# US 2019/0379683 A1 · Virtualized intrusion detection and prevention in autonomous vehicles

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0379683 A1
- Document ID: US20190379683A1
- Status: Published application
- Kind: A1
- Application number: 16/435,364
- Filed: 2019-06-07
- Published: 2019-12-12
- Earliest claimed: 2018-06-08
- Assignees: NVIDIA Corporation
- Applicants: NVIDIA Corporation
- Inventors: MARK OVERBY; Rick Dingle; Nicola Di Miscio; Varadharajan Kannan; Yong Zhang; Francesco Saracino
- Web page: https://patentgrep.com/patent/US20190379683A1

## CPC

- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 9/45533: {Hypervisors; Virtual machine monitors}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 13/4068: {Electrical coupling}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/606: {by securing the transmission between two devices or processes}
- G06N 3/045: Combinations of networks
- G06N 3/063: using electronic means
- G06N 3/08: Learning methods
- G06N 20/00: Machine learning
- H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3247: {involving digital signatures}
- H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model}
- H04L 12/40: Bus networks
- H04L 12/40013: {Details regarding a bus controller}
- H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)}
- H04L 47/24: Traffic characterised by specific attributes, e.g. priority or QoS
- H04L 61/2585: through application level gateway [ALG]
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/30: Profiles
- H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching
- H04L 67/61: taking into account QoS or priority requirements
- H04W 4/40: for vehicles, e.g. vehicle-to-pedestrians [V2P]
- H04W 4/48: for in-vehicle communication
- H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
- H04W 12/122: Counter-measures against attacks; Protection against rogue devices
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 61/2514: between local and global IP addresses
- H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
- H04L 63/1458: {Denial of Service}
- H04L 63/166: {at the transport layer}
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L 2012/40215: {Controller Area Network CAN}
- H04L 2012/40273: {the transportation system being a vehicle}
- H04L 2209/76: Proxy, i.e. using intermediary entity to perform cryptographic operations
- H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
- H04L 2209/84: Vehicles
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Various approaches are disclosed to virtualizing intrusion detection and prevention. Disclosed approaches provide for an embedded system having a hypervisor that provides a virtualized environment supporting any number of guest OSes. The virtualized environment may include a security engine on an internal communication channel between the guest OS and a virtualized hardware interface (e.g., an Ethernet or CAN interface) to analyze network traffic to protect the guest OS from other guest OSes or other network components, and to protect those network components from the guest OS. The security engine may be on a different partition than the guest OS and the virtualized hardware interface providing the components with isolated execution environments that protect against malicious code execution. Each guest OS may have its own security engine customized for the guest OS to account for what is typical or expected traffic for the guest OS.

## Claims

### Claim 1

An embedded system comprising:
a hypervisor that supports virtualized components with isolated execution environments on partitions of a virtualized environment;
a first communication channel of the virtualized environment that provides a guest operating system (OS) on a first of the partitions with connectivity through a network interface of the virtualized environment to at least one electronic control unit (ECU), the ECU being a component of a vehicle, and further being communicatively coupled to one or more other components in the vehicle via a vehicle data bus external to the virtualized environment;
a communications manager on a second of the partitions that provides the guest OS with connectivity to an Internet Protocol (IP) network, the communications manager comprising a virtualized hardware interface of the virtualized environment to a network channel of the vehicle;
a second communication channel of the virtualized environment that provides the guest OS with connectivity to the network communication channel of the vehicle through the virtualized hardware interface; and
a security engine that monitors communications on the second communication channel between the guest OS and the virtualized hardware interface for security events and executes a security response upon determining a security event from the communications.

### Claim 2 (depends on 1)

The embedded system of claim 1, wherein the vehicle data bus is a Controller Area Network (CAN) bus and the network communication channel is an Ethernet communication channel.

### Claim 3 (depends on 1)

The embedded system of claim 1, wherein the security engine is on a third of the partitions.

### Claim 4 (depends on 1)

The embedded system of claim 1, wherein the virtualized hardware interface is a first virtualized hardware interface and the network interface is a second virtualized hardware interface that is on a separate partition from the first virtualized hardware interface.

### Claim 5 (depends on 1)

The embedded system of claim 1, wherein the security engine is positioned above the guest OS in a chain of trust of a certificate chain.

### Claim 6 (depends on 1)

The embedded system of claim 1, wherein the communications manager comprises a para-virtualized driver that is used by the guest OS to communicate to the network communication channel.

### Claim 7 (depends on 1)

The embedded system of claim 1, wherein the determining of the security event comprises performing anomaly detection on the communications based at least in part on historical communications transmitted over the second communication channel.

### Claim 8 (depends on 1)

The embedded system of claim 1, wherein the communications manager comprises a reverse cone network address translation (NAT) gateway.

### Claim 9 (depends on 1)

The embedded system of claim 1, wherein the security response includes limiting bandwidth allocated to the communication channel using Quality of Service (QoS) parameters.

### Claim 10

An embedded system comprising:
a hypervisor that supports virtualized components with isolated execution environments on partitions of a virtualized environment;
a first communication channel of the virtualized environment that provides a first guest operating system (OS) on a first of the partitions with connectivity through a network interface of the virtualized environment to a vehicle data bus external to the virtualized environment;
a second communication channel of the virtualized environment that provides a second guest OS on a second of the partitions with connectivity to the first guest OS over an Internet Protocol (IP) network; and
a security engine of the second communication channel on a third of the partitions that monitors communications between the first guest OS and the second guest OS for security events and executes a security response upon determining a security event from the communications.

### Claim 11 (depends on 10)

The embedded system of claim 10, wherein the network interface is a virtualized hardware interface on a fourth partition of the partitions.

### Claim 12 (depends on 10)

The embedded system of claim 10, wherein the network interface comprises a virtual router that connects the first communication channel to the second communication channel.

### Claim 13 (depends on 10)

The embedded system of claim 10, wherein a different security engine monitors communications over the first communication channel between the first guest OS and the second guest OS for security events and executes a different security response upon determining a security incident from the communications.

### Claim 14 (depends on 10)

The embedded system of claim 10, further comprising a communications manager of the virtualized components on a fourth of the partitions that includes para-virtualized drivers that are used by the first guest OS and the second guest OS to exchange the communications.

### Claim 15

A method comprising:
receiving, by a security engine of a virtualized environment, a communication over a first communication channel to a guest operating system (OS) of the virtualized environment, the virtualized environment providing communication channels to respective guest OSes of the virtualized environment over a shared connection to a network interface external to the virtualized environment;
analyzing the communication to determine a security event over the first communication channel;
based at least in part on the determining the security event, determining quality of service (QoS) parameters to limit network resources available to the first communication channel relative to others of the communication channels; and
applying the QoS parameters to the communication channel.

### Claim 16 (depends on 15)

The method of claim 15, wherein the applying of the QoS parameters to the first communication channel includes computing a delay for a message over the first communication channel based on the QoS parameters.

### Claim 17 (depends on 15)

The method of claim 15, wherein the QoS parameters limit network resources available to the first communication channel by reducing bandwidth allocated to the first communication channel.

### Claim 18 (depends on 15)

The method of claim 15, further comprising, based at least in part on the determining the security event, activating a QoS handler to apply the QoS parameters to the first communication channel.

### Claim 19 (depends on 15)

The method of claim 15, wherein the security event corresponds to a Denial-of-Service (DoS) attack over the first communication channel.

### Claim 20 (depends on 15)

The method of claim 15, further comprising deactivating a QoS handler used to apply the QoS parameters to the first communication channel based at least in part on determining an end to the security event.