Title: Intrusion detection apparatus, system and methods

Abstract

Described herein are various technologies for detection and mitigation of rogue terminal attacks on multiplex data buses. An intrusion detection device is incorporated between a bus controller and a bus of a multiplex data bus. The intrusion detection device receives message that are communicated among the bus controller and a plurality of remote terminals (by way of the bus). The intrusion detection device determines whether messages are unauthorized based upon origins of the messages and predefined rules. When a message is determined to be unauthorized, the intrusion detection device outputs a notification that the unauthorized message has been detected and can block the unauthorized message.

Inventors:

Jenkins, Chris; Roesler, Alexander

Issue Date:

Tue Sep 10 00:00:00 EDT 2019

Research Org.:

Sandia National Lab. (SNL-NM), Albuquerque, NM (United States)

Sponsoring Org.:

USDOE

OSTI Identifier:

1576345

Patent Number(s):

10410002

Application Number:

15/341,279

Assignee:

National Technology & Engineering Solutions of Sandia, LLC (Albuquerque, NM)

Patent Classifications (CPCs):

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

Show more

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

G06F13/4282 - {on a serial bus, e.g. I2C bus, SPI bus
G06F21/554 - {involving event detection and direct action}
G06F21/60 - Protecting data
G06F21/606 - {by securing the transmission between two devices or processes}
G06F21/85 - interconnection devices, e.g. bus-connected or in-line devices

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

H04L63/0227 - {Filtering policies
H04L63/123 - {received data contents, e.g. message integrity}
H04L63/126 - {the source of the received data}
H04L63/1416 - {Event detection, e.g. attack signature detection}
H04L63/1466 - {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}

Show less

DOE Contract Number:  

AC04-94AL85000

Resource Type:

Patent

Resource Relation:

Patent File Date: 2016 Nov 02

Country of Publication:

United States

Language:

English

Subject:

97 MATHEMATICS AND COMPUTING