US 2019/0245872 A1Published application

Identifying compromised electronic control units via voltage fingerprinting

AssigneeThe Regents of the University of Michigan

InventorsKang G. SHIN, Kyong-Tak CHO

Life of this patent

Estimating the term…

Loading patent…

Abstract

Research efforts to detect and prevent possible attacks on vehicles have led to various defense schemes that are capable of preventing attacks and/or determining the presence/absence of an attack on the in-vehicle network. However, these efforts still cannot identify which Electronic Control Unit (ECU) on the in-vehicle network actually mounted the attack. Moreover, they cannot detect attacks by an adversary that impersonates ECUs injecting in-vehicle messages aperiodically. Identifying the source of an attack is essential for efficient forensic, isolation, security patch, etc. To fill these gaps, a method is presented for detecting and identifying compromised ECUs in a vehicle network.

Claims19

Dependent claims

A method for detecting a compromised electronic control unit (ECU) connected to a vehicle bus, comprising:

storing, by a monitor node, a plurality of learned fingerprints in a data store accessible to the monitor node, where each fingerprint in the plurality of learned fingerprints is derived from voltage measurements made during transmission of a message on the vehicle bus and uniquely identifies one of the ECUs connected to the vehicle bus;
measuring, by the monitor node, voltage on the vehicle bus during transmission of a message on the vehicle bus by an ECU, where the voltage on the vehicle bus is measured at less than one million samples per second;
constructing, by the monitor node, an unknown fingerprint from the plurality of voltage measurements made during the transmission of the message, where the unknown fingerprint is indicative of statistical dispersion of the voltage measurements;
and
comparing, by the monitor node, the unknown fingerprint to the plurality of learned fingerprints and thereby detect a comprised ECU.

2 more elements

A method for detecting a compromised electronic control unit (ECU) connected to a vehicle bus formed by two wires, comprising:

storing, by a monitor node, a plurality of learned fingerprints in a data store accessible to the monitor node, where each fingerprint in the plurality of learned fingerprints is derived from voltage measurements made during transmission of a message on the vehicle bus by an ECU and uniquely identifies one of the ECUs connected to the vehicle bus;
measuring, by the monitor node, voltage on the vehicle bus during transmission of a message on the vehicle bus, thereby yielding a plurality of voltage measurements;
discarding a subset of the plurality of voltage measurements, where the voltage measurements in the subset correspond to an acknowledgement of the message;
constructing, by the monitor node, an unknown fingerprint from remaining voltage measurements in the plurality of voltage measurements, where the unknown fingerprint is indicative of statistical dispersion of the voltage measurements;
and
comparing, by the monitor node, the unknown fingerprint to the plurality of learned fingerprints and thereby detecting a comprised ECU.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/316,452Filed 13 Jan 2017
Priority: 15 Jul 2016
Published: 8 Aug 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 12/40
Characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]: bus networks
H04L 12/40169
Bus networks: flexible bus arrangements
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection

Family

Application62/362,627Us provisional application · filed 15 Jul 2016
US 11,108,789 B2Related patent
US 2019/0245872 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key