Secure communication between vehicle components via bus guardians

{
  "publication_number": "US2019324450A1",
  "country": "US",
  "kind": "A1",
  "title": "Secure communication between vehicle components via bus guardians",
  "abstract": "In one embodiment, a computing system of an autonomous vehicle may receive a first set of data packets on one or more networks. The computing system may analyze the data packets to determine, for each packet, one or more of an authenticity, a validity, or a correctness of the data packet. The computing system may perform a first action for the first set of data packets based on the analysis. The first action may include signaling a safety driver of the autonomous vehicle to take over manual control of the vehicle in response to the data packets failing to satisfy the one or more of the authenticity, the validity, or the correctness criteria.",
  "claims": [
    "1. A method comprising: receiving, by a computing system of a vehicle, a data packet from one or more sensors or processors of the vehicle through one or more networks; analyzing, by the computing system of the vehicle, the data packet to determine: 1) an authenticity of the data packet received from the one or more sensors or processors of the vehicle or 2) a validity or a correctness of the data packet based on a comparison of the data packet to expected information; and initiating, by the computing system of the vehicle, one or more actions including at least one of signaling a driver that a fault has occurred or transferring control of the vehicle to the driver in response to one or more of the authenticity, the validity, or the correctness failing to satisfy one or more criteria. 2. The method of claim 1, wherein the one or more networks are two physically redundant networks. 3. The method of claim 2, wherein the two physically redundant networks comprise ethernet networks. 4. The method of claim 1, further comprising sending the data packet to one or more components of the vehicle via one or more non-redundant networks in response to the data packet satisfying the one or more criteria. 5. The method of claim 4, wherein the one or more non-redundant networks comprise: an ethernet network; a controller area network (CAN) bus; or a local interconnect network (LIN) bus. 6. The method of claim 1, wherein the one or more actions further comprise: sending signals or commands to a plurality of components of the vehicle; restricting fraudulent or faulty data packets from sending to the one or more components of the vehicle; alerting the safety driver of the vehicle to take over manual control of the vehicle in case of the fraudulent or faulty data packets; determining an action for the vehicle independent of actions determined by one or more of a high-performance computer or a lower performance computer of the vehicle; or encrypting and decrypting communications between components of the vehicle. 7. The method of claim 1, wherein the one or more components of the vehicle comprise one or more of: a sensor; an actuator; a high-performance computer; or a lower performance computer. 8. The method of claim 1, wherein analyzing the data packet comprises analyzing one or more of time schedules and priority schemes determined for the one or more components of the vehicle. 9. The method of claim 1, wherein the expected information comprises the internal data of the computing system. 10. (canceled) 11. The method of claim 1, wherein analyzing the validity of the data packet comprises: analyzing votes assigned by one or more components of the vehicle, each vote representing a particular action to be performed by the vehicle; and determining whether the votes and their corresponding actions for the vehicle are valid based on one or more characteristics of the vehicle. 12. The method of claim 11, further comprising overriding the votes assigned by the one or more components of the vehicle if the corresponding actions to be performed by the vehicle are determined to be invalid. 13. The method of claim 1, further comprising: receiving instructions to stop receiving and sending subsequent data packets to one or more components of the vehicle. 14. The method of claim 13, wherein the instructions are received in response to the driver activating an emergency stop button of the vehicle. 15. The method of claim 1, wherein signaling the driver comprises activating one or more indicators on a dashboard of the vehicle alerting the driver to take over control of the vehicle. 16. The method of claim 15, wherein the one or more indicators comprise light emitting diodes (LEDs). 17. The method of claim 1, wherein the data packet is cryptographically encrypted. 18. The method of claim 1, further comprising: prior to analyzing the data packet, decrypting the data packet, by a secure element of the computing system. 19. A computing system comprising: one or more processors and one or more computer-readable non-transitory storage media coupled to one or more of the processors, the one or more computer-readable non-transitory storage media comprising instructions operable when executed by one or more of the processors to cause the computing system to perform operations comprising: receiving a data packet from one or more sensors or processors of the vehicle through one or more networks; analyzing the data packet to determine: 1) an authenticity of the data packet received from the one or more sensors or processors of the vehicle or 2) a validity or a correctness of the data packet based on a comparison of the data packet to expected information; and initiating one or more actions including at least one of signaling that a fault has occurred to a driver or transferring control of the vehicle to the driver in response to one or more of the authenticity, the validity, or the correctness failing to satisfy one or more criteria. 20. One or more computer-readable non-transitory storage media embodying software that is operable when executed to cause one or more processors to perform operations comprising: receiving a data packet from one or more sensors or processors of the vehicle through one or more networks; analyzing the data packet to determine: 1) an authenticity of the data packet received from the one or more sensors or processors of the vehicle or 2) a validity or a correctness of the data packet based on a comparison of the data packet to expected information; and initiating, by the computing system of the vehicle, one or more actions including at least one of signaling a driver that a fault has occurred or transferring control of the vehicle to the driver in response to one or more of the authenticity, the validity, or the correctness failing to satisfy one or more criteria."
  ],
  "description_excerpt": "An autonomous vehicle (AV) may be a vehicle that is capable of sensing its environment and navigating with little or no human input. The autonomous vehicle may include a system having a variety of modules or sub-systems for enabling the vehicle to determine its surroundings and safely navigate to target destinations. For example, an autonomous vehicle may have a computer (e.g., one or more central processing units, graphical processing units, memory, and storage) for controlling various operations of the vehicle, such as driving and navigating. To that end, the computer may process data from one or more sensor arrays. For example, an autonomous vehicle may have optical cameras for, e.g., recognizing hazards, roads and lane markings. Data from these systems and modules may be used by a navigation system to safely guide the autonomous vehicle, even without the aid of a human driver.\n\nSuccessful and safe navigation of AV may depend on making appropriate decisions in response to the external environment. Making appropriate decisions may, in turn, depend on appropriate data being transmitted fast and in time between different components of the AV system. However, when multiple components are transmitting data to a single receiver, and the combined throughput of the multiple components exceeds the channel capacity, congestion latency may occur.\n\nThe AV may have a control system to provide control commands to the various components of the AV performing the driving functions of the AV (e.g., steering, acceleration, or braking).",
  "cpc": [
    "H04L 12/40026",
    "B60W 2050/0215",
    "B60W 2050/022",
    "B60W 2050/146",
    "B60W 50/0205",
    "B60W 50/082",
    "B60W 50/10",
    "B60W 50/14",
    "B60W 60/0053",
    "B60W 60/0059",
    "G05D 1/0061",
    "G05D 1/0077",
    "G05D 1/0246",
    "G05D 1/81",
    "G05D 1/87",
    "H04L 2012/40215",
    "H04L 2012/40234",
    "H04L 2012/40273",
    "H04L 2209/84",
    "H04L 67/12",
    "H04L 67/62",
    "H04L 9/14",
    "H04L 9/3236",
    "H04L 9/3247",
    "H04L 9/3263",
    "H04W 4/38",
    "H04W 4/48"
  ],
  "ipc": [
    "B60W 50/14",
    "G05D 1/00",
    "H04L 29/08",
    "H04L 9/14",
    "H04L 12/40"
  ],
  "assignees": [
    "Lyft Inc",
    "Magna Autonomous Systems LLC"
  ],
  "inventors": [
    "Helen Ruth Lurie",
    "George James Hansel",
    "James Allen-White Hoffacker",
    "Osama M. Salem"
  ],
  "filing_date": "2018-04-20",
  "publication_date": "2019-10-24",
  "priority_date": "2018-04-20",
  "application_number": "US-201815959130-A",
  "family_id": "68237741",
  "cited_by_count": 64,
  "citations": [
    "US20160285864A1",
    "US9566986B1",
    "US20170109944A1",
    "US20170132477A1",
    "US20180120829A1",
    "US20200094832A1"
  ]
}