Method and control unit for recognizing manipulations on a vehicle network

• US 9,471,770 B2
• Filed: 05/15/2012
• Issued: 10/18/2016
• Est. Priority Date: 05/24/2011
• Status: Expired due to Fees

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Beyer, Ralf, Falk, Rainer
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US14/117,877
• Publication Number:
  US 20140107875A1
• Time in Patent Office: 1,617 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: B61L 15/0036 Conductor-based, e.g. using CAN-Bus, train-line or optical fibres
• CPC Class Codes: B61L 15/0072 On-board train data handling
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04W 12/121 Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
• CPC Class Codes: H04W 4/40 for vehicles, e.g. vehicle-to-pedestrians [V2P]

Abstract

A method for detecting manipulation of at least one vehicle network of a vehicle includes determining a digital fingerprint of the at least one vehicle network, comparing the digital fingerprint of the at least one vehicle network to reference information, adapting a function of the at least one vehicle network as a function of a result of the comparison, such that operational safety is ensured, and activating a regular control mode if no manipulation of the at least one vehicle network is detected, or activating an operationally safe control mode if manipulation of the at least one vehicle network is detected. A control unit for detecting manipulation of at least one vehicle network of a vehicle carries out control tasks as a function of a result of a comparison of a digital fingerprint of at least one vehicle network to reference information of a control network.

Claims

1. A method for detecting manipulation of at least one vehicle network of a vehicle, the method comprising the following steps:

ascertaining a digital fingerprint of the at least one vehicle network, wherein the at least one vehicle network is selected from the group consisting of a drive network, a brake network, a train protection network, an air-conditioning control network, a door control network, a passenger information network, and a video monitoring network;

comparing the digital fingerprint of the at least one vehicle network with reference information to determine a manipulation; and

activating a regular control mode if no manipulation of the at least one vehicle network is detected, or activating a safe control mode if a manipulation of the at least one vehicle network is detected.

2. The method according to claim 1, which further comprises carrying out a step of adapting the at least one vehicle network using a control unit.

3. The method according to claim 1, which further comprises using stored safety functions to prevent damage when a manipulation is detected, wherein the safe control mode prevents damage to at least one entity selected from the group consisting of a person and the vehicle.

4. The method according to claim 1, which further comprises detecting a manipulation on the at least one vehicle network by using the result of the comparison of the reference information with the digital fingerprint from the vehicle network.

5. The method according to claim 4, which further comprises executing the regular control mode in a vehicle control network only if an ascertained digital fingerprint from the vehicle control network used for controlling the vehicle matches a stored piece of reference information.

6. The method according to claim 4, which further comprises prompting the at least one vehicle network to be operated in a restricted mode or deactivated to keep the vehicle in a safe state, upon a discrepancy between a recorded digital fingerprint and a piece of reference information.

7. The method according to claim 1, wherein the vehicle network is implemented as an Ethernet network, an IP network, or a combination thereof.

8. The method according to claim 1, wherein the vehicle network is a self-contained vehicle network with a fixed network configuration to simplify detection of a discrepancy from the fixed network configuration.

9. The method according to claim 8, which further comprises prompting adaptation of control of the at least one vehicle network upon a discrepancy in a comparison between a fixed piece of reference network configuration information and the digital fingerprint of at least one vehicle network to be checked.

10. The method according to claim 1, which further comprises not commencing regular operation of the vehicle upon detecting a manipulation or vandalism on the at least one vehicle network.

11. The method according to claim 1, which further comprises checking topological integrity for network cabling.

12. The method according to claim 1, which further comprises monitoring the vehicle network with physical sensors.

13. The method according to claim 1, which further comprises evaluating physical transmission parameters and comparing the physical transmission parameters with reference values.

14. The method according to claim 1, which further comprises detecting extraneous devices in the vehicle network.

15. The method according to claim 14, which further comprises protecting an identifier of a device by using a cryptographic key.

16. The method according to claim 1, which further comprises storing a currently available fingerprint of the vehicle network as a new fingerprint of the vehicle network.

17. The method according to claim 1, which further comprises carrying out manipulation recognition constantly or at selected times or for selected events or for selected operating states.

18. The method according to claim 1, which further comprises monitoring individual vehicle subnetworks.

27. The method according to claim 1, wherein the fingerprint includes information selected from the group consisting of a number, a type and an identity of components connected to the vehicle network.

19. A network, comprising:

a plurality of networks disposed on a vehicle, said plurality of networks including a control network with a control unit and at least one vehicle network selected from the group consisting of;

a drive network, a brake network, a train protection network, an air-conditioning control network, a door control network, a passenger information network, and a video monitoring network;

said control unit configured to compare a digital fingerprint from said at least one vehicle network with reference information from said control network to determine a manipulation, wherein said control unit is a computer; and

said control unit configured for activating a regular control mode if no manipulation of the at least one vehicle network is detected, and for activating a safe control mode if a manipulation of the at least one vehicle network is detected.

20. The network according to claim 19, wherein said control unit is configured to perform a self-check.

21. The network according to claim 19, wherein said control unit is configured to enable, restrictedly enable or deactivate at least one controller for a regular operation.

22. The network according to claim 19, wherein said a control computer is configured to limit admissible communication through a network coupler/gateway to couple a plurality of vehicle networks.

23. The network according to claim 19, wherein said control unit is configured to switch off an alarm message indicating detection of a manipulation and to commence regular operation.

24. The network according to claim 19, which further comprises an error memory configured to store check results.

25. The network according to claim 19, which further comprises a standard mobile radio network interface configured to transmit data communication for detection of manipulation to a land-based unit.

26. The network according to claim 19, which further comprises a network coupler/gateway interconnecting a plurality of vehicle networks or vehicle subnetworks.

28. The network according to claim 19, wherein the fingerprint includes information selected from the group consisting of a number, a type and an identity of components connected to the vehicle network.