# US 10,372,903 B2 · Method of updating fraud detection rules for detecting malicious frames, fraud detecting electronic control unit, and on-board network system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,903 B2 - Document ID: US10372903B2 - Status: Granted - Kind: B2 - Application number: 15/381,498 - Filed: 2016-12-16 - Published: 2017-05-25 - Granted: 2019-08-06 - Earliest claimed: 2015-01-20 - Assignees: Panasonic Intellectual Property Corporation of America - Applicants: Panasonic Intellectual Property Corporation of America - Inventors: Yoshihiro Ujiie; Hideki Matsushima; Tomoyuki Haga; Yuji Unagami; Takeshi Kishikawa - Web page: https://patentgrep.com/patent/US10372903B2 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - B60R 16/02: electric {constitutive elements} - B60R 16/023: for transmission of signals between vehicle parts or subsystems - B60R 16/0231: {Circuits relating to the driving or the functioning of the vehicle (monitoring tyres B60C23/00; indicating overspeed B60K31/00; for dash boards B60K37/00, B60Q3/10; for indicating emergencies B60Q1/52; brake control systems B60T; registering or indicating the working of vehicles G07C5/00; measuring distance G01C, e.g. combinations of speed and distance G01C23/00; engine indicators G01L; measuring speed or acceleration G01P)} - G06F 13/36: for access to common bus or bus system - H04L 12/28: characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks] (wireless communication networks H04W {; arrangements for dividing the transmission path H04W40/00}) - H04L 63/0263: {Rule management} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2221/034: Test or assess a computer or a system - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 2012/40215: {Controller Area Network CAN} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - B60R: VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Provided is a fraud detection rule updating method enabling the updating of rules that serve as the basis for detecting malicious frames as necessary in an on-board network system. In an on-board network system equipped with multiple electronic control units (ECUs) that communicate via buses and fraud detecting ECUs that determine, based on fraud detection rules, whether messages transmitted on the buses conform to the rules, a fraud detection rule updating method is used in which delivery data including updated fraud detection rules is received from a server external to the on-board network system, and if a certain update condition is satisfied, the fraud detection rules in a fraud detecting ECU are updated to the updated fraud detection rules. ## Claims ### Claim 1 A method used in an on-board network system provided with a plurality of electronic controllers that exchange messages by communication over one or more buses, and a fraud detecting electronic controller connected to the one or more buses, the method comprising: determining, in the fraud detecting electronic controller, whether or not a message transmitted on the one or more buses connected to the fraud detecting electronic controller conforms to the rules based on fraud detection rules; receiving, from an external device external to the on-board network system, delivery data including updated fraud detection rules and bus type information indicating one of a plurality of bus types to which the updated fraud detection rules are to be applied; determining whether or not a vehicle in which the on-board network system is installed is running; when the vehicle is determined to be running, additionally determining whether or not the bus type information indicates a drive bus which is connected to an electronic controller related to travel of the vehicle; (i) when the bus type information indicates the drive bus, not conducting an update process with the updated fraud detection rules; and (ii) when the bus type information does not indicate the drive bus, updating the fraud detection rules to the updated fraud detection rules. ### Claim 2 (depends on 1) The method according to claim 1, wherein when the bus type connected to the fraud detecting electronic controller is indicated by the bus type information, the fraud detecting electronic controller treats a certain update condition as satisfied, and performs the update. ### Claim 3 (depends on 1) The method according to claim 1, wherein the delivery data includes a plurality of updated fraud detection rules, and includes bus type information indicating a bus type corresponding to each of the plurality of updated fraud detection rules, and the fraud detecting electronic controller conducts the receiving of the delivery data by communicating with the external device, extracts from the delivery data updated fraud detection rules corresponding to bus type information matching the bus type connected to the fraud detecting electronic controller, and updates the fraud detection rules associated with the determination to the extracted updated fraud detection rules. ### Claim 4 (depends on 1) The method according to claim 1, wherein the delivery data includes a plurality of updated fraud detection rules, and includes bus type information indicating bus type corresponding to each of the plurality of updated fraud detection rules, one of the electronic controllers conducts the receiving of the delivery data, includes each of the updated fraud detection rules from the delivery data in a message with an attached message ID for updating fraud detection rules according to the bus type indicated by the corresponding bus type information, and transmits the message over the one or more buses, and the fraud detecting electronic controller receives, from the one or more buses, the message with the message ID for updating fraud detection rules according to the bus type connected to the fraud detecting electronic controller, and updates the fraud detection rules associated with the determination to the updated fraud detection rules included in the message. ### Claim 5 (depends on 1) The method according to claim 1, wherein the delivery data includes associated information, a certain update condition is a condition related to the associated information, and the updating of the fraud detection rules is conducted when the associated information in the received delivery data satisfies the certain update condition, and is not conducted when the associated information does not satisfy the certain update condition. ### Claim 6 (depends on 5) The method according to claim 5, wherein whether or not the certain update condition is satisfied is determined according to a result of comparing the associated information to information stored by the electronic controller or the fraud detecting electronic controller. ### Claim 7 (depends on 6) The method according to claim 6, wherein the associated information indicates a version of the updated fraud detection rules, and when the associated information indicates a version newer than the version of the fraud detection rules serving as a basis of the determination, the fraud detecting electronic controller treats the certain update condition as satisfied, and conducts the update. ### Claim 8 (depends on 5) The method according to claim 5, wherein the associated information indicates a vehicle type to which the updated fraud detection rules are to be applied, and when the associated information indicates a vehicle type corresponding to a vehicle in which the on-board network system is installed, the certain update condition is treated as satisfied, and the update is conducted. ### Claim 9 (depends on 1) The method according to claim 1, wherein the fraud detection rules and the updated fraud detection rules are configured to include a program for determining conformity to the rules. ### Claim 10 (depends on 1) The method according to claim 1, wherein the delivery data has been subjected to a cryptographic process, and during the receiving of the delivery data, a process corresponding to the cryptographic process is performed. ### Claim 11 (depends on 1) The method according to claim 1, wherein the plurality of electronic controllers communicate over the one or more buses in accordance with a controller area network (CAN) protocol. ### Claim 12 (depends on 1) The method according to claim 1, wherein, the plurality of bus types includes (i) the drive bus which is connected to an electronic controller related to a travel of the vehicle, the travel of the vehicle includes an engine, fuel and a transmission, (ii) a body bus which is connected to an electronic controller related to a control of one of equipment of the vehicle, the equipment includes a door lock, an air conditioner, a light and a winker, and (iii) a safety bus which is connected to an electronic controller related to safety, the safety includes a brake and an air bag. ### Claim 13 A fraud detecting electronic controller connected to one or more buses used for communication by a plurality of electronic controllers, comprising: a processor; and a memory having a computer program stored thereon, a computer program causing the processor to execute operations including: storing fraud detection rules; determining whether or not a message transmitted on the bus connected to the fraud detecting electronic controller conforms to the rules based on the fraud detection rules; receiving delivery data including updated fraud detection rules and bus type information indicating one of a plurality of bus types to which the updated fraud detection rules are to be applied; determining whether or not a vehicle in which an on-board network system is installed is running, the on-board network system including the plurality of controllers; when the vehicle is determined to be running, additionally determining whether or not the bus type information indicates a drive bus which is connected to an electronic controller related to a travel of the vehicle; (i) when the bus type information indicates the drive bus, not conducting an update process with the updated fraud detection rules; and (ii) when the bus type information does not indicate the drive bus, updating the fraud detection rules to the updated fraud detection rules. ### Claim 14 (depends on 13) The controller according to claim 13, wherein when the bus type connected to the fraud detecting electronic controller is indicated by the bus type information, the fraud detecting electronic controller treats a certain update condition as satisfied, and performs the update. ### Claim 15 (depends on 13) The controller according to claim 13, wherein the delivery data includes a plurality of updated fraud detection rules, and includes bus type information indicating a bus type corresponding to each of the plurality of updated fraud detection rules, and the fraud detecting electronic controller conducts the receiving of the delivery data by communicating with the external device, extracts from the delivery data updated fraud detection rules corresponding to bus type information matching the bus type connected to the fraud detecting electronic controller, and updates the fraud detection rules associated with the determination to the extracted updated fraud detection rules. ### Claim 16 (depends on 13) The controller according to claim 13, wherein the delivery data includes a plurality of updated fraud detection rules, and includes bus type information indicating a bus type corresponding to each of the plurality of updated fraud detection rules, one of the electronic controllers conducts the receiving of the delivery data, includes each of the updated fraud detection rules from the delivery data in a message with an attached message ID for updating fraud detection rules according to the bus type indicated by the corresponding bus type information, and transmits the message over the one or more buses, and the fraud detecting electronic controller receives, from the one or more buses, the message with the message ID for updating fraud detection rules according to the bus type connected to the fraud detecting electronic controller, and updates the fraud detection rules associated with the determination to the updated fraud detection rules included in the message. ### Claim 17 An on-board network system comprising: a plurality of electronic controllers configured to exchange messages by communication over one or more buses; and a fraud detecting electronic controller configured to connect to the one or more buses, wherein the fraud detecting electronic controller determines whether or not a message transmitted on the one or more buses connected to the fraud detecting electronic controller conforms to the rules based on fraud detection rules, one of the electronic controllers receives, from an external device external to the on-board network system, delivery data including updated fraud detection rules and bus type information indicating one of a plurality of bus types to which the updated fraud detection rules are to be applied, and transmits the updated fraud detection rules over the one or more buses, and the fraud detecting electronic controller receives the updated fraud detection rules from the one or more buses, determines whether or not a vehicle in which the on-board network system is installed is running, when the vehicle is determined to be running, additionally determines whether or not the bus type information indicates a drive bus which is connected to an electronic controller related to the travel of the vehicle, (i) when the bus type information indicates a drive bus related to running, does not conduct an update process with the updated fraud detection rules, and (ii) when the bus type information does not indicate a drive bus related to running, updates the fraud detection rules to the updated fraud detection rules. ### Claim 18 (depends on 17) The system according to claim 17, wherein when the bus type connected to the fraud detecting electronic controller is indicated by the bus type information, the fraud detecting electronic controller treats a certain update condition as satisfied, and performs the update. ### Claim 19 (depends on 17) The system according to claim 17, wherein the delivery data includes a plurality of updated fraud detection rules, and includes bus type information indicating a bus type corresponding to each of the plurality of updated fraud detection rules, and the fraud detecting electronic controller conducts the receiving of the delivery data by communicating with the external device, extracts from the delivery data updated fraud detection rules corresponding to bus type information matching the bus type connected to the fraud detecting electronic controller, and updates the fraud detection rules associated with the determination to the extracted updated fraud detection rules. ### Claim 20 (depends on 17) The system according to claim 17, wherein the delivery data includes a plurality of updated fraud detection rules, and includes bus type information indicating a bus type corresponding to each of the plurality of updated fraud detection rules, one of the electronic controllers conducts the receiving of the delivery data, includes each of the updated fraud detection rules from the delivery data in a message with an attached message ID for updating fraud detection rules according to the bus type indicated by the corresponding bus type information, and transmits the message over the one or more buses, and the fraud detecting electronic controller receives, from the one or more buses, the message with the message ID for updating fraud detection rules according to the bus type connected to the fraud detecting electronic controller, and updates the fraud detection rules associated with the determination to the updated fraud detection rules included in the message.