US 12,069,027 B2
Securing intra-vehicle communications via a controller area network bus system based on behavioral statistical analysis
H. Agustin Cozzetti, Vallauris (FR)
Assigned to Fortinet, Inc., Sunnyvale, CA (US)
Filed by Fortinet, Inc., Sunnyvale, CA (US)
Filed on Mar. 22, 2019, as Appl. No. 16/361,521.
Prior Publication US 2020/0304467 A1, Sep. 24, 2020
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01); H04L 12/40 (2006.01); B60R 16/023 (2006.01)
CPC H04L 63/0245 (2013.01) [H04L 12/40 (2013.01); B60R 16/0231 (2013.01); H04L 2012/40215 (2013.01); H04L 2012/40273 (2013.01)] 14 Claims
OG exemplary drawing
 
1. A computer-implemented method comprising:
receiving, by one or more processors associated with a receiving node of a plurality of nodes coupled with a Controller Area Network (CAN) bus of a connected car, a data frame broadcast from a source node of the plurality of nodes;
making a first determination, by the one or more processors, whether the receiving node is the intended recipient of the data frame;
responsive to said first determination being affirmative:
making a second determination, by the one or more processors, whether an internal firewall node of the plurality of nodes has identified the data frame as a potentially malicious data frame; and
responsive to said second determination being affirmative, dropping the data frame and discontinuing processing of the data frame;
responsive to said first determination being negative or said second determination being negative, extracting, by the one or more processors, information from the data frame;
analyzing coherence between the extracted information and historical information observed by the receiving node, wherein said analyzing coherence comprises analyzing coherence between the extracted information and a combination of (i) a current status of an environment in which the connected car is operating based on a current database and (ii) a status of the source node, using a local behavior database, wherein the current database includes historical information regarding one or more of (a) an identity of neighboring vehicles in proximity to the connected car, and (b) respective status associated with the neighboring vehicles within a predetermined amount of time, and wherein the local behavior database includes historical information regarding a sequence of communications observed by the receiving node; and
responsive to a result of said analyzing coherence indicating the data frame is valid, updating, by the one or more processors, the historical information based on the data frame, otherwise discarding the data frame.