# US 11,451,586 B2 · Network security attack misdirection on a transport vehicle > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,586 B2 - Document ID: US11451586B2 - Status: Granted - Kind: B2 - Application number: 16/115,948 - Filed: 2018-08-29 - Published: 2020-03-05 - Granted: 2022-09-20 - Earliest claimed: 2018-08-29 - Assignees: Panasonic Avionics Corporation - Applicants: Panasonic Avionics Corporation - Inventors: Philip Watson; Steven Bates - Web page: https://patentgrep.com/patent/US11451586B2 ## CPC - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04W 4/42: for mass transport vehicles, e.g. buses, trains or aircraft - H04W 12/08: Access security - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04L 63/0272: {Virtual private networks} - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A network security attack misdirection line-replaceable unit for installation on an aircraft and connected to an onboard data network include a local network interface to the onboard data network. A local simulation server accepts incoming access requests accompanied by an access credential from an attacker client device, and is responsive thereto with either a simulated access denial response or a simulated access grant response. Delays between receipt of the access request and to the access denial response is progressively increased with each presentation of the access credential. ## Claims ### Claim 1 A system for misdirecting network security attacks onboard a vehicle, comprising: a local simulated server including a data networking interface connected to a local area network of the vehicle, wherein the local simulated server is based onboard the vehicle, and wherein the local simulated server comprises a processor and a memory storing instructions, that when executed by the processor, causes the local simulated server to execute: an onboard network service simulator connected to the data networking interface, the onboard network service simulator configured to accept incoming access requests accompanied by an access credential from an attacker client device and being responsive thereto; and a simulated service user interface configured to accept command inputs corresponding to requests to access a simulated data set upon an acceptance of the access credential; and a remote simulated server that is ground based, the remote simulated server comprising a processor and a memory storing instructions, that when executed by the processor, causes the remote simulated server to execute: a remote network service simulator in communication with the data networking interface, the remote network service simulator configured to accept incoming remote access requests accompanied by a remote access credential from the attacker client device and being responsive thereto with a simulated remote access denial response; an access attempt monitor in communication with the onboard network service simulator and the simulated service user interface, the access attempt monitor configured to capture a security breach event for each incoming access request to the onboard network service simulator and the command inputs corresponding to the requests to access the simulated data set; and a remote monitor in communication with the remote network service simulator, the remote monitor configured to log requests to access a remote simulated data set as remote security breach events. ### Claim 2 (depends on 1) The system of claim 1, wherein the onboard network service simulator is responsive to the incoming access requests with either a simulated access denial response or a simulated access grant response, delays between receipt of the access request to presentation of the access denial response being progressively increased with each presentation of an incorrect access credential from the attacker client device to the onboard network service simulator, and with the access grant response, permitting access to the simulated data set. ### Claim 3 (depends on 1) The system of claim 1, further comprising an avionics system implementing one or more monitors of corresponding authentic network services connected to the local area network, legitimate and malicious access attempts to one of the authentic network services being tracked by the one or more monitors, said one or more monitors collecting records of monitored events for later retrieval from the vehicle. ### Claim 4 (depends on 3) The system of claim 3, wherein the simulated data set is accessible from the authentic network services. ### Claim 5 (depends on 1) The system of claim 1, wherein delays between receipt of the remote access requests to presentation of the remote access denial response are progressively increased with each presentation of an incorrect remote access credential from the attacker client device to the remote network service simulator. ### Claim 6 (depends on 1) The system of claim 1, wherein the simulated data set includes account and password data. ### Claim 7 (depends on 1) The system of claim 1, wherein the simulated data set includes financial account data. ### Claim 8 (depends on 1) The system of claim 1, wherein the onboard network service simulator mimics a secure shell (SSH) server. ### Claim 9 (depends on 1) The system of claim 1, wherein the data networking interface and the onboard network service simulator are implemented in a standalone line replaceable unit. ### Claim 10 A method of misdirecting network security attacks onboard a vehicle, comprising: accepting, by an onboard network service simulator that is based onboard the vehicle and connected to a data networking interface in communication with a local area network of the vehicle, incoming access requests accompanied by an access credential from an attacker client device; accepting, by a simulated service user interface, command inputs corresponding to requests to access a simulated data set upon acceptance of the access credential; accepting, by a remote network service simulator that is ground based and connected to the data networking interface, incoming remote access requests accompanied by a remote access credential from the attacker client device and being responsive thereto with a simulated remote access denial response; capturing, by an access attempt monitor in communication with the onboard network service simulator and the simulated service user interface, a security breach event for each incoming access request to the onboard network service simulator and the command inputs corresponding to the requests to access the simulated data set; and logging, by a remote monitor in communication with the remote network service simulator, requests to access a remote simulated data set as remote security breach events. ### Claim 11 (depends on 10) The method of claim 10, further comprising: presenting, by the onboard network service simulator in response to the incoming access requests, either a simulated access denial response or a simulated access grant response, delays between receipt of the access request and presentation of the access denial response being progressively increased with each presentation of an incorrect access credential from the attacker client device to the onboard network service simulator, and with presentation of the access grant response, permitting access to the simulated data set. ### Claim 12 (depends on 10) The method of claim 10, further comprising: tracking, by one or more monitors of authentic network services connected to the local area network, legitimate and malicious access attempts to the authentic network services; and collecting, by the one or more monitors, records of monitored events for later retrieval from the vehicle. ### Claim 13 (depends on 12) The method of claim 12, wherein the simulated data set is accessible from the authentic network services. ### Claim 14 (depends on 10) The method of claim 10, wherein delays between receipt of the remote access requests to presentation of the remote access denial response are progressively increased with each presentation of an incorrect remote access credential from the attacker client device to the remote network service simulator. ### Claim 15 (depends on 10) The method of claim 10, wherein the simulated data set includes account and password data. ### Claim 16 (depends on 10) The method of claim 10, wherein the simulated data set includes financial account data. ### Claim 17 (depends on 10) The method of claim 10, wherein the onboard network service simulator mimics a secure shell (SSH) server. ### Claim 18 (depends on 10) The method of claim 10, wherein the data networking interface and the onboard network service simulator are implemented in a standalone line replaceable unit.