ECU Register Access Control for CAN Message Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems in vehicles, such as those using the CAN protocol, are vulnerable to invalid message transmission due to injected invalid programs, which can cause erroneous operations in connected ECUs, and existing solutions do not effectively prevent such transmissions.
Innovation Solution
A communication device with a switching mechanism that restricts writing and reading access to specific registers after a predetermined period, using a combination of modes (full control and restriction modes) to prevent invalid message transmission, and includes authentication processing to ensure secure mode switching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If writing and reading access to all registers is allowed for full control, then ease of operation is improved, but reliability deteriorates due to invalid message transmission
Solution Approach 1:
The patent implements dynamic access control by switching between two operational modes: a first mode allowing full read/write access to registers for ease of operation, and a second mode restricting access to prevent invalid message transmission. The switching unit dynamically transitions between these modes based on operational requirements, thereby resolving the contradiction between operational ease and transmission security.
Solution Approach 2:
The patent changes the access permission parameter of registers based on operational state. In the first mode, registers have permissive access parameters allowing both reading and writing. In the second mode, the access parameters are changed to restrictive settings that prevent writing to or reading from specific registers, thus preventing invalid message transmission while maintaining system functionality.
2Reliability
If access to registers is restricted to prevent invalid messages, then reliability is improved, but ease of operation deteriorates
Solution Approach 1:
The switching unit enables dynamic adjustment of register accessibility, transitioning between a restrictive second mode that ensures message transmission security and a permissive first mode that facilitates ease of operation. This dynamic approach allows the system to maintain high reliability during critical operations while preserving operational flexibility when needed.
Solution Approach 2:
The patent applies preliminary restrictions by defaulting to the second mode where access to communication registers is restricted to prevent invalid message transmission. When full access is needed, the system temporarily switches to the first mode, but quickly returns to restrictions afterward. This preliminary protective action ensures reliability is maintained while minimizing impact on operational ease.
3Adaptability or versatility
If mode switching is allowed freely, then adaptability is improved, but reliability deteriorates due to potential invalid mode transitions
Solution Approach 1:
The patent applies preliminary anti-action by preventing potentially harmful mode transitions before they can occur. The switching unit is designed to block transitions from the second mode back to the first mode, thereby preventing invalid mode changes that could compromise message transmission security. This anticipatory restriction maintains reliability while preserving necessary adaptability for legitimate operational requirements.
Solution Approach 2:
The switching unit incorporates feedback mechanisms to monitor the current operational mode and control subsequent mode transitions. Based on the detected mode state, the switching unit enables or disables specific transition paths, ensuring that only valid and secure mode changes are permitted. This feedback-controlled approach maintains both adaptability for legitimate operations and reliability by preventing invalid transitions.
Data Source
AI summary
Provided are a communication device and a communication restriction program capable of suppressing invalid message transmission to a network by injecting an invalid program. The ECU includes a CAN controller having a register group storing a value concerning communication with a different ECU and a processing unit processing a value for the register group. The ECU switches the mode between the full control mode in which writing and reading are allowed for the register group in the CAN controller and the restriction mode wherein writing and reading are restricted for a part of the registers in the register group. The ECU sets a predetermined period from activation corresponding to the full control mode, and switches the full control mode to the restriction mode after the predetermined period elapses. After switching to the restriction mode, the ECU will not switch the mode to the full control mode.