# US 10,870,412 B2 · System and method for controlling access to a cyber-physical system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,870,412 B2 - Document ID: US10870412B2 - Status: Granted - Kind: B2 - Application number: 16/441,893 - Filed: 2019-06-14 - Published: 2020-08-13 - Granted: 2020-12-22 - Earliest claimed: 2019-02-07 - Assignees: AO Kaspersky Lab - Applicants: AO Kaspersky Lab - Inventors: Sergey G. Zorin; Alexander V. Shadrin - Web page: https://patentgrep.com/patent/US10870412B2 ## CPC - B60R 25/24: using electronic identifiers containing a code not memorised by the user - B60R 25/30: Detection related to theft or to other events relevant to anti-theft systems - B60R 25/04: operating on the propulsion system, e.g. engine or drive motor - G06F 21/44: Program or device authentication - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/554: {involving event detection and direct action} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2221/2123: Dummy operation - B60R: VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for controlling access to a cyber-physical system (CPS). A security tool can perform access authorization by analyzing messages sent through the CPS, creating a plurality of fictitious messages, sending the plurality of fictitious messages though the CPS, and checking whether correct authorization data is included in the analyzed messages to determine authorized or unauthorized access to the CPS. An access monitoring tool can detect a change in a functional CPS module related to unauthorized access to the CPS, and responsive to the detection of a change in a functional CPS module related to unauthorized access to the CPS, change a state of a functional CPS module using a monitoring rule. ## Claims ### Claim 1 A system for controlling access to a cyber-physical system (CPS), the system comprising: at least one electronic control unit (ECU) including at least one processor and memory operably coupled to the at least one processor; instructions that, when executed on the at least one ECU, cause the at least one ECU to implement: a security tool configured to— perform access authorization by: analyzing a plurality of messages sent through the CPS, creating a plurality of fictitious messages, the plurality of fictitious messages addressed to at least one of the ECUs to which the plurality of messages are addressed, sending the plurality of fictitious messages though the CPS in random order and with random delay, and checking whether correct authorization data is included in the analyzed messages to determine authorized or unauthorized access to the CPS; an access monitoring tool configured to— detect a change in at least one functional CPS module related to unauthorized access to the CPS, and responsive to the detection of a change in at least one functional CPS module related to unauthorized access to the CPS, change a state of at least one functional CPS module using at least one monitoring rule. ### Claim 2 (depends on 1) The system of claim 1, further comprising a database of trusted ECUs including a trusted ECU list, wherein the security tool is installed on a first ECU and the access monitoring tool is installed on a second ECU, and wherein the first ECU and the second ECU are included on the trusted ECU list. ### Claim 3 (depends on 1) The system of claim 1, wherein the access monitoring tool is further configured to send a first integrity check message to the security tool, wherein the security tool is further configured to send a second integrity check message to the access monitoring tool, and determine unauthorized access to the CPS when the access monitoring tool fails to send the first integrity message, and wherein the access monitoring tool is further configured to determine unauthorized access to the CPS when the security tool fails to send the second integrity message. ### Claim 4 (depends on 3) The system of claim 3, wherein the first integrity check message and the second integrity check message are sent through an encoded communication channel. ### Claim 5 (depends on 1) The system of claim 1, wherein when the security tool determines authorized access, the security tool is further configured to send a successful CPS authorization message to the access monitoring tool. ### Claim 6 (depends on 1) The system of claim 1, wherein the CPS is a vehicle comprising a plurality of data buses connecting a drivetrain subsystem, a multimedia subsystem, a transmission subsystem, and a telematics subsystem. ### Claim 7 (depends on 6) The system of claim 6, wherein the at least one functional CPS module is at least one of a vehicle engine ECU included in the drivetrain subsystem, a vehicle wheel ECU included in the transmission subsystem, or a vehicle steering ECU included in the transmission subsystem, and wherein the at least one monitoring rule comprises disabling the vehicle through at least one of the vehicle engine ECU, the vehicle wheel ECU, or the vehicle steering ECU. ### Claim 8 (depends on 6) The system of claim 6, wherein detecting the change in at least one functional CPS module includes a start of the vehicle's engine or immobilization of the vehicle. ### Claim 9 (depends on 6) The system of claim 6, wherein the security tool is installed on a central gateway coupling the drivetrain subsystem, the multimedia subsystem, the transmission subsystem, and the telematics subsystem. ### Claim 10 (depends on 6) The system of claim 6, wherein the security tool is configured to selectively analyze the plurality of messages by ignoring messages unrelated to authorization of a user of the vehicle. ### Claim 11 (depends on 1) The system of claim 1, wherein the security tool is preinstalled on the ECU by a manufacturer, and wherein the security tool is further configured to receive access authorization data from a user, the access authorization data determining access to the CPS. ### Claim 12 A method for controlling access to a cyber-physical system (CPS), the system including at least one electronic control unit (ECU) including at least one processor and memory operably coupled to the at least one processor, the method comprising: performing access authorization by: analyzing a plurality of messages sent through the CPS, creating a plurality of fictitious messages, the plurality of fictitious messages addressed to at least one of the ECUs to which the plurality of messages are addressed, sending the plurality of fictitious messages though the CPS in random order and with random delay, and checking whether correct authorization data is included in the analyzed messages to determine authorized or unauthorized access to the CPS; detecting a change in at least one functional CPS module related to unauthorized access to the CPS; and responsive to the detection of a change in at least one functional CPS module related to unauthorized access to the CPS, changing a state of at least one functional CPS module using at least one monitoring rule. ### Claim 13 (depends on 12) The method of claim 12, wherein the performing access authorization is implemented by a security tool and the detecting a change in the at least one functional CPS module and changing the state of the at least one functional CPS module is implemented by an access monitoring tool, the method further comprising: sending a first integrity check message from the access monitoring tool to the security tool; sending a second integrity check message from the security tool to the access monitoring tool; determining unauthorized access to the CPS when the access monitoring tool fails to send the first integrity message; and determining unauthorized access to the CPS when the security tool fails to send the second integrity message. ### Claim 14 (depends on 13) The method of claim 13, wherein the first integrity check message and the second integrity check message are sent through an encoded communication channel. ### Claim 15 (depends on 12) The method of claim 12, further comprising when authorized access is determined, generating a successful CPS authorization message. ### Claim 16 (depends on 13) The method of claim 13, further comprising: preinstalling the security tool on the ECU; and receiving access authorization data from a user, the access authorization data determining access to the CPS. ### Claim 17 A vehicle comprising: a drivetrain gateway configured to deliver power to vehicle wheels; a multimedia gateway configured to control multimedia for the vehicle; a transmission gateway configured to control the vehicle wheels through the drivetrain gateway, wherein each of the drivetrain gateway, the multimedia gateway, and the transmission gateway includes at least one electronic control unit (ECU); at least one security tool configured to perform access authorization by: analyzing a plurality of messages sent through the vehicle, creating a plurality of fictitious messages, sending the plurality of fictitious messages though the vehicle, and checking whether correct authorization data is included in the analyzed messages to determine authorized or unauthorized access to the vehicle; and at least one access monitoring tool configured to: detect a change in at least one functional CPS module related to unauthorized access to the CPS, and responsive to the detection of a change in at least one functional CPS module related to unauthorized access to the CPS, change a state of at least one functional CPS module using at least one monitoring rule. ### Claim 18 (depends on 17) The vehicle of claim 17, wherein the at least one functional CPS module is at least one of a vehicle engine ECU included in the drivetrain subsystem, a vehicle wheel ECU included in the transmission subsystem, or a vehicle steering ECU included in the transmission subsystem, and wherein the at least one monitoring rule comprises disabling the vehicle through at least one of the vehicle engine ECU, the vehicle wheel ECU, or the vehicle steering ECU. ### Claim 19 (depends on 17) The vehicle of claim 17, wherein detecting the change in at least one functional CPS module includes a start of the vehicle's engine or immobilization of the vehicle. ### Claim 20 (depends on 17) The vehicle of claim 17, wherein the security tool is configured to selectively analyze the plurality of messages by ignoring messages unrelated to authorization of a user of the vehicle.