# US 12,182,259 B2 · Vehicle bus security by corrupting suspected transmitted frames

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,182,259 B2
- Document ID: US12182259B2
- Status: Granted
- Kind: B2
- Application number: 17/347,787
- Filed: 2021-06-15
- Published: 2021-10-07
- Granted: 2024-12-31
- Earliest claimed: 2015-07-22
- Assignees: SheeldS Cyber Ltd.
- Applicants: Arilou Information Security Technologies Ltd.
- Inventors: Gil Litichever; Ziv Levi
- Web page: https://patentgrep.com/patent/US12182259B2

## CPC

- G06F 21/554: {involving event detection and direct action}
- G06F 13/36: for access to common bus or bus system
- G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices
- H04L 12/40006: {Architecture of a communication node (current supply arrangements H04L12/10; intermediate storage or scheduling H04L49/90)}
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L 67/565: Conversion or adaptation of application format or content (adding application control or application functional data H04L67/561)
- H04L 69/00: Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass (networks security protocols H04L9/40; wireless communication networks H04W)
- H04L 69/22: Parsing or analysis of headers
- G06F 2221/034: Test or assess a computer or a system
- H04L 2012/40215: {Controller Area Network CAN}
- H04L 2012/40273: {the transportation system being a vehicle}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method of real-time data security of a communications bus, the method comprising the steps of: reading at least an early portion of a message being transmitted over a communications bus, determining whether the message is suspicious, according to at least one rule applied on the read early portion of the message, and upon determining that the message is suspicious, corrupting at least a part of the message.

## Claims

### Claim 1

A method for use with multiple Electronic Control Units (ECUs) communicating over a first vehicle bus in a vehicle using frames that are composed of first and second parts, where the first part is transmitted to the first vehicle bus before the second part, the method comprising:
receiving, by a second connector from a serial data source that is not a vehicle bus, a first part of a first frame that is composed of first and second parts;
transmitting, by a first transceiver that is controlled by a processor, via a first connector that is different from the first connector and that is connectable to the first vehicle bus, the received first part of the first frame to the first vehicle bus;
receiving, by the second connector from the serial data source, the second part of a first frame that is composed of the first and second parts;
while receiving the second part, checking, by the processor, the received first part for compliance with a rule;
transmitting, by the first transceiver to the first vehicle bus, responsive to the first part complying with the rule, the second part of the first frame; and
transmitting, by the first transceiver to the first vehicle bus, responsive to the first part not complying with the rule, data other than the second part of the first frame, for corrupting or preventing the first frame on the first vehicle bus, so that the first frame is rendered ineligible to be properly received by at least one of the multiple ECUs connected to the first vehicle bus,
wherein the second connector, the first connector, the first transceiver, and the processor, are housed in a single enclosure.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the vehicle is an autonomous or self-driving car, wherein the processor is a Central Processor Unit (CPU), a controller, a Field-Programmable Gate Array (FPGA), or an Application Specific Integrated Circuit (ASIC), and wherein the checking comprises real-time detecting of malicious messages carried over the first vehicle bus.

### Claim 3 (depends on 1)

The method according to claim 1, wherein the serial data source sends data according to a protocol of a second vehicle bus.

### Claim 4 (depends on 3)

The method according to claim 3, wherein the first and second vehicle buses use different protocols, and the method further comprising converting between the different protocols.

### Claim 5 (depends on 3)

The method according to claim 3, further for use with a second transceiver coupled between the second connector and the processor, the method comprising receiving frames from the second vehicle bus by the second transceiver and forwarding the received frames from the second vehicle bus to the processor.

### Claim 6 (depends on 5)

The method according to claim 5, further comprising storing, by a buffer coupled for sequentially storing a series of bits from the second transceiver, the first part of the first frame, and wherein the checking comprises checking the series of bits stored in the buffer.

### Claim 7 (depends on 5)

The method according to claim 5, further comprising:
receiving, by the first transceiver, a first part and a second part of a second frame from the first vehicle bus transmitted by an ECU connected thereto;
checking the first part of the second frame by the processor according to an additional rule;
transmitting, by the second transceiver, at least part of the first part of the second frame to the second vehicle bus, while at least part of the second frame is received from the first vehicle bus, by the first transceiver via the first connector;
forwarding the second part of the second frame to the second vehicle bus, by the second transceiver via the second connector, responsive to the first part of the second frame complying with the additional rule; and
transmitting, responsive to the first part of the second frame not complying with the additional rule, data other than the second part of the second frame, by the second transceiver to the second vehicle bus via the second connector, for corrupting the second frame on the second vehicle bus so that the second frame is rendered ineligible to be properly received by any of the multiple ECUs connected to the second vehicle bus.

### Claim 8 (depends on 5)

The method according to claim 5, wherein the communication over the second vehicle bus uses, or is based on, Control Area Network (CAN) or Control Area Network-Flexible Data-rate (CAN-FD) standard, and wherein the second transceiver is respectively CAN or CAN-FD transceiver.

### Claim 9 (depends on 5)

The method according to claim 5, for use with a gateway or a bridge, the method further comprising transferring messages between the first and second vehicle buses, or wherein the gateway or the bridge is part of, or integrated with, one of the multiple ECUs.

### Claim 10 (depends on 5)

The method according to claim 5, further comprising converting, by the first transceiver, a first series of bits that use first logical data levels to the first frame, and converting, by the second transceiver, a second series of bits that use second logical data levels to at least part of the first part of the first frame that is transmitted to the second vehicle bus.

### Claim 11 (depends on 10)

The method according to claim 10, wherein the second series of bits of the first part is identical to the first series of bits of the first part, and wherein an output of the first transceiver is directly connected, with no delay, to an input of the second transceiver.

### Claim 12 (depends on 10)

The method according to claim 10, wherein the first or second logical data levels are CMOS or TTL levels, or wherein the first series of bits are carried over an interconnection protocol that is a Serial Peripheral Interface (SPI), Inter-Integrated Circuit (I2C), Universal Asynchronous Receiver/Transmitter (UART), or Peripheral Component Interconnect (PCI).

### Claim 13 (depends on 5)

The method according to claim 5, further comprising sending, by the second transceiver via the second connector, a message to the second vehicle bus responsive to the first part and the second part complying a first protocol.

### Claim 14 (depends on 13)

The method according to claim 13, for use with the first protocol over the second vehicle bus, wherein the message sent is an acknowledgement message or proper receipt of the first frame, and wherein the first protocol consists of, employs, or is based on, Control Area Network (CAN) or Control Area Network-Flexible Data-rate (CAN-FD) standard, and wherein the message comprises an ‘ACK’ message.

### Claim 15 (depends on 5)

The method according to claim 5, wherein the single enclosure comprises the first ECU, wherein the first ECU is connectable to the Internet for receiving malicious information therefrom, and wherein the first frame is transmitted, by the first ECU to the second vehicle bus in response to the received malicious information from the Internet, the method further comprising detecting of the malicious information, and wherein the malicious information comprises an instruction to turn off a vehicle anti-theft system, or wherein the malicious information comprises a code or an instruction for remotely controlling critical system in the vehicle.

### Claim 16 (depends on 1)

The method according to claim 1, wherein the first transceiver is coupled to the second connector for transmitting at least part of the first part of the first frame received from the serial data source while at least part of the first frame is received from the second connector.

### Claim 17 (depends on 1)

The method according to claim 1, further comprising transmitting the first and second parts of the first frame to the first vehicle bus, by the first transceiver, only in response to the first part of the first frame complying with the rule.

### Claim 18 (depends on 1)

The method according to claim 1, further comprising, responsive to the first part not complying with the rule, not forwarding at least one bit of the second part of the first frame to the first vehicle bus, or discarding the second part of the first frame and blocking the forwarding of any bit of the second part of the first frame to the first vehicle bus.

### Claim 19 (depends on 1)

The method according to claim 1, further comprising, responsive to the first part not complying with the rule, forwarding a corrupted second part of the first frame to the first vehicle bus.

### Claim 20 (depends on 19)

The method according to claim 19, wherein the second vehicle bus is carrying data as dominant (‘0’) or recessive (‘1’) bits, the method further comprising corrupting of the second part of the first frame by changing at least one bit in the second part of the first frame, and corrupting of the second part of the first frame by changing one or more bits from recessive to dominant bits.

### Claim 21 (depends on 20)

The method according to claim 20, further comprising corrupting of the second part of the first frame by changing multiple non-consecutive bits in the second part of the first frame.

### Claim 22 (depends on 1)

The method according to claim 1, wherein the communication over the first vehicle bus uses, or is based on, a standard protocol that defines fields in any frame transmitted over the second vehicle bus, and wherein the corrupting of the second part of the first frame comprises changing at least one bit in a field in the first frame.

### Claim 23 (depends on 22)

The method according to claim 22, wherein the field is Cyclic Redundancy Check (CRC), and wherein the communication over the first vehicle bus uses, or is based on, Control Area Network (CAN) or Control Area Network-Flexible Data-rate (CAN-FD) standard, and wherein the corrupting of the second part of the first frame comprises inserting a CAN stuffing error to the first frame.

### Claim 24 (depends on 22)

The method according to claim 22, wherein the communication over the first vehicle bus uses, or is based on, Control Area Network (CAN) or Control Area Network-Flexible Data-rate (CAN-FD) standard, and wherein the corrupting of the second part of the first frame comprises inserting a CAN Error Frame that comprises an Active Error Frame, or wherein the changed bit is an Error Flag or an Error Delimiter.

### Claim 25 (depends on 1)

The method according to claim 1, further comprising delaying by a time interval, by a message delay component coupled between the second connector and the first transceiver, the received first part before being transmitted to the second vehicle bus.

### Claim 26 (depends on 25)

The method according to claim 25, wherein the first part is delayed until the checking, by the processor, of the first part is completed.

### Claim 27 (depends on 25)

The method according to claim 25, further comprising sensing, by a second transceiver, whether the first vehicle bus is busy or free, and wherein the first part is delayed by the message delay component until the second vehicle bus is sensed to be free.

### Claim 28 (depends on 25)

The method according to claim 25, wherein the time interval is fixed.

### Claim 29 (depends on 25)

The method according to claim 25, wherein message delay component is coupled be controlled by the processor, and the time interval is controlled in response to a value in a field of in the first frame, or wherein the time interval is controlled in response to a length of the first part or of the first frame.

### Claim 30 (depends on 1)

The method according to claim 1, wherein the first transceiver is operative to receive or to transmit using fast bit sampling for avoiding loss of bits timing, or wherein the first transceiver is operative to receive or to transmit using batch bits sampling.

### Claim 31 (depends on 1)

The method according to claim 1, for use with a first and second baud rate used by the first transceiver for the receiving from, or the transmitting to, the first vehicle bus, and wherein the processor is coupled to the first transceiver for controlling the first transceiver to use the first or the second baud rate.

### Claim 32 (depends on 1)

The method according to claim 1, wherein the first part of the first frame comprises two or more bytes, and wherein the checking comprises checking two or more non-consecutive bytes or two or more non-consecutive bytes in the first part of the first frame.

### Claim 33 (depends on 1)

The method according to claim 1, further comprising receiving the rule using a connection for receiving the rule from an operator or a logic circuit designer; and storing the rule.

### Claim 34 (depends on 1)

The method according to claim 1, wherein the first part comprises a field of the first frame, and wherein the rule applies to the field content.

### Claim 35 (depends on 34)

The method according to claim 34, wherein the field consists of, or comprises, a frame header, an identification of the frame sender, a flag, or an identification of the frame type, for use with a list of field data associated with the field content, and wherein the checking comprises comparing the first part to the list.

### Claim 36 (depends on 35)

The method according to claim 35, wherein the transmitting of the signal is responsive to the first part being identical to one of the field data in the list, or wherein the transmitting of the signal is responsive to the first part being not found in any of the field data in the list, or wherein each of the first ECU and the multiple ECUs is identified in the communication over the respective vehicle bus using an address, wherein each of the frames received from the second connector comprises the address of the respective sending ECU, and wherein the list of field data comprises a list of addresses of part of, or all of, the ECUs connected to the respective vehicle bus, and wherein the transmitting of part of the first frame to the first vehicle bus is responsive to the address of the first ECU being included in the list of addresses.

### Claim 37 (depends on 1)

The method according to claim 1, wherein the rule applies to the first frame length or to a timing property of the first frame, and wherein the timing property comprises the frame sending time, or frames transmission rate.

### Claim 38 (depends on 1)

The method according to claim 1, wherein the frames and the communication over the first vehicle bus is according to, based on, or is compatible with, a standard protocol that is based on, or uses, a no-master, broadcast protocol using a differential bus that consists of two wires that carry bits using a dominant state and a recessive state.

### Claim 39 (depends on 38)

The method according to claim 38, wherein the standard protocol consists of, employs, or is based on, a Control Area Network (CAN), a Local Interconnect Network (LIN), a Flex-Ray bus, a Vehicle Area Network (VAN), or an Ethernet bus.

### Claim 40 (depends on 38)

The method according to claim 38, wherein the first frame is corruptedly propagated on the first vehicle bus so that the first frame is not compatible with the standard protocol when received by any of the multiple ECUs, wherein the transmitting of the signal to the first vehicle bus comprises changing one or more bits in a series of bits received by each of the multiple ECUs, rendering the received frame by each of the multiple ECUs as errored frame according to the standard protocol, or wherein the standard protocol defines a Cyclic Redundancy Check (CRC) field in any frame, and wherein the transmitting of the signal to the first vehicle bus comprises changing one or more bits resulting in an error in the CRC field when received by each of the multiple ECUs.