# US 2016/0366156 A1 · Protection of communication on a vehicular network via a remote security service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366156 A1 - Document ID: US20160366156A1 - Status: Published application - Kind: A1 - Application number: 14/738,935 - Filed: 2015-06-15 - Published: 2016-12-15 - Earliest claimed: 2015-06-15 - Assignees: Check Point Software Technologies Ltd. - Applicants: Check Point Software Technologies Ltd. - Inventors: Alon KANTOR; Tamir Zegman - Web page: https://patentgrep.com/patent/US20160366156A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/0281: {Proxies} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 4/40: for vehicles, e.g. vehicle-to-pedestrians [V2P] - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 12/125: Protection against power exhaustion attacks - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04L 63/164: {at the network layer} - H04L 63/168: {above the transport layer} - H04L 2209/84: Vehicles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods and systems for protecting components of a linked vehicle from cyber-attack are disclosed. These methods and systems comprise elements of hardware and software for receiving a packet; tunneling the packet to a terrestrial-based security service, analyzing whether the packet is harmful to a component in the vehicle, and at least one action to protect at least one component. ## Claims ### Claim 1 A method to mitigate a cyber-attack on a linked vehicle, comprising: receiving, by a terrestrial-based security service, a packet transmitted to a vehicle; analyzing whether the received packet is suspected to be part of a cyber-attack; and, based on the analysis that the received packet is suspected to be part of a cyber-attack, taking at least one action to protect at least one of the vehicle components. ### Claim 2 (depends on 1) The method of claim 1, wherein the analyzing whether the received packet is suspected to be part of a cyber-attack includes performing at least one process from the group consisting of: inspecting the data in the packet for non-conformance to static requirements of correctness of a protocol; inspecting data in the packet for non-conformance to session-contextual requirements of correctness of a protocol; inspecting data in the packet for exploitation of a vulnerability in a protocol implementation; measuring the rate of packet arrival to determine whether a particular maximum threshold arrival rate has been exceeded; and, inspecting the packet to determine whether it includes a bit pattern that is characteristic of cyber-attack packets. ### Claim 3 (depends on 1) The method of claim 1, wherein the at least one action to protect at least one of the components includes blocking the packet. ### Claim 4 (depends on 1) The method of claim 1, wherein the at least one action to protect at least one of the components includes issuing an alert. ### Claim 5 A method of protecting communications between a linked vehicle and a terrestrial peer, wherein the vehicle and terrestrial peer share a secret key, the method comprising: applying an encryption algorithm to data for transmission; applying an integrity protection algorithm to data for transmission, to create a cryptographic hash; and, transmitting the encrypted data and cryptographic hash to the remote peer using a format recognized by the remote peer. ### Claim 6 (depends on 5) The method of claim 5, wherein the format used for transmitting the encrypted data and cryptographic hash is IPSEC. ### Claim 7 (depends on 5) The method of claim 5, wherein the format used for transmitting the encrypted data and cryptographic checksum is TLS. ### Claim 8 A method for controlling access to network services within a linked vehicle, comprising: receiving a packet from a vehicle component; inspecting the packet to determine an associated application; according to whether the determined associated application was HTTP, determining a requested URL; and, according to the determined application information, taking an action specified by vehicle policy. ### Claim 9 (depends on 8) The method of claim 8, wherein the action specified by vehicle policy is logging use of an application. ### Claim 10 (depends on 8) The method of claim 8, wherein the action specified by vehicle policy is blocking the packet. ### Claim 11 A terrestrial-based computer system to mitigate a cyber-attack on a linked vehicle, comprising: a storage medium for storing computer components; and, a computerized processor for executing the computer components comprising: a first computer component for receiving a packet transmitted to a vehicle; a second computer component for analyzing whether the received packet is suspected to be part of a cyber-attack; and, a third computer component for, based on the analysis that the received packet is suspected to be part of a cyber-attack, taking at least one action to protect at least one of the vehicle components. ### Claim 12 (depends on 11) The system of claim 11, wherein the second computer component analyzes whether a received packet is suspected to be part of a cyber-attack, by performing at least one process from the group consisting of: inspecting the data in the packet for non-conformance to static requirements of correctness of a protocol; inspecting data in the packet for non-conformance to session-contextual requirements of correctness of a protocol; inspecting data in the packet for exploitation of a vulnerability in a protocol implementation; measuring the rate of packet arrival to determine whether a particular maximum threshold arrival rate has been exceeded; and, inspecting the packet to determine whether it contains a bit pattern that is characteristic of cyber-attack packets. ### Claim 13 A computer-usable non-transitory storage medium having a computer program embodied thereon for causing a suitable programmed system to mitigate a cyber-attack on a linked vehicle, by performing the following steps when such program is executed on the system, the steps comprising: reception, by a terrestrial-based security service, of a packet transmitted to a vehicle; analyzing whether the received packet is suspected to be part of a cyber-attack; and, based on the analysis that the received packet is suspected to be part of a cyber-attack, taking at least one action to protect at least one of the vehicle components. ### Claim 14 (depends on 13) The storage medium of claim 13, wherein the analysis of whether the received packet is suspected to be part of a cyber-attack includes performing at least one process from the group consisting of: inspecting the data in the packet for non-conformance to static requirements of correctness of a protocol; inspecting data in the packet for non-conformance to session-contextual requirements of correctness of a protocol; inspecting data in the packet for exploitation of a vulnerability in a protocol implementation; measuring the rate of packet arrival to determine whether a particular maximum threshold arrival rate has been exceeded; and, inspecting the packet to determine whether it includes a bit pattern that is characteristic of cyber-attack packets.