Apparatus, system, and method for network isolation of a mobile system when the vehicle is in motion

Abstract

An air gap device for isolating a motorized system while a vehicle is in motion can include a housing. The housing can include various input ports and various output ports. The various input ports can include a connection to a safety gateway. The various output ports can include a connection to one or more motorized electronic control units (ECUs). The air gap device can include at least one pair of terminal contacts. The at least one pair of terminal contacts can include a first terminal contact and a second terminal contact. The air gap device can include an air gap embedded in the housing. The air gap can open when the first terminal is not in contact with the second terminal contact. The air gap device can be instructed to open the air gap when it is determined that the vehicle is in motion or will be in motion.

Description

Technical Field

[0001] This disclosure relates to an air gap device for network isolation of a motor system when the vehicle is in motion. This disclosure also relates to a system and method for network isolation of a motor system when the vehicle is in motion. Background Technology

[0002] Mobility systems in a motor vehicle can include one or more devices for guiding the vehicle's movement. Today, mobility systems (which at least guide acceleration, braking, and steering) are integrated into one or more electronic control units (ECUs), configured based on instructions obtained through software applications. If these software applications are compromised or hacked, the vehicle can be vulnerable. In this regard, automotive cybersecurity is a challenge for automakers or vehicle manufacturers, as hackers are constantly refining their methods of compromising software applications. Furthermore, deploying software security updates in the field can be challenging for vehicle manufacturers due to restrictions on access to all vehicle groups. Traditionally, access has been achieved through owner notifications, dealer networks, and more recently, over-the-air updates. Even with these methods, the task is arduous. While software applications can be protected with techniques such as firewalls, asymmetric encryption, and intrusion detection systems, skilled hackers may eventually find ways to penetrate the network connections associated with the software applications. Finally, while third-party devices can defend network connections to monitor and block inappropriate traffic, these devices act only as additional firewalls or filters, limiting traffic by defining which devices can communicate with the vehicle. Summary of the Invention

[0003] An air gap device for isolating a networked motor system while a vehicle is in motion includes a housing. The housing includes various input ports and various output ports. The input ports include connections to a security gateway. The output ports include connections to one or more motor electronic control units (ECUs). The air gap device includes at least one pair of terminal contacts. The at least one pair of terminal contacts includes a first terminal contact and a second terminal contact. The air gap device includes an air gap embedded in the housing. The air gap closes when the first terminal contact contacts the second terminal contact. The air gap opens when the first terminal contact is not in contact with the second terminal contact. The air gap device is instructed to open when it is determined that the vehicle is in motion or will be in motion.

[0004] A system for network isolation of a motor system while a vehicle is in motion includes a gateway device. The gateway device is connected to one or more infotainment electronic control units (ECUs), one or more body ECUs, one or more telematics ECUs, or an on-board diagnostic device for the vehicle. The system includes one or more motor ECUs. The one or more motor ECUs include one or more powertrain ECUs, one or more chassis ECUs, and one or more advanced driver assistance system (ADAS) ECUs. The system includes an air gap device. The air gap device includes a housing. The housing includes various input ports and various output ports. The various input ports include connections to a security gateway. The various output ports include connections to one or more motor ECUs. The air gap device includes at least one pair of terminal contacts. The at least one pair of terminal contacts includes a first terminal contact and a second terminal contact. The air gap device includes an air gap embedded in the housing. The air gap closes when the first terminal contact contacts the second terminal contact. The air gap opens when the first terminal contact is not in contact with the second terminal contact. The air gap device is instructed to open when it is determined that the vehicle is in motion or will be in motion.

[0005] A method for isolating a motor system while a vehicle is in motion includes obtaining the vehicle's state via a gateway device. The vehicle state indicates whether the vehicle is currently in motion or about to move. The method includes determining the state of an air gap device by multiple motor electronic control units (ECUs). This state indicates whether the air gap device is in a safe state. The method includes confirming whether the vehicle is in motion by multiple motor ECUs. The method includes confirming connectivity level requirements by multiple motor ECUs based on the vehicle state. The method includes determining safety level requirements based on the connectivity level requirements. The method includes generating an air gap command indicating whether to enable or disable the air gap based on the determined safety level requirements.

[0006] Other aspects of this disclosure will become apparent from the following description and the appended claims. Attached Figure Description

[0007] Specific embodiments of the disclosed technology will now be described in detail with reference to the accompanying drawings. For consistency, the same elements in the figures are indicated by the same reference numerals.

[0008] Figure 1 A schematic diagram of an air gap device according to one or more embodiments is shown.

[0009] Figure 2 A schematic diagram of a system including an air gap device according to one or more embodiments is shown.

[0010] Figure 3 A schematic diagram of a system including an air gap device according to one or more embodiments is shown.

[0011] Figure 4 Examples according to one or more embodiments are shown.

[0012] Figure 5 A state diagram according to one or more embodiments is shown.

[0013] Figure 6 A flowchart according to one or more embodiments is shown.

[0014] Figure 7 A computer system according to one or more embodiments is shown. Detailed Implementation

[0015] Numerous specific details are set forth in the following detailed description of embodiments of this disclosure in order to provide a more thorough understanding of the disclosure. However, it will be apparent to those skilled in the art that the disclosure may be practiced without these specific details. In other instances, well-known features have not been described in detail to avoid unnecessarily complicating the description.

[0016] Throughout the application, ordinal numbers (e.g., first, second, third, etc.) may be used as adjectives for elements (i.e., any noun in the application). The use of ordinal numbers does not imply or produce any particular order of elements, nor does it limit any element to merely a single element, unless explicitly stated otherwise, such as by using the terms "before," "after," "single," and other such terms. Rather, ordinal numbers are used to distinguish elements. For example, the first element is different from the second element, and the first element may contain more than one element and is after (or before) the second element in the element order.

[0017] In motor vehicles, attack surfaces that could be used to compromise vehicle subsystems can be protected through cybersecurity systems and methods. These systems and methods may include secure boot, firewalls, public / private key authentication, intrusion detection and prevention systems, and the delivery of security patches and updates. Systems and methods for protecting motor vehicles rely on software applications that provide a security layer over critical vehicle functions. These software applications depend on cryptographic security methods to prevent unauthorized access. In these cases, denial-of-service attacks are based on probability.

[0018] In general, embodiments of the present invention include apparatus, systems, and methods for providing a layered approach to vehicle cybersecurity. In some embodiments, the apparatus reduces the probability of a successful attack and mitigates any consequences of potential unauthorized access by implementing a protective layer via a physical isolation mechanism. More specifically, in one or more embodiments, such an isolation mechanism can create an air gap between any potential attack surface vulnerable to attack vectors and critical mobility systems. A potential attack surface can be a set of interfaces (i.e., “attack vectors” when these interfaces are vulnerable) where an unauthorized user might attempt to input / extract data from the system or modify the system’s behavior. In some embodiments, an attack vector is an interface or path that an attacker can use to exploit vulnerabilities in a communications network. For example, an exploit could involve an open IP port vulnerability on a network that may use various different attack vectors, such as Wi-Fi, cellular networks, or Bluetooth IP. Attack vectors may enable an attacker to exploit system vulnerabilities, including those of the driver or occupants of a motor vehicle.

[0019] In some embodiments, the isolation mechanism is an air gap device. When the air gap device activates the air gap during a maneuvering event, critical maneuvering systems can be isolated, thereby allowing communication with diagnostic systems and over-the-air (OTA) updates at other times. In one or more embodiments, using an air gap device does not significantly alter the vehicle network architecture because the air gap device can be an intermediary that physically separates the convenience domain and maneuvering domain of a motor vehicle.

[0020] In one or more embodiments, the apparatus, system, and method allow connection to a network interface via a firewall when the vehicle is stationary, and then switch to air-gap mode when the vehicle is in motion. In this respect, implementing the apparatus, system, and method can prevent real-time network attack vectors from reaching motion-related systems (i.e., engine, braking, steering) while the vehicle is being driven, thereby preventing attacks while the vehicle is in operation. Network security methods, such as firewalls, public / private keys, authentication, and intrusion detection / prevention, should be maintained so that the apparatus, system, and method can protect against attacks reaching motion-related systems whether the vehicle is in motion or stationary.

[0021] Figure 1 A system configuration for preventing cyberattacks in a communication network 100 of a motor vehicle, according to one or more embodiments, is illustrated. Specifically, the system may include an air-gap device 110 that utilizes a defense system within the communication network 100 to implement a physical layer that prevents unwanted terminal connections from entering the communication network 100. Thus, an attack is any successful connection and allocation of network resources by an unauthorized terminal (not shown). Therefore, attack prevention may include any monitoring, identification, and control of physical connections from terminals attempting to infiltrate the communication network 100. According to one or more embodiments, Figure 1 An air gap device 110 is shown connected to a communication network 100 and located between a convenience domain 175 and a mobility domain 185. The mobility domain 185 may include ports associated with various mobility controls. These controls may be for monitoring and regulating the vehicle's engine, steering system, brakes, cameras, radar devices, or stationary charging mechanism. The convenience domain 175 may include ports associated with various communication controls. These controls may be for monitoring and regulating wireless connections or protocols (i.e., Global Navigation Satellite System (GNSS), AM / FM / HD radio, cellular, Internet, Bluetooth, Near Field Communication (NFC)), wired connections to storage media (i.e., smartphones, USB, CDs, DVDs, or MSDs), secure keyless entry device connections, or tire pressure monitoring systems (TPMS) of the vehicle.

[0022] In one or more embodiments, the air gap device 110 provides network isolation or an air gap for any associated motor domain electronics module (i.e., a motor-related electronic control unit (ECU)). The air gap device 110 can be configured to activate the air gap to physically isolate the motor domain electronics module from the rest of the vehicle's communication network when the vehicle is in a motor mode determined by one or more parameters, such as engine operation, drivetrain engagement, or vehicle movement. The air gap can be a space between two consecutive contact points that are otherwise physically connected. The air gap can be an insulating space that interrupts the continued propagation or transmission of data and commands. In some embodiments, the air gap device 110 can be installed during the manufacturing process of the vehicle such that any vehicle with the air gap device 110 can be considered to have an underlying layer of security, regardless of any additional security protocols, firewalls, or software applications.

[0023] Figure 1 The air gap device 110 is shown to include a housing 150 having various input ports 120a and 120b and various output ports 130a and 130b. The air gap device 110 can be connected between a safety gateway 170 and one or more motor ECUs 180, such that the air gap device 110 can automatically control the physical connection between the safety gateway 170 and the one or more motor ECUs 180. The safety gateway 170 can be a contact point for a convenience domain 175 for a motor vehicle, and the one or more motor ECUs 180 can be fully integrated into the motor control of the motor vehicle. Input ports 120a and 120b can be the physical connection between the safety gateway 170 and the air gap device 110. Output ports 130a and 130b can be the physical connection between the air gap device 110 and the one or more motor ECUs 180.

[0024] Although Figure 1 Arrows are shown pointing from security gateway 170 to one or more motor ECUs 180, but this is only shown to illustrate that security gateway 170 gains access to motor information in the motor ECU 180 in the direction of the arrows. Once the physical connection is established, communication signals 160a and 160b can be exchanged (i.e., exchanged back and forth) between security gateway 170 and one or more motor ECUs 180.

[0025] In one or more embodiments, the physical connection may be implemented via one or more relays (i.e., mechanical or solid-state), which are actuated using one or more control signals 140 received from one or more motion ECUs 180 indicating whether the physical connection is enabled or disabled. These physical connections may include a pair of terminal contacts 111a and 112a or 111b and 112b for each relay. The relays may include opto-isolators 113a and 113b. The first contacts 111a and 111b may be switchable connections corresponding to relay actuation. At this point, when the motion ECU 180 recognizes that the vehicle is in motion or about to begin motion, the motion ECU 180 may automatically instruct the air gap device 110 to open the terminal contact pairs 111a and 112a and 111b and 112b using one or more control signals 140. Thus, when the air gap device 110 is instructed to open the air gap based on one or more control signals 140, and when the terminal contact pairs 111a and 112a and 111b and 112b are separated, the air gap device 110 may include an air gap embedded in the housing 150. Similarly, when the motor ECU 180 recognizes that the vehicle has stopped or is about to stop moving, the motor ECU 180 may use one or more control signals 140 to instruct the air gap device 110 to close the terminal contact pairs 111a and 112a and 111b and 112b.

[0026] The air gap device 110 can physically disconnect the network / data bus between a critical maneuvering system and a non-critical maneuvering system by opening the air gap and establishing a disconnect. The critical maneuvering system is a safety-critical vehicle control system responsible for braking, steering, and propulsion. The air gap device 110 can provide the necessary termination for the network to maintain network integrity (i.e., terminating resistors), allowing both halves of the isolated network to remain functional. The air gap device 110 can be automatically activated by the critical maneuvering system, rather than by the non-critical maneuvering system. In some embodiments, the air gap device 110 can be in a passive / de-energized state, allowing the network to remain unisolated. In some embodiments, the air gap device 110 can be in an active / energized state, allowing the network to be isolated.

[0027] Although the air gap device (110) is in Figure 1The air gap device (110) is shown between the security gateway (170) and the motor ECU (180), but those skilled in the art will understand that the air gap device (110) may be implemented in the security gateway or in one of the motor ECUs without departing from the scope of this document. Furthermore, in one or more embodiments, the air gap device 110 may be deployed at multiple physical locations within the motor vehicle. In some embodiments, elements in the system may be implemented on a single device, wherein various physical layers and corresponding resources are decomposed to provide functionality associated with each element in the system. For example, the air gap device 110 may be a device dedicated to each of the one or more motor ECUs 180, such that each air gap device 110 can be actuated using a unique corresponding control signal 140.

[0028] Figure 2 Various types of communication between elements in a communication network 100, including an air-gap device 110, are illustrated. One type of communication may include desired network connections / communications, such as established or soon-to-be-established communication links shown by solid connecting lines. Another type of communication may include control signals, such as commands shown by dashed connecting lines. (See reference...) Figure 1 The air gap device 110 can separate the vehicle's mobility domain 185 from its convenience domain 175 (indicated by arrows). In some embodiments, the mobility domain 185 may include critical mobility systems (i.e., one or more mobility ECUs 180), such as one or more powertrain ECUs 210, one or more chassis ECUs 220, or one or more advanced driver assistance system (ADAS) ECUs. In some embodiments, the convenience domain 175 may include non-critical mobility systems (i.e., one or more communication systems), such as a security gateway 170, one or more infotainment ECUs 250, one or more body ECUs 260, one or more telematics ECUs, or on-board diagnostics (OBD) 280.

[0029] In one or more embodiments, the security gateway 170 provides data routing between the mobility domain 185 and the convenience domain 175. When the vehicle is not in mobility mode (i.e., not being driven), the air gap device 110 between the security gateway 170 and the communication system can allow data flow between the convenience domain 175 and the mobility domain 185. This can allow functions such as service queries via the OBD port, remote vehicle diagnostics via one or more telematics ECUs 270, and over-the-air (OTA) updates. Furthermore, when one or more powertrain ECUs 210, one or more chassis ECUs 220, and one or more ADAS ECUs 230 determine that the vehicle is in or about to transition to mobility mode, the air gap device 110 can be activated to physically isolate one or more mobility ECUs 170 from the data bus from the security gateway 170 / convenience domain 175.

[0030] Figure 3 A block diagram of a system according to one or more embodiments is shown. Specifically, Figure 3 An example of a motor vehicle 300 is shown, which includes a mobility domain 185 and a convenience domain 175 distributed in various locations. Each location may include a driver's area 310, a passenger area 315, a front area 320, or a rear area 325. The mobility domain 185 and convenience domain 175 may perform reference functions via an air gap device 110. Figure 1 and Figure 2 The physical separation operation described is performed to separate the components. The air gap device 110 can be connected to the motion control module 360, which monitors and controls the movement of the vehicle by tracking the engine module 330, steering module 340, camera and radar module 350, and / or braking module 370. The motion control module 360 ​​may include... Figure 1 The discussion focuses on the motor ECU 180 associated with one or more modules in the motor domain 185. The air gap device 110 can be connected to a communication control module 365, which monitors and controls communications exchanged with the motor vehicle via a wireless communication module 335, a wired communication module 345, and / or a diagnostic module 355. Figure 1 The security gateway 170 discussed herein controls and is associated with one or more modules in the convenience domain 175 of the ECU.

[0031] In one or more embodiments, a module or submodule located at the front of the vehicle may include the same elements mirrored at the rear of the vehicle. In one or more embodiments, the motor vehicle may be divided into different locations, including a driver area 310, a passenger area 315, a front area 320, and a rear area 325.

[0032] The front area 320 and rear area 325 can be any area that passengers cannot access by normal use of the vehicle. Similarly, these areas can include the area below and above the vehicle, under the hood at the front of the vehicle, or in the trunk at the rear of the vehicle. In larger vehicles or vehicles that do not require a conventional engine (such as electric vehicles), this area may be larger. In hatchbacks or vehicles with the back or front exposed to the driver, this area can be considered any area in the front beyond the dashboard or any area behind the rear seats.

[0033] The driver area 310 and passenger area 315 can be any area that any passenger can access at any time through normal use of the motor vehicle. For example, these areas can include any area from the dashboard toward the driver and any area from the rear seats toward the front of the vehicle.

[0034] Although Figure 1-3 Various configurations of the components are shown, but other configurations may be used without departing from the scope of this disclosure. For example, Figure 1-3 Various components can be combined to create a single component (i.e., the safety gateway 170 can be modified to incorporate the air gap device 110). As another example, a function performed by a single component can be performed by two or more components (i.e., the powertrain ECU 210 can be incorporated into the motor ECU 180).

[0035] Figure 4 An example is shown of instructions generated for the air gap device 110 based on information identified by an ECU in the motion domain 185 and / or convenience domain 175. Instructions can be generated using a combination of ECUs in the motion domain 185 and / or convenience domain 175. Similarly, a computing system (see reference 110) communicating with the air gap device 110 via the motion domain 185 can also be used. Figure 7 (Description) Information collected to generate instructions. In some embodiments, vehicle state 410 may initiate the instruction generation process. Vehicle state 410 may collect vehicle motion information 420 from the motion ECU 180 and the security gateway 170. In this regard, vehicle motion information 420 may indicate motion ECU information 412 associated with one or more motion markers of the motion ECU 180. The motion marker may be an indicator displaying the status of the ECU in the motion domain 185. Furthermore, vehicle motion information 420 may indicate gateway status information 414 associated with one or more gateway markers of the security gateway 170. The gateway marker may be an indicator displaying the status of the data bus exchanging communication information from the ECUs in the convenience domain 175.

[0036] Figure 4It is shown that after vehicle motion information 420 is processed, log event recording 430 can use log event information 440 to identify a timestamp for enabling or disabling the air gap in air gap device 110. In some embodiments, obtaining the timestamp may include further identifying event information authentication 432 and air gap device type 434. Once event information authentication 432 and air gap device type 434 are identified, air gap enable / disable command 450 can be prepared. Event information authentication 432 can identify the bus or wired connection port required to reach air gap device 110. Air gap device type 434 can identify the method used to exchange communication signals with air gap device 110 (e.g., the connection port is different between mechanical relays and solid-state relays).

[0037] The air gap enable / disable command 450 can be confirmed using air gap device information 460, which uses connection status 452 and security status 454, respectively, by confirming that the air gap device 110 is correctly connected and securely connected. Once the air gap enable / disable command 450 is confirmed as a possible control parameter, the security gateway 170 confirms that the convenience domain 175 is ready to be disconnected via the air gap. Specifically, the security gateway confirms that the security gateway 170 is ready to be connected / disconnected by coordinating other authentication protocols 472 and the air gap authentication protocol 474. Other authentication protocols 472 may include disabling the wireless communication protocol before enabling the air gap. The air gap authentication protocol 474 may include protocols required to identify the disabling of the air gap to connect the mobility domain 185 and the convenience domain 175. At this point, when the protocol is complete, the ECU / computer system may instruct the execution of the air gap enable / disable command 490 in the air gap device 110.

[0038] Figure 5 An example of a state sequence 500 in a communication network 100 that executes enable / disable commands in one or more embodiments is shown. Figure 5 The automatic processing of closing / opening the air gap based on recognizing the vehicle's motion state 510 or stationary state 530 is illustrated. When the vehicle is identified as being in motion state 510 and has already performed actions such as... Figure 4 When the appropriate protocol is met, the air gap in the air gap device 110 is opened via the air gap activation command 520. Furthermore, when the vehicle is identified as being in a stopped state 530 and has performed actions such as... Figure 4 When the appropriate protocol is met, the air gap in the air gap device 110 is closed by the air gap disable command 540. Changes between various states can be performed automatically and without driver intervention. All control signals to the air gap device 110 can be hardwired or encoded using hardware and / or software, allowing states to transition without interference from a user (e.g., the driver, passenger, or occupant of the motor vehicle).

[0039] Figure 6 A flowchart according to one or more embodiments is shown. Specifically, Figure 6 A method for isolating the motion system from the motion domain 185 when the motor vehicle 300 is in motion is described. Figure 6 One or more boxes in the above can be formed by the following: Figure 1-3 One or more components described herein are used to perform this (e.g., multiple ECUs spanning the mobility domain 185 and the convenience domain 175). Although Figure 6 The boxes in the diagram are presented and described sequentially; however, those skilled in the art will understand that some or all boxes may be executed in a different order, may be combined or omitted, and some or all boxes may be executed in parallel. Furthermore, these boxes may be executed actively or passively.

[0040] In box 600, the vehicle state 410 of the motor vehicle 300 is obtained, indicating whether the motor vehicle 300 is capable of becoming mobile. For example, the motor ECU 180 may collect vehicle mobility information 420 to identify the engine state of the motor vehicle. This vehicle state 410 indicates whether the engine is activated (i.e., running). If vehicle state 410 indicates that the motor vehicle 300 is moving, then the motor ECU 170 indicates that the motor vehicle is in a vehicle motion state 510. That is, box 600 is the initiator that continues to determine the mobility state, and vehicle state 410 (i.e., ignition of the internal combustion engine) is a precursor to determining that the vehicle is moving via the motor ECU 180. In electric vehicles, this would be more generally referred to as powertrain state, indicating "powertrain on" or "powertrain off".

[0041] In block 610, the state of air gap device 110 is determined. The state of air gap device 110 indicates whether air gap device 110 is in a safe state. For example, if the safe state 454 indicates that air gap device 110 is safe according to air gap device information 460, then air gap enable / disable command 450 can be triggered. That is, the safe state indicates whether air gap device 110 is fully functional, diagnostically operable, and / or no fault has been triggered.

[0042] In box 620, various motion parameters corresponding to the motion ECU 180 are identified. Each of the various motion parameters is independent and distinct from the others. The connections of the various motion ECUs can be sampled, and parameters associated with each of them can be identified. These parameters may include the connection status (i.e., on or off) and an identifier indicating whether each motion ECU has completed a disconnection protocol to enable the air gap.

[0043] In box 630, the mobility state is determined based on various mobility parameters. The mobility state is either vehicle motion state 510 or vehicle stationary state 530, such that the mobility state is directly related to the parameters displayed by the mobility ECU 180 indicating that the mobility ECU 180 is ready to disconnect from the security gateway 170.

[0044] In block 640, the connection level requirement is determined based on the motion state from block 630 and the air gap device state from block 610. As described above, the motion state is related to confirming that the motion ECU 180 is ready to send a command to enable the air gap in the air gap device 110. The motion state and the air gap device state result in a connection state 452 being obtained, in order to generate an air gap enable / disable command 450.

[0045] In box 650, safety level requirements are determined based on connection level requirements. At this stage, connection status 452, together with air gap device information 460, is used to further determine safety status 454.

[0046] In block 660, based on security level requirements, an air gap instruction is generated indicating whether to enable or disable the air gap. As described above, the air gap is structurally embedded in the air gap device 110. At this stage, various protocols are established via security gateway certificate 470 and instruction determination information 480. Once the protocols are met, the method moves to executing the enable / disable instruction 490.

[0047] Embodiments of the present invention can be implemented using virtually any type of computing implementation, regardless of the platform used. In some embodiments, the motor ECU 180 may be a computer system located in the motor domain 185 or the convenience domain 175. In some embodiments, the computing system may be a computing device that includes at least minimum processing power, memory, and input and output devices to execute one or more embodiments of the present invention.

[0048] like Figure 7As shown, the computing system 700 may include one or more computer processors 704, non-persistent memory 702 (e.g., random access memory (RAM), cache memory, or flash memory), one or more persistent memory 706 (e.g., hard disk), and many other elements and functions. The computer processor 704 may be an integrated circuit for processing instructions. The computing system 700 may also include one or more input devices 720, such as a touchscreen, keyboard, mouse, microphone, touchpad, electronic pen, or any other type of input device. Furthermore, the computing system 700 may include one or more output devices 710, such as a screen (e.g., liquid crystal display (LCD), plasma display, or touchscreen), external storage, or any other output device. One or more of the output devices may be the same as or different from the input devices. For example, in one or more embodiments, the input device 720 may be coupled to a receiver and transmitter for exchanging communication with one or more peripheral devices connected to the network system 730. The receiver may receive information related to one or more ECUs. The transmitter may forward the information received by the receiver to other elements in the computing system 700. Additionally, the computer processor 704 may be configured to perform or assist in implementing references. Figure 1-5 The process described.

[0049] The computing system 700 may be an ECU in the convenience domain 175 and connected to the network system 730 (e.g., a controller area network (CAN), local area network (LAN), wide area network (WAN), such as the Internet, mobile network, or any other type of network) via a network interface (not shown). The network system 730 may be a cloud-based interface that performs processing at a location remote from the vehicle and connects to other components via a network. For example, the computing system 700 may be an infotainment ECU 250, a body ECU 260, or a telematics ECU 270 in the convenience domain 175 and connected to the network system 730 via a remote connection established using a 5G connection, using protocols established in version 15 and later versions of the 3GPP / New Radio (NR) standard.

[0050] Although Figure 1-7 Various configurations of the components are shown, but other configurations may be used without departing from the scope of this disclosure. For example, Figure 1-3 Various components can be combined to create a single component. As another example, a function performed by a single component can be performed by two or more components.

[0051] While this disclosure has been described with respect to a limited number of embodiments, those skilled in the art who benefit from it will understand that other embodiments can be conceived without departing from the scope of this disclosure. Therefore, the scope of this disclosure should be defined only by the appended claims.

Claims

1. An air gap device for a network-isolated motor system when a vehicle is in motion, the air gap device comprising: The enclosure includes multiple input ports and multiple output ports. The plurality of input ports include connections to a security gateway, and The plurality of output ports include connections to one or more motor electronic control units (ECUs); At least one pair of terminal contacts, Wherein, the at least one pair of terminal contacts includes a first terminal contact and a second terminal contact; and Air gap, embedded in the outer shell, Specifically, when the first terminal contact contacts the second terminal contact, the air gap closes, and Specifically, the air gap opens when the first terminal is not in contact with the second terminal contact. Specifically, when it is determined that the vehicle is moving or about to move, the air gap device is instructed to open the air gap. When the vehicle is in motion, the plurality of motor ECUs instruct the activation of the air gap, and When the vehicle stops, the plurality of motor ECUs instruct the air gap to be disabled.

2. The air gap device according to claim 1, in, The air gap device is located between the security gateway and the one or more motor ECUs. The security gateway is connected to one or more infotainment ECUs, one or more body ECUs, one or more telematics ECUs, or the vehicle's on-board diagnostic device. The one or more motor ECUs include one or more powertrain ECUs, one or more chassis ECUs, and one or more advanced driver assistance system (ADAS) ECUs.

3. The air gap device according to claim 2, in, The security gateway obtains the vehicle status of the vehicle, which indicates whether the vehicle is in motion.

4. The air gap device according to claim 3, in, The one or more motor ECUs are multiple motor ECUs, and Among them, the multiple motor ECUs: The state of the air gap device is determined, indicating whether the air gap device is in a safe state. Identify multiple motion parameters corresponding to the multiple motion ECUs, and The maneuver state is determined from the plurality of maneuver parameters.

5. The air gap device according to claim 4, in, The multiple motor ECUs: Confirm whether the vehicle is in motion. The connection level requirement is determined by comparing the aforementioned maneuverability and the state of the air gap device. The security level requirements are determined based on the connection level requirements, and Based on the determined security level requirements, an air gap instruction is generated indicating whether to enable or disable the air gap.

6. The air gap device according to claim 5, in, The plurality of motor ECUs coordinate with one or more additional authentication systems to generate the air gap command.

7. A system for network-isolated motor systems while a vehicle is in motion, the system comprising: A security gateway, which is connected to one or more infotainment electronic control units (ECUs), one or more body ECUs, one or more telematics ECUs, or the vehicle's on-board diagnostic device; One or more motor ECUs, including one or more powertrain ECUs, one or more chassis ECUs, and one or more advanced driver assistance system (ADAS) ECUs; and Air gap device, the air gap device comprising: The enclosure includes multiple input ports and multiple output ports. The plurality of input ports include connections to a security gateway, and The plurality of output ports include connections to one or more motor ECUs. At least one pair of terminal contacts, Wherein, the at least one pair of terminal contacts includes a first terminal contact and a second terminal contact, and Air gap, embedded in the outer shell, Specifically, when the first terminal contact contacts the second terminal contact, the air gap closes, and Specifically, the air gap opens when the first terminal is not in contact with the second terminal contact. Specifically, when it is determined that the vehicle is moving or about to move, the air gap device is instructed to open the air gap. When the vehicle is in motion, the plurality of motor ECUs instruct the activation of the air gap, and When the vehicle stops, the plurality of motor ECUs instruct the air gap to be disabled.

8. The system according to claim 7, in, The air gap device is located between the security gateway and the one or more motor ECUs.

9. The system according to claim 8, in, The security gateway obtains the vehicle status of the vehicle, which indicates whether the vehicle is in motion.

10. The system according to claim 9, in, The one or more motor ECUs are multiple motor ECUs, and Among them, the multiple motor ECUs: The state of the air gap device is determined, indicating whether the air gap device is in a safe state. Identify multiple motion parameters corresponding to the multiple motion ECUs, and The maneuver state is determined from the plurality of maneuver parameters.

11. The system according to claim 10, in, The multiple motor ECUs: Confirm whether the vehicle is in motion. The connection level requirement is determined based on a comparison of the mobility status and the vehicle status. The security level requirements are determined based on the connection level requirements, and Based on the determined security level requirements, an air gap instruction is generated indicating whether to enable or disable the air gap.

12. The system according to claim 11, in, The plurality of motor ECUs coordinate with one or more additional authentication systems to generate the air gap command.

13. A method for isolating a motor system while a vehicle is in motion, the method comprising: The vehicle status is obtained through a security gateway, and the vehicle status indicates whether the vehicle is moving or about to move. The status of the air gap device is determined by multiple motor electronic control units (ECUs), which indicate whether the air gap device is in a safe state; The multiple motor ECUs confirm whether the vehicle is in motion; The connectivity level requirements are determined by the multiple motor ECUs based on the vehicle status; The security level requirements are determined based on the aforementioned connectivity level requirements. and Based on the determined security level requirements, an air gap command is generated indicating whether to enable or disable the air gap. When the vehicle is in motion, the plurality of motor ECUs instruct the activation of the air gap. When the vehicle stops, the plurality of motor ECUs instruct the air gap to be disabled, and The air gap device is integrated into the security gateway and one or more ECUs installed in the vehicle.

14. The method of claim 13, further comprising: The plurality of motion parameters corresponding to the plurality of motion ECUs are identified by the plurality of motion ECUs; The multiple motor ECUs determine the motor state based on the multiple motor parameters; and The connectivity level requirements are determined by the plurality of motor ECUs based on a comparison of the motor state and the vehicle state.

15. The method according to claim 14, wherein the air gap device comprises: The enclosure includes multiple input ports and multiple output ports. The plurality of input ports include connections to a security gateway, and The plurality of output ports include connections to the plurality of motor ECUs; At least one pair of terminal contacts, Wherein, the at least one pair of terminal contacts includes a first terminal contact and a second terminal contact; and Air gap, embedded in the outer shell, Specifically, when the first terminal contact contacts the second terminal contact, the air gap closes, and Specifically, the air gap opens when the first terminal is not in contact with the second terminal contact. Specifically, when it is determined that the vehicle is in motion, the air gap device is instructed to open the air gap.

16. The method according to claim 15, in, The air gap device is located between the security gateway and the plurality of motor ECUs. The security gateway is connected to one or more infotainment ECUs, one or more body ECUs, one or more telematics ECUs, or the vehicle's on-board diagnostic device. The plurality of motor ECUs include one or more powertrain ECUs, one or more chassis ECUs, and one or more advanced driver assistance system (ADAS) ECUs.

17. The method according to claim 16, The generation of the air gap command is coordinated by the plurality of motor ECUs and one or more additional authentication systems.

Images