Vehicle Relay Device Message Integrity Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing relay devices in vehicle networks are unable to effectively prevent the transmission of improper messages, even when the program for relay processing is falsified, which can lead to malfunctions in other ECUs connected to the network.

Innovation Solution

A relay device with a message storage unit, a processing unit, and a determination unit that compares messages to ensure properness before transmission, and a prohibition unit to prevent the transmission of improper messages, along with a detection unit to abort transmission if falsification is detected.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a relay device performs message relay processing using a software program, then the relay function can be flexibly controlled and adapted, but the system becomes vulnerable to program falsification which can invalidate security measures

Engineering Contradiction:

Improverelay function adaptabilityVSAvoidsecurity against program falsification

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The relay device is divided into separate functional units: a determination unit that verifies message propriety and a relay unit that performs message transmission. This segmentation isolates the security-critical determination function from the relay processing, so that even if the relay program is falsified, the determination unit can still prevent improper messages from being transmitted.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The determination unit acts as an intermediary between the message source and the relay transmission. It independently verifies whether messages are proper before allowing them to be relayed, serving as a security gatekeeper that is not affected by program falsification in the relay processing unit.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If filtering processes are implemented to detect improper messages, then message security can be improved, but the filtering process itself may be invalidated if the program is falsified

Engineering Contradiction:

Improveimproper message detectionVSAvoidfiltering process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The security verification function is extracted from the complex relay processing program and implemented as a separate determination unit. This extracted function focuses solely on verifying message propriety using simple comparison operations, eliminating the need for complex filtering logic that could be vulnerable to falsification.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Instead of using complex filtering parameters (such as transmission frequency, cycle timing, and message patterns), the invention changes the verification approach to a simple parameter comparison: checking whether the message ID and data content match between the current message and the previously received message. This simplifies the verification process while maintaining security effectiveness.

Inventive Principle:

Principle #35Parameter changes

3Adaptability or versatility

If multiple ECUs are connected via network to enable information exchange, then system functionality and flexibility are enhanced, but the risk of improper message transmission and network malfunction increases

Engineering Contradiction:

Improvenetwork communication capabilityVSAvoidimproper message impact on ECUs

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The determination unit performs preliminary verification of message propriety before messages are transmitted through the network. By checking whether messages are proper in advance, the system prevents improper messages from entering the network and potentially causing harm to other ECUs, thus countering the harmful effects before they can occur.

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The invention uses the redundancy of message transmission (comparing current messages with previously received messages) to convert a potential vulnerability into a security feature. The ability to store and compare previous messages, which could be seen as adding complexity, actually provides the benefit of detecting and blocking improper messages that attempt to exploit the network communication.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

Data Source

PatentUS10439842B2Relay device

Publication Date: 2019.10.08 AUTONETWORKS TECH LTD

AI summary

A relay device capable of preventing transmission of an improper message to one or more networks even if improper falsification is made to a program for executing relay processing. If one CAN controller receives a message, a gateway stores the received message in the message storage unit and also sends the message to the processing unit. The processing unit that received the message performs processing necessary for relay of the message by executing a relay program, and sends the message to be relayed to the CAN controller. The gateway compares the message before being sent from the CAN controller to the processing unit with the message sent from the processing unit to the CAN controller, to determine the properness of the message.