System and method for controlling access to an in-vehicle communication network
A system or method may include an in-vehicle network including an interface port for connecting an external device to the in-vehicle network; and a security unit connected to the in-vehicle network, the security unit adapted to enable an external device to communicate with the in-vehicle network, over the interface port, based on a security token received from the external device. A system or method may, based on a token, prevent an external device from at least one of: communicating with a selected set of components on in an in-vehicle network, communicating with a selected set of network segments in the in-vehicle network and performing a selected set of operations.
1. A system comprising:
an in-vehicle communication network included in a vehicle and electrically connected to a physical interface port for connecting an external device to the in-vehicle communication network, wherein the external device is adapted to physically connect to the physical interface port and to exchange data with the in-vehicle communication network, via the physical interface port; and
a security unit including a memory and a controller physically installed between the physical interface and the in-vehicle communication network and adapted, based on a security code received from the external device, to:
select at least one of: a set of components connected to the in-vehicle communication network, and a set of segments of the in-vehicle communication network;
prevent the external device from communicating with at least one of: the selected set of components and the selected set of segments; and
record information related to a communication with the external device; wherein the security code is generated based on an interaction of a user with a server, and
wherein the server is adapted to:
receive the recorded information, and
perform at least one of:
generate a history log of maintenance service of the vehicle,
identify unauthorized access to the in-vehicle network,
identify malicious activity on the in-vehicle network, and
generate insights based on the recorded data, and wherein the security unit is adapted to:
share a secret with a generator of the security code; and
validate the security code based on the shared secret and based on a unique attribute of the vehicle.
2. The system of claim 1 , wherein the security unit is adapted to use the same security code a predefined number of times.
3. The system of claim 1 , wherein the security unit is adapted to prevent communication over the interface port based on at least one of: a predefined time interval and an event.
4. The system of claim 1 , wherein the security code is provided to the security unit by one of: a hardware component directly connected to the interface port and an external network.
5. The system of claim 1 wherein the security code is a vehicle-specific code generated or provided by one of: a user associated with the vehicle and a server.
6. The system, of claim 1 wherein the security code includes at least two of: a unique identification of the security code, an identification of the vehicle, a duration value, a reuse value, an identification of an event, an identification of nodes connected to the in-vehicle network, an indication of an operation, a context, and vehicle-specific identification.
7. The system of claim 1 wherein the security code is a vehicle-specific code generated based on an attribute of the vehicle, and wherein the vehicle-specific code is validated, by the security unit, based on the attribute of the vehicle.
8. A method comprising:
receiving, by a security unit including a memory and a controller, from an external device, a code including digital information, wherein the security unit is physically installed between the physical interface and an in-vehicle communication network included in a vehicle, and wherein the external device is adapted to exchange data with the in-vehicle communication network, via a physical interface port;
selecting, by the security unit and based the digital information, at least one of: a set of components connected to the in-vehicle communication network, and a set of segments of the in-vehicle communication network;
preventing the external device from communicating with at least one of: the selected set of components and the selected set of segments; and
recording information related to a communication with the external device;
sharing a secret between a generator of the code and the security unit; and
validating the code, by the security unit, based on the shared secret and based on a unique attribute of the vehicle,
wherein the code is generated based on an interaction of a user with a server, and
wherein the server is adapted to:
receive the recorded information, and
perform at least one of:
generate a history log of maintenance service of the vehicle,
identify unauthorized access to the in-vehicle network,
identify malicious activity on the in-vehicle network, and
generate insights based on the recorded data.
9. The method of claim 8 , comprising using the same code a predefined number of times.
10. The method of claim 8 , comprising disabling, based on the code and by the security unit, communication over the interface port based on at least one of: a predefined time interval and an event.
11. The method of claim 8 , wherein the code is provided to the security unit by one of: a hardware component directly connected to the interface port and an external network.
12. The method of claim 8 comprising generating, a vehicle-specific code by one of a user associated with the vehicle and a server.