Patent Application
20230256940
The present application relates to a controller and method to determine whether a housing of the controller has been subject to an unauthorized opening.
Controllers are used in many electronic vehicle systems, including air brake systems such as anti-lock braking, stability control and adaptive cruise control. While some controllers may be reprogrammable, they are not generally meant to be remanufactured. End users who open the controller housing could be contaminating the sensitive circuitry. A person with malevolent intent may be trying to tap into the microcontroller to download proprietary code. Therefore, there is interest in determining whether a housing of a controller has been improperly tampered with and preventing access to the circuitry of the controller.
In accordance with one embodiment, a tamper detection system for a controller includes a housing, a circuit board mounted in the housing, a voltage input line on the circuit board receiving an operating voltage, a light detection circuit mounted on the circuit board receiving the operating voltage from the voltage input line and a signal conditioning device conditioning the operating voltage and connected to the light detection circuit. The light detection circuit interrupts the operating voltage at the signal conditioning device in response to detecting a source of light having a light value greater than a threshold.
In accordance with another embodiment, a method for disabling a controller in response to unauthorized access includes receiving an operating voltage and powering a light detection circuit and a signal conditioning device of the controller with the operating voltage. The method further includes comparing a light value to a threshold in the light detection circuit, wherein the light detection circuit inhibits the operating voltage from reaching the signal conditioning device in response to the light value being greater than the threshold. The controller is thereby disabled.
Referring to
The controller 10 is designed for operations such as antilock braking, stability control or adaptive cruise control for a vehicle and should be subject to troubleshooting only by the manufacturer or an authorized representative. The controller 10 is not designed to be remanufactured or taken apart by an unauthorized person. If there is an unauthorized removal of the housing portion 12 from the connector portion 14, the present inventive system will shut down certain operational aspects of the circuit board 16 so that the system cannot be reverse engineered.
The present invention includes a method of detecting when the housing 12 is not securely enclosing the circuit board 16. The method prevents portions of the circuitry on the circuit board 16 from operating when removed from the housing 12 or if the housing 12 has been compromised.
The operating voltage is first received through the input supply 20 via the connector portion 14. The operating voltage at this stage is typically the vehicle system voltage received when the ignition of the vehicle is activated. The ignition voltage level for a heavy vehicle can range from +12V to +24V. The operating voltage passes through a resistor array 22. The resistor array 22 reduces the operating voltage level.
The operating voltage passes through an input filter 24. The input filter 24 reduces the noise on the operating voltage. The operating voltage is subject to electrical noise from surrounding wires, electromagnetic interference, and other sources. The input filter 24 removes or reduces the noise levels on the operating voltage.
The operating voltage passes through a regulator circuit 26. The regulator circuit 26 reduces the operating voltage further to a voltage usable by the sensitive equipment on the circuit board 16, such as +5V. The regulator circuit 26 may be a linear regulator, a switching regulator, or a low drop out regulator. In a circuit that would use a switching regulator, resistor array 22 and signal conditioning circuit 28 would not be necessary.
The operating voltage also connects to a signal conditioning circuit 28 from the input supply 20. The signal conditioning circuit 28 reduces the input voltage to the regulator circuit 26.
In one example, the signal conditioning circuit 28 and regulator circuit 26 may be combined in one signal conditioning device.
The operating voltage as it leaves the regulator circuit 26 enters an output filter 38. The output filter 38 provides the operating voltage required by the rest of the circuitry on the circuit board 16 at the output supply 40. The output supply voltage is determined by the configuration of the regulator circuit 26. In one example, the output supply voltage is the nominal voltage (e.g., +5V) needed for the microcontroller(s) on the circuit board 16 to operate.
The light based circuitry 30 includes a logic circuit 32, an amplifier or switch 34 and a light sensor 36. The light based circuitry 30 will activate the regulator circuit 26 and the signal conditioning circuit 28. The light based circuitry 30 is powered directly from the input supply 20.
The light based circuitry 30 controls the operation of the regulator circuit 26 and the signal conditioning circuit 28, or of the combined single signal conditioning device.
The light sensor 36 may be any type of sensor or switch that detects light, such as resistive device or an active device like a photodiode or phototransistor. A resistive device offers lower sensitivity compared to an active device and is typically on whenever any level of light is detected. In an example when the light sensor 36 is a switch, as long as the light sensor 36 is “closed”, the regulator circuit 26 and signal conditioning circuit 28 are operating. Based on the response timing of the light based circuitry 30 and the material of housing 12, the appropriate light sensor can be selected. The light sensor 36 will be detecting ambient light and not light from a specific external source or a powered light source on the circuit board 16 itself.
The light based circuitry 30 operates independently of any control or input from a microcontroller or other circuitry on the circuit board in order to provide the tamper detection feature.
The light based circuitry 30 can be in the form of an integrated circuit chip and indistinguishable from dozens of other integrated circuits on the circuit board 16. Only a party authorized to review or troubleshoot the board will know which circuit chip or individual light sensor 36 has to be “covered” or “jumped” before legitimate troubleshooting can begin. The circuit or sensor must remain in the low or “closed” state in order to allow the regulator circuit 26 and signal conditioning circuit 28 to operate. When the circuit board 16 is powered but the housing 12 is removed, the circuit or sensor must not be exposed to any source of light in order for the controller 10 to operate. The light based circuitry 30 may also include internal traces on the circuit board 16 to make it more difficult for any unauthorized user to bypass the light based circuitry 30.
Therefore, a tamper detection system for a controller includes a housing, a circuit board mounted in the housing, a voltage input line on the circuit board receiving an operating voltage, a light detection circuit mounted on the circuit board receiving the operating voltage from the voltage input line and a signal conditioning device conditioning the operating voltage and connected to the light detection circuit. The light detection circuit interrupts the operating voltage at the signal conditioning device in response to detecting a source of light having a light value greater than a threshold.
If the luminosity is greater than the threshold, tampering is detected as in step 58. The threshold may be set at zero, for example. However, the threshold may be pre-set by the manufacturer at a different level, such as when a sensor is used rather than a switch. The threshold can be adjustable by the modifying the light based circuitry 30. In another example, the threshold can be defined to be greater than the amount of ambient lightning expected inside the enclosure in a normal operating condition. Some enclosures are not sealed perfectly against the possible penetration of light, but still provide adequate sealing against environmental factors. Based on the types of enclosure and the users' needs, the threshold can be defined by the type of sensor selected and by changing the gain of the amplifier so that there is not an interruption of the power circuit under normal operating conditions.
In step 60, the light based circuitry 30 interrupts the normal operation of the regulator circuit 26 and the signal conditioning circuit 28 by interrupting the power supplied to the regulator circuit 26 and signal conditioning circuit 28 as described in
In another example, a plurality of light sensors 36 may be used in different locations on the circuit board 16 in order to better sense the change in light. The position of the light sensor(s) 36 on the circuit board 16 is important so that ambient light can be detected quickly after the housing 12 is removed from the circuit board 16.
If the input supply 20 is not available when the housing 12 is removed from the circuit board 16, the light sensor 36 will not work. However, if the circuit board 16 is powered up in the open housing state, then the light sensor 36 will prevent the regulator circuit 26 and signal conditioning circuit 28 from providing the operating voltage downstream.
This design may also detect when the housing 12 is damaged and allowing ambient light to enter the circuit board space but may not be damaged in a manner visible to the naked eye. Even small breaches in the housing 12 may allow water or contaminants to enter the circuit board space and damage the sensitive components. In this instance, the light based circuit 30 would prevent the operating voltage from being received by downstream circuits and the controller 10 would not be operational. When a light sensor 36 that is capable of measuring differing levels of light is used, then a determination can be made whether the entire housing 12 has been removed or whether there is a small breach in the housing 12.
The light based circuit 30 will continue to operate even after the initial power up cycle of the controller 10. The controller 10 is capable of tracking the interruption of the power such that the memory contents can be saved. In another example, the time at which the luminosity is greater than the threshold may be stored in a memory location by the light based circuitry 30. The time can be used to determine a failure of the housing 12 itself or to document the unauthorized access attempt.
Therefore, a method for disabling a controller in response to unauthorized access includes receiving an operating voltage and powering a light detection circuit and a signal conditioning device of the controller with the operating voltage. The method further includes comparing a light value to a threshold in the light detection circuit, wherein the light detection circuit inhibits the operating voltage from reaching the signal conditioning device in response to the light value being greater than the threshold. The controller is thereby disabled.
While the present invention has been illustrated by the description of example processes and system components, and while the various processes and components have been described in detail, applicant does not intend to restrict or in any way limit the scope of the appended claims to such detail. Additional modifications will also readily appear to those skilled in the art. The invention in its broadest aspects is therefore not limited to the specific details, implementations, or illustrative examples shown and described. Accordingly, departures may be made from such details without departing from the spirit or scope of applicant's general inventive concept.
