# US 12,192,232 B2 · Security system for in-vehicle network and method therefor > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,232 B2 - Document ID: US12192232B2 - Status: Granted - Kind: B2 - Application number: 17/366,402 - Filed: 2021-07-02 - Published: 2022-06-09 - Granted: 2025-01-07 - Earliest claimed: 2020-12-08 - Assignees: Hyundai Motor Company; Kia Corporation - Applicants: Hyundai Motor Company; Kia Corporation - Inventors: Ho Jin Jung - Web page: https://patentgrep.com/patent/US12192232B2 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 12/40: Bus networks - H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 2012/40215: {Controller Area Network CAN} - H04L 2012/40273: {the transportation system being a vehicle} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A security system for an in-vehicle network includes a gateway including at least one processor, wherein the at least one processor is configured to transition an intrusion detection and prevention system (IDPS) loaded into the gateway from a function off mode to a first monitoring mode and detect an intrusion into a general message and a diagnostic message on the in-vehicle network, transition from the first monitoring mode to a second monitoring mode and stop detecting the intrusion into the general message when there is a request to stop transmitting the general message from outside, detect the intrusion into the diagnostic message, and detect and block the general message introduced into the in-vehicle network. ## Claims ### Claim 1 A security system for an in-vehicle network, the security system comprising: a gateway including at least one processor, wherein the at least one processor is configured to: transition an intrusion detection and prevention system (IDPS) loaded into the gateway from a function off mode to a first monitoring mode and detect an intrusion into a general message and a diagnostic message on the in-vehicle network; transition from the first monitoring mode to a second monitoring mode and stop detecting the intrusion into the general message when there is a request to stop transmitting the general message from outside, and detect the intrusion into the diagnostic message; and detect and block the general message introduced into the in-vehicle network; wherein the at least one processor is configured to transition from the second monitoring mode to the first monitoring mode: when a session maintenance request message is not received within a predetermined time in the second monitoring mode; or when a communication control command to permit transmission of the general message from the outside in the second monitoring mode is received. ### Claim 2 (depends on 1) The security system of claim 1, further comprising a memory configured to store an IDPS rule. ### Claim 3 (depends on 2) The security system of claim 2, wherein the at least one processor is configured to generate and store a log for the detected general message in the memory when detecting the general message introduced into the in-vehicle network. ### Claim 4 (depends on 3) The security system of claim 3, wherein the in-vehicle network is a controller area network. ### Claim 5 (depends on 2) The security system of claim 2, wherein the at least one processor is configured to determine whether the diagnostic message is an attack message based on the IDPS rule in the second monitoring mode. ### Claim 6 (depends on 5) The security system of claim 5, wherein the in-vehicle network is a controller area network. ### Claim 7 (depends on 2) The security system of claim 2, wherein the in-vehicle network is a controller area network. ### Claim 8 (depends on 1) The security system of claim 1, wherein the in-vehicle network is a controller area network. ### Claim 9 (depends on 1) The security system of claim 1, wherein the IDPS is a software module configured to be executed by the at least one processor. ### Claim 10 A security method for an in-vehicle network, the security method comprising: transitioning an intrusion detection and prevention system (IDPS) loaded into a gateway from a function off mode to a first monitoring mode when a vehicle starts and detecting an intrusion into a general message and a diagnostic message on the in-vehicle network; transitioning from the first monitoring mode to a second monitoring mode and stopping detecting the intrusion into the general message upon receipt of a request to stop transmitting the general message from the outside and detecting the intrusion into the diagnostic message; and detecting and blocking the general message introduced into the in-vehicle network; wherein the security method further comprises transitioning from the second monitoring mode to the first monitoring mode after not receiving a session maintenance request message within a predetermined time in the second monitoring mode or upon receipt of a communication control command to permit transmission of the general message in the second monitoring mode. ### Claim 11 (depends on 10) The security method of claim 10, wherein detecting the intrusion into the general message and the diagnostic message includes: examining the general message and the diagnostic message under an IDPS rule in the first monitoring mode to detect an attack message; and blocking routing of the attack message. ### Claim 12 (depends on 10) The security method of claim 10, wherein detecting the intrusion into the diagnostic message includes: transitioning from the first monitoring mode to the second monitoring mode upon receipt of the communication control command requesting to stop transmitting the general message in the first monitoring mode; examining the diagnostic message based on an IDPS rule to detect an attack message; and blocking routing of the detected attack message. ### Claim 13 (depends on 10) The security method of claim 10, wherein detecting and blocking of the general message includes generating a log for the detected general message upon detecting the general message being introduced into the in-vehicle network in the second monitoring mode. ### Claim 14 (depends on 10) The security method of claim 10, wherein the in-vehicle network is a controller area network. ### Claim 15 A security system for an in-vehicle network, the security system comprising: a diagnoser; a gateway communicably coupled to the diagnoser and including at least one processor, wherein the at least one processor is configured to: transition an intrusion detection and prevention system (IDPS) loaded into the gateway from a function off mode to a first monitoring mode and detect an intrusion into a general message and a diagnostic message on the in-vehicle network; transition from the first monitoring mode to a second monitoring mode and stop detecting the intrusion into the general message when there is a request to stop transmitting the general message from outside, and detect the intrusion into the diagnostic message; and detect and block the general message introduced into the in-vehicle network; and at least one electronic control unit communicably coupled to the gateway; wherein the at least one processor is configured to transition from the second monitoring mode to the first monitoring mode when a session maintenance request message is not received within a predetermined time in the second monitoring mode; or wherein the at least one processor is configured to transition from the second monitoring mode to the first monitoring mode when a communication control command to permit transmission of the general message from the outside in the second monitoring mode is received. ### Claim 16 (depends on 15) The security system of claim 15, wherein the gateway further comprises a memory configured to store an IDPS rule. ### Claim 17 (depends on 16) The security system of claim 16, wherein the at least one processor is configured to generate and store a log for the detected general message in the memory when detecting the general message introduced into the in-vehicle network. ### Claim 18 (depends on 16) The security system of claim 16, wherein the at least one processor is configured to determine whether the diagnostic message is an attack message based on the IDPS rule in the second monitoring mode. ### Claim 19 (depends on 15) The security system of claim 15, wherein the in-vehicle network is a controller area network. ### Claim 20 (depends on 15) The security system of claim 15, wherein the IDPS is a software module configured to be executed by the at least one processor.