Vehicle Gateway Security Event Time Estimation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Connected cars face challenges in accurately determining the time of occurrence of security events due to reliance on internal vehicle clocks, which may be disabled or inconsistent, especially during battery removal, making it difficult to record and analyze security data effectively for cyber attack detection and forensic analysis.
Innovation Solution
A method and system that transmit actual time to a vehicle's gateway, obtain time history data and logging data based on a vehicle reference time including a timestamp and reset counter, and estimate the time of a security event by mapping the internal clock state with actual time, using milestone flags and reset flags to account for clock state changes and battery removal scenarios.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the vehicle uses its internal clock for time recording, then the system is simple and self-contained, but the time accuracy deteriorates when the clock is disabled or battery is removed
Solution Approach 1:
The patent introduces an external server as an intermediary to provide accurate time references to the vehicle. The server receives security event data with internal clock timestamps and correlates them with actual time from multiple sources (GPS, network time protocol, etc.), acting as a mediator between the vehicle's internal clock system and the required accurate time recording.
Solution Approach 2:
The system performs preliminary time synchronization by establishing a time reference relationship between the internal clock and actual time before security events occur. The server stores historical time correlation data and milestone flags that enable retrospective time correction even when the clock was disabled during critical periods.
2Loss of energy
If the internal clock is disabled during battery removal, then power consumption is reduced, but the ability to record accurate security event times deteriorates
Solution Approach 1:
The external server acts as a mediator that compensates for the internal clock being disabled. It receives security event data with internal timestamps and correlates these with actual time using stored time history data and milestone flags, ensuring reliable time recording even when the vehicle clock is powered down.
Solution Approach 2:
The system creates a copy of the time reference relationship by storing milestone flags and time correlation data on the server. This copied time reference enables accurate time estimation without requiring the internal clock to remain active, thus reducing power consumption while maintaining reliability.
3Device complexity
If milestone flags are recorded at fixed time intervals, then time tracking is simplified, but the system complexity increases due to additional data elements
Solution Approach 1:
The patent segments the continuous time tracking into discrete milestone intervals marked by flags. Instead of continuously monitoring time, the system divides the time axis into segments defined by milestone events, reducing the complexity of time tracking while maintaining sufficient precision for security event correlation.
Data Source
AI summary
Provided are a method and system for estimating a time of occurrence of a security event. The method includes: transmitting an actual time to a gateway of a vehicle; obtaining, from the gateway, time history data storing an actual time flag data element; obtaining, from the gateway, logging data prepared during security event detection; and estimating a time of occurrence of a security event, based on the logging data and the time history data, wherein the time history data and the logging data are prepared based on a vehicle reference time including a timestamp value and reset counter value of the vehicle.