System and method for detecting OBD-II CAN BUS message attacks

• US 9,646,156 B2
• Filed: 07/17/2015
• Issued: 05/09/2017
• Est. Priority Date: 07/17/2014
• Status: Expired due to Fees

• Current Assignee: VisualThreat Inc.
• Original Assignee: Visual Threat Incorporated
• Inventors: Yan, Wei, Peng, Kai, Pan, JunWu
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US14/802,803
• Publication Number:
  US 20160019389A1
• Time in Patent Office: 662 Days
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

The present application discloses method and system for detecting potential security attacks against a vehicle networking through an OBD-II port. The system establishes an inbound OBD-II CAN message whitelist and an outbound OBD-II CAN message blacklist, respectively. Upon receipt of a CAN message command, the system updates statistics for the command and determines whether the command is inbound or outbound. In response to an inbound command from a device external to the vehicle, the system compares the inbound command with the whitelist and forwards the inbound CAN message command to the vehicle via the vehicle'"'"'s OBD-II port when inbound command appears in the whitelist. In response to an outbound CAN message command from the vehicle, the system compares the outbound command with the blacklist and prevents the outbound command from being sent to an external vehicle via the vehicle'"'"'s OBD-II port when the outbound command appears in the blacklist.

Claims

1. A method for detecting security attacks against a vehicle via the vehicle'"'"'s OBD-II (On-Board Diagnostics II) port, the method comprising:

at an OBD-II CAN (Controller Area Network) message screening system, wherein the OBD-II CAN message screening system is electrically coupled to the vehicle via the OBD-II port;

establishing an OBD-II CAN inbound message whitelist and an OBD-II CAN outbound message blacklist;

in response to receiving an inbound CAN message command from a device external to the vehicle,

updating statistics of the inbound CAN message command;

comparing the inbound CAN message command with the OBD-II CAN message whitelist alone;

forwarding the inbound CAN message command to the vehicle via the vehicle'"'"'s OBD-II port and sending alerts to a mobile application via a wireless communication channel when the updated statistics meets a predefined threshold when the inbound CAN message command appears in the OBD-II CAN message whitelist;

in response to receiving an outbound CAN message command from the vehicle,

comparing the outbound CAN message command with the OBD-II CAN message blacklist alone; and

forwarding the CAN message command to an external device via the vehicle'"'"'s OBD-II port when the CAN message command does not appear in the OBD-II CAN message blacklist.

2. The method of claim 1, wherein the statistics of the inbound CAN message command includes transmission frequency information by which the inbound CAN message command is received.

3. The method of claim 1, wherein the wireless communication channel is one of a WiFi, 2G, 3G, 4G or Bluetooth communication channel.

4. The method of claim 1, further comprising:

when the inbound CAN message command is not found in the OBD-II CAN message whitelist, sending alerts to a mobile application via a wireless communication channel.

5. The method of claim 1, further comprising:

when the outbound CAN message command is found in the OBD-II CAN message blacklist;

sending alerts to a mobile application via a wireless communication channel.

6. The method of claim 1, wherein the device external to the vehicle is a smartphone that is wirelessly coupled to the OBD-II CAN message screening system or a vehicle diagnostic device that is coupled to the OBD-II CAN message screening system.

7. An OBD-II (On-Board Diagnostics II) CAN (Controller Area Network) message screening system comprising:

an MCU (Micro Controller Unit); and

memory that is electrically coupled to the MCU, wherein the memory stores an inbound OBD-II CAN message whitelist and an outbound OBD-II CAN message blacklist and a plurality of program modules to be executed by the MCU, and the plurality of program modules further include a CAN message processing module, a communication module, and a command statistics module;

wherein;

the MCU is configured to transmit an inbound OBD-II CAN message command received by the communication module to the CAN message processing module and the command statistic module, respectively;

the command statistic module is configured to update statistics of the inbound CAN message command and report the updated statistics to the MCU;

the CAN message processing module is configured to determine whether the inbound OBD-II CAN message command appears in the inbound OBD-II CAN message whitelist alone and report the determination to the MCU;

the MCU is configured to forward the inbound OBD-II CAN message command to a vehicle coupled to the OBD-II CAN message screening system via an OBD port in accordance with the determination and send alerts to a mobile application via a wireless communication channel when the updated statistics meets a predefined threshold;

the MCU is configured to transmit an outbound CAN message command from the vehicle to the CAN message processing module and the command statistic module, respectively;

the CAN message processing module is configured to determine whether the outbound OBD-II CAN message command appears in the outbound OBD-II CAN message blacklist alone and report the determination to the MCU; and

the MCU is configured to forward the outbound OBD-II CAN message command to an external device coupled to the OBD-II CAN message screening system via the OBD port in accordance with the determination.

8. The system of claim 7, wherein the statistics of the CAN message command includes transmission frequency information by which the CAN message command is received.

9. The system of claim 7, wherein the wireless communication channel is one of a WiFi, 2G, 3G, 4G or Bluetooth communication channel.

10. The system of claim 7, wherein the device external to the vehicle is a smartphone that is wirelessly coupled to the OBD-II CAN message screening system or a vehicle diagnostic device that is coupled to the OBD-II CAN message screening system.

11. The system of claim 7, wherein the OBD-II port is a 16-pin OBD-II physical interface.

12. The system of claim 7, wherein the MCU is configured to send alerts to a mobile application via a wireless communication channel when the inbound CAN message command is not found in the OBD-II CAN message whitelist.