Sequence-and-Counter Checks for Unauthorized In-Vehicle Messages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are inadequate in accurately detecting unauthorized messages in in-vehicle networks, leading to potential security vulnerabilities.
Innovation Solution
A detection device and method that monitors periodic and event messages in an in-vehicle network, using sequence numbers and counter values to identify unauthorized messages through provisional and conclusive determinations based on message intervals and transmission cycles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sequence number comparison is used for unauthorized message detection, then detection capability is improved, but false detection increases
Solution Approach 1:
The patent performs preliminary actions by recording transmission times and sequence numbers of periodic messages before comparison. The detection device stores reference data including transmission cycles and sequence numbers in advance, then uses this pre-recorded information to accurately determine whether event messages are unauthorized, thereby reducing false detections while maintaining high detection capability.
Solution Approach 2:
The patent implements feedback mechanisms by continuously monitoring the in-vehicle network, comparing received event messages against recorded periodic message patterns, and using the results to refine detection accuracy. The system feedback loop allows it to distinguish between legitimate sequence number variations and actual unauthorized messages, resolving the contradiction between detection capability and accuracy.
2Measurement precision
If all messages are monitored and analyzed, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent segments messages into two categories: periodic messages with known transmission cycles and event messages that require detection. By separating these message types and applying different processing strategies to each, the system achieves high detection accuracy for event messages while efficiently handling periodic messages through pattern matching, thereby reducing overall processing time.
Solution Approach 2:
The patent utilizes the periodic nature of certain messages by recording their transmission cycles and using this periodic pattern to predict expected message arrivals. This allows the system to quickly identify deviations from normal patterns without analyzing every message in detail, thus maintaining high detection accuracy while minimizing processing time for routine periodic messages.
3Reliability
If sequence number continuity is strictly enforced, then unauthorized message detection is improved, but legitimate message variations are misidentified
Solution Approach 1:
The patent changes the detection parameter from strict sequence number continuity to sequence number comparison against recorded patterns. Instead of enforcing continuous incrementing, the system compares sequence numbers against stored reference data that accounts for legitimate variations. This parameter change allows accurate detection of unauthorized messages while accepting natural sequence number variations in legitimate communications.
Solution Approach 2:
The patent performs preliminary recording of valid sequence number patterns from legitimate periodic messages before detection begins. This pre-established baseline of acceptable sequence variations allows the system to distinguish between legitimate sequence number changes and unauthorized messages, reducing false positives while maintaining reliable detection capability.
Data Source
AI summary
A detection device includes: a monitoring unit configured to monitor a periodic message and an event message as messages in an in-vehicle network, each message having, assigned thereto, identification information of a transmission source and a sequence number; a counter unit configured to change a counter value corresponding to the identification information, when the detection device has received the event message from the in-vehicle network; and a detection unit configured to compare the sequence number with the counter value, based on a result of monitoring, and perform provisional determination for detection of an unauthorized message, based on a result of the comparison. The detection unit performs conclusive determination for detection of the unauthorized message, based on an interval of messages that satisfy a predetermined condition regarding the sequence number, among messages to which the same identification information is assigned, and on a predetermined transmission cycle of the periodic message.