# US 12,118,083 B2 · System and method for detection and prevention of cyber attacks at in-vehicle networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,083 B2 - Document ID: US12118083B2 - Status: Granted - Kind: B2 - Application number: 17/795,564 - Filed: 2021-05-09 - Published: 2023-03-23 - Granted: 2024-10-15 - Earliest claimed: 2020-05-21 - Assignees: High Sec Labs Ltd. - Applicants: High Sec Labs Ltd. - Inventors: Aviv Soffer - Web page: https://patentgrep.com/patent/US12118083B2 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 11/1417: {Boot up procedures} - G06F 11/3024: {where the computing system component is a central processing unit [CPU]} - G06F 11/3027: {where the computing system component is a bus} - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A cyber security system for in-vehicle networks comprises a plurality of electronic control units (ECUs) communicating via a vehicle bus. The system comprises a plurality of bus security units (BSUs), wherein each BSU is configured to be connected between the vehicle bus and one of the ECUs, and the BSUs communicating via a security bus separate from the vehicle bus. Each BSU is configured to monitor the activity of the corresponding ECU, on the vehicle bus, send the monitored activity to another BSU on the security bus and detect abnormal communication on the vehicle bus. ## Claims ### Claim 1 A cyber security system for in-vehicle networks comprising a plurality of electronic control units (ECUs) communicating via a vehicle bus, the system comprising: a plurality of bus security units (BSUs), wherein each BSU is configured to be connected between the vehicle bus and one of the ECUs, and the BSUs communicating via a security bus separate from the vehicle bus, wherein each BSU is configured to: monitor the activity of the corresponding ECU, on the vehicle bus; send the monitored activity to another BSU on the security bus; detect abnormal communication on the vehicle bus; and perform at least one of the following security operations: (a) disconnecting the corresponding ECU from the vehicle bus; (b) firewalling between the vehicle bus and the corresponding ECU; and (c) bridging between the corresponding ECU and another ECU by bypassing the vehicle bus using the security bus instead. ### Claim 2 (depends on 1) The system of claim 1, further comprising a controller, in operable communication with the BSUs, wherein the controller is configured to: analyze information received from the BSUs; and instruct the BSUs to switch communication between the vehicle bus and the security bus. ### Claim 3 (depends on 1) The system of claim 1, wherein the BSUs are configured to block ECUs with detected abnormal communication. ### Claim 4 (depends on 1) The system of claim 1, wherein the BSUs are configured to switch communication from the vehicle bus to the security bus upon detection of a potential cyber-attack. ### Claim 5 (depends on 1) The system of claim 1, wherein the BSUs are configured to reset ECUs with detected abnormal communication. ### Claim 6 (depends on 1) The system of claim 1, wherein the BSUs are configured to use the security bus to perform at least one of: source and destination addressing for messages of at least one compromised ECU. ### Claim 7 (depends on 1) The system of claim 1, wherein the vehicle bus is in communication with a gateway, wherein the gateway is in communication with a third bus, and wherein at least one BSU is in operable communication with the gateway. ### Claim 8 (depends on 7) The system of claim 7, wherein for each bus, at least one BSU is configured to monitor communication to the gateway. ### Claim 9 (depends on 1) The system of claim 1, wherein the security bus comprises at least one of an optical and a copper local area network (LAN). ### Claim 10 (depends on 1) The system of claim 1, wherein the vehicle bus is at least one of CAN Bus 2.0, CAN bus 2.0A, CAN Bus 2.0B, CAN FD 1.0 and ISO-11898. ### Claim 11 A method of cyber security protection for in-vehicle networks comprising a plurality of electronic control units (ECUs) communicating via a vehicle bus, the method comprising: connecting a plurality of bus security units (BSUs) between the vehicle bus and one of the ECUs; connecting the BSUs to communicate via a security bus separate from the vehicle bus; monitoring, by each BSU, the activity of the corresponding ECU, on the vehicle bus; sending, by each BSU, the monitored activity to another BSU on the security bus; detecting, by each BSU, abnormal communication on the vehicle bus; and performing at least one of the following security operations: (a) disconnecting the corresponding ECU from the vehicle bus; (b) firewalling between the vehicle bus and the corresponding ECU; and (c) bridging between the corresponding ECU and another ECU by bypassing the vehicle bus and using the security bus instead. ### Claim 12 (depends on 11) The method of claim 11, further comprising: analyzing information received from the BSUs, by a controller, in operable communication with the BSUs; and instructing the BSUs to switch communication between the vehicle bus and the security bus. ### Claim 13 (depends on 11) The method of claim 11, further comprising blocking, by the BSUs, ECUs with detected abnormal communication. ### Claim 14 (depends on 11) The method of claim 11, further comprising switching, by the BSUs, communication from the vehicle bus to the security bus upon detection of a potential cyber-attack. ### Claim 15 (depends on 11) The method of claim 11, further comprising resetting, by the BSUs, ECUs with detected abnormal communication. ### Claim 16 (depends on 11) The method of claim 11, further comprising using, by the BSUs, the security bus to perform at least one of: source and destination addressing for messages of at least one compromised ECU. ### Claim 17 (depends on 11) The method of claim 11, further comprising monitor communication to a gateway in communication with the vehicle bus, wherein the gateway is in communication with a third bus, and wherein at least one BSU is in operable communication with the gateway. ### Claim 18 A bus security unit (BSU) for communication with an electronic control unit (ECU) communicating via a vehicle bus, the BSU comprising: at least one vehicle bus transceiver, configured to communicate with at least one of the ECU and the vehicle bus; at least one controller, coupled to the at least one vehicle bus transceiver, wherein the at least one controller is configured to block communication with detected abnormal messages; and a secured interface, configured to connect the BSU to a security bus separate from the vehicle bus, wherein the BSU is configured to: monitor the activity of the ECU, on the vehicle bus; send the monitored activity to another BSU on the security bus; detect abnormal communication on the vehicle bus; and perform at least one of the following security operations: (a) disconnecting the corresponding ECU from the vehicle bus; (b) firewalling between the vehicle bus and the corresponding ECU; and (c) bridging between the corresponding ECU and another ECU by bypassing the vehicle bus using the security bus instead. ### Claim 19 (depends on 18) The BSU of claim 18, wherein the at least one controller is configured to emulate at least one of the ECU and the vehicle bus. ### Claim 20 (depends on 18) The BSU of claim 18, wherein processor is configured to perform at least one of: encryption/decryption of messages, authentication, addressing, message routing, firewalling, storing keys and/or logs, and controlling the ECU.