METHOD AND DEVICE FOR PROTECTION AGAINST INTRODUCTION TO A VEHICLE DATA BUS

Description

[0001] The present invention claims priority from French application 2104785 filed on 06.05.2021, the content of which (text, drawings and claims). technical field

[0002] The invention relates to methods and devices for protecting against intrusions on a vehicle's data bus, particularly in automobiles. The invention also relates to a method and device for detecting one or more messages emitted by a malicious device on a vehicle's data bus. Technological background

[0003] Modern vehicles are equipped with numerous electronic control units (ECUs), each performing one or more functions, such as managing driver assistance systems, traction control, electronic brake-force distribution, or controlling actuators to ensure optimal operation of an internal combustion engine. These ECUs are interconnected via a multiplexed data bus of the CAN (Controller Area Network) or CAN FD (Controller Area Network Flexible Data-Rate) type. The data bus and ECUs together form the vehicle's onboard system. These ECUs are also called Electronic Control Units (ECUs). They contain software that executes to perform their assigned functions.

[0004] The transmission of malicious messages by a device such as an electronic control unit or by malware introduced into one of the onboard system's computers is used to hack or disrupt data exchange between the onboard system's computers. These malicious messages are potentially dangerous to vehicle safety, as their introduction can cause malfunctions in the computers that use the data contained within them. FR 3 102 269 A1, EP 3 726 796 A1, and US 2014 / 346284 A1 were used in preparing the European search report and examining the European patent application. Summary of the present invention

[0005] One object of the present invention is to solve at least one of the problems of the technological background, for example to improve protection against the introduction of malicious messages on a data bus of a vehicle, for example automobile and / or to improve the detection of intrusion of malicious message on a data bus of a vehicle.

[0006] Another object of the invention is to improve the security of data exchanges between computers connected by a vehicle's data bus.

[0007] According to a first aspect, the present invention relates to a method of protection against intrusion on a vehicle's data bus, the method comprising the following steps: detection of an intrusion of a first message transmitted on the data bus, the first message belonging to a set of messages transmitted on the data bus, the intrusion being detected according to a value of a counter associated with the first message and according to determined rules of incrementing the counter for each transmission of a message from the set of messages on the data bus; transmission, on the data bus, of a filtering request for the first message, the request including at least one value representing an identifier of the first message, the request being included in a message, called periodic, belonging to a set of messages transmitted periodically on the data bus.

[0008] According to one variant, the process further includes a step of storing the identifier in a "first in, first out" type memory, called FIFO memory, configured to store a determined number of identifiers, a periodic message being transmitted for each identifier stored in the FIFO memory, the periodic messages being transmitted sequentially according to a storage order of the associated identifiers in the FIFO memory.

[0009] According to another variant, the query includes a first value representing the identifier of the first message and a second value representing the identifier of the first message, the first value being obtained by a product of the identifier by a first determined matrix and the second value being obtained by a product of the identifier by a second determined matrix, the second matrix being different from the first matrix.

[0010] According to an additional variant, a computer receiving the filtering request includes in memory a third inverse matrix of the first matrix and a fourth inverse matrix of the second matrix, the first matrix including at least one value not present in the third matrix and / or the second matrix including at least one value not present in the fourth matrix.

[0011] According to yet another variant, a third value is obtained by a product of the first value by the third matrix and a fourth value is obtained by a product of the second value by the fourth value, the computer receiving the filtering request performing the filtering of the first message when the third value is equal to the fourth value.

[0012] According to an additional variant, the filtering of the first message by the computer triggers a degraded mode operation of the computer with respect to at least one function associated with the first message.

[0013] According to a second aspect, the present invention relates to a device for protection against intrusion on a data bus of a vehicle, the device comprising a memory associated with a processor configured to implement at least a part of the steps of the process according to the first aspect of the present invention.

[0014] According to a third aspect, the present invention relates to a system comprising a device as described above according to the second aspect of the present invention and at least one computer connected to the device as described above according to the second aspect of the present invention via a data bus, the system being configured for the implementation of the steps of the process according to the first aspect of the present invention.

[0015] According to a fourth aspect, the present invention relates to a vehicle, for example of the automobile type, comprising a device as described above according to the second aspect of the present invention or a system as described above according to the third aspect of the present invention.

[0016] According to a fifth aspect, the present invention relates to a computer program which includes instructions adapted for carrying out the steps of the process according to the first aspect of the present invention, in particular when the computer program is executed by at least one processor.

[0017] Such a computer program can use any programming language, and be in the form of source code, object code, or an intermediate form between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0018] According to a sixth aspect, the present invention relates to a computer-readable recording medium on which is recorded a computer program comprising instructions for carrying out the steps of the process according to the first aspect of the present invention.

[0019] On the one hand, the recording medium can be any entity or device capable of storing the program. For example, the medium can include a storage means, such as a ROM, a CD-ROM or a microelectronic circuit-type ROM, or a magnetic recording means or a hard drive.

[0020] On the other hand, this recording medium can also be a transmissible medium such as an electrical or optical signal, such a signal being able to be transmitted via an electrical or optical cable, by conventional or radio frequency, by self-directing laser beam, or by other means. The computer program according to the present invention can, in particular, be downloaded from a network such as the Internet.

[0021] Alternatively, the recording medium may be an integrated circuit in which the computer program is incorporated, the integrated circuit being adapted to execute or to be used in the execution of the process in question. Brief description of the figures

[0022] Other features and advantages of the present invention will become apparent from the description of the specific and non-limiting embodiments of the present invention below, with reference to figures 1 to 7 attached, on which: [ Fig. 1 ] schematically illustrates a vehicle data bus, according to a particular embodiment of the present invention; [ Fig. 2 ] schematically illustrates the storage of an identifier for the first message transmitted on the data bus of the figure 1 , according to a particular and non-limiting example of the present invention; [ Fig. 3] schematically illustrates the transmission of messages including the identifier of the first message placed in the memory of the figure 2 , according to a particular and non-limiting example of the present invention; [ Fig. 4 ] schematically illustrates the encryption of an identifier in the first message transmitted on the data bus of the figure 1 , according to a particular and non-limiting example of the present invention; [ Fig. 5 ] schematically illustrates the decryption of the identifier of the first message transmitted on the data bus of the figure 1 , according to a particular and non-limiting example of the present invention; [ Fig. 6 ] schematically illustrates a device configured to protect against intrusion on the data bus of the figure 1 , according to a particular and non-limiting example of the present invention; [ Fig. 7] illustrates a flowchart of the different stages of a process for protecting against intrusion on the data bus of the figure 1 , according to a particular and non-limiting example of the present invention. Description of examples of achievements

[0023] A method and device for protecting against intrusion on a vehicle's data bus will now be described in what follows, with joint reference to figures 1 to 7 The same elements are identified with the same reference symbols throughout the description that follows.

[0024] According to a particular, non-limiting embodiment of the present invention, an intrusion on a vehicle's data bus is detected by a device connected to the data bus. The data bus is, for example, of the CAN (Controller Area Network) or CAN FD (Controller Area Network Flexible Data-Rate) type. An intrusion is detected by monitoring the value of a counter associated with each message transmitted on the data bus, the counter incrementing according to specific rules. If a counter associated with the first transmitted message does not have the expected value, an intrusion associated with the transmission of that first message is detected. A filtering request is then transmitted by the device on the data bus, requesting one or more computers connected to the data bus to filter the first message.Such a request is advantageously transmitted in a message issued periodically on the data bus, the request comprising one or more values ​​representative of the identifier of the first message.

[0025] The transmission of a filtering request when an intrusion is detected helps to protect the computers on the data bus by requiring them to filter a message considered and detected as malicious, a malicious message corresponding to a message introduced on the data bus by an unauthorized or malicious device.

[0026] There figure 1 schematically illustrates a data bus 100 of a vehicle, according to a particular and non-limiting embodiment of the present invention.

[0027] Data bus 100 advantageously corresponds to a multiplexed data bus connecting several computers 11, 12, and 13. A device 10 configured to detect one or more intrusions on data bus 100 is also connected to computers 11 through 13 via data bus 100. Device 10 corresponds, for example, to an intrusion detection system, known as an IDS (Intrusion Detection System) device or module, and / or to an intrusion protection system, known as an IPS (Intrusion Protection System) device or module. Such an IDS / IPS module corresponds, for example, to a device configured to receive and process data and is, for example, hosted in a computer as a software module. An IDS / IPS module is advantageously hosted in a secure environment or zone (a "trusted zone") of a computer to protect it from a potential attack.

[0028] The data bus 100, the control units 11 to 13, and the device 10 together constitute all or part of a vehicle's embedded system, for example, a motor vehicle. However, the number of control units 11 to 13 is not limited to 3 and can extend to any number, for example, 2, 5, 10, 100, or more.

[0029] The embedded system also includes, for example, a telematic control unit, called a TCU (Telematic Control Unit), which is connected in communication with computers 11 to 13 via data bus 100. The TCU is connected to one or more antennas of the vehicle for data communication between the vehicle and one or more remote devices, for example via a wireless link based on a cellular network of type LTE (Long-Term Evolution), LTE-Advanced, also called 4G or 5G network.

[0030] The data bus is, for example, of the CAN type as defined in the ISO 11898 standard or of the CAN FD type as defined in the ISO 11898-1 standard. The data bus 100 advantageously implements time-division multiplexing allowing computers 11 to 13 to transmit messages (also called data frames).

[0031] According to one embodiment, data bus 100 corresponds for example to a FlexRay type bus (according to ISO 17458 standard) or Ethernet (according to ISO / IEC 802-3 standard).

[0032] Messages transmitted on data bus 100 can be of several types, depending on the data they carry. Each message type is identified by a specific identifier. A counter is included in the messages, or at least in messages of one or more specific types. A counter is associated with a first type of message identified by a unique identifier; that is, the value of the counter associated with this first type of message increments only when a message of this first type is successfully transmitted on the data bus, for example, by a specific computer on that data bus. If a counter is included in messages of a second type different from the first, then the counter for these messages of the second type increments only when a message of the second type is successfully transmitted on data bus 100.The message counter of the first type and the message counter of the second type are therefore independent of each other, particularly with regard to the incrementation of these counters.

[0033] The messages transmitted on data bus 100 correspond, for example, to periodic messages. These periodic messages include a counter and are of a specific type identified by a unique identifier. The messages are called periodic because they are transmitted at regular intervals (a period), for example, by computer 11, for example, every 10, 20, or 30 ms.

[0034] In another example, the messages transmitted on data bus 100 are event messages. These event messages include a counter and are of a specific type, identified by a unique identifier. The messages are called event messages because they are transmitted when an event is detected by a control unit, for example, control unit 11, or by a sensor associated with a control unit. Event messages are transmitted at irregular intervals that depend on the occurrence of the events to be signaled by these messages. For example, two consecutive event messages might be transmitted with a 30 ms interval, and the next two consecutive event messages might be transmitted on the data bus with a 10-minute interval between them.An event corresponds, for example, to an alert, for example associated with exceeding a threshold (rotation speed of the motor shaft above a threshold, motor temperature above a threshold, ...).

[0035] A process for protecting a vehicle's data bus against one or more intrusions is advantageously implemented by a device, for example by device 10, for example by one or more processors of device 10. According to an embodiment, the process is implemented by a system comprising device 10 and one or more computers connected to device 10 via a data bus, for example data bus 100.

[0036] In the first operation, an intrusion associated with the transmission of the first message on data bus 100 is detected. This first message might belong to a set of messages transmitted on the data bus, each message in this set being, for example, of the same type, such as periodic or event-driven. The intrusion is advantageously detected based on the value of a counter associated with the first message. This counter increments according to rules defined for each transmission of a message from the set of messages on the data bus. If the value of the counter for the first message does not follow one or more of the defined rules, then an intrusion is detected.

[0037] The detection of an intrusion based on a counter is described for example in patent document FR1911601 published on April 23, 2021 or in patent document FR1911602 published on April 23, 2021.

[0038] Each of these documents describes a method and device for detecting intrusion on a vehicle's data bus.

[0039] Thus, an intrusion detection process involves determining a counter value for each message in a set of periodic (or event-driven) messages transmitted over the data bus by a computer. The periodic (or event-driven) messages are advantageously identified by a common identifier, with the counter value incremented by 1 for each successful transmission of a message with the same identifier. The counter advantageously takes on a first value determined by the first message indicating the start of counter initialization, and a second value determined by the second message indicating the end of counter initialization. For periodic messages, the counter initialization time is advantageously longer than the period of the periodic messages.An intrusion on the data bus is finally detected by monitoring the value(s) taken by the counter included in the messages transmitted on the data bus, knowing the time it takes to initialize the counter.

[0040] The counter uses, for example, 1 byte (i.e., 8 bits) from each periodic message. The counter can thus hold 255 values, coded from 0 to 255 (or equivalently from 00 to FF in hexadecimal notation). Of course, the counter can use a different number of bits, for example, 10 bits, which would allow it to hold 1024 values. The rules for incrementing the counter associated with messages identified by a specific and unique identifier include the following: the counter value increments by 1 with each successful transmission of a message of the determined type on the data bus 100; at the beginning of counter initialization (for example triggered by the initialization of the computer emitting the messages, for example computer 11), computer 11 transmits a first message including a counter value equal to a first determined value, for example FE; the transmission of this message determines the beginning of the counter initialization phase; during the counter initialization phase, computer 11 may optionally transmit one or more first messages each including a counter value equal to the first determined value, for example FE;at the end of the counter initialization (the initialization time being determined and known by the calculator 11 and the device 10), the calculator 11 transmits a second message including a counter value equal to a second determined value, for example FF. ;

[0041] The counter's initialization time is advantageously greater than the period of the periodic messages that include this counter; that is, the initialization time is greater than the time interval between the transmission of two periodic messages identified by the same identifier. This initialization time is advantageously less than 254 times the period (according to the example in which the counter is encoded on 8 bits).

[0042] An intrusion is detected by device 10 in one or more of the following cases: when, outside the counter initialization period detected by the reception of a first message with a counter value equal to the first value, for example FE, the difference in the value taken by the counter of 2 successively received messages is not 1; when the time between the reception of a first message with a counter value equal to the first value (for example FE) and the reception of a second message with a counter value equal to the second value (for example FF) is less than the counter initialization period; when the counter value of a message received immediately after the reception of a second message with a counter value equal to the second value (for example FF) is not the first value (for example FE) and a third value corresponds to the value taken by the counter when it starts the incrementing series (for example 00).

[0043] Conversely, no intrusion is detected by device 10 in one or more of the following cases: when the difference in the value taken by the counter of 2 messages received successively is equal to 1; when several messages received successively have a counter having the value of the first value (for example FE), corresponding for example to several successive initializations of the counter.

[0044] For example, the following sequences of values ​​taken by the counter do not generate intrusion detection: FE ... FE FF 00: several initializations followed by an end of initialization (the duration between the end of initialization FF and the last start of initialization FE being less than the initialization duration) and a new series of counter increments starting with 00; FE ... FE FF FE ... FE FF 00: corresponding to the case where a counter initialization is carried out just after an end of initialization marked by FF, respecting for each sequence a duration between the end of initialization FF and the last start of initialization FE being less than the initialization duration; XX FE ... FE FF 00, where XX corresponds to any value other than FE or FF, corresponding to a counter initialization after a message including a counter at 'XX'.

[0045] This process allows the IDS / IPS 10 device to detect a malicious intrusion by sending an initial message that copies a message previously transmitted by a control unit, for example, control unit 11, and also contains data that is dangerous for one or more of the control units 11 to 13 and the vehicle's onboard system. Since the malicious device does not know the counter increment rules, it cannot generate a message that conforms to the rules described above.

[0046] The first message is, for example, identified by an identifier, coded for example on 11 bits.

[0047] In a second operation, when a first message is detected as corresponding to a malicious or unauthorized intrusion on the data bus 100, the identifier of the first message is recorded in a memory of the device 10. Such a memory corresponds for example to a sequential memory, for example of the "first in, first out" type, called FIFO memory (from the English "First In, First Out").

[0048] Such a recording is illustrated by the figure 2 which schematically represents the storage of the identifier of the first message, according to a particular and non-limiting embodiment of the present invention.

[0049] FIFO memory 20 corresponds to a shift register of fixed or variable size. FIFO memory 20 includes, for example, a specific number of registers 201, 202, 203, each configured to store a word of a specific number of bits. This word might correspond, for example, to the identifier of the first message detected as an unauthorized intrusion. FIFO memory 20 is configured, for example, to store three words or identifiers: 201, 202, 203. When the first message is detected as an unauthorized intrusion, its identifier 21 is stored in register 201, the identifier previously stored in register 201 is moved to register 202, the identifier previously stored in register 202 is moved to register 203, and the identifier previously stored in register 203 is removed from FIFO memory 20 and is no longer stored in memory 20.

[0050] The FIFO 20 memory is advantageously reset, i.e. emptied, when the vehicle is restarted.

[0051] In a third operation, a filtering request for the first message is transmitted by the IDS / IPS device 10 on the data bus. The filtering request is, for example, sent to all the computers 11 to 13 connected to the data bus or to a subset of these computers 11 to 13. Advantageously, such a request includes one or more values ​​representing the identifier 21 of the first message.

[0052] Such a filtering request is advantageously transmitted in a message issued periodically on the data bus, for example every 100 ms.

[0053] There figure 3schematically illustrates the transmission of periodic messages, each comprising an identifier of a first message detected as corresponding to an unauthorized intrusion on the data bus 100, according to a particular and non-limiting embodiment of the present invention.

[0054] There figure 3Figure 3 illustrates the transmission of a set of periodic messages as a function of time 't'. Each message advantageously carries one of the identifiers stored in the FIFO memory 20. For example, a first message carrying a filtering request for the first message identified by the identifier stored in register 201 is transmitted at time 't1'. This first message is followed by a second message carrying a filtering request for the first message identified by the identifier stored in register 202 and is transmitted at time 't2'. This second message is followed by a third message carrying a filtering request for the first message identified by the identifier stored in register 203 and is transmitted at time 't3'.

[0055] The first, second, and third messages are said to be periodic because they are transmitted periodically, that is, at regular intervals. The time interval between the transmission of two successive messages is constant and, for example, equal to 100 ms. The filtering requests are thus issued sequentially in the order of their storage in FIFO memory. The transmission of the first, second, and third messages is cyclical, as illustrated in the diagram. figure 3 that is to say that the three messages are re-sent in the same order at times 't4', 't5' and 't6', as long as the FIFO 20 memory contains identifiers of the first message(s) detected as corresponding to an intrusion.

[0056] If FIFO memory 20 contains no identifier, i.e., if no intrusion has been detected, no periodic message (and therefore no filtering request) is sent on data bus 100.

[0057] To reduce the risk of malicious attack related to the transmission of filtering request(s) on the data bus, the identifier of a first message targeted by a filtering request and included in that filtering request is encrypted, according to a variant of the embodiment.

[0058] According to one embodiment, a filtering query contained in a periodic message includes, for example, two values ​​representing the same identifier 21 from a first message. Such a query thus comprises a first value 'V1' representing the identifier 21, for example encoded on 16 bits, and a second value 'V2' representing the same identifier 21, for example also encoded on 16 bits.

[0059] The first value 'V1' is obtained (or encrypted or encoded) by multiplying the identifier 21 by a first, predetermined matrix 'M1'. The second value 'V2' is also obtained by multiplying the identifier 21 by a second, predetermined matrix 'M2', the second matrix being different from the first matrix so that the first value 'V1' and the second value 'V2' are different.

[0060] The first value 'V1' and the second value 'V2' are thus obtained from the identifier 'ID' and the first matrix 'M1' and the second matrix 'M2' as follows: V 1 = ID * M 1 V 2 = ID * M 2

[0061] The dimensions of the first matrix 'M1' are advantageously identical to the dimensions of the second matrix 'M2', these dimensions depending on the size of the identifier.

[0062] For example, if the identifier is coded on 11 bits, the dimensions of the first matrix 'M1' and the second matrix 'M2' are equal to 11x16.

[0063] According to one embodiment, one or more values ​​from the first matrix 'M1' and / or the second matrix 'M2' are not used to decrypt the identifier from the first value 'V1' and the second value 'V2'. Such a variant makes the encryption / decryption of the identifier more complex.

[0064] There figure 4 schematically illustrates the encryption of the identifier of a first message corresponding to an unauthorized intrusion on the data bus 100, according to a particular and non-limiting embodiment example of the present invention.

[0065] There figure 4 represents an identifier 40, corresponding for example to identifier 21 of the figure 2, this identifier 40 being coded on 11 bits and taking the value '01100101010'. A first value 'V1' 42 representing this identifier 40 is obtained by performing the product of the identifier 40 by the matrix 'M1' 41.

[0066] Following the example of the figure 4 , certain values ​​of the matrix 'M1' 41 represented in black and bold, such as the referenced value 412, correspond to values ​​of the matrix 'M1' 41 allowing the extraction of bits from the first value 'V1' also represented in black and bold, such as bit 422, which are not used during decryption to obtain the identifier, as will be illustrated by the figure 5 below.

[0067] The values ​​and bits shown in light gray, such as the value 411 and bit 421, correspond, conversely, to values ​​and bits that are found and used for decryption to obtain the identifier, as will be illustrated by the figure 5 below.

[0068] The same treatment is applied to identifier 40 to obtain the second value 'V2' from a second matrix 'M2' different from the first matrix 'M1' 41.

[0069] In a fourth operation, the computer(s) 11 to 13 receiving the periodic message(s) emitted by the device 10 are received. For example, a periodic message containing a filtering request for a first message detected as corresponding to an intrusion is received; this request includes one or more values ​​representing the identifier of this first message.

[0070] Each computer receiving the request decodes the value(s) of the identifier of the first message, such an identifier being for example stored in the memory of each receiving computer.

[0071] When the first message is received by computer(s) 11 to 13, this computer or these computers identify this first message as corresponding to a message to be filtered, the data contained in this first message is then not decoded or interpreted and this first message is not taken into account by computer(s) 11 to 13.

[0072] When the identifier of the first message is encrypted in the request, each computer 11 to 13 decrypts this identifier using the inverse matrix of the inverse matrix used to encrypt the identifier by device 10. Such an inverse matrix is ​​advantageously stored in the memory of each computer 11 to 13.

[0073] For example, and according to one variant of the embodiment, when the query includes the first value 'V1' 42 representing the identifier and the second value 'V2' representing the identifier, each computer determines the identifier from the inverse matrix 'M1 -1< ' (called third matrix) of the matrix 'M1' and from the inverse matrix 'M2 -1< ' (called fourth matrix) of the matrix 'M2', the third and fourth matrices 'M1 -1< ' and 'M2 -1< ' being stored in the memory of each computer 11 to 13.

[0074] A value of the identifier 'ID 1' (called the third value) is obtained by multiplying the first value 'V1' by the first inverse matrix 'M1 -1<' and a value of the identifier 'ID 2' (called the fourth value) is obtained by multiplying the second value 'V2' by the second inverse matrix 'M2 -1<', as follows: ID 1 = V 1 * M 1 − 1 ID 2 = V 2 * M 1 − 2

[0075] There figure 5schematically illustrates the decryption of the identifier of a first message corresponding to an unauthorized intrusion on data bus 100, according to a particular and non-limiting embodiment of the present invention.

[0076] There figure 5 represents an identifier 'ID 1' 51, corresponding for example to identifier 21 of the figure 2 , this identifier 51 being obtained via the product of the first value 'V1' 42 received in the filtering request by the matrix 'M1 -1< ' 51 corresponding to the inverse matrix of the matrix 'M1' 41 without the values ​​which made it possible to obtain the undefined bits 422 (illustrated in black and bold) of the first value 'V1' 42.

[0077] As illustrated on the figure 5 , the identifier 'ID 1 ' 51 has the value '01100101010' and effectively corresponds to the identifier 'ID' 40 of the first message.

[0078] The same treatment is applied to the second value 'V2' to obtain the identifier 'ID 2' from the second inverse matrix 'M2 -1< ' of the second matrix 'M2'.

[0079] When the query includes several representative values ​​of the identifier, for example two values ​​'V1' and 'V2', the identifiers of the first message obtained from each of these values ​​'V1' and 'V2' are compared.

[0080] When the comparison result indicates that these identifiers are identical (ID 1 = ID 2), then each computer 11 to 13 executes the received filtering request and filters the first message (provided the filtering request has not been corrupted or attacked). Filtering corresponds, for example, to disabling the reception of the first messages bearing that ID.

[0081] The reception of the first messages bearing this ID identifier will only resume after restarting this or these calculators 11 to 13 which executed the filtering request.

[0082] In such a case, the function(s) associated with the reception of such a first message by computer(s) 11 to 13 are implemented in degraded mode by computer(s) 11 to 13. If redundancy is implemented in the transmission of messages associated with these functions, the function(s) will be ensured by computer(s) 11 to 13 upon receipt of the redundant message(s) to the first messages identified as corresponding to a detected intrusion.

[0083] Conversely, when the comparison result indicates that these identifiers are not identical (ID 1 ≠ ID 2), then control units 11 to 13 do not execute the received filtering request. In this scenario, and according to a variant, a fault associated with this periodic message containing this filtering request is recorded by each control unit 11 to 13, and an alert message is generated and transmitted, for example, to a server at a security center (e.g., a SOC (Security Operations Center) of the vehicle manufacturer) to indicate that an attack is in progress on the function of filtering unauthorized or malicious messages.

[0084] There figure 6Figure 6 schematically illustrates a device 5 configured to protect the data bus 100 against intrusion, according to a particular and non-limiting embodiment of the present invention. Device 6 corresponds, for example, to device 10. In one variant, device 6 corresponds to a computer, also called an ECU, for the data bus 100.

[0085] Device 6, for example, is configured to implement the operations described alongside the figures 1 to 5 and / or steps of the process described in relation to the figure 7The elements of device 6, individually or in combination, can be integrated into a single integrated circuit, into several integrated circuits, and / or into discrete components. Device 6 can be implemented as electronic circuits or software (or computer) modules, or a combination of electronic circuits and software modules. In various specific embodiments, device 6 is coupled for communication with other similar devices or systems, for example, via a communication bus or through dedicated input / output ports.

[0086] The device 6 includes one (or more) processor(s) 60 configured to execute instructions for carrying out the steps of the process and / or for executing instructions from the software embedded in the device 6. The processor 60 may include integrated memory, an input / output interface, and various circuits known to those skilled in the art. The device 6 further includes at least one memory 61, for example, volatile and / or non-volatile memory, and / or includes a memory storage device that may include volatile and / or non-volatile memory, such as EEPROM, ROM, PROM, RAM, DRAM, SRAM, flash, magnetic disk, or optical disk.

[0087] The computer code of the embedded software(s) including the instructions to be loaded and executed by the processor is for example stored on the first memory 61.

[0088] According to a particular embodiment, the device 6 includes a communication interface 62 which allows communication to be established with other devices (such as the computers of the embedded system and connected to the data bus) via a communication channel 620. The communication interface 62 corresponds, for example, to a transmitter configured to transmit and receive information and / or data via the communication channel 620. The communication interface 62 corresponds, for example, to a wired network of the CAN (Controller Area Network) or CAN FD (Controller Area Network Flexible Data-Rate) type.

[0089] According to a further particular embodiment, the device 6 can provide output signals to one or more external devices, such as a display screen, one or more speakers and / or other peripherals via output interfaces not shown respectively.

[0090] There figure 7 illustrates a flowchart of the different stages of a method for protecting against intrusion on a vehicle's data bus, according to a particular and non-limiting embodiment of the present invention. The method is implemented, for example, by a device embedded in the vehicle, for example by device 10, or by device 6 of the figure 6 .

[0091] In a first step 71, an intrusion of a first message transmitted on the data bus is detected, the first message belonging to a set of messages transmitted on the data bus. This intrusion is advantageously detected based on a value of a counter associated with the first message and according to determined rules for incrementing the counter for each transmission of a message from the set of messages on the data bus.

[0092] In a second step 72, a filtering request for the first message is transmitted on the data bus. The filtering request includes at least one value representing an identifier of the first message, the request being included in a message, called a periodic message, belonging to a set of messages transmitted periodically on the data bus.

[0093] According to one variant, the variants and examples of the operations described in relation to the figures 1 to 5apply to the steps of the process of the figure 7 .

[0094] Of course, the present invention is not limited to the embodiments described above but extends to a method for detecting an intrusion on a vehicle's data bus, which would include secondary steps without falling outside the scope of the present invention. The same would apply to a device configured for implementing such a method.

[0095] The present invention also relates to a vehicle, for example a motor vehicle or more generally an autonomous land-powered vehicle, comprising device 6 of the figure 6 or a system comprising device 10 connected to one or more computers 11 to 13 via data bus 100.

Claims

1. Method for protecting against an intrusion on a data bus (100) of a vehicle, said method comprising a step of detecting (71) an intrusion of a first message transmitted on said data bus (100), said first message belonging to a set of messages transmitted on said data bus (100), each of these messages comprising an identification, said intrusion being detected as a function of a value of a counter associated with said first message and as a function of determined rules for incrementing said counter for each transmission of a message of said set of messages on said data bus (100); wherein said method further comprises a step of transmission (72), on said data bus (100), of a request for screening of said first message in order to deactivate a receipt of messages bearing the identification of said first message, said screening being said first message included in a message, called periodical, belonging to a set of messages transmitted periodically on said data bus (100), said periodically request comprising a first value (42) representative of the screening (40) of said first message and a second value representative of the identification (40) of said first message, said first value (42) being obtained by a identification of said product (40) by a first determined matrix (41) and said second value being obtained by a identification of said product (40) by a second determined matrix, said second matrix being different from said first matrix (41).

2. Method according to claim 1, further comprising a step of storage of said identification in a « first in, first out » type memory, called a FIFO memory (20), configured to store a determined quantity of identifications, a message {circumflex over (Y)} being transmitted for each identification stored in said FIFO memory (20), said periodic messages being transmitted sequentially according to an order of storage of the associated periodically in said FIFO memory (20).

3. Method according to claim 1 or 2, wherein a consignee computer (11 to 13) of said screening request comprises in memory a third matrix (51) inverse of said first matrix (41) and a fourth matrix inverse of said second matrix, said first matrix (41) comprising at least one value not present in said third matrix (51) and / or said second matrix comprising at least one value not present in said fourth matrix.

4. Method according to claim 3, for which a third value (52) is obtained by a product of said first value (42) by said third matrix (51) and a fourth value is obtained by a product of said second value by said fourth value, said computer consignee of said request executing the screening of said first message when said third value is equal to said fourth value.

5. Method according to claim 4, wherein said screening of said first message by said computer (11 to 13) causes said computer (11 to 13) to operate in degraded mode relative to at least one function associated with said first message.

6. Computer plan comprising instructions for implementing the method according to any one of claims 1 to 2, when these instructions are executed by a processor.

7. Device (6) for protecting against an intrusion on a data bus of a vehicle, said device (6) comprising a memory (61) associated with at least one processor (60) configured for implementing the steps of the method according to any one of claims 1 to 2.

8. System comprising the device (6) according to claim 7 and at least one computer (11 to 13) connected to said device via a data bus (100), said system being configured for implementing the steps of the method according to any one of claims 1 to 5.

9. Vehicle comprising the device (6) according to claim 7 or the system according to claim 8.