REAL-TIME ACTIVE THREAT VALIDATION MECHANISM FOR VEHICLES

• US 20180367554A1
• Filed: 06/20/2017
• Published: 12/20/2018
• Est. Priority Date: 06/20/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: ALLOUCHE, YAIR, KOHLER, ARNDT, SAGY, RAVID, WOLFSTHAL, YARON
• Granted Patent: US 10,652,256 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 4/48 for in-vehicle communication

Abstract

A vehicle system, comprising multiple electronic control units (ECUs) configured to manage operation of multiple vehicle components, a controller area network (CAN) bus that provides communication pathways between the multiple ECUs, and a threat validation module configured to receive a message from an electronic control unit (ECU) of the multiple ECUs, wherein the message comprises data of a suspicious message flagged by the ECU, generate a query to determine authenticity of the message, broadcast the query to at least one ECU of the multiple ECUs, listen for responses from the at least one ECU, and determine whether the suspicious message is an actual threat based at least on a count of received responses.

Claims

1. A vehicle system, comprising:

multiple electronic control units (ECUs) configured to manage operation of multiple vehicle components;

a controller area network (CAN) bus that provides communication pathways between the multiple ECUs; and

a threat validation module configured to;

receive a message from an electronic control unit (ECU) of the multiple ECUs, wherein the message comprises data of a suspicious message flagged by the ECU,

generate a query to determine authenticity of the message,

broadcast the query to at least one ECU of the multiple ECUs,

listen for responses from the at least one ECU, and

determine whether the suspicious message is an actual threat based at least on a count of received responses.

2. The vehicle system according to claim 1, wherein the threat validation module is further configured to detect whether a jamming of the CAN bus is ongoing, and wherein the determination of whether the suspicious message is an actual threat is further based on the detection.

3. The vehicle system of claim 1, wherein the response to the query is a binary response.

4. The vehicle system of claim 1, wherein the query comprises an identification to identify the at least one ECU that generates messages similar to the suspicious message.

5. The vehicle system of claim 4, wherein the at least one ECU must respond to the query.

6. The vehicle system of claim 1, wherein the threat validation module is further configured to provide an indication that the suspicious message is a threat.

7. The vehicle system of claim 1, wherein the query is provided to the at least one ECU according to a communication protocol.

8. The vehicle system of claim 1, further comprising a hardware processor wherein, the threat validation module is a software module executed by said hardware processor.

9. A method comprising using at least one hardware processor of a vehicle system for:

receiving a message comprising data of a suspicious message that was flagged as suspicious by an electronic control unit (ECU);

generating a query to determine authenticity of the suspicious message;

broadcasting the query via a controller area network (CAN) bus to at least one ECU coupled to the CAN bus;

listening for responses from the at least one ECUs; and

determining whether the suspicious message is an actual threat based at least on a count of received responses.

10. The method of claim 9, further comprising detecting whether a jamming of the CAN bus is ongoing, and wherein the determination of whether the suspicious message is an actual threat is further based on the detection.

11. The method of claim 9, further comprising providing an indication that the suspicious message is likely a threat.

12. The method of claim 9, wherein the suspicious message is determined not to be an actual threat when the bus is not jammed and the count of at least on the count of received responses.

13. The method of claim 9, wherein determination that the suspicious message is an actual threat according to at least a response value of the responses received.

14. The method of claim 9, further comprising detecting an actual threat when the responses received do not match the expected responses.

15. The method of claim 9, wherein the query is provided to the at least one ECU according to a communication protocol.

16. A computer program product for vehicular test generation, the computer program product comprising a non-transitory computer-readable storage medium having program code embodied therewith, the program code executable by at least one hardware processor to:

receiving a message comprising data of a suspicious message that was flagged as suspicious by an electronic control unit (ECU);

generate a query to determine authenticity of the suspicious message;

broadcast the query on a central access network (CAN) bus to at least one ECU;

listen for responses from the at least one ECU; and

determine whether the suspicious message is an actual threat based at least on a count of received responses.

17. The computer program according to claim 16, wherein the program code is further executable by the at least one hardware processor to detect whether a jamming of the CAN bus is ongoing.

18. The computer program according to claim 16, wherein the suspicious message is an actual threat is further based on the detection.

19. The computer program according to claim 16, wherein the program code is further executable by the at least one hardware processor to provide an indication that the suspicious message is likely a threat.

20. The computer program according to claim 16, wherein the program code is further executable by the at least one hardware processor to determine the suspicious message is not an actual threat when the bus is not jammed and the count of at least on the count of received responses.