Implementation of a dynamic trust model in a vehicle

Abstract

A system for implementing a dynamic trust model in a vehicle. The system comprises a first electronic device including an electronic processor. The electronic processor is configured to receive a message associated with an action to be performed by the first electronic device from a second electronic device, determine a trust score associated with the message, and determine a risk score associated with the action based on a safety consideration. The electronic processor is also configured to perform the action in response to the trust score being greater than or equal to the risk score.

Description

Summary

[0001] Modern vehicles contain a collection of highly specific electronic control units (ECUs). ECUs communicate with each other, but each ECU is uniquely tasked with a specific functionality. For example, an anti-lock braking system (ABS) ECU is designed to control a vehicle's braking system, with the ABS ECU containing software functions to control the vehicle's braking. Currently, the problem of trust or security within the ECU architecture is solved by establishing symmetric keys to authenticate messages between critical ECUs. High-security messages can include a key-based message signature to ensure a high degree of confidence that the message is coming from the correct ECU and not a compromised imposter.If it is determined that the ECU has been compromised, an ECU's access to signing keys or the ability to sign a message using a key may be revoked.

[0002] Keys used in current vehicles are assigned by the manufacturer during vehicle assembly and stored in the memory of each ECU. If any key update is necessary, a protected environment is required. Generally, symmetric key solutions used to provide security in ECU architecture are considered static and rigid, meaning that the keys change rarely and only with great difficulty. In current security techniques, the sender ECU calculates a message signature based on a key and sends a message signed with the message signature; after that, the receiver ECU calculates the message signature using the key contained in its own memory.If the message signature contained in the message from the sender ECU matches the message signature calculated by the receiver ECU, the receiver ECU trusts the message. If the message signature contained in the message from the sender ECU does not match the message signature calculated by the receiver ECU, the receiver ECU ignores the message. In other words, in the shared key solution, a receiver ECU has a binary response—either complete trust or complete lack of trust. There is no in-between or gradation.

[0003] However, the currently implemented binary trust solution to cybersecurity will become less applicable as vehicles become more reliant on software. For example, autonomous and semi-autonomous vehicles face fundamentally new cybersecurity challenges and require a more flexible vehicle software architecture. Customer service-oriented vehicle software architectures enable software modules to request services and negotiate them in real time. Software-defined vehicles (SDVs) rely on powerful central computers to control vehicle operation and require frequent updates.

[0004] The prevalence of zero-trust (ZT) cybersecurity systems has increased. ZT is currently used to protect confidential information or privacy in information technology (IT) systems. In IT systems, the ZT cybersecurity system uses a two-fold trust question. First, the ZT cybersecurity system asks: "Can the requester prove their identity?" Second, the ZT cybersecurity system asks: "Is the requester authorized to access the requested information?" SDVs, customer service-oriented vehicle software architectures, and vehicles with autonomous functionality require trust to be dynamic, nuanced, and adaptive. ZT enables trust to be dynamic, nuanced, and adaptive.

[0005] However, ensuring physical security is the main concern when ZT is applied to enhance security in vehicles rather than in IT systems. Within a vehicle, multiple sources can easily provide information, and the current state and functions of the vehicle are not really a secret that needs to be protected within the vehicle's boundaries. Within the vehicle, the main cybersecurity question is not, "Do I trust the other electronic device enough to tell it what to do?", but, "Do I trust the other electronic device enough to perform an action based on what it tells me?" In contrast to ZT in IT systems, where the question is about access, for cyber-physical systems such as vehicles, the question is about actions. Thus, in some implementations described here, every potential action that an electronic device (e.g., a keystroke) could perform has a security risk.B. an ECU) within a vehicle, there is an associated safety risk.

[0006] When multiple sources within the vehicle can provide similar information, there are several use cases where the dynamic trust model described here can provide significant benefits. For example, implementations described here enable the validation of possible variants of the inputs to the dynamic trust model (e.g., confidence values ​​mapped to confidence factors (described further below)) during the development phase, thus significantly reducing the overall validation effort required to maintain the dynamic trust model in a vehicle over time. Vehicle Safety Operations Centers (VSOCs) actively monitor fleets of vehicles for anomalous behavior and require a rapid process for incorporating this sensitive information into safety-critical systems.The dynamic trust model described here allows a factory-customer VSOC (OEM VSOC) to directly influence the vehicle. Intrusion detection systems (IDS) have been constructed to detect anomalous behavior in automotive systems, but high rates of false positives, associated with aggressive actions (e.g., stopping the vehicle, slowing the vehicle, and the like) performed when threats are detected, make it difficult to enable IDS to interact with critical systems. With millions of controller area network (CAN) messages exchanged between electronic devices in a vehicle per hour, the number of false detections made by an IDS is so high that it prevents the IDS from being useful. For example, drivers who receive one or more false alerts per day might ignore warnings regarding real or true threats.The dynamic trust model described here allows determinations made by an IDS to be taken into account without leading to a high rate of false positive results, making it useless.

[0007] Thus, implementations described herein provide a dynamic trust model that balances a risk associated with performing an action against a trust associated with a message requesting that the action be performed. The risk associated with performing an action is determined at least in part by security considerations associated with performing an action. According to some implementations, the trust associated with the message is determined at least in part by information received from the VSOC and determinations made by the IDS. Implementations described herein also balance a risk associated with performing an action against a trust associated with a message to determine an extent to which the data contained in the message should be relied upon when determining a value.

[0008] For example, one implementation provides a system for implementing a dynamic trust model in a vehicle. The system comprises a first electronic device including an electronic processor. The electronic processor is configured to receive, from a second electronic device, a message associated with an action to be performed by the first electronic device, determine a trust score associated with the message, and determine a risk score associated with the action based on a security consideration. The electronic processor is also configured to perform the action in response to the trust score being greater than or equal to the risk score.

[0009] According to another exemplary implementation, a method for implementing a dynamic trust model in a vehicle is provided. The method includes receiving a message associated with an action to be performed by a first electronic device from a second electronic device, determining a trust score associated with the message, and determining a risk score associated with the action based on a security consideration. The method also includes executing the action with the first electronic device in response to the trust score being greater than or equal to the risk score.

[0010] Yet another exemplary implementation provides a system for implementing a dynamic trust model in a vehicle. The system comprises an electronic device including an electronic processor. The electronic processor is configured to receive, from a second electronic device, a message associated with an action to be performed by the first electronic device, determine a confidence score associated with the message, and determine a risk score associated with the action based on a safety consideration. The electronic processor is configured to determine a reduced confidence value and, in response to the confidence score being less than the risk score, determine a value based on data included in the message and the reduced confidence score.Furthermore, the electronic processor included is configured to perform the action based on the value. Brief description of the drawings Fig. 1 schematically illustrates an example system for implementing a dynamic trust model in a vehicle according to some implementations. Fig. 2 shows schematically one in the system Fig. 1, according to some implementations. Fig. 3 provides a flowchart of an example first method for implementing a dynamic trust model in a vehicle according to some implementations. Fig. Figure 4 provides an example table illustrating how trust factors affect a trust score, according to some implementations. Fig. 5A and Fig. 5B provide example tables illustrating information that may be used to determine risk scores associated with actions according to some implementations. Fig. 6 provides an example table illustrating example confidence values ​​and weights associated with confidence factors according to some implementations. Fig. 7 provides a flowchart of an example second method for implementing a dynamic trust model in a vehicle according to some implementations. Fig. Figure 8 provides a graph of an example scenario using one or more of the implementations described here. Detailed description

[0011] Before any embodiments, examples, aspects, and features are explained in more detail, it is to be understood that their application is not limited to the details of construction and arrangement of components set forth in the following description or illustrated in the following drawings. Other embodiments, examples, aspects, and features are possible and may be implemented or embodied in various ways.

[0012] For ease of description, some or all of the exemplary systems illustrated herein are shown with a single instance of each of its component parts. Some examples may not describe or illustrate all components of the system. Other examples may include more or fewer of each of the illustrated components, may combine some components, or may include additional or alternative components.

[0013] Unless the context of their use clearly dictates otherwise, the articles "ein," "eine," and "das" are not to be interpreted as meaning "one" or "only one." Rather, these articles are to be interpreted as meaning "at least one" or "one or more." Likewise, when the terms "das" or "das genannte" are used to refer to a noun previously introduced by the indefinite article "ein" or "eine," "das" and "das genannte" mean "at least one" or "one or more," unless usage clearly dictates otherwise.

[0014] Additionally, although certain drawings depict hardware and software residing within particular devices, it should be understood that these depictions are for illustrative purposes only. According to some embodiments, the depicted components may be combined or separated into separate software, firmware, and / or hardware. For example, rather than being located and executed by a single electronic processor, logic and processing may be distributed among multiple electronic processors. Regardless of how they are combined or divided, hardware and software components may be located within the same computing device or may be distributed among different computing devices connected by one or more networks or other suitable communication links.

[0015] Thus, in the claims, if a device or system is claimed, e.g., as including an electronic processor or other element configured in a particular way, e.g., to make multiple determinations, the claim or claim element is to be interpreted to mean one or more electronic processors (or other elements), any one of the one or more electronic processors (or other elements) being claimed, e.g., as configured to make some or all of the multiple determinations. To reiterate, these electronic processors, or this processing, may be distributed.

[0016] Fig. 1 schematically illustrates an exemplary system 100 for implementing a dynamic trust model in a vehicle 105. Although implementations are described and illustrated herein as being implemented in a vehicle, the implementations described herein may be implemented in any cyber-physical machine or any machine with a computer that can perform actions that can have a physical impact in the concrete world. For example, the implementations described herein may be implemented in robots configured to perform tasks in factories, homes, offices, and the like. Although the vehicle 105 is Fig. 1 is shown as a four-wheeled vehicle, it may also be any type of vehicle, e.g., a two-wheeled vehicle such as a motorcycle, a three-wheeled vehicle such as a tricycle, or an eight-wheeled vehicle such as a tractor-trailer.

[0017] The vehicle 105 may contain one or more electronic devices. Fig. The exemplary vehicle 105 illustrated in Figure 1 includes a first electronic device 110, a second electronic device 115, and a third electronic device 120. According to some implementations, the first electronic device 110, the second electronic device 115, and the third electronic device 120 are ECUs. According to other implementations, the first electronic device 110, the second electronic device 115, and the third electronic device 120 are general computing devices. According to some implementations, the first electronic device 110 may be a central computer. According to some implementations, the vehicle 105 may include one or more components not illustrated herein. For example, the vehicle 105 may include one or more sensors, such as a radar sensor, a lidar sensor, a camera, and the like.According to some implementations, one or more of the second electronic device 115 and the third electronic device 120 may include a sensor. Furthermore, the vehicle 105 may include a different number of electronic devices than the three shown in FIG. Fig. 1 as included in the vehicle 105. The components of the vehicle 105, along with various other modules and components, are electrically and communicatively coupled to one another via direct or indirect connections or by or through one or more control or data buses (e.g., bus 125) that enable communication therebetween. In some cases, bus 125 is a Controller Area Network (CAN™) bus. In some cases, bus 125 is an Automotive Ethernet™, a FlexRay™ communications bus, or another suitable bus. In alternative cases, some or all of the components of the vehicle 105 may be communicatively coupled using suitable wireless modalities (e.g., Bluetooth™ or near-field communications links).

[0018] In addition to the vehicle 105 and its components, the system 100 may include a fourth electronic device 130 and a fifth electronic device 132 located outside the vehicle 105. According to some implementations, the fourth electronic device 130 is a remote server containing software that, when executed by an electronic processor, causes the server to implement the VSOC. According to some implementations, the VSOC may be implemented by a plurality of electronic devices working together (e.g., one or more servers, one or more databases, and the like). According to some implementations, the vehicle 105 may be configured to send and receive vehicle-to-everything (V2X) communications (e.g.,Vehicle-to-infrastructure (V2I) communications, vehicle-to-vehicle (V2V) communications, both, or the like), and the fifth electronic device 132 may be an electronic device included in another vehicle with which the vehicle 105 is configured to communicate, or included in an infrastructure (e.g., a traffic signal) with which the vehicle 105 is configured to communicate.

[0019] According to some implementations, one or more of the electronic devices included in the vehicle 105 are configured to communicate with the fourth electronic device 130 and with the fifth electronic device 132 via a communication network 135. The communication network 135 is a communication network that includes wireless connections, wired connections, or combinations of both. The communication network 135 may be implemented using a wide area network, e.g., the Internet, a Long Term Evolution (LTE) network, a 4G network, a 5G network, or one of their successors, and one or more local area networks, e.g., a Bluetooth™ network or Wi-Fi network, or combinations or derivatives thereof.According to some implementations, the vehicle 105 may communicate via the communication network 135 with electronic devices other than those electronic devices configured to implement the VSOC.

[0020] Fig. 2 illustrates an example of the components included in the first electronic device 110. The first electronic device 110 includes an electronic processor 200 (e.g., a microprocessor, an application-specific integrated circuit, etc.), a memory 205, and a communications interface 210. The memory 205 may be composed of one or more non-transitory computer-readable media. The memory 205 may include combinations of various types of memory, such as read-only memory ("ROM"), random access memory ("RAM"), electrically erasable programmable read-only memory ("EEPROM"), flash memory, or other suitable storage devices. The electronic processor 200 is coupled to the memory 205 and to the communications interface 210. The electronic processor 200 sends and receives information (e.g.,from the memory 205 and / or from the communication interface 210) and processes the information by executing one or more software instructions or software modules, which may be stored in the memory 205 or in another non-transitory computer-readable medium. The software may include firmware, one or more applications, program data, filters, rules, one or more program modules, and other executable instructions. The electronic processor 200 is configured to read from the memory 205 and execute, among other things, software for carrying out methods such as those described herein. In the illustrated example, the memory 205 stores, among other things, an IDS 215 and dynamic trust software 220. According to some implementations, the IDS may be stored in the memory of another electronic device included in the vehicle 105 (e.g.,an ECU or a central gateway) other than the first electronic device 110. The communication interface 210 sends and receives information from devices external to the first electronic device 110 (e.g., from components of the vehicle 105 via the bus 125 and from the fourth electronic device 130 and the fifth electronic device 132 via the communication network 135). According to some implementations, the second electronic device 115 and the third electronic device 120 have similar components and connections to the components and connections shown in FIG. Fig. 2 as being included in the first electronic device 110. According to some implementations, the fourth electronic device 130 and the fifth electronic device 132 may also include similar components and connections as the first electronic device 110. However, the memory of the fourth electronic device 130 and the fifth electronic device 132 may include different software components than those shown as being included in the memory 205 of the first electronic device 110.

[0021] Fig. 3 provides a flowchart of an exemplary first method 300 for implementing a dynamic trust model in a vehicle. According to some implementations, the first method 300 is performed when the electronic processor 200 executes the dynamic trust software 220. According to some implementations, the method 300 begins in step 305 when the electronic processor 200 of the first electronic device 110 receives a message from a second electronic device associated with an action to be performed by the first electronic device 110. According to some implementations, the second electronic device described in step 305 may be the second electronic device 115 (e.g., an ECU, a sensor, or a general computing device).For ease of illustration, the second electronic device referenced in method 300 is described below as second electronic device 115, but this is only one example of what the second electronic device described in method 300 may be. According to other implementations, second electronic computing device 115 may be fifth electronic device 125 (e.g., an electronic device included in another vehicle or in an infrastructure component with which vehicle 105 is configured to communicate). According to still other implementations, the second electronic device may be a component included in first electronic device 110 (e.g., memory 205 or additional memory or electronic processor (in . Fig. 2), which is included in the first electronic device 110). The action may be controlling the movement of the vehicle 105, outputting information to a vehicle operator, or the like. For example, the second electronic device 115 may be an ECU that controls a steering system of the vehicle 105, the first electronic device 110 may be an ECU that controls a braking system of the vehicle 105, and may request the message that the first electronic device 110 perform the action of applying the brakes to decelerate the vehicle 105 to a speed of 45 mph while the vehicle 105 makes a gradual change of direction.

[0022] In step 310, the electronic processor 200 determines a trust score associated with the message. According to some implementations, the electronic processor 200 is configured to determine the trust score associated with the message based on one or more trust factors. The one or more trust factors may include a threat probability determined by the IDS for the message, data from the VSOC, a history between the first electronic device 110 and the second electronic device 115, a distance associated with the message, an authentication status of the second electronic device 115, and the like.

[0023] Fig. Figure 4 contains an example table 400 illustrating how trust factors influence the trust rating assigned to a message. It should be understood that the trust factors included in Fig. 4, Fig. 5A, Fig. 5B and Fig. 6 are merely illustrative and do not necessarily illustrate a working example. Each row contained in table 400 represents a different exemplary message received by a first electronic device (e.g., first electronic device 110) from a second electronic device (e.g., second electronic device 115). Column 405 contains a trust score (f(i)) associated with a message. According to the Fig. In the example shown in Figure 4, the lowest trust rating that can be assigned to a message is 0 and the highest trust rating that can be assigned to a message is 1.

[0024] Column 410 contains a distance a message travels when sent from the second electronic device 115 to the first electronic device 110. The greater the distance a message travels, or the more hops a message makes, the greater the likelihood that the message can be tampered with. Thus, as shown in table 400, the trust rating of the message decreases as the distance the message travels increases.

[0025] Column 415 contains a history between the first electronic device 110 and the second electronic device 115. The longer the period of time during which the first electronic device 110 has trusted messages from the second electronic device 115, the greater the trust score determined for messages from the second electronic device 115.

[0026] Column 420 contains an authentication status of the second electronic device 115, or whether and how the first electronic device 110 authenticates the second electronic device 115. For example, the message in row 435 does not contain a message authentication code (MAC) or contains a MAC that the first electronic device 110 does not recognize, thus the authentication confidence factor that contributed to the lowest confidence score associated with the example depicted in row 435. Furthermore, the longer the MAC, the more difficult it is for a malicious actor to replicate it. Thus, longer MACs for messages signed with them contribute to higher confidence scores.It should be understood that the MAC is an exemplary form of authentication, and that other forms of authentication may be used to authenticate messages between the first electronic device 110 and the second electronic device 115. For example, RSA may also be used to authenticate messages between electronic devices.

[0027] Column 425 contains data from the VSOC. The VSOC may receive data from each vehicle in a fleet of vehicles and compile this data to gain insight into the cybersecurity threats currently facing vehicles. For example, the VSOC may determine that a particular type of sensor contained in vehicles is vulnerable to attack by a malicious actor. The VSOC may then warn the vehicles in the fleet to treat messages received from that type of sensor with a higher level of suspicion. Thus, VSOC data associated with the second electronic device 115 lowers the trust score associated with the message received by the second electronic device 115.

[0028] Column 430 contains a threat probability determined by the IDS for a message. For example, in row 435, the IDS determines that there is a greater than 20 percent probability that the message is compromised or associated with a cybersecurity threat, so the confidence rating associated with the message is negatively impacted. In contrast, in the example shown in row 440, the IDS determines that there is a less than 0.1 percent probability that the message is compromised or associated with a cybersecurity threat, so the confidence rating is positively impacted.

[0029] According to some implementations, in step 315, the electronic processor 200 determines a risk rating associated with the action based on a safety consideration. According to some implementations, a safety consideration is a potential physical consequence of the action being performed, and the safety consideration is assigned a value based on a severity of damage associated with the potential physical consequence of the action. Two available methods for calculating or determining a risk rating associated with an action in a vehicle are Failure Mode and Effects Analysis (FMEA) severity and Automotive Safety Integrity Level (ASIL). Fig. 5A illustrates an example table 500 of potential physical consequences (contained in column 505) and their associated values ​​(contained in column 510). For example, in row 515, the potential physical consequence of losing control of the vehicle at a high speed is assigned a value of 10, while in row 520, the potential physical consequence of losing control at a low speed is assigned a value of 8, since a higher severity of damage can be caused when a vehicle loses control at a high speed than can be caused when a vehicle loses control at a low speed. According to an example implementation, the risk score is 8 if the action has a potential physical consequence of losing control of the vehicle 105 at a low speed. Fig. 5B illustrates an example table 525 of ASIL levels and their associated risk ratings. Each action may be assigned an ASIL level based on the severity of harm associated with the potential physical consequence of the action. Actions that have potential physical consequences with high severity of harm are assigned an ASIL-D level and are assigned a risk rating of 4 based on the example table 525. Actions that have potential physical consequences with little to no severity of harm are assigned a QM level and are assigned a risk rating of 0 based on the example table 525.

[0030] In some situations, privacy considerations may be relevant to determining a risk rating associated with the action. For example, privacy considerations may be relevant to determining a risk rating associated with the action if the action involves sharing the vehicle's location with a remote vehicle or sharing a user profile of an operator of the vehicle 105. Thus, according to some implementations, the electronic processor 200 determines the risk rating based on the security consideration and a privacy consideration.

[0031] According to some implementations, in step 320, the electronic processor 200 performs the action in response to the confidence score being greater than or equal to the risk score. According to some implementations, the electronic processor 200 declines to perform the action in response to the confidence score being less than the risk score.

[0032] The method 300 is described below as a series of calculations. A M represents the action that the first electronic device 110 can perform based on the message M from the second electronic device 115. R A represents the risk assessment associated with performing action A M and R A = f(security, privacy). In other words, the risk assessment is determined based on security and privacy considerations. T Mrepresents the trust rating associated with the message sent to the first electronic device 110, where T M = f(distance, history, authentication, VSOC, IDS). In other words, the trust score is determined based on one or more trust factors. A trust score can also be expressed as T M = Σ if(i), where i represents a confidence factor. In other words, the confidence score is the sum of the confidence values ​​associated with the confidence factors on the basis of which the confidence score is determined. For example, a first confidence factor (such as a threat probability determined for the message by the IDS) may be assigned a confidence value of 0.5, a second trust factor (e.g., data from the VSOC) may be assigned a confidence value of 1, a third trust factor (e.g., the history between the first electronic device 110 and the second electronic device 115) may be assigned a confidence value of 0.2, a fourth trust factor (e.g., the distance associated with the message) may be assigned a confidence value of 0.3, and a fifth factor (e.g.,An authentication status of the second electronic device 115 may be assigned a trust value of 0.5. Thus, the trust rating in the previous example is 2.5.

[0033] According to some implementations, each confidence factor may be assigned a weight, and the confidence score may be the sum of the weighted confidence values ​​for each of the confidence factors. Equation 1 describes a normalized confidence score calculated using one or more weighted confidence factors. TM=∑iWeight⋅f(i)WeightTotal

[0034] Weight Gesamt can be used to normalize the confidence score and can be calculated using Equation 2 given below. WeightTotal=∑iWeighti

[0035] If T M ≥ R A the electronic processor 200 performs action A Mthrough or out.

[0036] Fig. 6 provides an example table 600 illustrating example confidence values ​​and weights associated with confidence factors. Each row contained in table 600 is associated with a confidence factor. For example, row 605 is associated with the distance confidence factor, row 610 is associated with the history confidence factor, row 615 is associated with the authentication confidence factor, row 620 is associated with the VSOC confidence factor, and row 625 is associated with the IDS confidence factor. Column 630 contains example weights associated with each confidence factor, and column 635 contains example confidence values ​​associated with confidence factors given a specific situation.For example, the confidence value associated with the distance confidence factor is 4 when a message is sent from a second electronic device to a first electronic device over a protected bus. According to another example, the confidence value associated with the distance confidence factor is 1 when a message passes through a firewall on its way from a second electronic device to a first electronic device.

[0037] Fig. 7 provides a flowchart of an exemplary second method 650 for implementing a dynamic trust model in a vehicle. According to some implementations, the second method 650 is performed when the electronic processor 200 executes the dynamic trust software 220. In step 655, the electronic processor 200 receives a message from a second electronic device associated with an action to be performed by the first electronic device. In step 660, the electronic processor 200 determines a trust score associated with the message. In step 665, the electronic processor 200 determines a risk score associated with the action based on a security consideration.

[0038] Steps 655, 660, and 665 may be similar, in this order, to steps 305, 310, and 315 described above with respect to the first method 300. However, the message associated with the action described in step 655 does not necessarily request that a first electronic device (e.g., the first electronic device 110) perform an action. Rather, the first electronic device 110 may be configured to perform an associated action based on a value determined by the first electronic device 110 using data included in the message.For example, the second electronic device 115 may be or include a sensor, the first electronic device 110 may be an ECU configured to control the steering system of the vehicle 105, and the message received by the first electronic device 110 may include data that the first electronic device 110 considers when determining a value (e.g., the speed of a following vehicle) to control the steering system of the vehicle 105 based thereon.

[0039] In step 668, the electronic processor 200 determines whether the confidence score is less than the risk score. In step 670, the electronic processor 200 determines a reduced confidence score in response to the confidence score being less than the risk score. The calculation or determination of a confidence score, according to some implementations, is described in Equation 3. Reliance={510(Trust−Risk),if trust <Risiko1,sonst

[0040] In Equation 3, Reliance represents a reliability value, Trust represents the confidence rating, and Risk represents the risk rating. According to some implementations, the reliability value is determined using an exponential scale. As in Fig. 3, if the confidence score is greater than or equal to the risk score, the confidence value is 1, and the electronic processor 200 can determine a value based on data included in the message and perform an action based on the value as if a dynamic trust model were not implemented in the vehicle 105. If the confidence score is less than the risk score, the confidence value is a reduced confidence value (in this example, a value less than 1) based on a difference between the confidence score and the risk score.

[0041] In step 675, the electronic processor 200 determines a value based on the data contained in the message and the reduced confidence value if the confidence score is less than the risk score. For example, the message may include data from a radar sensor regarding the position of an object in the vicinity of the vehicle 105. Based on the data from the radar sensor, data from a camera sensor, and data from a lidar sensor, the electronic processor 200 may determine a value (in this example, the position of the object in the vicinity of the vehicle 105). If a confidence score associated with a message from the radar sensor is less than a risk score associated with an action, the electronic processor 200 may operate based on the message from the radar sensor, wherein the electronic processor 200 determines a reduced confidence value.When the value (in this example, the position of the object in the vicinity of the vehicle 105) is determined based on the reduced confidence value, the electronic processor 200 relies less on the data contained in the message from the radar sensor and may rely more on data from other sensors (e.g., from the camera sensor and the lidar sensor) to determine the value. According to one implementation, the lower the reduced confidence value, the less the electronic processor 200 relies on the data contained in the message to determine a value.

[0042] In step 680, the electronic processor 200 performs the action based on the value. For example, if the value is a position of an object in the vicinity of the vehicle 105 and the first electronic device 110 is an ECU that controls the braking system of the vehicle 105, the electronic processor 200 may stop or decelerate the vehicle 105 based on the position of the object in the vicinity of the vehicle 105.

[0043] According to some implementations, a confidence value calculated for a message received by an electronic device at a previous time may be a confidence factor used to calculate a confidence score for a message received by the electronic device at a current time.

[0044] The following provides an example scenario in which a dynamic trust model is used. According to this example, two sensors (a radar sensor and a camera) provide an estimate of the speed of a second vehicle traveling in front of vehicle 105. A radar sensor provides an accurate speed value with a tolerance of ±1 km / h. The camera provides a less accurate speed with a tolerance of ±5 km / h. A typical sensor fusion strategy would be to combine the speed values ​​from the two sensor sources based on their accuracy (e.g., the weight of the speed from the radar sensor is five times more important than that of the speed from the camera).

[0045] However, using the implementations described herein for implementing a dynamic trust model in a vehicle, the electronic processor 200 determines trust ratings for the messages received from the radar sensor and the camera. The example described below focuses on determining trust ratings for messages from the radar sensor received over a period of time during which the radar sensor transitions from uncompromised to compromised.

[0046] Before the radar sensor is compromised, the confidence value associated with the confidence factor of the threat probability for the message determined by the IDS is 1 (f(IDS) = 1), because the IDS has established sufficient trust in the radar sensor.

[0047] Before the radar sensor is compromised, the confidence value associated with the confidence factor of data from the VSOC is 1 (f(VSOC) = 1), because the VSOC has established confidence in the radar sensors in the fleet of which vehicle 105 is a member. According to this example, the confidence factor of the data from the VSOC is assigned a weight of 5 (weight VSOC = 5) to give significant weight to the VSOC confidence factor in determining the confidence rating.

[0048] Both before and after the radar sensor is compromised, the confidence value associated with the trust factor of the authentication status of the electronic device sending the message is 1 (f(authentication) = 1), since according to this example, the assumption is that the attacker has successfully compromised the radar sensor and avoided detection in the radar sensor. In this example, the trust factor of the authentication status of the electronic device sending the message is assigned a weight of 3 (weight Authentifizierung = 3), since the authentication trust factor should have a moderate weight in determining the trust value.

[0049] Before the radar sensor is compromised, the confidence value associated with the confidence factor of the distance associated with the message is 0.4 (f(distance) = 0.4). According to this example, the distance confidence factor is assigned a value of 4 (weight Entfernung = 4).

[0050] Before the radar sensor is compromised, the trust value associated with the history trust factor between the electronic device receiving the message and the electronic device sending the message is 1 (f(history) = 1), because the radar sensor has a long history of being trusted. According to this example, the history trust factor is assigned a weight of 4 (weight Vorgeschichte = 1).

[0051] Based on Equation 1 and the confidence values ​​and weights described above, the initial confidence score associated with a message from the radar sensor is 0.87 (confidence Radarnachricht = 0.87).

[0052] According to this example, the data from the radar sensor and the camera can be used for two different tasks (to perform two different actions). First, the speed of the second vehicle from the radar sensor and the speed of the second vehicle from the camera can be used by an electronic device (e.g., the third electronic device 120) to determine a value for a speedometer. The action of determining a speedometer value can be assigned an ASIL-B level and a risk rating of 0.6. Second, the speed of the second vehicle from the radar sensor and the speed of the second vehicle from the camera can be used by an electronic device (e.g., the first electronic device 110) to determine the speed of the second vehicle to control the brakes of the vehicle 105.The action of controlling the brakes of the vehicle 105 may be assigned an ASIL-D level and a risk rating of 0.8.

[0053] Fig.Figure 8 provides a graph 700 of how the speed of the leading vehicle, determined or measured by various components, changes when the radar sensor is compromised, and how the confidence rating associated with messages from the radar sensor changes when the radar sensor is compromised. The true speed of the leading vehicle is represented in the graph 700 as a dashed line with short dashes. The speed of the leading vehicle from the radar sensor is represented as a dashed line with long dashes. The speed of the leading vehicle from the camera is represented as a thin solid line. The thick solid line represents the speed of the vehicle 105 determined by the first electronic device 110 based on the speed received from the radar sensor and the speed received from the camera.The dotted line represents the speed of vehicle 105 determined by the third electronic device 120 based on the speed received from the radar sensor and the speed received from the camera. At 8 seconds, vehicle 105 receives a message from the VSOC that other vehicles in the fleet have experienced suspicious activity in messages from radar sensors, and the confidence value for the VSOC confidence factor is 0.8 (f(VSOC) = 0.8). At 10 seconds, the radar sensor contained in vehicle 105 is compromised when an attacker changes the speed transmitted by the radar sensor to 25 km / h.At 10 seconds, the speeds of the preceding vehicle, determined by the first electronic device 110 and by the third electronic device 120 based on the speed received from the radar sensor and the speed received from the camera, fall to 33.3 km / h.

[0054] If the radar sensor included in vehicle 105 is compromised, the IDS included in vehicle 105 quickly detects the suspicious behavior, and the confidence value associated with the IDS confidence factor causes a gradual decrease in the confidence value associated with messages from the radar sensor, in increments from an initial 0.2. As the confidence score associated with messages from the radar sensor decreases, the first electronic device 110 and the third electronic device 210 gradually transfer their reliance on the preceding vehicle's speed data from the more accurate, but compromised, radar sensor to the less accurate, but uncompromised camera.Because the risk score associated with controlling the brakes of vehicle 105 is higher than the risk score associated with determining a speed reading for a speedometer, the first electronic device 110 responds more quickly than the third electronic device, while the confidence score decreases. At 14 seconds, the first electronic device 110, when determining the speed of the preceding vehicle, stops paying attention to messages from the radar sensor and instead relies on messages from the camera. At 14 seconds, the third electronic device 120 has just begun to pay less attention to messages received from the radar sensor and rely more on messages received from the camera.At 18 seconds, the fourth electronic device 130 implementing the VSOC provides another update to the vehicle to further decrease the confidence score associated with messages received from the radar sensor with f(VSOC) = 0.6, and the final confidence score associated with the radar sensor is 0.48.

[0055] Thus, present examples, aspects, and features provide, among other things, things, systems, and methods for implementing a dynamic trust model in a vehicle.

Claims

[1] A system for implementing a dynamic trust model in a vehicle, the system comprising: a first electronic device comprising: an electronic processor configured to: receive a message associated with an action to be performed by the first electronic device from a second electronic device; Determining a trust rating associated with the message; Determining a risk rating associated with the action based on a security assessment; and Perform the action in response to the confidence score being greater than or equal to the risk score. [2] The system of claim 1, wherein the electronic processor is configured to determine a confidence score associated with the message by: Determining the confidence score associated with the message based on one or more confidence factors. [3] The system of claim 2, wherein the one or more confidence factors include a threat probability determined by an intrusion detection system for the message, data from a vehicle security operations center, a history between the first electronic device and the second electronic device, a distance associated with the message, and an authentication status of the second electronic device. [4] The system of claim 1, wherein the action includes controlling the movement of the vehicle. [5] The system of claim 1, wherein the action includes outputting information to a vehicle operator. [6] The system of claim 2, wherein the electronic processor is configured to assign a weight to each of the one or more confidence factors. [7] The system of claim 1, wherein a safety consideration is a potential physical consequence of the action being performed, and the safety consideration is assigned a value based on a severity of damage associated with the potential physical consequence of the action. [8] The system of claim 1, wherein the electronic processor is further configured to: Determine the risk assessment based on the security consideration and a privacy consideration. [9] The system of claim 1, wherein the electronic processor is further configured to: Decline to perform the action in response to the confidence score being less than the risk score. [10] A method for implementing a dynamic trust model in a vehicle, the method comprising: receiving a message associated with an action to be performed by a first electronic device from a second electronic device; Determining a confidence rating associated with the message; Determining a risk assessment associated with the action based on a safety assessment; and Performing the action with the first electronic device in response to the trust score being greater than or equal to the risk score. [11] The method of claim 10, wherein determining a trust score associated with the message includes: Determining the confidence score associated with the message based on one or more confidence factors. [12] The method of claim 11, wherein the one or more confidence factors include a threat probability determined by an intrusion detection system for the message, data from a vehicle security operations center, a history between the first electronic device and the second electronic device, a distance associated with the message, and an authentication status of the second electronic device. [13] The method of claim 10, wherein the action includes controlling the movement of the vehicle. [14] The method of claim 10, wherein the action includes outputting information to a vehicle operator. [15] The method of claim 11, further comprising: Assigning a weight to each of the one or more confidence factors. [16] The method of claim 10, wherein a safety consideration is a potential physical consequence of the action being performed, and the safety consideration is assigned a value based on a severity of damage associated with the potential physical consequence of the action. [17] The method of claim 10, wherein the method further comprises: Determine the risk assessment based on the security consideration and a privacy consideration. [18] The method of claim 10, wherein the method further comprises: Decline to perform the action in response to the confidence score being less than the risk score. [19] A system for implementing a dynamic trust model in a vehicle, the system comprising: an electronic device containing: an electronic processor configured to: receive a message associated with an action to be performed by the first electronic device from a second electronic device; Determining a trust rating associated with the message; Determining a risk rating associated with the action based on a security assessment; and in response to the confidence rating being lower than the risk rating, Determining a reduced reliance value; determining a value based on data contained in the message and the reduced reliance value; and performing the action based on the value. [20] The system of claim 19, wherein the reduced confidence value is determined based on the difference between the confidence score and the risk score.

Images