# US 11,030,310 B2 · Systems and methods for disabling a malicious ECU in a controller area network (CAN) bus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,310 B2 - Document ID: US11030310B2 - Status: Granted - Kind: B2 - Application number: 16/639,532 - Filed: 2017-08-17 - Published: 2020-12-10 - Granted: 2021-06-08 - Earliest claimed: 2017-08-17 - Assignees: Red Bend Ltd. - Applicants: Red Bend Ltd. - Inventors: Tomer Gilad; Shachar Rosen - Web page: https://patentgrep.com/patent/US11030310B2 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/554: {involving event detection and direct action} - G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - G06F 2221/034: Test or assess a computer or a system - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 2012/40215: {Controller Area Network CAN} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract There is provided a computer implemented method of disabling a malicious electronic control unit (ECU) of a plurality of ECUs in communication with a controller area network (CAN) bus network, the method executed by a computing device in communication with the plurality of ECUs and the CAN bus network, the method comprising: detecting a malicious message transmitted by the malicious ECU over the CAN bus network, and injecting a plurality of bits over the CAN bus network to trigger a predefined plurality of errors for disabling the malicious ECU before the malicious ECU makes an additional attempt to retransmit an additional instance of the malicious message. ## Claims ### Claim 1 A computer implemented method of disabling a malicious electronic control unit (ECU) of a plurality of ECUs in communication with a controller area network (CAN) bus network, the method executed by a computing device in communication with the plurality of ECUs and the CAN bus network, the method comprising: detecting a malicious message transmitted by the malicious ECU over the CAN bus network; and injecting a plurality of bits over the CAN bus network to trigger a predefined plurality of errors for disabling the malicious ECU before the malicious ECU makes an additional attempt to retransmit an additional instance of the malicious message; wherein the predefined number of the plurality of errors are triggered by a plurality of injection sessions, wherein each bit injection session is triggered in response to detection of an additional error; wherein a first injection session of the plurality of injection sessions comprises injecting bits to trigger a first error and transmission of a first error flag, wherein a current error count value stored by at least one error counter of the malicious ECU is increased by the transmission of the first error flag; and further comprising: interrupting the error frame storing the first error flag and injecting bits as an additional bit injection session for manipulating the form of the error frame to trigger a form error, wherein the form error triggers transmission of another error flag which triggers another increase of the current error count value stored by the at least one error counter of the malicious ECU; iterating the interrupting of an additional error frame and the injection of bits as an additional bit injection session for manipulating the form of the error frame, to trigger at each iteration the transmission of a form error form and a respective increase of the current error count value, wherein the number of iterations are performed accordingly to generate the predefined number of the plurality of errors for disabling the malicious ECU. ### Claim 2 (depends on 1) The computer implemented method of claim 1, wherein a current error count value stored by at least one error counter of the malicious ECU is increased above an error threshold denoting disabling of the malicious ECU in response to the triggered predefined plurality of errors. ### Claim 3 (depends on 2) The computer implemented method of claim 2, wherein a difference between the current error count value and the error threshold is greater than the value by which the error counter increases the current error count value in response to a single generated error. ### Claim 4 (depends on 2) The computer implemented method of claim 2, wherein the predefined number of the plurality of errors is computed according to the error threshold value divided by amount of increase of the current error count value in response to generating a single error. ### Claim 5 (depends on 2) The computer implemented method of claim 2, wherein the predefined number of the plurality of errors is 32 when the error threshold value is 255 and when the current transmit error count value is increased by 8 in response to generating a single error. ### Claim 6 (depends on 1) The computer implemented method of claim 1, wherein the injected bits are designed to trigger one or more of the following errors, selected from the group consisting of: bit stuffing, bit error, cyclic redundancy check (CRC), monitoring, frame, and acknowledgement errors. ### Claim 7 (depends on 1) The computer implemented method of claim 1, wherein manipulating the form of the error frame comprises transmitting a single dominant bit in place of the expected at least one recessive bit of an error delimiter field of the error frame. ### Claim 8 (depends on 1) The computer implemented method of claim 1, wherein the last iteration of the interrupting the error frame is performed without the manipulating the form of the error frame. ### Claim 9 A computer implemented method of disabling a malicious electronic control unit (ECU) of a plurality of ECUs in communication with a controller area network (CAN) bus network, the method executed by a computing device in communication with the plurality of ECUs and the CAN bus network, the method comprising: detecting a malicious message transmitted by the malicious ECU over the CAN bus network; and injecting a plurality of bits over the CAN bus network to trigger a predefined plurality of errors for disabling the malicious ECU before the malicious ECU makes an additional attempt to retransmit an additional instance of the malicious message; wherein the injecting the plurality of bits comprises injecting the plurality of bits in a single session as a consecutive streaming of dominant bits of: a first predefined number of consecutive dominant bits, and injecting a second predefined number of consecutive sets each of a third predefined number of dominant bits, followed by a fourth predefined number of valid bits of a recessive delimiter and a fifth predefined number of recessive bit intermission. ### Claim 10 (depends on 9) The computer implemented method of claim 9, wherein the first predefined number of consecutive dominant bits comprises 14 dominant bits, the second predefined number of consecutive sets comprises 31 consecutive sets, the third predefined number of dominant bits comprises 8 dominant bits, the fourth predefined number of valid bits comprises valid 8 bit recessive delimiter, and the fifth predefined number of recessive bit intermission comprises 3-bit recessive intermission. ### Claim 11 (depends on 9) The computer implemented method of claim 9, wherein in response to the malicious ECU detecting the first predefined number of consecutive dominant bits, and in response to detecting each sequence of the second predefined number of the additional third predefined number of consecutive dominant bits, a current error count value stored by at least one error counter of the malicious ECU is increased. ### Claim 12 (depends on 9) The computer implemented method of claim 9, wherein the first predefined number of consecutive dominant bits are detected by the malicious ECU after transmission of an active error flag. ### Claim 13 (depends on 9) The computer implemented method of claim 9, wherein the first predefined number of consecutive dominant bits are detected by the malicious ECU after detecting a sixth predefined number of consecutive dominant bits following a passive error flag. ### Claim 14 A system for disabling a malicious electronic control unit (ECU) of a plurality of ECUs in communication with a controller area network (CAN) bus network, comprising: a non-transitory memory having stored thereon a code for execution by at least one hardware processor of a computing device in communication with the plurality of ECUs and the CAN bus network, the code comprising: code instructions for detecting a malicious message transmitted by the malicious ECU over the CAN bus network; and code instructions for injecting a plurality of bits over the CAN bus network to trigger a predefined plurality of errors for disabling the malicious ECU before the malicious ECU makes an additional attempt to retransmit an additional instance of the malicious message; wherein the injecting the plurality of bits comprises injecting the plurality of bits in a single session as a consecutive streaming of dominant bits of: a first predefined number of consecutive dominant bits, and injecting a second predefined number of consecutive sets each of a third predefined number of dominant bits, followed by a fourth predefined number of valid bits of a recessive delimiter and a fifth predefined number of recessive bit intermission. ### Claim 15 (depends on 14) The system of claim 14, wherein the malicious ECU, the CAN bus network, the plurality of ECUs, and the computing device are implemented in a vehicle. ### Claim 16 (depends on 14) The system of claim 14, wherein the computing device is implemented as one or more of the plurality of ECUs with the code instructions installed on a local memory of the respective one or more of the plurality of ECUs for execution by the hardware processor of the respective one or more of the plurality of ECUs. ### Claim 17 (depends on 14) The system of claim 14, wherein the computing device is implemented as one or more of the plurality of ECUs with the code instructions installed on a local memory of the respective one or more of the plurality of ECUs for execution by the hardware processor of the respective one or more of the plurality of ECUs. ### Claim 18 A computer program product for disabling a malicious electronic control unit (ECU) of a plurality of ECUs in communication with a controller area network (CAN) bus network, comprising: a non-transitory memory having stored thereon a code for execution by at least one hardware processor of a computing device in communication with the plurality of ECUs and the CAN bus network, the code comprising: instructions for detecting a malicious message transmitted by the malicious ECU over the CAN bus network; and instructions for injecting a plurality of bits over the CAN bus network to trigger a predefined plurality of errors generated for disabling the malicious ECU before the malicious ECU makes an additional attempt to retransmit an additional instance of the malicious message; wherein the injecting the plurality of bits comprises injecting the plurality of bits in a single session as a consecutive streaming of dominant bits of: a first predefined number of consecutive dominant bits, and injecting a second predefined number of consecutive sets each of a third predefined number of dominant bits, followed by a fourth predefined number of valid bits of a recessive delimiter and a fifth predefined number of recessive bit intermission.