System and method for detecting OBD-II CAN BUS message attacks
First Claim
1. A method for detecting security attacks against a vehicle via the vehicle'"'"'s OBD-II (On-Board Diagnostics II) port, the method comprising:
- at an OBD-II CAN (Controller Area Network) message screening system, wherein the OBD-II CAN message screening system is electrically coupled to the vehicle via the OBD-II port;
establishing an OBD-II CAN inbound message whitelist and an OBD-II CAN outbound message blacklist;
in response to receiving an inbound CAN message command from a device external to the vehicle,updating statistics of the inbound CAN message command;
comparing the inbound CAN message command with the OBD-II CAN message whitelist alone;
forwarding the inbound CAN message command to the vehicle via the vehicle'"'"'s OBD-II port and sending alerts to a mobile application via a wireless communication channel when the updated statistics meets a predefined threshold when the inbound CAN message command appears in the OBD-II CAN message whitelist;
in response to receiving an outbound CAN message command from the vehicle,comparing the outbound CAN message command with the OBD-II CAN message blacklist alone; and
forwarding the CAN message command to an external device via the vehicle'"'"'s OBD-II port when the CAN message command does not appear in the OBD-II CAN message blacklist.
1 Assignment
0 Petitions
Accused Products
Abstract
The present application discloses method and system for detecting potential security attacks against a vehicle networking through an OBD-II port. The system establishes an inbound OBD-II CAN message whitelist and an outbound OBD-II CAN message blacklist, respectively. Upon receipt of a CAN message command, the system updates statistics for the command and determines whether the command is inbound or outbound. In response to an inbound command from a device external to the vehicle, the system compares the inbound command with the whitelist and forwards the inbound CAN message command to the vehicle via the vehicle'"'"'s OBD-II port when inbound command appears in the whitelist. In response to an outbound CAN message command from the vehicle, the system compares the outbound command with the blacklist and prevents the outbound command from being sent to an external vehicle via the vehicle'"'"'s OBD-II port when the outbound command appears in the blacklist.
-
Citations
12 Claims
-
1. A method for detecting security attacks against a vehicle via the vehicle'"'"'s OBD-II (On-Board Diagnostics II) port, the method comprising:
at an OBD-II CAN (Controller Area Network) message screening system, wherein the OBD-II CAN message screening system is electrically coupled to the vehicle via the OBD-II port; establishing an OBD-II CAN inbound message whitelist and an OBD-II CAN outbound message blacklist; in response to receiving an inbound CAN message command from a device external to the vehicle, updating statistics of the inbound CAN message command; comparing the inbound CAN message command with the OBD-II CAN message whitelist alone; forwarding the inbound CAN message command to the vehicle via the vehicle'"'"'s OBD-II port and sending alerts to a mobile application via a wireless communication channel when the updated statistics meets a predefined threshold when the inbound CAN message command appears in the OBD-II CAN message whitelist; in response to receiving an outbound CAN message command from the vehicle, comparing the outbound CAN message command with the OBD-II CAN message blacklist alone; and forwarding the CAN message command to an external device via the vehicle'"'"'s OBD-II port when the CAN message command does not appear in the OBD-II CAN message blacklist. - View Dependent Claims (2, 3, 4, 5, 6)
-
7. An OBD-II (On-Board Diagnostics II) CAN (Controller Area Network) message screening system comprising:
-
an MCU (Micro Controller Unit); and memory that is electrically coupled to the MCU, wherein the memory stores an inbound OBD-II CAN message whitelist and an outbound OBD-II CAN message blacklist and a plurality of program modules to be executed by the MCU, and the plurality of program modules further include a CAN message processing module, a communication module, and a command statistics module; wherein; the MCU is configured to transmit an inbound OBD-II CAN message command received by the communication module to the CAN message processing module and the command statistic module, respectively; the command statistic module is configured to update statistics of the inbound CAN message command and report the updated statistics to the MCU; the CAN message processing module is configured to determine whether the inbound OBD-II CAN message command appears in the inbound OBD-II CAN message whitelist alone and report the determination to the MCU; the MCU is configured to forward the inbound OBD-II CAN message command to a vehicle coupled to the OBD-II CAN message screening system via an OBD port in accordance with the determination and send alerts to a mobile application via a wireless communication channel when the updated statistics meets a predefined threshold; the MCU is configured to transmit an outbound CAN message command from the vehicle to the CAN message processing module and the command statistic module, respectively; the CAN message processing module is configured to determine whether the outbound OBD-II CAN message command appears in the outbound OBD-II CAN message blacklist alone and report the determination to the MCU; and the MCU is configured to forward the outbound OBD-II CAN message command to an external device coupled to the OBD-II CAN message screening system via the OBD port in accordance with the determination. - View Dependent Claims (8, 9, 10, 11, 12)
-
Specification