Secure controller operation and malware prevention

Abstract

In one implementation, a method for providing security on an externally connected controller includes launching, by the controller, a kernel level security layer that includes a whitelist of permitted processes on the controller, the whitelist being part of a custom security policy for the controller; receiving, at the security layer, a request to run a particular process; determining, by the security layer, a signature for the particular process; identifying, by the security layer, a verified signature for the process from the whitelist; determining, by the security layer, whether the particular process is permitted to be run on the controller based on a comparison of the determined signature with the verified signature from the whitelist; and blocking by the security layer, the particular process from running on the automotive controller based on the determined signature not matching the verified signature for the process.

1 - 22 . (canceled) 
     
     
         23 . A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for providing a visual indicator of a status of a vehicle's cybersecurity systems, comprising:
 performing a cybersecurity testing protocol within the vehicle, the cybersecurity testing protocol being performed by one or more anti-tampering agents and being configured to determine whether a security software layer installed on an ECU in the vehicle has been tampered with; and   determining, based on a result of the cybersecurity testing protocol, whether to display in a display panel of the vehicle a visual indicator of the security status of the ECU.   
     
     
         24 . The non-transitory computer readable medium of  claim 23 , wherein the visual indicator is configured to display a security status of a plurality of ECUs in the vehicle. 
     
     
         25 . The non-transitory computer readable medium of  claim 23 , wherein the cybersecurity testing protocol includes determining whether one or more whitelist hooks associated with the ECU in the vehicle have been removed. 
     
     
         26 . The non-transitory computer readable medium of  claim 25 , wherein the one or more whitelist hooks are configured to cause calls to the one or more kernel level processes to be forwarded to the security software layer. 
     
     
         27 . The non-transitory computer readable medium of  claim 26 , wherein the forwarded calls include process information identifying a kernel level process being called. 
     
     
         28 . The non-transitory computer readable medium of  claim 26 , wherein the forwarded calls include a pointer to a kernel level process being called. 
     
     
         29 . The non-transitory computer readable medium of  claim 23 , wherein the cybersecurity testing protocol includes determining whether one or more portions of a security policy associated with the ECU have been removed. 
     
     
         30 . The non-transitory computer readable medium of  claim 29 , wherein the one or more portions of the security policy are configured to implement a software stack inspection operation for the ECU. 
     
     
         31 . The non-transitory computer readable medium of  claim 29 , wherein the one or more portions of the security policy are configured to determine whether a sequence of process calls is consistent with a process map for the ECU. 
     
     
         32 . The non-transitory computer readable medium of  claim 29 , wherein the one or more portions of the security policy are based on static analysis of at least one of: permitted processes, binaries, scripts, network usage, or other ECU behaviors. 
     
     
         33 . A computer-implemented method for providing a visual indicator of a status of a vehicle's cybersecurity systems, the method comprising:
 performing a cybersecurity testing protocol within the vehicle, the cybersecurity testing protocol being performed by one or more anti-tampering agents and being configured to determine whether a security software layer installed on an ECU in the vehicle has been tampered with; and   determining, based on a result of the cybersecurity testing protocol, whether to display in a display panel of the vehicle a visual indicator of the security status of the ECU.   
     
     
         34 . The computer-implemented method of  claim 33 , wherein the visual indicator is configured to display a security status of a plurality of ECUs in the vehicle. 
     
     
         35 . The computer-implemented method of  claim 33 , wherein the cybersecurity testing protocol includes determining whether one or more whitelist hooks associated with the ECU in the vehicle have been removed. 
     
     
         36 . The computer-implemented method of  claim 35 , wherein the one or more whitelist hooks are configured to cause calls to the one or more kernel level processes to be forwarded to the security software layer. 
     
     
         37 . The computer-implemented method of  claim 36 , wherein the forwarded calls include process information identifying a kernel level process being called. 
     
     
         38 . The computer-implemented method of  claim 36 , wherein the forwarded calls include a pointer to a kernel level process being called. 
     
     
         39 . The computer-implemented method of  claim 33 , wherein the cybersecurity testing protocol includes determining whether one or more portions of a security policy associated with the ECU have been removed. 
     
     
         40 . The computer-implemented method of  claim 39 , wherein the one or more portions of the security policy are configured to implement a software stack inspection operation for the ECU. 
     
     
         41 . The computer-implemented method of  claim 39 , wherein the one or more portions of the security policy are configured to determine whether a sequence of process calls is consistent with a process map for the ECU. 
     
     
         42 . The computer-implemented method of  claim 39 , wherein the one or more portions of the security policy are based on static analysis of at least one of: permitted processes, binaries, scripts, network usage, or other ECU behaviors.