Method and computing unit for detecting an unauthorized physical access of a bus system

A method for identifying unauthorized physical access to a bus system, in which data are transmitted in message frames according to a bus specification as a voltage signal on bus lines, wherein bus participants are configured to generate the voltage signal on the bus lines from a transmission signal from a bus protocol controller and to determine a reception signal for the bus protocol controller from the voltage signal on the bus lines, the method comprising the following steps:

• detecting the voltage signal on the bus lines;
• determining a sampling period based on at least one signal received or output by the bus protocol controller;
• forming a sampling pattern based on the detected voltage signal, wherein it is evaluated, at sampling time points within the sampling period, whether or not the detected voltage signal is above a specific threshold voltage;
• comparing the sampling pattern with at least one reference pattern;
• and
• determining that possible unauthorized physical access is present when it is determined during the comparison that the sampling pattern does not match the at least one reference pattern or does not match it within a tolerance.

A computing unit connected or connectable to a bus system and configured to identify unauthorized physical access to a bus system, in which data are transmitted in message frames according to a bus specification as a voltage signal on bus lines, wherein bus participants are configured to generate the voltage signal on the bus lines from a transmission signal from a bus protocol controller and to determine a reception signal for the bus protocol controller from the voltage signal on the bus lines, the computing unit configured to perform the following steps:

• detecting the voltage signal on the bus lines;
• determining a sampling period based on at least one signal received or output by the bus protocol controller;
• forming a sampling pattern based on the detected voltage signal, wherein it is evaluated, at sampling time points within the sampling period, whether or not the detected voltage signal is above a specific threshold voltage;
• comparing the sampling pattern with at least one reference pattern;
• and
• determining that possible unauthorized physical access is present when it is determined during the comparison that the sampling pattern does not match the at least one reference pattern or does not match it within a tolerance.