Security gateway for autonomous or connected vehicles
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for a system associated with a vehicle are provided. One of the systems includes one or more electronic control units (ECUs) connected to a controller area network (CAN) bus, one or more infotainment devices, and a security gateway coupled to the one or more ECUs via the CAN bus and connected to the one or more infotainment devices. The security gateway may be configured to receive signals from the CAN bus and the one or more infotainment devices and detect a security event based at least in part on received signals.
1. A system associated with a vehicle, comprising:
one or more electronic control units (ECUs) connected to a controller area network (CAN) bus;
one or more infotainment devices;
one or more sensors comprising one or more image sensors and a global positioning system (GPS) receiver; and
a security gateway coupled to the one or more ECUs via the CAN bus and connected to the one or more infotainment devices and the one or more sensors, wherein the security gateway is configured to:
receive signals from the CAN bus, the one or more infotainment devices, and the one or more sensors;
verify an identity of a person in the vehicle by comparing a facial image of the person received from the one or more image sensors with a pre-stored facial image;
confirm the identity of the person by determining, based on signals received from the GPS receiver, whether the vehicle is on one or more routes associated with the person;
detect a security event based on signals received from the CAN bus and the one or more infotainment devices;
create a plurality of virtual machines (VMs) for respectively handling data from different components to achieve segmentation, the different components comprising the one or more ECUs, the one or more infotainment devices, and the one or more sensors; and
store logs of security events associated with a first VM of the plurality of virtual machines into a second VM of the plurality of virtual machines to prevent deletion by an attacker.
2. The system of claim 1 , wherein, to detect a security event, the security gateway is configured to:
perform correlation analysis on the signals from the CAN bus and the signals from the one or more infotainment devices; and
detect the security event based on a result of the correlation analysis.
3. The system of claim 1 , wherein:
the security gateway is connected to an autonomous driving controller that is coupled to the ECUs via the CAN bus; and
the security gateway is further configured to receive one or more signals from the autonomous driving controller and detect the security event further based on the one or more signals from the autonomous driving controller.
4. The system of claim 1 , wherein:
the security gateway is further configured to detect the security event further based on one or more signals from the one or more sensors.
5. The system of claim 4 , wherein the one or more sensors further comprise:
one or more radar sensors;
one or more light detection and ranging (LiDAR) sensors;
one or more ultrasonic sensors; or
one or more inertial measurement units.
6. The system of claim 1 , wherein:
the security gateway is connected to one or more network interfaces; and
the security gateway is further configured to receive one or more signals from the one or more network interfaces and detect the security event further based on the one or more signals from the one or more network interfaces.
7. The system of claim 6 , wherein the one or more network interfaces comprise:
a Wi-Fi client;
a cellular modem; or
a Bluetooth module.
8. The system of claim 6 , wherein:
the one or more signals comprise a data packet corresponding to a network address;
the security gateway is further configured to:
determine that the network address is not among a plurality of pre-stored network addresses;
generate a log associated with the data packet; and
send the log to a server through the one or more network interfaces.
9. A method for managing network security of a vehicle, comprising:
receiving signals from one or more electronic control units (ECUs) via a controller area network (CAN) bus, one or more infotainment devices, and one or more sensors, the one or more sensors comprising one or more image sensors and a global positioning system (GPS) receiver;
verifying an identity of a person in the vehicle by comparing a facial image of the person received from the one or more image sensors with a pre-stored facial image;
confirming the identity of the person by determining, based on signals received from the GPS receiver, whether the vehicle is on one or more routes associated with the person;
detecting a security event based on signals received from the one or more ECUs and the one or more infotainment devices; and
create a plurality of virtual machines (VMs) for respectively handling data received from the CAN bus, the one or more infotainment devices, and the one or more sensors.
10. The method of claim 9 , wherein the detecting a security event comprises:
performing correlation analysis on the signals from the CAN bus and the signals from the one or more infotainment devices; and
detecting the security event based on a result of the correlation analysis.
11. The method of claim 9 , wherein:
the method further comprises receiving one or more signals from an autonomous driving controller coupled to the ECUs via the CAN bus; and
the detecting a security event is further based on the one or more signals from the autonomous driving controller.
12. The method of claim 9 , wherein:
the detecting a security event is further based on one or more signals from the one or more sensors.
13. The method of claim 12 , wherein the one or more sensors comprise:
one or more radar sensors;
one or more light detection and ranging (LiDAR) sensors;
one or more ultrasonic sensors; or
one or more inertial measurement units.
14. The method of claim 9 , wherein:
the method further comprises receiving one or more signals from one or more network interfaces; and
the detecting a security event is further based on the one or more signals from the one or more network interfaces.
15. The method of claim 14 , wherein the one or more network interfaces comprise:
a Wi-Fi client;
a cellular modem; or
a Bluetooth module.
16. The method of claim 14 , wherein:
the one or more signals comprise a data packet corresponding to a network address;
the method further comprises:
determining that the network address is not among a plurality of pre-stored network addresses;
generating a log associated with the data packet; and
sending the log to a server through the one or more network interfaces.
17. A non-transitory computer-readable storage medium for managing network security of a vehicle, configured with instructions executable by one or more processors to cause the one or more processors to perform operations comprising:
receiving signals from one or more electronic control units (ECUs) via a controller area network (CAN) bus, one or more infotainment devices, and one or more sensors, the one or more sensors comprising one or more image sensors and a GPS receiver;
verifying an identity of a person in the vehicle by comparing a facial image of the person received from the one or more image sensors with a pre-stored facial image;
confirming the identity of the person by determining, based on signals received from the GPS receiver, whether the vehicle is on one or more routes associated with the person;
detecting a security event based on signals received from one or more ECUs and the one or more infotainment devices; and
create a plurality of virtual machines (VMs) for respectively handling data received from the CAN bus, the one or more infotainment devices, and the one or more sensors.
18. The medium of claim 17 , wherein the detecting a security event comprises:
performing correlation analysis on the signals from the CAN bus and the signals from the one or more infotainment devices; and
detecting the security event based on a result of the correlation analysis.