AU2020376035A1

AU2020376035A1 - Balise integrity

Info

Publication number: AU2020376035A1
Application number: AU2020376035A
Authority: AU
Inventors: Amir LEVINTAL; Michael SHIFMAN
Original assignee: Cylus Cyber Security Ltd
Current assignee: Cylus Cyber Security Ltd
Priority date: 2019-10-30
Filing date: 2020-10-30
Publication date: 2022-06-23
Also published as: WO2021084542A1; EP4051553A1

Abstract

A cyber security system for providing security to a railway, the system comprising a data monitoring and processing hub; a network comprising a plurality of data collection agents configured to monitor railway infrastructure communications associated with balises to detect anomalies indicative of a cyber-attack.

Description

BALISE INTEGRITY

RELATED APPLICATIONS

[0001] The present application claims the benefit under 35 U.S.C. 119(e) of U.S. Provisional Application 62/927,706 filed on October 30, 2019 the disclosure of which is incorporated herein by reference.

FIELD

[0002] Embodiments of the disclosure relate to providing a system for providing cyber security to a railroad system.

BACKGROUND

[0003] Early railroad systems visually signaled train drivers and controlled trains operating on the systems using mechanical signaling and control devices to govern movement of the trains along fixed lengths of track, referred to as “blocks”. Each block was the responsibility of a signalman who operated signal and control equipment to authorize and control movement of trains into and out of the signalman’s block. Generally, a signalman operated from the vantage point of a second floor of a small, two story building referred to as a signal box that was high enough to offer the signalman visual surveillance of the block for which the signalman was responsible. For example, at railroad track switches at which trains are directed to proceed along different tracks, track switches and signaling equipment were manually set to required positions by signalmen operating levers or handles located in a signal box. And early automatic, track “wayside”, devices were mechanical devices that operated by direct physical contact with trains. For example, train stops, which operated to automatically stop a passing train if it didn’t have authority to proceed from one block to a next block, comprised an arm that engaged a valve on the passing train to trigger the train’s brake system and stop the train.

[0004] However, the growth, urbanization, and globalization of the world’s population generated need for and deployment of railroad systems capable of providing large transport capacities that span continents, which older conventional signaling and control technology could not support. The advent of modem digital processors, sensors, communications systems, and Global Navigation Satellite Systems (GNSSs), have made technologies available that are capable of supporting the new requirements of the railway systems. Operations of the systems generate communication activities between railway entities, which may be railway infrastructure entities, for example, trackside entities, such as balises, railroad switches, and train stations, and/or rolling stock entities, for example trains that move on the railway tracks and onboard equipment they carry.

[0005] Advanced rail traffic management (ARTMN) systems based on the new technologies that are deployed and/or under development at various levels of sophistication provide real time monitoring and flexible management of train movement that adapts to operational contexts of the trains. The systems may provide such train control functionalities as Automatic Train Protection (ATP), Automatic Train Operation (ATO), and/or Automatic Train Supervision (ATS) as defined in various national and international technical standards, such as by way of example the IEEE 1474 or IEC 61375 standards. An ARTMN system may also include management and control of passenger facility infrastructures, such as train stations, fire alarm and safety systems, and passenger services such as automatic ticketing and information display systems.

[0006] The European Rail Traffic Management System (ERTMS) is an example of an ARTMN system that is a software-based railway command, signaling, and communication system, adopted by the European Union as a standard for railway control. The system comprises an ATP referred to as a European Train Control System (ETCS) that operates to provide train operation compliance with speed, safety, and inter-train spacing regulations; and a railway communications system, referred to as Global System for Mobile communications Railways (GSM-R), for voice and data services.

SUMMARY

[0007] An aspect of an embodiment of the disclosure relates to providing a cyber security system, hereinafter also referred to as “Rail-Eye”, which operates to provide a railway with protection against cyber-attack. Providing protection against cyber-attack may comprise identifying an attempt to perpetrate, vulnerability to, and/or presence of a cyber-attack. Reference to a cyber-attack may refer to any one or any combination of more than one of an attempt to perpetrate, vulnerability to, and/or a cyber-attack.

[0008] In an embodiment, Rail-Eye comprises an optionally cloud based, data monitoring and processing hub, and a distributed, synchronized network of data collection agents and aggregator nodes. The data collection agents which may be referred to as “cyber-snitches”, comprise infrastructure cyber-snitches and rolling stock, “onboard”, cyber-snitches. Infrastructure snitches are configured to monitor communications generated by and/or operations of infrastructure equipment. Onboard snitches are configured to monitor communications generated by and/or operations of onboard equipment. An infrastructure and/or rolling stock snitch may operate and provide functions of a network tap. For convenience of presentation monitoring communications and/or operations of a piece of equipment is generically referred to as monitoring communications of the equipment. Aggregator nodes, also referred to simply as aggregators, comprise onboard aggregator nodes and infrastructure aggregator nodes. Onboard aggregators are located onboard rolling stock. Infrastructure aggregators, also referred to as RBC aggregators, are installed at fixed locations generally in railway Radio Block Centers (RBCs).

[0009] In an embodiment, the network of cyber-snitches, aggregators, and Rail-Eye hub are configured in a hierarchical logical topology. Onboard cyber-snitches transmit data they acquire from communications that they monitor to onboard aggregator nodes in data messages. Onboard aggregator nodes may forward data as received, and/or as processed, optionally to identify presence of a cyber-attack, to RBC aggregators. Infrastructure cyber-snitches also transmit data they acquire from communications that they monitor to RBC aggregators in data messages. RBC aggregators in turn may forward data as received, and/or as processed by the RBC aggregators, optionally to determine presence of a cyber-attack to the Rail-Eye hub for storage and/or for processing, optionally to determine presence of a cyber-attack. In an embodiment, the hub and/or an aggregator determining that a cyber-attack is indicated may be configured to undertake a response to the indicated cyber-attack.

[0010] In an embodiment, the Rail-Eye system is synchronized to a common, network clock time, optionally based on a reference frequency and time of day (TOD) timing information provided by transmissions from a GNSS. Data that an onboard and/or infrastructure cyber snitch transmits in a data message to an aggregator may be time stamped with a time based on the network clock time at which the monitored communication comprising the data is received by the cyber-snitch. The time stamp associated with data that an onboard cyber-snitch transmits in a data message may comprise a time lapse between a beginning of a turn of a multifunctional vehicle bus (MVB) comprised in a train communication network (TCN) of the train in which the onboard cyber-snitch is located.

[0011] In an embodiment cyber-snitches and/or aggregator nodes in Rail-Eye are configured to monitor communications generated by entities in the railroad system to determine if balise integrity is maintained and balises in the railway system are operating properly. The communications monitored to determine balise integrity comprise communications, conventionally referred to as “telegrams”, generated by balises, and/or communications, also referred to as “balise related communications”, generated by non-balise entities that are related to balise telegrams. In an embodiment, Rail -Eye monitors patterns and content of telegrams and/or communications related to balise communications that are considered to be free of cyber-infringement to determine normative patterns of balise telegrams and balise related communications. Rail-Eye vets telegrams and/or balise related communications for proper operation in real time to determine if communications that appear anomalous in view of normative patterns of balise communications are indictive of a cyber-attack. Hereinafter, balise telegrams and/or balise related communications may be referred to generically as balise communications.

[0012] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter

BRIEF DESCRIPTION OF FIGURES

[0013] Non-limiting examples of embodiments of the invention are described below with reference to figures attached hereto that are listed following this paragraph. Identical features that appear in more than one figure are generally labeled with a same label in all the figures in which they appear. A label labeling an icon representing a given feature of an embodiment of the invention in a figure may be used to reference the given feature. Dimensions of features shown in the figures are chosen for convenience and clarity of presentation and are not necessarily shown to scale.

[0014] Fig. 1A schematically shows a Rail-Eye system comprising a cloud-based data monitoring and processing hub and a distribution of cyber-snitches operating to protect a railway system from cyber incursion, in accordance with an embodiment of the disclosure;

[0015] Fig. IB schematically shows an enlarged image of a portion of the railway system shown in Fig. 1A, in accordance with an embodiment of the disclosure;

[0016] Fig. 2A schematically show a train, components of the train TCN, and cyber-snitches and aggregators connected to the TCN, in accordance with an embodiment of the disclosure;

[0017] Fig. 2B schematically shows a locomotive of the train shown in Fig. 2A and cyber snitches and aggregators connected to devices in the locomotive, in accordance with an embodiment of the disclosure; [0018] Fig. 2C schematically shows a car of the train shown in Fig. 2A and cyber-snitches and aggregators connected to devices in the car, in accordance with an embodiment of the disclosure;

[0019] Fig. 3 schematically shows a Rail-Eye operating to protect a railway from cyber incursion of the balise infrastructure of the railway, in accordance with an embodiment of the disclosure;

[0020] Fig. 4A shows a flow diagram illustrating a process that Rail-Eye executes to determine if a balise communication is an anomaly, in accordance with an embodiment of the disclosure;

[0021] Fig. 4B is a continuation of the flow diagram of Fig. 4A, in accordance with an embodiment of the disclosure; and

[0022] Fig. 4C is continuation of the flow diagram of Fig. 4B, in accordance with an embodiment of the disclosure.

DETAILED DESCRIPTION

[0023] In the following detailed description, components of a Rail-Eye system operating to provide cyber security to a railway system in a train operations area are discussed with reference to Figs. 1A and IB. Figs. 2A-2C schematically show details of atrain communication network (TCN) optionally comprising a “train-wide”, wire train bus (WTB) that spans the length of atrain and is coupled to multifunctional vehicle buses (MVB), each of which supports communications for onboard devices in a single car of the train. Placement and operation of onboard cyber-snitches and onboard aggregators located in the train in accordance with an embodiment of the disclosure are discussed with reference to the figures.

[0024] In the discussion, unless otherwise stated, adjectives such as “substantially” and “about” modifying a condition or relationship characteristic of a feature or features of an embodiment of the disclosure, are understood to mean that the condition or characteristic is defined to within tolerances that are acceptable for operation of the embodiment for an application for which the embodiment is intended. Unless otherwise indicated, the word “or” in the description and claims is considered to be the inclusive “or” rather than the exclusive or, and indicates at least one of, or any combination of items it conjoins.

[0025] Fig. 1A schematically shows a perspective view of Rail-Eye system 20, operating to provide cyber-protection to a railway system 200, in accordance with an embodiment of the disclosure. Fig. IB schematically shows an enlarged portion of railway system 200 and Rail- Eye 20, in accordance with an embodiment of the disclosure. [0026] Railway system 200 comprises an infrastructure of tracks 202 along which trains 300 move to transport passengers and goods, and infrastructure equipment that cooperate to control movement of the trains in an operations area schematically represented by a dashed rectangle 204. The infrastructure equipment comprises switches (not shown) at track junctions 206, signaling apparatuses represented by color light signal equipment 208 along the tracks and at track junctions 206 and crossovers 207, interlocking trackside units 210 at the track junctions, trackside balises 218, RBCs 230, each represented by a house and radio antenna tower, and train stations represented by clusters of human icons 260.

[0027] A signaling apparatus 208 conventionally referred to as a “signal” is a trackside device, typically a color light device as schematically shown in Fig. 1A, operable to visually transmit to a train driver by color of lights that the signal displays, information relating to the state of track ahead of a train which the train driver is driving. For example, a signal 208 might inform the train driver of a speed at which the train may safely proceed, or, if the track ahead of the train is occupied by another train, instruct the train driver to stop the train. An interlocking trackside unit 210, controls signaling and switches at a track junction 206 to prevent conflicting movement and provide for safe passage of trains through the junction. A balise 218, such as a Euro-balise used by the ERTMS, is a passive electronic beacon mounted to a track sleeper between the rails of a track. The balise receives energy from a train passing over the balise and uses the energy to transmit information to the train via a signal referred to as a telegram. The telegram typically comprises a unique identification of the balise and thereby location of the train as it passes over the balise, speed limits, gradients, and if the balise is a balise referred to as a switchable or transparent balise, it may be operated to provide movement authority.

[0028] A radio block center, RBC 230, is a radio control center that communicates with trains 300, and infrastructure equipment over a railway communications system, such as GSM-R, in an area referred to as an RBC control area for which the RBC has radio coverage and is responsible for safe operations of the trains. By way of example, control areas for two adjacent RBCs 230 are schematically indicated by dashed hexagonal boundaries 231. An RBC 230 receives data relevant to the status and locations of trains 300 in control area 231 of the RBC via GSM-R radio transmissions from the trains and data relevant to status of infrastructure equipment from interlocking trackside units 210 in the RBC control area 231 via wire and/or radio communication. The RBC processes the received data and information to formulate and transmit movement authorities to trains 300 and data to interlocking trackside units 210 for use by the trackside units to control signaling and switching at track junctions 206 at which the trackside units and interlocking components such as signal lights and switches are respectively located. The movement authorities that an RBC generates and transmits to the trains are determined to provide distances between trains that maintain safe headways (distances between trains and next trains) and generally also advantageous transport capacity.

[0029] Trains 300 comprise a locomotive 310 and optionally one or more train vehicles 330, also referred to as cars 330. Enlarged images and details of a train 300, locomotive 310, and car 330 are schematically shown in Figs. 2A, 2B and 2C respectively. Generally, a train 300 has atrain communications network, TCN 331 (Figs. IB, 2A-2C), comprising atrain-wide bus, WTB 336, running the length of the train, and for each car 330 and locomotive 310, an MVB bus 332 connected to the WTB by a train vehicle gateway 334. MVB 332 in a given car 330 or locomotive 310 supports communications between and with onboard devices, generically referenced in Figs. 2A-2C by the label 360 (Figs. 2A-2C), in the car or locomotive. For example, in a train car 330 door control actuators, air-conditioning, lighting, and passenger information devices are connected to MVB 332. Transmissions over MVB 332 by devices 360 attached to MVB 332 are controlled by at least one bus master 335 which controls access to MVB 332 during sequential time periods referred to as turns. WTB 336 supports communications between cars 330 and between cars 330 and locomotive 310. Brake control apparatus 362 (Fig. 2C) in each car 330 and locomotive 310 is typically directly connected to WTB so that application and release of brakes in train 300 may be properly synchronized. Focomotive 310 typically comprises a communication module 312 (Fig. IB) having a suitable front end and antenna that supports GSM-R communications with RBCs 230 (Figs. 1A and IB) and trackside equipment, a GSNS (Global Satellite Navigation System) receiver 313, and a balise “reader”, conventionally referred to as a balise transmission module (BTM), 314, (Figs. 2A, 2B) configured to interface with balises 218 (Figs. 1A, IB).

[0030] The locomotive is mandated to comprise an event recorder, which in European Train Control Systems, ETCS, is a Juridical Recording Unit (JRU). The event recorder or JRU, hereinafter generically referred to as a JRU, is a rolling stock “black box” recorder, which receives and stores data relevant to events of specific interest that may occur during operation of train 300 to facilitate analysis of train behavior and accidents in which the train may be involved. The ERTMS has defined a set of specific events, hereinafter also referred to as JRU events, which trigger transmission to the JRU of data relevant to the events in formatted message packets, referred to as JRU data messages that identify the events. A JRU data messages associated with a given JRU event includes the date and time of occurrence in UTC of the event and other information items that identify the JRU event. A list of JRU events is provided in an ERTMS/ETCS functional interface specification (FIS) entitled FIS Juridical Recording.

[0031] Rail-Eye system 20 optionally comprises a data monitoring and processing hub 22 (Fig. 1A and IB), which may, as shown in Figs. 1A and IB, be cloud based, and a network of onboard cyber-snitches schematically represented by diamond shape icons 32, and onboard aggregator nodes 34 schematically represented by hexagonal icons, located on trains 300. For convenience of presentation, in Figs. 1A and IB, to accommodate constraints on sizes of images shown in the figures, onboard cyber-snitches 32 and aggregators 34 are shown over or on images of trains 300, and a single onboard cyber-snitch 32 and/or onboard aggregator 34 associated with a train 300 or portion of a train 300 in Figs. 1A and IB represents one or more cyber-snitches and/or one or more onboard aggregators respectively.

[0032] Figs. 2A-2C schematically show details discussed below of possible placements of onboard cyber-snitches 32 and onboard aggregators 34 in a train 300 and how they may be connected to the train’s TCN 331 (Fig. IB, 2A-2C). Rail-Eye 20 also comprises stationary, infrastructure cyber-snitches, schematically represented by icons 36, and RBC aggregators 38 (Figs. 1A-2C) that communicate with the infrastructure cyber-snitches. A single infrastructure cyber-snitch 36 and/or a single RBC aggregator 34 shown in Figs. 1A and IB represents one or more of an infrastructure cyber-snitch and aggregator respectively.

[0033] Onboard and infrastructure cyber-snitches 32 and 36, and aggregators 34 and 38 may be configured as separate bare metal components, as might be inferred from Figs. 1A-2C. However, cyber-snitches and aggregators in accordance with an embodiment of the disclosure may be defined by software and hardware components, or only by software components and may quite generally comprise any combination of software and/or hardware components that support functionalities of the cyber-snitches and aggregators.

[0034] For example, a cyber-snitch or aggregator may be a bare metal, hardware module comprising any electronic and/or optical processing and/or control circuitry, to provide and enable functionalities that the cyber-snitch or aggregator may require to support monitoring or processing functionalities of the cyber-snitch or aggregator. The cyber-snitch or aggregator may comprise any one, or any combination of more than one of, a microprocessor, an application specific circuit (ASIC), field programmable array (FPGA) and/or system on a chip (SOC). The cyber-snitch or aggregator may comprise a memory having any electronic and/or optical circuitry suitable for storing data and/or computer executable instructions and may, by way of example, comprise any one or any combination of more than one of a flash memory, random access memory (RAM), read only memory (ROM), and/or erasable programmable read-only memory (EPROM). A cyber-snitch or aggregator may be a software module comprised in any of various onboard and/or infrastructure equipment of a railway system and may cooperate with hardware and/or software in railway system equipment to perform functionalities of the cyber-snitch and/or aggregator. A cyber-snitch or aggregator may be a virtual entity. Similarly, hub 22 optionally has a memory 23 and a processor 24 configured to support functionalities of the hub, may comprise any combination of hardware and software components, and may comprise or be a virtual entity.

[0035] As schematically shown in Figs. 2A-2C onboard cyber-snitches 32 and onboard aggregators 34 may be coupled to different onboard equipment in a train 300 to monitor communications generated by devices in the train and transmit data from the monitored communications to onboard aggregator 34 of the train for forwarding to an RBC 230 and/or hub 22 for processing and optionally storage. And a cyber-snitch 32 may be coupled in different ways to a device 360 in train 300 and to TCN 331 of the train to acquire and forward the data.

[0036] For example, an onboard cyber-snitch 32 distinguished by a label 32-1 located in a car 330 (Fig. 2C) may be coupled directly to a device 360 in the car to monitor communications generated by the device. Cyber-snitch 32-1 may be coupled to a port (not shown) of device 360 to monitor communications propagated through the port or to a processor (not shown) comprised in the device to monitor activity of the processor. Cyber-snitch 32-1 is optionally not directly connected to TCN 331 by a connection to MVB 332 and may be configured to use a connection that device 360 has to MVB 332 to transmit data acquired from the monitored communications or activity to the MVB and therefrom to aggregator 34 in car 330. Alternatively or additionally, a cyber-snitch 32, such as the cyber-snitch distinguished by a label 32-2 in Fig. 2C, monitoring a device 360 in car 330 may itself be directly coupled to MVB 332 to transmit data to TCN 331 that cyber-switch 32-2 acquires from monitored communications. An onboard aggregator 34 in car 330 may be connected to MVB 332 to receive and aggregate data comprised in data messages transmitted by cyber-snitches 32-1 and 32-2 for forwarding and processing. Onboard aggregator 34 may process the aggregated data to determine possible presence of a cyber-attack and forward aggregated data and/or aggregated data as processed to train vehicle gateway 334 for transmission via WTB 336 to locomotive 310 and forwarding by GSM-R communication to an RBC 230. An onboard aggregator, such as aggregator 34 comprised in locomotive 310 schematically shown in Fig. 2B may receive data messages generated by a cyber-snitch distinguished by a label 32-3 (Fig. 2B) monitoring WTB 336.

[0037] In an embodiment, to reduce bandwidth use and possible interference that activity of cyber-snitches 32 and 36 and aggregators 34 and 38 may have on operations of onboard and/or infrastructure equipment of railway system 200, a cyber-snitch and/or aggregator may compress data it receives for transmission in a data message and/or processing. Optionally, to facilitate processing data comprised in data messages that cyber-snitches and aggregators comprised in Rail-Eye 20 generate and transmit, the data messages may be configured in accordance with a common Rail-Eye rapporteur protocol. In an embodiment a data message configured in accordance with the Rail-Eye rapporteur protocol may comprise a message field encoding a weighting vector having components that indicate degree of relevance of the data for different operational aspects of the railway system. The weighting vector for a data message generated by a cyber-snitch aggregator may for example indicate how relevant the data may be for safety of operation of rolling stock and/or infrastructure equipment, provide a desired time frame and/or priority for processing the data, and/or that an alarm should be raised to indicate that human intervention is advised. Weighting may be context dependent.

[0038] Rail-Eye 20 components are optionally synchronized to a same network clock schematically represented by a clock 25 that generates a reference frequency and TOD based on timing information and TOD signals received from a GNSS system schematically represented by satellites 50. Cyber-snitches and aggregators may time stamp data that they acquire with network clock times at which they acquire the data. In an embodiment, the Rail- Eye system is synchronized to a common, network clock time, optionally based on a reference frequency and time of day (TOD) timing information provided by transmissions from a GNSS. As noted above, transmissions over MVB 332 by devices attached to the MVB are controlled by at least one bus master 335 which controls access to MVB 332 during sequential time periods turns. In an embodiment, an onboard snitch 32 may time stamp data that it acquires from an onboard device 360 with a time lapse, also referred to as a “turn time” lapse, between a time at which the cyber-snitch acquired the data and a beginning of a turn during which the data was acquired. An onboard and/or RBC aggregator, a train vehicle gateway, and/or hub 22 that receives the data may determine when the data was acquired relative to network time using the turn time lapse.

[0039] In an embodiment, as indicated in Fig. 1A and IB, the network of cyber-snitches 32 and 34, aggregators 36 and 38, and Rail-Eye hub 20 are configured in a hierarchical logical topology. Onboard snitches 32 transmit data messages to onboard aggregators 34 for processing and/or forwarding to RBC aggregators 38. Onboard aggregators 34, infrastructure snitches 34, and optionally onboard snitches 32, transmit data to RBC aggregators 38 for processing. RBC aggregators 38 in turn transmit data they receive and/or have processed to Rail-Eye hub 22 for processing.

[0040] Optionally, Rail-Eye 20 is configured to process data acquired by onboard and infrastructure cyber-snitches 32 and 34 in “layers” homomorphic to the hierarchical network topology to determine presence of a possible cyber-attack.

[0041] Onboard aggregators 34 may be configured to identify anomalous events responsive to data they receive and aggregate from onboard snitches 32 on respective trains 300 in which the onboard aggregators are located. In an embodiment, an onboard aggregator 34 may determine an operational train context for the train in which the onboard aggregator is located, and identify anomalous events based on the train context. A train context may comprise by way of example, at least one or any combination of more than one of train speed, track conditions, traffic congestion, ambient weather conditions, passenger or freight loading, number of cars in the train, number of locomotives in the train and specifications of locomotives and cars. Optionally, upon identifying an indication of a cyber-attack, onboard aggregator 34 may operate to undertake a response to the attack.

[0042] For example, in an embodiment, onboard cyber-snitches 32 in a car 330 of a train 300 may monitor devices 360 controlling doors in the car and generate and transmit to an onboard aggregator 34 in the car data messages comprising data indicating status of the doors. The onboard aggregator 34 in the car that receives the data messages may determine an operational context for the train comprising values based on speed and location of the train for times at which time stamps in the data messages indicate the status data was acquired by the cyber snitches. For a situation in which the data messages from cyber-snitches 32 indicate that doors of car 330 are open, aggregator 34 may generate and transmit to an RBC aggregator 38 (Fig. IB) a data message for which a weighting vector has a very large weight for each of both operational safety and anomalousness indicative of possible cyber-attack if train 300 is carrying passengers between railway stations. The magnitudes of the large weights may be dependent on speed and/or location of the train indicated by the operational train context. Optionally, onboard aggregator 34 may be configured to respond to the situation as a function of magnitudes of the safety and anomalousness weights. For instance, if the weighting vector weight for either operational safety or anomalousness exceeds a predetermined threshold, aggregator 34 may generate an alarm notice to a driver of the train and/or the RBC aggregator 38. On the other hand, the weights for operational safety and anomalousness may be relatively low if the train context determined by aggregator 34 indicates that car 330 is empty of passengers or the train is in a train yard.

[0043] By way of another example, an onboard cyber-snitch 32 may be coupled to WTB 336 and an output of train vehicle gateway 334. The cyber-snitch may generate and transmit data messages to an onboard aggregator 34 responsive to time delays between the gateway receiving a communication via WTB 336 to activate or release brakes in the car and a time at which the gateway transmits a corresponding activation signal to the brakes. If the time delay exceeds a predetermined maximum could be the cyber-snitch may determine presence of an anomaly indicating a possible cyber-attack.

[0044] RBC aggregators 38 may be configured to identify anomalous events indicating a possible cyber-attack responsive to data the RBC aggregators 38 receive from infrastructure snitches 34, and onboard snitches 32 and/or onboard aggregators 34 located in respective control areas 231 (Fig. 1) of the RBCs 230 in which the RBC aggregators are located. An RBC aggregator 38 may be configured to determine an RBC control area context for rolling stock and/or infrastructure equipment in its control area 231 and identify anomalous events, optionally based on the RBC context. An RBC control area context may comprise at least one of or any combination of more than one of measures related to track conditions, such as state of rail repair and railhead adhesion, weather conditions, such as visibility and precipitation, and rolling stock status, such as congestion and types of rolling stock moving in a control area 231 of an RBC 230. A control area context may also comprise customer demand for rail transportation as evidenced by numbers of people physically present at railroad stations and/or ticket purchases for train travel in the RBC control area. Optionally, an RBC aggregator 38 may be configured to undertake a response to an identified possible cyber-attack.

[0045] For example, anomalous situations on a single train 300, such as anomalous door statuses or time delays discussed above with respect to a train 300 may be due to device malfunction on the train rather than a cyber-attack. However, in an embodiment, an RBC aggregator 38 (Fig. IB) is configured to correlate data messages from different onboard and infrastructure cyber-snitches in a control area 231 of RBC 230 with which RBC aggregator 38 is associated. If the RBC aggregator receives data from onboard aggregators 34 reporting similar anomalies in door status or time delays for a plurality of different trains 300 in control area 231 of RBC 230, the RBC aggregator may correlate the data to determine with greater reliability that the data is indicative of a cyber-attack.

[0046] By way of another example, in an embodiment an RBC aggregator 38 may determine that a cyber-attack is possibly present responsive to data messages received from infrastructure cyber-snitches 36 monitoring signal lights 208, balises 218, and interlocking trackside units 210 at a track intersection 206 (Fig. IB). For example, control of switches and signals 208 at a track intersection 206 in a control area 231 (Fig. IB) of an RBC 230 to enable trains to move through the intersection safely generally involves a carefully timed choreography of signals and events orchestrated by the RBC in cooperation with an interlocking trackside unit 210 located at the intersection. Trains 300 approaching and leaving a neighborhood of the intersection report their locations based on balise telegrams and/or GN S locations via GSM- Rto RBC 230. Based on the location information and an RBC control area context parameter such as train congestion, the RBC determines movement authorizations for the trains and corresponding control sequences for the switch and signal 208 to be mediated by interlocking trackside unit 210 to enable safe passage of a train through the intersection. For passage of a given train 300 through the intersection, RBC aggregator 38 may process data messages received from onboard cyber-snitches 32 via an onboard aggregator 34 on the train and infrastructure cyber-snitches 36 monitoring equipment at the intersection, to determine whether passage of the train comports with a normative scenario of signaling and movement of a train through the intersection. If events associated with passage of the train do not comport with a normative scenario, RBC aggregator 38 may determine that presence of a possible cyber-attack is indicated. Normative scenarios for use by the RBC aggregator may be stored in a database (not shown) comprised in the RBC aggregator or in a database, for example database 23 comprised in hub 22, to which the RBC aggregator has access.

[0047] Rail-Eye hub 22 may operate to identify anomalous events indicating a possible cyber attack responsive to data the hub receives from cyber-snitches 32 and 34 and aggregators 36 and 38 in geographical railway operations area 204 in which railway system 200 for which Rail-Eye 20 is responsible operates. Optionally, hub 22 is configured to generate a system context for operations of the railway system in railway operations area 204 and identify anomalous events indicating a possible a cyber-attack based on the system context. A system context may comprise at least one of or any combination of more than one of time of day, season, holiday, special events in the operations area, weather, and/or status of a power grid supplying power to railway system 200. In an embodiment, hub 22 may be configured to identify, based on data that the hub receives, anomalous events indicative of a possible cyber attack on a given train 300, in a given RBC control area 231, as well as a possible system-wide cyber-attack in railway operations area 204 of railway system 200. Hub 22 may be configured to undertake a response to an identified possible cyber-attack.

[0048] As in the case of an RBC aggregator 38 which may correlate data received from a plurality of trains in a control area of the aggregator’s RBC 230 to improve reliability of identification of a possible cyber-attack, hub 22 may operate to correlate data received from a plurality of RBC aggregators 38 to improve reliability of an identification of a cyber-attack. For example, as in the case of a malfunction of onboard equipment in a train giving rise to a suspicion of a cyber-attack, malfunction and/or weather conditions may affect operation of wayside equipment and/or an RBC 230 and give rise to an RBC aggregator 38 determining that there is a suspicion of a cyber-attack. By correlating data received from a plurality of RBC aggregators 38 hub 22 may improve reliability of a determination that the suspicion is due to an actual cyber-attack.

[0049] By way of another example, in an embodiment of the disclosure hub 22 may be configured to determine normative geographic and/or temporal patterns for activity of railway system 200 in railway operations area 204 and store the normative patterns in memory 23 of the hub. The hub may compare real time patterns of activity of the railway system based on data that the hub receives in data messages from cyber-snitches and aggregators to normative patterns to determine if a cyber-attack is present. For example, activity of railway system 200 may exhibit normative diurnal, monthly, and/or seasonal patterns of activity and if a real time pattern of activity differs from a normative pattern, hub 22 may determine that the difference indicates presence of a cyber-attack.

[0050] By way of a specific example, normative passenger rail traffic in a given suburban region of a particular RBC control area 231 may be high in the morning as people from the suburban region travel to work in a metropolis in another RBC control area, taper off during late morning and early afternoon and increase again towards evening as people return from work. Normative train speeds and headways in the given suburban region are expected to correlate with the traffic. Train speeds may be expected to be high and headways relatively short during the morning and late afternoon hours to provide capacity advantageous for servicing the heavy passenger traffic. Train speeds are expected to be respectively relatively low and headways long during the late morning and early afternoon hours when traffic is relatively light. If data processed by hub 22 indicates that magnitudes of real time train speeds and/or headways vary from magnitudes of the normative train speeds and headways respectively or are out of phase with passenger traffic load hub 22 may determine that a cyber attack is present.

[0051] In an embodiment, hub 22 comprises a rule-based system for providing an initial classification of received messages. In an embodiment, telegrams classified by the rule-based system may be used to teach a supervised neural network to distinguish anomalous communications that may indicate a cyber-attack on the railway. Subsequent to being taught, the neural network may be used to classify, in real time, communications as normative or anomalous. The database of received messages may be constantly updated with new messages and the updated database periodically used to reteach the neural network. In an embodiment, an unsupervised neural network may be used to process communications in the database and leam to distinguish in real time normative from anomalous messages. The unsupervised neural network may constantly update itself as communications are mirrored to hub 22 and accumulated.

[0052] Fig. 3 schematically shows Rail-Eye 20 monitoring balise integrity in a region 200a, of railway 200 to provide cyber-protection to the region in accordance with an embodiment of the disclosure. The region comprises tracks 202 and is shown having three balise groups BGj, 1< j < 3, which may be referred to generically by the label BG. A balise group BGj has at least one and may conventionally have up to a maximum of eight balises B_j j, 1< i < I , where 1< I < 8. For example, balise group BG _| has six balises B _{| |} .. B _{| v} Cyber snitches 32 copy balise telegrams sent by balises Bj j and send the balise telegrams to hub 22 for processing and vetting for proper operation in real time to determine if communications appear anomalous in view of normative patterns. A train 300 is schematically shown in perspective traveling along a section of track 202.

[0053] A balise or the balise group may be linked or unlinked. A linked balise or balise group has information as to the location of another balise or balise group and transmits the location information to a train when the train passes over the linked balise or balise group. Location of a given linked balise group and locations of balises in the given balise group are referenced to a location of a reference balise, generally a first balise in the given linked balise group. In addition, balises may be fixed or non-fixed. Fixed balises transmit the same data in every telegram they transmit. Non-fixed balises, also referred to as switchable or transparent balises, transmit data that can change dynamically, generally responsive to signaling information. [0054] Inset 30 of Fig. 3 schematically shows an enlarged image of train 300 passing over balise B _{| |} of balise group BG _| and a BTM 314 of the train communicating with balise B \

As previously noted, a balise is passive and requires a charge of energy to send out its telegrams. The balise is charged with energy by the BTM as the train passes over the balise. Once the balise charge reaches a threshold, the balise starts to broadcast a telegram and may broadcast a duplicate of the same telegram a plurality of times. Once the train passes and the balise charge falls below the threshold, the balise stops broadcasting.

[0055] Communications and balise telegrams propagated for example in ERTMS/ETCS systems are based on variables, packets, and messages that are nested, defined, and configured in accordance with specific syntaxes. ERTMS/ETCS variables are used to encode single data values. ERTMS/ETCS packets may include more than one variable and comprise a header that identifies the packet by a unique packet type number, referred to as a NID-Packet. The header may include such administrative variables that may identify a railway, such as a country code, NID C”, a RBC code, “NID RBC”, a train driver code “Driver lD”, a user identity “NID USER”, “Q DIR” which specifies a running direction of a Eurobalise group, and a “Q_SCALE”, which specifies a distance scale that characterizes distance information that may be included in a packet payload. ERTMS/ETCS messages typically group a plurality of ERTMS/ETCS variables and / or packets. As in the case of an ERTMS/ETCS packet, an ERTMS/ETCS message comprises a header that includes an ID number referred to as a NID_MESSAGE, that identifies the type of message, and administrative variables. Administrative variables may include a time, “T TRAIN”, in accordance with a train borne clock, a balise group identity number “NID LRBG”, and/or a track gradient profile.

[0056] Figs. 4A-4C show a flow diagram 500 which illustrates an algorithm, also referred to by the numeral 500, by which Rail-Eye 20 may process balise telegrams to determine if a telegram, such as a telegram transmitted by a balise 218 is anomalous, in accordance with an embodiment of the disclosure.

[0057] Whereas any of various components of Rail-Eye 20, or combinations of the components may execute algorithm 500, in the description that follows, hub 22 is assumed to process balise telegrams generated by balises in railway region 202a. The sequential order of blocks representing actions as shown in algorithm 500 is not compulsory, and the order of the sequence may be different from that shown.

[0058] In a block 501, hub 22 receives copies of telegram TGij from an i-th balise Bij ( 1 £i£I) of balise group (BGj) (l<j<J). Optionally, in a block 503, hub 22 decodes the balise telegram. Balise telegrams are usually sent compressed or encoded to save bandwidth when broadcast and the balise telegram is decoded to be read and/or further analyzed. In a block 505, the hub reads the decoded balise telegram for a selection of variables. Using ETCS numerical ID (NID) packet coding these variables may by way of example comprise country code “NID_Cj” of balise group “j”, “NID BGj” an ID number of balise group j, and position “NID PIGij” in balise group j of balise i which transmitted the telegram TGij. Algorithm 500 optionally continues to a decision block 507 where if the country code is not known or is determined not to match the country in which the balise is known to be located, algorithm 500 continues to a flow junction A connected to a block 540 (Fig. 4C), and in a block 540 determines that the telegram is anomalous and raises an alarm. If the country code is known, the algorithm continues to a block 509 and the hub determines if balise group BGj is known. If the balise group is not known, algorithm 500 continues to junction A which couples to a block 540 (Fig. 4C), and in block 540 determines that the telegram is anomalous and raises an alarm. However, if balise group BGj is known, algorithm 500 continues to a block 511. In block 511, the hub may determine if the position of balise Bi,j in the balise group correct, and if the position of balise Bij in balise group BGj is not correct, algorithm 500 continues to junction A, and in block 540 determines that the telegram is anomalous and raises an alarm. Conversely, if the balise position in the balise group is correct, then the algorithm continues to a block 513.

[0059] In block 513, the hub determines the number of balise telegram duplicates, “NTGij” of the telegram “TGij” that the balise transmitted. The number of duplicates transmitted by a balise for a specific speed of a train is known or determinable by the Rail -Eye. After the hub determines the number of balise telegram duplicates, it further determines if the number of balise telegram duplicates is the correct number of balise telegram duplicates for that balise group and train speed. If it is not the correct number of balise telegram duplicates, the algorithm continues to junction A, and in block 540 determines that the telegram is anomalous and raises an alarm. However, if it is the correct number of duplicates, the process proceeds to a block 515.

[0060] In block 515, the hub analyzes the electromagnetic waveform, “WTGij” of telegram, TGij and determines a feature vector or vectors, referred to as a fingerprint for the waveform. The feature vector of a balise telegram waveform may comprise by way of example values for shape, duration and/or signal to noise ratio that characterizes waveform that may be advantageous in determining whether the waveform and thereby the telegram is normative or anomalous. [0061] In a block 517, (Fig. 4B), the hub classifies waveform fingerprint feature vector, “WTGij” to determine if the waveform is normative or not normative. Any of various classifiers, for example a support vector machine (SVM), or artificial intelligence (AI), may be used to classify a balise waveform feature vector as normative or anomalous. If the waveform is not normative, algorithm 500 continues to junction A, and in block 540 determines that the telegram is anomalous and raises an alarm. If the waveform is normative, the algorithm optionally continues to a block 519. In block 519 the hub reads the balise telegram “Q LINK” field to determine if the balise is linked or unlinked. In accordance with conventional coding if Q LINK equals 0, the balise in unlinked and if Q LINK equals 1 the balise is linked. In a block 521 , the hub may determine if the link status of the balise is correct, and if the link status is not correct, algorithm 500 continues to junction A, and in block 540 determines that the telegram is anomalous and raises an alarm.

[0062] In block 523 the hub optionally determines a location, “Lij” of balise, Bij relative to a reference balise “RBj” of balise group, BGj, based on the train velocity, “Vtr”, the number of copies of balise telegrams “NTGij” transmitted by the balise, and/or times at which the train’s onboard processor determines that the train passes over the balises.

[0063] In block 525, the hub optionally determines distances ALBi’,i,j between balises, Bij and Bi’j optionally for any i ¹ i’)” in balise group, BGj. In a block 527, the hub determines if a distance found in block 525 is normative or not. If the distance found in block 525 is not normative, algorithm 500 continues to junction A, and in block 540 determines that the telegram is anomalous and raises an alarm. On the other hand, if the determined distance is normative, the algorithm optionally continues to a block 529. In block 529, the hub may determine a distance, “ALRBjj”’ between reference balise RBj of balise group BGj and reference balise RBj’ of balise group BGj’ optionally (for any (j ¹j’))”. In a block 531, the hub determines if the distance between the two reference balises is normative. In determining if the distance between reference balises is normative, if one of the balise groups is linked, hub 22 determines whether the distance between the reference balises agrees with linking information in the linked balise group. If not normative, algorithm 500 continues to junction A, and in block 540 determines that the telegram is anomalous and raises an alarm. If the distance is normative, the algorithm continues to a junction C in FIG. 4C.

[0064] Optionally, in a block 533 of FIG. 4C, the balise telegram copies are further analyzed by hub 22 for their format, which may include checking the format of variables, which may be country code “NID Cj” of balise group “j”, “NID BGj” an ID number of balise group j, and position “NID PIGij” in balise group j of balise i which transmitted the telegram TGij . In a block 535, if the formatting of these variables is not normative, algorithm 500 continues to junction A, and in block 540 determines that the telegram is anomalous and raises an alarm, and if the formatting is normative, the algorithm continues to a block 537. Optionally in block 537, packets, “Pi,j,n”, of telegram TGij are read and analyzed by the hub. In a block 539, the hub determines if the packets are normative. If the hub determines that the packets are not normative, the algorithm continues to block 540 determines that the telegram is anomalous and raises an alarm. In a block 541 algorithm 500 optionally returns to block 501 and hub 22 receives copies of a next balise telegram.

[0065] There is therefore provided in accordance with an embodiment of the disclosure a cyber security system for providing security to a railway, the system comprising: a data monitoring and processing hub; and a network comprising a plurality of data collection agents synchronized to a same network clock and configured to monitor railway balises, and/or BTMs comprised in a train, and forward monitored data to the hub for processing to detect anomalies indicative of a cyber-attack; wherein an agent of the plurality of the data collection agents monitoring communications between a balise and a BTM of a train passing over the balise that powers the balise forwards for processing to the hub data based on the communications together with a time stamp comprising a network clock time at which the communications are respectively received by the agent. Optionally, the data based on the communications comprises a copy of a telegram transmitted by the balise to the BTM. Optionally, processing comprises decoding the telegram and determining if data encoded in a selection of data packets comprised in the telegram is expected data.

[0066] The selection of data packets may comprise at least one or any combination of more of a data packet encoding a country code (NID_C) identifying a country in which the balise is located, a balise group identifier (NID BG) identifying a balise group of which the balise is a member , a position of the balise in the balise group (NID PIG); a movement authority that provides a maximum train speed for a region of track in which the balise is located; a gradient profile that provides a slope for the region of track; and/or linking data that provides a distance to a next balise group.

[0067] In an embodiment, the processing comprises determining how many copies of the telegram the balise transmitted to the BTM and determining if the communications indicated a cyber incursion based on the determined number. Optionally, determining if there is an indication of a cyber incursion comprises determining a number of copies of the telegram that the balise is expected to transmit and comparing the expected number to the number of copies the balise actually transmitted to the BTM. Optionally, the cyber security system determines a speed at which the train moves over the balise and determines the expected number of copies based on the speed. Optionally, the cyber security system determines the expected number of copies based on a balise group to which the balise belongs.

[0068] In an embodiment the cyber security system determines a format that formats data in a packet comprised in the telegram and determines if the communications indicate a cyber incursion based on the format.

[0069] In an embodiment the data based on the communications comprises a transmitted electromagnetic waveform that encodes the telegram. Optionally, determining whether there is an indication of a cyber incursion comprises determining a feature vector that characterizes the waveform and determining whether there is an indication of a cyber incursion based on the feature vector. Optionally, the feature vector comprises components having values that characterize at least one or any combination of more than one of the waveform shape, duration, and/or signal to noise ratio.

[0070] Processing may comprise identifying a BTM that powered the balise and determining whether there is an indication of a cyber incursion based on the identity of the BTM. Optionally, determining whether there is an indication of a cyber incursion based on the identity of the BTM comprises determining the feature vector based on the identity of the BTM.

[0071] In an embodiment processing comprises determining a distance between the balise and another balise in the railway and determining if the communications indicate a cyber incursion based on the distance. Optionally, the balise and the other balise belong to a same balise group. Alternatively, the balise and the other balise belong to different balise groups.

[0072] In an embodiment processing comprises determining a difference between a time stamp of the balise and a time stamp of another balise in the railway and determining if the communications indicate a cyber incursion based on the difference. Optionally, the balise and the other balise belong to a same balise group. Alternatively, the balise and the other balise belong to different balise groups.

[0073] In the description and claims of the present application, each of the verbs, “comprise” “include” and “have”, and conjugates thereof, are used to indicate that the object or objects of the verb are not necessarily a complete listing of components, elements or parts of the subject or subjects of the verb. [0074] Descriptions of embodiments of the invention in the present application are provided by way of example and are not intended to limit the scope of the invention. The described embodiments comprise different features, not all of which are required in all embodiments of the invention. Some embodiments utilize only some of the features or possible combinations of the features. Variations of embodiments of the invention that are described, and embodiments of the invention comprising different combinations of features noted in the described embodiments, will occur to persons of the art. The scope of the invention is limited only by the claims.

Claims

1. A cyber security system for providing security to a railway, the system comprising: a data monitoring and processing hub; and a network comprising a plurality of data collection agents synchronized to a same network clock and configured to monitor railway balises, and/or balise transmission modules (BTMs) comprised in a train, and forward monitored data to the hub for processing to detect anomalies indicative of a cyber-attack; wherein an agent of the plurality of the data collection agents monitoring communications between a balise and a BTM of a train passing over the balise that powers the balise forwards for processing to the hub data based on the communications together with a time stamp comprising a network clock time at which the communications are respectively received by the agent.

2. The cyber security system according to claim 1 wherein the data based on the communications comprises a copy of a telegram transmitted by the balise to the BTM.

3. The cyber security system according to claim 2 wherein processing comprises decoding the telegram and determining if data encoded in a selection of data packets comprised in the telegram is expected data.

4. The cyber security system according to claim 3 wherein the selection of data packets comprises at least one or any combination of more of a data packet encoding a country code (NID_C) identifying a country in which the balise is located, a balise group identifier (NID BG) identifying a balise group of which the balise is a member , a position of the balise in the balise group (NID PIG); a movement authority that provides a maximum train speed for a region of track in which the balise is located; a gradient profile that provides a slope for the region of track; and/or linking data that provides a distance to a next balise group.

5. The cyber security system according to any of claims 2-4 wherein processing comprises determining how many copies of the telegram the balise transmitted to the BTM and determining if the communications indicated a cyber incursion based on the determined number.

6. The cyber security system according to claim 5 wherein determining if there is an indication of a cyber incursion comprises determining a number of copies of the telegram that the balise is expected to transmit and comparing the expected number to the number of copies the balise actually transmitted to the BTM.

7. The cyber security system according to claim 6 wherein determining the expected number of copies comprises determining a speed at which the train moves over the balise and determining the expected number of copies based on the speed.

8. The cyber security system according to claim 6 or claim 7 wherein determining the expected number of copies comprises determining a balise group to which the balise belongs and determining the expected number of copies based on the balise group.

9. The cyber security system according to any of claims 2-8 wherein processing comprises determining a format that formats data in a packet comprised in the telegram and determining if the communications indicate a cyber incursion based on the format.

10. The cyber security system according to any of claims 2-9 wherein the data based on the communications comprises a transmitted electromagnetic waveform that encodes the telegram.

11. The cyber security system according to claim 10 wherein processing comprises determining a feature vector that characterizes the waveform and determining whether there is an indication of a cyber incursion based on the feature vector.

12. The cyber security system according to claim 11 wherein the feature vector comprises components having values that characterize at least one or any combination of more than one of the waveform shape, duration, and/or signal to noise ratio.

13. The cyber security system according to claim 11 or claim 12 wherein processing comprises identifying a BTM that powered the balise and determining whether there is an indication of a cyber incursion based on the identity of the BTM.

14. The cyber security system according to claim 13 wherein determining whether there is an indication of a cyber incursion based on the identity of the BTM comprises determining the feature vector based on the identity of the BTM.

15. The cyber security system according to any of the preceding claims wherein processing comprises determining a distance between the balise and another balise in the railway and determining if the communications indicate a cyber incursion based on the distance.

16. The cyber security system according to claim 15 wherein the balise and the other balise belong to a same balise group.

17. The cyber security system according to claim 15 wherein the balise and the other balise belong to different balise groups.

18. The cyber security system according to any of the preceding claims wherein processing comprises determining a difference between a time stamp of the balise and a time stamp of another balise in the railway and determining if the communications indicate a cyber incursion based on the difference.

19. The cyber security system according to claim 18 wherein the balise and the other balise belong to a same balise group.

20. The cyber security system according to claim 18 wherein the balise and the other balise belong to different balise groups.