Security system and method for protecting a vehicle electronic system

• US 9,881,165 B2
• Filed: 03/28/2013
• Issued: 01/30/2018
• Est. Priority Date: 03/29/2012
• Status: Active Grant

• Current Assignee: Sheelds Cyber Limited
• Original Assignee: Arliou Information Security Technologies Ltd.
• Inventors: Litichever, Gil, Levi, Ziv
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US14/376,827
• Publication Number:
  US 20150020152A1
• Time in Patent Office: 1,769 Days
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 12/40143 involving priority mechanisms hybrid switching fabrics H04L12/6402; intermediate storage or scheduling H04L49/90; time-division multiplex systems H04J3/00
• CPC Class Codes: H04L 12/40169 Flexible bus arrangements arrangements for maintenance or administration involving management of faults; events, alarms H04L41/06; automatic restoration of network faults H04L41/0654
• CPC Class Codes: H04L 2012/40215 Controller Area Network CAN
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 4/48 for in-vehicle communication

Abstract

Security system for protecting a vehicle electronic system by selectively intervening in the communications path in order to prevent the arrival of malicious messages at ECUs, in particular at the safety critical ECUs. The security system includes a filter which prevents illegal messages sent by any system or device communicating over a vehicle communications bus from reaching their destination. The filter may, at its discretion according to preconfigured rules, send messages as is, block messages, change the content of the messages, request authentication or limit the rate such messages can be delivered, by buffering the messages and sending them only in preconfigured intervals.

Claims

1. An Electronic Control Unit (ECU) for exchanging messages with other ECUs in a vehicle over a vehicle communication bus under control of a data unit, each of the messages is composed of multiple parts, the ECU comprising in a single enclosure:

a first port;

a first transceiver coupled to the first port for transmitting messages to, and for receiving messages from, the first port;

a second physical port for connecting to the communication bus;

a second transceiver coupled to the second physical port for transmitting messages to, and for receiving messages from, the communication bus;

a third physical port for connecting to the data unit;

a third transceiver coupled to the third physical port for receiving from the data unit a rule associated with a part of the message;

a software and a processor for executing the software, the processor is coupled for controlling the first, second, and third transceivers;

a fourth physical port for connecting to an additional communication bus or to an additional ECU; and

a fourth transceiver coupled to the fourth physical port for transmitting messages to, and for receiving messages from, the respective additional communication bus or the additional ECU,

wherein the fourth transceiver is coupled to be controlled by the processor,

wherein the ECU is operative to receive messages from the fourth physical port, and responsive to the rule received from the data unit via the third physical port, to pass, to block, or to change and then pass, the received messages to the communication bus via the second physical port, or to the first port,

wherein the ECU is operative to receive messages from the first port, and responsive to the rule received from the data unit via the third physical port, to pass, to block, or to change and then pass, the received messages to the communication bus via the second physical port, and

wherein the ECU is operative to receive messages from the communication bus via the second physical port, and responsive to the rule received from the data unit via the third physical port, to pass, to block, or to change and then pass, the received messages to the first port.

2. The ECU according to claim 1, further operative to receive, and to respond to, multiple rules from the data unit via the third physical port.

3. The ECU according to claim 1, wherein all the messages received from the first port and from the communication bus are associated with a property, and wherein each of the messages includes a value of the property, and wherein the rule identifies the property and one or more values, and a specific received message is passed, blocked, or changed and then passed, in response to a comparison of the specific message value to the one or more rule values.

4. The ECU according to claim 3, wherein the property corresponds to a message header, a message content, a message length, an identification (ID) of a message, a message destination, or any combination thereof.

5. The ECU according to claim 1, wherein all the messages received from the first port and from the communication bus are associated with a timing information, wherein the rule includes one or more timing values, and wherein a specific received message is passed, blocked, or changed and then passed, in response to a comparison of the specific message timing information to the one or more rule timing values.

6. The ECU according to claim 1, wherein the parts comprise a header, a source identification, a destination identification, or content, and the ECU is further operative to limit the rate of transmitting messages to the first port.

7. The ECU according to claim 6, further comprising a buffer coupled between the first and second transceivers for adapting between the messages incoming rate from the communication bus via the second physical port and the messages outgoing rate to the first port.

8. The ECU according to claim 1, wherein a message is transmitted to the first port only a pre-determined time interval after the previous message was transmitted.

9. The ECU according to claim 1, further operative to limit the rate of transmitting messages to the communication bus via the second physical port.

10. The ECU according to claim 9, further comprising a buffer coupled between the first and second transceivers, to adapt between the message incoming rate from the first port and the message outgoing rate to the communication bus via the second physical port.

11. The ECU according to claim 1, wherein a message is transmitted to the communication bus via the second physical port only a pre-determined time interval after the previous message was transmitted.

12. The ECU according to claim 1, further comprising a communication bus emulator coupled to the first transceiver for emulating the communication bus.

13. The ECU according to claim 12, further operative to emulate the communication bus to the ECU when the ECU is not connected to the communication bus.

14. The ECU according to claim 12, wherein the communication via the first port is based on, uses, or is according to a protocol, and wherein the communication bus emulator comprises a high-level driver and is operative for protocol abstraction.

15. The ECU according to claim 14, wherein the communication bus emulator is operative to continuously transmit ‘

keep-alive’

messages to the first port.

16. The ECU according to claim 1, further comprising a non-volatile memory in the single enclosure coupled to the third transceiver for storing the rule.

17. The ECU according to claim 16, wherein the non-volatile memory is Flash based.

18. The ECU according to claim 16, further operative to fetch the rule from the non-volatile memory, and to pass, to block, or to change and then pass, the received message in response to the fetched rule.

19. The ECU according to claim 1, wherein the communication with the data unit is based on, or using, serial communication, and wherein the third physical port is a serial physical port connection and the third transceiver is a serial data transceiver.

20. The ECU according to claim 19, wherein the serial data transceiver comprises a Universal Asynchronous Receiver Transmitter (UART).

21. The ECU according to claim 19, wherein the serial communication is based on, or using, RS-232.

22. The ECU according to claim 1, further operative to receive a message from the first port or from the communication bus via the second physical port, and to pass the message to the data unit via the third physical port.

23. The ECU according to claim 1, further operative for being inspected, controlled, or debugged by the data unit when connected to the data unit via the third physical port.

24. The ECU according to claim 1, wherein the ECU is operative to, responsive to the rule received from the data unit via the third physical port, to pass, to block, or to change and then pass, transmit messages received from the first port or from the communication bus via the second physical port, to an additional communication bus or to an additional ECU via the fourth physical port.

25. The ECU according to claim 1, further operative to append a signature to part of, or all of, the messages received from the first port, and to transmit the signed messages to the communication bus via the second physical port, or is operative to append a signature to part of, or all of, the messages received from the communication bus via the second physical port, and to transmit the signed messages to the first port.

26. The ECU according to claim 25, further operative to calculate a hash value of the content of the part of, or all of, the messages, and wherein the added signature is based on, or according to, the calculated hash value.

27. The ECU according to claim 25, further operative to encrypt the content of the part of, or all of, the messages, and wherein the added signature is based on, or according to, the encrypted content.

28. The ECU according to claim 27, wherein the encryption is based on, or uses, a key.

29. The ECU according to claim 28, for use with messages originated by a source ECU to be sent to a destination ECU, wherein the ECU serves as the source or destination ECU, and wherein the key is shared between the source and destination ECUs.

30. The ECU according to claim 1, wherein the part of, or all of, the messages include a signature, and wherein the ECU is further operative to verify the signature.

31. The ECU according to claim 30, wherein the verification comprises calculating a hash value or encrypting the content of the part of, or all of, the messages, and respectively comparing the hash value or the encrypted content to the signature.

32. The ECU according to claim 30, further operative to pass, to block, or to change and then pass, the messages in response to the signature verification.

33. The ECU according to claim 1, further comprising a buffer coupled to the first transceiver for temporarily storing messages received via the first port.

34. The ECU according to claim 1, further comprising a buffer coupled to the second transceiver for temporarily storing messages received via the second physical port.

35. The ECU according to claim 1, further comprising a buffer coupled to the first transceiver for temporarily storing messages to be transmitted via the first port.

36. The ECU according to claim 1, further comprising a buffer coupled to the second transceiver for temporarily storing messages to be transmitted via the second physical port.

37. The ECU according to claim 1, wherein the first transceiver or the software comprises a physical layer driver adapted to transmit or receive messages respectively to or from the first port.

38. The ECU according to claim 1, wherein the second transceiver or the software comprises a physical layer driver adapted to transmit or receive messages respectively to or from the communication bus.

39. The ECU according to claim 1, further operative to save messages received from the first port or from the communication bus via the second physical port.

40. The ECU according to claim 1, further operative to derive and log statistics associated with the messages received from the first port or from the communication bus via the second physical port.

41. The ECU according to claim 1, further comprising a filter coupled between the first and second transceivers for passing messages therebetween.

42. The ECU according to claim 41, wherein the filter is part of, or comprises, the software, the processor, or any combination thereof.

43. The ECU according to claim 1, wherein the communication bus is according to a first protocol and wherein the ECU is further connectable to an additional communication bus that uses a second protocol, and wherein the ECU is operative to convert between the first and second protocols.

44. The ECU according to claim 1, for use with an authentication scheme that uses a message pair consisting of a challenge message and a challenge response message, wherein the ECU is operative to determine one of the other ECUs as authenticated based on using the authentication scheme.

45. The ECU according to claim 44, further operative to transmit to the first port the challenge message, and to receive a response from the first port.

46. The ECU according to claim 45, further operative to compare the received response from other ECU to the challenge response message, and upon verifying that the received response is identical to the challenge response message, determining that the other ECU as authenticated.

47. The ECU according to claim 44, further operative to receive from the first port the challenge message, and in response to transmit to the first port the challenge response message.

48. The ECU according to claim 44, further operative to responsive to the determining of the other ECU as authenticated, to pass, to block, or to change and then pass, the received messages to the communication bus via the second physical port.

49. The ECU according to claim 44, further operative to responsive to the determining of the other ECU as authenticated, to pass, to block, or to change and then pass, the received messages to the first port.

50. The ECU according to claim 1, for use with a plurality of ECUs coupled to transmit messages to, and receive messages from, the communication bus, and for use with an authentication scheme that uses a message pair consisting of a challenge message and a challenge response message, wherein the ECU is operative to select a first ECU selected from the plurality of ECUs and to determine the first ECU as authenticated based on using the authentication scheme.

51. The ECU according to claim 50, further operative to transmit to the first ECU via the second physical port the challenge message, and to receive a response from the first ECU via the second physical port.

52. The ECU according to claim 51, further operative to compare the received response from the first ECU to the challenge response message, and upon verifying that the received response is identical to the challenge response message, determining the first ECU as authenticated.

53. The ECU according to claim 50, further operative to receive from the first ECU via the second physical port the challenge message, and in response to transmit to the first ECU via the second physical port the challenge response message.

54. The ECU according to claim 50, wherein each of the messages includes identification of the source or destination ECU, and wherein the ECU is further operative to responsive to the determining of the first ECU as authenticated, to pass, to block, or to change and then pass, the received messages that include the first ECU as a source or destination.

55. The ECU according to claim 1, wherein the vehicle communication bus uses, or is compatible with, a multi-master, serial protocol using acknowledgement, arbitration, and error-detection schemes.

56. The ECU according to claim 55, wherein the vehicle communication bus employs, uses, is based on, or is compatible with, a synchronous and frame-based protocol.

57. The ECU according to claim 56, wherein the vehicle communication bus consists of, employs, uses, is based on, or is compatible with, a Controller Area Network (CAN).

58. The ECU according to claim 55, wherein the vehicle communication bus employs, uses, is based on, or is compatible with, a Local Interconnect Network (LIN), FlexRay protocol, or Vehicle Area Network (VAN) bus.

59. The ECU according to claim 1, wherein the vehicle communication bus is based on, uses, or is compatible with, MOD-BUS, MIL-STD-1553, or MIL-STD-1773 (ARINC).

60. The ECU according to claim 1, further comprising, or consisting of, an Engine Control Unit (EcU), immobilizer, or antitheft unit.

61. The ECU according to claim 1, further comprising, or consisting of, a safety critical ECU.

62. The ECU according to claim 61, further comprising, or consisting of, an Engine Control Unit (EcU), a Transmission Control Unit (TCU), Anti-Lock Braking System (ABS), Electronic Stability Control (ESC), or a brake control module.

63. The ECU according to claim 1, further comprising, consisting of, or is connectable to, an infotainment system, wireless tire pressure sensor (TPMS), Course Computer Unit (CCU), or telematics unit.

64. The ECU according to claim 1, further coupleable or connectable to receive data from a unit that is external to the vehicle.

65. The ECU according to claim 64, further wirelessly coupleable to receive data from the unit that is external to the vehicle.

66. The ECU according to claim 64, further wirelessly coupleable to receive radio or a Radio Data System (RDS) or to receive via cellular communication.

67. The ECU according to claim 1, further operative to encrypt part of, or whole of, the content of the part of, or all of, the messages that are transmitted via the first, second, or third ports.

68. A vehicle comprising the vehicle communication bus and the Electronic Control Unit (ECU) according to claim 1 connected thereto.

69. The vehicle according to claim 68, wherein the vehicle comprises, or consists of, a car, a truck, a motorcycle, a train, a tank, an airplane, a missile, a spaceship, a rocket, or a robot.

70. The vehicle according to claim 68, further operative for Vehicle-to-Vehicle (V2V) or Vehicle-to-Infrastructure (V2I) communication.