FR3102269A1 - Method and device for detecting an intrusion on a vehicle data bus - Google Patents

Abstract

The invention relates to a method and a device for detecting an intrusion on a data bus (100). To this end, a value taken by a counter included in messages transmitted periodically on the data bus (100) is determined by a computer (11). The messages are advantageously identified via the same identifier, the value of the counter being incremented by 1 on each transmission of a message. The counter takes a first value for a first message indicating the start of initialization of the counter and the counter takes a second value for a second message indicating the end of the initialization of the counter. A counter initialization time is greater than the message period. An intrusion on the data bus is detected by a device (10) by monitoring the values taken by the counter included in the messages transmitted on the data bus (100). Figure for the abstract: Figure 1

Description

Method and device for detecting an intrusion on a data bus of a vehicle

The invention relates to methods and devices for detecting intrusion on a data bus of a vehicle, in particular of the automobile type. The invention also relates more particularly to a method and a device for detecting one or more messages transmitted by a malicious device on a data bus of a vehicle.

Technology background

Contemporary vehicles carry a number of computers, each performing one or more functions, such as, for example, the management of driving assistance, traction control, electronic brake distribution or even the control of actuators to ensure the operation optimal for a combustion engine. These computers are interconnected via a multiplexed data bus of the CAN type (from the English "Controller Area Network" or in French "Réseau de Contrôleurs") or CAN FD (from the English "Controller Area Network Flexible Data-Rate or in French "Flexible Data Rate Controller Network"), the set of data buses and computers forming the vehicle's on-board system. These computers are also called UCE ("Unit of Electronic Control" or in English ECU "Electronic Control Unit"). These computers embed software which is executed to ensure the functions for which they are responsible.

The transmission of malicious messages by a device such as an electronic unit or by malware-type software introduced into one of the on-board system computers is used to hack or disrupt data exchanges between the on-board system computers. This or these malicious messages are potentially dangerous for the safety of the vehicle, the introduction of such malicious messages could cause malfunctions of the computers using the data contained in these messages.

An object of the present invention is to detect the introduction of malicious messages on a data bus of a vehicle, for example automobile.

Another object of the invention is to improve the security of data exchanges between computers connected by a data bus of a vehicle.

According to a first aspect, the invention relates to a method for detecting an intrusion on a data bus of a vehicle, the method comprising the following steps:

- determination of a value taken by a counter included in each message of a set of periodic messages transmitted on the data bus by a computer, the periodic messages of the set being identified by the same identifier, the value of the counter being incremented by 1 on each successful transmission of a message from the set, the counter having a first value determined for a first message from the set indicating a start of initialization of the counter, the counter having a second value determined for a second set message indicating completion of counter initialization, wherein a counter initialization time is greater than a set message period;

- detection of an intrusion on the data bus according to the value taken by the counter included in each message and according to a counter initialization time.

According to a variant, an intrusion is detected on the data bus when the difference between the values taken by the counter of two temporally successive messages is different from 1 apart from the initialization of the counter.

According to another variant, an intrusion is detected on the data bus when the time interval between a reception of the first message and a reception of the second message is less than the initialization duration.

According to yet another variant, an intrusion is detected on the data bus when the value taken by the counter of a message received immediately after the second message is different from the first value or from a determined third value.

According to another variant, no intrusion is detected on the data bus when the value taken respectively by the counter of several messages received successively during the initialization period is equal to the first value.

According to an additional variant, no intrusion is detected on the data bus when the difference between the values taken by the counter of two temporally successive messages is equal to 1.

According to a second aspect, the invention relates to a device for detecting an intrusion on a data bus of a vehicle, the device comprising a memory associated with a processor configured for the implementation of the steps of the method according to the first aspect of the invention.

According to a third aspect, the invention relates to a data bus comprising the device as described above according to the second aspect of the invention and one or more computers.

According to a fourth aspect, the invention relates to a vehicle, for example of the automobile type, comprising a device as described above according to the second aspect of the invention or a data bus as described above according to the third aspect of the invention.

According to a fifth aspect, the invention relates to a computer program which comprises instructions adapted for the execution of the steps of the method according to the first aspect of the invention, this in particular when the computer program is executed by at least one processor.

Such a computer program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

According to a sixth aspect, the invention relates to a computer-readable recording medium on which is recorded a computer program comprising instructions for the execution of the steps of the method according to the first aspect of the invention.

On the one hand, the recording medium can be any entity or device capable of storing the program. For example, the medium may comprise a storage means, such as a ROM memory, a CD-ROM or a ROM memory of the microelectronic circuit type, or even a magnetic recording means or a hard disk.

On the other hand, this recording medium can also be a transmissible medium such as an electrical or optical signal, such a signal being able to be conveyed via an electrical or optical cable, by conventional or hertzian radio or by self-directed laser beam or by other ways. The computer program according to the invention can in particular be downloaded from an Internet-type network.

Alternatively, the recording medium may be an integrated circuit in which the computer program is incorporated, the integrated circuit being adapted to execute or to be used in the execution of the method in question.

Brief description of figures

Other characteristics and advantages of the invention will emerge from the description of the non-limiting embodiments of the invention below, with reference to the appended figures 1 to 6, in which:

schematically illustrates a data bus of a vehicle, according to a first particular embodiment of the present invention;

schematically illustrates a data bus of a vehicle, according to a second particular embodiment of the present invention;

schematically illustrates a message transmitted on the data bus of FIG. 1 and/or of FIG. 2, according to a particular embodiment of the present invention;

schematically illustrates the values taken by a counter included in the message of FIG. 3, according to a first particular embodiment of the present invention;

schematically illustrates a device configured to detect an intrusion on the data bus of FIG. 1 and/or of FIG. 2, according to a particular embodiment of the present invention;

illustrates a flowchart of the different steps of a method for detecting an intrusion on the data bus of FIG. 1 and/or of FIG. 2, according to a particular embodiment of the present invention.

A method and a device for detecting an intrusion on a data bus of a vehicle will now be described in the following with reference to FIGS. throughout the following description.

According to a particular and non-limiting embodiment of the invention, a method for detecting an intrusion on a data bus, for example of the CAN type (from the English "Controller Area Network" or in French "Réseau de Contrôleurs ") or CAN FD (from the English "Controller Area Network Flexible Data-Rate" or in French "Réseau de Contrôleurs à Flow de Data Flexible"), of a vehicle includes the determination of a value taken by a meter of each message of a set of periodic messages transmitted on the data bus by a computer. The periodic messages are advantageously identified via the same identifier, the value of the counter being incremented by 1 on each successful transmission of a message having the same identifier. The counter advantageously takes a first value determined for a first message indicating a start of initialization of the counter and the counter advantageously takes a second value determined for a second message indicating the end of initialization of the counter. A counter initialization duration is advantageously greater than the period of the periodic messages. An intrusion on the data bus is finally detected by monitoring the value or values taken by the counter included in the messages transmitted on the data bus, knowing the initialization time of the counter.

The use of a counter incrementing in a determined manner and taking particular values at the start and end of initialization allows a device configured to monitor the messages transmitted on the data bus to detect a message introduced on the data bus by a malicious device.

schematically illustrates a data bus 100 of a vehicle, according to a first particular and non-limiting embodiment of the present invention.

The data bus 100 advantageously corresponds to a multiplexed type data bus connecting several computers C1 11, C2 12 and C3 13. A device D 10 configured to detect one or more intrusions on the data bus 1 is also connected to the computers 11 to 13 via the data bus 100. The device 10 corresponds for example to an intrusion detection system, called IDS (from the English "Intrusion Detection System"). The assembly formed by the data bus 100, the computers 11 to 13 and the device 10 form all or part of an on-board system of the vehicle, for example a motor vehicle. The number of computers 11 to 13 is however not limited to 3 and extends to any number, for example 2, 5, 10, 100 or more computers.

The data bus is for example of the CAN type as defined in the ISO 11898 standard or of the CAN FD type as defined in the ISO 11898-1 standard. The data bus 100 advantageously implements time-division multiplexing allowing the computers 11 to 13 to transmit messages (also called data frames) in turn. The messages sent can be of several types depending on the data they transport, each type of message being identified by a determined and particular identifier. As will be described in more detail in Figure 3, a counter is included in the messages, or at least for the messages of one or more determined types. A counter is then associated with a given first type of message identified via a unique identifier, i.e. the value of the counter associated with this first type of message is only incremented when a message of this first type is successfully transmitted on the data bus, for example by a particular computer of this data bus. If a counter is included in messages of a second type different from the first type, then the counter of these messages of the second type is only incremented when a message of the second type is successfully transmitted on the data bus 100. The counter of messages of the first type and the counter of messages of the second type are therefore independent of one another, in particular with regard to the incrementation of these counters.

By way of illustration, it will be considered that the computer 11 transmits periodic messages on the data bus 100, these periodic messages comprising a counter and are of a determined type identified by a determined and unique identifier. The messages are said to be periodic in that they are transmitted at regular intervals (one period) by the computer 11, for example every 10, 20, 30 ms. To allow the device 10 to detect an intrusion on the data bus, rules for incrementing the values taken by the counter are put in place, these rules being known to the computer 11 and to the device 10, and possibly to the other computers 12 and 13 from the data bus. The counter uses for example 1 byte (i.e. 8 bits) of each periodic message. The counter can thus take 255 values, coded from 0 to 255 (or equivalently from 00 to FF in hexadecimal notation). Of course, the counter can use a number of different bits, for example 10 bits which would allow the counter to take 1024 values. The rules for incrementing the counter associated with the messages identified by the determined and unique identifier include the following rules:

- the value of the counter is incremented by 1 with each successful transmission of a message of the determined type on the data bus 100;

- at the start of initialization of the counter (for example triggered by the initialization of the computer transmitting the messages, for example the computer 11), the computer 11 transmits a first message comprising a counter value equal to a first determined value, for example EF; transmission of this message determines the start of the counter initialization phase;

- During the counter initialization phase, the computer 11 may optionally transmit one or more first messages each comprising a counter value equal to the first determined value, for example FE;

- at the end of initialization of the counter (the initialization duration being determined and known to the computer 11 and the device 10), the computer 11 transmits a second message comprising a counter value equal to a second determined value, for example FF.

The initialization time of the counter is advantageously greater than the period of the periodic messages which include this counter, that is to say that the initialization time is greater than the time interval between the transmission of 2 identified periodic messages by the same identifier. This initialization duration is advantageously less than 254 times the period (according to the example in which the counter is coded on 8 bits).

In a first operation, the device 10 which monitors the transmission of messages on the data bus 100 receives several messages identified by the same identifier. The device 10 determines the value taken by the counter of each message received.

In a second operation, the device 10 determines whether or not an intrusion has taken place upon receipt of each message transmitted on the data bus and identified via the same identifier. An intrusion is detected from the value taken by the counter included in each message, knowing the initialization duration and the rules for incrementing the counter.

An intrusion is detected by device 10 in one or more of the following cases:

- when, outside the initialization period of the counter detected by the reception of a first message with a counter value equal to the first value, for example FE, the difference in the value taken by the counter of 2 messages received successively is different from 1;

- when the time duration between the reception of a first message having a counter value equal to the first value (for example FE) and the reception of a second message having a counter value equal to the second value (for example FF ) is less than the initialization time of the counter;

- when the value of the counter of a message received immediately after the reception of a second message having a counter value equal to the second value (for example FF) is different from the first value (for example FE) and a third value corresponds to the value taken by the counter when it begins the series of incrementation (for example 00).

Conversely, no intrusion is detected by device 10 in one or more of the following cases:

- when the difference in the value taken by the counter of 2 messages received successively is equal to 1;

- when several messages received successively have a counter whose value is the first value (for example FE), corresponding for example to several successive initializations of the counter.

By way of example, the following sequences of values taken by the counter do not generate an intrusion detection:

- FE … FE FF 00: several initializations followed by an end of initialization (the duration between the end of FF initialization and the last start of FE initialization being less than the initialization duration) and a new series number of counter increments starting with 00

- FE … FE FF FE … FE FF 00: corresponding to the case where an initialization of the counter is carried out just after an end of initialization marked by FF, respecting for each sequence a duration between the end of initialization FF and the last start initialization time FE being less than initialization time;

- XX FE … FE FF 00, where XX corresponds to any value different from FE or FF, corresponding to an initialization of the counter after a message including a counter at ‘XX’.

Such a process thus allows the device 10 to detect a malicious intrusion of a message copying a message previously transmitted by a computer, for example the computer 11, and additionally comprising dangerous data for one or more of the computers 11 to 13 and the vehicle's on-board system. Since the malicious device does not know the rules for incrementing the counter, it cannot generate a message that complies with the rules described above.

According to a variant embodiment, the data bus 100 corresponds for example to a bus of the FlexRay type (according to the ISO 17458 standard) or Ethernet (according to the ISO/IEC 802-3 standard).

schematically illustrates a data bus 100 of a vehicle, according to a second particular and non-limiting embodiment of the present invention.

The difference between the example of Figure 2 and that of Figure 1 lies in the fact that in the example of Figure 2, the intrusion detection system 231 is integrated into one of the computers, for example the computer C3 23 According to this example, the detection system 231 corresponds for example to a software module integrated into the computer 23.

The process for detecting an intrusion or a lack of intrusion described with regard to FIG. 1 is identically applicable in the case of an embodiment corresponding to that of FIG. 2.

schematically illustrates the structure 3 of a periodic type message transmitted on the data bus 100 by a computer of the on-board system of a vehicle, according to a particular and non-limiting example embodiment of the present invention.

According to the illustrative example of Figure 3, only part of the fields of the message (also called data frame) are described or represented, in particular those related to the object of the present invention.

The message includes as follows:

- a first field 31 corresponding to a start of message or start of frame, called SOF (from the English "Start Of Frame"), comprising for example 1 bit;

- a second field 32 corresponding for example to an arbitration field, also called an identifier field, and comprising the identifier of the type of message, this field comprising for example 12 or 32 bits; this field advantageously serves as an identifier for the data or types of data transported in the message, i.e. in the part called the data field;

- third fields 33 to 36 forming the data field and comprising in particular the counter and the useful data of the messages; these fields 33 to 36 each comprise for example 8 bits; the message counter is for example included in the first of these fields, i.e. field 33, and the useful data in the other fields, i.e. fields 34, 35 and 36; in another example, the counter is included in the last of these fields, i.e. field 36; alternatively, there are more than 4 data fields, for example 8 data fields;

- A fourth field 37 corresponding to an end of message or end of frame, called EOF (from the English "End Of Frame"), comprising for example 7 bits.

The message also optionally includes other fields not described or not shown in Figure 3, such as for example a command field (for example on 6 bits), a CRC field (from the English "Cyclic Redundancy Check" or in French "Verification de redundancy cyclic") and/or an acknowledgment field.

schematically illustrates a sequence 4 of values taken by a counter associated with a set of messages identified by the same identifier, according to a particular and non-limiting embodiment of the present invention.

FIG. 4 illustrates the values of the counter (in ordinates) as a function of time (in abscissa). At t ₀ , a first message is transmitted with a counter value equal to FE. This event corresponds for example to an initialization of the counter or to a start of the computer leading ultimately to a start (or an initialization of the counter). At the end of the initialization, that is to say at a time t1, a following message (called second message) is transmitted with a counter value equal to FF, marking the end of the initialization of the counter. The duration between t0 and t1 corresponds to the initialization duration of the counter. The message following the message with the counter at FF has a counter value of 00, which corresponds to the start of the counter increment sequence. The counter is incremented with each message successfully transmitted on the data bus until it reaches the value FD then resumes at 00. The counter then reaches for example a value 'XX' between 00 and FD before an initialization of the counter starts at t ₂ , materialized by the transmission of a message with a counter at FE. At t ₃ , another message with a counter at FE is transmitted, signifying for example that a new initialization of the counter is launched. Finally, at t ₄ a message with a counter at FF is transmitted signifying the end of initialization, the duration between t ₃ and t ₄ being equal to the initialization duration.

Of course, the values of the counters are provided for illustrative purposes only, the counter can take other values (for example 00 for a start of initialization, 01 for an end of initialization and between 02 and FF for one of the messages out initialization).

schematically illustrates a device 5 configured to detect an intrusion on the data bus 100, according to a particular and non-limiting embodiment of the present invention. Device 5 corresponds for example to device 10 or to system 231.

The device 5 is for example configured for the implementation of the operations described with regard to FIG. 1 and/or the steps of the method described with regard to FIG. 6. The elements of the device 5, individually or in combination, can be integrated in a single integrated circuit, in several integrated circuits, and/or in discrete components. The device 5 can be made in the form of electronic circuits or software (or computer) modules or else a combination of electronic circuits and software modules. According to different particular embodiments, the device 5 is coupled in communication with other similar devices or systems, for example via a communication bus or through dedicated input/output ports.

The device 5 comprises one (or more) processor(s) 50 configured to execute instructions for carrying out the steps of the method and/or for executing the instructions of the software or software embedded in the device 5. The processor 50 can include integrated memory, an input/output interface, and various circuits known to those skilled in the art. The device 5 further comprises at least one memory 51 corresponding for example to a volatile and/or non-volatile memory and/or comprises a memory storage device which can comprise volatile and/or non-volatile memory, such as EEPROM, ROM, PROM, RAM, DRAM, SRAM, flash, magnetic or optical disk.

The computer code of the on-board software or software comprising the instructions to be loaded and executed by the processor is for example stored on the first memory 51.

According to a particular embodiment, the device 5 comprises a communication interface 53 which makes it possible to establish communication with other devices (such as the computers of the on-board system and connected to the data bus) via a communication channel 530. The communication interface 53 corresponds for example to a transmitter configured to transmit and receive information and/or data via the communication channel 530. The communication interface 53 corresponds for example to a CAN-type wired network (of the 'English "Controller Area Network" or French "Réseau de Contrôleurs") or CAN FD (from English "Controller Area Network Flexible Data-Rate" or French "Réseau de Contrôleurs à Flow de Data Flexible").

According to an additional particular embodiment, the device 5 can provide output signals to one or more external devices, such as a display screen, one or more loudspeakers and/or other peripherals respectively via interfaces output not shown.

illustrates a flowchart of the different steps of a method for detecting an intrusion on a data bus of a vehicle, according to a particular and non-limiting embodiment of the present invention. The method is for example implemented by the device 10, the system 231 or by the device 5 of figure 5.

In a first step 61, the value taken by a counter included in each message of a set of periodic messages transmitted on the data bus by a computer is determined. The periodic messages of the set are advantageously identified by the same identifier, the value of the counter being incremented by 1 on each successful transmission of a message on the data bus. The counter advantageously takes a first value determined for a first message of the set indicating a start of initialization of the counter. The counter advantageously takes a second value determined for a second message of the set indicating an end of initialization of the counter. The initialization time of the counter is advantageously greater than one period of the periodic messages.

In a second step 62, an intrusion on the data bus is detected according to the value taken by the counter included in each message and according to a counter initialization time.

Of course, the invention is not limited to the embodiments described above but extends to a method for monitoring and/or controlling a data bus and to the device configured for implementing the method.

The invention also relates to a vehicle, for example an automobile or more generally a land motor vehicle, comprising the device 5 of FIG. 5.

Claims (10)

Method for detecting an intrusion on a data bus (100) of a vehicle, said method comprising the following steps:
- determination (61) of a value taken by a counter (33) included in each message of a set of periodic messages transmitted on said data bus (100) by a computer (11), the periodic messages of said set being identified by the same identifier, the value of said counter being incremented by 1 on each successful transmission of a message from said set, said counter (33) having a first value determined for a first message from said set indicating a start of initialization of said counter (33 ), said counter (33) having a second value determined for a second message of said set indicating an end of initialization of said counter (33), an initialization duration of said counter (33) being greater than a period of said messages of together ;
- detection (62) of an intrusion on said data bus (100) according to said value taken by the counter (33) included in said each message and according to an initialization time of said counter (33). Method according to claim 1, for which an intrusion is detected on said data bus (100) when the difference between the values taken by said counter (33) of two temporally successive messages is different from 1 apart from the initialization of said counter (33). Method according to claim 1 or 2, for which an intrusion is detected on said data bus (100) when the time interval between a reception of said first message and a reception of said second message is less than said initialization duration. Method according to one of Claims 1 to 3, for which an intrusion is detected on the said data bus (100) when the value taken by the counter (33) of a message received immediately after the second message is different from the first value or a third determined value. Method according to one of Claims 1 to 4, for which no intrusion is detected on the said data bus (100) when the value taken respectively by the counter (33) of several messages received successively during the said initialization period is equal to said first value. Method according to one of Claims 1 to 5, for which no intrusion is detected on the said data bus (100) when the difference between the values taken by the counter (33) of two temporally successive messages is equal to 1. Device (5) comprising a memory (51) associated with at least one processor (50) configured for implementing the steps of the method according to any one of Claims 1 to 6. Data bus comprising the device according to claim 7 and said computer. Vehicle comprising the device (5) according to Claim 7 or the data bus according to Claim 8. Computer program product comprising instructions adapted for the execution of the steps of the method according to one of Claims 1 to 6, when the computer program is executed by at least one processor.