Method for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit of the vehicle, computer-readable medium, system, and vehicle

Abstract

Method (100) for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit (204) of the vehicle, the method (100) comprising: Receiving (102) a first message (216) from a first control unit (202) of the vehicle via a first bus system (206, 208) by the second control unit (204) of the vehicle; Determining (104) a bus system (206, 208) belonging to the received first message by the second control unit (204), wherein the determination (104) of a bus system (206, 208) belonging to the received first message by the second control unit (204) comprises: Determining a message type of the received first message by the second control unit (204);Determining a second message by the second control unit (204) of the vehicle, wherein the second message has a message type corresponding to the determined message type of the first message (216), wherein the second message is the last successfully transmitted message of the second control unit (204) that has the message type of the received first message; Determining a bus system (206, 208) associated with the determined second message; and Determining the bus system (206, 208) of the determined second message as the bus system (206, 208) belonging to the received first message; and If the determined bus system (206, 208) differs from the first bus system (206, 208): Determining (106) the received first message as an invalid message of the first bus system (206, 208) by the second control unit (204);The second control unit (204) identifies (108) the first control unit (202) as the manipulated control unit if the received first message is determined to be an invalid message; and the second control unit (204) provides (110) an alarm message (220) to an external server.

Description

[0001] The invention relates to a method for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit of the vehicle. The invention further relates to a computer-readable medium for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit of the vehicle, a system for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit of the vehicle, and a vehicle comprising the system for detecting an impermissible message from a manipulated control unit of the vehicle by a second control unit of the vehicle.

[0002] Vehicle control units are interconnected via bus systems. If a control unit sends an unauthorized message on a bus system, the function of a receiving control unit can be affected without authorization. The unauthorized sending of messages by a control unit on a vehicle's bus system is not currently monitored.

[0003] It is therefore an object of the invention to efficiently detect the unauthorized transmission of a message on a bus system. In particular, an object of the invention is to efficiently detect an unauthorized message from a manipulated control unit by another control unit of the vehicle's bus system.

[0004] This problem is solved by the features of the independent claims. Advantageous embodiments and further developments of the invention result from the dependent claims.

[0005] According to a first aspect, the invention is characterized by a method for detecting an unauthorized message from a manipulated control unit of a vehicle by a second control unit of the vehicle. The method can be a computer-implemented method or a control unit-implemented method. The unauthorized message can be a message from an unauthorized sender of a bus system. The manipulated control unit can be a control unit that, after delivery of the vehicle, was connected to the bus system(s) of the vehicle in addition to an existing control unit. The vehicle can be a motor vehicle.

[0006] The method comprises receiving a first message from a first vehicle control unit (ECU) via a first bus system by the second ECU of the vehicle. The first ECU and / or the second ECU can be connected to multiple vehicle bus systems. Preferably, the first ECU and / or the second ECU can send and / or receive messages via multiple vehicle bus systems. A bus system can be a CAN bus. The method further comprises the second ECU determining which bus system corresponds to the received first message. If the determined bus system differs from the first bus system, the method designates the received first message as an invalid message from the first bus system by the second ECU.If the identified bus system differs from the first bus system and if the received first message is determined to be an invalid message, the procedure recognizes the first control unit as the manipulated control unit by the second control unit and provides an alarm message to an external server via the second control unit.

[0007] Advantageously, the second control unit can check whether the received first message was sent via a bus system authorized for that message. This allows for the efficient detection of invalid messages and the identification of the sender as a manipulated control unit. This enables the rapid detection of control unit manipulation across multiple bus systems.

[0008] According to an advantageous embodiment of the invention, the second control unit can be the only trusted source of the message. This allows for the efficient detection of unauthorized message transmission by a manipulated control unit.

[0009] According to a further advantageous embodiment, the second control unit can be connected to at least two bus systems, and / or the first of the at least two bus systems can be a bus system for transmitting diagnostic messages, and / or the second of the at least two bus systems can be a bus system for transmitting application messages. This enables efficient monitoring of impermissible messages across bus systems by the second control unit.

[0010] According to a further advantageous embodiment of the invention, the first message can be an application message that is transmitted via the first bus system.

[0011] According to a further advantageous embodiment of the invention, determining a bus system associated with the received first message by the second control unit can comprise: determining the message type of the received first message by the second control unit, determining a second message by the second control unit of the vehicle, wherein the second message has a message type corresponding to the determined message type of the first message, determining a bus system associated with the determined second message, and identifying the bus system of the determined second message as the bus system associated with the received first message. This allows the permissible bus system for a received message to be efficiently determined by the second control unit.

[0012] According to a further advantageous embodiment of the invention, the second message can be the last successfully transmitted message of the second control unit, which has the same message type as the received first message, and / or the second message can be a message for which the second control unit is the only trusted message source on the bus system associated with the second message, and / or the second message can be sent by the second control unit via a bus system associated with the second message before the first message is received, and the second message can be stored by the second control unit after successful transmission of the second message via the bus system associated with the second message. This allows the permissible bus system for a received message to be efficiently determined by the second control unit.

[0013] According to a further advantageous embodiment of the invention, the alarm message can include the manipulated control unit and / or the impermissible message of the first bus system.

[0014] According to a further aspect, the invention is characterized by a computer-readable medium for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit of the vehicle, wherein the computer-readable medium comprises instructions which, when executed on a control unit of the vehicle, execute the method described above.

[0015] According to another aspect, the invention is characterized by a system for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit of the vehicle, wherein the system is configured to perform the method described above.

[0016] According to another aspect, the invention is characterized by a vehicle comprising the system described above for detecting an impermissible message from a manipulated control unit of the vehicle by a second control unit of the vehicle.

[0017] Further features of the invention will become apparent from the claims, the figures, and the description of the figures. All features and combinations of features mentioned above in the description, as well as those subsequently mentioned in the description of the figures and / or shown in the figures alone, are usable not only in the combinations specified, but also in other combinations or individually.

[0018] The following describes a preferred embodiment of the invention with reference to the accompanying drawings. Further details, preferred configurations, and further developments of the invention will be derived from these drawings. In detail, the drawings schematically illustrate... Fig. 1. An exemplary method for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit, and Fig. 2 an exemplary system for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit.

[0019] In detail, it shows Fig. 1 An exemplary method 100 for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit of the vehicle. Messages on bus systems of a vehicle can only be sent by an authorized control unit, the second control unit, on a specified bus system. On any other bus system of the vehicle, the message is impermissible. By monitoring all messages on all other bus systems to which the authorized control unit is connected, the authorized control unit can detect an impermissible message from a manipulated control unit on any other bus system of the vehicle and send an alarm message.

[0020] Method 100 can receive a first message from a first vehicle control unit via a first bus system through the second vehicle control unit 102. For example, a bus monitoring component capable of receiving the first message from the first control unit can be integrated into the second control unit as the authorized sender of the first message. Preferably, the second control unit, and in particular its bus monitoring component, can receive all messages exchanged via the bus systems to which it is connected. Preferably, the second control unit, and in particular its bus monitoring component, can receive all messages exchanged via the bus systems to which it is connected for which it is the authorized sender. The second control unit can be the authorized sender for the first message.This allows the second control unit to receive the first message.

[0021] Method 100 can determine a bus system belonging to the received first message by the second control unit 104. If the determined bus system differs from the first bus system, method 100 can determine the received first message as an invalid message from the first bus system by the second control unit 106. Furthermore, if the received first message has been determined as an invalid message, method 108 can detect that the first control unit is a manipulated control unit by the second control unit. Finally, method 100 can provide an alarm message to an external server via the second control unit 110. By providing the alarm message to the external server, a vehicle manufacturer, for example, can be informed about a manipulation of the vehicle.

[0022] If the first message is, for example, an application message and is received via a diagnostic bus system, the second control unit, as the authorized sender of the first message, can recognize that the application message was transmitted improperly on the diagnostic bus system. This constitutes manipulation of the first control unit as the sender of the improper message.

[0023] In detail, it shows Fig.2 An exemplary system 200 for detecting an impermissible message from a manipulated control unit 202 of a vehicle by a second control unit 204. The manipulated control unit 202, also called the first control unit, and the second control unit are connected via two bus systems 206 and 208. The second control unit 204, as the authorized sender of a message 210 of a first message type, has transmitted this message via the bus system 208 to a third control unit 212. The successful transmission of the message 210 and the associated bus system can be stored by the second control unit 204 in a memory 214.

[0024] The second control unit 204 can receive a first message 216 from the manipulated control unit 202 via a bus monitoring component 218. The first message 216 can have a message type for which the second control unit is the authorized sender. The bus monitoring component 218 of the second control unit 204 can determine a bus system belonging to the received first message. For example, the bus monitoring component 218 can query the memory 214 to determine the bus system belonging to the received first message and compare it with the bus system via which the first message was received. If the determined bus system 208 differs from the bus system 206 of the received first message, the bus monitoring component 218 of the second control unit 204 can determine the received first message as an invalid message of bus system 206 and identify the first control unit as the manipulated control unit 202.By means of an alarm message 220, the second control unit can provide the impermissible message and / or the manipulated control unit 202 to an external server.

[0025] Advantageously, unauthorized transmission of messages from bus systems can be efficiently detected by the authorized sender of the respective message. Manipulations of control units can thus be detected and / or reported more quickly. Reference symbol list 100 procedures 102 received a first message 104 Determine a bus system 106 determine the received, first message as an inadmissible message 108 Recognizing the first control unit as the manipulated control unit 110 provides an alarm message 200 System 202 first control unit or manipulated control unit 204 second control unit 206 Bus system 208 Bus system 210 message 212 third control unit 214 storage 216 first message 218 Bus monitoring component 220 Alarm message

Claims

[1] Method for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit of the vehicle, the method comprising: Receiving an initial message from the vehicle's first control unit via a first bus system by the vehicle's second control unit; Determining a bus system belonging to the received first message by the second control unit; and If the identified bus system differs from the first bus system: Determining the received first message as an invalid message from the first bus system by the second control unit; The second control unit detects the first control unit as the manipulated one if the received first message is identified as an invalid message; and Providing an alarm message to an external server via the second control unit. [2] Method according to claim 1, wherein the second control unit is the only trusted source of the message. [3] A method according to any of the preceding claims, wherein the second control unit is connected to at least two bus systems; and / or wherein the first of the at least two bus systems is a bus system for transmitting diagnostic messages; and / or where the second bus system of the at least two bus systems is a bus system for transmitting application messages. [4] Method according to any of the preceding claims, wherein the first message is an application message that is transmitted via the first bus system. [5] Method according to any of the preceding claims, wherein the second control unit comprises: Determining a bus system belonging to the received first message: Determining the message type of the received, first message by the second control unit; Determining a second message by the second control unit of the vehicle, wherein the second message has a message type that corresponds to the specified message type of the first message; Determine a bus system that is linked to the identified second message; and Determining the bus system of the identified second message as the bus system belonging to the received first message. [6] The method of claim 5, further comprising: wherein the second message is the last successfully transmitted message from the second control unit, which has the same message type as the received first message; and / or where the second message is a message for which the second control unit is the only trusted message source on the bus system associated with the second message; and / or wherein the second message was sent by the second control unit via a bus system linked to the second message before the first message was received, and the second message was stored by the second control unit after successful transmission of the second message via the bus system linked to the second message. [7] Method according to any of the preceding claims, wherein the alarm message includes the manipulated control unit and / or the impermissible message of the first bus system. [8] Computer-readable medium for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit of the vehicle, wherein the computer-readable medium comprises instructions which, when executed on a control unit of the vehicle, execute the method according to any one of claims 1 to 7. [9] System for detecting an impermissible message from a manipulated control unit of a vehicle by a second control unit of the vehicle, wherein the system is configured to perform the method according to any one of claims 1 to 7. [10] Vehicle comprising the system for detecting an impermissible message from a manipulated control unit of the vehicle by a second control unit of the vehicle according to claim 9.

Images