A device for detection and prevention of an attack on a vehicle.

(54) Title: DEVICE FOR DETECTION AND PREVENTION OF ATTACK IN VEHICLE. (54) Title: A DEVICE FOR DETECTION AND PREVENTION OF AN ATTACK ON A VEHICLE.

(57) Summary

A new device for detection and prevention of an attack on a vehicle through its communication channels, which has: an input unit configured to collect data in real time and / or offline from various sources such as sensors, services to network base, navigation applications, electronic vehicle control units, common vehicle driver networks, vehicle subsystems, and on-board diagnostics; a database, to store the data; a detection unit in communication with the input unit; and an action unit, in communication with the detection unit, configured to send an alert through the communication channels and / or prevent the attack, by breaking or changing the attacked communication channels. The detection unit is configured to simultaneously monitor content, metadata, and physical data in the data and detect the attack.

(57) Abstract

A new device for detection and prevention of an attack on a vehicle via its communication channels, having: an inputunit configured to collect real-time and / or offline data from various sources such as sensors, network based Services, navigation applications, the vehicles electronic control units, the vehicle's bus-networks, the vehicle's subsystems, and on board diagnostics; a database, for storing the data; a detection-unit in communication with the input-unit; and an actionunit, in communication with the detection unit, configured for sending an alert via the communication channels and / or prevent the attack, by breaking or changing the attacked communication channels. The detection-unit is configured to simultaneously monitor the content, the meta-data and the physical-data of the data and detect the attack.

IMPI ί

PATENT TITLE No. 356554

Headlines):

Home:

Denomination:

Classification:

TOWERSEC LTD

Hamada 6, 4673340, Herzliya, ISRAEL

DEVICE FOR DETECTION AND PREVENTION OF ATAOUE IN VEHICLE.

CIP: B60R16 / 023; G06F11 / 00; G06N99 / 00; H04L29 / 06

CPC: B60R16 / 623; B6§Rféíp231; \ G06N99 / 005; H04L63 / 1408; H04L63 / 1441;

H04L63 / 146 »; H04L67 / 12 'i'>

EISGLÁSS

Inventor (s): GUY RUVtQ; SAAR DICKMAN; YLÜtíMpW^AND

Number:

MX / a / 2015/004828

<img file="MX356554B_D0001.tif" />

International:

2013

Country:

US

Validity: Veinfe years

Venortmientibr 1 &lt;de-oCtbbré''Be 2033 Issue Date: June 4, 2018? 'v vi: · &lt;Λν V, I ···,' ·: dj *. · '· Τ? 'ΐ V ί i •, ·' '' i · '. \ V \

The reference patent is-Afraa based on the attiSilosí e

In accordance with the arttaib from the date of filing

<img file="MX356554B_D0002.tif" />

Who subscribes to this title is (Official Gazette of the Federation! ® ^

01/25/2006, 06/05 / 2009,06 / 01/2010,. ^ 6 ^ WpA / 06gw; .._ Regulations of the Mexican Institute iWÉfstnal articles 1, 3, 4, 5, section V subsection a ),

12/27/1999, amended on 10/10/2002, 07/29:

Deputy Generals, Coordinator, Departmental Directors and other subordinates of the Institute Me: 08/04/2004 and 09/13/2007). 'V

Number:

61/705,426

y.5 # tfetóTVey &lt;le la F * ropfe &lt;fee! Industrial⁵ // wia.vigéngtáde vei I irílfesJíWrec y 7 »bis Z dfe la Le»

1897, 13*05/1999,

SW enforceable, counted to dates.

Industrial Property Law 01/26/2004, 06/16/2005, ViDOao a), 4th and 12th fractions I and III of * 1007/2004, 07/28/2004 and 09/07/2007); ino of Industrial Property (DOF that delegates powers to the Divisional Deputy Directors, Coordinators 12/15/1999, amended on 02/04/2000, 07/29/2004,

The present document is signed advanced electronic signature (FIEL), based on articles 7 BIS 2 of the Industrial Property Law; 3 of its Regulations, and 1 section III, 2 section ^ /., 26 BIS and 26 TER of the Agreement establishing the guidelines for the use of the Electronic Payment and Services Portal (PASE) of the Mexican Institute of Industrial Property , in the procedures indicated.

<img file="MX356554B_D0003.tif" />

DIVISIONAL DIRECTOR OF PATENTS NAHANNY CANAL REYES

Original string:

NAHANNY MARISOL CANAL REYES | 00001000000403252793 | Tax Administration Service | 1695 || MX / 2018/46266 | MX / a / 2015/004828] Patent title PCT | 1027 | RGZ | Pág (s) | 4XWVzODF8dAFAtqCinx56DFzjUM =

Digital stamp:

ZQMohHF85pK4EvlOfMjFqVyWvPOC3FXIhjL1QjOMQJLdB7caPmY / YP6IIAtvODV4JOcn + COBEvWbN4C6dPeUhazeMJ lu8lwaN4YOA09K1DlpncxirvPlttNH7r1X3M8M96Q / YXuMPZ7pBLXDbEqKvt6e¡SQHoLczlggVDIsK8z64hls + Zerg

A4aHDXKzR44EBaoVslNB622VsSvsWddtkW5pd6Bw3EewBXP4bSpmk7LCdyAIQZ4u13zFzRkxWQh7Tp7TmtS3t + 3Zg1

B83qSK30nLXzlc1WJ + PFf6 + tl0NWYXJ0NXODnGfm + jW2OrxhZw + B3soS8MhWWfKA¡ITpXUFw ==

Arenal No 550. Piso 1, Pueblo Santa María Tepepan, Xoehímilco, 16020, Mexico City.

(55) 53340700 www.gob.rnx / impi

<img file="MX356554B_D0004.tif" />

MX / 2018/46266

(I saw Γ I

INSTITUTO MEXICAN './ ¿\ + I'E LA PROPIEI' AD

DEVICE FOR DETECTION AND PREVENTION OF ATTACK H »P^orVHHICTtYes-ⁱ'·’

FIELD OF THE INVENTION

This invention generally relates to a device that allows detection of an attack such as a cyber attack or vehicle communication attack.

BACKGROUND OF THE INVENTION

Modern automobiles are no longer just mechanical devices; They are penetratively monitored and controlled by dozens of digital computers coordinated through internal vehicle networks. Although this transformation has fueled further advances in efficiency and safety, it has also introduced a range of new potential risks.

Because many of today's cars contain cellular connections and Bluetooth wireless technology, it is possible for a hacker, working from a remote location, to take control of various features, such as car locks and brakes, as well as dragging the location of the vehicle, spy on your cabin and steal vehicle data. Modern automobiles are penetratingly computerized, and therefore potentially vulnerable to such an attack. However, although previous research has shown that the internal networks inside some modern cars are insecure, the threat model

Ref. 256117

<img file="MX356554B_D0005.tif" />

\»

<img file="MX356554B_D0006.tif" />

INSTITUTO MEZICANS DE LA TROPIEZA »

INDUSTRIAL partner requiring prior physical access has been justifiably observed as unrealistic. Exploitation is feasible through a wide variety of remote attack vectors or physical connections, including mechanical diagnostic tools and CD, Bluetooth, cellular and radio players; In addition, wireless communication channels allow vehicle control and communication over long and short distances, location tracking, ex-filtration and theft of audio in the cabin.

Various solutions in the prior art were described, including:

Chutorash, US 6,314,351, described a vehicle computer system that provides a firewall between a car PC and its application software and the common vehicle driver and vehicle components.

Firewall prevents unauthorized software access on the car PC to the common vehicle driver and vehicle components. Preferably, the firewall uses cryptographic encryption technology within the salute between the auto PC software and firewalls.

Dierickx, US 8,402,268, described a system for providing network security in a vehicle information system and methods for manufacturing and using it. The security system comprises an all-in-one security system that facilitates security system functions for the λ J.VA r 1

MEXICAN INSTITUTE ΛΛ

l. £ l&gt; .ROFIEOAD 'íS .-. y ^ jFY ·¹

INDUSTRIAL vehicle information system. Illustrative security system functions include secure storage of keys used to cryptographically encrypt and / or decode system data, security related application programming interfaces, a security log file, and / or private data. The security system can similarly use antivirus software, anti-spyware software, an application firewall, and / or a network firewall. As desired, the security system may include an intrusion prevention system and / or an intrusion detection system. If the information system includes a wireless distribution system, the security system may include an intrusion prevention (and / or detection) system that is suitable for use with wireless network systems. Thereby, the security system can advantageously provide a defense in depth approach by adding multiple layers of security to the information system.

Melman, US 7,917,261, described a method of controlling a control system for a vehicle comprising: providing at least one common data communications driver; to provide at least one firewall in communication with at least one common data communications conductor, wherein at least one firewall is creating at least two common communication communications conductors.

r.

INSTITIJ TCMUiCANO V.,

D ¿LA VKC-í'ISCal) data from the at least one common driver of data data; provide at least one virtual device Hn "·" communication with at least one of at least two common data communication conductors; providing at least one vehicle device in communication with at least one firewall; and providing at least one controller with firewalls transmits a policy to the firewalls and the firewall transmits the policy through the at least two common data communications conductors that controls at least one vehicle device.

However, nothing in the prior art describes or utilizes the unique characteristics of operating logic and potential vehicle attack vectors.

SUMMARY OF THE INVENTION

It is an object of the present invention to describe a device for detection and prevention of at least one attack in a vehicle through its one or more communication channels, the device comprises:

to. an input unit configured to collect real-time and / or offline data from at least one source selected from a group consisting of:

one or more sensors, one or more network-based services, one or more navigation applications or navigation devices,

Τ, // ”7 Τ ΐνι and ι.

MEXICAN INSTITUTE&gt;

OH THE PROPERTY * INOU5TRJAL one or more vehicle electronic control units (ECUs), one or more common vehicle driver networks, one or more vehicle subsystems, and one or more on-board diagnostics (OBDs) , for its acronym in English);

<img file="MX356554B_D0007.tif" />

b. a database, configured to store the data;

c. a detection unit in communication with the input unit; and

d. an action unit, in communication with the detection unit, configured to send an alert through the communication channels and / or prevent the attack, by breaking or changing the attack of one or more communication channels;

wherein the detection unit is configured to simultaneously monitor content, metadata, and physical data in the data and detect the attack.

It is another objective of the present invention to describe the device as defined above, wherein the detection unit configured to detect the attack based on at least one characteristic selected from a group consisting of:

to. irregular data content;

b. irregular source of data;

<img file="MX356554B_D0008.tif" />

ΓΝ3ΤΙΓ !! , 'G Á - -'Al · ·' IL »t ¿.A: '/ ·' &lt;

<img file="MX356554B_D0009.tif" />

c. regular destination for data;

d. irrational data content, when compared to data received by at least one other source;

and. irrational action of at least one of subsystems, when compared with data received by at least one other subsystem, f. irrational action between at least two of the subsystems;

g. irrational action of at least one of the subsystems, when compared with the data received by at least one of the sensors;

h. irrational metadata;

i. irrational meta-content;

j. binding or blocking of communication channels and network-based services; and

k. sudden change in signal characteristics of network-based services and / or sensors.

It is another objective of the present invention to describe the device as defined above, wherein the database further comprises parameters of at least one known attack, previously detected as the attack.

It is another objective of the present invention to describe the device as defined above, wherein the action unit and / or the detection unit are further configured to extract the parameters of the attack and

<img file="MX356554B_D0010.tif" />

<img file="MX356554B_D0011.tif" />

update the database.

It is another objective of the present invention to describe the device as defined above, wherein the device further comprises an identification unit configured to identify the parameters of the known attack and update the unit of action.

It is another objective of the present invention to describe the device as defined above, wherein the device further comprises a remote server configured to communicate with the database to deliver and / or receive at least one of the additional parameters of the known attack.

It is another objective of the present invention to describe the device as defined above, wherein the remote server configured to collect data from at least one additional vehicle, monitor the content, metadata, and physical data of the data, detect the attack, and update attack for database.

It is another objective of the present invention to describe the device as defined above, where the parameters are selected from a group consisting of:

to. irregular data content;

b. irregular source of data;

c. regular destination for data;

d. irrational data content, when

compares with data received by at least one other^or'ftiiéftM «/&gt; AO | HZ) u J i r.IAL irrational action of at least one of the subsystems, when compared with data received by at least one other subsystem;

F. irrational action between at least two of the subsystems, 9 · subsystems, minus one of

h.

i.

j · communication

k.

signal of the

l.

m.

n.

or.

Pqr.

It is irrational action of at least one of those when compared with the data received by the sensors;

irrational metadata;

irrational meta-content;

binding or blocking of channels and network-based services; and sudden change in the characteristics of network-based services and / or sensors;

the location of the vehicle;

the make of vehicle;

the sensors;

communication channels;

the navigation application the navigation device; and communication interfaces.

Another objective of the present invention is to describe the device as defined above, wherein the detection unit comprises a learning processor ιπ: ι »ι» · i - (γ'-ι '~; / »&lt;&lt;. · and machine configured to learn the faces.^lc^JVeraIstib® ^ _- and-data content behavior, mptaHat-ng and H-at-nn., - ™ ~. physical and recognize any unfamiliar behavior.

It is another objective of the present invention to describe the device as defined above, wherein the device further comprises a display unit configured to notify and alert a user of the attack.

It is another objective of the present invention to describe the device as defined above, wherein the device is in communication with a remote display unit configured to notify and alert a user of the attack.

It is another objective of the present invention to describe the device as defined above, wherein the one or more sensors are selected from a group consisting of

<td>to.</td><td>sensor</td><td>of</td><td>distance,</td>

<td>b.</td><td>sensor</td><td>of</td><td>speed,</td>

<td>c.</td><td>sensor</td><td>of</td><td>temperature,</td>

<td>d.</td><td>sensor</td><td>of</td><td>satellite transmission,</td>

and. cellular transmission sensors,

F. video image,

g. fuel-air ratio meter,

h. blind spot monitor,

i. Crankshaft position sensor,

j. sidewalk edge detector, used for

<img file="MX356554B_D0012.tif" />

<img file="MX356554B_D0013.tif" />

I warn the driver of curb edges,

k. defect detector, used · railways to detect axle and signal problems in passing trains

l. engine coolant temperature sensor (ECT), used to measure engine temperature,

m. hall effect sensor, used to time the speed of wheels and axles,

n. manifold absolute pressure (MAP) sensor, used when regulating fuel metering,

or. mass flow sensor, or mass air flow sensor (MAF), used to tell the mass of air entering the engine,

p. oxygen sensor used to monitor the amount of oxygen in the exhaust,

q. parking sensors, used to alert the driver to unseen obstacles during parking maneuvers,

r. radar gun, used to detect the speed of other objects,

s. speedometer, used to measure the instantaneous speed of a land vehicle,

t. speed sensor, used to detect ujn · »'». K'a.it sj

<img file="MX356554B_D0014.tif" />

MPÍ iwrmno mexican nor · LA ΡΚΓ'ΠΡΙΆΏ IMP'UStRJAt the speed of an object,

or. throttle position sensor ^ used to monitor the throttle position in an internal combustion engine,

v. tire pressure monitoring sensor, used to monitor the air pressure inside the tires,

w. torsion sensor, or torsion transducer, or torque and torsion (torsion force) gauge on a rotating system

x. transmission fluid temperature sensor, used to measure the temperature of the transmission fluid,

and. turbine speed sensor (TSS), or input speed sensor (ISS), used to measure the speed of rotation of the input shaft or torque converter,

z. variable reluctance sensor, used to measure position and speed of moving metal components, aa. vehicle speed sensor (VSS), used to measure vehicle speed, bb. water sensor or water in fuel sensor, used to indicate the presence of water in fuel,

IMPI

MEXICAN INSTITUTE;

OF INDUSTRIAL PROPERTY cc. tire speed sensor, used for

<img file="MX356554B_D0015.tif" />

read the speed of a vehicle's tire rotation, dd. comfort sensors including: seat position, seat heat, air condition, and passenger location, and usa any combination thereof.

It is another objective of the present invention to describe the device as defined above, wherein the one or more subsystems are selected from a group consisting of:

<td></td><td></td><td>to.</td><td colspan="3">tire pressure monitoring,</td><td></td>

<td></td><td></td><td>b.</td><td>control</td><td>stability,</td><td></td><td></td>

<td></td><td></td><td>c.</td><td>control</td><td>cruising,</td><td></td><td></td>

<td></td><td></td><td>d.</td><td>control</td><td>air bag,</td><td></td><td></td>

<td></td><td></td><td>and.</td><td>module</td><td>train control</td><td>motor (PCM, for</td><td>their</td>

<td>acronym</td><td>in</td><td colspan="2">English),</td><td></td><td></td><td></td>

<td></td><td></td><td>F.</td><td>module</td><td colspan="2">transmission control (TSM, for</td><td>their</td>

<td>acronym</td><td>in</td><td colspan="2">English),</td><td></td><td></td><td></td>

<td></td><td></td><td>g</td><td>module</td><td colspan="2">brake control (BCM, for</td><td>their</td>

<td>acronym</td><td>in</td><td colspan="2">English),</td><td></td><td></td><td></td>

<td></td><td></td><td>h.</td><td>module</td><td>central control</td><td>(CCM, for short</td><td>in</td>

<td>English)</td><td> /</td><td></td><td></td><td></td><td></td><td></td>

<td></td><td></td><td>i.</td><td>module</td><td>timing</td><td>central (CTM,</td><td>by</td>

<td>acronym</td><td>in</td><td colspan="2">English),</td><td></td><td></td><td></td>

<td></td><td></td><td>j</td><td>module</td><td>general electronic</td><td>(GEM, for short</td><td>in</td>

English) κ τΙΔ

... ινχ τ ι

<td>acronym</td><td>in</td><td>k. english</td><td>module is) ,</td><td>of</td><td>, ΙΝίΤΙϊυΐΟo body control</td><td></td>

<td></td><td></td><td> 1.</td><td>module</td><td>of</td><td>suspension control (SCM,</td><td>by</td>

<td>acronym</td><td>in</td><td colspan="2">English),</td><td></td><td></td><td></td>

<td></td><td></td><td>m.</td><td>Unit</td><td>of</td><td>convenience control (CCU,</td><td>by</td>

<td colspan="3">its initials in</td><td>English)</td><td>z</td><td></td><td></td>

<td></td><td></td><td>n.</td><td>Unit</td><td>of</td><td>convenience control,</td><td></td>

<td></td><td></td><td>or.</td><td>Unit</td><td>of</td><td>convenience control,</td><td></td>

<td></td><td></td><td>P-</td><td>Unit</td><td>of</td><td>motor control.</td><td></td>

<td></td><td></td><td>what-</td><td>Unit</td><td>of</td><td colspan="2">power direction control</td>

<td colspan="2">electrical</td><td colspan="2">(PSCU, for</td><td>their</td><td>acronym in English),</td><td></td>

<td></td><td></td><td>r.</td><td colspan="2">Interface</td><td>human-machine (HMI, for</td><td>their</td>

<td>acronym</td><td>in</td><td colspan="2">English),</td><td></td><td></td><td></td>

<td></td><td></td><td>s.</td><td>Unit</td><td>of</td><td>seat control,</td><td></td>

<td></td><td></td><td>t.</td><td>Unit</td><td>of</td><td>speed control,</td><td></td>

<td></td><td></td><td>or.</td><td>Unit</td><td>of</td><td>telephone control (TCU, for</td><td>their</td>

<td>acronym</td><td>in</td><td colspan="2">English),</td><td></td><td></td><td></td>

<td></td><td></td><td>v.</td><td>Unit</td><td>of</td><td>transmission control (TCU, for</td><td>their</td>

<td>acronym</td><td>in</td><td colspan="2">English),</td><td></td><td></td><td></td>

<td></td><td></td><td>w.</td><td>module</td><td>of</td><td>brake control (ABS or ESC),</td><td></td>

<td></td><td></td><td>x.</td><td colspan="3">shock sensors,</td><td></td>

<td></td><td></td><td>and-</td><td>bags</td><td>of</td><td>air,</td><td></td>

<td></td><td></td><td>z.</td><td colspan="2">belts</td><td>: of security,</td><td></td>

<td></td><td></td><td>aa.</td><td colspan="4">tire pressure monitoring systems</td>

<td>(TPMS,</td><td colspan="2">for their</td><td>: acronyms</td><td>in</td><td>English),</td><td></td>

bb. stabilization control system

<img file="MX356554B_D0016.tif" />

(ESC), cc. traction control system (TCS), dd. anti-lock braking system (ABS), usa Electronic Brake Assist System (EBA) ff. electronic force distribution, gg. electronic brake force distribution system (EBD) hh. emergency closure, ii. notifications and alerts handled, jj. pedestrian object recognition, kk. lane assist,

eleven. shock evasion, mm. Adaptive Headlight Control, nos. reverse backup sensors, oo. adaptive cruise control, pp. active cruise control (ACC) qq rr ss traction control systems, electronic stability control automated parking system, tt multimedia ϊ

<img file="MX356554B_D0017.tif" />

zr 'uu. active noise cancellation ^ sus ^ l'M'JÜ RiAi.

acronym in English),

w. radio, ww. radio data system (RDS), xx. driver information functions, yy. AM / FM or satellite radio, zz. CD / DVD player, aaa. payment systems, bbb. Wi-Fi router in vehicle, ccc. internal lights, ddd. climate control, eee. chairs adjustment, fff. electric windows,

999 · mirror adjustment, hhh. central block, iii. battery management, jjj. cargo handling, kkk. vehicle network system,

111. active cruise control, mmm. remote control keys, nnn. theft deterrent systems, ooo. immobilizer system, dpi. security system, qqq. digital cameras, .I

Λ 'JS

<img file="MX356554B_D0018.tif" />

rrr. night vision, sss. lasers, ttt. radar, uuu. RF sensors, vw. informative entertainment system and www. robotic gear tree.

It is another objective of the present invention to describe the device as defined above, where the ECU is selected from a group consisting of:

<td>to.</td><td>module</td><td>of</td><td>electronic / motor control (ECM,</td>

<td>its initials</td><td colspan="2">in English)</td><td> 1 ?</td>

<td>b.</td><td>module</td><td>of</td><td>powertrain control,</td>

<td>c.</td><td>module</td><td>of</td><td>transmission control,</td>

<td>d.</td><td>module</td><td>of</td><td>brake control,</td>

<td>and.</td><td>module</td><td>of</td><td>central control,</td>

<td>F.</td><td>module</td><td>of</td><td>central timing,</td>

<td>g.</td><td>module</td><td>of</td><td>general electronic,</td>

<td>h.</td><td>module</td><td>of</td><td>body control,</td>

<td>i.</td><td>module</td><td>of</td><td>suspension control,</td>

<td>j</td><td>Unit</td><td>of</td><td>airbag control (ACU, for</td>

<td>acronyms in</td><td>English)</td><td> /</td><td></td>

<td>k.</td><td>module</td><td>of</td><td>body control (BCU, for its</td>

acronym in English), control door locks, power windows, and courtesy lights,

one. convenience control unit,

ΙΜΐ'ϊΟΒ ^

ΙΗ3Τ1Τ1 'ΤΟ MEXICAN

m. door control unit fSótí'jjsTRijaor ^ SlSSu ^³^ acronym in English), _-_;--—— -—

n. motor control unit,

or. electric power steering control unit, integrated into the electric power steering power package (EPS),

p. human-machine interface,

<td rowspan="2"></td><td rowspan="2">q. r. s.</td><td rowspan="2">module Unit Unit</td><td rowspan="2">of of of</td><td rowspan="2">control control control</td><td colspan="4">powertrain, seat,</td>

<td colspan="2">speed (SCU,</td><td>by</td><td>their</td>

<td>acronym</td><td colspan="2">in English),</td><td></td><td></td><td></td><td></td><td></td><td></td>

<td></td><td>t.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>phone,</td><td></td><td></td>

<td></td><td>or.</td><td>Unit</td><td>of</td><td colspan="2">control</td><td>telematic (TCU,</td><td>by</td><td>their</td>

<td>acronym</td><td colspan="2">in English),</td><td></td><td></td><td></td><td></td><td></td><td></td>

<td></td><td>V.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>transmission,</td><td></td><td></td>

<td></td><td>w.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>Brake,</td><td></td><td></td>

<td></td><td>x.</td><td colspan="2">services</td><td>remote</td><td>of</td><td>ECU processing</td><td colspan="2">on board</td>

or integrated, and

and. any combination thereof.

It is another objective of the present invention to describe the device as defined above, wherein the action unit configured to initiate additional data collection from the at least one source.

It is another objective of the present invention to describe the device as defined above, where the

I 1st

INSTITUTO MÉXíCAN Ί

DE LA PROZIF.DAD {'device also includes a comdr'óiádiz antivirus'' application of malware, firewalls or other base — ele — data — malicious code, which may be provided by a third party.

<img file="MX356554B_D0019.tif" />

It is another object of the present invention to describe the device as defined above, wherein the vehicle is driven by a human, by an at least partially autonomous driving system, or by a remote control system or by complete autonomous driving system.

It is another objective of the present invention to describe the device as defined above, wherein the vehicle is a robotic platform.

It is another objective of the present invention to describe the device as defined, where the vehicle travels by land, water or air.

It is another object of the present invention to describe the device as defined above, wherein the device is at least partially embedded within one of the vehicle hardware cards, software units, and / or within the remote server.

It is another object of the present invention to describe the device as defined above, wherein the device further comprises an evaluation processor configured to assess risk level of attack on the vehicle and its passengers and prioritize attack.

I IVi

7-.

i ..?

ΒβΠΤυΤΟ MEXICANA 'f - / S », ·. ·': .... DELA PROPIECAi) '

It is another objective of the present invention^{&gt; u}^ 3e * cr * i «« t ^ⁱ'the device as defined above, -eyi deade- -e ·! · -one or more network-based services are selected from a group consisting of: web, physical cable, Wi-Fi, cellular, Bluetooth, RF, GPS, vehicle-to-vehicle communication, vehicle-to-passenger infrastructure, infrastructure-to-vehicle environment.

It is another objective of the present invention to describe the device as defined above, wherein the one or more applications or navigation device are selected from a group consisting of: satellite browser, cellular browser and dedicated inertia browser.

It is another object of the present invention to describe the device as defined above, wherein the one or more applications or navigation devices are the vehicle's own subsystem browser.

It is another objective of the present invention to describe a method for detecting and preventing at least one attack on a vehicle through its one or more communication channels, the method comprises steps of:

to. collect real-time and / or offline data from at least one source selected from a group consisting of:

one or more sensors, one or more network-based services, one or more navigation applications or devices

<img file="MX356554B_D0020.tif" />

<img file="MX356554B_D0021.tif" />

navigation devices, one or more vehicle Κ, ΟΏ, ί, ΩΩ control units, one or more common vehicle driver networks, one or more vehicle subsystems, and one or more on-board diagnostics, b. store the data in a database;

c. monitor data for an attack; and if the attack is detected,

d. act by sending an alert and / or preventing the attack by breaking or changing the one or more communication channels;

where monitoring includes simultaneous examination of the content, metadata and physical data of the data for detection of the attack.

It is another objective of the present invention to describe the method as defined above, wherein the detection of the attack based on at least one characteristic selected from a group consisting of:

to. irregular data content;

b. irregular source of data;

c. regular destination for data;

d. irrational data content, when compared to data received by at least one other source;

and. irrational action of at least one of the institutes «£ XIC ·· 'i,. ·; ···· with data recib - ^^ /, ^ c&gt; rj¿_al¿&gt; i · 'subsystems, when less subsystem is compared;

F. irrational action between at least two of the subsystems;

g. irrational action of at least one of the subsystems, when compared with the data received by at least one of the sensors;

h. irrational metadata;

i. irrational meta-content;

j. binding or blocking of communication channels and network-based services; and

k. sudden change in signal characteristics of network-based services and / or sensors.

<td></td><td colspan="4">It is another object of the present invention to describe</td>

<td>the method</td><td>how I know</td><td>previously defined,</td><td>where the step</td><td>of</td>

<td>to stock</td><td>also</td><td colspan="2">comprises storing the parameters of</td><td>to the</td>

<td>minus one</td><td>attack</td><td>previously known</td><td>detected as</td><td>the</td>

attack.

It is another objective of the present invention to describe the method as defined above, which further comprises the step of extracting the parameters.

It is another objective of the present invention to describe the method as defined above, which further comprises the step of identifying the parameters of the known attack and updating for the alert step.

<img file="MX356554B_D0022.tif" />

It is another objective of the present invention to describe the method as defined above, gne mnipranda ------ the step of communicating the database with a remote server that delivers and / or receives at least one additional of the parameters of the known attack.

It is another objective of the present invention to describe the method as defined above, wherein the remote server configured to collect data from at least one additional vehicle, monitor the content, metadata, and physical data of the data, detect the attack, and update the attack on the database.

It is another objective of the present invention to describe the method as defined above, where the parameters are selected from the group consisting of:

to. irregular data content;

b. irregular source of data;

c. regular destination for data;

d. irrational data content, when compared to data received by at least one other source;

and. irrational action of at least one of the subsystems, when compared to data received by at least one other subsystem;

F. irrational action between at least two of the subsystems;

one. irrational action of at least one of the

1 * 1. .ί. . ', ·; *4

1N5TJTUT, '. · &lt;- / 7 --./- 0 ce la ¿r. i '; -., »?

'~ í.

subsystems, when compared to the data received '¹¹ po'T'-Yes ^ · minus one of the sensors; -^K~ - ”—— ~~ m. irrational metadata;

n. irrational meta-content;

g. binding or blocking of communication channels and network-based services; and

h. sudden change in signal characteristics of network-based services and / or sensors;

i. the location of the vehicle;

j. the make of vehicle;

k. the sensors;

l. communication channels;

m. the navigation application

n. the navigation device; and

or. communication interfaces.

It is another objective of the present invention to describe the method as defined above, wherein the detection step further includes learning the characteristics and behavior of the data, metadata and physical data content and recognizing any unfamiliar behavior.

It is another objective of the present invention to describe the method as defined above, which further comprises the step of presenting the alert to notify and alert a user of the attack.

It is another object of the present invention to describe

IMPI

INSTITUTO MEXICA. '».')

to.

b.

c.

d.

and.

F.

g

h.

i.

j

DE LA LL JT-lLDAO 'Á the method as defined above, in don¿fé^oops^ Í^L uneMo 'more sensors are selected from a group with:' ¹ distance sensor, speed sensor, temperature sensor, satellite transmission sensor, cell transmission sensors, video image, air-fuel ratio meter, blind spot monitor, crankshaft position sensor, edge detector sidewalk, used to warn the driver of curb edges,

k. defect detector, used in railways to detect axle and signal problems in passing trains

l. engine coolant temperature sensor, used to measure engine temperature,

m. hall effect sensor, used to time the speed of wheels and axles,

n. manifold absolute pressure sensor, used when regulating fuel metering,

or. mass flow sensor, or mass air flow sensor, used to tell the mass of air entering the engine,

<img file="MX356554B_D0023.tif" />

p. oxygen sensor used for móñiUtffea *) amount of oxygen in the exhaust, q. parking sensors, used to alert the driver to unseen obstacles during parking maneuvers,

r. radar gun, used to detect the speed of other objects,

s. speedometer, used to measure the instantaneous speed of a land vehicle,

t. speed sensor, used to detect the speed of an object,

or. throttle position sensor, used to monitor the throttle position in an internal combustion engine,

v. tire pressure monitoring sensor, used to monitor the air pressure inside the tires,

w. torsion sensor, or torsion transducer, or torque and torsion (torsion force) gauge on a rotating system

x. transmission fluid temperature sensor, used to measure the temperature of the transmission fluid,

and. turbine speed sensor, or input speed sensor, used to measure the speed of ΐ Λ V ζΤ · ί / '..Λ&gt; 1, Τ. · FNSTtT'l ', ·&gt;'. · '&lt;·. ·. ·, · - ·· V \ --- rotation of the input shaft or tomsíiony converter. '•' i.

zb

2. variable reluctance sensor -, - ut ί 1 i 7.ad.Q ,, pa.ra ~, measure position and speed of moving metal components, aa. vehicle speed sensor, used to measure vehicle speed, bb. water sensor or water in fuel sensor, used to indicate the presence of water in fuel, cc. tire speed sensor, used to read the speed of a vehicle's tire rotation, dd. comfort sensors including: seat position, seat heat, air condition, and passenger location, and usa any combination thereof.

It is another objective of the present invention to describe the device as defined above, wherein the one or more subsystems are selected from a group consisting of:

<td>to.</td><td>monitor</td><td>of</td><td>Pressure</td><td>. of</td><td>ι tire,</td>

<td>b.</td><td>control</td><td>of</td><td colspan="3">stability,</td>

<td>c.</td><td>control</td><td>of</td><td>cruise</td><td>¹,</td><td></td>

<td>d.</td><td>control</td><td>of</td><td colspan="3">airbag,</td>

<td>and.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>Powertrain,</td>

<td>F.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>transmission,</td>

<td>g.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>Brake,</td>

<td>h.</td><td>module</td><td>of</td><td>control</td><td colspan="2">central,</td>

<img file="MX356554B_D0024.tif" />

<img file="MX356554B_D0025.tif" />

MEXICAN INSTITUTE Dt THE PROPERTY

i. central timing module, inou¿twal

<img file="MX356554B_D0026.tif" />

j. general electronic module,

<td>k.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>Body,</td>

<td> 1.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>suspension,</td>

<td>m.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>convenience,</td>

<td>n.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>convenience,</td>

<td>or.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>convenience,</td>

<td>P-</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>engine,</td>

q. electric power steering control unit,

r. human-machine interface,

<td>s.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>seat,</td>

<td>t.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>speed,</td>

<td>or.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>phone,</td>

<td>V.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>transmission,</td>

<td>w.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>brake (ABS or ESC),</td>

x. shock sensors,

and. airbags,

z. seat belts, aa. tire pressure monitoring systems, bb. electronic stability control system, cc. traction control system, dd. anti-lock braking system, usa electronic brake assist system, ff. electronic force distribution,

MMS ·.

<td></td><td></td>

<td>gg.</td><td>INPTITVT, 'MEXICANO' tí'A DHAWíxiíDaÓ tíj force distribution system ^ tté¹Ri * e &amp; e- ~</td>

<td>electronic,</td><td> ---.--—</td>

<td>H H.</td><td>emergency shutdown,</td>

<td>ii.</td><td>notifications and alerts handled,</td>

<td>jj</td><td>pedestrian object recognition,</td>

<td>kk.</td><td>lane assist,</td>

<td> 11.</td><td>shock evasion,</td>

<td>mm.</td><td>adaptive headlight control,</td>

<td>nn.</td><td>reverse backup sensors,</td>

<td>oo.</td><td>adaptive cruise control,</td>

<td>PP</td><td>active cruise control,</td>

<td>qq.</td><td>traction control systems,</td>

<td>rr.</td><td>electronic stability control,</td>

<td>H.H.</td><td>automated parking system,</td>

<td>tt.</td><td>multimedia,</td>

<td>uu.</td><td>active noise cancellation,</td>

<td>w.</td><td>radio,</td>

<td>ww.</td><td>radio data system,</td>

<td>XX.</td><td>driver information functions,</td>

<td>yy.</td><td>AM / FM or satellite radio,</td>

<td>zz.</td><td>CD / DVD player,</td>

<td>aaa.</td><td>payment systems,</td>

<td>bbb.</td><td>Wi-Fi router in vehicle,</td>

<td>ccc.</td><td>internal lights.</td>

<td>ddd.</td><td>climate control,</td>

Á JLV J; A 1

IN.iTITiJT'i MEXICANO J · * ·

<td>eee.</td><td>chairs adjustment,</td><td>OF THE INDUSTRIAL PRITY</td>

<td>fff</td><td></td><td></td>

<td>ggg.</td><td>mirror adjustment,</td><td></td>

<td>hhh.</td><td>central lock,</td><td></td>

<td>iii.</td><td>battery management,</td><td></td>

<td>jjj-</td><td>cargo handling,</td><td></td>

<td>kkk.</td><td>vehicle network system,</td><td></td>

<td> 111.</td><td>active cruise control,</td><td></td>

<td>mmm.</td><td>remote control keys,</td><td></td>

<td>nnn.</td><td>theft deterrent systems,</td><td></td>

<td>ooo</td><td>immobilizer system,</td><td></td>

<td>PPP ·</td><td>security system,</td><td></td>

<td>qqq</td><td>digital cameras,</td><td></td>

<td>rrr.</td><td>night vision,</td><td></td>

<td>sss.</td><td>lasers,</td><td></td>

<td>ttt.</td><td>Radar,</td><td></td>

<td>uuu.</td><td>RF sensors,</td><td></td>

<td>vw.</td><td colspan="2">informative entertainment system and</td>

<td>WWW.</td><td>robotic gear tree.</td><td></td>

It is another objective of the present invention to describe the device as defined above, where the ECU is selected from a group consisting of:

to. electronic / motor control module (ECM),

b. powertrain control module,

INSTITUTO MEXICAN OE LA EX&gt; PIE. '&gt; AÍ&gt;

INDUSTRIAL

<img file="MX356554B_D0027.tif" />

<td>c.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>transmission,</td>

<td>d.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>Brake,</td>

<td>and.</td><td>module</td><td>of</td><td>control</td><td colspan="2">central,</td>

<td>F.</td><td>module</td><td>of</td><td colspan="3">central timing,</td>

<td>g.</td><td>module</td><td>of</td><td colspan="3">general electronic,</td>

<td>h.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>Body,</td>

<td>i.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>suspension.</td>

<td>j</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>airbag,</td>

<td>k.</td><td>module</td><td>of</td><td>control</td><td>of</td><td>body, insurance</td>

<td>controls,</td><td colspan="4">electric windows,</td><td>and lights of cuts:</td>

<td> 1.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>convenience,</td>

<td>m.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>door,</td>

<td>n.</td><td>Unit</td><td>of</td><td>control</td><td>of</td><td>engine,</td>

or. electric power steering control unit, integrated into the electric power steering power pack,

p. human-machine interface,

q. powertrain control module,

r. seat control unit,

s. speed control unit,

t. telephone control unit,

or. telematic control unit,

v. transmission control unit,

w. brake control module,

x. onboard or integrated remote ECU processing services, and

<img file="MX356554B_D0028.tif" />

and · any combination of

<img file="MX356554B_D0029.tif" />

It is another objective of the present invention to describe the method as defined above, which further comprises the step of evaluating the risk level of the attack on the vehicle and its passengers and prioritizing the attack.

It is even an objective of the present invention to describe the method as defined above, which further comprises the step of selecting the one or more networks based on a group consisting of: web, physical cable, Wi-Fi, cellular, Bluetooth, RF, GPS, vehicle-to-vehicle communication, vehicle-to-passenger infrastructure, vehicle-environment infrastructure.

Finally, it is an objective of the present invention to describe the method as defined above, which also includes the step of selecting the one or more applications or navigation devices from a group consisting of: satellite navigator, cellular navigator, systems that find the north (NFS), or inter-vehicle guidance system and dedicated inertia navigator.

BRIEF DESCRIPTION OF THE FIGURES

The invention is described herein, by way of example only, with reference to the accompanying figures, wherein:

Figure 1 is a schematic diagram showing l 'τ *? and the vehicle detection and prevention device and its basic components; and ___________________________ Figure 2 is a schematic diagram showing an implementation example of the vehicle attack detection device.

DETAILED DESCRIPTION OF THE INVENTION

The following description is provided, throughout all the chapters of the present invention, to allow any person skilled in the art to make use of the invention and establishes the best ways contemplated by the inventor to carry out this invention. However, various modifications are tailored to remain apparent to those skilled in the art, as the generic principles of the present invention have been specifically defined to provide a device and method for detecting and preventing vehicle attack.

The potential damage from a cyberattack on functional vehicle units may be unprecedented, for example a remote attack on airbag system can potentially trigger airbag activation during regular handling or manipulate wireless transmission of the tire pressure in order to mislead the actual pressure report. Traditional information security methods such as firewalls, antivirus, and network IDS may not be sufficient to respond to this.

· .: ί / '

INSTITUTO MSXICaN '· »/? \ Critical need, since attack vectors sÓh ^ iSlilí ^ enCg ^ ii-Z' since while the vehicle has logic • Funsipnal single interunit, such as direct access through different vehicle sensors, or through remote control service or through other vehicles or infrastructure units (V2V, V2I).

The present invention presents a new device and method for dealing with attack threats, such as a cyberattack or communication attack. The present

<td>invention is</td><td>suitable for</td><td>to protect</td><td>such attacks,</td><td>to the</td>

<td>use the</td><td>characteristics</td><td>unique</td><td>from: logic</td><td>of</td>

<td>functioning</td><td>of vehicle,</td><td>vectors</td><td colspan="2">of potential attack.</td>

<td colspan="2">communication between</td><td>systems</td><td>vehicle and</td><td>its</td>

combination.

The term Electronic Control Units (ECU), used herein, refers to any built-in system that controls one or more of the electrical systems or subsystems in a motor vehicle. ECU types include Electronic / Engine Control Module (ECM), Powertrain Control Module (PCM), Transmission Control Module, Brake Control Module (BCM or EBCM), Central Control Module, Timing Module Central (CCM), General Electronic Module (GEM), Body Control Module (BCM), Suspension Control Module (SCM), Control Unit, or Control Module. Taken together these systems ¡í Ja V 00 are sometimes indicated as the compu ^ ^ /_Td_rq'l / .aútQmóy_/il 'Á' 7

Üfc IA FK '.

Go * L / JjI &lt;ΙΛ (Technically there is no single computer but multiple). Sometimes an assembly incorporates several of the individual control modules (PCM is often both engine and transmission). Some modern motorized vehicles have up to 80 ECUs. Built-in ECU software continues to increase in line count, complexity, and sophistication. Managing the complexity and increasing number of ECUs in a vehicle has become a key challenge for original equipment manufacturers (OEMs).

The term Metadata, as used here, refers to data about data. The term is used in two fundamentally different concepts: structural metadata and descriptive metadata. Structural metadata is about the design and specification of the data structure or in other words data about the data containers. Descriptive metadata is about individual cases of application data, the data content. In this case, a useful description would be data content on data or content on the content of that meta-content form.

The term physical data, as used herein, refers to the electrical and physical specifications of data connections. Physical data defines the characteristics between a device and a transmission

<img file="MX356554B_D0030.tif" />

physical (for example, a copper cable or fibif ^ 'oS ^^ íic'a ·) !. - This .... includes terminal design, voltages, in-line impedance, cable specs, signal timing, hubs, repeaters, network adapters, current, frequency, gradient, changing amplitude, modulation method, and more.

The term irrational, used here, refers to data content, metadata, physical data or the resulting action that is misleading, illegitimate, inconsequential, without consequences, invalid, illogical, non-rational, unreasonable, without reason, soundproof, unexpected or weak, based on vehicle present: status, action, or condition, or when compared to data collected from different data sources.

The term vehicle, used herein, refers to a mobile machine that transports passengers or cargo such as bicycle, automobile, truck, bus, motorcycle, train, ship, boat, aircraft, water vehicle, aircraft, and spacecraft. The vehicle can be powered by a human, by at least a partially autonomous driving system, or by a remote control system. The vehicle can also be a robotic platform. The vehicle can travel by land, water, or air.

The term communication channels, used here, refers to a physical transmission medium, such as a

Μ Ρ Κ '' 'cable, or a logical connection over a medium such as a radio channel. The channels are used to transport information signals, for example a digital bit stream, from one or more senders (or transmitters) to one or more receivers. A channel has some capacity to transmit information, often measured by its bandwidth in Hz or its data rate in bits per second. Communicating data from one location to another requires some form of path or medium. These paths, called communication channels, use two types of media: cable (twisted pair wire, cable, and fiber optic cable) and transmission (microwave, satellite, radio, and infrared). Cabled or cabled media use physical wires or cables to transmit information data. Twisted pair wire and coaxial cable are made of copper, and fiber optic cable is made of glass.

The term network-based services used here refers to web, physical cable, Wi-Fi, mobile, Bluetooth, RF and

GPS.

The present invention provides a new device for detection and prevention of at least one attack on a vehicle through its one or more communication channels, the device comprises:

to. an input unit configured to collect real-time and / or offline data from at least one source selected from a group that¹** one or more sensors, one or more network-based services, one or more navigation applications or navigation devices, one or more electronic control units (ECUs) of the

ΈΑΤίηιτί-ΡΛΤ) τ · .; · Α ..., INDUSTRIAL -... A .._- * vehicle, one or more common vehicle driver networks, one or more vehicle subsystems, and one or more on-board diagnostics (OBD);

b. a database, configured to store the data;

c. a detection unit in communication with the input unit;

d. an action unit, in communication with the detection unit, configured to send an alert through the communication channels and / or prevent the attack,

<td>when breaking or changing</td><td>the attack</td><td>of one or</td><td>plus</td><td>channels</td><td>of</td>

<td>communication;</td><td></td><td></td><td></td><td></td><td></td>

<td>where the</td><td>unit of</td><td>detection</td><td>this</td><td colspan="2">configured</td>

<td colspan="2">to monitor simultaneously</td><td>content,</td><td>the</td><td>metadata</td><td>and</td>

<td colspan="2">the physical data the data and</td><td>detect the</td><td colspan="2">attack.</td><td></td>

The detection unit configured to monitor and detect the attack based on at least one characteristic selected from a group consisting of:

<img file="MX356554B_D0031.tif" />

to. The data content is irregular 'P? ^' · '? ^ -.

b. irregular source of data;

c. regular destination for data;

d. irrational data content, when compared to data received by at least one other source;

and. irrational action of at least one of the vehicle subsystems, when compared to data received by at least one other subsystem;

F. irrational action between at least two of the subsystems;

g. irrational action of at least one of the vehicle subsystems, when compared with the data received by at least one of the sensors;

h. irrational metadata;

i. irrational meta-content;

j. binding or blocking of communication channels and network-based services; and

k. sudden change in signal characteristics of network-based services and / or sensors.

The present invention provides a new method for detecting and preventing at least one attack on a vehicle through its one or more communication channels, the method comprising the steps of:

to. collect real-time and / or offline data from at least one source selected from a group consisting of:

<img file="MX356554B_D0032.tif" />

IN3TITUT ·? mf.'JC'Jlc of the «λψ: * ¡&gt;

<img file="MX356554B_D0033.tif" />

one or more sensors, _ one or more network-based services, one or more navigation applications or navigation devices, one or more electronic vehicle control units, one or more common vehicle driver networks, one or more subsystems of the vehicle, and one or more on-board diagnostics;

b. store the data in a database;

c. monitor data for an attack; and if the attack is detected,

d. act by sending an alert and / or preventing the attack by breaking or changing the one or more communication channels;

where monitoring includes simultaneous examination of the content, metadata and physical data of the data for detection of the attack.

In accordance with an embodiment of the present invention, the database further comprises parameters of at least one known, previously detected attack. Parameters can be selected from: irregular data content; irregular source of data; irregular destination for data; the irregular data content, when, · κ ·,, IMPI S'Y compares with data received by at least ϊ ^, © ΛμΕ &amp; λν'Χ -^:.-1

OF PROPERTY Wj / *

INDUSTRIAL irrational action of at least one of the vehicle subsystems, when compared with data received by at least one other subsystem; irrational action between at least two of the subsystems; irrational action of at least one of the vehicle subsystems, when compared with the data received by at least one of the sensors; irrational metadata; irrational meta-content; binding or blocking of communication channels and / or network-based services; sudden change to signal characteristics of network-based services and / or sensors; the location of the vehicle; the make of vehicle; the sensors; communication channels; the navigation application; the navigation device; and communication interfaces.

In accordance with another modality, the action unit and / or the detection unit are configured to extract these parameters from the attack and update the database.

In accordance with an embodiment of the present invention, the device further comprises an identification unit, configured to identify the aforementioned known parameters of the known attack and update the action unit.

Under another modality, the action unit may initiate additional data collection from at least one of the sources.

II ·

<img file="MX356554B_D0034.tif" />

INSTITUTO MF.XI'aN ') DF LA Ρ? /.&gt; Ρ «ΗΟαΓ&gt; INDUSTRIAL

In accordance with an embodiment of the present invention, the device further comprises a remote server configured to communicate with the database to deliver and / or receive additional parameters of known attacks detected by other similar devices.

In accordance with another embodiment, the remote server is configured to collect data from at least one additional vehicle, to monitor the content, metadata, and physical data of the data, to detect the attack, and to update the attack database .

In accordance with an embodiment of the present invention, the detection unit comprises a machine learning processor configured to learn the characteristics and behavior of the data, metadata and physical data content and recognize any unfamiliar behavior.

In accordance with the embodiment of the present invention, the device further comprises a display unit configured to notify an user of an attack alert. The device may also be in communication with a remote display unit configured to notify and alert a user of an attack.

In accordance with another modality of the present

-. F i,.

invention, the device can use ™? man) MF.xiarati'tó: ru ^ &lt;&gt; q »jv j- nF ia psoriFUAn · ??

DE LA PHOFIE!) AD INDUSTRIAL commercialized, malware application, firewalls or other database of malicious code offered in the market.

In accordance with another embodiment, the device is at least partially embedded within one of the vehicle hardware cards, software units, and / or within the remote server.

In accordance with another embodiment, the device further comprises an evaluation engine, to assess the risk level of the attack on the vehicle and its passengers and to give priority to the detected attack.

The sensors, as mentioned above, can be selected from: distance sensor (to avoid collision), speed and acceleration sensors, temperature sensor, satellite transmission sensor, cellular transmission sensor, video image, air-fuel ratio meter, blind spot monitor, position sensor crankshaft, curb edge detector, used to warn the driver of curb edges, defect detector, used on railways to detect axle and signal problems on passing trains, engine coolant temperature sensor, or ECT sensor, used to measure engine temperature, hall effect sensor, used to time wheel and axle speed, Manifold Absolute Pressure sensor, used when regulating measurement

<img file="MX356554B_D0035.tif" />

fuel, mass flow sensor, or

INDUSTRIAL mass air, used to tell the ECU the mass of air entering the engine, oxygen sensor, used to monitor the amount of oxygen in the exhaust, parking sensors, used to alert the driver of objects not seen during maneuvers parking, radar gun, used to detect the speed of other objects, speedometer, used to measure the instantaneous speed of a land vehicle, speed sensor, used to detect the speed of an object, throttle position sensor, used to monitor the throttle position in an internal combustion engine, tire pressure monitoring sensor, used to monitor the air pressure inside the tires, sensor Torque, or Torque Transducer, or Torque Gauge measures torsion (torque) in a rotating system, transmission fluid temperature sensor, used to measure transmission fluid temperature, turbine speed sensor, or inlet speed sensor, used to measure input shaft rotation speed or torque converter, variable reluctance sensor, used to measure position and speed of mobile metal components, vehicle speed sensor, used to measure vehicle speed, water sensor or water-in-fuel sensor, used to indicate the presence '·&gt;

: / from water to fuel, speed sensor 9S ^? íi ^ nA3lIaii.ta,. ·:

INnUÍTRIAL used to read the tire rotation speed of a vehicle, and any combination thereof.

The subsystems, as mentioned above, can be selected from: tire pressure monitoring, stability control, cruise control, airbag control, Powertrain Control Module, Transmission Control Module, Brake Control Module, Central Control Module, Central Timing Module, Module General Electronic, Body Control Module, Suspension Control Module, Convenience Control Unit, Convenience Control Unit, Convenience Control Unit,

Engine Control Unit, Steering Control Unit

Electric Power, Human-Machine Interface, seat control unit, speed control unit, Telephone Control Unit, Transmission Control Unit, Module

Brake Control (ABS or ESC) shock sensors, airbags, seat belts, Monitoring System

Tire Pressure, Stability Control System

Electronic, Traction Control System, anti-lock braking system, Brake Assist system

Electronic, electronic brake force distribution, electronic brake force distribution system, emergency shutdown, handled notifications and alerts, pedestrian object recognition, assistance to maintain

V 'PI / ¾

INSTITI, Τ ') M KXl LAN lane, crash avoidance, adaptive VMeíar headlight control, reversing backup sensors, —controlJ —- adaptive cruise control, active cruise control, traction control systems, Electronic Stability Control, system automated parking, multimedia, active noise cancellation, radio, Data System

Radio, driver information functions, AM / FM or satellite radio, DC / DVD player, payment systems, Wi-Fi router in vehicle, internal lights, climate control, chair adjustment, electric windows, mirror adjustment, central lock, battery management, charge management, vehicle network system ACC, remote control keys, theft deterrence systems, immobilizer system, other security systems, digital cameras, night vision, laser, radar, RF sensors , and robotic gear tree.

The ECU, as mentioned, can previously be selected from: electronic / engine control module, powertrain control module, transmission control module, brake control module, central control module, central timing module, general electronic module, body control module, engine control module suspension, airbag control unit, body control module, door controls, electric windows, and courtesy lights, convenience control unit, door control unit, motor control unit,

<img file="MX356554B_D0036.tif" />

INSTITUTO rO XIC

Electric Power Management Control, integracfeB^TO'in power steering power pack- - ^ ^ léo-fear-ioa, - human-machine interface, powertrain control module, seat control unit, speed control unit, telephone control unit, telematics control unit, transmission control unit, Brake Control Module, and any combination thereof.

Network-based services, as mentioned above can be selected from a group consisting of: web, physical cable, Wi-Fi, cellular, Bluetooth, RF, GPS, vehicle-to-vehicle communication, vehicle-to-passenger infrastructure, infrastructure environment (traffic) to vehicle.

Navigation applications or devices as mentioned above can be selected from a group consisting of: satellite navigator, cellular navigator and dedicated inertia (gyro) navigator, relationship location system based on RF communication with other vehicles, ground signals and lighthouse. Navigation applications or devices can also be the vehicle's own subsystem browser.

Reference is now made to Figure 1 which describes a schematic diagram of the device [100] and its basic components and includes:

to. an input unit [110] configured to collect real-time and / or offline data from

IMPI

INSTITUTO MÍXICANO DE LA MONEDAD minus one source selected from a group consisting of one or more sensors [lll], one or more network-based services [112], one or more navigation applications or navigation devices [ 113], one or more vehicle electronic control units [114], one or more vehicle common conductor networks [115],

<td>one</td><td>or more</td><td>subsystems [116] of the</td><td>vehicle, and</td>

<td>one</td><td>or more</td><td>On Board Diagnostics</td><td> [117] ;</td>

<td>b.</td><td>a</td><td>database [120]</td><td>, configured for</td>

<td>store the</td><td>data</td><td>r</td><td></td>

c. a detection unit [130] in communication with the input unit;

d. an action unit [140], in communication with the detection unit, configured to send an alert through the communication channels and / or prevent the attack, by breaking or changing the attack of one or more communication channels.

Figure 1 further describes the identification unit [150], configured to identify the previously mentioned known parameters of a known attack and update the action unit [140]; the remote server [160], configured to communicate with the

<img file="MX356554B_D0037.tif" />

<img file="MX356554B_D0038.tif" />

ΙΝ3ΤΓΤυ &lt;0 Me: G &lt;GíG, ρΐ LA ALG'ILG. · G

<img file="MX356554B_D0039.tif" />

OF THE ALG'I

<img file="MX356554B_D0040.tif" />

additional known attacks detected<img file="MX356554B_D0041.tif" /> similar devices [100]; and the display unit [170], configured to notify and alert a user of an attack.

Reference is now made to Figure 2 which describes an implementation example of the vehicle's cyber attack detection device. In this implementation, the detection unit includes: the database, the evaluation engine (analysis engine), the machine learning engine, and where the irrational or irregular message is carried out separately from the cross detection unit. This example describes communication between the detection unit and the remote server, the input unit (interface unit), the network-based services; and where the detection unit also sends alerts of potential attacks and activates the action unit.

Figures 1 and 2 further describe optional attack vectors including in-vehicle sources, such as but not limited to vehicle sensors, electronic control units, common driver network, subsystem, on-board diagnostic and navigation device; and sources outside the vehicle; such as but not limited to web, mobile, Wi-Fi, network services, connected applications, and other vehicles

<img file="MX356554B_D0042.tif" />

Examples for operating logic, v potential attack vectors which are the characteristics detected by the detection unit:

to. Examples for irregular data content include but are not limited to: unusual readings of tire air pressure; control commands that are longer than usual; discontinuous round-per-minute (RPM) reading; a STOP command that comes in before a DECELERATE command.

b. Examples for irregular data sources include but are not limited to another vehicle passing by and sending activation messages such as open window; cell phone that transmits via Bluetooth; cheated cell phone instruction; internal temperature indication; and a STOP command coming out of the vehicle.

c. Examples for irregular destination for data include but are not limited to network communication that activates mirror adjustment.

d. Examples for irrational data content, when compared to data received by at least one other source, include but are not limited to:

Network system reporting cold weather where automobile temperature sensors detect weather

<img file="MX356554B_D0043.tif" />

warm; a physical control connection while 'h' ^ 'blockTl' cellular transmission; a message from pneumat'forytsj^FW”* S '± Tr' ^ Tre” '' (low pressure signal) received with an irregularly strong signal; uploading an MP3 file followed by unusual commands to engine systems such as acceleration; suspicious metadata for a remote control command followed by sudden throttle depressing (which is different than the average for the last 5 minutes); a cellular device virus detection (by a third party) followed by irrational script to vehicle subsystems; and identification of irrational communication characteristics followed by a sharp turn of the agitation wheel while the navigation system recognizes an untracked, dangerous or even crash path.

and. Examples for irrational action of at least one of the vehicle subsystems, when compared to data received by at least other subsystems include but are not limited to an instruction to unlock and / or open vehicle doors while the vehicle is accelerating.

F. Examples for irrational action between at least two of the subsystems include but are not limited to an action to accelerate (push the accelerator) and stop (push the brake pedal) simultaneously.

g. Examples for a

<img file="MX356554B_D0044.tif" />

INSTI '· ¡0 rz-xy; ..,' -; ;

U £ LA «'t / .TDT: · ·. i v. ·. ·. ·, · '&gt;'

INL&gt; ÓS ¡KiAL t .. 'i____ irrational action of at least one of the vehicle subsystems, when compared to the data received by at least one of the sensors include but is not limited to an instruction to activate the airbags , when the sensors do not detect any crash situation.

h. Examples for irrational metadata and meta-content include but are not limited to an incoming cellular call to the vehicle's remote control, where the calling number is tested and the command content appears normal, but the cellular provider is unusual or the signal is with unexpected force;

identification of irrational communication characteristics within the vehicle's internal systems (canbus) identified as irregular by the learning machine.

i. Examples of binding or blocking of communication channels and / or network-based services include but are not limited to a cellular distortion of GPS communication identified by its signal strength, transmission method, frequency band, operation at other frequencies.

j. Examples for sudden change to signal characteristics of network-based services and / or

IMPí

...., - flWITWTO MWICANO P? * '®' · '! *' sensors may include but are not weakened or strengthened from vehicle sensors, satellite based communication and cellular communication, while the web network has a sudden increased signal.

It is noted that in relation to this date, the best method known by the applicant to put the aforementioned invention into practice is the one that is clear from the present description of the invention.

<img file="MX356554B_D0045.tif" />

as above. I know