Vehicle gateway network protection

Abstract

A method for protecting a vehicle (102), the method comprising:managing, with a processor (118), state transitions of a gateway (112) that physically separates a telematics dongle (104) and a vehicle data bus (110);when the gateway (112) is in a field state (206), blocking a first type of requests sent from the telematics dongle (104) to the vehicle data bus (110);andin response to the gateway transition to the field state (206), blocking the first type of requests and a second type of requests sent from the telematics dongle (104) to the vehicle data bus (110) for a period of time.

Claims

[1] A method for protecting a vehicle (102), the method comprising: Managing, with a processor (118), state transitions of a gateway (112) that physically separates a telematics dongle (104) and a vehicle data bus (110); when the gateway (112) is in a field state (206), blocking a first type of requests sent from the telematics dongle (104) to the vehicle data bus (110); and in response to the gateway transition to the field state (206), blocking the first type of requests and a second type of requests sent from the telematics dongle (104) to the vehicle data bus (110) for a period of time. [2] The method of claim 1, comprising, when the gateway (112) is in the field state (206), allowing the second type of requests sent from the telematics dongle (104) to the vehicle data bus (110). [3] A method according to claim 1, comprising: in response to power being applied to the gateway (112), obtaining a feature state value from a non-volatile protected memory (124); if the feature state value indicates activated, transitioning the gateway (112) to a transition state (202); and if the feature state value indicates disabled, transitioning the gateway (112) to a diagnostic state (204). [4] The method of claim 3, wherein the first type of requests and the second type of requests sent from the telematics dongle (104) to the vehicle data bus (110) are permitted when the gateway (112) is in the diagnostic state (204). [5] The method of claim 3, comprising, when the gateway (112) is in a transition state (202): Monitoring a speed of the vehicle (102); when the speed of the vehicle (102) reaches a threshold value, transitioning the gateway (112) to the field state (206); and if the speed of the vehicle (102) does not reach the threshold value, transferring the gateway (112) to a diagnostic state (204). [6] The method of claim 1, comprising, when the gateway (112) is in a diagnostic state (204): monitoring a speed of the vehicle (102); and when the speed of the vehicle (102) reaches a threshold and the feature state value in the non-volatile protected memory (124) indicates activated, transitioning the gateway (112) to the field state (206). [7] A method according to claim 1, comprising: Storing a value indicative of a setting of a feature state in the non-volatile protected memory (124); and in response to a request to change the value indicating the feature state in the non-volatile protected memory (124) to indicate a disabled setting: Requesting an authentication token; and in response to the authentication token being valid, changing the value in non-volatile protected memory (124) to indicate the disabled setting. [8] A system for protecting a vehicle (102), the system comprising: a gateway (112) located in the vehicle (102) which is electronically connected to a diagnostic port (106), the gateway (112) physically separating the diagnostic port (106) and a telematics dongle (104) plugged into the diagnostic port (106) from the vehicle data bus (110), the gateway (112) comprising a non-volatile protected memory (124) and a processor (118); wherein the non-volatile memory (124) stores a value indicative of a feature state; and wherein the processor (118) is programmed to: Managing gateway state transitions (112); when the gateway (112) is in a field state (206), blocking a first type of diagnostic requests sent from the telematics dongle (104) to electronic control units (108a-108g); and in response to the gateway transition to the field state (206), blocking the first type of diagnostic requests and a second type of diagnostic requests sent by the telematics dongle (104) for a period of time. [9] The system of claim 8, comprising allowing the second type of diagnostic requests sent by the telematics dongle (104) when the gateway (112) is in the field state (206) to reach the electronic control unit (108a-108g). [10] The system of claim 8, wherein the processor (118) is to: in response to power being applied to the gateway (112), obtain the value of the feature state from the non-volatile protected memory (124); if the value of the feature state indicates activated, to transition the gateway (112) to a transition state (202); and if the value of the feature state indicates disabled, to transfer the gateway (112) to a diagnostic state (204). [11] The system of claim 10, wherein the processor (118) is for allowing the first type of requests and the second type of requests from the telematics dongle (104) to pass to the electronic control unit (108a-108g) when the gateway (112) is in the diagnostic state (204). [12] The system of claim 10, wherein the processor (118), when the gateway (112) is in the transition state (202), is to: to monitor a speed of the vehicle (102); when the speed of the vehicle (102) reaches a threshold value, to transfer the gateway (112) to the field state (206); and if the speed of the vehicle (102) does not reach the threshold value, to transfer the gateway (112) to the diagnostic state (204). [13] System according to claim 10, wherein the processor (118), when the gateway (112) is in the diagnostic state (204), is to: to monitor a speed of the vehicle (102); and when the speed of the vehicle (102) reaches a threshold value and the value of the feature state indicates activated, to transfer the gateway (112) to the field state (206). [14] The system of claim 8, wherein the first type of diagnostic requests causes electronic control units (108a-108g) communicatively coupled to the vehicle data bus (110) to reset or transition to a diagnostic session, and wherein the second type of diagnostic requests causes the electronic control units (108a-108g) communicatively coupled to the vehicle data bus (110) to report status information. [15] The system of claim 8, wherein in response to a request to change the value of the feature state in the non-volatile protected memory (124) to indicate a disabled setting, the processor (118) is to: request an authentication token; and in response to the authentication token being valid, change the value of the feature state in the non-volatile protected memory (124) to indicate the disabled setting.

Images