# US 10,454,957 B2 · Method for preventing electronic control unit from executing process based on malicious frame transmitted to bus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,957 B2 - Document ID: US10454957B2 - Status: Granted - Kind: B2 - Application number: 15/275,860 - Filed: 2016-09-26 - Published: 2017-01-12 - Granted: 2019-10-22 - Earliest claimed: 2014-04-03 - Assignees: Panasonic Intellectual Property Corporation of America - Applicants: Panasonic Intellectual Property Corporation of America - Inventors: Yoshihiro Ujiie; Hideki Matsushima; Tomoyuki Haga; Manabu Maeda; Yuji Unagami; Takeshi Kishikawa - Web page: https://patentgrep.com/patent/US10454957B2 ## CPC - H04L 12/40006: {Architecture of a communication node (current supply arrangements H04L12/10; intermediate storage or scheduling H04L49/90)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 12/40: Bus networks - H04L 12/6418: {Hybrid transport} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/101: {Access control lists [ACL]} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 2012/40215: {Controller Area Network CAN} - H04L 2012/40273: {the transportation system being a vehicle} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for use in a network communication system including a plurality of electronic controllers that communicate with each other via a bus in accordance with a Controller Area Network (CAN) protocol includes determining whether or not content of a predetermined field in a transmitted frame meets a predetermined condition indicating fraud, transmitting an error frame before an end of the frame is transmitted in a case where it is determined that the frame meets the predetermined condition, recording a number of times the error frame is transmitted, for each identifier (ID) represented by content of an ID field included in a plurality of frames which has been transmitted, and providing a notification in a case where the number of times recorded for an ID exceeds a predetermined count. ## Claims ### Claim 1 A method for use in a network communication system including a plurality of electronic controllers that communicate with each other via a bus in accordance with a Controller Area Network (CAN) protocol, the method comprising: determining, by an electronic controller of the plurality of electronic controllers, whether or not content of a predetermined field in a frame which has started to be transmitted meets a predetermined condition indicating fraud; transmitting, by the electronic controller, an error frame before an end of the frame is transmitted in a case where it is determined that the content of the predetermined field in the frame meets the predetermined condition; recording, by the electronic controller, a number of times the error frame is transmitted in the transmitting, for each identifier (ID) represented by content of an ID field included in a plurality of frames which has been transmitted; and providing a notification in a case where the number of times recorded for an ID exceeds a predetermined count, wherein the predetermined count represents a value at which a transition to a passive state specified in the CAN protocol in accordance with a rule for handling a transmission error counter is to occur, and in the providing, in a case where the number of times recorded for the ID exceeds the predetermined count, one of the electronic controllers that has transmitted a frame having the ID for which the number of times exceeds the predetermined count is determined to be a malicious electronic controller that does not transition to the passive state, and the notification notifies of a presence of the malicious electronic controller. ### Claim 2 (depends on 1) The method according to claim 1, wherein in the transmitting, transmission of the error frame is performed before an end of a Cyclic Redundancy Check sequence in the frame is transmitted. ### Claim 3 (depends on 1) The method according to claim 1, wherein the predetermined field comprises the ID field, and in the determining, an ID represented by the content of the predetermined field is compared with one or more IDs indicated by predetermined ID-list information to perform a determination of whether or not the predetermined condition is met. ### Claim 4 (depends on 1) The method according to claim 1, wherein the predetermined field comprises a control field, and in the determining, a determination of whether or not a data length represented by the content of the predetermined field is included in a predetermined range is performed to determine whether or not the content meets the predetermined condition. ### Claim 5 (depends on 1) The method according to claim 1, wherein the predetermined field comprises a data field, and in the determining, the predetermined condition includes the frame, which has started to be transmitted, being a data frame. ### Claim 6 (depends on 5) The method according to claim 5, wherein in the determining, a determination of whether or not a data value representing the content of the predetermined field is included in a predetermined range is performed to determine whether or not the content meets the predetermined condition. ### Claim 7 (depends on 5) The method according to claim 5, wherein in the determining, a message authentication code in the content of the predetermined field is verified by using a predetermined verification process procedure, and the content is determined to meet the predetermined condition in a case where a verification has failed. ### Claim 8 A method for use in a network communication system including a plurality of electronic controllers that communicate with each other via a bus in accordance with a Controller Area Network (CAN) protocol, the method comprising: determining, by an electronic controller of the plurality of electronic controllers, whether or not content of a predetermined field in a frame which has started to be transmitted meets a predetermined condition indicating fraud; transmitting, by the electronic controller, an error frame before an end of the frame is transmitted in a case where it is determined that the content of the predetermined field in the frame meets the predetermined condition; recording, by the electronic controller, a number of times the error frame is transmitted in the transmitting, for each identifier (ID) represented by content of an ID field included in a plurality of frames which has been transmitted; and providing a notification in a case where the number of times recorded for an ID exceeds a predetermined count, wherein the predetermined field comprises a data field, in the determining, the predetermined condition includes the frame, which has started to be transmitted, being a data frame, in the determining, a message authentication code in the content of the predetermined field is verified by using a predetermined verification process procedure, and the content is determined to meet the predetermined condition in a case where a verification has failed, in a case where the data frame is transmitted by an authorized electronic controller, the data field includes a message authentication code determined in accordance with a variable that changes each time the data frame is transmitted, and in the determining, the content is determined to meet the predetermined condition in a case where the message authentication code in the content of the predetermined field does not reflect the variable that changes each time the data frame is transmitted. ### Claim 9 A method for use in a network communication system including a plurality of electronic controllers that communicate with each other via a bus in accordance with a Controller Area Network (CAN) protocol, the method comprising: determining, by an electronic controller of the plurality of electronic controllers, whether or not content of a predetermined field in a frame which has started to be transmitted meets a predetermined condition indicating fraud; transmitting, by the electronic controller, an error frame before an end of the frame is transmitted in a case where it is determined that the content of the predetermined field in the frame meets the predetermined condition; recording, by the electronic controller, a number of times the error frame is transmitted in the transmitting, for each identifier (ID) represented by content of an ID field included in a plurality of frames which has been transmitted; and providing a notification in a case where the number of times recorded for an ID exceeds a predetermined count, wherein the predetermined field comprises a data field, in the determining, the predetermined condition includes the frame, which has started to be transmitted, being a data frame, in the determining, a message authentication code in the content of the predetermined field is verified by using a predetermined verification process procedure, and the content is determined to meet the predetermined condition in a case where a verification has failed, in a case where the data frame is transmitted by an authorized electronic controller that includes a message authentication code key, the data field includes a message authentication code generated by using the message authentication code key, and in the determining, a verification of the message authentication code in the content of the predetermined field is performed by using a key corresponding to the message authentication code key. ### Claim 10 A fraud-detection electronic controller for connection to a bus that a plurality of electronic controllers which communicate with each other in accordance with a Controller Area Network (CAN) protocol use for communication, the fraud-detection electronic controller comprising: one or more memories; and circuitry which, in operation, performs operations including: receiving a frame which has started to be transmitted; determining whether or not content of a predetermined field in the frame meets a predetermined condition indicating fraud; transmitting an error frame before an end of the frame is transmitted in a case where it is determined that the content of the predetermined field in the frame meets the predetermined condition; recording a number of times the error frame is transmitted in the transmitting, for each identifier (ID) represented by content of an ID field included in a plurality of frames which has been transmitted; and providing a notification in a case where the number of times recorded for an ID exceeds a predetermined count, wherein the predetermined count represents a value at which a transition to a passive state specified in the CAN protocol in accordance with a rule for handling a transmission error counter is to occur, and in the providing, in a case where the number of times recorded for the ID exceeds the predetermined count, one of the electronic controllers that has transmitted a frame having the ID for which the number of times exceeds the predetermined count is determined to be a malicious electronic controller that does not transition to the passive state, and the notification notifies of a presence of the malicious electronic controller. ### Claim 11 A network communication system, comprising: a plurality of electronic controllers that communicate with each other via a bus in accordance with a Controller Area Network (CAN) protocol; and a fraud-detection electronic controller connected to the bus, wherein the fraud-detection electronic controller comprises: one or more memories; and circuitry which, in operation, performs operations including: receiving, by the fraud-detection electronic controller, a frame which has started to be transmitted; determining, by the fraud-detection electronic controller, whether or not content of a predetermined field in the frame meets a predetermined condition indicating fraud; transmitting, by the fraud-detection electronic controller, an error frame before an end of the frame is transmitted in a case where it is determined that the content of the predetermined field in the frame meets the predetermined condition; recording, by the fraud-detection electronic controller, a number of times the error frame is transmitted in the transmitting, for each identifier (ID) represented by content of an ID field included in a plurality of frames which has been transmitted; and providing a notification in a case where the number of times recorded for an ID exceeds a predetermined count, wherein the predetermined count represents a value at which a transition to a passive state specified in the CAN protocol in accordance with a rule for handling a transmission error counter is to occur, and in the providing, in a case where the number of times recorded for the ID exceeds the predetermined count, one of the electronic controllers that has transmitted a frame having the ID for which the number of times exceeds the predetermined count is determined to be a malicious electronic controller that does not transition to the passive state, and the notification notifies of a presence of the malicious electronic controller. ### Claim 12 (depends on 11) The network communication system according to claim 11, wherein a plurality of buses is used for communication by the plurality of electronic controllers, the network communication system further comprises: a gateway device having a function of transferring a frame between the plurality of buses; and a plurality of fraud-detection electronic controllers each connected to a different bus, the predetermined field comprises the ID field, in the determining, an ID represented by the content of the predetermined field is compared with one or more IDs indicated by predetermined ID-list information to perform a determination of whether or not the predetermined condition is met, and the ID-list information is different for each of the plurality of fraud-detection electronic controllers.