# US 12,111,908 B2 · Lightweight electronic control unit fingerprinting > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,908 B2 - Document ID: US12111908B2 - Status: Granted - Kind: B2 - Application number: 18/215,924 - Filed: 2023-06-29 - Published: 2023-10-26 - Granted: 2024-10-08 - Earliest claimed: 2020-08-14 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Eduardo Alban; Shabbir Ahmed; Marcio Juliato; Christopher Gutierrez; Qian Wang; Vuk Lesi; Manoj Sastry - Web page: https://patentgrep.com/patent/US12111908B2 ## CPC - G06F 21/44: Program or device authentication - G06F 13/20: for access to input/output bus - G06F 21/73: by creating or determining hardware identification, e.g. serial numbers - G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices - H04L 12/40: Bus networks - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 2012/40215: {Controller Area Network CAN} - H04L 2012/40273: {the transportation system being a vehicle} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, apparatuses, and methods to identify an electronic control unit transmitting a message on a communication bus, such as an in-vehicle network bus, are provided. ECUs transmit messages by manipulating voltage on conductive lines of the bus. Observation circuitry can observe voltage signals associated with the transmission at a point on the in-vehicle network bus. A distribution can be generated from densities of the voltage signals. ECUs can be identified and/or fingerprinted based on the distributions. ## Claims ### Claim 1 An apparatus, comprising: processing circuitry; and memory coupled to the processing circuitry, the memory comprising instructions that when executed by the processing circuitry cause the processing circuitry to: process a voltage waveform of a message from a communication bus; determine a message identification (MID) from the message; determine if the memory comprises a fingerprint associated with the MID; generate a set of histograms from the voltage waveform after a failure to find the fingerprint associated with the MID in the memory; generate a density from the set of histograms with a kernel based density function, the kernel based density function to fit the set of histograms as a sum of kernels; generate an observed distribution from the density of the voltage waveform with a cumulative distribution function (CDF); and store the fingerprint with an indicator of the MID in the memory to associate the MID with the fingerprint, wherein the fingerprint comprises an indication of the observed distribution. ### Claim 2 (depends on 1) The apparatus of claim 1, the instructions when executed by the processing circuitry cause the processing circuitry to further: determine an electronic control unit (ECU) identification (ID) from the message; and determine if the ECU ID is profiled in the memory; wherein storage of the fingerprint with the indicator of the MID further comprises associating the fingerprint in the memory with the ECU ID after a failure to determine that the ECU ID is profiled in the memory. ### Claim 3 (depends on 1) The apparatus of claim 1, the instructions when executed by the processing circuitry cause the processing circuitry to further: identify the message on the communication bus; observe voltage signals on the communication bus associated with transmission of the message; and generate the voltage waveform based on the voltage signals. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the communication bus is an in-vehicle network. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the processing circuitry further comprises observation circuitry arranged to observe the voltage signals at a point on the communication bus. ### Claim 6 (depends on 1) The apparatus of claim 1, the memory comprising a plurality of fingerprints, wherein ECU IDs, MIDs, or a combination thereof are associated with the plurality of fingerprints. ### Claim 7 (depends on 6) The apparatus of claim 6, the memory comprising a data structure comprising the plurality of fingerprints, wherein each entry in the data structure comprises one of the plurality of fingerprints, one of the ECU IDs, and one of the MIDs. ### Claim 8 (depends on 6) The apparatus of claim 6, the memory pre-populated with ECU IDs. ### Claim 9 (depends on 8) The apparatus of claim 8, the instructions when executed by the processing circuitry cause the processing circuitry to further determine whether any ECU IDs in the memory remain to profile. ### Claim 10 A system, comprising: at least one electronic control unit (ECU); and an ECU identification sub-system coupled to the at least one ECU via an in-vehicle network (IVN), the ECU identification sub-system comprising: processing circuitry; and memory coupled to the processing circuitry, the memory comprising instructions that when executed by the processing circuitry cause the processing circuitry to: process a voltage waveform of a message from a communication bus of the IVN; determine a message identification (MID) from the message; determine if the memory comprises a fingerprint associated with the MID; generate a set of histograms from the voltage waveform after a failure to find the fingerprint associated with the MID in the memory; generate a density from the set of histograms with a kernel based density function, the kernel based density function to fit the set of histograms as a sum of kernels; generate an observed distribution from the density of the voltage waveform with a cumulative distribution function (CDF); and store the fingerprint with an indicator of the MID in the memory to associate the MID with the fingerprint, wherein the fingerprint comprises an indication of the observed distribution. ### Claim 11 (depends on 10) The system of claim 10, the instructions when executed by the processing circuitry cause the processing circuitry to further: determine an ECU identification (ID) from the message; and determine if the ECU ID is profiled in the memory; wherein storage of the fingerprint with the indicator of the MID further comprises associating the fingerprint in the memory with the ECU ID after a failure to determine that the ECU ID is profiled in the memory. ### Claim 12 (depends on 10) The system of claim 10, the instructions when executed by the processing circuitry cause the processing circuitry to further: identify the message on the communication bus; observe voltage signals on the communication bus associated with transmission of the message; and generate the voltage waveform based on the voltage signals. ### Claim 13 (depends on 10) The system of claim 10, wherein the processing circuitry further comprises observation circuitry arranged to observe the voltage signals at a point on the communication bus. ### Claim 14 (depends on 10) The system of claim 10, the memory comprising a plurality of fingerprints, wherein ECU IDs, MIDs, or a combination thereof are associated with the plurality of fingerprints. ### Claim 15 (depends on 14) The system of claim 14, the memory comprising a data structure comprising the plurality of fingerprints, wherein each entry in the data structure comprises one of the plurality of fingerprints, one of the ECU IDs, and one of the MIDs. ### Claim 16 (depends on 15) The system of claim 15, the instructions when executed by the processing circuitry cause the processing circuitry to further determine whether any ECU IDs in the memory remain to profile. ### Claim 17 At least one non-transitory computer-readable storage device comprising instructions that when executed by processing circuitry cause the processing circuitry to: process a voltage waveform of a message from a communication bus; determine a message identification (MID) from the message; determine if the memory comprises a fingerprint associated with the MID; generate a set of histograms from the voltage waveform after a failure to find the fingerprint associated with the MID in the memory; generate a density from the set of histograms with a kernel based density function, the kernel based density function to fit the set of histograms as a sum of kernels; generate an observed distribution from the density of the voltage waveform with a cumulative distribution function (CDF); and store the fingerprint with an indicator of the MID in the memory to associate the MID with the fingerprint, wherein the fingerprint comprises an indication of the observed distribution. ### Claim 18 (depends on 17) The non-transitory computer-readable storage device of claim 17, comprising instructions that when executed by the processing circuitry cause the processing circuitry to further: determine an electronic control unit (ECU) identification (ID) from the message; and determine if the ECU ID is profiled in the memory; wherein storage of the fingerprint with the indicator of the MID further comprises associating the fingerprint in the memory with the ECU ID after a failure to determine that the ECU ID is profiled in the memory. ### Claim 19 (depends on 17) The non-transitory computer-readable storage device of claim 17, comprising instructions that when executed by the processing circuitry cause the processing circuitry to further: identify the message on the communication bus; observe voltage signals on the communication bus associated with transmission of the message; and generate the voltage waveform based on the voltage signals. ### Claim 20 (depends on 17) The non-transitory computer-readable storage device of claim 17, comprising instructions that when executed by the processing circuitry cause the processing circuitry to further determine whether any ECU IDs in the memory remain to profile.