SECURE COMMUNICATION BETWEEN VEHICLE COMPONENTS VIA BUS GUARDIANS

• US 20190324450A1
• Filed: 04/20/2018
• Published: 10/24/2019
• Est. Priority Date: 04/20/2018
• Status: Active Grant

• Current Assignee: Magna Autonomous Systems LLC, Woven By Toyota US Incorporated (Toyota Motor Corporation)
• Original Assignee: LYFT Incorporated
• Inventors: Lurie, Helen Ruth, Hansel, George James, Hoffacker, James Allen-White, Salem, Osama M.
• Granted Patent: US 10,782,684 B2
• Time in Patent Office: Days
• CPC Class Codes: B60W 2050/0215 Sensor drifts or sensor failures
• CPC Class Codes: B60W 2050/022 Actuator failures
• CPC Class Codes: B60W 2050/146 Display means
• CPC Class Codes: B60W 50/0205 Diagnosing or detecting failures; Failure detection models
• CPC Class Codes: B60W 50/082 Selecting or switching between different modes of propelling
• CPC Class Codes: B60W 50/10 Interpretation of driver requests or demands
• CPC Class Codes: B60W 50/14 Means for informing the driver, warning the driver or prompting a driver intervention
• CPC Class Codes: G05D 1/0061 for transition from automatic pilot to manual pilot and vice versa
• CPC Class Codes: G05D 1/0077 using redundant signals or controls
• CPC Class Codes: G05D 1/0246 using a video camera in combination with image processing means
• CPC Class Codes: G05D 1/81 Handing over between on-board automatic and on-board manual control
• CPC Class Codes: G05D 1/87 using redundant control arrangements
• CPC Class Codes: H04L 12/40026 Details regarding a bus guardian
• CPC Class Codes: H04L 2012/40215 Controller Area Network CAN
• CPC Class Codes: H04L 2012/40234 Local Interconnect Network LIN
• CPC Class Codes: H04L 2012/40273 the transportation system being a vehicle
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3236 : using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 4/38 : for collecting sensor information
• CPC Class Codes: H04W 4/48 : for in-vehicle communication

Abstract

In one embodiment, a computing system of an autonomous vehicle may receive a first set of data packets on one or more networks. The computing system may analyze the data packets to determine, for each packet, one or more of an authenticity, a validity, or a correctness of the data packet. The computing system may perform a first action for the first set of data packets based on the analysis. The first action may include signaling a safety driver of the autonomous vehicle to take over manual control of the vehicle in response to the data packets failing to satisfy the one or more of the authenticity, the validity, or the correctness criteria.

Claims

1. A method comprising:

receiving, by a computing system of a vehicle, a data packet from one or more sensors or processors of the vehicle through one or more networks;

analyzing, by the computing system of the vehicle, the data packet to determine;

     1) an authenticity of the data packet received from the one or more sensors or processors of the vehicle or

     2) a validity or a correctness of the data packet based on a comparison of the data packet to expected information; and

initiating, by the computing system of the vehicle, one or more actions including at least one of signaling a driver that a fault has occurred or transferring control of the vehicle to the driver in response to one or more of the authenticity, the validity, or the correctness failing to satisfy one or more criteria.

2. The method of claim 1, wherein the one or more networks are two physically redundant networks.

3. The method of claim 2, wherein the two physically redundant networks comprise ethernet networks.

4. The method of claim 1, further comprising sending the data packet to one or more components of the vehicle via one or more non-redundant networks in response to the data packet satisfying the one or more criteria.

5. The method of claim 4, wherein the one or more non-redundant networks comprise:

an ethernet network;

a controller area network (CAN) bus;

or

a local interconnect network (LIN) bus.

6. The method of claim 1, wherein the one or more actions further comprise:

sending signals or commands to a plurality of components of the vehicle;

restricting fraudulent or faulty data packets from sending to the one or more components of the vehicle;

alerting the safety driver of the vehicle to take over manual control of the vehicle in case of the fraudulent or faulty data packets;

determining an action for the vehicle independent of actions determined by one or more of a high-performance computer or a lower performance computer of the vehicle;

or

encrypting and decrypting communications between components of the vehicle.

7. The method of claim 1, wherein the one or more components of the vehicle comprise one or more of:

a sensor;

an actuator;

a high-performance computer;

or

a lower performance computer.

8. The method of claim 1, wherein analyzing the data packet comprises analyzing one or more of time schedules and priority schemes determined for the one or more components of the vehicle.

9. The method of claim 1, wherein the expected information comprises the internal data of the computing system.

11. The method of claim 1, wherein analyzing the validity of the data packet comprises:

analyzing votes assigned by one or more components of the vehicle, each vote representing a particular action to be performed by the vehicle; and

determining whether the votes and their corresponding actions for the vehicle are valid based on one or more characteristics of the vehicle.

12. The method of claim 11, further

comprising overriding the votes assigned by the one or more components of the vehicle if the corresponding actions to be performed by the vehicle are determined to be invalid.

13. The method of claim 1, further comprising:

receiving instructions to stop receiving and sending subsequent data packets to one or more components of the vehicle.

14. The method of claim 13, wherein the instructions are received in response to the driver activating an emergency stop button of the vehicle.

15. The method of claim 1, wherein signaling the driver comprises activating one or more indicators on a dashboard of the vehicle alerting the driver to take over control of the vehicle.

16. The method of claim 15, wherein the one or more indicators comprise light emitting diodes (LEDs).

17. The method of claim 1, wherein the data packet is cryptographically encrypted.

18. The method of claim 1, further comprising:

prior to analyzing the data packet, decrypting the data packet, by a secure element of the computing system.

10. (canceled)

19. A computing system comprising:

one or more processors and one or more computer-readable non-transitory storage media coupled to one or more of the processors, the one or more computer-readable non-transitory storage media comprising instructions operable when executed by one or more of the processors to cause the computing system to perform operations comprising;

receiving a data packet from one or more sensors or processors of the vehicle through one or more networks;

analyzing the data packet to determine;

     1) an authenticity of the data packet received from the one or more sensors or processors of the vehicle or

     2) a validity or a correctness of the data packet based on a comparison of the data packet to expected information; and

initiating one or more actions including at least one of signaling that a fault has occurred to a driver or transferring control of the vehicle to the driver in response to one or more of the authenticity, the validity, or the correctness failing to satisfy one or more criteria.

20. One or more computer-readable non-transitory storage media embodying software that is operable when executed to cause one or more processors to perform operations comprising:

receiving a data packet from one or more sensors or processors of the vehicle through one or more networks;

analyzing the data packet to determine;

     1) an authenticity of the data packet received from the one or more sensors or processors of the vehicle or

     2) a validity or a correctness of the data packet based on a comparison of the data packet to expected information; and

initiating, by the computing system of the vehicle, one or more actions including at least one of signaling a driver that a fault has occurred or transferring control of the vehicle to the driver in response to one or more of the authenticity, the validity, or the correctness failing to satisfy one or more criteria.