Patent Grant
11899785
The present application claims the benefit under 35 U.S.C. 119 of German Patent Application No. DE 102020214099.5 filed on Nov. 10, 2020, which is expressly incorporated herein by reference in its entirety.
The present invention relates to a method for detecting an unauthorized physical access to a bus system, as well as an arithmetic-logic unit and a computer program for its implementation.
Programmable control units are used in machines and motor vehicles in order to control them or components thereof. For example, a motor vehicle may contain control units for the engine management, for the brake system, etc. The control units include a microcontroller or processor having one or typically several processor cores which execute programs stored in a memory in order to achieve the functions of the control unit.
The control units may be connected to each other and to further devices, e.g., sensors, via a bus. For example, the CAN (Controller Area Network) bus is widespread, a bus based on differential voltages which transmits data or messages via two bus lines; bus lines and bus users together form a bus system. In order to prevent an attacker which has access to the physical layer, particularly the bus lines, from manipulating the transmitted data or implanting its own data, the data to be transmitted may be encrypted.
However, an attacker should be prevented from gaining access to the physical layer in spite of the encryption, since on one hand, the attacker may eavesdrop on data transmissions and, given a large number of data transmissions, possibly break the encryption, and on the other hand, the attacker may inundate the bus with messages and thus may impair the functioning of the bus system. The latter represents a particular danger in the case of the CAN bus, since in the CAN bus, each message has a specific priority which is specified by the sender and according to which the bus bandwidth is used, that is, only the message having the highest priority is transmitted at any one time. Thus, the attacker could bring the data transmission between control units to a standstill by flooding the bus with messages of high priority.
German Patent Application Nos. DE 10 2017 208 547 A1 and DE 10 2018 208 118 A1 describe methods according to which characteristics, perhaps signal edges, of a transmission of a message via a network are evaluated, the origin of the message being determined or the message being authenticated based on the characteristics.
According to the present invention, a method is provided for detecting an unauthorized physical access to a bus system, as well as an arithmetic-logic unit and a computer program for its implementation. Advantageous refinements and embodiments of the present invention are disclosed herein.
For a test-level sequence detected in the voltage signal of the bus, according to an example embodiment of the present invention, a measuring-signal pattern is compared to a corresponding reference pattern, in doing so, specific properties being checked for deviations outside of certain tolerances. The measuring-signal pattern is formed from a measuring signal which is acquired, for example, by a comparator comparing the voltage signal to the threshold voltage, and the measuring signal having a first state and a second state accordingly. At the very least, the measuring-signal pattern and the reference pattern indicate transitions between the two states and their points in time during a period of time corresponding to the test-level sequence, the reference pattern being formed from a corresponding reference measuring signal which is acquired during a state of the bus system in which it is ensured that no unauthorized access is present.
By using a threshold voltage, which generally differs from the voltage levels that are used according to the bus specification for the data transmission and which in particular lies between the voltage levels used by the bus for the data transmission, disturbances in the voltage signal that are caused by the design of the bus system, e.g., voltage oscillations after an edge in the voltage signal, are able to be detected within one signal-level sequence and utilized for the comparison. This is advantageous, since these disturbances change depending on the specific design of a bus system. They are characteristic for the individual bus system and cannot be foreseen by an attacker. Attacks on the physical layer of the bus system, for example, by an attacker connecting a device to the bus line with the aid of mechanical contacting, are thus detected more easily utilizing the present invention.
According to one preferred embodiment of the present invention, the threshold voltage is changed, that is, is alterable or predefinable by software, for example. It goes without saying that after a change, the corresponding reference pattern should be redetermined. Changing the threshold voltage allows a selection of suitable reference patterns, so that the accesses of all bus users are classified as authorized, particularly when the bus system is changed, e.g., when a new bus user is connected.
The term “signal-level sequence” is intended to denote a specific sequence of levels in the voltage signal, which encodes data or bus-control signals in accordance with the bus specification. Thus, according to the bus specification, a specific meaning may be assigned to a signal-level sequence, e.g., one bit having a specific value or several bits having specific values; it may also be a matter of bus-control signals, for instance, a signal-level sequence which signals the end of a message. Whether and which signal-level sequence is present may generally only be ascertained with the completion of the signal-level sequence. In principle, a signal-level sequence is recognized based on its meaning or specification according to the bus specification.
From among these signal-level sequences, at least one signal-level sequence is selected which is used in the method to check whether possibly an unauthorized physical access to the bus system, more precisely to the physical layer, is present. This signal-level sequence is referred to as “test-level sequence”; advantageously, it involves signal-level sequences utilized during normal communication. Namely, a suitable test-level sequence may already occur during the transmission of a single bit.
The “measuring-signal pattern” and the “reference pattern” correspond to the measuring signal and reference measuring signal, respectively, during the period of time which is assigned to the test-level sequence, for instance, from an initial edge up to a terminating edge of one bit in the voltage signal (see
The tolerances may be indicated as a relative measure, for example, that a time interval between two transitions in the measuring-signal pattern is allowed to deviate by a maximum of a certain percentage (e.g., 10%) from the corresponding time interval in the reference pattern. Likewise, absolute specifications may be indicated, for example, a certain permissible deviation may be specified in nanoseconds or picoseconds. For each test-level sequence, generally a separate tolerance is indicated for each property. The tolerances ensure that small disturbances do not lead to a possible unauthorized physical access being determined mistakenly.
In accordance with an example embodiment of the present invention, preferably, the measuring signal is formed with the aid of a comparator. This has the advantages that it is easy to realize in terms of circuit engineering and permits high speed.
In addition, preferably a timer module is used to record the points in time of the transitions. This makes it possible to determine the points in time with high time resolution.
Moreover, the measuring-signal pattern and, for each test-level sequence, the assigned reference pattern preferably indicates the direction of the transitions. By indicating the directions, certain structures in the measuring-signal pattern such as oscillation valleys or peaks are able to be recognized and checked during the comparison.
For each test-level sequence, preferably the assigned reference pattern includes at least four transitions. This may be achieved by suitable selection or by altering the threshold voltage, so that as a result, the reference patterns determined have the corresponding number of transitions. Since each signal-level sequence typically includes one initial and one final transition, which defines the period of time of the signal-level sequence, transitions may thus be checked which are not included as such in the definition of the signal-level sequence, e.g., disturbances or oscillations caused by the bus system.
The one or more predetermined properties are selected from: a number of transitions; at least one time interval between specific transitions; at least one quotient of two time intervals between specific transitions; and a position of one predetermined transition, e.g., the last transition prior to a stable signal phase. For example, the transitions in the patterns may be determined according to at least one numbering starting from the first transition and/or from the last transition. The direction of the transitions may also be taken into account, for instance, separate numberings for rising transitions (i.e., from the first to the second state) and falling transitions (i.e., from the second to the first state). Since it is inherent in the design that rising and falling transitions always occur in alternation, and normally a first (either rising or falling) transition is predetermined by the data structure, typically a numbering starting from the first transition is sufficient to clearly identify each transition including direction.
In accordance with an example embodiment of the present invention, preferably, the method includes a determination that an unauthorized physical access is present when a message transmitted on the bus system includes multiple test-level sequences, and a possible unauthorized physical access is ascertained for a preset minimum number of these test-level sequences. Random disturbances, which are not caused by the bus system but which may lead to the determination of deviations during the comparison of the patterns, may thus be prevented from leading immediately to the assumption of an unauthorized access.
For at least one test-level sequence, the method preferably includes: Determining the reference pattern assigned to the test-level sequence, in doing so, a voltage signal being generated which includes the test-level sequence; the reference measuring signal, which assumes the first state when the voltage signal lies above the threshold voltage and assumes the second state when the voltage signal does not lie above the threshold voltage, in particular being formed, if given, with the aid of the comparator; and the reference pattern assigned to the test-level sequence being determined based on the reference measuring signal. Thus, in principle, the reference pattern is determined the same way as the measuring-signal pattern, the only difference being that in this case, a reference measuring signal is used which is obtained from a voltage signal (reference-voltage signal) that is present in an un-manipulated state, that is, a state in which no unauthorized physical access is present, e.g., when manufacturing the bus system or the device (motor vehicle, machine) in which it is included.
In addition, preferably the threshold voltage is changed or adjusted prior to determining the reference pattern assigned to the respective test-level sequence, more preferably the change being carried out randomly within a predetermined threshold-voltage range. During series production, for instance during auto manufacturing, a high number of bus systems is produced which have identical or at least very similar electrical properties. If the threshold voltage is the same, this can lead to a large number of (approximately) identical reference patterns, so that an attacker which, undetected by the manipulation detection method, succeeds in gaining access to one of these bus systems, potentially gains access to a large number of identically constructed bus systems. If, in various of these bus systems, the reference patterns are determined with different threshold voltages, the reference patterns are able to be varied between the bus systems. In each of these bus systems, the method for detecting a manipulation attempt must then naturally use the threshold voltages with which the reference patterns were determined. More preferably, in each case, the threshold voltage is altered randomly within a certain range.
Moreover, for at least one test-level sequence, the method preferably includes determining the tolerance for at least one of the properties checked during the comparison, in doing so, each user of the bus system one after the other generating a voltage signal in accordance with the test-level sequence, in each case the measuring signal being acquired for each bus user, based on which the measuring-signal pattern is formed, and a bus-user-specific deviation of the formed measuring-signal pattern from the reference pattern assigned to the test-level sequence being determined; the tolerance being defined in such a way that the bus-user-specific deviations lie within the tolerance, more preferably, the tolerance being defined in such a way that the tolerance is the smallest tolerance allowing the bus-user-specific deviations to lie within the tolerance. In this way, it is ensured that a message of a bus user is not mistakenly recognized as manipulation of the bus system, that is, determined to be an unauthorized physical access.
An arithmetic-logic unit according to an example embodiment of the present invention, e.g., a control unit of a motor vehicle, includes a comparator and is equipped, especially in terms of program engineering, to carry out a method of the present invention. The comparator is furnished to compare the voltage signal to the threshold voltage and to form the measuring signal.
The implementation of a method according to the present invention in the form of a computer program or computer-program product having program code for carrying out all method steps is also advantageous, since the costs it entails are particularly low, especially if an executing control unit is also being used for other tasks and is therefore present in any case. Suitable data carriers for providing the computer program are, namely, magnetic, optical and electrical memories like, e.g., hard disks, flash memories, EEPROMs and DVDs, among others. Download of a program via computer networks (Internet, intranet, etc.) is also possible.
Further advantages and refinements of the present invention are derived from the description and the figures.
The present invention is represented schematically in the figures on the basis of exemplary embodiments, and is described in the following with reference to the figures.
Attacker 8, say a device which likewise has a transceiver or at least a transmitter or receiver, e.g., a so-called OBD plug, has physical access to the bus system and is thus able to connect to lines 4a 4b. Consequently, attacker 8 is able to eavesdrop on messages transmitted over the bus and/or to send messages itself.
In ideal differential-voltage characteristic 30 (
However, the physical layer, that is, bus lines 4a, 4b together with bus users 6, has electrical properties, particularly inductances and capacitances, which interfere with this idealized differential-voltage characteristic. This leads to disturbances such as changes in the steepness of the edges, reflections, oscillations in the voltage characteristic and the like. These disturbances are a function of the precise realization of the physical layer, i.e., the design of an actual bus system (e.g., the length of the lines, the number of users and where they are connected to the lines, electrical properties of the transceivers of the users, etc.). Such an actual differential-voltage characteristic 32 is shown by way of example in
Since the disturbances are dependent on the design of the bus system, they are characteristic for the specific concrete bus system. If a further user or, as in
Provided in the system is a comparator 12 which compares the voltage signal (with which data are transmitted) to a threshold voltage VS. For example, the voltage signal here is differential voltage VD between the two lines 4a, 4b of a CAN bus system. For example, the differential voltage may be obtained with the aid of a differential amplifier 14—which determines the difference between two input signals—from the voltages applied to bus lines 4a, 4b. For buses that do not use differential voltages, the system must obviously be adapted accordingly in order to obtain the voltage signal, which is the input signal for comparator 12. Alternatively (not shown), the voltage signal or differential voltage may also be obtained from a transceiver or receiver 16.
Comparator 12 generates a measuring signal which indicates whether voltage signal VD lies above or below threshold voltage VS. Namely, the measuring signal may assume a first state, e.g., a first measuring-signal voltage, when the voltage signal lies above a certain threshold voltage, and a second state, e.g., a second measuring-signal voltage, when the voltage signal does not lie above the threshold voltage.
The measuring signal is transmitted by comparator 12 to a microcontroller 18 which is furnished to acquire and interpret the measuring signal. In this context, microcontroller 18 determines the points in time of transitions between the first and second state of the measuring signal and the direction of the transitions (first after second state and second after first state, respectively). For this purpose, preferably a timer module 20 (included in the microcontroller) is used, which permits a high-resolution time measurement in the picosecond range. A time resolution of the points in time of the transitions amounts preferably to at least 5 nanoseconds, more preferably at least 100 picoseconds, even more preferably at least 20 picoseconds, most preferably at least 5 picoseconds. Suitable timer modules are described in European Patent No. EP 2 553 540 B1, for example.
Data are transmitted via transceiver 16, for example, which on one hand, converts received data into signals suitable for processing by microcontroller 18 and transmits them to it, or rather, to an interface module 22 there, e.g., a CAN module, and on the other hand, receives data to be transmitted or corresponding signals from interface module 22 and from them, generates voltages on bus lines 4a, 4b which correspond to these data in accordance with the bus specification. Alternatively, instead of a special interface module, a generic module as described, for instance, in German Patent Application No. DE 10 2013 210 182 A1, e.g., likewise timer module 20, may be used.
In this context, specific signal-level sequences correspond to specific data, e.g., one bit which has logical value 1 (see, for instance,
Some or all of the signal-level sequences in the voltage signal known according to the bus specification may be utilized as test-level sequences. For each of these test-level sequences, when the bus system is an unmanipulated state, a reference pattern is determined from the associated reference measuring signal obtained by the comparator, the reference pattern including the points in time of the transitions and their direction in the voltage signal during the test-level sequence. Thus, a reference pattern is assigned to each test-level sequence.
If a test-level sequence is detected in the voltage signal, e.g., on the basis of the data transmitted, then using the comparator and from the measuring signal obtained by it, a corresponding measuring-signal pattern may be obtained that may be compared to the reference pattern (obviously the threshold voltage when acquiring the measuring signal should be the same as when acquiring the reference measuring signal). If, given a suitably selected threshold voltage, deviations are ascertained, then a possible manipulation attempt is present, since the electrical disturbances and therefore the points in time of the transitions may change due to the attacker connected to the bus system.
The determination of the measuring signal for the voltage signal of
The measuring signal in
Various properties may be taken into account in the comparison. A first is the number of transitions (here 6). This number may change in response to stronger or weaker attenuation of the oscillation by an added attacker.
Another property involves time intervals or periods of time between points in time corresponding to each other in the measuring-signal pattern and reference pattern, that is, the difference between two points in time. For instance, difference t5−t0 may be calculated between last point in time t5 and first point in time t0, which represents a total time of the signal-level sequence (here, let us say, equal to tBit). Further possible time states are the durations of the oscillation peaks and/or oscillation valleys in the voltage signal, that is, the time difference ti−ti-1 between two successive points in time (here: oscillation peaks: t2−t1, t4−t3; oscillation valleys: t1−t0, t3−t2). In the same way, for example, the time difference between two successive rising edges (here: t3−t1) or two successive falling edges (here: t4−t2) may be calculated and compared (these differences are a measure for the period or frequency of the oscillation, which is influenced by a change of the inductance or capacitance in the bus system).
A further possibility is the consideration of quotients of time intervals. Here, four or three (if two points in time coincide) different points in time go into the calculation. For example, in the case of an oscillation structure as in
Another possibility is to determine the position of one predetermined transition, e.g., the last transition prior to a stable signal phase, i.e., the end of an initial signal oscillation. By evaluation of the pattern in terms of when a stable signal is present, and comparison to a reference pattern which was stored as reference prior to delivery of the vehicle from the manufacturer, for example, it is possible to detect an unauthorized physical access. For instance, if upon delivery, the signal is stable after 10 samples and this deviates by more than 5 samples during the measurement, an unauthorized physical access is able to be detected.
In optional step 50, first of all the assigned reference pattern is determined for at least one test-level sequence. To that end—for each test-level sequence—a voltage signal, that is, a reference-voltage signal, in which the test-level sequence appears, is generated, for instance, by a bus user. From it, a reference measuring signal is formed (particularly by a comparator) based on which the reference pattern is determined in a period of time corresponding to the test-level sequence. In determining the reference pattern, the procedure is similar to the formation of the measuring-signal pattern, with the difference that it is carried out based on the reference measuring signal which is obtained from the reference voltage signal. The reference pattern(s) is/are stored in a memory, for example, which the microcontroller of
The determination of at least one reference pattern which is assigned to the test-level sequence may include a change of the threshold voltage, so that suitable reference patterns are obtained, that is, reference patterns which, on one hand, do not classify test-level sequences transmitted by bus users as unauthorized accesses, and on the other hand, characterize the corresponding voltage signal sufficiently narrowly to permit detection of attackers. This determination of at least one reference pattern may likewise include a definition of the tolerances.
In step 52, the measuring signal is formed, which records whether the voltage signal lies above the threshold value or does not lie above the threshold value. Preferably, the measuring signal is formed with the aid of a comparator. The voltage signal here is that with which data are transmitted over the bus during the operation. The measuring signal assumes two states, depending on whether the voltage signal does or does not lie above the threshold value.
The voltage signal is thereupon checked as to whether a test-level sequence is occurring, that is, which is detected in the voltage signal, step 54. The test-level sequence extends over a certain period of time in the voltage signal.
If the test-level sequence was detected, in step 56, a measuring-signal pattern is formed which is based on the measuring signal during the period of time corresponding to the test-level sequence (the period of time over which the test-level sequence extends). The measuring-signal pattern is formed so that, just like the reference pattern determined in step 50, it indicates at least the points in time of transitions between the two states in the measuring signal.
In step 58, the measuring-signal pattern is compared to the reference pattern, during the comparison it being checked whether certain properties of the two patterns are the same or different. If it is ascertained during the comparison that in one or more predetermined properties, the measuring-signal pattern and the reference pattern differ from each other by more than a specific tolerance, then in step 60, a possible unauthorized physical access is determined. If it is ascertained that the measuring-signal pattern and reference pattern do not differ within the tolerances, then in step 60, it is assumed that no unauthorized physical access is present. In this case, it is possible to jump back again to step 54 (detection of a test-level sequence), and the method may be repeated from there for further test-level sequences.
If an unauthorized physical access is determined, suitable actions may be taken, for example, the message in which the questionable test-level sequence was contained may be discarded. In addition, a warning may be sent in which perhaps an operator or another device is cautioned that the bus system is possibly being accessed in unauthorized manner. For example, the bus system may then be further analyzed by an expert, for instance, may be examined to ascertain whether structural changes (connection of an attacker to the bus) were made.
| Number | Date | Country | Kind |
|---|---|---|---|
| 102020214099.5 | Nov 2020 | DE | national |
| Number | Name | Date | Kind |
|---|---|---|---|
| 5226137 | Bolan | Jul 1993 | A |
| 9665870 | Rezayee | May 2017 | B1 |
| 11709971 | Aue | Jul 2023 | B2 |
| 20120216301 | Erickson | Aug 2012 | A1 |
| 20140013425 | Samson | Jan 2014 | A1 |
| 20180181500 | Shappir | Jun 2018 | A1 |
| 20210034745 | Ruvio | Feb 2021 | A1 |
| 20220138350 | Aue | May 2022 | A1 |
| 20220147621 | Aue | May 2022 | A1 |
| 20220394053 | Sorani | Dec 2022 | A1 |
| Number | Date | Country |
|---|---|---|
| 102013210182 | Dec 2014 | DE |
| 102017208547 | Nov 2018 | DE |
| 102018208118 | Nov 2019 | DE |
| 2553540 | Jun 2013 | EP |
| 2011120823 | Jun 2011 | WO |
| WO-2022093180 | May 2022 | WO |
| Number | Date | Country | |
|---|---|---|---|
| 20220147621 A1 | May 2022 | US |
