Granted Patent B2

US 12,278,823 · App. 18/000,670 · Granted Apr 15, 2025

Inventor: David Myara (Toulouse, FR)

Assignees: AMPERE S.A.S.; NISSAN MOTOR CO., LTD.

H04L63/1408H04W4/44H04W12/03H04W12/121H04W12/45

Abstract

Claims (31)

1. A vehicle comprising:

circuitry configured to implement:

a communication module configured to use two telecommunication identifier cards, one relating to a subscription between a constructor of said vehicle and a telecommunications operator, an other relating to a subscription between a user of said vehicle and a telecommunications operator;

a trusted execution environment hosting security functions of the vehicle; and

a multimedia system execution environment hosting at least a part of said communication module,

wherein said trusted execution environment comprises a supervision module that monitors a connection between said vehicle and a remote management server of said vehicle, and when the supervision module detects an anomaly in the connection, the supervision module is configured to:

send a first instruction to the communication module, triggering a disabling of external communications for unsecured applications of the vehicle, when said communication module indicates that the cellular connection of the vehicle is unavailable for a time greater than a first predefined time interval, and

send a second instruction to the communication module, triggering a selection by the communication module of the telecommunication identifier card relating to the subscription of the constructor of said vehicle as a sole connection means, and the disabling by the communication module of any communication other than with said remote management server, when said communication module indicates that the cellular connection of the vehicle is unavailable for a time greater than a second predefined time interval greater than the first predefined time interval.

2. The vehicle as claimed in claim 1 , wherein said supervision module is configured to regularly test said connection by sending and receiving signed, unique and predefined messages, respectively to said remote management server and from said remote management server.

3. The vehicle as claimed in claim 2 , wherein said supervision module is configured to detect the anomaly when:

said communication module indicates that the cellular connection of the vehicle is operated while said communication module does not confirm the sending of one of said messages to said remote management server or it does not transmit one of said messages sent by said remote management server, or

said communication module indicates that the cellular connection of the vehicle is unavailable for a time greater than a first predefined time interval.

4. The vehicle as claimed in claim 2 , wherein the messages sent by said supervision module comprise information representative of a detection of the between said vehicle and said remote management server, or representative of an absence of such a detection.

5. The vehicle as claimed in claim 1 , wherein said supervision module is configured to regularly test said connection by receiving signed, unique and predefined messages, from said remote management server.

6. The vehicle as claimed in claim 1 , wherein the supervision module is configured to

send a third instruction to the communication module, triggering a restart of said communication module, and provoking a restart of said multimedia system execution environment, while imposing a secured configuration of said restarts, and

send a fourth instruction triggering a restart of at least a part of other execution environments or of other software of the vehicle while imposing on them a secured configuration.

7. The vehicle as claimed in claim 6 , wherein said supervision module is configured to send said third or fourth instruction only when said vehicle is stopped.

8. A system comprising:

the vehicle as claimed in claim 1 , and

said remote management server, wherein said remote management server comprises circuitry configured to:

receive a message sent by said supervision module and comprising information representative of a detection of said anomaly between said vehicle and said remote management server,

detect the fact that said anomaly detection is not due to a cyber-attack by correlation between a position of said vehicle and radio coverage data, and

send a message indicating that said anomaly is not due to a cyber-attack on said vehicle, in response to said message from said supervision module and reporting said anomaly detection.

9. The system as claimed in claim 8 , wherein said circuitry of said remote management server is further configured to:

detect a cyber-attack as soon as anomalies are reported by a number of vehicles greater than a predefined threshold, and

send a message to said vehicle activating a procedure for secured restarting of said communication module and of said multimedia execution environment and/or for updating said multimedia execution environment as soon as the cyber-attack is detected.

10. A method for securing the connection between the vehicle as claimed in claim 1 and said remote management sever of said vehicle, the method comprising:

sending and/or receiving signed, unique and predefined messages, respectively to said remote management sever and/or from said remote management server,

detecting the anomaly on said connection, and

sending an instruction to said communication module, configured to switch the communication between said vehicle and said remote management server over to a connection using the telecommunication identifier card relating to the subscription of the constructor of said vehicle.

Assignments (2)

Priority Claims (1)

Continuity (1)

References Cited (16)