Intel Corporation

Marcio Rogerio Juliato

Manoj R Sastry

Shabbir Ahmed

Christopher N Gutierrez

Vuk Lesi

Liuyang L Yang

Qian Wang

Xiruo Liu

Santosh Ghosh

Dave A Cavalcanti

Javier Perez-Ramirez

Li Zhao

Rafael Misoczki

Markus Dominik Mueck

Mikhail T Galeev

Jong-Kae Fwu

Debdeep Chatterjee

Emily H Qi

Nageen Himayat

Carlos Horacio Aldana

Shilpa Talwar

Kathiravetpillai Sivanesan

Bahareh Sadeghi

Hassnaa Moustafa

Zhibin Yu

Thorsten Clevorn

Bertram Gunzelmann

Ana Lucia Pinheiro

Harry G Skinner

Debabani Choudhury

Ingolf Karls

Duncan Kitchin

Stefan Fechtel

Jeffrey R Foerster

Aviad Kipnis

Ralf Graefe

Wen-Ling Huang

Eduardo Alban

Saiveena Kesaraju

Christopher Hall

Michael Kara-Ivanov

Ivan Simoes Gaspar

Ned M Smith

Francesc Guim Bernat

Kshitij Arun Doshi

Rath Vannithamby

Satish Chandra Jha

Christian Maciocco

John Charles Weast

Srikathyayani Srikanteswara

Vallabhajosyula S Somayazulu

S M Iftekharul Alam

Vesh Raj Sharma Banjade

Leonardo Gomes Baltar

Kilian Roth

Kevin B Stanton

Rafael Rosales

Maria Soledad Elli

Kilian Peter Anton Roth

Ahmed Shabbir

Huaxin Li

Liuyang Lily Yang

Jack Charles Weast

Christopher Noe Gutierrez

Techniques include an apparatus to retrieve a first parameter for the IDS to monitor a device for a time-synchronized network. The first parameter may represent a number of messages the IDS needs to analyze in order to detect a security attack. The messages may comprise time information to synchronize a clock for a device to a network time for a time-synchronized network. The processor circuitry may retrieve a second parameter for a time sensitive application. The second parameter may represent a defined amount of time error tolerated by the time sensitive application, and determine a third parameter for the IDS based on the first and second parameters. The third parameter may represent a defined frequency to receive a number of messages with time information in order to detect the security attack on the device within a defined time interval. Other embodiments are described and claimed.

Security-guided adjustment of time-sync frequency in time synchronized networking

A system is disclosed for quarantining and recovery of a network after an outage or in advance of a potential outage. Unaffected network slices are isolated and recovery is initiated by quarantine physical and virtual network functions. An AI model is trained based on recent events detected by sensors disposed throughout the network to determine whether to quarantine network slices, move services to unaffected network slices, or initiate recovery. Once the network is stabilized, resources that are specifically allocated for recovery and services are released and the traffic moved back to the recovered network slices.

Quarantine control network in a 5G RAN for coordinated multi-layer resiliency of network slice resources

Techniques include a method, apparatus, system and computer-readable medium to detect, quantify and localize attacks to enhance security for time-synchronized networking. Embodiments include a diagnostic stream producer to produce diagnostic information providing evidence of a timing attack on a node of a time-synchronized network. Embodiments include a diagnostic stream consumer to consume diagnostic information, analyze the diagnostic information, and determine whether a node is under a timing attack. Other embodiments are described and claimed.

Scheduled-based low-latency detection for desynchronization attacks

Systems and techniques for misbehavior processing in connected vehicle networks such as a vehicle-to-everything (V2X) communication environment are described herein. A misbehavior report may be received by a local misbehavior agent from a node operating on a vehicle communication network. The local misbehavior agent may be responsible for a geographic area in which the node is located. The misbehavior report may be corroborated using the misbehavior report and evidence of misbehavior of a subject node of the misbehavior report. A revocation recommendation may be generated for the subject node based on the corroboration. The revocation recommendation may be transmitted to a misbehavior authority operating on the vehicle communication network.

Misbehavior processing in connected vehicle networks

An apparatus for clock manager redundancy comprises a clock circuitry to manage a clock for a device; a first processing circuitry coupled to the clock circuitry to execute instructions to perform operations for a clock manager, the clock manager to receive messages with time information for a network and generate clock manager control information to adjust the clock to a network time for the network; a hardened execution environment coupled to the clock circuitry and the first processing circuitry, the hardened execution environment to comprise: a detector to monitor the clock manager and generate an alert when the detector identifies abnormal behavior of the clock manager; and a second processing circuitry to execute instructions to perform operations for a redundant clock manager, the redundant clock manager to take over operations for the clock manager in response to the alert from the detector. Other embodiments are described and claimed.

Clock manager redundancy for time synchronized networks

Techniques include receiving a message with time information from a clock leader by a clock follower in a time-synchronized network (TSN), the time information to synchronize a clock to a network time for the TSN, retrieving an actual time offset value for the message, the actual time offset value to comprise a value between an actual sending time and an actual receiving time of the message, retrieving an estimated time offset value for the message, the estimated time offset value to comprise a value between an estimated sending time and an estimated receiving time of the message, the estimated time offset value generated using a physics-aware model of the TSN and a clock adjustment value for the clock based on the time information, and determining whether the time information for the message was modified to cause the clock to desynchronize based on difference information. Other embodiments are described and claimed.

Physics-aware detector for protocol spoofing attacks in time synchronized networking

Techniques to perform time recovery from attacks on delayed authentication in a time synchronized network are described. One embodiment comprises a method for decoding time information and a message authentication code (MAC) from a time message, the time information to synchronize a local clock for a device to a network time of a time synchronized network (TSN), and the MAC to authenticate the time message, determining whether the time message is authentic using the MAC, discarding the time information when the time message is not authentic, performing a bounded search to identify authentic time information using the MAC, and passing the authentic time information to a clock manager to synchronize the local clock to the network time of the TSN when the authentic time information is identified. Other embodiments are described and claimed.

Time recovery from attacks on delayed authentication

A computing node to implement a management entity in a CP-based network. The node including processing circuitry configured to encode an inquiry message requesting information on CPS capabilities. Response messages are received from a set of sensing nodes of a plurality of sensing nodes in response to the inquiry message. The response messages include the information on the CPS capabilities of the set of sensing nodes. A notification message indicating selecting of a sensing node as a sensing coordinator is encoded for transmission. Sensed data received in a broadcast message from the sensing coordinator is decoded. The sensed data including data associated with one or more non-V2X capable sensing nodes.

Occupancy grid map computation, V2X complementary sensing, and coordination of cooperative perception data transmission in wireless networks

Systems, apparatuses and methods may provide for technology that detects one or more non-compliant nodes with respect to a timing schedule, detects one or more compliant nodes with respect to the timing schedule, and identifies a malicious node based on positions of the one or more non-compliant nodes and the one or more compliant nodes in a network topography. The non-compliant node(s) and the compliant node(s) may be detected based on post-synchronization messages, historical attribute data and/or plane diversity data.

Attacker localization based on tracking anomaly propagation in time-sensitive networking

Techniques for clock manager monitoring for time sensitive networks are described. An apparatus, comprises a clock circuitry to manage a clock for a device, a processing circuitry coupled to the clock circuitry, the processing circuitry to execute instructions to perform operations for a clock manager, the clock manager to receive messages with time information for a network and generate clock manager control information to adjust the clock to a network time for the network, and a detector coupled to the processing circuitry and the clock circuitry, the detector to receive the clock manager control information, generate model control information based on a clock model, compare the clock manager control information with the model control information to generate difference information, and determine whether to generate an alert based on the difference information. Other embodiments are described and claimed.

Clock manager monitoring for time synchronized networks

Techniques to detect attacks for time synchronization networking

Cross-network time-alignment characterization for scheduled traffic

Systems, apparatuses, and methods to attest to and verify the integrity of cargo during transport by an autonomous vehicle are provided. An autonomous vehicle can discretize parameters associated with transportation of cargo and can generate a keyed hash digest from the discretized parameters. The keyed hash digest can be sent to a stakeholder in the transportation of the cargo to attest to the integrity of the cargo during transport.

Continuous integrity monitoring for autonomous transportation services

Systems, apparatuses, and methods to identify bus-off and masquerade attacks against electronic control units (ECUs) transmitting on a communication bus from behind a gateway coupled to the communication bus are described. The disclosure further describes systems, apparatuses, and methods to mitigate against bus-off attacks made against an ECU coupled to a communication bus through a gateway. Other embodiments are described and claimed.

Post-gateway bus-off attack mitigation

Systems, apparatuses, and methods to establish ground truth for an intrusion detection system in the presence of an attacker electronic control unit transmitting masqueraded messages on a communication bus, such as an in-vehicle network bus, are provided.

Re-training intrusion detection fingerprints in the presence of an attacker

Growing community of inventors

Portland, OR, United States of America

Marcio Rogerio Juliato