Patent Description:
This application relates to internal bus systems of various devices or systems that are connectable to external networks.

Many devices and systems today include a number of mission critical devices or systems and a number of peripheral devices or systems that are commonly connected through a centralized bus system such that the devices and systems can communicate with each other. As used herein, peripheral devices or systems refers to those devices or systems with an external connection. Such external connections may be through physical connection (e.g., USB connectors, on-board diagnostic (OBD) connectors, etc.) or through the Internet or other various networks (e.g., LTE, Wi-Fi, Bluetooth, LAN, etc.). Examples of devices and systems that use centralized bus systems to connect peripheral devices and mission critical devices include, but are not limited to, transportation devices (e.g., automobiles, naval vessels, aircraft, trains, etc.), heavy industry, etc. are equipped with modem centralized bus systems.

The general functionality and purpose of such centralized bus systems is to create a single bus system for all the technology devices and systems used in a particular system or device (e.g., in an automobile) such that the technology can communicate with each other to share data and exchange information. In the example of an automobile, peripheral devices or systems may include entertainment systems, navigation systems, alarming systems, diagnostic systems, etc., and mission critical devices or systems may include the engine, brakes, accelerator, fuel injector, etc..

Because all of the technology devices and systems are commonly connected with the central bus system, it is possible to remotely hijack or remotely access one of the devices or systems and gain access to the central bus system, and, from that access, proceed to access and control other technology devices and systems. For example, with an automobile, a hacker may access the central bus system completely remotely through an external network connection of one of the peripheral devices such as a mobile phone in the car, the entertainment system, the navigation system, the radio, etc. Additionally or alternatively, the hacker may "plug in" to the bus system through some hardware of the transportation device (such as an OBD connector in an automobile). As a result, it is possible for a hacker to break into the central bus system and potentially turn the device into a weapon by remotely increasing the speed of the transportation device, disabling the brake system, etc..

<CIT> discloses an automotive ECU architecture with two separate buses, one for critical systems and another for non-critical systems. The two buses are connected by a firewall/gateway, which applies a set of rules and filters to control the flow of information between the two.

<CIT> teaches protecting safety-critical automotive ECUs by having multiple communication buses isolated by gateways/bridges applying a set of rules to control the flow of information, which may potentially be malicious.

According to certain embodiments of the present invention, a bus emulator device includes a first computer, a second computer, and an information interface. In some embodiments, the first computer is configured to connect to a main bus system, the first computer includes only write access into the information interface, and the second computer includes only read access into the information interface.

In various embodiments, the main bus system includes at least one mission critical system, and the second computer is configured to simulate the at least one mission critical system In an emulated bus system. In some cases, the emulated bus system includes at least one peripheral system connectable to an external network. In certain aspects, the bus emulator device includes a tact generator, and the first computer, the second computer, and the information interface run on the tact generator.

According to certain embodiments of the present invention, a system includes a first bus system, a second bus system, and a bus emulator device connected to the first bus system and the second bus system. In certain embodiments, the bus emulator device physically isolates the first bus system from the second bus system.

In some embodiments, the first bus system is a main bus system having at least one mission critical system, and the second bus system includes at least one peripheral system connectable to an external network and an emulated system simulating the at least one mission critical system.

According to certain embodiments of the present invention, a bus system includes a first system and a second system. In some embodiments, the first system is at least one physical system, and the bus system is directly connected to the at least one physical system. In various embodiments, the second system is an emulated system including at least one simulation of a third system.

According to certain embodiments of the present invention, a bus emulator device includes an information interface. The bus emulator device may be configured to connect to a main bus system and an emulated bus system, and the information interface may define a one-way data exchange between the main bus system and the emulated bus system.

According to certain embodiments of the present invention, a bus emulator device includes a first computer, a second computer, and an information interface. In some embodiments, the first computer is configured to connect to a main bus system, the first computer includes at least write access into the information interface, and the second computer comprises only read access into the information interface. In certain embodiments, the first computer also includes read access into the information interface.

According to certain embodiments of the present invention, a bus emulator device includes a first computer, a second computer, and an information interface. In various embodiments, the first computer is configured to connect to a main bus system, the first computer includes only write access into the information interface, and the second computer includes at least read access into the information interface. In some embodiments, the second computer also includes write access into the information interface.

According to certain embodiments of the present invention, a bus emulator device includes a first computer, a second computer, an information interface, and an additional memory. In certain aspects, the first computer is configured to connect to a main, bus system, and the first computer includes at least write access into the information interface. In various embodiments, the second computer includes only read access into the information interface. In some embodiments, the first computer has no access to the additional memory, and the second computer includes read access and write access into the additional memory.

Various implementations described herein can include additional systems, methods, features, and advantages, which cannot necessarily be expressly disclosed herein but will be apparent to one of ordinary skill in the art upon examination of the following detailed description and accompanying drawings. It is intended that all such systems, methods, features, and advantages be included within the present disclosure and protected by the accompanying claims.

The subject matter of embodiments of the present invention is described here with specificity to meet statutory requirements, but this description is not necessarily intended to limit the scope of the claims. The claimed subject matter may be embodied in other ways, may include different elements or steps, and may be used in conjunction with other existing or future technologies. This description should not be interpreted as implying any particular order or arrangement among or between various steps or elements except when the order of individual steps or arrangement of elements is explicitly described.

Certain embodiments of the present invention provide a bus emulator device that includes at least two independent computers that may or may not share memory or part of memory (i.e., at least a first independent computer and a second independent computer) and at least one independent physical memory (or "information interface"). The first independent computer is connectable to the central or main bus system (also called a "hot-bus") of the transportation device and the second independent computer emulates a bus similar to the main bus system (also called an "emulated bus system" or a "cold bus"). There is no direct connection from the main bus ("hot bus") to the open Internet, open Wi-Fi or any other open network. In some examples, the main bus may have a controlled secure network connection (e.g., to an emergency network).

The first independent computer (connected to the main bus system) (also called the "main computer") has full access to the main bus and the information on the main bus. The second independent computer (also called the "emulation computer") has only read access to the information of the first independent computer that is connected to the main bus. The second independent computer can read current and past status information from the main computer but he cannot modify the information. This configuration of the second independent computer may be achieved in a number of different ways. As one non-limiting example, the emulation computer may have read access to parts of the memory of the main computer (but does not have delete / modify / write rights). As another non-limiting example, the emulation computer may get the information from the main computer as a request from the emulation computer or automatically (i.e., a push from main computer). With this information of the main computer, the emulation computer emulates the main bus, meaning that the emulation computer builds up a "virtual" bus that looks exactly like the main bus. External devices and services may access this emulated bus instead of the main (hot) bus. This allows all external services (navigation, diagnostic, convenient services etc.) to obtain the information they need from the vehicle to deliver their services, but without the capability to modify this information directory. This dramatically lowers the risk for the vehicle to be hijacked and/or manipulated by external sources. Various other suitable configurations may be utilized.

In the event that external services need to share information with the main bus, they can modify the information in the emulated bus only. In such examples, the main computer (hot computer) can read out this information and check the information for plausibility and safety. In some cases, if the information is safe and passes all safety and security tests, the main computer has the capability to use this information in the hot bus system. In this manner, updates for traffic conditions on the navigation system or other updates are still possible.

When the bus emulator device is installed with a device having a main bus system (e.g., in an automobile, ship, aircraft, etc.), the first independent computer connects with the main bus system. Any number of critical devices or systems are connected to the main bus system including, but not limited to, the engine, brakes, accelerator, suspension, fuel injection, steering, power steering, navigation, identification (e.g., transponders), etc. While the first independent computer is connected with the main bus system, the first independent computer writes (in real time or as otherwise desired) all needed data or information from those critical devices or systems (e.g., engine conditions, motor parameters, speed, etc.) into the information interface. The second independent computer (handling the emulated bus system) reads this data from the information interface (in real time or as otherwise desired) and uses the read data to emulate the main bus system in the emulated bus system. In various aspects, the emulated bus system may look the same as the main bus system but without a physical connection into the main bus system. Additional peripheral devices or systems including, but not limited to, smart navigation systems, entertainment systems, internet access systems, OBD connectors, interfaces with USB connectors, mobile phone connections, alarming systems, etc., are physically connected to the emulated bus system and do not have any physical connection to the main bus system.

The bus emulator systems and devices described herein provide a cost-efficient and cost-effective solution to increase safety of central bus systems of devices and can be integrated without major modification to new and existing central bus systems.

In one example, a system according to aspects of the current disclosure creates a second bus system to separate mission critical systems from other systems that may have additional connection. In other aspects, the system physically isolates the mission critical bus system of a vehicle, vessel, plane or any other device / industrial unit.

<FIG> is a diagram illustrating an example of a bus emulator device <NUM> provided in a transportation device <NUM>. As illustrated, the transportation device <NUM> includes one or more mission critical systems or devices 104A-F. In some non-limiting examples, mission critical systems or devices <NUM> may include, but are not limited to, the engine, brakes, accelerator, fuel injector, etc. In other examples, the mission critical systems or devices <NUM> may be different devices or systems, and the listed mission critical devices or systems or the characterization of devices or systems as "mission critical" should not be considered limiting on the current disclosure. The number of mission critical devices <NUM> should not be considered limiting on the current disclosure. The transportation device <NUM> may also include one or more peripheral systems or devices 106A-F. In some non-limiting examples, peripheral devices may include, but are not limited to, navigation systems, radio, USB connectors, OBD connectors, entertainment systems, alarm systems, etc. In other examples, the peripheral systems or devices <NUM> may be different devices or systems, and the listed peripheral devices or systems or the characterization of devices or systems as "peripheral" should not be considered limiting on the current disclosure. The number of peripheral devices <NUM> should not be considered limiting on the current disclosure. The mission critical devices 104A-F are connected into a main bus system <NUM> such that a normal exchange of data and information among the mission critical devices <NUM> is possible. In certain examples, the peripheral devices 106A-F are connected to the bus emulator device <NUM> such that they have read access to the information of the main bus system <NUM> (from the mission critical devices) but cannot modify the information. In some examples, the peripheral devices <NUM> are not physically connected into the main bus system <NUM>.

The bus emulator device <NUM> includes a first independent computer <NUM>, a second independent computer <NUM>, and the independent physical memory or information interface <NUM>. While a single bus emulator device <NUM> is illustrated, it will be appreciated that any number of devices <NUM> could be utilized. In some cases, each mission critical device <NUM> may have a dedicated emulator, although it need not in other examples. In various examples, the computer <NUM>, the computer <NUM>, and the information interface <NUM> run on the same tact generator, although they need not in other examples.

The first independent computer <NUM> may be associated and in communication with Boot ROM <NUM> and a memory subsystem <NUM>. Similarly, the second independent computer <NUM> may be associated and in communication with Boot ROM <NUM> and a memory subsystem <NUM>. The independent computers <NUM>, <NUM> may be general purpose processing units, processors specially designed for the bus emulator, a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a microprocessor, etc..

The information interface <NUM> and memory subsystems <NUM>, <NUM> may include a long-term storage memory and/or a short-term working memory and may be various suitable types of computer-readable medium including, but not limited to, include magnetic disks, memory chips, ROM, random-access memory (RAM), an ASIC, a configured processor, optical storage, or any other medium from which a processor can read the instructions. In some cases, the information interface <NUM> is shared memory where the first independent computer <NUM> has at least write capabilities (and optionally has read capabilities) and the second independent computer <NUM> only has read capabilities. In this example, the information interface <NUM> may always include the information from the hot bus system <NUM> (via the first independent computer <NUM>) so that the second independent computer <NUM> can read the information to emulate the cold bus system <NUM>. In other examples, the information interface <NUM> may be a memory that is only controlled by the second independent computer <NUM>, and the second independent computer <NUM> may use it to directly emulate the cold bus system <NUM>. In these examples, the second independent computer <NUM> may get the information by push from the first independent computer <NUM> or upon request. In further examples, the first independent computer <NUM> and the second independent computer <NUM> may each include at least one additional memory. In these examples, the first independent computer <NUM> may build up the information on the information interface <NUM>, the second independent computer <NUM> may copy the information from the information interface <NUM> to its additional memory, and the second independent computer <NUM> may then allow peripheral devices to read and/or modify the content on the additional memory.

The first independent computer <NUM>, the second independent computer <NUM>, and the information interface <NUM> are arranged and connected such that the second independent computer <NUM> can read current and past status information provided by or on the first independent computer <NUM> but cannot modify such information.

<FIG> illustrates one configuration of the first independent computer <NUM>, the second independent computer <NUM>, and the information interface <NUM> where the second independent computer <NUM> can read current and past status information provided by or on the first independent computer <NUM> but cannot modify such information. As illustrated in <FIG>, in some examples, the first independent computer <NUM> has write access to the information interface <NUM> but not read access. In other examples, and as discussed in detail below, the first independent computer <NUM> has full access to the information interface <NUM> (e.g., read, write, delete, modify, etc.). The second independent computer <NUM> has read access to the information interface <NUM> but not write access. In other words, the information interface <NUM> is a one-way memory for data exchange between the main bus system <NUM> and an emulated bus system <NUM>. In some examples, the second independent computer <NUM> may read the information interface <NUM> upon a request and/or automatically (e.g., as a push).

Through the particular configuration of the bus emulator device <NUM> (i.e., the second independent computer <NUM> can read current and past status information provided by or on the first independent computer <NUM> but cannot modify such information), the first independent computer <NUM> writes all needed information and data from the mission critical devices 104A-F into the information interface <NUM>. The second independent computer <NUM> reads the information and data from the information interface <NUM> and uses the data and information to emulate the main bus system <NUM> in the emulated bus system <NUM>. As illustrated, the emulated bus system <NUM> may not have a physical (or direct) connection into the main bus system <NUM>. In other words, the emulated bus system <NUM> is only able to indirectly access information and data from the main bus system <NUM> via the bus emulator device <NUM>.

In various examples, the emulated bus system <NUM> may look the same or substantially the same as the main bus system <NUM> (although it need not be), meaning that the emulated bus system <NUM> can simulate each of the mission critical devices 104A-F. The peripheral devices 106A-F may physically connect into the emulated bus system <NUM>, but the peripheral devices 106A-F do not have a physical connection to the main bus system <NUM>. In other words, because the second independent computer <NUM> can only read the information interface <NUM>, the emulated bus system <NUM> (and systems or devices connected to the emulated bus system <NUM>) cannot manipulate the main bus system <NUM> (and systems or devices connected to the main bus system <NUM>). In certain examples, providing the first independent computer <NUM> such that can only write into the information interface may provide an additional layer of security between the two computers. However, in other examples and as discussed in detail below, the first independent computer <NUM> may have full access to the information interface.

<FIG> illustrates a non-limiting example of a possible software or firmware architecture on the emulated bus side. This software may be installed in the Boot ROM <NUM> or other computer readable medium associated with the second independent computer <NUM>. The software architecture can be programmed in various suitable programming languages as desired.

With the bus emulator device <NUM>, the peripheral devices 106A-F may not realize that there is no physical or direct connection to the mission critical devices 104A-F. This configuration may make it possible to install the bus emulator device in existing environments while maintaining compatibility. Such a configuration allows the peripheral devices 106A-F to still use the information from the mission critical devices 104A-F without being able to manipulate the mission critical devices 104A-F. As a non-limiting example, an OBD connector (a peripheral device) may connect with the emulated bus system <NUM> to perform various diagnostics on the vehicle, but the OBD connector cannot be used to manipulate the mission critical devices <NUM>. Updating of all peripheral devices is still possible with the bus emulator device <NUM>. It will be appreciated that through the bus emulator device <NUM>, the emulated bus system <NUM> combines physical systems or devices (i.e., the peripheral devices <NUM>) and virtual or emulated systems or devices (i.e., the simulated mission critical devices from reading the information interface <NUM>).

Referring to <FIG>, in some examples, the bus emulator device <NUM> optionally includes a second shared memory space <NUM> (or second information interface). Optionally, the second shared memory space <NUM> may allow for the write back of selected registers into the main bus system <NUM>. Such selected registers may be predefined and controlled to limit the manipulation of the hot bus system <NUM> and the mission critical devices <NUM>.

<FIG> illustrates another configuration of the first independent computer <NUM>, the second independent computer <NUM>, and the information interface <NUM> where the second independent computer <NUM> can read current and past status information provided by or on the first independent computer <NUM> but cannot modify such information. Compared to the configuration illustrated in <FIG>, in the configuration of <FIG>, the first independent computer <NUM> has full access to the information interface <NUM> (e.g., read, write, delete, modify, etc.). In this example, the information interface <NUM> is a shared memory where the first independent computer <NUM> has read and write capabilities, and the second independent computer <NUM> only has read capabilities. In this example, the information interface <NUM> may always include the information from the hot bus system <NUM>.

<FIG> illustrates another configuration of the first independent computer <NUM>, the second independent computer <NUM>, and the information interface <NUM> where the second independent computer <NUM> can read current and past status information provided by or on the first independent computer <NUM> but cannot modify such information to control the hot bus system <NUM>. In this example, and compared to the configuration illustrated in <FIG>, the first independent computer <NUM> only has write access, and the second independent computer <NUM> has both read and write access. In this example, the information interface <NUM> is controlled by the second independent computer <NUM>, and the second independent computer can use the information interface <NUM> to directly emulate the cold bus <NUM>. In this example, because the first independent computer <NUM> only has write access, any modifications to the memory made by the second independent computer <NUM> cannot be used to control the main bus system <NUM>. In this example, the information interface <NUM> may or may not always include current or past information of the hot bus system <NUM>.

<FIG> illustrates another configuration of the first independent computer <NUM>, the second independent computer <NUM>, and the information interface <NUM> where the second independent computer <NUM> can read current and past status information provided by or on the first independent computer <NUM> but cannot modify such information to control the hot bus system <NUM>. In this example, and compared to the configuration illustrated in <FIG>, the second independent computer <NUM> has an additional memory <NUM>. The additional memory <NUM> may be the same type of memory as the information interface <NUM> or a different type of memory as desired. The first independent computer <NUM> may similarly have an additional memory, although it need not in other examples. In the example of <FIG>, although the first independent computer <NUM> is illustrated with only write access to the information interface <NUM>, in other examples the first independent computer <NUM> may have full access to the information interface <NUM>. In the example of <FIG>, the first independent computer <NUM> builds up the information about the hot bus system <NUM> on at least the information interface <NUM>. The second independent computer <NUM> copies the information from the information interface <NUM> to the additional memory <NUM>. The peripheral devices <NUM> may read and/or modify the information on the additional memory <NUM> as desired.

Claim 1:
A bus emulator device (<NUM>) comprising:
a first computer (<NUM>);
a second computer (<NUM>); and
an information interface (<NUM>),
wherein the first computer is configured to connect to a main bus system (<NUM>) comprising at least one mission critical device (<NUM>) and write information and data from the at least one mission critical device into the information interface, and the second computer is configured to read the information and data from the information interface and use the data and information to emulate the main bus system in an emulated bus system (<NUM>)
wherein either i) the first computer comprises at least write access into the information interface, and the second computer comprises read-only access into the information interface, or
ii) the first computer comprises write-only access into the information interface and the second computer comprises at least read access into the information interface.