# US 2014/0195808 A1 · Secure message filtering to vehicle electronic control units with secure provisioning of message filtering rules

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0195808 A1
- Document ID: US20140195808A1
- Status: Published application
- Kind: A1
- Application number: 13/992,304
- Filed: 2011-12-01
- Published: 2014-07-10
- Earliest claimed: 2011-12-01
- Assignees: Intel Corporation
- Inventors: Victor B. Lortz; Somya Rathi; Anand P. Rangarajan; Vijay Sarathi Kesavan
- Web page: https://patentgrep.com/patent/US20140195808A1

## CPC

- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- G06F 15/177: Initialisation or configuration control {(processor initialisation G06F9/4405)}
- H04L 9/3247: {involving digital signatures}
- H04L 63/0263: {Rule management}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)}
- H04L 63/126: {the source of the received data}
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A method according to one embodiment includes the operations of configuring a host processor to receive a message filtering rule, the host processor associated with a vehicle; configuring a bus controller to verify authenticity of the message filtering rule, wherein the bus controller is programmed through an interface, the interface inaccessible from the host processor; filtering messages from the host processor using the verified message filtering rule, wherein the filtering is performed by the bus controller; and transmitting the filtered messages from the bus controller over a bus to one or more electronic control units (ECUs), the ECUs communicatively coupled to the bus.

## Claims

### Claim 1

A system, comprising:
a host processor associated with a vehicle, said host processor configured to receive a message filtering rule;
a bus controller configured to verify authenticity of said message filtering rule and further configured to filter messages from said host processor using said verified message filtering rule, wherein said bus controller is programmed through an interface, said interface inaccessible from said host processor; and
a bus configured to transmit said filtered messages from said bus controller to one or more electronic control units (ECUs), said ECUs communicatively coupled to said bus.

### Claim 2 (depends on 1)

The system of claim 1, wherein said message filtering rule further comprise a trusted manifest and said bus controller programming further comprises a trusted rule signing key, such that said authenticity verification is based on said trusted manifest and said trusted rule signing key.

### Claim 3 (depends on 1)

The system of claim 1, wherein said bus controller ignores said message filtering rule if said authenticity verification fails.

### Claim 4 (depends on 1)

The system of claim 1, wherein said bus controller blocks messages and indicates an error if said authenticity verification fails.

### Claim 5 (depends on 1)

The system of claim 1, wherein said bus controller comprises a Field Programmable Gate Array (FPGA) and said programming interface comprises a Joint Test Action Group (JTAG) interface.

### Claim 6 (depends on 1)

The system of claim 1, wherein said bus comprises a Controller Area Network (CAN) bus.

### Claim 7 (depends on 1)

The system of claim 1, wherein said host processor comprises an In-Vehicle Infotainment (IVI) platform.

### Claim 8 (depends on 1)

The system of claim 1, wherein said message filtering rule is received by said host processor through a wireless connection from a source external to said vehicle.

### Claim 9

A method, comprising:
configuring a host processor to receive a message filtering rule, said host processor associated with a vehicle;
configuring a bus controller to verify authenticity of said message filtering rule, wherein said bus controller is programmed through an interface, said interface inaccessible from said host processor;
filtering messages from said host processor using said verified message filtering rule, wherein said filtering is performed by said bus controller; and
transmitting said filtered messages from said bus controller over a bus to one or more ECUs, said ECUs communicatively coupled to said bus.

### Claim 10 (depends on 9)

The method of claim 9, wherein said message filtering rule further comprise a trusted manifest and said bus controller programming further comprises a trusted rule signing key, such that said authenticity verification is based on said trusted manifest and said trusted rule signing key.

### Claim 11 (depends on 9)

The method of claim 9, wherein said bus controller ignores said message filtering rule if said authenticity verification fails.

### Claim 12 (depends on 9)

The method of claim 9, wherein said bus controller blocks messages and indicates an error if said authenticity verification fails.

### Claim 13 (depends on 9)

The method of claim 9, wherein said bus controller comprises a Field Programmable Gate Array (FPGA) and said programming interface comprises a Joint Test Action Group (JTAG) interface.

### Claim 14 (depends on 9)

The method of claim 9, wherein said bus comprises a Controller Area Network (CAN) bus.

### Claim 15 (depends on 9)

The method of claim 9, wherein said host processor comprises an In-Vehicle Infotainment (IVI) platform.

### Claim 16 (depends on 9)

The method of claim 9, wherein said message filtering rule is received by said host processor through a wireless connection from a source external to said vehicle.

### Claim 17

A method, comprising:
receiving a message filtering rule from a rule authoring entity;
receiving a digital signature associated with said message filtering rule, wherein said digital signature verifies identity of said rule authoring entity as a trusted source;
generating a trusted manifest associated with said message filtering rule based on said digital signature; and
providing said trusted manifest to said rule authoring entity, such that said rule authoring entity associates said trusted manifest with said message filtering rule for transmission to a host processor associated with a vehicle.

### Claim 18 (depends on 17)

The method of claim 17, wherein said generating said trusted manifest is further based on a trusted rule signing key provisioned to a message filtering bus controller associated with said vehicle.

### Claim 19

A non-transitory computer-readable storage medium having instructions stored thereon which when executed by a processor result in the following operations comprising:
receiving a message filtering rule on a host processor, said host processor associated with a vehicle;
verifying authenticity of said message filtering rule on a bus controller, wherein said bus controller is programmed through an interface, said interface inaccessible from said host processor;
filtering messages from said host processor using said verified message filtering rule, wherein said filtering is performed by said bus controller; and
transmitting said filtered messages from said bus controller over a bus to one or more ECUs, said ECUs communicatively coupled to said bus.

### Claim 20 (depends on 19)

The non-transitory computer-readable storage medium of claim 19, wherein said operations further comprise verifying authenticity based on a trusted manifest and a trusted rule signing key, wherein said message filtering rule further comprises said trusted manifest and said bus controller programming further comprises said trusted rule signing key.

### Claim 21 (depends on 19)

The non-transitory computer-readable storage medium of claim 19, wherein said operations further comprise ignoring said message filtering rule if said authenticity verification fails.

### Claim 22 (depends on 19)

The non-transitory computer-readable storage medium of claim 19, wherein said operations further comprise blocking messages and indicating an error if said authenticity verification fails.