Apparatus and method for intrusion detection

Abstract

A control system 370 for a vehicle (100), the control system comprising one or more controllers, comprising input means (540) for receiving environment data from one or more sensors indicative of obje

Description

TECHNICAL FIELD The present disclosure relates to controlling a vehicle. Aspects of the invention relate to a control system, to a system, to a vehicle, to a method and to computer software. BACKGROUND Vehicles have increasing levels of autonomous functionality, such as SAE Level 3 and 4 autonomy, and telecommunication capability. As the complexity and interconnectivity of such systems increases, it has been realised that mechanisms to prevent or defend against network intrusions i.e. unauthorised access to an internal system of the vehicle are required. For example, in order to reduce a likelihood of unauthorised access to and attempts to control one or more modules or systems associated with a communication network of a vehicle it has been suggested that every module should communicate over the communications network using secured communication techniques. Furthermore it has also been suggested that at least some modules should have protection against computer-readable code stored therein being tampered with, such as the code being signed to support tamper detection. However these countermeasures use system resources to, for example, encrypt communications on the network and to detect code-tampering. Furthermore, use of such secure communication techniques by every module may require some modules to have increased capabilities such as processor power to support e.g. encryption. It is an aim of the present invention to address one or more of the disadvantages associated with the prior art. SUMMARY OF THE INVENTION Aspects and embodiments of the invention provide a control system, a system, a vehicle, a method and computer readable instructions as claimed in the appended claims. According to an aspect of the present invention there is provided a control system for a vehicle, the control system comprising one or more controllers, the control system comprising output means for outputting one or more override control signals to control movement of the vehicle, a memory device storing computer-readable instructions therein, processing means arranged to execute the computer-readable instructions stored in the memory device to determine an indication of an intrusion into a network system of the vehicle, determine a manoeuvre for the vehicle to a stopping location, and control the output means to output one or more override control signals to control the vehicle to perform the manoeuvre. Advantageously the vehicle is controlled to manoeuvre to the stopping location in dependence on the indication of the intrusion into the network system. According to an aspect of the present invention there is provided a control system fora vehicle, the control system comprising one or more controllers, the control system comprising input means for receiving environment data from one or more sensors indicative of objects in an environment of the vehicle, and one or more vehicle parameters, output means for outputting one or more override control signals to control movement of the vehicle, a memory device storing computer-readable instructions therein, processing means arranged to execute the computer-readable instructions stored in the memory device to determine, in dependence on the vehicle parameters and the environment data, an indication of an intrusion into a network system of the vehicle, determine, in dependence on the indication of the intrusion into the network system, and at least one of the environment data and the one or more vehicle parameters, a manoeuvre for the vehicle to a stopping location, and control the output means to output one or more override control signals to control the vehicle to perform the manoeuvre. Advantageously the vehicle is controlled to manoeuvre to the stopping location in dependence on the indication of the intrusion into the network system. The environment data may be indicative of a presence of any objects in the environment of the vehicle. Advantageously the manoeuvre is determined with respect to the presence of any objects. The stopping location may be a location at which the vehicle can stop with minimal or reduced impact on other road users. The stopping location may be a location at a side of a road way or a vehicle lane. The stopping location may be a location within a stopping lane, such as a hard shoulder, at least partly upon a verge of a road or other location not intended for use by through traffic on the roadway. The stopping location may be a location of relative safety, such as at a side of a navigable path. Advantageously the stopping location is convenient. The manoeuvre for the vehicle to the stopping location may be arranged to bring the vehicle to a stop. The navigable path may be a roadway. Advantageously the vehicle is brought to rest at the stopping location. Optionally the processing means is arranged to determine the indication of the intrusion into the network system, comprising determine, in dependence on the environment data, a valid trajectory for the vehicle. Advantageously the valid trajectory can be utilised to determine the indication of the intrusion. The processing means may be arranged to determine the indication of the intrusion into the network system, comprising determine, in dependence on the one or more vehicle parameters, whether a current trajectory of the vehicle corresponds to the valid trajectory. Advantageously a comparison of the valid and current trajectories enables the indication of the intrusion to be detected. The valid trajectory may correspond to a navigable path for the vehicle. Advantageously the valid trajectory may align with the roadway to enable comparison with the current trajectory. The navigable path optionally corresponds to roadway. The navigable path may correspond to a lane of a roadway. The processing means is arranged to determine the indication of the intrusion into the network system, comprising determining, in dependence on the one or more vehicle parameters, whether a control input to the vehicle exceeds an associated threshold. Advantageously the indication of the intrusion is determined in dependence on control inputs to the vehicle, which may allow rapid detection. The associated threshold may comprise a maximum acceleration. The maximum acceleration optionally comprises a maximum negative acceleration and / or a maximum lateral acceleration. Advantageously acceleration in either lateral or longitudinal directions may be used. The processing means may be arranged to control the output means to output the one or more override control signals according to a predetermined secure communication protocol. Advantageously the secure communication protocol reduces a likelihood of tapering with the override control signals. The computer-readable instructions stored in the memory device may be signed according to a predetermined protocol. Advantageously the instructions may be tamper resistant. The predetermined protocol may utilise a hash function, or similar. Advantageously the has function, or similar, may prevent tampering with the stored instructions. According to an aspect of the present invention there is provided a system for a vehicle, comprising a control system according to an aspect of the invention, and one or more control modules each associated with a respective vehicle sub-system, each control module being arranged to receive a respective control signal and to control the vehicle to assist in performing the manoeuvre in dependence thereon. Advantageously the control system may control the vehicle via the control modules. The at least one control module optionally comprises a first control module associated with a braking system of the vehicle and a second control module associated with a steering system of the vehicle. Advantageously braking and steering of the vehicle may be controlled. The system may comprise a primary vehicle controller arranged to receive environment data from one or more sensors, to determine a trajectory for the vehicle in dependence on the environment data and to control the vehicle to follow said trajectory. Advantageously the primary controller or control system may control the vehicle. The primary vehicle controller may be arranged to output one or more primary control signals to at least some of the one or more control modules to control the vehicle to follow said trajectory in dependence thereon. Advantageously the primary control signals may cause the vehicle to follow the trajectory. The override control signals may be associated with a higher priority than the primary control signals. The one or more control modules optionally respond preferentially to the one or more override control signals. Advantageously the override control signals may override control of the vehicle via the primary control signals, such as in the event of the intrusion being detected. The one or more control modules are each arranged to communicate with the control system according to the secure communication protocol. The primary controller may be arranged to communicate with the at least some of the one or more control modules without using the secure communication protocol. The primary controller is optionally arranged to receive the environment data from the one or more sensors of a first set of sensors associated with the vehicle. The control system is optionally arranged to receive the environment data from the one or more sensors of a second set of sensors associated with the vehicle. According to another aspect of the present invention there is provided a vehicle comprising a control system as described above or a system as described above. According to a further aspect of the present invention there is provided a method, comprising determining, in dependence on one or more vehicle parameters and environment data from one or more sensors indicative of objects in an environment of the vehicle, an indication of an intrusion into a network system of the vehicle, determining, in dependence on the indication of the intrusion into the network system, and at least one of the environment data and the one or more vehicle parameters, a manoeuvre for the vehicle to a stopping location, and outputting one or more override control signals to control the vehicle to perform the manoeuvre. The determining the indication of the intrusion into the network system of the vehicle may comprise determining, in dependence on the environment data, a valid trajectory for the vehicle. The determining the indication of the intrusion into the network system of the vehicle may comprise determining, in dependence on the one or more vehicle parameters, whether a current trajectory of the vehicle corresponds to the valid trajectory. The determining the indication of the intrusion into the network system of the vehicle optionally comprises determining, in dependence on the one or more vehicle parameters, whether a control input to the vehicle exceeds an associated threshold. According to yet another aspect of the present invention, there is provided computer readable instructions which, when executed by a computer, are arranged to perform a method according to an aspect of the invention. The computer readable instructions may be stored on a computer readable medium. The computer readable instructions may be tangibly stored on the computer readable medium. Within the scope of this application it is expressly intended that the various aspects, embodiments, examples and alternatives set out in the preceding paragraphs, in the claims and / or in the following description and drawings, and in particular the individual features thereof, may be taken independently or in any combination. That is, all embodiments and / or features of any embodiment can be combined in any way and / or combination, unless such features are incompatible. The applicant reserves the right to change any originally filed claim or file any new claim accordingly, including the right to amend any originally filed claim to depend from and / or incorporate any feature of any other claim although not originally claimed in that manner. BRIEF DESCRIPTION OF THE DRAWINGS One or more embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which: Figure 1 shows a vehicle according to an embodiment of the invention; Figure 2 shows a system as an example of the prior art; Figure 3 shows a system for a vehicle according to an embodiment of the invention; Figure 4 shows a trajectory according to an embodiment of the invention; Figure 5 illustrates a control system according to an embodiment of the invention; Figure 6 illustrates a method according to an embodiment of the invention; Figure 7 illustrates trajectories according to an embodiment of the invention; and Figure 8 illustrates a stopping location according to an embodiment of the invention. DETAILED DESCRIPTION A vehicle 100 in accordance with an embodiment of the present invention is described herein with reference to the accompanying Figure 1. The vehicle 100 in the present embodiment is an automobile (including commercial vehicle, heavy goods vehicle, truck or wagon), such as a wheeled vehicle 100, but it will be understood that embodiments of the present invention may be used in other types of vehicle, such as aircraft and watercraft. With reference to Figure 2, there is illustrated an example of a prior art system 200 for the vehicle 100. The system 200 comprises a controller 210 which is associated with one or more sensors 220 to provide an at least partly autonomous driving functionality for the vehicle 100. The system 200 comprises one or more control modules 230, 240, 250, 260 for controlling respective functions of the vehicle. The components of the system 200 are communicatively coupled via a communications network 205 of the vehicle, such as a time-based communication network e.g. FlexRay, which may be defined by ISO 17458, an IP-based communication network 205 or any other appropriate communication network. In the illustrated example the system 200 comprises a plurality of control modules 230, 240, 250, 260. The control modules 230, 240, 250, 260 may comprise a powertrain control modules (PCM) 230, a power-steering control modules (PSCM) 240, an anti-lock braking (ABS) control module 250 and a steering angle sensor module (SASM) 260. It will be appreciated that the control modules are merely illustrative and may comprise fewer or more control modules and that other control modules may be envisaged. In the example, the SASM 260 is arranged to provide steering angle data to the controller 210. The controller 210 is arranged to determine the autonomous control of the vehicle 100 and may to provide control data to one or more of the PCM 230, PSCM 240 and ABS 250. The sensors 220 provide data about an environment of the vehicle 100, such as indicating a location of objects which may include stationary objects, other vehicles, people etc. to the controller 210. The controller 210 is arranged to determine, in dependence on the data from the sensors 220 and data from at least some of the control modules, such as the SASM 260, a control of the vehicle 100. The controller 210, for example, may determine steering and braking control commands to be communicated to respective modules to control the vehicle 100. Every communication over the network 205 uses a protocol to provide secure communication with the system 200. Such secure communication may be achieved via, for example, authentication i.e. verifying an identity of devices or modules communicating over the network The protocol may comprise authenticating the communications such as authenticated data communicated in packets over the network 205 according to a predetermined authentication algorithm. For example, steering angle data from the SASM 260 communicated to the controller 210 is signed before being transmitted over the network 205 from the SASM 260 and verified at the controller 210. Control data 270 from the controller 210 to, for example, the ABS control module 250 is signed by the controller 210 before communication over the network 205 and verified at the ABS control module 250. Although the use of such a protocol may improve security and reduce an ability of an attacker to, for example, communicate malicious data over the network, a burden is placed on the controller 210 and each of the modules 230-260 as well as to the network 205 to support the authentication. Since each of the controller 210, sensors 220, and control modules 230-260 sign and verify communications, the entire system 200 may be considered to operate in a secured partition as indicated by dotted region 270. The authentication requirements consume processing resources within the system 200, such as requiring each control module 230, 240, 250, 260 to have a capability of performing the signing and verifying algorithm, and require each part of the system to have sufficient processing capability e.g. requiring secure hardware partition, more powerful hardware, increased network bandwidth and speed thereby increasing cost or in case of reaching a limitation of the hardware, disables the implementation of security measures hence leave the system vulnerable to cyber-attacks. Figure 3 illustrates a network system 300 according to an embodiment of the present invention. The system 300 as illustrated in Figure 3 comprises a control system 370 for a vehicle, such as the vehicle 100 illustrated in Figure 1. The control system 370 is formed in the illustrated embodiment by a controller 370 according to an embodiment of the invention, although it will be appreciated that this is merely illustrative and the system 300 may comprise more than one controller 370 according to an embodiment of the present invention. As will be explained, the control system 370 is arranged to determine an indication of an intrusion into the network system 300 of the vehicle 100. In dependence on determining the indication of the intrusion into the network system 300, the control system 370 is arranged to determine a manoeuvre for the vehicle 100 to a stopping location and to output one or more override control signals to control the vehicle 100 to perform the manoeuvre. The network system 300 comprises a first control system 310 which is associated with a first set of sensors 320 comprising one or more sensors. The first control system 310 may be formed by one or more controller 310, hereinafter first controller 310. The first set of sensors 320 and one more and first controller 310 provide an at least partly autonomous driving functionality for the vehicle 100, as will be explained. The first set of sensors 320 (first sensors 320) provide first environment data about an environment of the vehicle 100, such as indicating a location of objects or features which may include stationary objects, other vehicles, people, road or surface markings, etc. to the first controller 310. The first sensors 320 may comprise one or more devices for receiving radiation from the environment of the vehicle 100. At least some of the first sensors 320 may emit radiation outward from the vehicle 100 and receive radiation reflected from the environment. The first set of sensors 320 may comprise one more vision devices i.e. cameras, and lidar, radar or similar devices for supporting autonomous driving of the vehicle 100. The system 300 comprises one or more control modules 330, 340, 350, 360 for controlling respective functions of the vehicle. The components of the system 200 are communicatively coupled via a communications network 305 of the vehicle, such as a time-based communication network e.g. FlexRay, which may be defined by ISO 17458, an IP-based communication network 205 or any other appropriate communication network. In the illustrated example the system 300 comprises a plurality of control modules 330, 340, 350, 360. The control modules 330, 340, 350, 360 may comprise a powertrain control modules (PCM) 330, a power-steering control modules (PSCM) 340, an anti-lock braking (ABS) control module 350 and a steering angle sensor module (SASM) 360. It will be appreciated that the control modules are merely illustrative and may comprise fewer or more control modules and that other control modules may be envisaged. In the example, the SASM 360 is arranged to provide steering angle data to the first controller 310. The first controller 310 is arranged to determine the autonomous control of the vehicle 100 may to provide control data to one or more of the PCM 330, PSCM 340 and ABS 250. The first controller 310 is arranged to determine, in dependence on the data from the first sensors 320 and data from at least some of the control modules 330, 340, 350, 360, such as the SASM 360, a control of the vehicle 100. The first controller 310 may receive data indicative of one or more parameters of the vehicle 110 i.e. current parameters associated with the vehicle. Data indicative of at least some of the current parameters may be provided by at least some of the control modules 330, 340, 350, 360. For example, a current parameter associated with the vehicle 100 is a current steering angle of the vehicle, a current speed of the vehicle 100 etc. Other parameters may include a geographic location of the vehicle, such as indicated by received wireless signals, including GPS signals, a heading of the vehicle 100 etc. The controller 310 may determine steering, acceleration and braking control commands to be communicated to respective control modules to control the vehicle 100. The first controller 310 is arranged to receive the first environment data from the first sensors 320 and to control the vehicle 110 in dependence thereon. In particular, the first controller 310 is arranged to provide at least Level 3 autonomous driving of the vehicle 100 and, in some embodiments, at least Level 4 autonomous driving. The first controller 310 is arranged to determine a route or trajectory 450 for the vehicle 100 in dependence on the first environment data. The trajectory 450 may be a trajectory or route 450 for the vehicle 100 to follow from a current location 430 of the vehicle, as shown in Figure 4, to a destination location 440. The destination location may be a location at a time horizon in future of the current time, such as 1, 2 or 5 seconds ahead of the current time, although other time horizons may be used. The first controller 310 may determine the trajectory 450 in dependence on a location of objects and features indicated in the first environment data, where at least some objects may be dynamic i.e. moving objects for which at least some of the first sensors 320 and / or the first controller 310 track to determine the trajectory 450 in dependence thereon. In an example, the trajectory 450 is a trajectory 450 determined by the first controller 310 which follows a lane of a roadway 410 as indicated by surface markings 420 on a surface of the roadway 410. The trajectory 450 comprises data indicative of one or more of braking, acceleration and steering inputs for the vehicle 100 to control a speed and direction of the vehicle 100 accounting for the presence and movement of, for example, other vehicles in the environment. The trajectory 450 may comprise, or be defined by, a plurality of waypoints and / or control data for the vehicle 430 indicative of one or more of braking, acceleration and steering inputs along the trajectory 450, such as at intermediate time points between the current time and the time horizon. The first controller 310 is arranged to receive the first environment data from the first sensors 320 and to output first control data to at least some of the one or more control modules 330, 340, 350, 360 for controlling the movement of the vehicle 100, 430. Some of the control modules 330, 340, 350, 360 may provide data to the first controller 310, such as the SASM 360 indicative of a steering angle of the vehicle 100, 430. In embodiments of the invention, data communicated with i.e. to / from the first controller 310 is not encrypted, thereby allowing the first controller 310 and associated modules to advantageously operate upon more lightweight hardware i.e. without a processing overhead for encryption. The second controller 370 is associated with a second set of sensors 380. The second set of sensors 380 (second sensors 380) provide second environment data about the environment of the vehicle 100, such as indicating a location of objects or features which may include stationary objects, other vehicles, people, road or surface markings, etc. to the second controller 370. The second sensors 380 may comprise one or more devices for receiving radiation from the environment of the vehicle 100. At least some of the second sensors 380 may emit radiation outward from the vehicle 100 and receive radiation reflected from the environment. The second set of sensors 380 may comprise one more vision devices i.e. cameras, and lidar, radar or similar devices for supporting autonomous driving of the vehicle 100. In Figure 3 the first set of sensors 320 and the second set of sensors 380 are shown as disparate sets. However it will be appreciated that at least some of the sensors of the vehicle may be shared between the first and second sets of sensors 320, 380. In some embodiments, the first and second sets of sensors are not co-terminus i.e. that although some sensors may be shared between both sets, at least some sensors of the second set 380 are not within the first set of sensors 320. For example, the second set of sensors may comprise one or more devices, such as a lidar device and / or a camera, which are not used by the first controller 310. The second controller 370 is arranged to communicate with one or both of the second sensors 380 to receive second environment data and at least some of the control modules 330, 340, 350, 360 to control movement of the vehicle 100, 430 using a predetermined secure communication protocol. The secure communication protocol may comprise, for example a MAC (message authentication code) attached to the message. The authentication is utilised to ensure secure communication to / from the second controller 370. In particular, the authentication may assist in a recipient having confidence in an identity of a sender of a communication i.e. that the sender is not an intruder on the network. In this way, the second controller 370 may be considered to operate in a secured partition as indicated by dotted region 390. It will be appreciated that the first controller 310 operates outside of the secured partition 390 as illustrated in Figure 3. As noted above, the control system 370, hereinafter second controller 370, is arranged to determine an indication of an intrusion into the network system 300 of the vehicle 100. In some embodiments, determining the indication of the intrusion into the network system 300 comprises the second controller 380 determining whether a current trajectory of the vehicle substantially corresponds to a valid trajectory. If the indication of the intrusion into the network system 300 is determined or detected, then the second controller 370 is arranged to determine a manoeuvre for the vehicle to a stopping location and to output one or more override control signals to control the vehicle 100 to perform the manoeuvre, as will be explained. The control signals provided by the second controller 370 are referred to as override control signals as they are intended to override control signals from the first controller 310. That is, the control modules 330, 340, 350, 360 are arranged to respond preferentially to the override control signals from the second controller 370. Whilst reference is made to the control modules 330, 340, 350, 360 it will be appreciated that other control modules may be arranged to respond preferentially to the override control signals from the second controller 370. Figure 5 illustrates the second controller 370, 510 according to an embodiment of the invention. The controller 510 comprises processing means 520 and memory means 530. The processing means 520 may be one or more electronic processing device 520 or processor 520 which operably executes computer-readable instructions. The memory means 530 may be one or more memory device 530 or memory 530. The memory means 530 is electrically coupled to the processing means 520. The memory means 530 is configured to store instructions, and the processing means 520 is configured to access the memory means 530 and execute the instructions stored thereon. The instructions stored in the memory 530 when executed by the processor 520 are arranged to perform a method according to an embodiment of the invention, such as illustrated in Figure 6. The controller 510 comprises a communication means 540. The communication means 540 may comprise an electrical input / output 540 of the controller 510. In this way, the communication means 540 comprises an input means and an output means for the controller 510. In some embodiments the communication means 540 may comprise a separate input means and output means. The communication means 540 may comprise an electrical interface of the controller 510 for connecting to a communication network, such as for example Ethernet, although other communication networks may be envisaged. The communication means 540 may be a network interface module 540 for communicably connecting to the second controller 510 to the communications network 305 of the vehicle 100. Figure 6 illustrates a method 600 according to an embodiment of the invention. The method 600 is a method of controlling a vehicle 100, such as the vehicle 100 illustrated in Figure 1. In particular, the method 600 is a method of determining whether the network 305 of the vehicle 100 has been compromised. The method 600 may be performed by the system 300 illustrated in Figure 3 and, in particular, the second controller 370, 510 and the processor 510 thereof. In particular, the memory 530 of the second controller 370, 510 may comprise computer-readable instructions which, when executed by the processor 520, perform the method 600 according to an embodiment of the invention. The computer-readable instructions stored in the memory 520 of the second controller 370 may be signed according to a predetermined protocol to ensure integrity i.e. to prevent tampering. The method 600 comprises a block 610 of receiving, at the second controller 370, 510 data indicative of one or more vehicle parameters and environment data. The data indicative of the one or more vehicle parameters and the environment data may be received at the second controller 370 via the network 305 of the vehicle 100. The data indicative of the one or more vehicle parameters may be received from at least some of the control modules 330, 340, 350, 360 and / or from other sources, such as a navigation signal receiver (not shown) or navigation system of the vehicle 100. The environment data may be received from the second sensors 380. As noted above, the data indicative of the one or more vehicle parameters and the environment data may be one or both of secured by authentication and at least partially encrypted, or otherwise secured. The method 600 comprises a block 620 of determining an indication of an intrusion into the network system 300 of the vehicle 100. Block 620 is performed in dependence on the one or more vehicle parameters and the environment data received by the second controller 370. In the method 600 shown in Figure 6, block 620 is a decision block in which it is determined whether the indication of an intrusion into the network system 300 of the vehicle 100 exists or is detected. If no indication of an intrusion exists, the method 600 returns to block 610 via 622. If, however, an indication of intrusion into the network system 300 of the vehicle 100 exists i.e. is detected, the method 600 moves to block 630 via 645. In block 620, in some embodiments, the second controller 370 is arranged to determine the indication of an intrusion into the network system 300 of the vehicle 100 based on a determination of a valid trajectory. In block 620 the second controller is arranged to determine, in dependence on the environment data received in block 610, a valid trajectory for the vehicle. The valid trajectory may be a trajectory which, for example, corresponds to a navigable path for the vehicle. That is, the valid trajectory follows the navigable path. The navigable path may correspond to a roadway or other path along which the vehicle 100 may validly travel, such as a path through a parking area, an off-road path suitable for the vehicle etc. Wherein the navigable path corresponds to a lane of a roadway, the valid trajectory may follow a lane 705 of the roadway 701, as illustrated in Figure 7. The lane 705 is defined between a boundary of the roadway 701 and surface markings 702, such as paint, indicating the lane boundary. The second controller 370 is arranged to determine the valid trajectory in dependence on the environment data received from the second sensors 380. For example, in dependence on the second sensors 380 but not the first sensors 320. In Figure 7 a vehicle is located as shown at 710 and the valid trajectory for the vehicle 710 is determined as 720 which corresponds to the lane 705 of the roadway 701. It will be appreciated that the valid trajectory should avoid objects, such as other vehicles, people etc, present in the environment. Therefore, although not shown in Figure 7, the valid trajectory may comprise a movement around e.g. a parked vehicle, or a lane change to pass a slower vehicle. The second controller 370 determines in block 620 whether a current trajectory of the vehicle 100 corresponds to the valid trajectory. The second controller receives in block 610 the one or more vehicle parameters, such as the location and heading of the vehicle 710. Based on the received vehicle parameters the second controller 370 is arranged to determine whether the vehicle 710 is actually following, at least substantially, the valid trajectory. For example, as shown in Figure 7 at a point in time the vehicle begins to follow trajectory 730 which may be indicated by a change in heading of the vehicle 710 and / or a location of the vehicle 710 at least over a period of time such as 0.5 seconds, 1 second, 2 seconds etc. When the second controller 370 determines that the vehicle is not following the valid trajectory i.e. is following a different trajectory, it is determined that the indication of an intrusion into the network system 300 of the vehicle 100 exists. The different trajectory may be followed by, for example, a compromise of the first controller 310, such as the first controller executing unauthorised code, or an injection of malicious control data into the network 305. In this way, the second controller 370 acts as a watchdog controller over the first controller 310. In some embodiments, the second controller 370 is arranged to determine an indication of the intrusion into the network system 300 by determining whether a control input to the vehicle exceeds an associated threshold. Determining whether the control input to the vehicle exceeds an associated threshold may be performed in dependence on the one or more vehicle parameters received in block 610. For example, the control input may comprise one or more of a braking input, an acceleration input or a steering input to the vehicle 100. In some embodiments, the associated threshold comprises a maximum acceleration. The maximum acceleration may comprises one or both of a maximum longitudinal acceleration or a maximum lateral acceleration of the vehicle 100. The longitudinal acceleration may be caused by an application of excessive accelerator or braking inputs to the vehicle 100 and the lateral acceleration may be caused by an application of excessive steering inputs to the vehicle. The vehicle parameters received in block 610 may comprise, for example, a location of the vehicle and / or data from one or more accelerometers associated with the vehicle 100 indicative of an acceleration of the vehicle 100. In dependence on the vehicle parameters the longitudinal and / or lateral acceleration of the vehicle 100 may be determined. In block 630 a manoeuvre for the vehicle 100 to a stopping location is determined. The manoeuvre is determined as comprising one or more control inputs for the vehicle 100 from the current location of the vehicle i.e. location of vehicle 430 in Figure 4 to the stopping location. The control inputs are determined as those inputs to guide the vehicle to the stopping location from its current location. The manoeuvre is determined in block 630 with respect to at least one of the environment data and the one or more vehicle parameters received in block 610. For example, the manoeuvre may be determined with respect to a current location and / or heading of the vehicle 100, 430 as indicated by the vehicle parameters. Furthermore, the manoeuvre may be determined with respect to the stopping location identified within the environment data received in block 610. The stopping location may be, for example, a location at a side of a roadway such as a layby or other location at which the vehicle 100 may stop. Block 640 comprises outputting one or more override control signals to control the vehicle to perform the manoeuvre as determined in block 630. The override control signals are output by the second controller 370. It is anticipated that, in some instances, the override control signals from the second controller 370 are output at the same time as the first controller 310 outputs control signals i.e. for receipt by the same at least some of the control modules 330, 340, 350, 360. Therefore, the control modules 330, 340, 350, 360 are arranged to preferentially respond to the override control signals than the control signals from the first controller i.e. the override control signals have a higher priority. In this way, the second controller 370 is able to assume control of the vehicle 100 from the first controller 310 to manoeuvre the vehicle to the stopping location. Figure 8 illustrates an example stopping location for the vehicle 100, 710, 810 using the roadway 705 illustrated in Figure 7 when the indication of the intrusion into the network system 300 is determined by the second controller 370. As discussed above, the second controller 370 is operative to assume control of the vehicle 100, 710, 810 from the first controller 310 to manoeuvre the vehicle 100, 710, 810 to the stopping location 820. As illustrated in Figure 8 the stopping location 820 is in a region 805 adjacent the lane 705 of the roadway 701, such that the vehicle 100, 710, 810 when at rest in the stopping location 820 does not cause, or causes minimal obstruction to other vehicles travelling in the lane 705 on the roadway 701. It will be appreciated that although the stopping location 820 is illustrated as being entirely outside the lane 705, the vehicle 100, 710, 810 may be partly located in the lane 705 with part of the vehicle being located adjacent to the roadway in region 805. The stopping location 820 may be a location at which the vehicle 100, 810 can stop with minimal or reduced impact on other road users. The stopping location 820 may be a location at a side of the roadway 701 or the vehicle lane 705. The stopping location 820 may be a location within a dedicated stopping lane, such as a hard shoulder, at least partly upon a verge of the roadway 701 or other location not generally intended for use by through traffic on the roadway 701. As such the stopping location is a location of relative safety for the vehicle 100, 710, 810 to stop. The second controller 370 is therefore arranged to control the vehicle to perform the manoeuvre to the location of relative safety at which it is arranged to bring the vehicle 100, 710, 810 to a stop. It can be appreciated that the second controller 370 acts as an intrusion detection system (IDS) for the network system 300 of the vehicle 100. In some embodiments, the second controller 370 acts as an intrusion prevention system (IPS), or as an intrusion detection and prevention system (IDPS). The second controller acts as the IPS by overriding the first controller 310 in the event of an intrusion being detected to control the vehicle, thereby preventing authorised control. The second controller 370 is operable to determine if a likelihood of a network intrusion exists, such as to cause the vehicle 100 to deviate from a valid trajectory or one or more control inputs to the vehicle to cause excessive behaviour such as excessive negative acceleration i.e. braking or lateral acceleration i.e. steering. Advantageously, as the secured partition of the network system 390 is relatively small i.e. only a portion of the overall network 300, such that only communications with the second controller 370 require a security protocol such as authentication, thereby reducing an overhead for other controllers and modules of the network system and the network system itself such as the first controller 310 and control modules 330, 340, 350, 360 in most circumstances. In embodiments of the invention, during normal operation the first controller 310 provides control instructions for the vehicle 100 without utilising an additional security protocol, such as authentication, thereby providing lightweight communication. However, in the event of an indication of a network intrusion being detected, the second controller 370 assumes control of the vehicle 100 from the first controller 310, wherein the second controller 370 uses a security protocol such as authentication. In this way, an overhead of the security protocol is only incurred when necessary. It will be appreciated that various changes and modifications can be made to the present invention without departing from the scope of the present application.

Claims

1. A control system for a vehicle, the control system comprising one or more controllers, the control system comprising:input means for receiving environment data from one or more sensors indicative of objects in an environment of the vehicle, and one or more vehicle parameters;output means for outputting one or more override control signals to control movement of the vehicle;a memory device storing computer-readable instructions therein;processing means arranged to execute the computer-readable instructionsstored in the memory device to:determine, in dependence on the vehicle parameters and the environment data, an indication of an intrusion into a network system of the vehicle, wherein determining the indication of the intrusion comprises determining, in dependence on the one or more vehicle parameters, whether a control input to the vehicle exceeds an associated threshold, wherein the associated threshold comprises a maximum acceleration;determine, in dependence on the indication of the intrusion into the network system, and at least one of the environment data and the one or more vehicle parameters, a manoeuvre for the vehicle to a stopping location; andcontrol the output means to output one or more override control signals to control the vehicle to perform the manoeuvre.

2. A control system according to claim 1, wherein the processing means is arranged to determine the indication of the intrusion into the network system, comprising:determine, in dependence on the environment data, a valid trajectory for the vehicle; anddetermine, in dependence on the one or more vehicle parameters, whether a current trajectory of the vehicle corresponds to the valid trajectory.

3. A control system according to claim 2, wherein the valid trajectory corresponds to a navigable path for the vehicle.

4. A control system according to any preceding claim, wherein the maximum acceleration comprises a maximum negative acceleration.

5. A control system according to any preceding claim, wherein the maximum acceleration comprises a maximum lateral acceleration.

6. A control system according to any preceding claim, wherein the processing means is arranged to control the output means to output the one or more override control signals according to a predetermined secure communication protocol.

7. A control system according to any preceding claim, wherein the computer-readable instructions stored in the memory device are signed according to a predetermined protocol.

8. A system for a vehicle, comprising:a control system according to any preceding claim; andone or more control modules each associated with a respective vehicle subsystem, each control module being arranged to receive a respective control signal and to control the vehicle to assist in performing the manoeuvre in dependence thereon.

9. The system of claim 8, wherein the at least one control module comprises a first control module associated with a braking system of the vehicle and a second control module associated with a steering system of the vehicle.

10. The system of any of claims 8 or 9, comprising:a primary vehicle controller arranged to receive environment data from one or more sensors, to determine a trajectory for the vehicle in dependence on the environment data and to control the vehicle to follow said trajectory.

11. The system of claim 10, wherein the primary vehicle controller is arranged to output one or more primary control signals to at least some of the one or more control modules to control the vehicle to follow said trajectory in dependence thereon.

12. The system of claim 10 or 11, wherein the primary controller is arranged to communicate with the at least some of the one or more control modules without using the secure communication protocol.

13. The system of any of claims 8 to 12, wherein:the primary controller is arranged to receive the environment data from the one or more sensors of a first set of sensors associated with the vehicle; andthe control system is arranged to receive the environment data from the one or more sensors of a second set of sensors associated with the vehicle.

14. A vehicle comprising a control system according to any of claims 1 to 7 or a system according to any one of claims 8 to 13.

15. A method, comprising:determining, in dependence on one or more vehicle parameters and environment data from one or more sensors indicative of objects in an environment of the vehicle, an indication of an intrusion into a network system of the vehicle, wherein determining the indication of the intrusion comprises determining, in dependence on the one or more vehicle parameters, whether a control input to the vehicle exceeds an associated threshold, wherein the associated threshold comprises a maximum acceleration;determining, in dependence on the indication of the intrusion into the network system, and at least one of the environment data and the one or more vehicle parameters, a manoeuvre for the vehicle to a stopping location; andoutputting one or more override control signals to control the vehicle to perform the manoeuvre.

Images