A Practical Wireless Attack on the Connected Car and Security Protocol for In-Vehicle CAN

The controller area network (CAN) protocol is the most widely used in-vehicle network because it provides bounded transmission delay among electronic control units (ECUs) at data rates between 125Kbps and 1Mbps. And, many automotive companies have chosen the CAN protocol for their in-vehicle networking (IVN) system such as chassis network system of intelligent vehicles because of its excellent communication characteristics. However, the increasing number of ECUs and the need for more intelligent functions of advanced driver assistance systems (ADASs) or in-vehicle information systems (IVISs) require a network with more network capacity and real-time quality-of-service (QoS). As one approach to enhancing the network capacity of a CAN system, this paper introduces a CAN system with dual communication channel. And, this paper presents message allocation algorithm that allocates messages to the more appropriate channel using forecast traffic of each channel. An experimental testbed using commercial off-the-shelf microcontrollers with two CAN controllers was used to demonstrate the feasibility of the CAN system with dual communication channel using message allocation algorithm.

As de facto standards of in-vehicle network communications among various ECUs (Electronic Control Units), CAN (Controller Area Network) protocols invented by Bosch rely on the privately-defined unique identifiers CAN ID in CAN messages which do not convey any destination address. On the other hand, sticking to error handling mechanisms in CAN protocols, an ECU with an amount of transmission errors would enter bus-off state (i.e., go offline thereupon) and shall be recovered according to some prescribed bus-off recovery mode (BOM). All these sensitive CAN knowledge concealed inside an ECU by OEMs (Original Equipment Manufacturers) shall not be revealed and could be found extensive practical applications to both adversarial behavior (e.g., target ECU attacks) and security enhancement mechanisms (e.g., intrusion detection system designs). The paper presents FirmCAN, the first automatic analysis framework to dope out sensitive CAN knowledge (CAN IDs and bus-off recovery mode in particular) compiled in automotive ECU firmwares. FirmCAN first identifies base address (using accurate absolute function entry addresses), and then performs CAN module API positioning and sensitive configuration information resolution. We buckle down to automotive ECUs that resort to fixed-address mailboxes as CAN module transmission buffers (e.g., Renesas SuperH/RA series) and present concrete algorithms for each analysis phase. Our experimental evaluations first investigate firmwares extracted from real automotive ECUs. We then develop our own applications using RA6M4 development boards, which not only produce required firmwares to evaluate FirmCAN, but also create ground truth through hardware debugging. All evaluations demonstrate that FirmCAN can accurately garner above-mentioned sensitive CAN knowledge. FirmCAN can be trivially generalized to engage in extended frames and CAN modules with similar transmission logic, e.g., TI (Texas Instruments), ST (ST Microelectronics), etc.

This paper presents a new configuration for in-vehicle networks to increase the reliability of the communication between electronic control units (ECU) and to improve the safety level of a vehicle. Basically, the CAN (Controller Area Network) protocol is assumed for the data communication in vehicles but more reliable communication can be guaranteed by adding the ZigBee communication function to each ECU. To show the validity and the performance of the presented network configuration for some network faults, the Electronic Stability Control (ESC) operation is analyzed by using an ECU-In-the-Loop Simulation (EILS). The experimental set-up for EILS of ESC system consists of two 32-bit microcontroller boards which can be communicated with the CAN or the ZigBee protocol. A 7-DOF (Degrees Of Freedom) vehicle model and ESC algorithm is implemented on each microcontroller. It is shown by the experimental results that ESC using the high reliability CAN system can achieve the same performance as using only CAN protocol without disconnected CAN bus.KeywordsIn-vehicle networkController area networkReliabilityFault toleranceElectronic stability control

In order to contrast and analyze the real-time performance of the powertrain system of a plug-in hybrid electric vehicle, a mathematical model of the system delay is established under the circumstances that the transmission adopts the CAN (controller area network) protocol and the TTCAN (time-triggered CAN) protocol, respectively, and the interior of the controller adopts the foreground-background mode and the OSEK mode respectively. In addition, an experimental platform is developed to test communication delays of messages under 4 different implementation models. The 4 models are testing under the CAN protocol while the controller interior adopts the foreground-background mode; testing under the CAN protocol while the controller interior adopts the OSEK mode; testing under the TTCAN protocol while the controller interior adopts the foreground-background mode, and testing under the TTCAN protocol while the controller interior adopts the OSEK mode. The theoretical and testing results indicate that the communication delay of the OSEK mode is a little longer than the one of the foreground-background mode. Moreover, compared with the CAN protocol, the periodic message has a better real-time performance under the TTCAN protocol, while the nonperiodic message has a worse one.

Abstract- Modern vehicles use the Electronics Control Unit (ECU) to control and monitor all the activities within the vehicle. The number of ECUs are increasing as the complexity of vehicles increases. All the ECUs present in the vehicles are communicated with each other via CAN protocol. Any malfunction in the ECU or abnormal behaviour of ECU is detected or understood by diagnostic services. CAN Protocol does not have advanced features like Diagnostic. The CAN protocol covers only the Physical and Data link layer of the OSI model. There is a need for a standardised diagnostic protocol which can use CAN as underlying technology. Standardised diagnostic protocols used in the automotive domain are On Board Diagnostics (OBD) and Unified Diagnostic services (UDS). UDS protocol is defined under the ISO 14229 standard and provides a standardized framework for in-vehicle communication and fault diagnosis. This project focuses on the design and implementation of the UDS protocol on an embedded system using STM32F407 microcontrollers. The project involves developing a diagnostic communication system between Electronic Control Units (ECUs) Light Control Module (LCM) and Tester tool connected over a CAN bus. Keywords- Unified Diagnostic Services (UDS), ISO 14229, Electronic Control Unit (ECU), Body Control Module (BCM), Light Control Module (LCM), Controller Area Network (CAN), Diagnostic Trouble Code (DTC), Routine Control Identifier (RID), Data Identifier (DID), ISO-TP (Transport Protocol)

In today's world, renewable is the important source and in renewable energy plays vital role. Where wind turbines are placed in remote places and the operation and maintenance services (OMS) are plays key role to getting maximum availability and minimum breakdowns of wind turbine. To minimize the breakdowns in wind turbine, it is important to provide reliable and robust control system. Where communication between controllers plays key role in control system. In wind turbine, the frequency of occurrence of communication failed errors between rotating Hub and stationary Nacelle is causes of increase in breakdown in Wind Turbine. So, to implement W-CAN (Wireless Controller Area Network), where the CAN protocol gives reliable and robust communication between pitch controllers in HUB and Wireless Bluetooth over CAN protocol provide communication between Rotating hub and stationary nacelle which minimizes the communication failed errors. This system is implemented by using LPC1769, FreeRTOS, CAN (Controller Area Network), Bluetooth Protocol, LwIP (Light Weight Internet Protocol) Protocol and Motors. Today real-time communication is one of the key features in distributed embedded control systems. Using FreeRTOS, control system performance will be improved. FreeRTOS comprises CAN & LwIP protocol stack which transfer real time data from hub microcontroller node to nacelle microcontroller node. The Sensor acts as input source to this hub node and microcontroller nodes in compliance of FreeRTOS that includes the Real Time CAN driver which is used for secured and robust data transfer. Real-Time LwIP protocol stack is implemented on top of FreeRTOS to transfer the data to supervisory control and data acquisition (SCADA) System Application on Host PC. In this system, based on LwIP stack the data will be transferred from Turbine nacelle microcontroller Node to the PC Host SCADA application. SCADA application is used for data monitoring and controlling the operation. Hence with the help of this proposed system data acquisition and control of distributed embedded applications will be improved.

The existing response-time analysis for messages in Controller Area Network (CAN) with CAN controllers facilitating transmission abort requests in transmission buffers does not support mixed messages. The existing analysis assumes that a message is queued for transmission either periodically or sporadically. However, a message can also be queued both periodically and sporadically using a mixed transmission mode implemented by several high-level protocols for CAN used in the industry today. We extend the existing analysis for mixed messages in CAN which is generally applicable to any high-level protocol that uses periodic, sporadic and mixed transmission modes and supports transmission abort requests in CAN controllers.

Controller area network (CAN) data-reduction techniques have been developed to reduce CAN bus loads, which have increased due to the large number of electronic control units in modern automobiles. Automotive communication uses various in-vehicle network. These techniques make it possible that same information to be sent using less bandwidth. However, the existing CAN DR algorithms only consider the CAN network. Automotive communication uses various in-vehicle network (IVN) protocols such as CAN, FlexRay, and Ethernet. The use of DR techniques may cause compatibility issue in heterogenous IVNs. This paper proposes a gateway system for data-reduced communication between Ethernet and CAN systems with data-reduction. The proposed gateway system receives a compressed CAN message, decompresses it, and transmits it to the Ethernet network. Additionally, the gateway receives a normal Ethernet message, compresses it, and transmits it to the CAN protocol. An evaluation of the performance of the developed gateway system is also presented.

As connectivity between and within vehicles increases, so does concern about safety and security. Various automotive serial protocols are used inside vehicles such as Controller Area Network (CAN), Local Interconnect Network (LIN), and FlexRay. CAN Bus is the most used in-vehicle network protocol to support exchange of vehicle parameters between Electronic Control Units (ECUs). This protocol lacks security mechanisms by design and is therefore vulnerable to various attacks. Furthermore, connectivity of vehicles has made the CAN Bus vulnerable not only from within the vehicle but also from outside. With the rise of connected cars, more entry points and interfaces have been introduced on board vehicles, thereby also leading to a wider potential attack surface. Existing security mechanisms focus on the use of encryption, authentication, and vehicle Intrusion Detection Systems (IDS), which operate under various constraints such as low bandwidth, small frame size (e.g., in the CAN protocol), limited availability of computational resources, and real-time sensitivity. We survey and classify current cryptographic and IDS approaches and compare these approaches based on criteria such as real-time constraints, types of hardware used, changes in CAN Bus behaviour, types of attack mitigation, and software/ hardware used to validate these approaches. We conclude with mitigation strategies limitations and research challenges for the future.

<div class="section abstract"><div class="htmlview paragraph">The amount of data communicated in automotive networks is increasing rapidly, leading to more complex systems alongside the rising number of Electronic Control Units (ECUs) in modern vehicles. As the number of ECUs has risen, Controller Area Network (CAN) communication bandwidth has been pushed to its limit. Existing solutions - such as using multiple CAN buses, sending multiple CAN frames or switching to another protocol - require a significant system-design effort and replacement of hardware and software. This has paved the way for CAN Flexible Data-rate (CAN FD), which extends the CAN standard and permits significantly higher data rates, enabling faster firmware upgrades. However, some changes must be made like: exchange the classical CAN microcontroller with a CAN FD microcontroller and also a CAN FD transceiver must be used.</div><div class="htmlview paragraph">This article will explore the benefits of CAN FD, how it compares with the classical CAN protocol, requirements for systems and how to introduce CAN FD into existing CAN networks.</div></div>

<span lang="EN-US">Real-time communication is important in control network. In real-time communication, message need to be delivered from source to destination within specification. Embedded Ethernet and Controller Area Network (CAN) protocol can be used in control network to achieve hard real-time communication. For embedded Ethernet protocol, Carrier Sense Multiple Access with Collision Detection (CSMA/CD) is the media access control (MAC) used to control data transmission between nodes in network. Back-off algorithm in CSMA/CD is used to handle packet collisions and retransmission. For CAN protocol, it is communication protocol developed mainly for automotive application. It has priority arbitration to handle collisions and retransmission. In this project, embedded Ethernet network models and CAN network models are developed and simulated in MATLAB Simulink software. Several back-off algorithms, which are Binary Exponential Backoff (BEB), Linear Back-off Algorithm, Exponential-Linear back-off Algorithm and Logarithm Back-off Algorithm are proposed and implemented into Embedded Ethernet network model to evaluate the performance. Both embedded Ethernet and CAN network models are extended to 3 nodes, 10 nodes, and 15 nodes to evaluate performance at different network condition. The performance criteria evaluated and discussed are average delay and jitter of packets. The results show that in network with high number of nodes, Linear Back-off Algorithm and Exponential-Linear back-off Algorithm shows improvement in packets delay and jitter. For CAN network, the packet jitter is relatively low.</span>

The introduction of a communication link improves the performance of a distributed generation (DG) system. At present, standard techniques based on RS485, Global Positioning System and Power Line Carrier Communication are used in DG systems for control and coordination. These techniques have many disadvantages related to their cost and the speed of data transfer. The issues associated with the establishment and requirements of a communication link between high-frequency power converters and the possible solutions are addressed in this paper, which proposes to use Controller Area Network (CAN) protocol for establishing the communication between the converters. CAN has the main advantage that it is capable of operating at speeds of up to 1 Mbit/s and can work faithfully under severe test conditions. The paper includes the design of the communication link which assists the control and coordination of the converters. Use of digital signal controllers enables acquisition of voltage and current parameters as well as data transmission to happen in real time. The communication link is designed using the eCAN module available in TMS320F28069 Piccolo series Digital Signal Controller (DSC) from Texas Instruments. The features of CAN protocol offer the advantage that the local slave DSCs can continue to communicate with each other even after the master controller fails. CAN also provides priority based access to the CAN bus and higher baud rates.

Controller Area Network (CAN) is the main bus network that connects electronic control units in automobiles. Although CAN protocols have been revised to improve the vehicle safety, the security weaknesses of CAN have not been fully addressed. Security threats on automobiles might be from external wireless communication or from internal malicious CAN nodes mounted on the CAN bus. Despite of various threat sources, the security weakness of CAN is the root of security problems. Due to the limited computation power and storage capacity on each CAN node, there is a lack of hardware-efficient protection methods for the CAN system without losing the compatibility to CAN protocols. To save the cost and maintain the compatibility, we propose to exploit the built-in CAN fault confinement mechanism to detect the masquerade attacks originated from the malicious CAN devices on the CAN bus. Simulation results show that our method achieves the attack misdetection rate at the order of 10-5 and reduces the encryption latency by up to 68% over the complete frame encryption method.

Automobiles gradually favors computers on wheels-complete with various advance safety facilities such as emergency brake assist, safety belts, airbags, Tire-pressure monitoring, etc. Internally automobiles consist of 70 and above Electronic Control Units (ECUs), which communicate with each other using in-vehicle network example- Controller Area Network (CAN). The real time communication between the ECUs via CAN protocol is responsible for supervising safety related issues of car such as an automatic braking system, etc. There is no source ECU authentication in this protocol which leads to various security concerns because safety is futile without security. Security of the car can be compromised by connecting malicious ECU in CAN. Malicious ECU ejecting malign commands can threaten the functioning of steering, brakes, airbags, windows, headlights, etc. This gives rise to safety concern of people in and around the car. To avoid this, we propose a system, which authenticate the ECUs before allowing them to perform any function. The proposed authentication system consists of Physical Unclonable Function (PUF) and BCH. PUF known for its physical and mathematical unclonability is used to provide a unique signature to the system. On giving a challenge for n times it generates n random response, having closeness within them. This closeness is validated by calculating their hamming distance. The response of PUF is prone to noise, hence to remove these noises proposed approach uses BCH. For a challenge, the noise free response being generated is measured for closeness using hamming distance. If the closeness measured is enough, then the ECU is authentic, else it is suspected as malign.

The Controller Area Network (CAN) is the most common network system in automotive systems. However, the standardized design of a CAN protocol does not consider security issues, so it is vulnerable to various security attacks from internal and external electronic devices. Recently, in-vehicle network is often connected to external network systems, including the Internet, and can result in an unwarranted third-party application becoming an attack point. Message Authentication CAN (MAuth-CAN) is a new centralized authentication for CAN system, where two dual-CAN controllers are utilized to process message authentication. MAuth-CAN is designed to provide an authentication mechanism as well as provide resilience to a message flooding attack and sustainably protect against a bus-off attack. This paper presents formal techniques to guarantee critical timing properties of MAuth-CAN, based on model checking, which can be also used for safety certificates of vehicle components, such as ISO 26262. Using model checking, we prove sufficient conditions that MAuth-CAN is resilient and sustainable against message flooding and bus-off attacks and provide two formal models of MAuth-CAN in timed automata that are applicable for formal analysis of other applications running on CAN bus. In addition, we discuss that the results of model checking of those properties are consistent with the experiment results of MAuth-CAN implementation.