Patent Description:
In particular, US patent application <CIT> discloses a method for detecting ground faults in a communications system. The method includes measuring a predetermined number of voltage points; determining if the measured voltage points represent recessive or dominant bits; identifying which of the predetermined number of voltage points represent inter-frame bits and which represent frame data bits based on whether the measured voltage points are recessive or dominant; calculating a maximum average voltage for the inter-frame bits; calculating an average frame voltage for all dominant bits within a frame; determining a high average dominant voltage count based on a number of frames for which the average frame voltage is greater than a high voltage threshold; and determining if a ground fault exists based on the average frame voltage and the high average dominant voltage count. Additionally, <CIT> discloses a method of repairing communication disruption using a gateway, and an apparatus and a system therefor. A method of repairing communication disruption in a gateway includes detecting whether failure in a communication line occurs by monitoring a change in voltage of the communication line, successively transmitting communication line disconnection request signals to first to Nth smart joint blocks when the occurrence of the communication line failure is detected, and determining whether the communication line failure is repaired after transmitting the communication line disconnection request signals. The communication line failure may be repaired by identifying a smart joint block causing the failure according to a result of the determination.

In one aspect, a plurality of voltage lines of at least one electronic control unit (ECU) are monitored. The ECU is electrically coupled to a communications bus. At least one of a motor vehicle, a ship, an airplane, or a train can comprise the communications bus. A voltage differential across at least two of the plurality of voltage lines of the at least one ECU is measured. The voltage differential is compared to a plurality of predetermined signal fingerprints associated with the at least one ECU. Based on the comparing, a variance in the compared voltage differential relative to one or more of the plurality of predetermined signal fingerprints is identified. Data characterizing the identified variance can be provided by causing an alert to trigger, transmitting a fault state message corresponding to the data to the communications bus, causing the blockage of communication between the communications bus and the at least one ECU, or transmitting the data to a remote computing device.

In some variations, during an imprint mode of the at least one security module, a voltage line can be measured. A signal fingerprint associated with one ECU can be determined by comparing the measured voltage line to an ideal voltage associated with the measure voltage line. The signal fingerprint can be provided and stored into memory. The plurality of predetermined signal fingerprints comprises signals of transceiver components of the at least one ECU.

In other variations, the communications bus comprises a serial communications bus. The serial communications bus can be a controller area network (CAN) bus and the at least two voltage lines can be, for example, either a CAN high voltage line or a CAN low voltage line and a ground line.

In some variations, a vehicle control network comprises the communications bus. The vehicle control network can include (i) at least one ECU electrically coupled between the communications bus and a plurality of nodes, (ii) at least one security module electrically coupled between the at least one ECU and the communications bus, and (iii) at least a portion of the communications bus.

In other variations, the monitoring is initiated upon at least one of during operation of the at least one security module, after replacement of the at least one security module, during a loss of clock synchronization of the at least one security module, during a predetermined clock synchronization time window, or after replacement of the at least one ECU.

In some variations, the at least one security module comprises a data processor, a microcontroller, one or more transceivers, a clock, a power regulator, a transmitter, and an analog-to-digital (AD) sampler.

In other variations, at least one of a motor vehicle, a ship, an airplane, or a train comprises the communications bus.

In another aspect, a plurality of voltage lines of at least one ECU are monitored. A voltage differential across at least three of the plurality of voltage lines of the at least one ECU is measured. A data stream is injected into the communications bus via at least two voltage lines based on the measured voltage differential having an amplitude lower than a predetermined voltage threshold.

In some variations, the data stream can be a half-duplex data stream. The predetermined threshold comprises an absolute value of a summation of a first voltage range of one voltage line and a second voltage range of another voltage line.

In another aspect, a plurality of voltage lines of at least one ECU are monitored. A voltage differential across at least two of the plurality of voltage lines of the at least one ECU is measured. A pulse is injected into the communications bus via one of the plurality of voltage lines based on the measured voltage differential having an amplitude lower than a predetermined voltage threshold.

Similarly, computer systems are also described that may include one or more data processors and memory coupled to the one or more data processors, at least a portion of a communications bus, at least one ECU electrically coupled between a plurality of nodes and the portion of the communications bus, and at least one security module comprising at least one data processor. Such computing systems can be connected and can exchange data and/or commands or other instructions or the like via one or more connections, including but not limited to a connection over a network (e.g., the Internet, a wireless wide area network, a local area network, a wide area network, a wired network, or the like), via a direct connection between one or more of the multiple computing systems, etc..

The subject matter described herein provides many technical advantages. For example, the current subject matter provides an un-modifiable trusted hardware unit for the analysis and defense of a connected network that compromised controllers which belong to that network may otherwise be unable to access or affect. This platform can be utilized, for example, by vehicle manufacturers to provide a flexible, modular, and scalable security capability for use across their models without the need to design security solutions for each vehicle platform. Moreover, the security platform can utilize encrypted and signed over-the-air (OTA) or V2X communications methods to allow original equipment manufacturers (OEMs) to change or update the security features and capabilities of the vehicle platform without the need to recall the vehicle or change hardware in depot. Alternatively, there are many other non-vehicle environments which utilize communications buses to send and receive information amongst components within and/or outside, ranging from medical devices to industrial control systems, that can provide for identification of and protection from compromises such as malicious attacks.

The current subject matter is directed to techniques for protecting vehicle control and/or communications equipment and networks from alteration or malicious modification, through hardware and software platforms connected to one or more ECUs. A hardware module can be connected to or embedded on the ECU whereby creating a point for communications centralization and security posture assessment. Such a platform can provide defensive capabilities such as communications encryption, attack detection and prevention, ECU fingerprinting and authentication, message modification prevention, message activity recording, and a next-generation firewall. The platform can also provide awareness of an attack or compromise, control communications from the affected module to the network, and defend other ECUs on the network. In addition, the security platform can be used to monitor human-machine interfaces and third party firmware within the vehicle for integrity and malicious modification, reporting this to the user or external security personnel.

<FIG> is a system diagram <NUM> illustrating an example logical system architecture for use in connection with the current subject matter. A network <NUM> can include one or more ECUs <NUM>. Each ECU <NUM> can communicate with one or more nodes <NUM>. Nodes <NUM> can be, for example, external communication nodes (i.e., Bluetooth, Wi-Fi, Cellular, NFC, etc.), and/or vehicle sensors or actuators within the physical boundaries of the vehicle frame. In addition, a vehicle may also utilize connections to OEM or secondary monitoring services over the Internet via nodes <NUM>. Each ECU can be electrically coupled to a communications bus / network interface <NUM>.

The hardware protection framework can be used for a variety of different applications for protection of a network. One example is in connection with motor vehicles. Modern motor vehicles, for example, utilize an on-board diagnostics (OBD) standard to monitor, control, and/or diagnose a variety of vehicle aspects from engine control to accessory components. A CAN bus is a serial communications network bus used by some motor vehicles that allows for microcontrollers and other devices within the vehicle to communicate with one another.

Security zones can be established to provide a protection framework for one or more ECUs <NUM> and one or more nodes <NUM>. A single security module <NUM> can be electrically coupled to a single ECU <NUM>. That single ECU <NUM> can be connected to one or more nodes <NUM>. A security zone can be established by grouping together multiple security modules <NUM> having a one to one correlation with a corresponding ECU <NUM> (i.e., security zone Z). Alternatively, a security zone can be established to include a single security module <NUM> correlated to a single ECU <NUM> (i.e., security zone Y). Establishing of security zones can occur during installation of the one or more security modules <NUM> and can be based on the aspects of the security protection framework.

Message traffic on data bus <NUM> can be encrypted such that the message security zone origination or destination can be identified. For example, the message traffic along communications bus / network interface <NUM> can identify if the origin of such traffic is from an ECU <NUM> belonging to security zone X or alternatively from ECU <NUM> belonging to security zone Y.

In one variation, security module <NUM> can be integrated within the ECU (not shown). The physical connection between security module <NUM> and ECU <NUM> can differ based on the particular ECU being connected. However, the logical connections between security module <NUM> and ECU <NUM> can be uniform across varying ECU types.

Alternatively, in another variation, security module <NUM> can be an external interposer board electrically coupled external to the ECU <NUM>, between the ECU <NUM> and communications bus / network interface <NUM>. In this variation, the ECU <NUM> can be physically disconnected from its communication bus <NUM> connection as security module <NUM> has a physical connection between the communications bus / network interface <NUM> and ECU <NUM>.

One or more security modules <NUM> can communicate with each other via message traffic along path A. Security modules <NUM> can communication with communications bus / network interface <NUM> via path B. Each ECU can communicate with its respective connected security module <NUM> via path C. The communication between one or more security modules <NUM> can be an out of band communication along communications bus / network interface <NUM>. Path A indicates a logical connection that is routed over the physical communication bus <NUM>. Cross-communication information (i.e., information decipherable by the security modules) between one or more security modules <NUM> can be exchanged along path A. Path B represents a physical connection to communications bus / network interface <NUM>. Path C indicates a logical connection between one or more security modules <NUM> and one or more ECUs <NUM>.

<FIG> is a system diagram <NUM> illustrating another example logical system architecture for use in connection with the current subject matter. In some variations, a single security module <NUM> can be configured to communicate with multiple ECUs <NUM> using a cryptographic interface of security module <NUM>. This one to many mapping can form part of a security zone (i.e., security zone Z).

<FIG> is a system diagram <NUM> illustrating a logical integration of security module <NUM> with one ECU of a system <NUM>. Security module <NUM> can include a variety of components which can monitor, interpret, and/or inject data of communications bus / network interface <NUM>. The components of security module <NUM> can include, for example, a processor <NUM>, a hashing encryption chip <NUM>, a memory <NUM>, a clock <NUM>, a microcontroller <NUM>, one or more transceivers <NUM>, <NUM>, a failsafe module <NUM>, a power regulator <NUM>, a sideband transmitter <NUM>, and an AD sampler <NUM>. Processor <NUM> can be a general-purpose security processor that can perform calculations and logic operations required to execute operations described herein. A non-transitory processor-readable storage medium, such as memory <NUM> which can be an encrypted flash memory, can be in communication with the microcontroller <NUM> and can include one or more programming instructions for the operations specified herein. For example, memory <NUM> can store one or more signal fingerprints of ECU <NUM>. Programming instructions can be encrypted using hashing encryption chip <NUM>. Hashing encryption chip <NUM> can also encrypt message traffic along paths A, B, and/or C. Microcontroller <NUM> can be regulated by clock <NUM>. Clock <NUM> can be a high-precision clock that is synchronized based on bus initialization or upon determining that synchronization has been lost. A predetermined time synchronization window can be set for clock <NUM>. Microcontroller <NUM> can also include a memory (not shown) for performing various operations specified herein.

Microcontroller <NUM> can receive instructions provided by processor <NUM> in order to operate the one or more transceivers <NUM>, <NUM>. Transceiver <NUM> can be a CAN transceiver that receives data bus information from communications bus / network interface <NUM> that is first filtered through an AD sampler <NUM>. The AD sampler <NUM> can obtain a high-resolution fingerprint of a sending transceiver of one or more ECUs <NUM>. Transceiver <NUM> can also be a CAN transceiver. Transceiver <NUM> can be electrically coupled to the ECU <NUM> and can received data bus information from communications bus / network interface <NUM> that is first filtered through an AD sampler <NUM>. Transceivers <NUM>, <NUM> can be discrete and can each communicate with failsafe module <NUM>. Sideband transmitter <NUM> can communication with microcontroller <NUM> and transceiver <NUM>.

Some components of security module <NUM> can be interconnected with system <NUM>. In one example, system <NUM> can be a vehicle such as a motor vehicle, plane, train, and/or a ship. System <NUM> can also be any other non-traditional system having a communications bus / network interface <NUM>. System <NUM> can include communications bus / network interface <NUM>, one or more ECUs <NUM>, can have a battery voltage (VBAT) <NUM> and a ground (GND) <NUM>. Transceiver <NUM> can be electrically coupled to ECU <NUM> in order to exchange message traffic with ECU <NUM>. AD sampler <NUM> can be electrically coupled to communications bus / network interface <NUM>. Security module <NUM> can be powered through electrical couplings with system <NUM>. For example, power regulator <NUM> can be electrically coupled to the battery voltage <NUM> and grounded by ground <NUM>. As a result, security module <NUM> can be operative based on the power provided by the system <NUM>.

<FIG> is an example amplitude versus time plot <NUM> of an ECU signal fingerprint of a vehicle. For visual purposes only, the time axis (i.e. x-axis) of plot <NUM> is arbitrary and has no associated units. ECU <NUM> can include a CAN high voltage line and a CAN low voltage line which are each electrically coupled to a CAN bus (i.e., communications bus / network interface <NUM>). The nominal voltage of an example CAN high voltage line is illustrated as plot line <NUM>. The nominal voltage of an example CAN low voltage line is illustrated as plot line <NUM>. ECU <NUM> can contain a transceiver which communicates with communications bus / network interface <NUM>. A voltage differential across the CAN high voltage line and the CAN low voltage line relative to a ground line of ECU <NUM> can be measured to determine a unique transceiver identity. Such a unique transceiver identity can be, for example, of a transmitter within the transceiver. While the ideal model of the CAN bus' signaling is a direct differential voltage separation of either <NUM> V or <NUM> V on the CAN high and CAN low lines, each transceiver of one or more ECUs <NUM> on the communications bus / network interface <NUM> has unique transmission elements. For example, the transceiver contains electrical components such as resistors and capacitors which have unique electrical characteristics. The excitation phase of the transmission has a unique charge, discharge, and associated waveform characteristics that can be used to generate a signal fingerprinting of the transceivers of each ECU <NUM> on the communications bus / network interface <NUM>.

Based on tolerance values of the transceiver components, the micro-excitation values are unique within a tolerance of about <NUM> to <NUM> percent. The excitation time of a given transceiver is relatively unique on a given communications bus / network interface <NUM>. Signal fingerprints of each transceiver can be defined in terms of signal changes in amplitude relative to time on the communications bus / network interface <NUM>. For a CAN bus application, the CAN bus does not look at these micro-excitation states as they are relatively unique to each transceiver and bus configuration. As a result, these micro-excitation states can be used to identify and determine which transceiver of one or more ECUs <NUM> is actively transmitting.

Signal fingerprints can be predetermined by security module <NUM> during an imprint mode. For example, the imprint mode can be entered during replacement of one or more ECUs <NUM>. Security module <NUM> can measure actual voltages associated with the CAN high (i.e., plot line <NUM>) and CAN low (i.e., plot line <NUM>) voltage lines. As depicted in <FIG>, comparing the measured voltages of CAN high (i.e., plot line <NUM>) with the ideal voltage associated with the CAN high (i.e., plot line <NUM>), the micro-excitations can be seen as small variances are present in the excitation and drain states. Similar variances can be observed when comparing the measured voltage of the CAN low (i.e., plot line <NUM>) and the ideal voltage of the CAN low (i.e., plot line <NUM>) voltage lines. These variances determine a signal fingerprint and are stored into memory (i.e., memory <NUM>) for later comparisons.

During a monitoring mode, the CAN high and CAN low voltages lines can be continuously monitored while ECU <NUM> and/or security module <NUM> is energized. Such monitoring, for example, can be initiated during start-up of a vehicle, during a loss of clock synchronization of the at least one security module, during a predetermined clock synchronization time window, after replacement of security module <NUM>, or after replacement of ECU <NUM> once imprint mode has completed. A measured voltage differential across the CAN high and CAN low voltages lines relative to a ground of ECU <NUM> can be compared to the predetermined signal fingerprint that was measured and stored during imprint mode. Variances within this comparison can identify, for example, that signal transmission between ECU <NUM> and communications bus / network interface <NUM> has been compromised (i.e., via an internal or external attack). Based on this compromised determination, security module <NUM> can block signal transmissions to ECU <NUM>, cause an in-vehicle alert to trigger, transmit a fault state message corresponding to the compromise determination to the communications bus / network interface <NUM>, and/or transmit the compromise determination to a remote computing device.

Data characterizing this variance can be provided in a variety of ways. For example, the data can cause an in-vehicle alert to trigger and/or a fault state message can be transmitted to communications bus / network interface <NUM>. A remote computing device external to the vehicle (i.e., external source monitoring the state of the vehicle) can also be sent data characterizing the variance.

<FIG> is an example amplitude versus time plot <NUM> of an injected data stream on two differential signaling lines (i.e., CAN high <NUM> and CAN low <NUM>). For visual purposes only, the time x-axis of plot <NUM> is arbitrary and has no associated units. The CAN bus allows for differential signaling on two voltage lines which can include the CAN high and CAN low lines of the bus. The CAN bus also defines the state of bits transferred on the communications bus / network interface <NUM> to be either dominant (<NUM>) or recessive (<NUM>). These states correspond to the states of the CAN high and CAN low voltage lines. For example, a relative voltage of CAN low voltage line (i.e., plot line <NUM>) can be <NUM> V for the dominant state. The relative voltage for the dominant state of a CAN high voltage line (i.e., plot line <NUM>) is <NUM> V For the recessive state, a relative voltage for the CAN low voltage line (i.e., plot line <NUM>) is <NUM> V and the relative voltage for the CAN high voltage line is <NUM> V.

A voltage differential can be measured across the CAN high and CAN low voltage lines relative to a ground line of the ECU <NUM>. Additional data can be injected onto either the CAN high or CAN low voltage lines. While this additional data can be perceived by the CAN bus as noise, one or more security modules <NUM> can interpret and send data that is essentially transparent to the CAN bus. For example, input data stream <NUM> can be injected at low speeds and encoded onto an existing CAN bus differential bit stream via either the CAN high <NUM> or CAN low <NUM> voltage lines. Data stream <NUM> can be injected by security module <NUM> into a CAN bus for a given ECU <NUM> without adding additional electrical connections to the bus. The injected data can also be within normal signaling voltages of the voltages lines the data is injected into.

In one example, data stream <NUM> can be a <NUM> V data stream. Data stream <NUM> can be injected into the CAN high voltage line (i.e., plot line <NUM>) which results in a modifying data stream of the CAN high voltage line as shown in CAN high with data (i.e., plot line <NUM>). Data stream <NUM> can be made up of, for example, a series of micro-pulses. Similarly, data stream <NUM> can be injected into the CAN low voltage line (i.e., plot line <NUM>) which results in a modified data stream of the CAN low voltage line as shown in CAN low with data (i.e., plot line <NUM>). By adding in a moderate resolution clock provided by clock <NUM> and synchronization protocols, both CAN high with data (i.e., plot line <NUM>) and CAN low with data (i.e., plot line <NUM>) are additional half duplex data streams added onto the CAN bus.

The resulting CAN high with data (i.e., plot line <NUM>) and CAN low with data (i.e., plot line <NUM>) data streams operate at a substantially higher frequency than the CAN bus signaling. The resulting data stream(s) provide for a larger tolerance for bus noise at any given point in time. Adding in forward error correction, the bus noise can be addressed by the higher bandwidth of the bit stream to address noise versus the differential signaling mechanism. This can result in preservation of the original content of the CAN bus messaging protocols, while adding an additional data stream <NUM>.

<FIG> is an example amplitude versus time plot <NUM> of an injected data stream on a single differential signaling line. For visual purposes only, the time x-axis of plot <NUM> is arbitrary and has no associated units. Using time domain synchronized pulses of a lower voltage than the signaling voltage on the CAN bus can provide a way to send information that is outside of the normal signaling mechanism used on the CAN bus. This allows for transferring of a bit stream that is different than the normal bit stream sent across the CAN bus by differential signaling on the CAN high and CAN low lines. The voltage of the micro-pulses is low enough that it does not interfere with the normal signaling on the CAN bus.

According to the invention information is encoded by security module <NUM> and injected into the CAN bus using low voltage pulses relative to CAN bus ground. The low voltage pulses, for example, can be transmitted at substantially short intervals (i.e., micro-pulses) using a high-precision clock oscillator (i.e., clock <NUM>). The pulses can be encoded using a forward error correction approach by expanding the data message of the existing data stream and inserting accumulative parity information into the pulses such that data loss of over <NUM>% can be tolerated and recovered from. Through incorporating the forward error correction, signal corruption caused by, for example, electrical noise and/or bus line state changes can be accounted for.

For example, a pulse <NUM> can be injected into the CAN high voltage line (i.e., plot line <NUM>) resulting in a CAN high with data (i.e., plot line <NUM>). The signaling mechanism is also applicable to only one CAN bus line (CAN high or CAN low), but could also be used across both voltage lines to create full-duplex communications.

<FIG> is an example process flow diagram for monitoring communications signal bus fingerprints. A plurality of voltage lines of at least one ECU electrically coupled to a communications bus can be monitored, at <NUM>. A voltage differential across two of the plurality of voltage lines of at least one ECU can be measured, at <NUM>. One of the at least two voltage lines can include a ground line. The measured voltage differential can be compared, at <NUM>, to a plurality of predetermined signal fingerprints associated with the at least one ECU. A variance in the compared voltage differential can be identified, at <NUM>, relative to one or more of the plurality of predetermined signal fingerprints. Data characterizing the identified variance can be provided, at <NUM>.

<FIG> is an example process flow diagram <NUM> for communications signal bus fingerprinting. A voltage line of at least one ECU is measured, at <NUM>, during an imprint mode of the security module. A signal fingerprint associated with the ECU is determined, at <NUM>, by comparing the measured voltage line to an ideal voltage associated with the measured voltage line. Data characterizing the signal fingerprint is provided, at <NUM>.

<FIG> is an example process flow diagram <NUM> of communications bus data transmission using relative ground comparison techniques. A plurality of voltage lines of at least one ECU electrically coupled to a communications bus can be monitored, at <NUM>. A voltage differential can be measured, at <NUM>, across at least three of the plurality of voltage lines of at least one ECU. A ground line can be one of the plurality of voltage lines. A data stream can be injected, at <NUM>, into the communications bus via at least two of the at least three voltage lines based on the measured voltage differential having an amplitude lower than a predetermined voltage threshold. The predetermined threshold can comprise an absolute value of a summation of a first voltage range of the high voltage line and a second voltage range of the low voltage line.

<FIG> is an example process flow diagram <NUM> of communications bus data transmission analysis and recovery using microburst transmissions and high-accuracy clocks. A plurality of voltage lines of at least one ECU electrically coupled to a communications bus can be monitored, at <NUM>. A voltage differential can be measured, at <NUM>, across at least two of the plurality of voltage lines of at least one ECU. A pulse can be injected, at <NUM>, into the communications bus via one of the at least two voltage lines based on the measured voltage differential having an amplitude lower than a predetermined voltage threshold. The predetermined threshold can comprise a voltage range of the one of the plurality of voltage lines.

The programmable system or computing system can include clients and servers.

As used herein, the term "computer-readable medium" refers to any computer program product, apparatus and/or device, such as for example magnetic discs, optical disks, memory, and Programmable Logic Devices (PLDs), used to provide machine instructions and/or data to a programmable processor, including a computer-readable medium that receives machine instructions as a computer-readable signal. The term "computer-readable signal" refers to any signal used to provide machine instructions and/or data to a programmable processor. The computer-readable medium can store such machine instructions non-transitorily, such as for example as would a non-transient solid-state memory or a magnetic hard drive or any equivalent storage medium. The computer-readable medium can alternatively or additionally store such machine instructions in a transient manner, for example as would a processor cache or other random access memory associated with one or more physical processor cores.

Claim 1:
A system comprising:
at least a portion of a communications bus (<NUM>);
at least one electronic control unit, ECU, (<NUM>) electrically coupled between a plurality of nodes and the portion of the communications bus (<NUM>);
at least one security module (<NUM>) comprising at least one data processor, the at least one security module (<NUM>) electrically coupled to the at least one ECU (<NUM>) and the portion of the communications bus (<NUM>); and
memory-storing instructions, which when executed by at least one data processor result in operations comprising:
monitoring, by at least one data processor of at least one security module (<NUM>), a plurality of voltage lines of at least one electronic control unit, ECU, (<NUM>) electrically coupled to a communications bus (<NUM>), the communications bus (<NUM>) comprising a serial communications bus, wherein serial communications bus comprises a controller area network (CAN) bus and wherein the at least two of the plurality of voltage lines comprises either a CAN high voltage line or a CAN low voltage line and a ground line;
measuring, by at least one data processor, a voltage differential across at least two of the plurality of voltage lines of the at least one ECU (<NUM>);
comparing, by at least one data processor, the voltage differential to a plurality of predetermined signal fingerprints associated with the at least one ECU (<NUM>);
identifying, by at least one data processor and based on the comparing, a variance in the compared voltage differential relative to one or more of the plurality of predetermined signal fingerprints; and
providing, by at least one data processor, data characterizing the identified variance, wherein information is encoded by the at least one security module (<NUM>) and injected into the CAN bus using low voltage pulses relative to CAN bus ground.