A Scalable Security Protocol for Intravehicular Controller Area Network

As de facto standards of in-vehicle network communications among various ECUs (Electronic Control Units), CAN (Controller Area Network) protocols invented by Bosch rely on the privately-defined unique identifiers CAN ID in CAN messages which do not convey any destination address. On the other hand, sticking to error handling mechanisms in CAN protocols, an ECU with an amount of transmission errors would enter bus-off state (i.e., go offline thereupon) and shall be recovered according to some prescribed bus-off recovery mode (BOM). All these sensitive CAN knowledge concealed inside an ECU by OEMs (Original Equipment Manufacturers) shall not be revealed and could be found extensive practical applications to both adversarial behavior (e.g., target ECU attacks) and security enhancement mechanisms (e.g., intrusion detection system designs). The paper presents FirmCAN, the first automatic analysis framework to dope out sensitive CAN knowledge (CAN IDs and bus-off recovery mode in particular) compiled in automotive ECU firmwares. FirmCAN first identifies base address (using accurate absolute function entry addresses), and then performs CAN module API positioning and sensitive configuration information resolution. We buckle down to automotive ECUs that resort to fixed-address mailboxes as CAN module transmission buffers (e.g., Renesas SuperH/RA series) and present concrete algorithms for each analysis phase. Our experimental evaluations first investigate firmwares extracted from real automotive ECUs. We then develop our own applications using RA6M4 development boards, which not only produce required firmwares to evaluate FirmCAN, but also create ground truth through hardware debugging. All evaluations demonstrate that FirmCAN can accurately garner above-mentioned sensitive CAN knowledge. FirmCAN can be trivially generalized to engage in extended frames and CAN modules with similar transmission logic, e.g., TI (Texas Instruments), ST (ST Microelectronics), etc.

The controller area network (CAN) protocol is the most widely used in-vehicle network because it provides bounded transmission delay among electronic control units (ECUs) at data rates between 125Kbps and 1Mbps. And, many automotive companies have chosen the CAN protocol for their in-vehicle networking (IVN) system such as chassis network system of intelligent vehicles because of its excellent communication characteristics. However, the increasing number of ECUs and the need for more intelligent functions of advanced driver assistance systems (ADASs) or in-vehicle information systems (IVISs) require a network with more network capacity and real-time quality-of-service (QoS). As one approach to enhancing the network capacity of a CAN system, this paper introduces a CAN system with dual communication channel. And, this paper presents message allocation algorithm that allocates messages to the more appropriate channel using forecast traffic of each channel. An experimental testbed using commercial off-the-shelf microcontrollers with two CAN controllers was used to demonstrate the feasibility of the CAN system with dual communication channel using message allocation algorithm.

Vehicle-IT convergence technology is a rapidly rising paradigm of modern vehicles, in which an electronic control unit (ECU) is used to control the vehicle electrical systems, and the controller area network (CAN), an in-vehicle network, is commonly used to construct an efficient network of ECUs. Unfortunately, security issues have not been treated properly in CAN, although CAN control messages could be life-critical. With the appearance of the connected car environment, in-vehicle networks (e.g., CAN) are now connected to external networks (e.g., 3G/4G mobile networks), enabling an adversary to perform a long-range wireless attack using CAN vulnerabilities. In this paper we show that a long-range wireless attack is physically possible using a real vehicle and malicious smartphone application in a connected car environment. We also propose a security protocol for CAN as a countermeasure designed in accordance with current CAN specifications. We evaluate the feasibility of the proposed security protocol using CANoe software and a DSP-F28335 microcontroller. Our results show that the proposed security protocol is more efficient than existing security protocols with respect to authentication delay and communication load.

Abstract- Modern vehicles use the Electronics Control Unit (ECU) to control and monitor all the activities within the vehicle. The number of ECUs are increasing as the complexity of vehicles increases. All the ECUs present in the vehicles are communicated with each other via CAN protocol. Any malfunction in the ECU or abnormal behaviour of ECU is detected or understood by diagnostic services. CAN Protocol does not have advanced features like Diagnostic. The CAN protocol covers only the Physical and Data link layer of the OSI model. There is a need for a standardised diagnostic protocol which can use CAN as underlying technology. Standardised diagnostic protocols used in the automotive domain are On Board Diagnostics (OBD) and Unified Diagnostic services (UDS). UDS protocol is defined under the ISO 14229 standard and provides a standardized framework for in-vehicle communication and fault diagnosis. This project focuses on the design and implementation of the UDS protocol on an embedded system using STM32F407 microcontrollers. The project involves developing a diagnostic communication system between Electronic Control Units (ECUs) Light Control Module (LCM) and Tester tool connected over a CAN bus. Keywords- Unified Diagnostic Services (UDS), ISO 14229, Electronic Control Unit (ECU), Body Control Module (BCM), Light Control Module (LCM), Controller Area Network (CAN), Diagnostic Trouble Code (DTC), Routine Control Identifier (RID), Data Identifier (DID), ISO-TP (Transport Protocol)

<div class="section abstract"><div class="htmlview paragraph">The amount of data communicated in automotive networks is increasing rapidly, leading to more complex systems alongside the rising number of Electronic Control Units (ECUs) in modern vehicles. As the number of ECUs has risen, Controller Area Network (CAN) communication bandwidth has been pushed to its limit. Existing solutions - such as using multiple CAN buses, sending multiple CAN frames or switching to another protocol - require a significant system-design effort and replacement of hardware and software. This has paved the way for CAN Flexible Data-rate (CAN FD), which extends the CAN standard and permits significantly higher data rates, enabling faster firmware upgrades. However, some changes must be made like: exchange the classical CAN microcontroller with a CAN FD microcontroller and also a CAN FD transceiver must be used.</div><div class="htmlview paragraph">This article will explore the benefits of CAN FD, how it compares with the classical CAN protocol, requirements for systems and how to introduce CAN FD into existing CAN networks.</div></div>

This paper presents a new configuration for in-vehicle networks to increase the reliability of the communication between electronic control units (ECU) and to improve the safety level of a vehicle. Basically, the CAN (Controller Area Network) protocol is assumed for the data communication in vehicles but more reliable communication can be guaranteed by adding the ZigBee communication function to each ECU. To show the validity and the performance of the presented network configuration for some network faults, the Electronic Stability Control (ESC) operation is analyzed by using an ECU-In-the-Loop Simulation (EILS). The experimental set-up for EILS of ESC system consists of two 32-bit microcontroller boards which can be communicated with the CAN or the ZigBee protocol. A 7-DOF (Degrees Of Freedom) vehicle model and ESC algorithm is implemented on each microcontroller. It is shown by the experimental results that ESC using the high reliability CAN system can achieve the same performance as using only CAN protocol without disconnected CAN bus.KeywordsIn-vehicle networkController area networkReliabilityFault toleranceElectronic stability control

Controller Area Network (CAN) is the main bus network that connects electronic control units in automobiles. Although CAN protocols have been revised to improve the vehicle safety, the security weaknesses of CAN have not been fully addressed. Security threats on automobiles might be from external wireless communication or from internal malicious CAN nodes mounted on the CAN bus. Despite of various threat sources, the security weakness of CAN is the root of security problems. Due to the limited computation power and storage capacity on each CAN node, there is a lack of hardware-efficient protection methods for the CAN system without losing the compatibility to CAN protocols. To save the cost and maintain the compatibility, we propose to exploit the built-in CAN fault confinement mechanism to detect the masquerade attacks originated from the malicious CAN devices on the CAN bus. Simulation results show that our method achieves the attack misdetection rate at the order of 10-5 and reduces the encryption latency by up to 68% over the complete frame encryption method.

In order to contrast and analyze the real-time performance of the powertrain system of a plug-in hybrid electric vehicle, a mathematical model of the system delay is established under the circumstances that the transmission adopts the CAN (controller area network) protocol and the TTCAN (time-triggered CAN) protocol, respectively, and the interior of the controller adopts the foreground-background mode and the OSEK mode respectively. In addition, an experimental platform is developed to test communication delays of messages under 4 different implementation models. The 4 models are testing under the CAN protocol while the controller interior adopts the foreground-background mode; testing under the CAN protocol while the controller interior adopts the OSEK mode; testing under the TTCAN protocol while the controller interior adopts the foreground-background mode, and testing under the TTCAN protocol while the controller interior adopts the OSEK mode. The theoretical and testing results indicate that the communication delay of the OSEK mode is a little longer than the one of the foreground-background mode. Moreover, compared with the CAN protocol, the periodic message has a better real-time performance under the TTCAN protocol, while the nonperiodic message has a worse one.

<span lang="EN-US">Real-time communication is important in control network. In real-time communication, message need to be delivered from source to destination within specification. Embedded Ethernet and Controller Area Network (CAN) protocol can be used in control network to achieve hard real-time communication. For embedded Ethernet protocol, Carrier Sense Multiple Access with Collision Detection (CSMA/CD) is the media access control (MAC) used to control data transmission between nodes in network. Back-off algorithm in CSMA/CD is used to handle packet collisions and retransmission. For CAN protocol, it is communication protocol developed mainly for automotive application. It has priority arbitration to handle collisions and retransmission. In this project, embedded Ethernet network models and CAN network models are developed and simulated in MATLAB Simulink software. Several back-off algorithms, which are Binary Exponential Backoff (BEB), Linear Back-off Algorithm, Exponential-Linear back-off Algorithm and Logarithm Back-off Algorithm are proposed and implemented into Embedded Ethernet network model to evaluate the performance. Both embedded Ethernet and CAN network models are extended to 3 nodes, 10 nodes, and 15 nodes to evaluate performance at different network condition. The performance criteria evaluated and discussed are average delay and jitter of packets. The results show that in network with high number of nodes, Linear Back-off Algorithm and Exponential-Linear back-off Algorithm shows improvement in packets delay and jitter. For CAN network, the packet jitter is relatively low.</span>

The introduction of a communication link improves the performance of a distributed generation (DG) system. At present, standard techniques based on RS485, Global Positioning System and Power Line Carrier Communication are used in DG systems for control and coordination. These techniques have many disadvantages related to their cost and the speed of data transfer. The issues associated with the establishment and requirements of a communication link between high-frequency power converters and the possible solutions are addressed in this paper, which proposes to use Controller Area Network (CAN) protocol for establishing the communication between the converters. CAN has the main advantage that it is capable of operating at speeds of up to 1 Mbit/s and can work faithfully under severe test conditions. The paper includes the design of the communication link which assists the control and coordination of the converters. Use of digital signal controllers enables acquisition of voltage and current parameters as well as data transmission to happen in real time. The communication link is designed using the eCAN module available in TMS320F28069 Piccolo series Digital Signal Controller (DSC) from Texas Instruments. The features of CAN protocol offer the advantage that the local slave DSCs can continue to communicate with each other even after the master controller fails. CAN also provides priority based access to the CAN bus and higher baud rates.

The most vehicle manufacturers have been using the CAN (Controller Area Network) in order to communicate among ECUs in vehicle systems for a long time. However, CAN has a disadvantage in that it cannot send and receive large amounts of data quickly due to its limited speed and short data transmission size. The CAN FD (Controller Area Network with Flexible Data rate) was developed to compensate for this disadvantage, and it has the advantage of being able to communicate at more fast speed and eight times the data transmission size compared to CAN. These CAN and CAN FD are vulnerable to message replay attacks because they do not provide data authentication. In this paper, secure communication is implemented by applying CMAC (Cipher based Message Authentication Code) based on CAN and CAN FD. Also, the performance of the two secure communications is compared and analyzed. To implement CMAC, HW-based AES-128 (Advanced Encryption Standard) CBC (Cipher Block Chaining) algorithm is used. This paper compares the performance of Secure CAN and CAN FD communication based on CMAC and can help to check communication traffic of ECU (Electronic Control Unit) in advance when applying the function in the real vehicle system.

In today's world, renewable is the important source and in renewable energy plays vital role. Where wind turbines are placed in remote places and the operation and maintenance services (OMS) are plays key role to getting maximum availability and minimum breakdowns of wind turbine. To minimize the breakdowns in wind turbine, it is important to provide reliable and robust control system. Where communication between controllers plays key role in control system. In wind turbine, the frequency of occurrence of communication failed errors between rotating Hub and stationary Nacelle is causes of increase in breakdown in Wind Turbine. So, to implement W-CAN (Wireless Controller Area Network), where the CAN protocol gives reliable and robust communication between pitch controllers in HUB and Wireless Bluetooth over CAN protocol provide communication between Rotating hub and stationary nacelle which minimizes the communication failed errors. This system is implemented by using LPC1769, FreeRTOS, CAN (Controller Area Network), Bluetooth Protocol, LwIP (Light Weight Internet Protocol) Protocol and Motors. Today real-time communication is one of the key features in distributed embedded control systems. Using FreeRTOS, control system performance will be improved. FreeRTOS comprises CAN & LwIP protocol stack which transfer real time data from hub microcontroller node to nacelle microcontroller node. The Sensor acts as input source to this hub node and microcontroller nodes in compliance of FreeRTOS that includes the Real Time CAN driver which is used for secured and robust data transfer. Real-Time LwIP protocol stack is implemented on top of FreeRTOS to transfer the data to supervisory control and data acquisition (SCADA) System Application on Host PC. In this system, based on LwIP stack the data will be transferred from Turbine nacelle microcontroller Node to the PC Host SCADA application. SCADA application is used for data monitoring and controlling the operation. Hence with the help of this proposed system data acquisition and control of distributed embedded applications will be improved.

As connectivity between and within vehicles increases, so does concern about safety and security. Various automotive serial protocols are used inside vehicles such as Controller Area Network (CAN), Local Interconnect Network (LIN), and FlexRay. CAN Bus is the most used in-vehicle network protocol to support exchange of vehicle parameters between Electronic Control Units (ECUs). This protocol lacks security mechanisms by design and is therefore vulnerable to various attacks. Furthermore, connectivity of vehicles has made the CAN Bus vulnerable not only from within the vehicle but also from outside. With the rise of connected cars, more entry points and interfaces have been introduced on board vehicles, thereby also leading to a wider potential attack surface. Existing security mechanisms focus on the use of encryption, authentication, and vehicle Intrusion Detection Systems (IDS), which operate under various constraints such as low bandwidth, small frame size (e.g., in the CAN protocol), limited availability of computational resources, and real-time sensitivity. We survey and classify current cryptographic and IDS approaches and compare these approaches based on criteria such as real-time constraints, types of hardware used, changes in CAN Bus behaviour, types of attack mitigation, and software/ hardware used to validate these approaches. We conclude with mitigation strategies limitations and research challenges for the future.

Controller area network (CAN) data-reduction techniques have been developed to reduce CAN bus loads, which have increased due to the large number of electronic control units in modern automobiles. Automotive communication uses various in-vehicle network. These techniques make it possible that same information to be sent using less bandwidth. However, the existing CAN DR algorithms only consider the CAN network. Automotive communication uses various in-vehicle network (IVN) protocols such as CAN, FlexRay, and Ethernet. The use of DR techniques may cause compatibility issue in heterogenous IVNs. This paper proposes a gateway system for data-reduced communication between Ethernet and CAN systems with data-reduction. The proposed gateway system receives a compressed CAN message, decompresses it, and transmits it to the Ethernet network. Additionally, the gateway receives a normal Ethernet message, compresses it, and transmits it to the CAN protocol. An evaluation of the performance of the developed gateway system is also presented.

Controller Area Network (CAN) is an in-vehicle communication protocol which provides an efficient and reliable communication link between Electronic Control Units (ECUs) in real-time. Recent studies have shown that attackers can take remote control of the targeted car by exploiting the vulnerabilities of the CAN protocol. Motivated by this fact, we propose Clock Offset-based Intrusion Detection System (COIDS) to monitor in-vehicle network and detect any intrusion. Precisely, we first measure and then exploit the clock offset of transmitter ECU's clock for fingerprinting ECU. We next leverage the derived fingerprints to construct a baseline of ECU's normal clock behaviour using an active learning technique. Based on the baseline of normal behaviour, we use Cumulative Sum method to detect any abnormal deviation in clock offset. Particularly, if the deviation in clock offset exceeds an unexpected positive or negative value, COIDS declares this change as an intrusion. Further, we use sequential change-point detection technique to determine the exact time of intrusion. We perform exhaustive experiments on real-world publicly available datasets primarily to assess the effectiveness of COIDS against three most potential attacks on CAN, i.e., DoS, impersonation and fuzzy attacks. The results show that COIDS is highly effective in defending all these three attacks. Further, the results show that COIDS considerably faster in detecting intrusion compared to a state-of-the-art solution.