FIELD

Embodiments of the disclosure relate to providing cyber security for in-vehicle communication networks.

BACKGROUND

Over the last half century the automotive industry has, initially slowly, and subsequently with great rapidity, been evolving from mechanical control systems for controlling a vehicle's functions to electronic “drive by wire” control systems for controlling the functions. In mechanical vehicular control systems a driver of a vehicle controls components of a vehicle that control vehicle functions by operating mechanical systems that directly couple the driver to the components via mechanical linkages. In drive by wire vehicle control systems a driver may be coupled directly, and/or very often indirectly, to vehicle control components that control vehicle functions by electronic control systems and electronic wire and/or wireless communication channels, rather than direct mechanical linkages. The driver controls the control components by generating electronic signals that are input to the electronic control systems and the communication channels.

Typically, a vehicular electronic control system comprises a user interface for receiving driver actions intended to control a vehicle function, transducers that convert the actions to electronic control signals, and a plurality of sensors and/or actuators that generate signals relevant to the function. An electronic control unit (ECU) of the control system receives the user generated signals and the signals generated by the sensors and/or actuators, and responsive to the signals, operates to control a vehicle component involved in performing the function. The ECU of a given control system may also receive and process signals relevant to performance of the function generated by, and/or by components in, other vehicle control systems. The sensors, actuators, and/or other control systems communicate with each other and the ECU of the given control system via a shared in-vehicle communication network, to cooperate in carrying out the function of the given control system.

By way of example, a vehicle throttle by wire control system that replaces a conventional cable between an accelerator pedal and an engine throttle may comprise an electronic accelerator pedal, an ECU also referred to as an engine control module (ECM), and an electronic throttle valve that controls airflow into the engine and thereby power that the engine produces. The electronic accelerator pedal generates electronic signals responsive to positions to which a driver depresses the pedal. The ECM receives the accelerator pedal signals, and in addition electronic signals that may be generated by other sensors, actuators, and electronic control systems in the vehicle that provide information relevant to the safe and efficient control of the engine via an in-vehicle communication network. The ECM processes the driver input signals and the other relevant signals to generate electronic control signals that control the throttle. Among the other sensors actuators, and electronic control systems that may provide relevant signals to the ECM over the in-vehicle network are, air-flow sensors, throttle position sensors, fuel injection sensors, engine speed sensors, vehicle speed sensors, brake force and other traction control sensors comprised in a brake by wire system, and cruise control sensors.

In-vehicle communication networks of modern vehicles are typically required to support communications for a relatively large and increasing number of electronic control systems of varying degrees of criticality to the safe and efficient operation of the vehicles. A modern vehicle may for example be home to as many as seventy or more control system ECUs that communicate with each other and sensors and actuators that monitor and control vehicle functions via the in-vehicle network. The ECU's may, by way of example, be used to control in addition to engine throttle described above, power steering, transmission, antilock braking (ABS), airbag deployment, cruise control, power windows, doors, and mirror adjustment. In addition, an in-vehicle network typically supports on board diagnostic (OBD) systems and communication ports, various vehicle status warning systems, collision avoidance systems, audio and visual information and entertainment (infotainment) systems and processing of images acquired by on-board camera systems. The in-vehicle network in general also provides access to mobile communication networks, WiFi and Bluetooth communications, TPMS (tire pressure monitor system) V2X (vehicle to vehicle communication), keyless entry system, the Internet, and GPS (global positioning system).

Various communication protocols have been developed to configure, manage, and control communications of vehicle components that are connected to and communicate over an in-vehicle communication network. Popular in-vehicle network communication protocols currently available are CAN (control area network), FlexRay, MOST (Media Oriented Systems Transport), Ethernet, and LIN (local interconnect network). The protocols may define a communication bus and how the ECUs, sensors, and actuators, generically referred to as nodes, connected to the communication bus, access and use the bus to transmit signals to each other.

The growing multiplicity of electronic control systems, sensors, actuators, ECUs and communication interfaces and ports, that an in-vehicle communication network supports makes the in-vehicle communication network, and the vehicle components that communicate via the communication system, increasingly vulnerable to cyber attacks that may dangerously compromise vehicle safety and performance.

SUMMARY

An aspect of an embodiment of the disclosure relates to providing a system, hereinafter also referred to as a global automotive security system (GASS), which operates to provide security to in-vehicle communication systems against cyber attacks for vehicles subscribed to GASS in a relatively extended geographical area. In an embodiment of the disclosure, GASS comprises a data monitoring and processing hub, hereinafter also referred to as a Cyber-Hub, and a module installed in a subscriber vehicle that communicates with the Cyber-Hub. The module may be referred to as a Cyber-Watchman or Watchman.

The Cyber-Watchman installed in a subscriber vehicle monitors communication traffic over at least a portion of an in-vehicle communication network of the vehicle to identify anomalies in the communication traffic that may indicate a disturbance in the normal operation of the network or vehicle. The disturbance may by way of example comprise a malfunction of any of the various components, that is, nodes, in the vehicle connected to the in-vehicle communication network and/or occurrence and/or consequence of a cyber attack on the communication network. In response to identifying an anomaly in communications over the in-vehicle communication network, the Cyber-Watchman may undertake any, or any combination of more than one, of various actions to report, mitigate, and/or control the anomaly.

In an embodiment, the Cyber-Watchman operates to transmit data, hereinafter also referred to as “Watchman data”, to the Cyber-Hub responsive to communications traffic over the in-vehicle communications network that the Watchman monitors. The Cyber-Hub may process Watchman data from a subscriber vehicle to provide information for configuring the Watchman's monitoring of, and/or responding to detected anomalies in, communications over the vehicle's in-vehicle network. The Cyber-Hub, or a user, such a GASS agent or subscriber authorized to receive the information from the Cyber-Hub, may use the information to configure the Watchman.

In an embodiment of the disclosure, the Cyber-Hub processes Watchman data from a plurality of subscriber vehicles to determine if a vehicle or a fleet of vehicles may be under threat of an imminent cyber attack, is under a cyber attack, or has vulnerability to a cyber attack. In response to detecting an imminent, on-going, or vulnerability to, cyber attack, the Cyber-Hub may alert a GASS user to configure the Watchman or Watchmen of a subscriber vehicle or subscriber vehicles to engage the attack. Alternatively or additionally the Cyber-Hub may configure the Watchman or Watchmen directly by transmitting information to the Watchman or Watchmen over a suitable wire or wireless communication channel.

Optionally, the Cyber-Hub processes Watchman data from a plurality of Watchmen to generate measures of vehicle “health” for subscriber vehicles. The Cyber-Hub or a Watchman of a subscriber vehicle may use the measures of vehicle health to detect and anticipate mechanical and/or electronic malfunction of components and/or systems that the subscriber vehicle comprises. Optionally, the Watchman generates alarms to notify a driver of the vehicle, the Cyber-Hub, and/or a GASS agent or subscriber, that a vehicle malfunction is detected or anticipated. In an embodiment of the disclosure the Watchman may be configured to automatically invoke remedial measures to deal with the detected or anticipated malfunction.

By processing Watchman data from a plurality of Watchmen, the Cyber-Hub may benefit from improved statistics in providing measures and maintenance of vehicle health, and detecting vulnerability or exposure to Cyber attacks and providing early warnings and procedures for dealing with of such attacks.

In an embodiment, a Cyber-Watchman is a rule based module that operates in accordance with a set of rules to identify and classify messages transmitted over a subscriber vehicle's in-vehicle network and to determine what, if any, action or actions to undertake with respect to an identified message. The set of rules may autonomously determine how to process an identified message responsive to an operating context of the vehicle during which the message is transmitted over the in-vehicle network. The context may comprise an operating state of the vehicle and/or circumstances under which the vehicle is operating. An operating state of a vehicle may by way of example, comprise, vehicle speed, tire pressure, ambient temperature, vehicle load, and state of health. Circumstances under which the vehicle is operating may, by way of example, comprise road grade and/or traction, ambient temperature and/or humidity, and/or season. The operating context may comprise common operating state to which the Watchman is alerted by the Cyber-Hub. A common operating state is a state common to a plurality of subscriber vehicles at substantially a same time. A common operating state may be detected and defined by the Cyber-Hub from Watchman data transmitted to the Cyber-Hub by the Watchmen of the plurality of vehicles. A common operating state may for example, be defined as a state in which at substantially a same time the plurality of subscriber vehicles is subject to a same cyber attack, or subject to a same probability of failure of a vehicle control system or component. In an embodiment, the Cyber-Hub may configure the rule set of a Watchman in real time to engage and confront a possibly damaging common operating state.

This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter

