Patent Description:
An air-gap device for isolating cyber mobility systems when a vehicle is in motion includes a housing. The housing includes various input ports and various output ports. The various input ports include connections to a secure gateway. The various output ports include connections to one or more mobility Electronic Control Units (ECUs). The air-gap device includes at least one pair of terminal contacts. The at least one pair of terminal contacts includes a first terminal contact and a second terminal contact. The air-gap device includes an air gap embedded in the housing. The air gap is closed when the first terminal contact is in contact with the second terminal contact. The air gap is open when the first terminal is not in contact with the second terminal contact. The air-gap device is instructed to open the air gap when the vehicle is determined to be in motion or about to be in motion.

A system for cyber isolating mobility systems when a vehicle is in motion includes a gateway device. The gateway device is connected to one or more infotainment Electronic Control Units (ECUs), one or more Body ECUs, one or more Telematics ECUs, or on-board diagnostics of the vehicle. The system includes one or more mobility ECUs. The one or more mobility ECUs include one or more powertrain ECUs, one or more chassis ECUs, and one or more advance driver-assistance systems (ADAS) ECUs. The system includes an air-gap device. The air-gap device includes a housing. The housing includes various input ports and various output ports. The various input ports include connections to a secure gateway. The various output ports include connections to the one or more mobility ECUs. The air-gap device includes at least one pair of terminal contacts. The at least one pair of terminal contacts includes a first terminal contact and a second terminal contact. The air-gap device includes an air gap embedded in the housing. The air gap is closed when the first terminal contact is in contact with the second terminal contact. The air gap is open when the first terminal is not in contact with the second terminal contact. The air-gap device is instructed to open the air gap when the vehicle is determined to be in motion or about to be in motion.

A method for isolating mobility systems when a vehicle is in motion includes obtaining, by a gateway device, a vehicle status of the vehicle. The vehicle status indicates whether the vehicle is in motion or about to be in motion. The method includes determining, by a plurality of mobility Electronic Control Units (ECUs), a status of an air-gap device. The status indicates whether the air-gap device is in a secured state. The method includes confirming, by the plurality of mobility ECUs, whether the vehicle is in motion. The method includes confirming, by the plurality of mobility ECUs, a connectivity level requirement based on the vehicle status. The method includes determining a security level requirement based on the connectivity level requirement. The method includes generating an air gap instruction indicating whether to enable the air gap or to disable the air gap based on the security level requirement determined.

Other aspects of the disclosure will be apparent from the following description and the appended claims.

Specific embodiments of the disclosed technology will now be described in detail with reference to the accompanying figures. Like elements in the various figures are denoted by like reference numerals for consistency.

The use of ordinal numbers is not to imply or create any particular ordering of the elements nor to limit any element to being only a single element unless expressly disclosed, such as using the terms "before", "after", "single", and other such terminology.

In motor vehicles, attack surfaces that could potentially be used to disrupt the behavior of the vehicle's sub-systems may be protected by cyber security systems and methods. The systems and methods may include secure boot, firewalling, public/private keys, authentication, intrusion detection and prevention systems together with the delivery of security patches and updates. The systems and methods of protecting motor vehicles are based on software applications that provide security layers over critical vehicle functions. The software applications rely on cryptographic security methods to prevent unauthorized access. In these cases, a rejection of an attack is based on probability.

In general, embodiments of the invention include a device, a system, and a method that provide a layered approach to vehicle cybersecurity. In some embodiments, the device reduces the probability of success of an attack and mitigates any ramifications of a potential unauthorized access by implementing a layer of protection via a physical isolation mechanism. More specifically, in one or more embodiments, this isolation mechanism may create an air gap between any potential attack surfaces, susceptible to attack vectors, and critical mobility systems. Potential attack surfaces may be a set of interfaces (i.e., "attack vectors" when these interfaces are vulnerable) where an unauthorized user may try to enter/extract data to/from a system, or to modify a behavior of the system. In some embodiments, attack vectors are interfaces or paths an attacker may use to exploit a vulnerability in a communication network. For instance, an exploit may use an open IP port vulnerability on a variety of different attack vectors such as Wi-Fi, cellular networks, or IP over Bluetooth. Attack vectors may enable attackers to exploit system vulnerabilities, including a driver or an occupant in the motor vehicle.

In some embodiments, the isolation mechanism is an air-gap device. The critical mobility systems may be isolated when the air-gap device activates the air gap during mobility events allowing communication to diagnostics systems and over-the-air (OTA) updates at other times. In one or more embodiments, the vehicle network architectures are not significantly altered using the air-gap device because the air-gap device may be an intermediate device that physically separates a convenience domain from a mobility domain of the motor vehicle.

In one or more embodiments, the device, the system, and the method allow connection to cyber-interfaces, through a firewall, when the vehicle is stationary and then transition to an air-gap mode when the vehicle is in motion. In this regard, implementing the device, the system, and the method may prevent real-time cyber-attack vectors reaching mobility relevant systems (i.e., engine, brakes, steering) when the vehicle is being driven, thus preventing hacking situations on-the-fly. Cyber security methods such as firewalling, public/private keys, authentication, intrusion detection/prevention, should be maintained such that the device, the system, and the method may protect from an attack reaching mobility relevant systems while the vehicle is in motion or stationary.

<FIG> illustrates a system configuration for preventing network attacks in a communication network <NUM> of a motor vehicle in accordance with one or more embodiments. In particular, the system may include an air-gap device <NUM> implementing a physical layer with a defense system inside the communication network <NUM> that prevents unwanted terminal connections into the communication network <NUM>. To this point, an attack is any successful connection and allocation of network resources to an unauthorized terminal (not shown). As such, preventing an attack may involve any monitoring, identifying, and controlling of physical connections from terminals attempting to infiltrate the communication network <NUM>. According to one or more embodiments, <FIG> shows the air-gap device <NUM> connected to the communication network <NUM> and disposed between a convenience domain <NUM> and a mobility domain <NUM>. The mobility domain <NUM> may include ports associated with various mobility controls. These mobility controls may be directed towards monitoring and regulating an engine, steering devices, brakes, cameras, radar devices, or stationary charging mechanisms of the motor vehicle. The convenience domain <NUM> may include ports associated to various communication controls. These communication controls may be directed towards monitoring and regulating wireless connections or protocols (i.e., Global Navigation Satellite System (GNSS), AM/FM/HD radio, cellular, internet, Bluetooth, Near-Field-Communication (NFC)), wired connections to storage media (i.e., smartphones, USBs, CDs, DVDs, or MSDs), secure keyless entry device connections, or Tire Pressure Monitoring Systems (TPMSs) to the motor vehicle.

In one or more embodiments, the air-gap device <NUM> provides cyber isolation, or air-gapping, for any relevant mobility domain electronic modules (i.e., mobility related Electronic Control Unit (ECUs)). The air-gap device <NUM> may be configured to activate the air gap to physically separate the mobility domain electronic modules from the rest of a motor vehicle communications network when the motor vehicle is in a mobility mode as determined by one or more parameters (e.g., a combination of engine running, drivetrain engaged, or vehicle moving). The air gap may be a space between two consecutive points of contact in an otherwise continued physical connection. The air gap may be an insulated space that interrupts data and commands from continued travelling or transmission. In some embodiments, the air gap device <NUM> may be installed during manufacturing of the motor vehicle such that any motor vehicle built with an air gap device <NUM> may be considered to have an underlying layer of security irrespective of any additional security protocols, firewalls, or software applications.

<FIG> shows that the air-gap device <NUM> may include a housing <NUM> with various input ports 120a and 120b and various output ports 130a and 130b. The air-gap device <NUM> may be connected between a secure gateway <NUM> and one or more mobility ECUs <NUM> such that the air-gap device <NUM> may automatically control the physical connections between the secure gateway <NUM> and the one or more mobility ECUs <NUM>. The secure gateway <NUM> may be a point of contact for the convenience domain <NUM> of the motor vehicle, and the one or more mobility ECUs <NUM> may be completely incorporated in the mobility controls of the motor vehicle. The input ports 120a and 120b may be physical connections between the secure gateway <NUM> and the air-gap device <NUM>. The output ports 130a and 130b may be physical connections between the air-gap device <NUM> and the one or more mobility ECUs <NUM>.

While <FIG> shows arrows going from the secure gateway <NUM> to the one or more mobility ECUs <NUM>, this is only shown to illustrate that the secure gateway <NUM> gains access to mobility information in the mobility ECUs <NUM> in the direction of the arrows. Once the physical connections are established, communication signals 160a and 160b may be exchanged (i.e., back and forth) between the secure gateway <NUM> and the one or more mobility ECUs <NUM>.

In one or more embodiments, the physical connections may be implemented through one or more relays (i.e., mechanical or solid state) actuated using one or more control signals <NUM> received from one or more mobility ECUs <NUM> indicating whether the physical connections are enabled or disabled. These physical connections may include a pair of terminal contacts 111a and 112a or 111b and 112b for each relay. The relay may include opto-isolators 113a and 113b. A first contact 111a and 111b may be a switchable connection corresponding to the actuating of the relay. In this regard, when the mobility ECUs <NUM> identify that the vehicle is in motion, or about to start moving, the mobility ECUs <NUM> may automatically instruct the air-gap device <NUM> using one or more control signals <NUM> to open the terminal contact pairs 111a and 112a and 111b and 112b. As such, the air-gap device (<NUM>) may include an air gap embedded in the housing <NUM> when the terminal contact pairs 111a and 112a and 111b and 112b are separated when the air-gap device <NUM> is instructed to open the air-gap based on the one or more control signals <NUM>. Similarly, when the mobility ECUs <NUM> identify that the vehicle is stopped, or about to stop moving, the mobility ECUs <NUM> may instruct the air-gap device <NUM> using one or more control signals <NUM> to close the terminal contact pairs 111a and 112a and 111b and 112b.

The air-gap device <NUM> may physically disconnect networks/data buses between critical mobility systems and non-critical mobility systems, by opening the air gap and creating a disconnect between the two. The critical mobility systems are safety-critical vehicle control systems responsible for brakes, steering and propulsion. The air-gap device <NUM> may provide the necessary terminations for networks to preserve network integrity (i.e., termination resistors) such that both halves of the isolated networks may remain functional. The air-gap device <NUM> may be automatically activated by the critical mobility systems and not by the non-critical mobility systems. In some embodiments, the air-gap device <NUM> may be in a passive/unpowered state such that networks are not isolated. In some embodiments, the air-gap device <NUM> may be in an active/powered state such that networks are isolated.

Although the air-gap device (<NUM>) is shown in <FIG> between the secure gateway (<NUM>) and the mobility ECUs (<NUM>), those of ordinary skill in the art will appreciate that the air-gap device (<NUM>) may be implemented in the secure gateway, or in one of the mobility ECUs, without departing from the scope herein. Further, in one or more embodiments, the air-gap device <NUM> may be deployed across multiple physical locations in the motor vehicle. In some embodiments, the elements in the system may be executed on a single device with various physical layers and corresponding resources broken down to provide the functionality associated with each element in the system. For example, the air-gap device <NUM> may be a device dedicated for each mobility ECU out of the one or more ECUs <NUM> such that each air-gap device <NUM> may be actuated using a unique corresponding control signal <NUM>.

<FIG> shows various types of communication among the elements in the communication network <NUM> including the air-gap device <NUM>. A type of communication may include required network connections/communications, such as established or soon-to-be-established communication links shown in solid connection lines. Another type of communication may include control signals, such as instructions shown in dashed connection lines. As described in reference to <FIG>, the air-gap device <NUM> may separate a mobility domain <NUM> of the motor vehicle from a convenience domain <NUM> of the motor vehicle (denoted with arrows). In some embodiments, the mobility domain <NUM> may include critical mobility systems (i.e., the one or more mobility ECUs <NUM>) such as one or more powertrain ECUs <NUM>, one or more chassis ECUs <NUM>, or one or more advance driver-assistance systems (ADAS) ECUs. In some embodiments, the convenience domain <NUM> may include non-critical mobility systems (i.e., the one or more communication systems) such as the secure gateway <NUM>, one or more infotainment ECUs <NUM>, one or more body ECUs <NUM>, one or more telematics ECUs, or on-board diagnostics (OBD) <NUM>.

In one or more embodiments, the secure gateway <NUM> provides the data routing between the mobility domain <NUM> and the convenience domain <NUM>. When the motor vehicle is not in mobility mode (i.e., not being driven, for example), the air-gap device <NUM> between the secure gateway <NUM> and the communication systems may allow data traffic between the convenience domain <NUM> to the mobility domain <NUM>. This may allow functionality such as service enquiries via an OBD port, remote vehicle diagnostics via the one or more telematics ECUs <NUM> and over-the-air (OTA) reflash. Further, when the one or more Powertrain ECUs <NUM>, the one or more chassis ECUs <NUM>, and the one or more ADAS ECUs <NUM> determine that the vehicle is in, or is about to, transition to mobility mode, the air-gap device <NUM> may be activated to physically isolate the one or more mobility ECUs <NUM> from the secure gateway <NUM>/data busses from the convenience domain <NUM>.

<FIG> shows a block diagram of a system in accordance with one or more embodiments. Specifically, <FIG> shows an example of a motor vehicle <NUM> including the mobility domain <NUM> and the convenience domain <NUM> distributed among various devices in different locations. The various locations may include a driver area <NUM>, a passenger area <NUM>, a front area <NUM>, or a rear area <NUM>. The mobility domain <NUM> and the convenience domain <NUM> may be separated by the air-gap device <NUM> performing the physical separation operations described in reference to <FIG> and <FIG>. The air-gap device <NUM> may be connected to a mobility control module <NUM> that monitors and controls movement of the motor vehicle by tracking an engine module <NUM>, a steering module <NUM>, cameras and radar modules <NUM>, and/or a brake module <NUM>. The mobility control module <NUM> may include the mobility ECUs <NUM> discussed in <FIG> associated to one or more modules in of the mobility domain <NUM>. The air-gap device <NUM> may be connected to a communication control module <NUM> that monitors and controls communication exchanged with the motor vehicle via a wireless communication module <NUM>, a wired communication module <NUM>, and/or a diagnostics module <NUM>. The communication control module <NUM> may include the ECUs controlled through the security gateway <NUM> discussed in <FIG> and associated to one or more modules in of the convenience domain <NUM>.

In one or more embodiments, a module, or sub-module, located at the front of the vehicle may include the same elements mirrored in the back of the vehicle. In one or more embodiments, the motor vehicle may be divided into the various locations including the driver area <NUM>, the passenger area <NUM>, the front area <NUM>, and the rear area <NUM>.

The front area <NUM> and the rear area <NUM> may be areas that any passenger does not have access through regular use of the motor vehicle. As such, these areas may include under and above the motor vehicle, under the hood at the front of the motor vehicle, or in the trunk at the back of the motor vehicle, respectively. This area may be larger in larger vehicles or vehicles that do not require a conventional engine, such as is the case with electric motor vehicles. In a hatchback vehicle, or a vehicle with the back or front exposed to the driver, this area may be considered as any area beyond the dashboard at the front or any area behind the back seats at the back.

The driver area <NUM> and the passenger area <NUM> may be any area that any passenger has access to at any point through regular use of the motor vehicle. For example, these area may include any area from the dashboard towards the direction of the driver and any area from the back seats towards the front of the car.

While <FIG> show various configurations of components, other configurations may be used without departing from the scope of the disclosure. For example, various components in <FIG> may be combined to create a single component (i.e., the secure gateway <NUM> may be modified to incorporate the air-gap device <NUM>). As another example, the functionality performed by a single component may be performed by two or more components (i.e., powertrain ECUs <NUM> may be incorporated into mobility ECUs <NUM>).

<FIG> shows an example of generating instructions to the air-gap device <NUM> based on information identified by ECUs in the mobility domain <NUM> and/or the convenience domain <NUM>. The instructions may be generated using a combination of ECUs in the mobility domain <NUM> and/or the convenience domain <NUM>. Similarly, the instructions may be generated using information collected by a computing system (described in reference to <FIG>) communicating with the air-gap device <NUM> through the mobility domain <NUM>. In some embodiments, a vehicle status <NUM> may start a process of generating the instruction. The vehicle status <NUM> may collect vehicle mobility information <NUM> from the mobility ECUs <NUM> and the secure gateway <NUM>. In this regard, the vehicle mobility information <NUM> may indicate mobility ECUs information <NUM> relating to one or more mobility markers for the mobility ECUs <NUM>. The mobility markers may be indicators showing a status for ECUs in the mobility domain <NUM>. Further, the vehicle mobility information <NUM> may indicate gateway status information <NUM> relating to one or more gateway markers for the security gateway <NUM>. The gateway markers may be indicators showing a status of the data busses exchanging communication information from ECUs in the convenience domain <NUM>.

<FIG> shows that after the vehicle mobility information <NUM> is processed, a log event recording <NUM> may use log event information <NUM> to identify a timestamp for enabling or disabling the air gap in the air-gap device <NUM>. In some embodiments, obtaining the timestamp may include further identifying an event information authentication <NUM> and an air-gap device type <NUM>. Once the event information authentication <NUM> and the air-gap device type <NUM> are identified, an air-gap enable/disable instruction <NUM> may be prepared. The event information authentication <NUM> may be identifying required busses or wired connection ports for reaching the air-gap device <NUM>. The air-gap device type <NUM> may be identifying a method for exchanging communication signals with the air-gap device <NUM> (e.g., connection ports are different between a mechanical relay or a solid-state relay).

The air-gap enable/disable instruction <NUM> may be confirmed using an air-gap device information <NUM> using a connectivity state <NUM> and a security state <NUM> by confirming that the air-gap device <NUM> is connected properly and in a secured manner, respectively. Once the air-gap enable/disable instruction <NUM> is confirmed as a possible control parameter, the secure gateway <NUM> confirms that the convenience domain <NUM> is ready for separating by the air gap. Specifically, a security gateway certification confirms that the security gateway <NUM> is ready to be connected/disconnected by coordinating other authentication protocols <NUM> and an air-gap authentication protocol <NUM>. The other authentication protocols <NUM> may include closing wireless communication protocols before enabling the air gap. The air-gap authentication protocol <NUM> may include identifying protocols required to disable the air gap to connect the mobility domain <NUM> and convenience domain <NUM>. At this point, when the protocols are completed, the ECUs/the computer system may instruct to perform enable/disable instruction <NUM> of the air gap in the air-gap device <NUM>.

<FIG> shows an example of a state sequence <NUM> in the communication network <NUM> performing enable/disable instructions one or more embodiments. <FIG> illustrates an automatic processing of closing/opening the air gap based on a state of identifying a vehicle in motion state <NUM> or a vehicle in a stopped state <NUM>. When the vehicle is identified to be in the vehicle in motion state <NUM> and the appropriate protocols have been performed as described in <FIG>, the air gap in the air-gap device <NUM> is opened through an air-gap enable instruction <NUM>. Further, when the vehicle is identified to be in the vehicle in stopped state <NUM> and the appropriate protocols have been performed as described in <FIG>, the air gap in the air-gap device <NUM> is closed through an air-gap disable instruction <NUM>. The changes between the multiple states may be performed automatically and without driver intervention. All control signals to the air-gap device <NUM> may be hardwired or encoded using hardware and/or software such that the states may transition without user (e.g., a driver, a passenger, or an occupant of the motor vehicle) interference.

<FIG> shows a flowchart in accordance with one or more embodiments. Specifically, <FIG> describes a method for isolating mobility systems from the mobility domain <NUM> when the motor vehicle <NUM> is in motion. One or more blocks in <FIG> may be performed by one or more components as described above in <FIG> (e.g., the multiple ECUs across mobility domain <NUM> and convenience domain <NUM>). While the various blocks in <FIG> are presented and described sequentially, one of ordinary skill in the art will appreciate that some or all of the blocks may be executed in different orders, may be combined or omitted, and some or all of the blocks may be executed in parallel. Furthermore, the blocks may be performed actively or passively.

In Block <NUM>, the vehicle status <NUM> of the motor vehicle <NUM> is obtained, the vehicle status <NUM> indicates whether the motor vehicle <NUM> is able to become mobile. For example, the mobility ECUs <NUM> may collect vehicle mobility information <NUM> to identify the status of the engine of the motor vehicle. This vehicle status <NUM> indicates whether the engine is activated (i.e., running). If the vehicle status <NUM> indicates that the motor vehicle <NUM> is in motion, the mobility ECUs <NUM> indicate that the motor vehicle is in a vehicle in motion state <NUM>. That is, Block <NUM> is the initiator to then proceed to determining the mobility state and that the vehicle status <NUM> (i.e., ignition on for an IC engine) would be a precursor to determining vehicle in motion via the mobility ECU(s) <NUM>. In an electric vehicle, this would be more generalized as powertrain status indicating "Powertrain ON" or "Powertrain OFF.

In Block <NUM>, a status of the air-gap device <NUM> is determined. The status of the air-gap device <NUM> indicates whether the air-gap device <NUM> is in a secured state. For example, the air-gap enable/disable instruction <NUM> may be triggered if the security state <NUM> indicates that the air-gap device <NUM> is secure according to the air-gap device information <NUM>. Thai is, the secured state indicates whether the air-gap device <NUM> is fully functional, diagnostically operational, and/or no faults have been triggered.

In Block <NUM>, various mobility parameters are identified corresponding to the mobility ECUs <NUM>. Each parameter from the various mobility parameters are separate and distinct from one another. Connections for various mobility ECUs may be sampled and a parameter relating to each of them may be identified. The parameter may include a status of the connection (i.e., on or off), an identifier indicating whether each mobility ECU has completed a separation protocol to enable the air gap.

In Block <NUM>, a mobility state is determined from the various mobility parameters. The mobility state is either vehicle in motion state <NUM> or vehicle in stopped state <NUM> such that the mobility state will be directly related to identifying that the parameters for the mobility ECUs <NUM> show that the mobility ECUs <NUM> are ready for separating from the security gateway <NUM>.

In Block <NUM>, a connectivity level requirement is determined based on the mobility state from block <NUM> and the air-gap device status from block <NUM>. As described above, the mobility state is related to confirming that the mobility ECUs <NUM> are ready for sending the instruction enabling the air gap in the air gap device <NUM>. The mobility state and the air-gap device state leads to obtaining the connectivity state <NUM> to generate the air-gap enable/disable instruction <NUM>.

In Block <NUM>, a security level requirement is determined based on the connectivity level requirement. At this stage, the connectivity state <NUM> is used along with the air-gap device information <NUM> to further determine the security state <NUM>.

In Block <NUM>, an air gap instruction is generated indicating whether to enable the air gap or to disable the air gap based on the security level requirement. As noted above, the air gap is structurally embedded in the air-gap device <NUM>. At this stage, various protocols are established by the security gateway certification <NUM> and the instruction determination information <NUM>. Once the protocols are met, the method moves to perform enable/disable instruction <NUM>.

Embodiments of the invention may be implemented using virtually any type of computing system, regardless of the platform being used. In some embodiments, the mobility ECUs <NUM> may be computer systems located in the mobility domain <NUM> or the convenience domain <NUM>. In some embodiments, the computing system may be a type of computing device or devices that includes at least the minimum processing power, memory, and input and output device(s) to perform one or more embodiments of the invention.

As shown in <FIG>, a computing system <NUM> may include one or more computer processor(s) <NUM>, non-persistent storage <NUM> (e.g., random access memory (RAM), cache memory, or flash memory), one or more persistent storage <NUM> (e.g., a hard disk), and numerous other elements and functionalities. The computer processor(s) <NUM> may be an integrated circuit for processing instructions. The computing system <NUM> may also include one or more input device(s) <NUM>, such as a touchscreen, keyboard, mouse, microphone, touchpad, electronic pen, or any other type of input device. Further, the computing system <NUM> may include one or more output device(s) <NUM>, such as a screen (e.g., a liquid crystal display (LCD), a plasma display, or touchscreen), external storage, or any other output device. One or more of the output device(s) may be the same or different from the input device(s). In one or more embodiments, for example, the input device <NUM> may be coupled to a receiver and a transmitter used for exchanging communication with one or more peripherals connected to a network system <NUM>. The receiver may receive information relating to one or more ECUs. The transmitter may relay information received by the receiver to other elements in the computing system <NUM>. Further, the computer processor(s) <NUM> may be configured for performing or aiding in implementing the processes described in reference to <FIG>.

The computing system <NUM> may be an ECU in the convenience domain <NUM> and connected to the network system <NUM> (e.g., a Controller Area Network (CAN), a local area network (LAN), a wide area network (WAN) such as the Internet, mobile network, or any other type of network) via a network interface connection (not shown). The network system <NUM> may be a cloud-based interface performing processing at a remote location from the motor vehicle and connected to the other elements over a network. For example, the computing system <NUM> may be the infotainment ECUs <NUM>, the body ECUs, <NUM>, or the telematics ECUs <NUM> in the convenience domain <NUM> and connected to the network system <NUM> through a remote connection established using a <NUM> connection, using protocols established in Release <NUM> and subsequent releases of the 3GPP/New Radio (NR) standards.

While <FIG> show various configurations of components, other configurations may be used without departing from the scope of the disclosure. For example, various components in <FIG> may be combined to create a single component. As another example, the functionality performed by a single component may be performed by two or more components.

Claim 1:
An air-gap device (<NUM>) for cyber isolating mobility systems when a vehicle is in motion, the air-gap device comprising:
a housing comprising a plurality of input ports and a plurality of output ports,
wherein the plurality of input ports comprise connections to a secure gateway (<NUM>) and
wherein the plurality of output ports comprise connections to one or more mobility Electronic Control Units, ECUs (<NUM>);
at least one pair of terminal contacts,
wherein the at least one pair of terminal contacts comprise a first terminal contact and a second terminal contact; and
an air gap embedded in the housing,
wherein the air gap is closed when the first terminal contact is in contact with the second terminal contact, and
wherein the air gap is open when the first terminal contact is not in contact with the second terminal contact,
wherein the air-gap device is instructed to open the air gap when the vehicle is determined to be in motion or about to be in motion.