Controller area network bus monitor

• US 9,843,597 B2
• Filed: 08/10/2015
• Issued: 12/12/2017
• Est. Priority Date: 01/05/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Allouche, Yair, Gilad, Yossi, Margalit, Oded
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US14/821,820
• Publication Number:
  US 20160197944A1
• Time in Patent Office: 855 Days
• Field of Search: 726 23
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Techniques for monitoring a controller area network bus are described herein. In one example, a system comprises a processor that is to detect a message from a source electronic control unit in a vehicle and calculate a location of the source electronic control unit based on at least two arrival times, the arrival times indicating a distance between a first monitor and the source electronic control unit. The processor can also detect that the message corresponds to a function controlled by a second electronic control unit and generate a warning that the message from the source electronic control unit is malicious.

Claims

1. A system to monitor a controller area network bus comprising:

a hardware processor to;

detect a message from a source electronic control unit in a vehicle;

calculate a location of the source electronic control unit based on at least two arrival times and based on a distance from a first monitor to the source electronic control unit and a distance from a second monitor to the source electronic control unit, wherein the at least two arrival times comprise an error estimating a clock inaccuracy due to clock synchronization, wherein the error is bounded based at least in part on a wave propagation speed;

detect that a distance between the location of the source electronic control unit and a location of a predetermined authorized electronic control unit that processes a function corresponding to the message exceeds a predetermined threshold and that clock values for the source electronic control unit and the predetermined authorized electronic control unit are different; and

generate a warning that the message from the source electronic control unit is malicious in response to detecting a collision on the controller area network bus during transmission of the message and based on the distance between the source electronic control unit and the predetermined authorized electronic control unit and the different clock values, wherein the warning indicates the location of the source electronic control unit that is to be replaced or patched; and

invalidate the message by transmitting a zero bit simultaneously with a cyclic redundancy check delimiter corresponding to the message.

2. The system of claim 1, wherein the first monitor communicates with the controller area network bus via a read only protocol.

3. The system of claim 2, wherein the hardware processor is to transmit the warning to an external computing device residing on a secondary bus.

4. The system of claim 1, wherein the first monitor communicates with the controller area network bus via a read-write protocol.

5. The system of claim 1, wherein the arrival times indicate a propagation delay based on the distance between the source electronic control unit and the first monitor.

6. A method for monitoring a controller area network bus comprising:

detecting, via a hardware processor, a message transmitted by the controller area network from a source electronic control unit in a vehicle;

calculating, via the hardware processor, a location of the source electronic control unit based on at least two arrival times and based on a distance from a first monitor to the source electronic control unit and a distance from a second monitor to the source electronic control unit, wherein the at least two arrival times comprise an error estimating a clock inaccuracy due to clock synchronization, and wherein the error is bounded based at least in part on a wave propagation speed;

detecting that a distance between the location of the source electronic control unit and a location of a predetermined authorized electronic control unit that processes a function corresponding to the message exceeds a predetermined threshold and that clock values for the source electronic control unit and the predetermined authorized electronic control unit are different; and

generating, via the hardware processor, a warning that the message from the source electronic control unit is malicious in response to detecting a collision on the controller area network bus during transmission of the message and based on the distance between the source electronic control unit and the predetermined authorized electronic control unit and the different clock values, wherein the warning indicates the location of the source electronic control unit that is to be replaced or patched; and

invalidating the message by transmitting a zero bit simultaneously with a cyclic redundancy check delimiter corresponding to the message.

7. The method of claim 6, wherein the first monitor communicates with the controller area network bus via a read only protocol.

8. The method of claim 6, comprising transmitting the warning to an external computing device residing on a secondary bus.

9. The method of claim 6, wherein the first monitor communicates with the controller area network bus via a read/write protocol.

10. The method of claim 6, wherein the arrival times indicate a propagation delay based on the distance between the source electronic control unit and the first monitor.

11. A computer program product for monitoring a controller area network bus, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program instructions executable by a hardware processor to cause the hardware processor to:

detect, via the hardware processor, a message from a source electronic control unit in a vehicle;

calculate, via the hardware processor, a location of the source electronic control unit based on at least two arrival times and based on a distance from a first monitor to the source electronic control unit and a distance from a second monitor to the source electronic control unit, wherein the at least two arrival times comprise an error estimating a clock inaccuracy due to clock synchronization, and wherein the error is bounded based at least in part on a wave propagation speed;

detect that a distance between the location of the source electronic control unit and a location of a predetermined authorized electronic control unit that processes a function corresponding to the message exceeds a predetermined threshold and that clock values for the source electronic control unit and the predetermined authorized electronic control unit are different; and

generate, via the hardware processor, a warning that the message from the source electronic control unit is malicious in response to detecting a collision on the controller area network bus during transmission of the message and based on the distance between the source electronic control unit and the predetermined authorized electronic control unit and the different clock values, wherein the warning indicates the location of the source electronic control unit that is to be replaced or patched; and

invalidate the message by transmitting a zero bit simultaneously with a cyclic redundancy check delimiter corresponding to the message.

12. The computer program product of claim 11, wherein the arrival times indicate a propagation delay based on the distance between the source electronic control unit and the first monitor.

13. The computer program product of claim 11, wherein the first monitor communicates with the controller area network bus via a read only protocol.

14. The computer program product of claim 13, wherein the program instructions cause the hardware processor to transmit the warning to an external computing device residing on a secondary bus.