US 11,985,150 B2
Cybersecurity on a controller area network in a vehicle
Vishal Bajpai, Los Altos, CA (US)
Assigned to SECURETHINGS U.S., INC., Los Altos, CA (US)
Appl. No. 17/058,907
Filed by SECURETHINGS U.S., INC., Los Altos, CA (US)
PCT Filed May 24, 2019, PCT No. PCT/US2019/034053
§ 371(c)(1), (2) Date Nov. 25, 2020,
PCT Pub. No. WO2019/227076, PCT Pub. Date Nov. 28, 2019.
Claims priority of provisional application 62/755,923, filed on Nov. 5, 2018.
Claims priority of provisional application 62/676,879, filed on May 25, 2018.
Claims priority of provisional application 62/676,877, filed on May 25, 2018.
Claims priority of provisional application 62/676,874, filed on May 25, 2018.
Prior Publication US 2021/0203682 A1, Jul. 1, 2021
Int. Cl. H04L 9/40 (2022.01); H04L 12/40 (2006.01); H04W 4/44 (2018.01)
CPC H04L 63/1425 (2013.01) [H04L 12/40013 (2013.01); H04L 63/0428 (2013.01); H04L 63/1441 (2013.01); H04W 4/44 (2018.02); H04L 2012/40215 (2013.01); H04L 2012/40273 (2013.01)] 25 Claims
OG exemplary drawing
 
1. A system comprising:
a plurality of electronic control units (ECUs), wherein each of the plurality of ECUs is communicatively connected to a Controller Area Network (CAN) bus within a vehicle, and wherein each of the plurality of ECUs comprises at least one hardware processor and a hacking-detection software module that is configured to, when executed by the at least one hardware processor of the respective ECU,
during an initialization stage,
in accordance with a message protocol, transmit a message comprising a CAN identifier, used by the respective ECU, to at least one other hacking-detection software module on at least one other one of the plurality of ECUs,
in accordance with the message protocol, receive a message comprising a CAN identifier, used by the at least one other ECU, from the other hacking-detection software module,
monitor one or more parameters, including at least one parameter of CAN messages received by the respective ECU and transmitted by the respective ECU, according to a CAN bus protocol, on the CAN bus,
generate a pattern-detection mechanism based on the monitored one or more parameters, and
join at least one peer-to-peer sub-network with one or more other hacking-detection software modules, wherein the at least one peer-to-peer sub-network is associated with a security policy, and wherein each hacking-detection software module that has joined the at least one peer-to-peer sub-network operates in accordance with the associated security policy, and
during a detection stage,
monitor the one or more parameters, and
detect malicious activity based on the generated pattern-detection mechanism and the one or more parameters monitored during the detection stage.