EP3682610A1

EP3682610A1 - Method and device for detecting an attack on a serial communications system

Info

Publication number: EP3682610A1
Application number: EP18762061.2A
Authority: EP
Inventors: Birger Kamp; Anke Jentzsch; Viktor Bunimov; Steven Michna; Christoph Riechel
Original assignee: Volkswagen AG
Current assignee: Volkswagen AG
Priority date: 2017-09-12
Filing date: 2018-08-27
Publication date: 2020-07-22
Also published as: US11522876B2; CN111133727A; US20210067523A1; WO2019052798A1; CN111133727B; DE102017216096A1

Abstract

The invention relates to a method for detecting an attack on a serial communications system. The method comprises determining the status of each of a plurality of messages transmitted via the serial communications system in order to obtain a sequence of statuses (102). The status of one of the plurality of messages is based on a plurality of properties of the message and a plurality of properties of a preceding message of the plurality of messages. The method also comprises comparing the sequence of statuses with at least one reference sequence (104) and determining that there is an attack on the serial communications system if the sequence of statuses deviates from the reference sequence (106a).

Description

description

Method and apparatus for detecting an attack on a serial

communication system

The present invention relates to the monitoring of communication systems. More particularly, the present invention relates to a method and apparatus for detecting an attack on a serial communication system.

The vehicle has now become an integral part of the World Wide Web. A vehicle is a mobile means of transport for the transport of people or goods. The vehicle may therefore be both a passenger and a commercial vehicle. For example, a vehicle may be a passenger car, a truck, a motorcycle or a tractor. In general, a vehicle may be understood as a device that includes an engine, a powertrain system, and wheels. The number of online

available access to the vehicle is growing rapidly. In the same way, the threat potential increases through attacks on the vehicle and its core component - the electronics. This applies in particular to the bus systems that realize the communication between the control units of the vehicle. An intrusion into this communication structure can cause the complex vehicle system to fall into unplanned conditions. The monitoring of the bus systems of the vehicle is therefore desirable.

Document US 2016/0188396 A1 proposes a method for detecting temporal anomalies in vehicle networks. Each is controlled via a Controller Area Network (CAN) bus in the

Vehicle-checked message then checked whether the contained therein message identifier (engl, message ID) and the therein contained network identifier (EN, network ID) are respectively known. If this is the case, then it is further checked whether the currently examined message as well as previous messages regarding their time behavior are normal or abnormal.

Document EP 3 1 13 529 A1 proposes a further method for detecting time-based anomalies in a vehicle communication network. For this purpose, the time interval between two consecutive messages of identical message identifier is compared with a time model. The methods proposed in the aforementioned publications can not detect a large number of attacks. Thus, there is a need to provide a way to improve the detection of attacks on serial communication systems.

The present invention enables this by a method of detecting an attack on a serial communication system. A serial communications system transmits individual bits in sequence (i.e., serial) - as opposed to parallel communication systems that transmit their data in parallel over multiple lines.

The method includes determining a respective state of a plurality of messages transmitted over the serial communication system to obtain a sequence of states. The state of one of the plurality of messages is based on a plurality of attributes of the message and a plurality of characteristics of a preceding message of the plurality of messages, respectively. The features can be understood as so-called. Low-level descriptors. The individual properties may be irrelevant in their own right, but their common consideration (i.e., viewing as a whole) allows the condition classification of a message. The condition classification of a message is therefore e.g. possible via simple comparison operations. This results in a pattern of states - the sequence of states. The characteristics of a message may include, for example, a content, a (temporal) beginning of the message, an end of the message (temporal) or an identification of the message as active or inactive.

The method further comprises comparing the sequence of states with at least one reference sequence. In other words, a timing of the plurality of messages transmitted via the serial communication system is monitored. The reference sequence of states indicates the order of states in normal (i.e., undisturbed) operation of the serial communication system. Deviations from the normal (i.e., fixed) timing of the messages represented by the reference sequence may therefore indicate a manipulation of the serial communication system.

Accordingly, the method further comprises determining that there is an attack on the serial communication system when the sequence of states from the

Reference sequence deviates. Since the comparison of the sequence of states with the at least one reference sequence can be carried out very efficiently and with low computing power, The method according to the invention enables a simple and efficient monitoring of a serial communication system.

If the sequence of states matches the reference sequence, the method may include determining that there is no attack on the serial communication system.

According to some embodiments, the state of the message may be determined at least on a first comparison of a content of the message with a content of the preceding message and on a second comparison of the time difference between a beginning of the message

Message and a beginning of the preceding message with a comparative value. In addition to the content of the message, the beginning of the first message is thus compared to the beginning of the preceding message in order to allow a time interval between the messages

determine. The message content as well as the time interval between successive messages is characteristic and therefore suitable for the status description of the message. The comparison value may be, for example, a cycle time used by the serial communication system or a blocking time between successive messages. The state of the message may also be based on additional comparisons of the time difference between the beginning of the message and the beginning of the preceding message with at least one further comparison value.

In addition, in some embodiments, the state of the message may also be based on a comparison of one or more attributes of the message with a comparison value independent of the plurality of messages. For example, the content of the message (e.g., a status bit) may be compared to a comparison value indicating whether a message is active or inactive. Also, such comparisons may represent suitable low-level descriptors to determine the state of a message, i. to characterize a message.

According to some embodiments, comparing the sequence of states to at least one reference sequence includes incrementing a counter when a first state occurs within the sequence of states. Further, the comparing includes resetting the counter to an output value when a second condition occurs within the sequence of states. If the counter exceeds a threshold, the compare includes

Determining that the sequence of states differs from the reference sequence. Additional messages, ie inserted messages, change the characteristic pattern, ie the characteristic reference sequence. The characteristic reference sequence can be mapped by the threshold for the counter associated with the first state. Due to the additional, injected message, it can happen that the counter is not reset or too late. Accordingly, by using a counter, the deviation of the sequence of states from the reference sequence can be easily deduced.

In some embodiments, the method further comprises comparing a

Part of the sequence of states with at least one second reference sequence. The subarea of the sequence of states in this case only includes states that are different from the second state. If the portion of the sequence of states differs from the second reference sequence, then the method further comprises determining that an attack on the serial communication system exists. In other words, the sequence of states between a first state change from the second state to another state and a second state change from another state to the second state is checked. Thus, the correctness of the sequence (pattern) of states can be further secured.

In accordance with some embodiments, the method further comprises comparing the content of a first message of the plurality of messages with the content of a second message of the plurality of messages. The state of the first message is equal to the state of the second message, wherein between the first and the second message at least a third message is transmitted with a state different from the state of the first message state via the serial communication system. If the content of the second

Message is equal to the content of the first message, the method further includes

Determine that there is an attack on the serial communication system. Further comparison of the message content may enable the detection of smarter attacks. For example, it is possible to detect attacks on the serial communication system in which messages are introduced which cause a change of state between

pretend to successive messages. However, since the message content changes during a regular state change, these attacks can also be recognized effectively.

In some embodiments, the method further comprises sending a message to a receiving device of a monitoring site for the serial

Communication system, if it is determined that an attack on the serial

Communication system is present. The message includes information about the attack on the serial communication system. In this way, those responsible for the serial

Communication system to be alerted to the attack, so that Countermeasures (eg ignoring messages, deactivating the system, etc.) can be taken. The information about the attack on the serial communication system can be any kind of information regarding the attack and ranging from a simple notification that an attack took place to detailed information about eg type and extent of the attack or affected messages.

According to some embodiments, the information about the attack on the serial communication system includes information about at least a portion of the sequence of states. Thus, e.g. the messages affected by the attack (and possibly a number of preceding and / or subsequent messages) of the plurality of messages of the serial communication system are transmitted to the monitoring station, so that they can be further analyzed.

In some embodiments, the plurality of messages are each transmitted over a plurality of signals via the serial communication system. The method then further comprises comparing a signal portion associated with the message of a first one of the plurality of signals with a signal portion of the first signal associated with the preceding message. The information about the attack on the serial communication system then comprises information about a result of the comparison of the signal portion of the first signal associated with the message with the signal portion of the first signal associated with the preceding message. A message can therefore be composed of several signals. For the analysis of an attack, it may be helpful to know which of the signals were attacked. The result of the comparison of the signal portion of the first signal associated with the message with the signal portion of the first signal assigned to the preceding message can be transmitted in a compact form, so that the data volume required for the transmission is small.

According to some embodiments, the information about the result of the comparison is a binary information indicating whether the signal portion of the first signal associated with the message matches the signal portion of the first signal associated with the preceding message. Thus, the information about the result of the comparison may be transmitted as a single bit for each of the plurality of signals. Accordingly, the data volume required for the transmission is very small. In some embodiments, the serial communication system is a CAN bus system. CAN bus systems, eg in vehicles, require effective monitoring due to their increasing availability via the World Wide Web.

According to some embodiments, the reference sequence is selected depending on a transmission type of the CAN bus system. CAN bus systems support a variety of transmission modes (signal transmission types). For example, here are the transmission types "Cyclic", "OnChange", "OnChangeWithRepetition", "IfActive", "IfActiveWithRepetition",

Each of the transmission types of the CAN bus system has one or more characteristic reference sequences of the message states

Attack detection can be adapted to the type of transmission of the CAN bus system used.

In some embodiments, the comparison value for comparison with the time difference between the beginning of the message and the beginning of the preceding message is a first used cycle time (e.g., normal cycle time), a second cycle time used (e.g., fast cycle time), or a CAN bus system lock time. The CAN bus system can use several cycle times, each of which is characteristic for one transmission type.

Accordingly, from the comparison of the time interval successive

Messages with one of the cycle times are closed to attacks. Accordingly, the blocking time represents a minimum time interval between two consecutive messages, the undershooting of which represents an indication of an attack.

In a further aspect, the present invention further relates to a program having a program code for carrying out the method described herein, when the

Program code on a computer, processor or programmable

Hardware component is executed.

In a further aspect, the present invention also relates to an apparatus for detecting an attack on a serial communication system. It includes the

Apparatus comprising processor circuitry configured to determine a respective one of a plurality of messages transmitted over the serial communication system to obtain a sequence of statuses. The state of one of the plurality of messages is based on a plurality of attributes of the message and a plurality of characteristics of a preceding message of the plurality of messages, respectively. Further, the processor circuit is arranged to set the sequence of states with at least one Compare reference sequence and determine that an attack on the serial communication system is present when the sequence of states deviates from the reference sequence. The state classification of a message as well as the comparison of the sequence of states with the at least one reference sequence can be carried out very efficiently and with low computing power, so that the device according to the invention can also enable a simple and efficient monitoring of a serial communication system.

In some embodiments of the present invention, the processor circuitry may be further configured to include one or more of the associated with the

Execute said process steps.

The present invention further relates in one aspect to a vehicle having a

Device according to the invention for detecting an attack on a serial

Communication system, wherein the serial communication system is a CAN bus system of the vehicle. Accordingly, attacks on the CAN bus system of the vehicle can be detected efficiently and with low computing power. A safety of the vehicle can thus be increased.

Embodiments of the present invention will be explained below with reference to the accompanying figures. Show it:

FIG. 1 is a flowchart of an embodiment of a method of detecting an attack on a serial communication system; FIG.

Fig. 2 shows an embodiment of a data stream on a CAN bus system;

Fig. 3 shows an embodiment of an undisturbed sequence of messages;

Fig. 4 shows an embodiment of a disturbed sequence of messages;

Fig. 5 shows an embodiment of a sequence of messages for different ones

Transmission modes of a CAN bus system;

Fig. 6 shows another embodiment of a disturbed sequence of messages; Fig. 7 shows an embodiment of a comparison of signals of a CAN bus system;

Fig. 8 shows an embodiment of a device for detecting an attack on a serial communication system; and

Fig. 9 shows an embodiment of a vehicle.

In Fig. 1, a method 100 for detecting an attack on a serial

Communication system shown. The method 100 includes determining 102 a respective state of a plurality of messages transmitted over the serial communication system to obtain a sequence of states. The state of one of the plurality of messages is based on a plurality of attributes of the message and a plurality of characteristics of a preceding message of the plurality of messages, respectively. Furthermore, the method 100 includes comparing 104 the sequence of states with at least one reference sequence and determining 106a that an attack on the serial communication system is present if the sequence of states deviates from the reference sequence.

If the sequence of states matches the reference sequence, the method 100 may still include determining 106b that there is no attack on the serial communication system.

The state classification of a message as well as the comparison of the sequence of states with the at least one reference sequence in the method 100 can be performed very efficiently and with low computational power so that the method 100 can enable simple and efficient monitoring of a serial communication system.

Further details and aspects of the method 100 are described in connection with one or more further embodiments. The method 100 may include one or more optional features according to one or more of the further embodiments.

Hereinafter, with reference to Figs. 2 to 7 explained some embodiments of the method according to the invention. The serial communication system is in each case designed as a CAN bus system. However, it goes without saying that in context features of the method discussed with the CAN bus system may also be used in conjunction with other serial communication systems.

Fig. 2 shows a data stream on a CAN bus system. At the time T = 15 ms, an event s = 0 takes place, so that a message 210 with the content s = 0 is transmitted to the T = 15 ms via the CAN bus system. At time T = 75ms, i. after a normal cycle time of 60 ms, a second message 220 with the same content s = 0 is transmitted via the CAN bus system.

At T = 100 ms, the normal cycle is interrupted and an OnChange message 230 with content s = 1 is initiated, since an event s = 1 takes place at time T = 100 ms. At times T = 140ms and T = 180ms the message is repeated, i. the messages 240 and 250 are transmitted with a fast cycle time T = 40ms of the CAN bus system.

At T = 240ms the message 260 is transmitted having the content s = 1. Thus the normal cycle time T = 75ms is used again.

As already explained above, the proposed monitoring of the CAN bus system is based essentially on the control of the time behavior (combined with a comparison of

Message contents), since such anomalies, i. additionally inserted messages

(Messages), can be detected in the data stream. In other words, monitoring is based on the principle of pattern recognition.

The characteristic properties or characteristics, ie the states of a message, derive from two consecutive messages. For example, a first attribute of a message can be obtained by comparing whether the message contents are identical. Further properties can be derived from the time span between the two messages. For example, the observance of the normal and the fast cycle time t _Zy kius or t _Zy kius, schneii and compliance with the inhibit (inhibit) tinmbit be checked. In summary, the state of a message can be determined at least from the following comparisons:

4. If At = t ₀ -tl <t | nhibit? Where pi denotes the content of a message and t the time of beginning of a message with i = {0, 1}. Indices 0 and 1 indicate the two consecutive messages. For the comparison times tzykius, tz _y kius, schneii and tmhibit, a tolerance range can be taken into account. For each message content to be monitored, the comparison times tzykius, tzyklus.schnell and tinhibit can be stored in the monitoring system.

The features found can be understood as so-called. Low level descriptors. The simple queries can individually be of no importance. But the

Consideration together, i. however, their consideration as a whole provides the desired

Information about the state of a message. In this way, the detection of bus anomalies on simple queries can be reduced.

As already indicated above, the low-level descriptors can be understood as a set of suitable comparison operators, from which a characteristic state can be derived. It is understood that the comparisons are not limited to those of the above comparison operators, but e.g. may also be represented by ">", "<", ">", "Φ" comparisons and / or combinations thereof.

Likewise, the use of low-level descriptors, which are not based on a comparison of the two messages together possible. Purely exemplary here is the

Inactivity condition for certain signal transmit types of the CAN bus system called:

5. Is Pl = pin active?

Considering only the four characteristic properties of the two messages mentioned above, they define a state. The various possible states are shown in the following truth table:

State At-tcycle breathing cycle. Fast At <t | nhibit

A 1 1 0 0

B 0 1 0 0

C 1 0 0 0

D 0 0 0 0

E 1 1 1 0

F 0 1 1 0

G 1 0 1 0

H 0 0 1 0

J X X X 1

Table 1

In this case, "0" indicates that the condition is not satisfied, "1" indicates that the condition is satisfied, "X" indicates that the condition may be satisfied or not satisfied (ie, the result of the comparison may be arbitrary can be).

The truth table 1 can be used both for transmission types of the CAN bus, which send messages only with a constant cycle time, as well as for transmission types, the

Send messages with normal and short cycle times. The former type of transmission (with a constant cycle time) is a special case, because here only the observance of the normal cycle time has to be monitored in order to recognize additionally introduced messages.

States B and J immediately indicate a timing error. The states D and H each contain redundant information and can be combined. The states E and F are illogical and can not occur.

For a complete description of the condition, therefore, the information of a reduced truth table can be sufficient: State At-cycle cycle cycle. Fast At <t | nhibit Note

J X X X 1 error

B 0 1 0 0 Error

G 1 0 1 0 repetitions

A 1 1 0 0 normal operation

C 1 0 0 0 OnChange or ifActive finished

D 0 0 0 0 OnChange or ifActive finished

Table 2

By means of Table 2, a 4-bit information can be obtained which reflects the state of two consecutive messages and time behavior such as message content

characterized. If the check of the inhibit time (tinhibit) is carried out independently (for example in the context of another method), even the 3-bit information formed from columns 2 to 4 can be sufficient to characterize a message. The advantage of this is the space-saving 4-bit or 3-bit information and the application easier

Comparison operators. It goes without saying that also more comparison operators and accordingly information with more bits can be used.

Based on the above-described comparisons for state determination, a state can now be assigned to all messages in FIG. 2. Message 220 has a normal cycle time and therefore corresponds to state A (see Table 1 or 2). Accordingly, message 230 corresponds to state D because it is an on-chain message. The messages 240 and 250 mark repetitions with fast cycle time and therefore have state G. Message 260 is again associated with state A. In Fig. 2, a state change is thus shown. Thus, in the data stream shown in FIG. 2, the sequence of states is ... A A D G G A A .... Thus, time behavior and message behavior are represented by a time sequence of states, i. a typical pattern.

Each signal transmission type has its own, typical pattern over time in undisturbed operation. Each transmission type thus has a reference sequence of states. For example, the reference sequences to states may look like this: Send Type Reference Sequence

1 Cyclic et al

2 OnChange, cycle restart A xD A

3 OnChange, maintaining the cycle A xD C A

4 OnChangeWithRepetition, cycle restart A xD nG A

5 OnChangeWithRepetition, maintaining the cycle A xD nG A

6 IfActiv A u {xD yG} A

7 IfActivWithRepetition A u {xD yG} D nG A

8 OnChangeAndlfActiv A u {xD yG} D A

9 OnChangeAndlfActivWithRepetition A u {xD yG} v {D nG} A

Table 3

In Table 3, A, C, D and G each again designate a state of a message. The letters u, v, x respectively denote a variable and n a constant indicating the number of allowed repetitions. The bracket {...} indicates one each

Pattern block repeated according to the preceding variable u, v.

Since several OnChange states can occur consecutively, this is taken into account for the respective transmission types with xD. If, as in transmission mode 3, the old clock can be resumed after an on-hook, state C occurs. State G recognizes repetitions with a fast cycle time.

If the data stream shown in FIG. 2 is a data stream of the CAN bus system for signal transmission mode 4, the sequence of states agrees with the

Reference sequence according to Table 3 (here x = 1 and n = 2). If the data stream were a data stream of the CAN bus system for signal transmission mode 3, the sequence of states would not correspond to the reference sequence according to Table 3. Thus, there would be an indication of an attack since deviations from the typical pattern or exceedances of the allowable iterations (i.e., deviations from the reference sequence) are directly due to a timing error, i. a manipulation, point out.

An attack can e.g. insist that be in close proximity message with the

corresponding CAN identification (CAN ID) and the desired content. Likewise, for example, after a message with the corresponding CAN ID another message with this ID and a customized content can be introduced. Also, after each message with the corresponding CAN ID another message with this ID and the adapted content, whereby the blocking period is adhered to. In addition, before the next clock, the current, original message can always be inserted taking into account the blocking time. Alternatively, several messages can be introduced in a fast cycle time. An original OnChange will not intervene.

In connection with Figs. 3 and 4 will be explained below, as can be concluded from the counting of states already indicated above for an attack.

In Fig. 3 an undisturbed sequence of messages 310, 320, 380 is shown. Each message has a respective content 301. In addition, each message is assigned a state 302 according to the principles described above. This results in the following sequence (or pattern) 303 of the states: A A D D A A A.

As already shown above, a simple form of pattern recognition can be achieved by

State counter can be realized. For this purpose, a counter is incremented if a first state occurs within the sequence of states. If a second state occurs within the sequence of states, the counter is reset to its initial value. For example, for the states B, C, D and G, a state counter can be used in each case. If one of the states B, C, D or G occurs, the respective state counter is incremented. State A in this example causes the counters to be reset. Exceeding the respective permissible limit values (threshold values) is a direct indication of a manipulation.

While the characteristic pattern of undisturbed signal is shown in Fig. 3, Fig. 4 shows a distorted sequence of messages. In addition to the original messages 310, 320, 380 shown in FIG. 3, the inserted messages 410, 420, 480 are shown in FIG. 4. The message contents are again shown as numbers and the states as letters.

In addition, messages change the characteristic pattern, i. they deviate from the

Reference sequence of messages from. In the example of FIG. 4, in comparison to FIG. 3, the state A is no longer present due to the additional messages 410, 420, 480.

Accordingly, the state counter for the state D is always incremented and not reset. After exceeding the threshold value for the state counter of the

State D at the time T = 170ms is found to be a deviation from the

Reference sequence and thus an attack on the CAN bus system is present. In addition to the counting process, the pattern can still be checked during a state change in order to ensure the correctness of the pattern (the sequence of states) or the correct order of the individual states. An additionally introduced message also leads to a change in the course of the pattern (the sequence of states), which can be interpreted and checked as a change of state. From the possible variants, a catalog with permitted state patterns (second reference sequences) can be created, against which the state changes are compared.

FIG. 5 shows different transmission modes 2 to 5 of a CAN bus system over time. In this case, transmission mode 2 represents "OnChange" (cycle restart), transmission mode 3 "OnChange" (cycle maintenance), transmission mode 4 "OnChangeWithRepetition" (cycle restart) and transmission mode 5 "OnChangeWithRepetition" (maintenance of the cycle). At time t ₃ , a state change from A to D occurs. The state change 510 ends for transmission type 2 at time t ₄ and for the other types of transmission shown at time t ₅ , since then again the state A occurs. The pattern to be checked now covers the period from the beginning to the conclusion of a detected state change, ie states other than A.

That is, for each signal transmission mode, a portion 520 of the illustrated sequence will become

States compared with a second reference sequence. The sub-region 520 of the sequence of states in this case comprises only states that are different from a second state (here A). If the portion 520 of the sequence of states deviates from the second reference sequence, it is determined that there is an attack on the CAN bus system.

FIG. 6 also shows monitoring by means of extended pattern recognition. With the method described above, e.g. the above-described attacks are reliably detected. Individual, targeted attacks may not.

In addition to the original messages 610, 620, 690, the messages 601 and 602 are still introduced into the data stream of FIG. 6 from the time T = 340 ms on

To simulate state change.

With the counting method and the pattern recognition based on the comparison of two directly consecutive messages, this anomaly may under certain circumstances not be recognized, since the respective state counters do not exceed their threshold value. However, a comparison of the message contents before and after a regular or manipulated

Change of state remedy. As indicated by arrows 603 and 604, the content of a first message of the plurality of messages may be compared to the content of a second message of the plurality of messages. The state of the first message 630 or 670 is equal to the state of the second message 660 or 690 (namely A). Messages 640 and 650 or 601 and 602 are transmitted between the first message 630 or 670 and the second message 660 or 690, respectively, with a state different from the state of the first message 630 or 670 (here D) via the CAN bus system ,

With a regular state change, the message content changes. While the message 630 has the content 1, the second message 660 has the content 3. The messages 630 and 660 are separated only by the regular messages 640 and 650, each having state D.

In an irregular state change, the message content does not change. Both the first message 670 and the second message 690 have the content 3. The messages 670 and 690 are separated by the irregular messages 601 and 602, each having state D. The comparison of the message contents thus enables the detection of the irregular (injected) messages 601 and 602.

Thus, it can be reliably determined whether there is an attack on the CAN bus system.

For example, to compare the message contents, the message content may be stored prior to a state change.

In Fig. 7 is now shown how detected attacks effectively stored and to a

Responsible for the CAN bus system can be transferred.

To comprehensively analyze an attack, it may be helpful to store as much detailed information as possible and / or to transmit it to a controller (e.g., a central office or control room). For example, a message to a

Receiving device a monitoring point for the CAN bus system are sent when it is determined that an attack on the CAN bus system is present. The message then includes e.g. Information about the attack on the serial communication system. However, not only the attack can be reported, but also a certain period before and / or after the attack. In other words, the information about the attack on the CAN

Bus system can provide information about at least a portion of the investigated sequence at states. However, the data volume required for this can become so large that a transfer is not possible and / or the storage space of

Detection system is insufficient.

As already described above, it is possible to derive from the state patterns (sequences of states) a simple and space-saving possibility for historical data storage. With the 4-bit information described above (or other bit length information - see above), the timing or message content can be approximated. By transmitting the 4-bit information to a receiving device of a

Monitoring point for the CAN bus system can be an effective storage or

Transmission are allowed.

A message can be composed of several signals. For example, it is shown in FIG. 7 that the message 710 is composed of the plurality of signals A, B, C,. The further messages 720 and 730 at the times t1 and t2 are also transmitted by means of this plurality of signals A, B, C,... Via the CAN bus system. In other words, a plurality of messages are each transmitted via a plurality of signals via the CAN bus system.

When analyzing an attack, it may be helpful to know which signals have been attacked. This information may e.g. about comparing the signals for two

successive messages are received. The method according to the invention can therefore comprise comparing a signal portion of a first of the plurality of signals associated with a message with a signal portion of the first signal assigned to a preceding message. This comparison may be carried out for some or all of the plurality of signals used. Correspondingly, the information transmitted to the monitoring point for the CAN bus system about the attack on the CAN bus system can provide information about a result of the comparison of the message assigned to the message

Signal portion of the first signal with the signal associated with the preceding message signal portion of the first signal. Accordingly, the transmitted

Information about the attack on the CAN bus system also includes information about results of comparisons of the further signals.

This is illustrated in FIG. 7 by way of example for the messages 720 and 730. For the message 720, the CAN bus system information 721 transmitted to the CAN bus system includes state 722 of the message 720 as 4-bit Information and the information 723 on the results of comparisons of the message 720 associated signal sections of the plurality of signals A, B, C, ... with the

Accordingly, the information 731 transmitted to the monitoring point for the CAN bus system via the attack on the CAN bus system for the message 730 includes the state 732 of the message 730 as associated with preceding message 710 4-bit information and the information 733 on the results of comparisons of the signal portions of the plurality of signals A, B, C,... Associated with the message 730 with those associated with the preceding message 720

Signal sections of the plurality of signals A, B, C, ....

The coincidence of two signals (or signal sections) can be e.g. are encoded with a "1" while the mismatch is encoded with a "0" (or vice versa). In other words, the information about the result of the comparison transmitted to the monitoring point for the CAN bus system can be binary information which indicates whether the signal portion of a signal assigned to the message matches the signal portion of the signal assigned to the preceding message. In this way, a data reduction can be achieved. The number of bits required for transmission is determined by the number of signals used to transmit the message.

The state patterns (sequences of states) as well as the comparison information can provide indications of the course of an attack on a particular message content and, in accordance with the principles described in connection with FIG. a control station is reported or stored in the recognition system (i.e., a device implementing the method of the invention).

8 shows an apparatus 800 for detecting an attack on a serial communication system 810. The apparatus 800 comprises a processor circuit 810 which is adapted to connect a respective state of a plurality via the serial

Communication system 820 transmitted messages to obtain a sequence of states. The state of one of the plurality of messages is based on a plurality of attributes of the message and a plurality of characteristics of a preceding message of the plurality of messages, respectively. Further, the processor circuit 810 is configured to compare the sequence of states to at least one reference sequence and to determine that there is an attack on the serial communication system 820 if the sequence of states deviates from the reference sequence. The state classification of a message as well as the comparison of the sequence of states with the at least one Reference sequence through the processor circuitry 810 may be performed very efficiently and with low computational power so that the apparatus 800 may facilitate easy and efficient monitoring of the serial communication system 820.

Further details and aspects of the apparatus 800 are described in conjunction with one or more other embodiments. The device 800 may include one or more optional features according to one or more of the further embodiments.

Finally, FIG. 9 also shows a vehicle 900 including a CAN bus system 920 of the vehicle 900. The vehicle further comprises a device 910 according to the invention for detecting an attack on a serial communication system. Via the device 910, attacks on the CAN bus system 920 of the vehicle 900 can be efficiently and with less

Computing power can be detected.

LIST OF REFERENCE NUMBERS

A method for detecting an attack on a serial communication system 102 determining a respective state

104 comparing the sequence of states

106a Determine that there is an attack

106b Determine that there is no attack

210 message

220 message

230 message

240 message

250 message

260 message

301 Content of a message

302 state

303 sequence of states

310 original message

320 original message

330 original message

340 original message

350 original message

360 original message

370 original message

380 original message

410 inserted message 420 inserted message

430 message inserted

440 embarked message

450 embassy

460 embarked message

470 message inserted

480 inserted message

510 state change

520 Part of a sequence of states

601 message inserted

602 message inserted

603 arrow

604 arrow

610 original message

620 original message

630 original message

640 original message

650 original message

660 original message

670 original message

680 original message

690 original message

710 message

720 message

721 Information about the attack on the CAN bus system

722 State of the message

723 Information about the results of the comparisons 730 message

731 Information about the attack on the CAN bus system

732 State of the message

733 Information about the results of the comparisons

800 Device for detecting an attack on a serial communication system

810 processor circuit

820 serial communication system

900 vehicle

910 Device for detecting an attack on a serial communication system 920 CAN bus system

Claims

claims

A method (100) for detecting an attack on a serial communication system, comprising:

Determining (102) a respective state of a plurality of via the serial

Communication system of transmitted messages to obtain a sequence of states, wherein the state of one of the plurality of messages each on a plurality of

Characteristics of the message and a plurality of attributes of a preceding message of the plurality of messages;

Comparing (104) the sequence of states with at least one reference sequence; and

Determining (106a) that an attack on the serial communication system exists if the sequence of states deviates from the reference sequence.

The method of claim 1, wherein the state of the message is based on at least a first comparison of a content of the message with a content of the preceding message and a second comparison of the time difference between a beginning of the message and a beginning of the preceding message with a comparison value ,

3. The method of claim 1 or claim 2, wherein comparing (104) the sequence of states having at least one reference sequence comprises:

Incrementing a counter when a first condition occurs within the sequence of states;

Resetting the counter to an output value when a second state occurs within the sequence of states; and

Determining that the sequence of states deviates from the reference sequence when the counter exceeds a threshold.

4. The method of claim 3, further comprising:

Comparing a subset of the sequence of states with at least one second one

Reference sequence, wherein the portion of the sequence of states includes only states other than the second state; and

Determining that an attack on the serial communication system exists if the portion of the sequence of states deviates from the second reference sequence.

5. The method according to any one of claims 1 to 4, wherein the method further comprises:

Comparing the content of a first message of the plurality of messages with the content of a second message of the plurality of messages, wherein the state of the first message equals the state of the second message, and wherein between the first and second messages at least one third message having a is transmitted from the state of the first message different state via the serial communication system; and

Determining that an attack on the serial communication system exists if the content of the second message equals the content of the first message.

6. The method according to any one of claims 1 to 5, wherein the method comprises:

Sending a message to a receiving device of a monitoring point for the serial communication system when it is determined that an attack on the serial

Communication system is present, wherein the message includes information about the attack on the serial communication system.

The method of claim 6, wherein the serial communication system attack information includes information about at least a portion of the sequence of states.

The method of claim 6 or claim 7, wherein the plurality of messages are each transmitted over a plurality of signals via the serial communication system, the method further comprising comparing a signal portion associated with the message of a first one of the plurality of signals with one of the preceding message assigned Comprises signal portion of the first signal, and wherein the information on the attack on the serial communication system comprises information about a result of the comparison of the message associated signal portion of the first signal with the signal associated with the preceding message signal portion of the first signal.

The method of claim 8, wherein the information about the result of the comparison is binary information indicating whether the signal portion of the first signal associated with the message matches the signal portion of the first signal associated with the preceding message.

10. The method according to any one of the preceding claims, wherein the serial

Communication system is a controller area network bus system.

1 1. The method of claim 10, wherein the reference sequence is selected depending on a transmission type of the controller area network bus system.

12. The method of claim 10 or claim 11, wherein the comparison value is a first used cycle time, a second used cycle time or a blocking time of the controller area network bus system.

A program code program for performing any of the methods of any one of claims 1 to 12 when the program code is executed on a computer, a processor, or a programmable hardware component.

14. An apparatus (800) for detecting an attack on a serial communication system (820), the apparatus (800) comprising a processor circuit (810) configured to: a respective state of a plurality of messages transmitted via the serial communication system (820) determining to obtain a sequence of states, wherein the state of one of the plurality of messages is based on a plurality of attributes of the message and a plurality of attributes of a preceding message of the plurality of messages, respectively; compare the sequence of states with at least one reference sequence; and determine that an attack on the serial communication system (820) is present if the sequence of states differs from the reference sequence.

15. A vehicle (900) having an apparatus (910) for detecting an attack on a serial communication system according to claim 14, wherein the serial communication system is a controller area network bus system (920) of the vehicle (900).