Patent ID: 12261716

DESCRIPTION OF EMBODIMENTS

FIG.1schematically depicts an example of a CAN system100that is known in the field. The CAN system may include multiple CAN nodes102, also referred to as “ECUs,” each connected to a CAN BUS network104. In the embodiment ofFIG.1, each CAN node102includes a microcontroller106having an embedded CAN protocol controller108and a CAN transceiver112. The CAN protocol controller108may be referred to as a CAN controller. The CAN transceiver112may be referred to as a transceiver.

The microcontrollers106are typically connected to at least one device (not shown) such as a sensor, an actuator, or some other control device and are programmed to determine the meaning of received messages and to generate appropriate outgoing messages. The microcontrollers106, which may also be referred to as host processors, hosts or digital signal processors (DSPs), are known in the field. In an embodiment, the host supports application software that interacts with the CAN protocol controller108.

The CAN BUS network104carries analog differential signals and includes a first CAN signal line114, which is also referred to as the CAN high (CANH) bus line114, and a second CAN signal line116, which is also referred to as the CAN low (CANL) bus line116. The CAN BUS network104is known in the field.

FIG.2depicts an expanded view of one CAN node102fromFIG.1. In the expanded view ofFIG.2, the microcontroller106includes a host110, which may be, for example, a software application that is stored in a memory of the microcontroller106and executed by processing circuits of the microcontroller106. The microcontroller106and the CAN transceiver112of the CAN node102are connected between a first supply voltage, VCC, and as second supply voltage, which is usually ground, GND. As illustrated inFIG.2, data communicated from CAN protocol controller108being implemented by the microcontroller106to the CAN transceiver112is identified as transmit data (TXD) and data communicated from the CAN transceiver112to the CAN protocol controller108being implemented by the microcontroller106is referred to as receive data (RXD). Throughout the description, TXD is carried on a TXD path and RXD is carried on an RXD path. Messages can be communicated to and from the CAN BUS network104via the CANH and CANL bus lines114and116, respectively.

The CAN protocol controller108is preferably embedded within the microcontroller106, but may also be implemented external to the microcontroller106(e.g., a separate IC device). The data link layer operations between the CAN protocol controller108and the CAN transceiver112is known in the field.

For example, in receive operations, the CAN protocol controller108receives from the transceiver112a digital RXD signal via the RXD path. The RXD signal may represent an RXD message. The CAN protocol controller108may store the received RXD message. The RXD message complies with the standardized frame format of the CAN protocol.

In transmit operations, the CAN protocol controller108receives a TXD message from the microcontroller106and transmits a TXD signal, which represents the TXD message, via the TXD path to the CAN transceiver112. The TXD message typically complies with the standardized frame format of the CAN protocol.

The CAN transceiver112is located between the CAN controller108and the CAN BUS network104. The CAN transceiver112is configured to implement physical layer operations according to the CAN protocol as known in the field.

For example, in receive operations, a CAN transceiver112converts analog differential signals from the CAN BUS network104to the RXD signal that the CAN protocol controller108can interpret. The CAN transceiver112may also protects the CAN protocol controller108from extreme electrical conditions on the CAN BUS network104, e.g., electrical surges.

In transmit operations, the CAN transceiver112can convert the TXD signal received via the TXD path from the CAN protocol controller108into analog differential signals that are sent over a CAN BUS interface124on the CAN BUS network104. The CAN BUS interface is adapted to be connected to the first and second CAN BUS signal lines114,116.

As noted above, the CAN protocol controller108can be configured to support the normal mode or the flexible data rate mode. As used herein, “CAN normal mode” (also referred to as “CLASSICAL CAN mode”) as well as “CAN FD mode” refer to frames that are formatted according to the ISO 11898-1 standard.

FIG.3schematically illustrates an embodiment of the CAN system200according to the present disclosure. The CAN system200comprises a first CAN device202and a monitoring device204. The first CAN device202comprises a first transmit data, TXD, interface206. The first CAN device202also comprises a first transmitter208, a first CAN BUS interface210, and a first control unit212.

The first CAN BUS interface210of the first CAN device202is configured to be connected to the CAN BUS228. The CAN BUS228is also referred to as the CAN BUS network228. In an example, the first CAN BUS interface210has two ports, each of the two ports being connectable to a different CAN BUS line114,116of the CAN BUS network228.

The first transmitter208of the first CAN device202may be directly or indirectly coupled to the first CAN BUS interface210via signal connections268. In an example, the first control unit212may be coupled between the first transmitter208and the first CAN BUS interface210such that the first transmitter208is connected to the first CAN BUS interface210via the signal connections268and the first control unit212. In principle, the first transmitter208may be configured to generate a CAN BUS signal, which can be transmitted via the first CAN BUS interface210to the CAN BUS network228. The CAN BUS signal may be a differential voltage signal. The CAN BUS Signal is preferably a BUS Signal according to the CAN protocol.

The first CAN device202may receive a first TXD message216via the first TXD interface206. Preferably, the first TXD message216is a digital TXD message. Further, the first TXD message216may be constructed and/or structured according to the CAN protocol. In an example, the first CAN device202includes a signal connection276extending from the first TXD interface206to the first transmitter208. The signal connection276may be used to forward the first TXD message216, if received via the first TXD interface206, to the first transmitter208.

The first control unit212of the first CAN device202is configured to read a first identifier from a first TXD message216. The first transmitter208may be configured to generate a first CAN BUS signal220based on the first TXD message216. In an example, the first transmitter208may generate the first CAN BUS signal220, such that the first TXD message216is represented by the first CAN BUS signal220. As another example, the first control unit212of the first CAN device202may be configured to read a first identifier from a first TXD message216being represented by the first CAN BUS signal220. Thus, the first control unit212may be configured to receive and decode the first CAN BUS signal220, such that the first control unit212may the read the first identifier from the first TXD message216derived from the decoded first CAN BUS signal220. The first CAN BUS signal220generated by the transmitter208may be directed to the first CAN BUS interface210via the signal connections268and the first control unit212, such that the first CAN BUS signal220is injected into the CAN BUS network228. By the transmitter208, the first CAN BUS signal220may be generated such that the first CAN BUS signal220represents the first TXD message216. In an example, the first control unit212may be configured to decode the first CAN BUS signal220and read the first TXD message216from the decoded, first CAN BUS signal220. The first TXD message216comprises an identifier that can be read out as a first identifier from the first TXD message216by means of the first control unit212.

At least one first reference tag may be stored by the first CAN device202. In an example, the at least one first reference tag is stored by the first control unit212of the first CAN device202. Each first reference tag may have the form and/structure of an identifier. Preferably, each first reference tag is pre-defined. Each first reference tag may represent an identifier permissibly usable by the first CAN device202, the first TXD message126and/or the first CAN BUS signal220. For example, each first reference tag may represent a permissible identifier that may be permissibly included in the first TXD message216represented by the first CAN BUS signal220. If a first TXD message216may be received from the first CAN device202via the first TXD interface206, wherein the first transmitter208generates the first CAN BUS signal220based on the first TXD message216, and wherein the first TXD message216may be derived from the first TXD signal or from the first CAN BUS Signal220, the at least one first reference tag may be used at the first control unit212to verify whether the identifier included in the first TXD message216matches a permissible identifier (represented by a first reference tag). If a matching, permissible identifier is found for the first identifier included in the first TXD message216, it is permissible for the first CAN device202to send the first CAN BUS signal220that fully represents the first TXD message216. However, if no suitable, permissible identifier is found for the first identifier included in the first TXD message216, it may be inferred that the first identifier included in the first TXD message216is impermissible for the first CAN device202, the first TXD message216and/or the first CAN BUS signal220. This may mean that the first CAN device202may not generate a first CAN BUS signal220based on this first TXD message216that fully represents the first TXD message216. In the case where no matching, permissible identifier is found for the first identifier included in the first TXD message216, it may be assumed that the first TXD message216is an invalid message that may have been sent to the first CAN device202by a potentially malicious and/or compromised device. By not having the first TXD message216including an illegitimate identifier fully represented by the first CAN BUS signal220, potential subsequent issues in the CAN BUS network228, in the monitoring device204and/or in a further CAN device230can be prevented. This is because these further devices do not receive the corresponding first TXD message216via the first CAN BUS signal220, if the first TXD message216includes an impermissible first identifier.

At least one first reference tag may be stored by the first CAN device202, and preferably by the associated first control unit212. In an example, multiple first reference tags are stored by the first CAN device202, and preferably by the associated first control unit212. Each first reference tag may represent exactly one permitted identifier, or a group of a plurality of permitted identifiers. In an example, a first reference tag may represent an identifier mask that captures a plurality of permitted identifiers. If a plurality of first reference tags is provided, each reference tag may represent an associated identifier mask. The plurality of identifier masks may capture different permitted identifiers. Therefore, at least one permissible identifier or a plurality of permissible identifiers may be defined via the at least one first reference tag. Preferably, each first reference tag is predefined.

The first control unit212of the first device202is configured to compare, as a first comparison, the first identifier from the first TXD message216with the at least one first reference tag.

The first CAN device202is configured to generate the first CAN BUS signal220based on the first TXD message216via the first transmitter208at the first CAN BUS interface210, such that the first CAN BUS signal220represents at least a first part222of the first TXD message216. Preferably, the first TXD message216is a digital TXD message such that the bits of the first TXD message216arrive at the transmitter208sequentially. Corresponding to the sequence of incoming bits, the transmitter208may generate the first CAN BUS signal220, such that in an example, the transmitter208begins generating the first CAN BUS signal220before the transmitter208has fully received the first TXD message216. In an example, the first TXD message216may include an impermissible first identifier. Due to the sequential transmission of the bits of the first TXD message216to the first transmitter208, the first transmitter208in this example may have already begun generating the first CAN BUS signal220based on the bits of the first TXD message216that have already been received. Corresponding to the sequential transmission of the bits of the first TXD message216to the transmitter208, the first TXD message216may also be transmitted and/or represented sequentially via the first CAN BUS signal220. Therefore, at the first CAN BUS interface210, a first part222of the first TXD message216may have already been transmitted and/or represented by the first part223of the first CAN BUS signal220before the first control unit212has read the first identifier from the first part222of the first TXD message216, which is represented by the first part223of the CAN BUS signal. Only after the first control unit212has compared the first identifier with the at least one first reference tag and after the first control unit212has determined that the first identifier is impermissible, the first control unit212may initiate actions to prevent the first CAN BUS signal220from representing the full first TXD message216. Therefore, the first control unit212is configured, if a result of the first comparison indicates that the first identifier does not correspond to any of the at least one first reference tags, to invalidate a representation of the first TXD message216by the first CAN BUS signal220and to prevent a (preferably further) CAN BUS signal from being generated (preferably at all) by the first CAN device202at the first CAN BUS interface210for a predetermined first interruption time224.

In an example, the first identifier may not correspond to any of the at least one first reference tag if the first identifier does not correspond to any identifier represented and/or captured by the at least one reference tag. For example, the result of the first comparison may indicate that the first identifier is not represented and/or captured by any of the first reference tags. In this case, the first identifier is an impermissible first identifier. In another example, the result of the first comparison may indicate that the first identifier is represented and/or captured by at least one first reference tag. In this case, the first identifier is an permitted, first identifier.

Various possibilities exist to invalidate the representation of the full first TXD message216by the first CAN BUS signal220.FIG.3schematically illustrates an example of the first CAN device202, in which example the first control unit212is coupled between the first transmitter208and the first CAN BUS interface210. To invalidate the representation of the first TXD message216by the first CAN BUS signal220, the control unit212may interrupt the signal connection between the first transmitter208and the first CAN BUS interface210before the first TXD message216is fully represented by the first CAN BUS signal220. Further, following the interruption, the control unit212may generate an error CAN BUS signal at the first CAN BUS interface210, where the error CAN BUS signal representing an error frame, preferably according to the CAN protocol. With the error frame sent, any other device connected to the CAN BUS network28will understand that the first part222of the first TXD message216, already represented via the first part223of the first CAN BUS signal220, is invalid. In principle, however, there are other ways for the first control unit212to invalidate the representation of the first TXD message216by the first CAN BUS signal220. For example, the first control unit212may feed the error frame in digital form to the first transmitter208and simultaneously disconnect the signal connection276before the first TXD message216has been fully transmitted to the first transmitter208. The first transmitter208will integrate the error frame into the first CAN BUS signal220. The error frame is also recognized by all devices connected to the CAN BUS network228and understood in such a way that the first part222of the TXD message216, which was already represented by the first part223of first CAN BUS signal220, is invalid.

In an example, if a CAN BUS signal is transmitted via the CAN BUS network228, where the CAN BUS signal represents a CAN message, it is often not possible to determine from the CAN message which device has sent the CAN message or the respective CAN BUS signal. If a representation of a CAN message by the CAN BUS signal is invalidated due to an error frame being sent, it is therefore also not possible to determine from the invalidated representation of the CAN message by the CAN BUS signal which device has sent the CAN BUS signal.

The first control unit212is configured, after a representation of the first TXD message216by the first CAN BUS signal220has been invalidated, to subsequently prevent a (further) CAN BUS signal from being generated by the first CAN device202at the first CAN BUS interface210for a predetermined first interruption time224. The first interruption time224provides an opportunity for testing a reachability of each CAN device202,230coupled to the CAN BUS network228. The monitoring device204of the CAN system200may be used to test the reachability. During the interruption time224, the first CAN device202may not respond to any requests via the CAN BUS network228with a corresponding CAN BUS signal. As a result of the missing response, the first CAN device202may be detected.

The monitoring device204of the CAN system200is configured to receive an instruction message over the CAN BUS network228from the second CAN device230. The monitoring204is also configured to test a reachability of each CAN device202,230coupled to the CAN BUS network228in response to the received instruction message.

Previously, it was explained that the first control unit212may invalidate a representation of a first TXD message216by the first CAN BUS signal220if the first identifier of the first TXD message216is impermissible. Directly after the first control unit212has detected the impermissible first identifier, the first control unit212may start with the invalidation. In parallel or directly thereafter, the first control unit212may ensure for the first interruption time224that no CAN BUS signal is generated by the first CAN device202at the first CAN BUS interface210. During this interruption time224, the first CAN device202cannot send a message, and in particular not the instruction message to the monitoring device204via the CAN BUS network228. However, the instruction message may be sent from the second CAN device230to the monitoring device204via a corresponding CAN BUS signal248representing the instruction message. In an example, the second device230may also detect whether a first CAN BUS signal220received by the second CAN device230represents a first part222of a first TXD message216that includes an impermissible identifier. In this case, the second CAN device230may trigger sending the instruction message to the monitoring device204, preferably via a second CAN BUS signal248.

After the monitoring device204receives the instruction message, the monitoring device204may test the reachability of the first CAN device202and the second CAN device230(and any other CAN device coupled to the CAN BUS network228, if applicable) in response to the received instruction message. The first CAN device202will not be able to respond during the interruption time224. The lack of response from the first CAN device202allows the monitoring device204to determine that the first CAN device202, or any other device coupled to the first CAN device202, is potentially malicious. As a result, it can therefore be determined which CAN device202is potentially malicious (directly or indirectly) and requires analysis.

In the example of the first CAN device202ofFIG.3, the first transmitter208and the first control unit212are shown as separate units. However, it is also possible that the first transmitter208and the first control unit212are completely or partially integrally designed. In this way, a compact design for the first CAN device202can be achieved.

In an example, the first CAN device202may be configured as a first CAN transceiver112. In another example, the first CAN device202may include the first CAN transceiver112and a first CAN controller108. Further, in another example, the first CAN device202may be configured as a first CAN node102. If the first CAN device202comprises the first CAN controller108or if the first CAN device202is configured as a first CAN node102, the first control unit212may be disposed in either the first CAN transceiver212or the first CAN controller108. It is also possible that the first control unit212in the aforementioned example is distributed over the first CAN transceiver112and the first CAN controller108.

Controller area network (CAN) BUS is a message-based communications BUS protocol that is often used within automobiles. The CAN BUS protocol is used to enable communications between various electronic control units (ECUs), such as an engine control module (ECM), a power train control module (PCM), airbags, antilock brakes, cruise control, electric power steering, audio systems, windows, doors, mirror adjustment, battery and recharging systems for hybrid/electric cars, and many more. The data link layer of the CAN protocol is standardized as International Standards Organization (ISO) 11898-1. The standardized CAN data link layer protocol is extended to provide higher data rates. The extended protocol, referred to as CAN Flexible Data-Rate or “CAN FD,” is moving towards standardization in the form of an update of the existing ISO 11898-1 standard.

FIG.4schematically illustrates an example of the first TXD message in the format of an ISO 11898-1 frame (in the classical base frame format (CBFF)). The fields are defined as follows:SOF Start of Frame (always dominant)IDENTIFIER Identifier Bits, defining the message contentRTR Remote transmission RequestIDE ID Extensionr0 Reserved Bit 0 (replaced by FDF in the CAN FD format)DLC Data Length CodeData Data BytesCRC Cyclic Redundancy CheckCRC Del CRC Delimiter (always recessive)ACK AcknowledgeACK Del Acknowledge DelimiterEOF End Of Frame

CAN messages are broadcast messages. The CAN protocol controllers108of the receiving CAN nodes102usually have identifier filters that are “tuned” to certain identifiers to make sure that the host receives relevant messages and is not bothered with irrelevant messages. Standard CAN frames have an 11-bit IDENTIFIER field to carry an 11-bit identifier and extended CAN frames have a 29-bit IDENTIFIER field to carry a 29-bit identifier. The 29-bit IDENTIFIER field is preferably divided into two sections, an 11-bit base IDENTIFIER field and an 18-bit extended IDENTIFIER field.

The first TXD message216, as schematically illustrated inFIG.4, comprises an identifier field214, in which the first identifier of the first TXD message216may be represented. Preferably, the first part222of the first TXD message216extends from the first field (SOF) to at least including the identifier field214. Preferably, the first part222of the first TXD message216extends from the first field (SOF) to at least including the CRC delimiter field286.

FIG.6schematically illustrates an event diagram of messages and CAN BUS signals. The time runs horizontally from left to right. The first temporal event that occurs is the first TXD message216. The bits of the first TXD message216are sequentially transmitted to the first receiver208of the first CAN device202, and based on the bits of the first TXD message216, the first receiver208begins (often somewhat delayed) to generate the first CAN BUS signal220. There may be a possibly time gap between the start of the first TXD message216and the start of the first CAN BUS signal220.

In the schematic diagram ofFIG.6, the first CAN BUS signal220comprises a first part223corresponding to the first part222of the first TXD message216. The first control unit212is configured, if it is determined by the first comparison that the first identifier of the first TXD message216is impermissible, to invalidate the representation of the first TXD message216by the first CAN BUS signal220. In this case, the first control unit212may cause an error frame288to be generated and represented by a corresponding CAN BUS signal sent via the first CAN BUS interface210. According to the CAN protocol, the error frame288may comprise and/or be formed by at least six consecutive dominant bits. The dominant bits of the error frame288overwrite a second part of the first CAN BUS signal220. The transmission of the error frame288invalidates the representation of the first TXD message216, because the transmission of the error frame288occurs before the first CAN BUS signal220has fully represented the first TXD message216.

At the same time that the error frame288is emitted, the first interruption time224may begin. During the first interruption time224, the first control unit212prevents a (preferably further) CAN BUS signal from being generated by the first CAN device202at the first CAN BUS interface210.

In an example, the CAN system200includes the CAN BUS network228, and the first CAN BUS interface210of the first device202may be connected to the CAN BUS network228. Further, a third CAN BUS interface252of the monitoring device204may be connected to the CAN BUS network228.

In an example, the CAN system200includes the second CAN device230, and a second CAN BUS interface236of the second CAN device230may be connected to the CAN BUS network228. An example of the second CAN device is schematically illustrated inFIG.3.

The second CAN device230may include a second transmitter232, a second receiver234, the second CAN BUS interface236, and a second processing unit238. At this point, it should be noted that the term “second” has been used with respect to the second processing unit238to unambiguously name that processing unit238. However, the term “second” does not require that a first processing unit be present. The term “second” just as the other numerical words are used solely for distinguishing purpose.

To receive the first CAN BUS signal220, the second receiver234of the second CAN device230is preferably directly or indirectly coupled to the second CAN BUS interface236. In an example, the second receiver234may be directly or indirectly coupled to the second CAN BUS interface236via the signal connections294. However, it is also possible that the second receiver234is coupled to the second CAN BUS interface236via the signal connections294and a second control unit290. Provided that the second CAN device230is connected to the CAN BUS network228via the associated, second CAN BUS interface236, the first CAN BUS signal220may be transmitted from the first CAN device202to the second CAN device230via the CAN BUS network228. From the second CAN BUS interface236, the first CAN BUS signal220may be forwarded to the second receiver234.

The second receiver234of the second CAN device230is configured to generate a second RXD signal based on the first CAN BUS signal220. The first CAN BUS signal220is generated by the first CAN device202. Previously, it was explained that the first CAN BUS signal220may only represent a first part222of a first TXD message216if the first TXD message216includes an impermissible first identifier in the associated identifier field214. If the first CAN BUS signal220represents only the first part222of the first TXD message216, it results that the second RXD signal represents from the first TXD message216not more than the first part222of the first TXD message216. It should be noted, however, that the first part222of the first TXD message216comprises the first identifier of the first TXD message216. In an example, the second receiver234is configured to decode the first CAN BUS signal220according to the CAN protocol to generate the second RXD signal representing a second RXD message242.FIG.5schematically shows a structure of an example of the second RXD message242. If the first CAN BUS signal220only represents the first part222of the first TXD message216, the second receiver234will also decode only the corresponding first part223of the first CAN BUS signal220such that a first part244of the second RXD message242corresponds to the first part222of the first TXD message216. In an example, the second receiver234may be configured to reconstruct a second part296of the second RXD message242based on the first part244of the second RXD message242. The first part244and the second part296may together form the complete second RXD message242.

As previously explained, the second receiver234of the second CAN device230is configured to generate the second RXD signal based on the first CAN BUS signal220at least such that the second RXD signal represents at least the first part244of the second RXD message242. Preferably, the second RXD signal is a digital signal. The first part244of the second RXD message242includes the first identifier of the first TXD message216. In an example, the identifier field214of the first TXD message216and the identifier field298of the second RXD message242represent the same, first identifier.

The second receiver234may be configured to transmit the second RXD signal to the second processing unit238. In an example, a signal connection278may be formed between the second receiver234and the second processing unit238through which the second RXD signal may be transmitted from the second receiver234to the second processing unit238. The second processing unit238may be configured to read the first identifier from the first part244of the second TXD message242. The second processing unit238may be partially or fully integrated with the second control unit290. However, the second processing unit238may also be designed separately from the second control unit290.

At least one second reference tag may be stored by the second CAN device230. In an example, the at least one second reference tag is stored by the second processing unit238of the second CAN device230. Each second reference tag may have the form and/structure of an identifier. Preferably, each second reference tag is predefined. Each second reference tag may represent an identifier that is impermissible except for the second CAN device230. In other words, each second reference tag may represent an identifier that must not be included in a second RXD message242.

In an example, the second CAN device230may include a second TXD interface300to receive a second TXD message via the second TXD interface300. The second TXD message may have an associated identifier. In an example, each second reference tag may represent an permissible identifier for the second TXD message. Thus, the second TXD messages alone may permissibly use an identifier represented by the at least one second reference tag.

At least one second reference tag may be stored by the second CAN device230, and preferably by the associated second processing unit238. In an example, multiple second reference tags are stored by the second CAN device230, and preferably by the associated second processing unit238. Each second reference tag may represent exactly one identifier or a group of a plurality of identifiers. In an example, a second reference tag may represent an identifier mask that captures a plurality of identifiers. If a plurality of second reference tags are provided, each reference tag may represent an associated identifier mask. The plurality of identifier masks may capture different permitted identifiers. Therefore, at least one identifier or a plurality of identifiers may be defined via the at least one second reference tag. Preferably, each second reference tag is predefined.

The at least one second reference tag may be used by the second processing unit238of the second CAN device230to check whether the (first) identifier included in the second RXD message242matches an impermissible identifier (represented by a second reference tag). If a matching impermissible identifier is found for the (first) identifier included in the second RXD message242, then the second RXD message242, the first CAN BUS signal220and/or the first TXD message216may be determined by the second processing unit238as impermissible. Furthermore, in this case, the first CAN device203and/or a device connected to the first CAN device may be considered as malicious and/or compromised.

However, if no matching impermissible identifier (based on the at least one second reference tag) is found for the first identifier included in the second RXD message242, it may be inferred that the first identifier included in the second RXD message242is permissible and may be forwarded within the second CAN device to a second RXD interface301.

The second processing unit238is configured to read the first identifier from the first part244of the second RXD message242and, as a second comparison, compare the first identifier with the at least one second reference tag. The second processing unit238is also configured, if the result of the second comparison indicates that the first identifier (from the first part244of the second RXD message242) matches at least one second reference tag, to control the second transmitter232of the second CAN device230such that the second transmitter232generates a second CAN BUS signal248representing the instruction message. Preferably, the instruction message represents an improper use of the first identifier. In an example, the first identifier (from the first part244of the second RXD message242) matches a second reference tag if the first identifier matches and/or corresponds with an identifier represented by the second reference tag. The second processing unit238, via the second transmitter232, causes the instruction message to be sent in the event that the first identifier was improperly used. In an example, the second CAN device230is not prevented from generating a CAN BUS signal at the second CAN BUS interface236during the first interruption time224(which is preferably exclusively a first interruption time224for the first CAN device202). Thus, it is possible via the second CAN device230to report the impermissible use of the first identifier to the monitoring device204via the instruction message.

As previously explained, the monitoring device204is configured to test the reachability of each CAN device202,230connected to the CAN BUS network228in response to a received instruction message. In the example previously explained, the second CAN device230will be able to respond to the reachability test. However, the first CAN device202is prevented from generating a CAN BUS signal at the first CAN BUS interface210during the first interruption time224, such that the first CAN device202cannot respond to the reachability test of the monitoring device204. The monitoring device204may be configured to infer from the lack of response that the corresponding CAN device is potentially malicious and/or compromised.

In an example, the monitoring device204may be configured to test the reachability of each CAN device202,230coupled to the CAN BUS network228in response to the received instruction message only if the instruction message directly or indirectly represents the impermissible use of an identifier and/or a compromised device202,230and/or a compromised node102. This may prevent the monitoring device from performing a high number of tests.

In an example, the monitoring device204includes a third CAN BUS interface252, a third receiver254, a third transmitter256, and a third processing unit258. The third receiver254is preferably directly or indirectly coupled to the third CAN BUS interface252. Preferably, signal connections302extend from the third CAN BUS interface252to the third receiver254. The second CAN BUS signal248may be transmitted from the second CAN device230to the third CAN BUS interface252of the monitoring device204via the CAN BUS network228, wherein the second CAN BUS signal248may be forwarded from the third CAN BUS interface252, preferably via the signal connections302, to the third receiver254. In an example, the third receiver254is configured to decode a CAN BUS signal. Preferably, the third receiver254is configured to generate a third RXD signal based on the received, second CAN BUS signal248. The third RXD signal may then represent the instruction message. Further, the third RXD signal is a digital signal.

The third RXD signal generated by the third receiver254may be transmitted to the third processing unit258via the signal connection282. In an example, the third processing unit258is configured to decode the instruction message, in particular to check whether the instruction message indicates an unauthorized use of the first identifier or whether the instruction message indicates a compromised device or node.

The third processing unit in258is configured, preferably if the instruction message is received and preferably if the instruction message also indicates an impermissible use of the first identifier (or the compromised device/node), to initiate a reachability test of the CAN devices202,230coupled to the CAN BUS network228. In an example, the third processing unit258is coupled to the third transmitter256via another signal connection284. Via the signal connection284, the third processing unit258can control the third transmitter256.

To perform the reachability test, the third processing unit258may be configured to control the third transmitter256in response to the received instruction message such that a CAN BUS test signal262is generated by the third transmitter256at the third CAN BUS interface252. The third transmitter256may be coupled to the third CAN BUS interface252via signal connections such that the CAN BUS test signal262generated by the third transmitter256is transmitted to each CAN device202,230connected to the CAN BUS network228via the third CAN BUS interface252and the CAN BUS network228.

In an example to perform the reachability test, the third processing unit258is configured to transmit a digital control signal to the third transmitter256via the signal connection284. The digital control signal may represent a request message for sending a response message to the monitoring device204. The third transmitter256may generate the CAN BUS test signal262based on the digital control signal.

In Summary, with the instruction message transmitted via the second CAN BUS signal248from the second CAN device230to the monitoring device204, the monitoring device204receives the information to start the reachability test. For the reachability test, the monitoring device204sends the CAN BUS test signal262to each CAN device202,230that is connected to the CAN BUS network228.

The second CAN device230may respond to the CAN BUS test signal262with a response message. In an example, the second CAN device230may configure to respond to a received CAN BUS test signal262with the CAN BUS response signal272that directly or indirectly represents a reachability of the second CAN device230.

Although the first CAN device202may receive the CAN BUS test signal262at least at the first CAN BUS interface210and which possibly forwards it to the first receiver264via the first control unit212and/or signal connections266, the first interruption time224continues long enough, such that the first control unit212is configured to prevent a CAN BUS signal from being generated by the first CAN device202at the first CAN BUS interface210during the first interruption time224. Therefore, the first CAN device202cannot send a CAN BUS response signal272representing a response message in response to the CAN BUS test signal262to the monitoring device204. The monitoring device204may determine that the first CAN device202has not responded to the reachability test and is therefore most likely malicious and/or compromised.

In an example, the first interruption time224is predefined such that the CAN BUS test signal262may be transmitted during the first interruption time224. In another example, the first interruption time224is further defined such that the response message, in particular represented by a CAN BUS response message272, can be transmitted during the first interruption time224from each CAN device230, that is not malicious or compromised. For example, the first interruption time224may be predefined such that the first interruption time224is greater (preferably greater by at least 20%, greater by at least 50% greater, or greater by at least 100%) than a sum of processing times and transmission times for generating and transmitting the second CAN BUS signal248, for generating and transmitting the CAN BUS test signal262, and for generating and transmitting the CAN BUS response signal272. In an example, the first interruption time224may therefore be predefined to ensure that all CAN devices202,230connected to the CAN BUS network228can at least theoretically respond with a CAN BUS response signal272to a CAN BUS test signal262.

InFIG.3, the second CAN device230is schematically shown, wherein the second CAN device comprises the second processing unit238. Such a processing unit may also be provided for the first CAN device202, even though such a processing unit for the first CAN device202is not shown inFIG.3. However, assuming such a processing unit may be provided for the first CAN device202, the processing unit may not prevent the first control unit212from preventing a CAN BUS signal from being generated by the first CAN device202at the first CAN BUS interface210during the first interruption time224.

In an example, each CAN device202,230is configured, if the CAN BUS test signal262is received via the associated CAN BUS interface210,236and the associated receiver264,234, to generate a digital RXD test signal based on the respective received CAN BUS test signal262at the associated receiver264,234. In an example, if the CAN BUS test signal262is received by the second CAN device230via the associated, second CAN BUS interface236and the associated, second receiver234, the second receiver234may generate a digital RXD test signal based on the received CAN BUS test signal262. In the example ofFIG.3, the digital RXD test signal may be forwarded to the second processing unit238.

In an example, each CAN device202,230is configured, if the RXD test signal is generated by the associated receiver264,234, to read out the request message represented by the RXD test signal262, wherein the request message includes the request for sending a response message to the monitoring device204. The processing unit238of the respective CAN device202,230may be configured to read out the response message. In an example, if an RXD test signal is received by the second processing unit238of the second CAN device230, the second processing unit238may be configured to decode the RXD test signal and read out the response message.

In an example, each CAN device202,230may be configured, if it has read out the response message and if the transmitter208,232of the respective CAN device202,230is not disabled, to trigger the transmitter208,232of the respective CAN device202,230to generate a CAN BUS response signal272, wherein the CAN BUS response signal272represents a response message that directly or indirectly indicates the respective CAN device202,230. The respective response message may thus indicate from which CAN device202,230the respective response signal originates. However, it should be taken into account that, for example, the CAN device202comprises the first control unit212that prevents a CAN BUS signal from being generated by the first CAN device202at the first CAN BUS interface210during the first interruption time224. Thus, it is theoretically possible that the first transmitter208of the first CAN device202generates a CAN BUS response signal, but the first control unit212prevents the CAN BUS response signal from reaching the first CAN BUS interface210during the first interruption time224. In contrast, the second CAN device230may include an associated transmitter232that also generates a CAN BUS response signal272that is forwarded to the second CAN BUS interface236of the second CAN device230so that the CAN BUS response signal272will be sent from the second CAN device230to the monitoring device204via the CAN BUS network228.

In an example, each CAN device202,230is configured, if a signal connection268,292between the associated transmitter208,232and the associated CAN BUS interface210,236is not interrupted or disabled, to transmit the CAN BUS response signal272generated by the associated transmitter208,232via the associated CAN BUS interface210,236.

In an example, the monitoring device204is configured to receive the at least one CAN BUS response signal caused by the instruction message. The monitoring device204may be configured to receive multiple CAN BUS response signals272from different CAN devices230caused by the instruction message. Each CAN BUS response signal272may be routed through the third CAN BUS interface252and signal connections302to the third receiver254, which generates an associated digital (third) RXD response signal for each received CAN BUS response signal. Each (third) RXD response signal is routed from the third receiver254to the third processing unit258via the signal connection282. The third processing unit258may be configured to decode each (third) RXD response signal and to read out the associated response message. Each response message indicates a CAN device230.

In an example, the third processing unit258of the monitoring device204may be configured to determine which CAN device230responded via a corresponding CAN BUS response signal272based on the read response messages. A list representing all CAN devices202,230connected to the CAN BUS network228may be stored by the monitoring device204, and preferably by the associated third processing unit258. The list may be pre-defined and/or continuously updated by the third processing unit258. In an example, the third processing unit258may listen to the CAN BUS signals on the CAN BUS network258via the third CAN BUS interface252, the signal connections302, and the third receiver254, and based on the identifiers of the CAN BUS messages represented by the CAN BUS signals, create and/or update the list.

After the third processing unit258determines which of the CAN devices230has responded with a response message, the third processing unit258may determine based on the list and the response messages which of the CAN devices202has not responded with a response message. Any CAN device202that has not responded with a response message may be identified by the third processing unit258as a potential malicious device and/or a compromised device.

In an example, the third processing unit258is configured to identify a possible malicious CAN device202,230based on the received response message and preferably also on the list of CAN devices connected to the CAN BUS network228.

In an example, the first control unit212of the first CAN device202is configured to prevent CAN BUS signals from being received via the first CAN BUS interface210during the first interruption time224. For example, the first control unit212may be coupled between the first CAN BUS interface210and the receiver264, such that the first control unit212may prevent CAN BUS signals from being forwarded from the first CAN BUS interface210to the first receiver264during the first interruption time224. In this case, for example, the CAN BUS test signal262cannot be forwarded to the first receiver264. Due to the interruption of the forwarding of the CAN BUS test signal262, no CAN BUS response signal272is generated by the first CAN device202during the first interruption time224.

In an example, the first control unit212of the first device202may be configured to interrupt the at least one signal connection266between the first CAN BUS interface210and the first receiver264during the first interruption time224. Previously, it was explained that the first control unit212may be coupled between the first CAN BUS interface210and the first receiver264. However, this arrangement of the first control unit212is not mandatory. For example, the first control unit212may control an optional switch unit (not shown) integrated into the at least one signal connection266for interruption during the first interruption time224. In this case, for example, the CAN BUS test signal262cannot be forwarded to the first receiver264. Due to the interruption of the forwarding of the CAN BUS test signal262, no CAN BUS response signal272is generated by the first CAN device202during the first interruption time224.

In an example, the first control unit212of the first CAN device202is configured to disable the first receiver264during the first interruption time224. Also in this case, it is not mandatory that the first control unit212needs to be coupled between the first CAN BUS interface210and the first receiver264. Rather, a control line (not shown) may be provided through which the first control unit212may control the first receiver264to enable or disable the first receiver264. In the disabled state, the first receiver264cannot decode a CAN BUS signal and thus cannot generate a digital signal at the output of the first receiver264. Due to the deactivation of the first receiver264during the first interruption time224, a CAN BUS response signal272will also not be generated by the first CAN device202.

In an example, the first control unit212of the first CAN device202is configured to prevent transmission, in particular sending, of CAN BUS signals via the first CAN BUS interface210during the first interruption time224. For example, the first control unit212may be configured to disable the first CAN BUS interface210during the first interruption time224. This effectively prevents the first CAN device202from sending a CAN BUS response signal272over the CAN BUS network228during the first interruption time224.

In an example, the first control unit212of the first CAN device202is configured to interrupt the at least one signal connection268between the first transmitter208and the first CAN BUS interface210during the first interruption time224. Should the first transmitter208generate a CAN BUS response signal in response to a CAN BUS test signal262, interrupting the at least one signal connection268between the transmitter208and the first CAN BUS interface210during the first interruption time224effectively prevents the CAN BUS response signal from reaching the first CAN BUS interface210. In an example, the first control unit212may be coupled between the first transmitter208and the first CAN BUS interface210to enable the interruption of the at least one signal connection286. In an example, the first control unit212may be integrated into the at least one signal connection286between the first transmitter208and the first CAN BUS interface210.

In an example, the first control unit212is configured to disable the first transmitter208during the first interruption time224. Again, it is not mandatory that the first control unit212be coupled between the first transmitter208and the first CAN BUS interface210. Rather, a control line (not shown) may be provided through which the first control unit212may control the first transmitter208to disable or enable the first transmitter208. In the deactivated state, the first transmitter208cannot generate a CAN BUS signal, particularly the CAN BUS response signal272. Due to the possible deactivation of the first transmitter208during the first interruption time224, no CAN BUS response signal272will be generated by the first CAN device202either.

FIG.7schematically illustrates an embodiment of the method according to the present disclosure. The method preferably relates to the use of the CAN system200. The method comprises the steps of: a) the first control unit212reading out a first identifier from a first TXD message216; b) comparing, as a first comparison, the first identifier with at least a first reference tag; c) the first transmitter208generating, via the first CAN BUS interface210, a first CAN BUS signal220based on the first TXD message216, such that the first CAN BUS signal220represents at least a first portion222of the first TXD message216; d) both, invalidating a representation of the first TXD message216by the first CAN BUS signal220by means of the first control unit212and preventing the first CAN BUS signal220from being generated by the first CAN device202at the first CAN BUS interface210for a predetermined first interruption time224by means of the first control unit212, if a result of the first comparison of step b) indicates that the first identifier does not correspond to one of the at least one first reference tag; e) receiving an instruction message over the CAN BUS network228at the monitoring device204from a second CAN device230; and f) testing a reachability from the monitoring device204to each CAN device202,230coupled to the CAN BUS network228in response to the received instruction signal. It shall be noted, that step a) may be carried out before step b), or vice versa.

For the method, the preferred explanations, preferred features, technical effects and benefits are referred to in an analogous manner as previously explained for the CAN system200.

Although the described exemplary embodiments disclosed herein focus on devices, systems, and methods for using same, the present disclosure is not necessarily limited to the example embodiments illustrate herein. For example, various embodiments of providing

The systems and methods described herein may at least partially be embodied by a computer program or a plurality of computer programs, which may exist in a variety of forms both active and inactive in a single computer system or across multiple computer systems. For example, they may exist as software program(s) comprised of program instructions in source code, object code, executable code or other formats for performing some of the steps. Any of the above may be embodied on a computer-readable medium, which may include storage devices and signals, in compressed or uncompressed form.

As used herein, the term “computer” refers to any electronic device comprising a processor, such as a general-purpose central processing unit (CPU), a specific-purpose processor or a microcontroller. A computer is capable of receiving data (an input), of performing a sequence of predetermined operations thereupon, and of producing thereby a result in the form of information or signals (an output). Depending on the context, the term “computer” will mean either a processor in particular or more generally a processor in association with an assemblage of interrelated elements contained within a single case or housing.

The term “processor” or “processing unit” refers to a data processing circuit that may be a microprocessor, a co-processor, a microcontroller, a microcomputer, a central processing unit, a field programmable gate array (FPGA), a programmable logic circuit, and/or any circuit that manipulates signals (analog or digital) based on operational instructions that are stored in a memory. The term “memory” refers to a storage circuit or multiple storage circuits such as read-only memory, random access memory, volatile memory, non-volatile memory, static memory, dynamic memory, Flash memory, cache memory, and/or any circuit that stores digital information.

As used herein, a “computer-readable medium” or “storage medium” may be any means that can contain, store, communicate, propagate, or transport a computer program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (non-exhaustive list) of the computer-readable medium may include the following: an electrical connection having one or more wires, a portable computer diskette, a random-access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CDROM), a digital versatile disc (DVD), a Blu-ray disc (BD), and a memory card.

It is noted that the embodiments above have been described with reference to different subject-matters. In particular, some embodiments may have been described with reference to method-type claims whereas other embodiments may have been described with reference to apparatus-type claims. However, a person skilled in the art will gather from the above that, unless otherwise indicated, in addition to any combination of features belonging to one type of subject-matter also any combination of features relating to different subject-matters, in particular a combination of features of the method-type claims and features of the apparatus-type claims, is considered to be disclosed with this document.

Furthermore, it is noted that the drawings are schematic. In different drawings, similar or identical elements are provided with the same reference signs. Furthermore, it is noted that in an effort to provide a concise description of the illustrative embodiments, implementation details which fall into the customary practice of the skilled person may not have been described. It should be appreciated that in the development of any such implementation, as in any engineering or design project, numerous implementation-specific decisions must be made in order to achieve the developers' specific goals, such as compliance with system-related and business-related constraints, which may vary from one implementation to another. Moreover, it should be appreciated that such a development effort might be complex and time consuming, but would nevertheless be a routine undertaking of design, fabrication, and manufacture for those of ordinary skill.

Finally, it is noted that the skilled person will be able to design many alternative embodiments without departing from the scope of the appended claims. In the claims, any reference sign placed between parentheses shall not be construed as limiting the claim. The word “comprise(s)” or “comprising” does not exclude the presence of elements or steps other than those listed in a claim. The word “a” or “an” preceding an element does not exclude the presence of a plurality of such elements. Measures recited in the claims may be implemented by means of hardware comprising several distinct elements and/or by means of a suitably programmed processor. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Unless stated otherwise, terms such as “first” and “second” are used to arbitrarily distinguish between the elements such terms describe. Thus, these terms are not necessarily intended to indicate temporal or other prioritization of such elements.