DATA WATERMARK MARKER

Abstract

A computer comprises a processor and memory, the memory containing instructions that the processor can execute to generate a first and second message for transmission over a communication bus using a first modulation mode, and to generate a first and second watermark signal for transmission over the communication bus using a second modulation mode, the first and second modulation modes being isolated from each other. The instructions can additionally transmit the first message superimposed with the first watermark signal and transmit the second message superimposed with the second watermark signal, the second watermark signal having a parameter that varies with respect to the first watermark signal.

Description

FIELD OF TECHNOLOGY

[0001] This disclosure relates to techniques for data watermarking. GENERAL STATE OF THE ART

[0002] A variety of systems utilize internal communication links to exchange data, parameters, settings, etc., between system components. For example, in a vehicle system, internal communication links, such as those provided by a vehicle communication bus, may be used to transfer data from various vehicle sensors to a vehicle computer. The vehicle computer may then execute programming to detect and / or recognize objects present in a driving environment. A vehicle communication bus may transfer other types of data, such as a vehicle driver's personal information, contact information uploaded from a vehicle driver's mobile communication device, parameters used by vehicle facial recognition applications, etc. SUMMARY

[0003] This disclosure provides techniques for watermarking sensitive or potentially sensitive data generated by on-board vehicle sensors, computers, communication subsystems, etc. As used herein, the term "watermark" refers to a signal overlaid on a data message to provide authenticity for the data message. Thus, for example, a first message that may be modulated using a first modulation mode and that may include sensitive or potentially sensitive content may be watermarked using the signal modulated using a second modulation mode. Examples of sensitive or potentially sensitive data generated by on-board vehicle sensors may include objects detected via radar sensors, ultrasonic sensors, cameras, LIDAR devices, etc.detected and / or classified. Other types of sensitive or potentially sensitive data may include: the current location and current movement parameters of the vehicle, access data used by the vehicle's computer to enable a vehicle operator to enter and / or operate the vehicle, data uploaded by a mobile communications device belonging to a passenger or vehicle operator of the vehicle, etc. Such data may be transferred or exchanged between different vehicle subsystems using a vehicle communications bus.To prevent the insertion of false data that could be used to gain unauthorized access to the vehicle, direct vehicle operations, or cause disclosure of information that is private of the vehicle operator and / or vehicle passengers, sensitive or potentially sensitive data may be watermarked. Watermarking of data communications, which may be achieved by overlaying a watermarking signal on a data message transmitted to a vehicle communications bus using techniques described herein, may serve to authenticate the data message or convey additional data. At a receiving end, a receiving device may isolate data messages from the watermarking signal.A received watermark signal may be processed to determine whether the composite signal includes an expected watermark signal. In response to the received watermark signal including a watermark signal, the data message may be authenticated. In response to a received watermark signal not including a predetermined watermark signal, the data message may be discarded as incorrect or invalid.

[0004] In one example, the overlaying of a watermark signal using a second modulation mode may not be time-synchronized or time-synchronized with a transmission of a first message transmitted using a first modulation mode. Thus, for example, a watermark signal may be a preamble using a second modulation mode transmitted before the transmission of a data message containing sensitive or potentially sensitive content. In another example, a watermark signal may be transmitted after a data message to authenticate a previously transmitted data message. Furthermore, a watermark signal may be used to convey additional data, such as metadata, which may include parameters describing the source of a data message, access data of the data message, a length of a data message, etc.

[0005] A system for watermarking data communications may include a computer having a processor coupled to a memory, the memory storing instructions executable by the processor to generate first and second messages for transmission over a communications bus using a first modulation mode. The instructions may additionally be operable to generate first and second watermarking signals for transmission over the communications bus using a second modulation mode, the first and second modulation modes being isolated from each other.The instructions may additionally serve to transmit the first message superimposed with the first watermarking signal and to transmit the second message superimposed with the second watermarking signal, wherein the second watermarking signal has one or more parameters that differ from the first watermarking signal.

[0006] The first modulation mode may include a differential mode.

[0007] The second modulation mode may include a common mode.

[0008] The first and second watermarking signals may be modulated using a spread spectrum technique.

[0009] The parameter may be based on a ratio of a spreading code rate to a data rate of a spread spectrum signal.

[0010] The parameter may be an integer value of a ratio of a spreading code rate to a data rate of a spread spectrum signal.

[0011] The parameter may be a phase shift of a spreading code of a spread spectrum signal.

[0012] The parameter can be a length of the second watermark signal.

[0013] The parameter can be a code rate of a spread spectrum modulation mode.

[0014] The parameter may be an upconversion factor of a spread spectrum modulation mode.

[0015] The parameter can be an amplitude of a spread spectrum modulation mode.

[0016] The instructions may further be used to determine the parameter based on a content of the second message.

[0017] The instructions may further be used to determine the parameter based on a recipient of the second message.

[0018] The instructions may further be used to determine the parameter based on detected noise on a conductor of the communication bus.

[0019] The first watermarking signal or the second watermarking signal may extend beyond the interval during which the first message or the second message is transmitted.

[0020] The first watermark signal or the second watermark signal may end before completion of the transmission of the first message or the second message.

[0021] A method for watermarking data communications may include generating first and second messages for transmission over a communications bus using a first modulation mode; and generating first and second watermarking signals for transmission on the communications bus using a second modulation mode, the first and second modulation modes being isolated from each other. The method may additionally include transmitting the first message overlaid with the first watermarking signal; and the method may additionally include transmitting the second message overlaid with the second watermarking signal, the second watermarking signal having a parameter that varies from the first watermarking signal.

[0022] The method may further include detecting a fault on one or more conductors of the communication bus and determining the parameter of the second watermarking signal based on the detected fault.

[0023] The method may additionally include determining a recipient of the second message and determining the parameter of the second watermarking signal based on the determined recipient.

[0024] The method may additionally include determining a message content of the second message and determining the parameter of the second watermarking signal based on the determined content of the second message. BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a block diagram of an example vehicle system with internal and external communication connections. Fig. 2 is an illustration of a vehicle communication bus capable of conveying signals modulated using first and second communication modes. Fig. 3-4 are diagrams showing watermarking signals and data messages transmitted on a communications bus. Fig. 5A and Fig. 5B are block diagrams of a vehicle computer capable of communicating watermarking signals and data messages over a communications bus. Fig. Figure 6 is a block diagram of a vehicle computer capable of communicating watermarking signals in the presence of a fault. Fig. Figure 7 is a block diagram of programming and / or hardware components of a vehicle computer used in watermarking data communications. Fig. 8 is an illustration of an exemplary process flow for transmitting and receiving watermarked vehicle data using a communication bus. DETAILED DESCRIPTION

[0025] Fig. 1 is a block diagram of an exemplary vehicle system 100 with internal and external communication connections. As shown in Fig. 1, the system 100 includes a vehicle 105, which may be any vehicle, such as a car, a truck, a minivan, an SUV, a crossover, etc. In another example, the system 100 includes an aircraft or a watercraft. The system 100 includes a vehicle computer 110 that includes communication links, such as a vehicle communication bus 106, to and from various sensors, components, actuators, and subsystems of the vehicle 105. Thus, the vehicle computer 110 can transfer messages, which may include data, parameters, and / or settings, to sensors 115, actuators 120, vehicle components 125 (e.g., steering, propulsion, and braking), a communication subsystem 130, and a human machine interface (HMI) 135.The vehicle 105 may additionally communicate via a wireless communication network 140 with a server 145, which may be located remotely from the vehicle 105. Accordingly, the vehicle 105 may transmit messages to and / or receive messages from other vehicles when the vehicle 105 is stationary or traveling along a path 150 in a traveling environment.

[0026] The vehicle computer 110 includes a processor and memory. Memory of the vehicle computer 110, such as those described herein, includes one or more forms of computer-readable media and stores instructions executable by the vehicle computer 110 to perform various operations, including those disclosed herein. For example, a vehicle computer 110 may be a generic computer with a processor and memory, as described above, and / or may include an electronic control unit (ECU) or controller for a specific function or set of functions, and / or may include dedicated electronic circuitry, including an application-specific integrated circuit (ASIC) manufactured for a specific operation, e.g.,an ASIC for processing data from sensors 115 and / or communicating the data from the sensors 115. In another example, the computer 110 may include an FPGA (Field-Programmable Gate Array), which is an integrated circuit manufactured to be user-configurable. Typically, a hardware description language such as VHDL (Very High Speed ​​Integrated Circuit Hardware Description Language) is used in electronic design automation to describe digital and mixed-signal systems such as FPGAs and ASICs. For example, an ASIC is manufactured based on VHDL programming that is provided prior to manufacturing, whereas logical components inside an FPGA may be configured based on VHDL programming that is provided, for example, prior to manufacturing.B. stored on a memory electrically connected to the FPGA circuitry. In some examples, a combination of processor(s), ASIC(s), and / or FPGA circuitry may be included in the vehicle computer 110. Further, the vehicle computer 110 could include a plurality of computers onboard the vehicle 105, e.g., a plurality of ECUs (electronic control units) or the like, which operate together to perform operations attributed herein to the vehicle computer 110. The memory accessed by a processor of the vehicle computer 110 may be of any type, e.g., hard disk drives, solid-state drives, or any volatile or non-volatile media. The memory accessed by a processor of the vehicle computer 110 may store data collected by the sensors 115.Such a memory may be a separate device from the vehicle computer 110, and the vehicle computer 110 may retrieve information stored by the memory using the vehicle communication bus 106.

[0027] The vehicle computer 110 may include programming in the form of executable instructions that operate one or more components 125, such as vehicle brakes, propulsion (e.g., one or more of an internal combustion engine, an electric motor, a hybrid engine, etc.), steering, climate control, interior and / or exterior lighting, etc., as well as to determine if and when the computer 110 should control such operations in place of a human operator. Additionally, the computer 110 may be programmed to determine if and when a human vehicle operator should control such operations. The computer 110 may communicate, for example, via a communications bus 106, with more than one processor, e.g., included in components 125, such as sensors 115, electronic control units (ECUs), or the like, included in the vehicle for monitoring and / or controlling various vehicle components, e.g.,a powertrain control, a braking control, a steering control, etc., or be communicatively coupled to it.

[0028] The computer 110 is generally arranged for communications on the vehicle communication bus 106, which may include a communication bus operating in the vehicle, such as a controller area network bus, CAN bus, or the like. The vehicle communication bus 106 is a communication network over which messages may be exchanged between various devices, e.g., the sensors 115, the components 125, the computer(s) 110, etc., on board the vehicle 105. The computer 110 may generally be programmed to send and / or receive messages over the vehicle communication bus 106 to other devices in the vehicle 105, e.g., any or all of the ECUs, the sensors 115, the actuators, the components 125, the communication subsystem 130, the HMI 135, etc. For example, various subsystems of the components 125 (e.g.,Components 125 (the components 125 may be controlled by respective ECUs) and / or sensors 115 may provide data to computer 110 via communication bus 106. In some implementations, vehicle 105 may include additional networks in which messages are communicated using other wired communication technologies and / or wireless communication technologies, e.g., Ethernet, Wireless Fidelity (WiFi®), Bluetooth®, etc. Additional examples of protocols that may be used in some implementations for communications over vehicle communication bus 106 include, but are not limited to, Media Oriented System Transport (MOST), Time-Triggered Protocol (TTP), and FlexRay.In some implementations, communications between the computer 110, the sensors 115, the actuators 120, the components 125, the communication subsystem 130, and the HMI 135 occur using a combination of multiple networks, possibly of different types, that support communications between devices in a vehicle.

[0029] The vehicle 105 typically includes a variety of sensors 115. The sensors 115 may include device(s) capable of obtaining one or more measurements of one or more physical phenomena. Some of the sensors 115 may detect internal conditions of the vehicle, for example, wheel speed, wheel orientation, and engine and transmission variables. Some of the sensors 115 may be operable to detect the position or orientation of the vehicle, for example, using global positioning system (GPS) sensors; accelerometers such as piezoelectric or microelectromechanical systems (MEMS); gyroscopes such as rate, ring laser, or fiber optic gyroscopes; inertial measurement units (IMUs); and magnetometers.Some of the sensors 115 can detect the outside world, for example radar sensors, scanning laser rangefinders, light detection and ranging (LIDAR) devices, and image processing sensors such as cameras.

[0030] The vehicle computer 110 may be configured to communicate with a second vehicle via a wireless communication interface, e.g., via a vehicle-to-vehicle (V2V), vehicle-to-infrastructure (VI), and / or vehicle-to-everything (V2X) communication network (i.e., communications that may include V2V and V2I). Some of the sensors 115 are communication devices, e.g., vehicle-to-infrastructure (V2I) or V2V devices, that may operate via a wireless communication network 140.The communication subsystem 130 represents one or more mechanisms by which the computer 110 of the vehicle 105 can communicate with other vehicles and / or elements of a communication infrastructure, and may be one or more of wireless communication mechanisms, including any desired combination of wireless and wired communication mechanisms and any desired network topology (or topologies if a plurality of communication mechanisms are utilized). Example V2X communication protocols include cellular, IEEE 802.11, dedicated short range communication (DSRC), and / or wide area networks (WANs), including the Internet, which provide data communication services. DSRC may include wireless communication channels for one-way or two-way short- to medium-range communication.A V2X communication network can have multiple channels, each identified by an identifier, such as a channel number. Example system processes

[0031] Fig. 2 is an illustration 200 of a vehicle communication bus capable of conveying signals modulated using a first and a second communication mode. As described with reference to the example of Fig. 1, the vehicle communication bus 106 may include a controller area network (CAN) bus. The vehicle communication bus 106 may utilize two conductors (e.g., conductors 106A and 106B) to transmit messages between the computer 110, the sensors 115, the actuators 120, the components 125, the communication subsystem 130, and the HMI 135. The conductors 106A and 106B may be arranged in a twisted pair configuration in which the conductors 106A and 106B are twisted around each other. Messages may be transmitted along the vehicle communication bus 106 using a first mode 205, which may include a differential communication mode. In the context of this disclosure, a “differential communication mode” refers to a communication mode in which a first conductor (e.g., conductor 106A) is used to transmit a signal, e.g., a binary digit, while a second conductor (e.g.,conductor 106B) is used to transmit a substantially opposite signal. In the example from . Fig. 2, a binary 1 can thus be represented by transmitting a signal with a positive voltage during a time interval T1 with respect to a reference (e.g., a floating ground, a local ground, a vehicle chassis ground, etc.) using conductor 106A. A positive signal transmitted using conductor 106A can be accompanied by transmitting a signal with a negative voltage with respect to the reference, also during the time interval T1, using conductor 106B. In the example from Fig. 2, a binary 0 may be represented by transmitting a signal having a negative voltage, such as at a time interval T2, with respect to a reference using conductor 106A. A signal having a negative voltage may be accompanied by transmitting a signal having a positive voltage, also during the time interval T2, using conductor 106B.

[0032] For example, at a receiving end, a receiving circuit (e.g., CAN RX component 760) may decode a binary 1 in response to conductor 106A exhibiting a positive voltage while conductor 106B exhibits a substantially opposite voltage. At a receiving end, a receiving circuit may decode a binary 0 in response to conductor 106A exhibiting a negative voltage while conductor 106B exhibits a substantially opposite (positive) voltage. Accordingly, in response to the presence of conducted electromagnetic interference coupled to conductors arranged in a twisted pair configuration, a receiving circuit may be able to distinguish between binary values ​​(e.g., binary 1, binary 0) in a transmitted message because such discrimination is based on a voltage difference between conductor 106A and conductor 106B.Furthermore, because conductors 106A and 106B simultaneously transmit a signal and the opposite of the signal, a return conductor (e.g., a reference voltage such as a floating ground, local ground, chassis ground, etc.) is not utilized. Accordingly, electromagnetic interference can be reduced by removing a path for interference currents that can conduct using the return conductor (e.g., a reference voltage such as a floating ground, local ground, chassis ground, etc.).

[0033] Fig. 2 additionally shows the vehicle communication bus 106 utilizing a second mode 210. The second mode 210 may include a "common mode communication mode" between the computer 110, the sensors 115, the actuators 120, the components 125, the communication subsystem 130, and the HMI 135. In the context of this disclosure, a "common mode communication mode" refers to a communication mode in which a first conductor (e.g., conductor 106A) is used to transmit one signal, while a second conductor (e.g., conductor 106B) is used to transmit a substantially equal signal. In the example of Fig. 2, a binary 1 may be transmitted using a positive voltage with respect to a reference at time T1 over conductor 106A, while a signal having a substantially similar level may be transmitted using conductor 106B. In one example, a binary 0 may be transmitted using a negative voltage with respect to a reference over conductor 106A, while a signal having a substantially similar level may be transmitted using conductor 106B.

[0034] At a receiving end, a receiving circuit may decode a binary 1, for example, based on conductors 106A and 106B exhibiting a positive voltage. The receiving circuit may decode a binary 0, for example, based on conductors 106A and 106B exhibiting a negative voltage. Further, in response to conductor 106A and conductor 106B exhibiting common voltages (e.g., both positive or both negative), a return conductor (in Fig. 2 not shown). Accordingly, conducted electromagnetic interference can be introduced into a common-mode mode based on the use of a signal return conductor.

[0035] Out of Fig. 2, it can be seen that the vehicle communication bus 106 can employ both a differential mode (e.g., first mode) and a common mode (e.g., second mode) for communication between the computer 110, the sensors 115, the actuators 120, the components 125, the communication subsystem 130, and the HMI 135. At a transmitting end, the vehicle computer 110 can, for example, overlay a message transmitted via a differential mode (e.g., a first mode) with a message transmitted via a common mode (e.g., a second mode). Overlaying differential mode signals (e.g., first mode signals) with common mode signals (e.g., second mode signals) can be accomplished using a summing circuit at a transmitting interface of, for example, the vehicle computer 110. At a receiving end, a receiving circuit (e.g.,the CAN RX component 760, the watermark comparator 765 from . Fig. 7) utilize circuitry to separate binary digits of messages encoded via a differential mode (e.g., first mode) from signals encoded via a common-mode mode (e.g., second mode) by isolating a signal from conductor 106A that is not paired with an opposite signal on conductor 106B. Similarly, a receiving circuit at a receiving end may utilize circuitry to separate binary digits of messages encoded via a common-mode mode (e.g., second mode) from signals encoded via a differential mode (e.g., first mode) by isolating a signal from conductor 106A that is not paired with a substantially similar signal on conductor 106B.In the context of this disclosure, "isolating" or forms thereof refers to separating a first signal from a second signal such that information content of the first signal does not interfere with or affect the information content of the second signal. Accordingly, vehicle communication bus 106 may utilize differential mode (e.g., first mode) and common mode (e.g., second mode) voltage signals to transfer data while maintaining isolation between the first mode and the second mode.

[0036] Fig. 3 is a diagram 300 showing programming instructions and / or hardware components of the vehicle computer 110 that generate watermarks and data messages on a conductor (e.g., conductor 106A) of the communication bus 106. Although Fig. 3 indicates a voltage signal on conductor 106A, the voltage signal could be indicated on conductor 106B. As in Fig. 3, the vehicle computer 110 includes a first mode message generator 305 for generating a first mode message 315. The vehicle computer 110 additionally includes a second mode signal generator 310 for generating a second mode signal 320. The second mode signal 320 can be used as a watermark to authenticate the first mode message 315. The first mode message generator 305 can include a CAN message generator, e.g., the message buffer 730 of Fig. 7, which can be used to format data into messages for transfer from the vehicle computer 110, such as sensor operating modes, outputs from data or image processing operations, vehicle position data, data for display via the HMI 135 of the vehicle 105, or any other data generated by the vehicle computer 110.

[0037] As in Fig. 3, the message generator 305 of the first mode, e.g., the message buffer 730 from Fig. 7, is operated to generate the first mode message 315 for transmission along the vehicle communication bus 106 using a differential mode of operation. The second mode signal generator 310 may include a watermark signal generator for transmission along the vehicle communication bus 106. At a receiving end (in Fig. 3 not shown), a received watermark signal may be processed to determine whether the watermark signal includes a predetermined watermark signal. In response to the received watermark signal including a predetermined watermark signal, a data message may be authenticated. In response to the received watermark signal not including a predetermined watermark signal, the data message may be discarded as incorrect or invalid. In one example, an unauthenticated data message may be accepted by the receiver but later discarded according to the programming of a receiving computer 110, sensor 115, actuator 120, component 125, communication subsystem 130, and / or HMI 135.

[0038] The second mode signal 320 may include a spread spectrum technique to modulate the signal as a watermark to authenticate the first mode message 315. A spread spectrum signal may utilize a spreading code having a code rate significantly higher than the data rate of the first mode message 315. For example, the second mode signal generator 310 transmits, as shown in Fig. 3, during the interval used to transmit a first binary value of the message 315 of the first mode (ie, during an interval T3), 10 binary digits of a spreading code are used. Accordingly, as shown in Fig. 3, the signal 320 of the second mode comprises a spreading code with 10 times the data rate of the message 315 of the first mode (e.g. T4=110T3 ). Thus, as in Fig. 3, a first binary value of the first mode message 315 may be authenticated in response to binary values ​​of the spreading code of the second mode signal 320 having a threshold correlation (such as 80% correlation, 90% correlation, 95% correlation) with a predetermined spreading code stored at a receiving end of the communication bus 106.

[0039] As mentioned with reference to Fig. 2, uses the message 315 of the first mode, which in the example from Fig. 2 and Fig. 3 uses a differential transmission mode, no return signal path. However, the second mode signal 320, which uses a common-mode transmission mode to watermark the first mode message 315, may use a return signal path. The return signal path may present a vulnerability to electromagnetic interference propagated via the return signal path. Accordingly, in response to a receiver at a receiving end of the communication bus 106 detecting an increase in, for example, a bit error rate of the second mode signal 320, the second mode signal generator 310 may be instructed to modify a spreading ratio, which in this context refers to a ratio of binary digits of a spreading code to a binary digit of the first mode message 315.Thus, for example, in response to a receiver at a receiving end of the communication bus 106 detecting an increase in a bit error rate of the second mode signal 320, the second mode signal generator may decrease the spreading ratio of the second mode signal 320. In one example, in response to conducted electromagnetic interference causing or contributing to an increase in a bit error rate of the second mode signal 320, the second mode signal generator 310 may decrease the spreading ratio of the second mode signal 320 by an integer factor, such as from 10 times the data rate of the first mode message 315 to 5 times the data rate of the first mode message.In another example, in response to a receiver at a receiving end of the communication bus 106 detecting a decrease in the bit error rate of the second mode signal 320, the second mode signal generator 310 may increase the spreading ratio of the second mode signal 320 by, for example, an integer factor, such as from 5 times the data rate of the first mode message 315 to 10 times the data rate of the first mode message 315.

[0040] Fig. 4 is a diagram 400 showing the vehicle computer 110 generating watermarking and data messages on the communication bus 106. As shown in Fig. 4, the vehicle computer 110 is in communication with the HMI 135. Such communications may include relatively non-sensitive data, such as radio tuning parameters, climate control settings, etc. Such communications may also include sensitive or potentially sensitive content, such as codes used to access the vehicle 105, names of persons authorized to operate the vehicle 105, etc. Accordingly, the computer 110 may dynamically adjust the second mode signal 320 to provide an increased level of watermark authentication of the first mode message 315. For example, in response to a vehicle operator interacting with an infotainment display of the vehicle 105, the second mode signal generator 310 may utilize a relatively simple version of the second mode signal 320 to watermark the first mode message 315.In one example, such a signal may include a short sequence of binary ones followed by a short sequence of binary zeros. A relatively short sequence of binary ones may be transmitted exclusively during a portion of an interval during which the first mode message 315 is transmitted, such as during an interval T5, as shown in FIG. Fig. 4. In another example, in response to computer 110 transmitting a potentially sensitive message 415, e.g., a username or password or other content related to personally identifiable information to be received by a component of HMI 135 for display to an operator of vehicle 105, computer 110 may utilize second mode signal 420, which may include a complex pattern of binary ones and zeros. Second mode signal 420 may extend beyond the interval during which potentially sensitive message 415 is transmitted, e.g., over a time interval T6. Accordingly, computer 110 may dynamically adjust the length and / or complexity of a second mode signal 320 used as a watermark to authenticate first mode message 315.Such dynamic adjustment of the length and / or complexity of the second mode signal 320 may be based on a recipient of the first mode message 315, a sensitivity level (e.g., content) of data encoded in the first mode message 315, or other criteria.

[0041] As mentioned with reference to Fig. 4, the second mode signal 420 may not be time-synchronized or time-synchronized with a transmission of a first message, e.g., the potentially sensitive message 415, transmitted using a first modulation mode. Thus, the second mode signal 420 could, for example, act as a preamble transmitted before the transmission of the potentially sensitive message 415. In another example, the second mode signal 420 may be transmitted after the potentially sensitive message 415 to authenticate the potentially sensitive message. In another example, the second mode signal 420 may be used to convey additional data, such as metadata, which may include parameters describing the source of a potentially sensitive message 415, access data of the message 415, a length of the message 415, etc.

[0042] Fig. Figure 5A is a block diagram of a vehicle computer capable of communicating watermarking signals and data messages over a communications bus. As shown in Fig. 5A, the programming of the vehicle computer 110 may include a wavelet overlay component 505 operable to apply a wavelet algorithm to an input signal, such as an input from the second mode signal generator 310. In the context of this disclosure, a wavelet refers to a wave-like oscillation of an input signal, either in amplitude or phase, during a time interval of an input signal. Accordingly, in the example of Fig. 5A, the wavelet overlay component 505 displays a waveform that includes a portion of a sine wave oscillation of the amplitude. In other examples, the wavelet overlay component 505 may apply wavelet algorithms of various types, e.g., a cosine waveform, a trapezoidal waveform, a square waveform, etc., or another waveform type, to adjust the amplitudes over an interval of output signals from the second mode signal generator 310. In one example, a wavelet overlay applied by the wavelet overlay component 505 may be selected to provide isolation between the wavelet and the content of a data message, e.g., the first mode message 315, a potentially sensitive message 415, etc.

[0043] Programming of computer 110 may further include programming to upconvert a second mode signal using an upconverter 510. In one example, a second mode signal comprising a spread spectrum signal using a code rate of 1 megabit / second may be upconverted, e.g., by an integer or non-integer factor, to a code rate of 2 megabits / second, 3 megabits / second, 4 megabits / second, etc. Thus, second mode signal 520 may be a watermark that has been upconverted over a time interval and whose amplitude has been adjusted to authenticate first mode message 315.

[0044] Fig. Figure 5B is a block diagram of a vehicle computer capable of communicating watermarking signals and data signals over a communications bus. As shown in Fig. 5B, the programming of the vehicle computer 110 may include a wavelet overlay component 505 operable to apply a waveform that entails a 180° phase shift in an interval of an output signal from the second mode signal generator 310. Accordingly, in the example of Fig. 5B, the phase-shifted second mode signal 530 is an inverted version of the second mode signal 320. In other examples, the wavelet overlay component 505 may apply phase shifts other than 180°, such as 45° phase shifts, 90° phase shifts, or any other phase shift over an interval of an output signal from the second mode signal generator 310.

[0045] Fig. 6 is a block diagram of a vehicle computer capable of communicating watermarking signals and data messages over a communication bus. As previously stated, the second mode signal 320 may be modulated as a common-mode signal applied to the conductors of the vehicle communication bus 106. Further, and also as previously described, modulating signals in a common-mode mode may utilize a ground (e.g., floating ground, signal ground, chassis ground, etc.), which may provide a path for conducted electromagnetic interference. Accordingly, the vehicle computer 110 may, in response to a receiver of the second mode signal 320 (e.g., the sensors 115, the actuators 120, the components 125, the communication subsystem 130, the HMI 135, etc.),) detects an increase in the bit error rate or any other degradation of signal power, increase the amplitude of the second mode signal 320. Thus, as shown in . Fig. 6, the amplitude of the second mode signal 620 may be increased from a first amplitude (e.g., amplitude 605) to a second amplitude (e.g., amplitude 625) to provide an output signal amplitude that overcomes the source 610 of electromagnetic interference.

[0046] As mentioned with reference to Fig. 3, Fig. 4, Fig. 5A, Fig. 5B and Fig. 6, a first mode message, e.g., 315, may be transmitted using a differential mode (e.g., a first mode). The first mode message may be watermarked using a second mode signal, e.g., 320, transmitted via a common mode (e.g., a second mode). A second message transmitted in a differential mode, e.g., 415, may be watermarked using a second mode signal, e.g., 420, 520, 530, 620, having at least one parameter that is varied with respect to the second mode signal 320. Thus, in one example, as described with reference to Fig. 3, the second mode signal, e.g., 320, may be varied to include a reduced spreading ratio of a spread spectrum signal. In another example, as described with reference to Fig. 4, the second mode signal 420 may be varied with respect to the second mode signal 320 to extend beyond an interval during which the potentially sensitive second message 415 is transmitted. In another example, as described with reference to Fig. 5A, the second mode signal 520 may be varied with respect to the second mode signal 320 to include a wave superposition. In another example, as also described with reference to Fig. 5A, the second mode signal 520 may be varied to be upconverted with respect to the second mode signal, e.g., 320. In another example, as described with reference to Fig. 5B, the second mode signal 530 may include a wavelet superposition to be phase-shifted with respect to the second mode signal 320. In another example, as described with reference to Fig. 6, the second mode signal 620 may be varied to include an increased amplitude relative to the second mode signal 320.

[0047] Fig. Figure 7 is a block diagram of programming and / or hardware components of a vehicle computer 110 used in watermarking data communications. In the example of Fig. 7, the local controller 705 is a real-time session layer controller that includes a set of programming operations to generate, sequence, and modulate watermarking signals used to authenticate data messages. The network connection component 710 is a network layer component that controls network synchronization and network node management of the vehicle communication bus 106. In the example of Fig. 7, the network connection component 710 receives an initial transmission security seed (TRANSEC seed) from the transmission security engine 715. The transmission security seed includes an initial parameter, such as a pseudorandom number generator for a watermarking code, such as a spreading code, a spreading ratio, etc., that can be used to generate the second mode signal 320 described with reference to Fig. 3. Accordingly, the transmission safety engine 715 controls and manages dynamic generation of watermarking codes, such as codes used to generate the second mode signal 320 and the second mode signal 420. A controller area network bus media access control (CAN bus MAC) component 720 may be a legacy data formatting medium access control layer that includes logic for generating data messages, e.g., the first mode message 315 from Fig. 3. In other examples, the CAN bus MAC component 720 may be used to generate a different type of message, such as a message for use with a vehicle's Local Interconnect Network (LIN) bus, an Automotive Ethernet, or any other multi-conductor bus structure suitable for transmitting messages modulated using a differential mode (e.g., a first mode) with watermarking signals modulated using a common mode (e.g., a second mode).

[0048] The TRANSEC memory component 725 is operated to store a current value for a watermarking code. The sequence generator 740 is operated to generate the real-time binary values, e.g., a spreading sequence, according to a current watermarking code. The message buffer 730 is operated as a buffer for storing current data messages (e.g., the first mode message 315) as well as any other messages currently queued for transmission along the vehicle communication bus 106. The diagnostic engine 735 is operated to evaluate whether any current second mode signals received by the vehicle computer 110 contain an elevated level of noise and / or distortion, such as may be caused by electromagnetic interference.Accordingly, the diagnostic engine 735 may be operated to determine whether a bit error rate (BER) of a spreading code, i.e., one modulated via a common-mode mode, has increased above a threshold (e.g., 2%, 5%, 10%), etc. In this context, a threshold may be selected based on any error control coding capability of a spreading code used to generate the second-mode signal 320. In response, the diagnostic engine 735 may signal the local controller 705 to increase an amplitude of a second-mode signal to overcome electromagnetic interference occurring in a common-mode mode (e.g., in a first mode).

[0049] The transmit / receive (TX / RX) engine 745 receives input signals from a watermark comparator 765. Thus, the transmit / receive engine 745 operates to determine whether a received message (e.g., the first mode message 315) can be authenticated with an appropriate watermark. Accordingly, based on the output signals of the watermark comparator 765, the transmit / receive engine 745 determines whether to forward a message received from the vehicle communication bus 106 that has been authenticated or to discard the received message as inauthentic. In response to the authentication of the received messages, the messages may be forwarded to the message buffer 730.Thus, the watermark comparator 765 and the controller area network receive (CAN-RX) component 760 may operate concurrently to receive messages from the vehicle communication bus 106, with the CAN-RX component 760 receiving messages, e.g., the first mode message 315, modulated via a differential mode (e.g., a first mode), and the watermark comparator 765 receiving messages transmitted via a common mode (e.g., a second mode). Likewise, the watermark generator 750 may operate concurrently with the controller area network transmit (CAN-TX) component 755. Thus, the watermark generator 750 may modulate the second mode signals 320, e.g., using a common mode, concurrently with the CAN-TX component 755 to modulate first mode messages, e.g., B. using a differential mode.

[0050] Fig. 8 is a flowchart of an example process 800 for transmitting and receiving watermarked vehicle data using a vehicle communications bus. In some examples, executable instructions for performing the blocks of process 800 are stored in the memory of the vehicle computer 110, and / or such programming could be implemented in other computing devices of the vehicle system 100. Furthermore, the example process 800 may be used to provide watermark authentication of data messages in other applications, such as those capable of utilizing a differential mode (a first mode) and a second mode (e.g., a second mode).Thus, although process 800 is described as a vehicle-based process in which a watermarking signal is transmitted as a means of authenticating a data message, it should be understood that process 800 could be applied in the context of non-vehicle applications. Such non-vehicle applications may include, for example, security systems in which camera data transferred to a controller and modulated using a first mode may be authenticated using a second modulation mode. In other non-vehicle applications, sensor data modulated using a first mode may be authenticated using a second modulation mode.

[0051] As a general overview of a vehicle-based process 800, the vehicle computer 110 or a computer used in any other communication application may receive sensitive or potentially sensitive data. Sensitive or potentially sensitive data may include personal information of a vehicle operator, data uploaded from a mobile communication device of a vehicle operator or passenger, usernames of a vehicle operator or passenger used to gain access to a vehicle, etc. Thus, the vehicle computer 110 may determine whether a particular first mode message, e.g., 315, is to be watermarked, e.g., via the second mode signal 320. The vehicle computer 110 may additionally determine whether a second message, e.g.,the first mode message 415 is to be watermarked. A second mode signal may vary according to a spreading code rate, as described with reference to FIG. Fig. 3. The second mode signal may vary according to an interval during which the second signal is transmitted, as described with reference to Fig. 4. The signal of the second mode may be varied such that it is upconverted and / or superimposed with a wavelet, as described with reference to Fig. 5A and Fig. 5B. The second mode signal may vary to increase its amplitude, as described with reference to Fig. 6. Watermarking of transmitted data can serve as a means of authenticating sensitive or potentially sensitive data. Watermarking data communications can prevent the insertion of false data that could be used to gain unauthorized access to the vehicle, direct vehicle operations, or cause disclosure of information that is private to the vehicle operator and / or vehicle passengers. In such an environment, sensitive or potentially sensitive data messages are transmitted on a vehicle communications bus using a differential modulation mode (e.g., first modulation mode). Messages modulated using a first modulation mode are authenticated using a watermarking signal modulated in a common-mode mode (e.g., second mode).

[0052] Process 800 begins at block 805, where vehicle computer 110 generates first and second messages for transmission in a differential mode (first mode). In one example, a first mode message may relate to an operation of vehicle 105, such as an input from one of sensors 115. A second message may include potentially sensitive data, such as personal information of an operator or passenger of vehicle 105.

[0053] The process 800 may continue at block 810, where the vehicle computer 110 generates a first and a second watermark signal. A first watermark signal may include binary digits transmitted exclusively during a portion of an interval during which the first message 315 of the first mode is transmitted, such as during the time interval T5, as described with reference to Fig. 4. A second watermarking signal, such as a second mode signal 420, may include a more complex pattern of binary digits transmitted during an interval extending beyond the interval during which, for example, the potentially sensitive message 415 is transmitted, e.g., over the time interval T6. Alternatively or additionally, the second mode signal 420 may be upconverted and / or modified using the wavelet superposition component 505, which is operated to modify an amplitude of the second mode signal 320. Alternatively or additionally, the phase of the second mode signal 320 may be adjusted over an interval of an output signal from the second mode signal generator 310. Alternatively or additionally, the amplitude of the second mode signal 320 may be adjusted to overcome conducted electromagnetic interference.

[0054] The process 800 may continue at block 815, where the vehicle computer 110 transmits the first mode message 315 using a differential modulation mode (e.g., first modulation mode). Block 815 may include a simultaneous transmission of the second mode signal 320. Block 815 may utilize hardware and / or software components, such as the watermark generator 750 and the CAN TX component 755, described with reference to Fig. 7 were described.

[0055] The process 800 may continue at block 820, where the vehicle computer 110 transmits a second mode message using a differential modulation mode (e.g., a potentially sensitive message 415). Similar to block 815, block 820 may include simultaneously transmitting the second mode signal 420 using the watermark generator 750 and the CAN TX component 755, which may be described with reference to Fig. 7 are described.

[0056] The process 800 may continue at block 825, where a receiver, which may include the sensor 115, the actuator 120, the component 125, the communication subsystem 130, or the HMI 135, receives the first mode message 315 and the potentially sensitive message 415, as well as the first and second mode signals 320, 420. The reception of the first mode message 315 and the potentially sensitive message 415 and the first and second mode signals 320, 420 may utilize hardware and / or software components, such as the CAN RX component 760 and the watermark comparator 765, which may be described with reference to Fig. 7 are described.

[0057] The process 800 may continue at block 830, where a receiver, e.g., the sensor 115, the actuator 120, etc., performs a comparison to determine whether the received first and second mode signals (320, 420) match or at least correlate (e.g., 85% correlation, 90% correlation, 95% correlation, etc.) a watermark code stored within the TRANSEC memory component 725.

[0058] The process 800 may continue at block 835 where, in response to a match or threshold correlation at block 830 between the received first and second mode signals (320, 420) and the watermark codes stored in the TRANSEC memory component 725, messages may be forwarded to the message buffer 730.

[0059] The process 800 may alternatively continue at block 840, where a first mode message 315 may be discarded in response to an absence of a match or threshold correlation between the received second mode signal 320 and a watermark code stored within the TRANSEC memory component 725. Block 840 may additionally include discarding a potentially sensitive message 415 in response to an absence of a match or threshold correlation between the received second mode signal 420 and a watermark code stored within the TRANSEC memory component 725.

[0060] After block 835 or 840, process 800 ends.

[0061] In general, the described computing systems and / or devices may employ any of a number of computer operating systems, including, but not limited to, versions and / or variants of the Ford Sync® application, the AppLink / Smart Device Link middleware, the Microsoft Automotive® operating system, the Microsoft Windows® operating system, the Unix operating system (e.g., the Solaris® operating system distributed by Oracle Corporation in Redwood Shores, California), the AIX UNIX operating system distributed by International Business Machines in Armonk, New York, the Linux operating system, the Mac OSX and iOS operating systems distributed by Apple Inc. in Cupertino, California, the BlackBerry OS distributed by Blackberry, Ltd. in Waterloo, Canada, and the Android operating system developed by Google, Inc. and the Open Handset Alliance, or the QNX® CAR Platform for Infotainment offered by QNX Software Systems.Examples of computing devices include, without limitation, an on-board vehicle computer, a computer workstation, a server, a desktop, notebook, laptop, or handheld computer, or other computing system and / or device.

[0062] Computing devices generally include computer-executable instructions, where the instructions may be executable by one or more computing devices, such as those listed above. Computer-executable instructions may be compiled or interpreted by computer programs created using a variety of programming languages ​​and / or technologies, including, but not limited to, Java™, C, C++, Matlab, Simulink, Stateflow, Visual Basic, Java Script, Perl, HTML, etc., either alone or in combination. Some of these applications may be compiled and executed on a virtual machine, such as the Java Virtual Machine, the Dalvik Virtual Machine, or the like. Generally, a processor (e.g., a microprocessor) receives instructions from, e.g., memory, a computer-readable medium, etc.and executes those instructions, thereby performing one or more processes that include one or more of the processes described in this document. Such instructions and other data may be stored and transmitted using a variety of computer-readable media. A file in a computing device is generally a collection of data stored on a computer-readable medium, such as a storage medium, random access memory, etc.

[0063] A computer-readable medium (also referred to as a processor-readable medium) includes any non-transitory (e.g., physical) medium involved in providing data (e.g., instructions) that can be read by a computer (e.g., by a processor of a computer). Such a medium can take many forms, including, without limitation, non-transitory media and volatile media. Instructions can be transmitted through one or more transmission media, including fiber optics, wires, wireless communications, and internal structural elements comprising a system bus coupled to a processor of a computer. Common forms of computer-readable media include, for example, RAM, a PROM, an EPROM, a FLASH EEPROM, any other memory chip or cartridge, or any other medium from which a computer can read.

[0064] Databases, data repositories, or other data stores described in this document may include various types of mechanisms for storing, accessing, and retrieving various types of data, including a hierarchical database, a set of files in a file system, an application database in a proprietary format, a relational database management system (RDBMS), a non-relational database (NoSQL), a graph database (GDB), etc. Each such data store is generally contained within a computing device employing a computer operating system such as one of those listed above, and is accessed in one or more of a variety of ways over a network.A file system can be accessed by a computer operating system and can contain files stored in various formats. An RDBMS generally uses Structured Query Language (SQL) in addition to a language for creating, storing, editing, and executing stored procedures, such as the PL / SQL language mentioned above.

[0065] In some examples, system elements may be implemented as computer-readable instructions (e.g., software) on one or more computing devices (e.g., servers, PCs, etc.) stored on computer-readable media (e.g., disks, memory, etc.) associated with the computing devices. A computer program product may include such instructions stored on computer-readable media for performing the functions described herein.

[0066] In the drawings, the same reference numerals indicate the same elements. Furthermore, some or all of these elements could be changed. With respect to the media, processes, systems, methods, heuristics, etc., described in this specification, it is understood that although the steps of such processes, etc., have been described as occurring according to a certain ordered sequence, such processes could be practiced with the described steps performed in an order that differs from the order described in this specification. It is further understood that certain steps could be performed concurrently, other steps could be added, or certain steps described in this specification could be omitted.

[0067] All terms used in the claims are intended to be given their simple and general meaning as known to one skilled in the art, unless expressly indicated to the contrary herein. In particular, the use of the singular articles, such as "a," "an," "the," "the," etc., is intended to refer to one or more of the specified elements, unless a claim expressly limits it to the contrary. The adjectives "first" and "second" are used throughout this specification as identifiers and are not intended to symbolize meaning, order, or quantity. The use of "in response to" and "when determined" indicates a causal relationship, not merely a temporal relationship.

[0068] The disclosure has been described in an illustrative manner, and it is understood that the terminology used is intended to be in the nature of description rather than limitation. Many modifications and variations of the present disclosure are possible in light of the above teachings, and the disclosure may be practiced otherwise than as specifically described.

[0069] According to the present invention, a system is provided comprising: a computer including a processor coupled to a memory, the memory having stored therein instructions executable by the processor to: generate first and second messages for transmission over a communications bus via a first modulation mode; generate first and second watermarking signals for transmission on the communications bus via a second modulation mode, the first and second modulation modes being isolated from each other; transmitting the first message superimposed with the first watermarking signal; and transmitting the second message superimposed with the second watermarking signal, the second watermarking signal having a parameter that varies from the first watermarking signal.

[0070] According to one embodiment, the first modulation mode includes a differential mode.

[0071] According to one embodiment, the second modulation mode includes a common mode.

[0072] According to one embodiment, the first and second watermarking signals are modulated using a spread spectrum technique.

[0073] According to one embodiment, the parameter is based on a ratio of a spreading code rate to a data rate of a spread spectrum signal.

[0074] According to one embodiment, the parameter is an integer value of a ratio of a spreading code rate to a data rate of a spread spectrum signal.

[0075] According to one embodiment, the parameter is a phase shift of a spreading code of a spread spectrum signal.

[0076] According to one embodiment, the parameter is a length of the second watermarking signal.

[0077] According to one embodiment, the parameter is a code rate of a spread spectrum signal.

[0078] According to one embodiment, the parameter is an upconversion factor of a spreading code of a spread spectrum signal.

[0079] According to one embodiment, the parameter is an amplitude of a spreading code of a spread spectrum signal.

[0080] According to one embodiment, the instructions are further for: determining the parameter based on a content of the second message.

[0081] According to one embodiment, the instructions are further for: determining the parameter based on a recipient of the second message.

[0082] According to one embodiment, the instructions are further for: determining the parameter based on detected noise on a conductor of the communication bus.

[0083] According to one embodiment, the first or second watermarking signal extends beyond an interval during which the first message or the second message is transmitted.

[0084] According to one embodiment, the first or second watermarking signal ends before completion of the transmission of the first message or the second message.

[0085] According to the present invention, a method includes: generating first and second messages for transmission over a communication bus via a first modulation mode; generating first and second watermarking signals for transmission on the communication bus via a second modulation mode, the first and second modulation modes being isolated from each other; transmitting the first message superimposed with the first watermarking signal; and transmitting the second message superimposed with the second watermarking signal, the second watermarking signal having a parameter that varies from the first watermarking signal.

[0086] In one aspect of the invention, the method includes detecting a disturbance on one or more conductors of the communication bus and determining the parameter of the second watermarking signal based on the detected disturbance.

[0087] In one aspect of the invention, the method includes: determining a recipient of the second message; and determining the parameter of the second watermarking signal based on the determined recipient.

[0088] In one aspect of the invention, the method includes: determining a message content of the second message and determining the parameter of the second watermarking signal based on the determined content of the second message.

Claims

[1] Method comprising: Generating a first and a second message for transmission over a communication bus via a first modulation mode; Generating first and second watermarking signals for transmission on the communication bus via a second modulation mode, the first and second modulation modes being isolated from each other; Transmitting the first message superimposed with the first watermarking signal; and Transmitting the second message superimposed with the second watermarking signal, the second watermarking signal having a parameter that varies from the first watermarking signal. [2] The method of claim 1, wherein the first modulation mode includes a differential mode. [3] The method of claim 1, wherein the second modulation mode includes a common mode. [4] The method of claim 1, wherein the parameter is based on a ratio of a spreading code rate to a data rate of a spread spectrum signal. [5] The method of claim 1, wherein the parameter is a phase shift of a spreading code of a spread spectrum signal. [6] The method of claim 1, wherein the parameter is a length of the second watermarking signal. [7] The method of claim 1, wherein the parameter is a code rate of a spread spectrum signal. [8] The method of claim 1, wherein the parameter is an amplitude of a spreading code of a spread spectrum signal. [9] The method of claim 1, further comprising: Determine the parameter based on the content of the second message. [10] The method of claim 1, wherein the parameter is an upconversion factor of a spreading code of a spread spectrum signal. [11] The method of claim 1, further comprising: Determining the parameter based on detected noise on a conductor of the communication bus. [12] A method according to claim 1, wherein the first or second watermarking signal extends beyond an interval during which the first message or the second message is transmitted. [13] The method of claim 1, wherein the first or second watermarking signal ends before completion of the transmission of the first message or the second message. [14] A computer programmed to carry out the method according to any one of claims 1-13. [15] A vehicle comprising the computer of claim 14.

Images