Granted Patent B1

US 9,582,669 · App. 14/525,715 · Granted Feb 28, 2017

Abstract

Claims (66)

1. A computer-implemented method for detecting discrepancies in automobile-network data, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

receiving, via a logging device, data that indicates a first state of at least one attribute of an automobile at a moment in time, wherein:

the data has been conveyed via an automobile-network message that was purportedly broadcast over an automobile network of the automobile; and

the logging device is configured to:

connect to the automobile network via a port of the automobile network; and

log automobile-network messages that:

are broadcast over the automobile network; and

convey states of the attribute of the automobile;

receiving, via at least one sensor of a mobile device, additional data that indicates a second state of the same attribute of the automobile at the same moment in time, wherein the mobile device was traveling with the automobile when the automobile-network message was logged by the logging device;

detecting a security incident by determining that a difference between the first state and the second state is indicative of the automobile-network message having been falsified; and

performing a security action by flagging the data as having been falsified.

2. The computer-implemented method of claim 1 , wherein:

the data is received from the logging device by the mobile device;

the steps of detecting the security incident and performing the security action are performed by the mobile device; and

performing the security action comprises reporting the security incident to a cloud-based computing system.

3. The computer-implemented method of claim 2 , wherein:

the data is received from the logging device by a cloud-based computing system;

the additional data is received from the mobile device by the cloud-based computing system; and

the steps of detecting the security incident and performing the security action are performed by the cloud-based computing system.

4. The computer-implemented method of claim 1 , wherein:

detecting the security incident comprises determining that the difference between the first state and the second state is indicative of the automobile-network message having been tampered with; and

performing the security action comprises flagging the data as having been tampered with.

5. The computer-implemented method of claim 1 , wherein:

detecting the security incident comprises determining that the difference between the first state and the second state is indicative of the automobile-network message having been collected from a replay device that replayed the automobile-network message; and

performing the security action comprises flagging the data as having been collected from the replay device.

6. The computer-implemented method of claim 1 , wherein:

detecting the security incident comprises determining that the difference between the first state and the second state is indicative of the automobile-network message having been collected from a filtering device that filtered the automobile-network message; and

performing the security action comprises flagging the data as having been collected from the filtering device.

7. The computer-implemented method of claim 1 , wherein the automobile-network message was broadcast over the automobile network by a source device connected to the automobile network.

8. A system for detecting discrepancies in automobile-network data, the system comprising:

at least one receiving module, stored in memory, that:

receives, via a logging device, data that indicates a first state of at least one attribute of an automobile at a moment in time, wherein:

the data has been conveyed via an automobile-network message that was purportedly broadcast over an automobile network of the automobile; and

the logging device is configured to:

connect to the automobile network via a port of the automobile network; and

log automobile-network messages that:

 are broadcast over the automobile network; and

 convey states of the attribute of the automobile;

receives, via at least one sensor of a mobile device, additional data that indicates a second state of the same attribute of the automobile at the same moment in time, wherein the mobile device was traveling with the automobile when the automobile-network message was logged by the logging device;

a detecting module, stored in memory, that detects a security incident by determining that a difference between the first state and the second state is indicative of the automobile-network message having been falsified;

a security module, stored in memory, that performs a security action by flagging the data as having been falsified; and

at least one physical processor that executes the receiving module, the detecting module, and the security module.

9. The system of claim 8 , wherein:

the receiving module receives the data from the logging device as part of the mobile device;

the mobile device comprises the detecting module and the security module; and

the security module performs the security action by further reporting the security incident to a cloud-based computing system.

10. The system of claim 8 , wherein:

the detecting module detects the security incident by determining that the difference between the first state and the second state is indicative of the automobile-network message having been tampered with; and

the security module performs the security action by further flagging the data as having been tampered with.

11. The system of claim 8 , wherein:

the detecting module detects the security incident by determining that the difference between the first state and the second state is indicative of the automobile-network message having been collected from a replay device that replayed the automobile-network message; and

the security module performs the security action by further flagging the data as having been collected from the replay device.

12. The system of claim 8 , wherein:

the detecting module detects the security incident by determining that the difference between the first state and the second state is indicative of the automobile-network message having been collected from a filtering device that filtered the automobile-network message; and

the security module performs the security action by flagging the data as having been collected from the filtering device.

13. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

receive, via a logging device, data that indicates a first state of at least one attribute of an automobile at a moment in time, wherein:

the data has been conveyed via an automobile-network message that was purportedly broadcast over an automobile network of the automobile; and

the logging device is configured to:

connect to the automobile network via a port of the automobile network; and

log automobile-network messages that:

are broadcast over the automobile network; and

convey states of the attribute of the automobile;

receive, via at least one sensor of a mobile device, additional data that indicates a second state of the same attribute of the automobile at the same moment in time, wherein the mobile device was traveling with the automobile when the automobile-network message was logged by the logging device;

detect a security incident by determining that a difference between the first state and the second state is indicative of the automobile-network message having been falsified; and

perform a security action by flagging the data as having been falsified.

Assignments (6)