal ground pin  305  (pin  5  of the connector), a CAN High ISO J-2234 connection pin  306  (pin  6 ), a CAN Low ISO J-2234 connection  314  (pin  14 ), and a 12 Volt power connection pin  316  (pin  16 ). 
         [0017]    In  FIG. 2 , output drivers  210  are coupled to a warning status interface. The warning status interface includes a warning buzzer  260 . The warning buzzer  260  signals the driver when there is suspicious activity detected at the OBDII port  300 . Additionally, the warning status interface includes a red LED  265  and a green LED  270 . The red LED  265  illuminates as a warning signal that suspicious activity has been detected. The warnings allows the driver to stop driving the vehicle  105  ( FIG. 1 ) before an attack causes harm. The green LED is illuminated when the security monitoring device  100  is operating and no suspicious activity is detected. 
         [0018]    The flash signature  215  and code memory  220  are the physical computer storage media that include stored instructions, which when executed by the at least one microcontroller or processing unit  200 , cause the processing unit  200  to perform operations to monitor the OBDII port security. When the stored instructions are executed, they determine if suspicious messages or signals are being received through the CAN driver  205 . Messages are compared to a baseline for each electronic control unit (ECU) in the system being monitored; the baseline includes types of messages that a particular ECU is accustomed to seeing. If a message does not fall into that baseline group, then the message is flagged as suspicious activity. A suspicious message is an indication of an attack or that there is a faulty device (e.g. an ECU) on the CAN bus. If a suspicious message or suspicious activity is detected, a warning is sent to the driver that could include an LED  265  turning ON, a warning buzzer  260  emitting an audible warning, or another type of visual or audible warning. The warning allows the driver to stop driving the vehicle  105  ( FIG. 1 ) before the attack causes harm such as the loss of control of a vehicular function or system. 
         [0019]    Additionally, the stored instructions may counteract the attack by shutting off power, sending a reset command to the ECU that is the target of the attack, or causing the vehicle  105  ( FIG. 1 ) to enter into a safe mode. If the vehicle  105  ( FIG. 1 ) enters a safe mode, the advanced or unnecessary features of the vehicle  105  are turned off (e.g. the radio, seat heaters) by reducing the functionality or disabling the ECUs which control such non-critical systems, but critical, necessary and active-passive safety functions are available such as standard braking, power-assisted steering, transmission control, and air bags. 
         [0020]    Another method of counteracting suspicious activity is to notify non-targeted ECUs of the attack so that the non-targeted ECUs may run their pre-programmed countermeasures. For example, the invention can determine that a first critical ECU is being attacked and then notify other critical system ECUs of the attack on the first critical ECU. Another countermeasure is to transmit a reset command to the first critical ECU that is determined to be the target of suspicious activity. 
         [0021]    Another method of counteracting suspicious activity or an attack is flooding the CAN bus to prevent the attack from spreading to other ECUs. The CAN bus is a message system where the messages travel based on priority. When multiple messages are sent at the same time, the highest priority message is sent through the CAN bus. In order to flood the CAN bus, messages with a high priority are sent so that lower priority, or attack messages, cannot get through the CAN bus to the other ECUs. Many other methods of counteracting may be included in the storage device instructions. 
         [0022]    The USB interface  225  on the processing unit  200  is coupled to a USB port  265 . The Bluetooth interface  230  on the microcontroller  200  is connected to a Bluetooth port  270 . The Bluetooth port includes a signal ground, a CAN high connection, a CAN low connection, and a battery power connection. Both the USB port and Bluetooth port may be used to upload protection software to the security monitoring device  100  ( FIG. 1 ) or upgrades of that software. 
         [0023]    The power supply  275  for the system includes an input of 12V and outputs of 5V and 3.3 Volts. 
         [0024]    In some implementations, the above-described system is controlled using at least one controller, the controller can include one or more processing units (e.g., a processor, application specific integrated circuits (“ASIC”), etc.), one or more memory modules including non-transitory computer-readable medium, and on or more input/output interfaces. The controller uses the input/output interfaces to send and receive information with one or more sensors or systems external to the controllers (e.g., over a vehicle communication bus, such as a CAN bus). In some implementations, the controller can also include one or more internal sensors or systems. 
         [0025]    Various features and advantages of the invention are set forth in the following claims.