# US 10,766,439 B2 · Context-aware firewall for in-vehicle cyber security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,766,439 B2 - Document ID: US10766439B2 - Status: Granted - Kind: B2 - Application number: 15/671,406 - Filed: 2017-08-08 - Published: 2017-11-30 - Granted: 2020-09-08 - Earliest claimed: 2014-01-06 - Assignees: Argus Cyber Security Ltd. - Applicants: ARGUS CYBER SECURITY Ltd. - Inventors: Ofer Ben Noon; Yaron Galula; Oron Lavi - Web page: https://patentgrep.com/patent/US10766439B2 ## CPC - B60R 16/023: for transmission of signals between vehicle parts or subsystems - B60R 25/00: Fittings or systems for preventing or indicating unauthorised use or theft of vehicles (locks for vehicles E05B77/00-E05B85/00) - G06F 11/30: Monitoring - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/554: {involving event detection and direct action} - G06F 21/606: {by securing the transmission between two devices or processes} - G06F 21/6281: {at program execution time, where the protection is within the operating system} - H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 63/123: {received data contents, e.g. message integrity} - H04L 2012/40215: {Controller Area Network CAN} - H04L 2012/40273: {the transportation system being a vehicle} - B60R: VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A module for providing security to a vehicle's in-vehicle communication network that is responsive to an operational state of the vehicle. ## Claims ### Claim 1 A module for providing security to a vehicle comprising an in-vehicle communication network having a bus and at least one node connected to the bus, the module comprising: a memory having software comprising data characterizing messages that the at least one node transmits and receives via the bus during normal operation of the node; a communication port via which the module receives and transmits messages, the port being configured to be connected to a portion of the in-vehicle network; and a processor that processes, responsive to the software in the memory, messages received via the port from the portion of the in-vehicle network to: 1) accumulate data from the messages received via the port, the data being useable to determine an operating context of the vehicle; 2) determine a vehicle context based on the accumulated data, the vehicle context comprising an operating state of the vehicle that is common to each of a plurality of vehicles substantially at a same time; 3) based on the determined vehicle context determine if a received message is anomalous; and 4) if the received message is determined to be anomalous operate to log data relevant to the message into a memory and/or prevent the message from affecting a node of the at least one node. ### Claim 2 (depends on 1) The module according to claim 1 wherein the accumulated data comprises at least one or any combination of more than one of vehicle speed, acceleration, closing speed to a leading or trailing vehicle, engine rpm, engine temperature, oil pressure, hydraulic pressure, wheel traction, road condition, vehicle location, and/or weather condition. ### Claim 3 (depends on 1) The module according to claim 1 wherein the context comprises a state of the vehicle's in-vehicle communication system based on the accumulated data. ### Claim 4 (depends on 3) The module according to claim 3 wherein the accumulated data comprises at least one or any combination of more than one of baud rate, types of messages transmitted over the network, contents of a communication session, which nodes in in-vehicle communication network are actively communicating over the network, and/or if the in-vehicle network is compromised by a cyberattack. ### Claim 5 (depends on 1) The module according to claim 1 wherein the common operating state is based on at least one or any combination of more than one of a common cyberattack, and/or a same probability of failure of a vehicle control system. ### Claim 6 (depends on 1) The module according to claim 1 wherein the vehicle context is represented by a feature vector. ### Claim 7 (depends on 6) The module according to claim 6 wherein components of the feature vector comprises values of a message frequency histogram that provides a relative frequency of transmission over the in-vehicle network for each of a plurality of different messages. ### Claim 8 (depends on 1) The module according to claim 1 wherein the processor is configured to determine the context in real time substantially at a time that the message is received. ### Claim 9 (depends on 1) The module according to claim 1 wherein the module is a rule based module that operates in accordance with a set of rules to identify and classify messages transmitted over the in-vehicle network and to determine an action to undertake with respect to an identified message. ### Claim 10 (depends on 9) The module according to claim 9 wherein the processor is operable to configure the rules based on context. ### Claim 11 (depends on 1) The module according to claim 1 wherein the in-vehicle network is a CAN in-vehicle network and the received messages are control area network (CAN) messages comprising an arbitration ID, a data portion, and a cyclic redundancy check (CRC) code. ### Claim 12 (depends on 1) The module according to claim 1 wherein the module is a hardware module comprising a physical port configured to be connected to the portion of the in-vehicle network. ### Claim 13 (depends on 1) The module according to claim 1 wherein the module is a software module that may be integrated with software of the at least one node of the in-vehicle network.