Anomaly Detection Device for Vehicle Ethernet Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In service-oriented communication systems like SOME/IP, the lack of effective security measures allows hacked nodes to establish illegitimate communications, compromising critical vehicle functions such as traveling, turning, and stopping, and existing solutions like IPSec complicate key management and reduce portability.
Innovation Solution
An anomaly detection device that generates detection rules for communication IDs and addresses during the communication establishment phase, allowing for real-time monitoring and notification of anomalous frames in the communication phase, thereby enhancing security without sacrificing portability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPSec is used to encrypt communication, then security against eavesdropping is improved, but key management complexity and processing overhead increase
Solution Approach 1:
The patent extracts the security verification function from the communication payload and implements it at the Ethernet frame level by monitoring source and destination MAC addresses. This separates the security checking mechanism from the application-layer communication content, allowing security verification without requiring complex encryption keys or modifying the communication payload.
Solution Approach 2:
The patent introduces an intermediary monitoring mechanism that observes Ethernet frames without actively participating in or modifying the SOME/IP communication between ECUs. This intermediary layer provides security verification by checking MAC address patterns against pre-stored legitimate communication patterns, avoiding direct interference with the communication parties.
2Reliability
If different keys are used for different ECUs, then security is improved, but key management complexity and processing overhead increase
Solution Approach 1:
The patent segments the security verification into two distinct phases: a learning phase where legitimate communication patterns are recorded, and a monitoring phase where recorded patterns are compared against new frames. This segmentation allows the system to establish security baselines without continuous complex key management during operation.
Solution Approach 2:
The patent performs preliminary action by recording legitimate source and destination MAC address pairs during the learning phase before actual security monitoring begins. This pre-established baseline of legitimate communication patterns enables rapid comparison and anomaly detection during the monitoring phase without requiring real-time key management or complex cryptographic operations.
3Difficulty of detecting and measuring
If IP addresses are set in advance for anomaly detection, then anomaly detection capability is improved, but software portability is reduced
Solution Approach 1:
The patent implements dynamic adaptability by allowing the system to learn and record legitimate MAC address communication patterns during the learning phase. This enables the anomaly detection mechanism to adapt to different vehicle configurations and ECU arrangements without requiring pre-configured IP addresses or MAC address tables, maintaining software portability across different vehicle models.
Solution Approach 2:
The system performs self-service by automatically learning legitimate communication patterns during the learning phase and using these self-generated patterns for anomaly detection during the monitoring phase. This eliminates the need for manual configuration of IP addresses or communication patterns, enabling the software to adapt automatically to different deployment environments.
Data Source
AI summary
An anomaly detection device (IDS ECU) includes a detection rule generator that monitors a communication establishment frame flowing over Ethernet in a communication establishment phase of service-oriented communication and that generates, for each communication ID, a detection rule including the communication ID written in the communication establishment frame and a server (or client) address written in the communication establishment frame; an anomaly detector that monitors a communication frame flowing over the Ethernet in a communication phase of the service-oriented communication and that, by referring to a detection rule that includes a communication ID written in the communication frame, detects the communication frame as an anomalous frame when a server (or client) address written in the communication frame differs from a server (or client) address included in the detection rule; and an anomaly notifier that provides a notification of an anomaly in response to the anomalous frame being detected.