SYSTEM AND METHOD FOR CONTROLLING ACCESS TO AN IN-VEHICLE COMMUNICATION NETWORK

• US 20170093866A1
• Filed: 09/22/2016
• Published: 03/30/2017
• Est. Priority Date: 09/25/2015
• Status: Active Grant

• Current Assignee: Argus Cyber Security Ltd. (Continental AG)
• Original Assignee: Argus Cyber Security Ltd. (Continental AG)
• Inventors: BEN-NOON, Ofer, GALULA, Yaron, LAVI, Oron
• Granted Patent: US 11,397,801 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1014 to tokens
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2212/178 Electronic token or RFID
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A system or method may include an in-vehicle network including an interface port for connecting an external device to the in-vehicle network; and a security unit connected to the in-vehicle network, the security unit adapted to enable an external device to communicate with the in-vehicle network, over the interface port, based on a security token received from the external device. A system or method may, based on a token, prevent an external device from at least one of: communicating with a selected set of components on in an in-vehicle network, communicating with a selected set of network segments in the in-vehicle network and performing a selected set of operations.

Claims

1. A system comprising:

an in-vehicle network including an interface port for connecting an external device to the in-vehicle network; and

a security unit connected to the in-vehicle network, the security unit adapted to enable an external device to communicate with the in-vehicle network, over the interface port, based on a security token received from the external device.

2. The system of claim 1, wherein the security unit is adapted to enable the communication over the interface port using the same a token a predefined number of times.

3. The system of claim 1, wherein the security unit is adapted to disable communication over the interface port based on at least one of:

a predefined time interval and an event.

4. The system of claim 1, wherein the token is provided to the security unit by one of:

a hardware component directly connected to the interface port and an external network.

5. The system of claim 1, wherein the security unit is adapted to, based on the token, prevent the external device from at least one of:

communicating with a selected set of components on the in-vehicle network, communicating with a selected set of network segments in-vehicle network and performing a selected set of operations.

6. The system of claim 1 wherein the security unit is adapted to record information related to a communication with the external device.

7. The system of claim 6 comprising a server, the server adapted to:

receive the recorded information and perform at least one of;

generate a history log of maintenance service of the vehicle,

identify unauthorized access to the in-vehicle network,

identify malicious activity on the in-vehicle network, and

generate insights based on the recorded data.

8. The system of claim 1 wherein the security unit is adapted to:

synchronize a time value with a generator of a token;

share a secret with the generator;

generate, based on the shared secret and based on the synchronized a time value, at least one token; and

selecting whether to enable or disable the external device to transfer data over the interface port of the in-vehicle network based on validating a token received from the external device, wherein the validating is based on the at least one token.

9. The system of claim 1 wherein the token is generated based on at least one attribute of a vehicle and wherein the security unit is adapted to validate a token based on the at least one attribute.

10. The system of claim 1 wherein the token is a vehicle-specific token generated or provided by one of:

a user associated with the vehicle and a server.

11. A method comprising:

enabling, by a security unit, an external device to communicate with an in-vehicle network, over an interface port, based on a security token received from the external device, wherein the interface port is connected to the in-vehicle network.

12. The method of claim 11, comprising enabling the communication over the interface port using the same a token a predefined number of times.

13. The method of claim 11, comprising disabling, based on the token and by the security unit, communication over the interface port based on at least one of:

a predefined time interval and an event.

14. The method of claim 11, wherein the token is provided to the security unit by one of:

a hardware component directly connected to the interface port and an external network.

15. The method of claim 11 comprising, based on the token, preventing the external device from at least one of:

communicating with a selected set of components on the in-vehicle network, communicating with a selected set of network segments in-vehicle network and performing a selected set of operations.

16. The method of claim 11 comprising recording, by the security unit, information related to a communication with the external device.

17. The method of claim 16 comprising:

receiving, by a server, the recorded information and performing, by the server, at least one of;

generating a history log of maintenance service of the vehicle,

identifying unauthorized access to the in-vehicle network,

identifying malicious activity on the in-vehicle network., and

generating insights based on the recorded data.

18. The method of claim 11 comprising:

synchronizing a time value between a generator of a token and the security unit;

sharing a secret between a generator of a token and the security unit;

generating, based on the shared secret and based on the synchronized a time value, at least one token; and

selecting whether to enable or disable the external device to transfer data over the interface port of the in-vehicle network based on validating a token received from the external device, wherein the validating is based on the at least one token.

19. The method of claim 11 comprising generating the token based on at least one attribute of a vehicle and validating the token based on the at least one attribute.

20. The method of claim 11 comprising generating a vehicle-specific token by one of:

a user associated with the vehicle and a server.

21. A method comprising:

receiving, by a security unit connected to an in-vehicle network connected to in-vehicle components, a security code; and

selecting, by the security unit and based on a value in the security code whether or not to permit a system external to the vehicle to communicate with the in-vehicle components connected to the in-vehicle network.