Watchman hub

• US 10,214,164 B2
• Filed: 08/14/2017
• Issued: 02/26/2019
• Est. Priority Date: 01/06/2014
• Status: Active Grant

• Current Assignee: Argus Cyber Security Ltd. (Continental AG)
• Original Assignee: Argus Cyber Security Ltd. (Continental AG)
• Inventors: Ben Noon, Ofer, Galula, Yaron, Lavi, Oron
• Primary Examiner(s): Haile, Benyam
• Application Number:
  US15/675,959
• Publication Number:
  US 20170341605A1
• Time in Patent Office: 561 Days
• CPC Class Codes: B60R 16/023 for transmission of signals between vehicle parts or subsystems
• CPC Class Codes: B60R 25/00 Fittings or systems for preventing or indicating unauthorised use or theft of vehicles locks for vehicles E05B77/00-E05B85/00
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 2012/40215 Controller Area Network CAN
• CPC Class Codes: H04L 2012/40273 the transportation system being a vehicle
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

A system for providing security to an in-vehicle communication network, the system comprising: a data monitoring and processing hub external to the in-vehicle network, the in-vehicle network having a bus and at least one node connected to the bus; a module configured to monitor messages in communication traffic propagating in the in-vehicle network, the module comprising: at least one communication port via which the module receives and transmits messages; a memory having data characterizing messages that the at least one node transmits and receives during normal operation of the node, and software executable to: identify, responsive to the data characterizing messages, an anomaly in communications over the in-vehicle communication network; and instruct a communication interface, configured to support communication with the hub, to transmit monitoring data responsive to identifying the anomaly to the hub for processing; and a processor configured to execute the software in the memory.

Claims

1. A system for providing security to an in-vehicle communication network, the system comprising:

a data monitoring and processing hub external to the in-vehicle network, the in-vehicle network having a bus and at least one node connected to the bus;

a module configured to monitor messages in communication traffic propagating in the in-vehicle network of a vehicle, the module comprising;

at least one communication port connectable to a portion of the in-vehicle network, via which the module receives and transmits messages; and

a memory having data characterizing messages that the at least one node transmits and receives during normal operation of the node, and software executable to;

identify, responsive to the data characterizing messages, at least one anomalous message from a plurality of messages received via the at least one communication port;

receive and operate in accordance with a request to operate in an override mode, in which mode the at least one anomalous message is not acted upon as it would be acted upon as an anomalous message under normal operation;

in the override mode, limit a number of messages having a same message ID as the at least one anomalous message that are allowed to be forwarded to the bus; and

instruct a communication interface, configured to support communication with the hub, to transmit monitoring data responsive to identifying the anomaly to the hub for processing; and

a processor configured to execute the software in the memory, wherein

the hub is operable to receive monitoring data from a plurality of other modules monitoring other in-vehicle networks of other vehicles comprised in a fleet.

2. The system according to claim 1, wherein the hub is operable to process the monitoring data it receives from the module to determine if the in-vehicle network is under threat of an imminent cyber attack, is under a cyber attack, or has vulnerability to a cyber attack, and transmit information to configure the module in the vehicle to engage the cyber attack responsive to the determination.

3. The system according to claim 1, wherein the communication interface is comprised in the module.

4. The system according to claim 1, wherein the communication interface is comprised in a node connected to the bus.

5. The system according to claim 1, wherein the hub is operable to:

process the monitoring data it receives from the plurality of modules to determine if at least one vehicle is under threat of an imminent cyber attack, is under a cyber attack, or has vulnerability to a cyber attack, and transmit information to configure the module in one or more vehicles comprised in the fleet to engage the cyber attack responsive to the determination.

6. The system according to claim 5, wherein the hub is operable to provide a user interface that displays information regarding health of the fleet with respect to cyber attacks.

7. The system according to claim 6, wherein the user interface of the hub is operable to display a distribution of anomalous messages detected by at least one module of the plurality of modules in a specified timeframe.

8. The system according to claim 6, wherein the user interface of the hub is operable to display a distribution of anomalous messages detected by at least one module of the plurality of modules in a specified geographical area.

9. The system according to claim 8, wherein the distribution is displayed as a heat map.

10. The system according to claim 1, wherein the monitoring data comprises a state feature vector representing a state of the vehicle.

11. The system according to claim 10, wherein the software is executable to change the state feature vector responsive to identifying an anomaly in communications over the in-vehicle communication network.

12. The system according to claim 1, wherein the software is executable to raise an alert responsive to identifying an anomaly in communications over the in-vehicle communication network.

13. The system according to claim 1, wherein in the override mode the software is executable to constrain content of the at least one anomalous message.

14. The system according to claim 1, wherein the software executable to accede to a request to operate in an override mode only after authenticating the request.

15. The system according to claim 1, wherein the monitoring data comprises data relevant to tracking performance of the module, responsive to identifying the at least one anomalous message.

16. The system according to claim 15, wherein the monitoring data comprises information regarding the at least one anomalous message identified by the module.

17. The system according the claim 16, wherein tracking the performance of the module comprises determining how frequently the module generates false positives or false negatives in identifying messages as anomalous messages.