CANASTA: Controller Area Network Authentication Schedulability Timing Analysis

<div class="section abstract"><div class="htmlview paragraph">The amount of data communicated in automotive networks is increasing rapidly, leading to more complex systems alongside the rising number of Electronic Control Units (ECUs) in modern vehicles. As the number of ECUs has risen, Controller Area Network (CAN) communication bandwidth has been pushed to its limit. Existing solutions - such as using multiple CAN buses, sending multiple CAN frames or switching to another protocol - require a significant system-design effort and replacement of hardware and software. This has paved the way for CAN Flexible Data-rate (CAN FD), which extends the CAN standard and permits significantly higher data rates, enabling faster firmware upgrades. However, some changes must be made like: exchange the classical CAN microcontroller with a CAN FD microcontroller and also a CAN FD transceiver must be used.</div><div class="htmlview paragraph">This article will explore the benefits of CAN FD, how it compares with the classical CAN protocol, requirements for systems and how to introduce CAN FD into existing CAN networks.</div></div>

The most vehicle manufacturers have been using the CAN (Controller Area Network) in order to communicate among ECUs in vehicle systems for a long time. However, CAN has a disadvantage in that it cannot send and receive large amounts of data quickly due to its limited speed and short data transmission size. The CAN FD (Controller Area Network with Flexible Data rate) was developed to compensate for this disadvantage, and it has the advantage of being able to communicate at more fast speed and eight times the data transmission size compared to CAN. These CAN and CAN FD are vulnerable to message replay attacks because they do not provide data authentication. In this paper, secure communication is implemented by applying CMAC (Cipher based Message Authentication Code) based on CAN and CAN FD. Also, the performance of the two secure communications is compared and analyzed. To implement CMAC, HW-based AES-128 (Advanced Encryption Standard) CBC (Cipher Block Chaining) algorithm is used. This paper compares the performance of Secure CAN and CAN FD communication based on CMAC and can help to check communication traffic of ECU (Electronic Control Unit) in advance when applying the function in the real vehicle system.

Vehicle-IT convergence technology is a rapidly rising paradigm of modern vehicles, in which an electronic control unit (ECU) is used to control the vehicle electrical systems, and the controller area network (CAN), an in-vehicle network, is commonly used to construct an efficient network of ECUs. Unfortunately, security issues have not been treated properly in CAN, although CAN control messages could be life-critical. With the appearance of the connected car environment, in-vehicle networks (e.g., CAN) are now connected to external networks (e.g., 3G/4G mobile networks), enabling an adversary to perform a long-range wireless attack using CAN vulnerabilities. In this paper we show that a long-range wireless attack is physically possible using a real vehicle and malicious smartphone application in a connected car environment. We also propose a security protocol for CAN as a countermeasure designed in accordance with current CAN specifications. We evaluate the feasibility of the proposed security protocol using CANoe software and a DSP-F28335 microcontroller. Our results show that the proposed security protocol is more efficient than existing security protocols with respect to authentication delay and communication load.

The controller area network (CAN) protocol is the most widely used in-vehicle network because it provides bounded transmission delay among electronic control units (ECUs) at data rates between 125Kbps and 1Mbps. And, many automotive companies have chosen the CAN protocol for their in-vehicle networking (IVN) system such as chassis network system of intelligent vehicles because of its excellent communication characteristics. However, the increasing number of ECUs and the need for more intelligent functions of advanced driver assistance systems (ADASs) or in-vehicle information systems (IVISs) require a network with more network capacity and real-time quality-of-service (QoS). As one approach to enhancing the network capacity of a CAN system, this paper introduces a CAN system with dual communication channel. And, this paper presents message allocation algorithm that allocates messages to the more appropriate channel using forecast traffic of each channel. An experimental testbed using commercial off-the-shelf microcontrollers with two CAN controllers was used to demonstrate the feasibility of the CAN system with dual communication channel using message allocation algorithm.

Modern cars are equipped with a wide variety of sensors generating continually growing amounts of data. This data is transmitted via bus systems such as Controller Area Network (CAN) inside of the vehicle to the microcontroller-based Electronic Control Units. By connecting the vehicle to its surroundings using wireless interfaces, this data becomes accessible to the vehicle manufacturer from a distance. Through the opening to the outside, cyber attacks can exploit these interfaces and introduce major risks to the privacy and safety of vehicle users. Hence, suitable methods for vehicle security monitoring such as intrusion detection and logging are needed. In this work, we focus on the logging of network data, since this data is useful for the development of security updates, countermeasures and incident signatures. On this account, we propose a new method to aggregate the data of the CAN bus. The method combines CAN frames into so-called flows. Each flow contains a set of packets that share a certain common attribute (e.g.: frame type and identifier). To integrate security monitoring of vehicle fleets seamlessly into backend server systems, the gathered CAN flow data is stored in an industry standard data format. Additionally, the payload data is included in the flow format using a compression algorithm to leverage deep-packet inspection. The evaluation results with realworld vehicle data indicate that in our case about 40 % reduction of the overall data size is possible with our method compared to industry-standard formats for storing CAN frames. On this account, we propose a new method to aggregate the data of the CAN bus. The method combines CAN frames into so-called flows. Each flow contains a set of packets that share a certain common attribute (e.g.: frame type and identifier). To integrate security monitoring of vehicle fleets seamlessly into backend server systems, the gathered CAN flow data is stored in an industry standard data format. Additionally, the payload data is included in the flow format using a compression algorithm to leverage deep-packet inspection. The evaluation results with realworld vehicle data indicate that in our case about 40 % reduction of the overall data size is possible with our method compared to industry-standard formats for storing CAN frames.

As de facto standards of in-vehicle network communications among various ECUs (Electronic Control Units), CAN (Controller Area Network) protocols invented by Bosch rely on the privately-defined unique identifiers CAN ID in CAN messages which do not convey any destination address. On the other hand, sticking to error handling mechanisms in CAN protocols, an ECU with an amount of transmission errors would enter bus-off state (i.e., go offline thereupon) and shall be recovered according to some prescribed bus-off recovery mode (BOM). All these sensitive CAN knowledge concealed inside an ECU by OEMs (Original Equipment Manufacturers) shall not be revealed and could be found extensive practical applications to both adversarial behavior (e.g., target ECU attacks) and security enhancement mechanisms (e.g., intrusion detection system designs). The paper presents FirmCAN, the first automatic analysis framework to dope out sensitive CAN knowledge (CAN IDs and bus-off recovery mode in particular) compiled in automotive ECU firmwares. FirmCAN first identifies base address (using accurate absolute function entry addresses), and then performs CAN module API positioning and sensitive configuration information resolution. We buckle down to automotive ECUs that resort to fixed-address mailboxes as CAN module transmission buffers (e.g., Renesas SuperH/RA series) and present concrete algorithms for each analysis phase. Our experimental evaluations first investigate firmwares extracted from real automotive ECUs. We then develop our own applications using RA6M4 development boards, which not only produce required firmwares to evaluate FirmCAN, but also create ground truth through hardware debugging. All evaluations demonstrate that FirmCAN can accurately garner above-mentioned sensitive CAN knowledge. FirmCAN can be trivially generalized to engage in extended frames and CAN modules with similar transmission logic, e.g., TI (Texas Instruments), ST (ST Microelectronics), etc.

Reducing message-length variations in resource-constrained embedded systems implemented using the Controller Area Network (CAN) protocol

To realize the optimized design of the automotive cyber-physical system, it is required to consider the interplay between the communication and computation. However, the existing research about the design of the controller area network (CAN) with flexible data rate (CAN FD) ignores this, it only considers the minimization of the bandwidth utilization and neglects the fact that it would trigger too many unnecessary message receiving interrupts (MRIs) on message receiving electronic control units. To address this problem, this article formulates a tradeoff problem that balances the bandwidth utilization and the number of unnecessary MRIs during the design of the CAN FD. We first propose an algorithm to analyze the number of unnecessary MRIs triggered by the packed messages, and then, two heuristic algorithms, namely, the Top-Down approach and the Hybrid approach, are proposed to resolve the tradeoff problem for midsized and large signal sets, respectively. The experiment results show that compared with the state-of-the-art algorithm, the Top-Down approach reduces the unnecessary MRIs by 10.48%-99.89% with only 0.02%-1.32% bandwidth utilization overhead, the Hybrid approach reduces the unnecessary MRIs by 23.15%-99.63% with only 0.13%-2.07% bandwidth utilization overhead.

Controller area network (CAN) data-reduction techniques have been developed to reduce CAN bus loads, which have increased due to the large number of electronic control units in modern automobiles. Automotive communication uses various in-vehicle network. These techniques make it possible that same information to be sent using less bandwidth. However, the existing CAN DR algorithms only consider the CAN network. Automotive communication uses various in-vehicle network (IVN) protocols such as CAN, FlexRay, and Ethernet. The use of DR techniques may cause compatibility issue in heterogenous IVNs. This paper proposes a gateway system for data-reduced communication between Ethernet and CAN systems with data-reduction. The proposed gateway system receives a compressed CAN message, decompresses it, and transmits it to the Ethernet network. Additionally, the gateway receives a normal Ethernet message, compresses it, and transmits it to the CAN protocol. An evaluation of the performance of the developed gateway system is also presented.

In order to contrast and analyze the real-time performance of the powertrain system of a plug-in hybrid electric vehicle, a mathematical model of the system delay is established under the circumstances that the transmission adopts the CAN (controller area network) protocol and the TTCAN (time-triggered CAN) protocol, respectively, and the interior of the controller adopts the foreground-background mode and the OSEK mode respectively. In addition, an experimental platform is developed to test communication delays of messages under 4 different implementation models. The 4 models are testing under the CAN protocol while the controller interior adopts the foreground-background mode; testing under the CAN protocol while the controller interior adopts the OSEK mode; testing under the TTCAN protocol while the controller interior adopts the foreground-background mode, and testing under the TTCAN protocol while the controller interior adopts the OSEK mode. The theoretical and testing results indicate that the communication delay of the OSEK mode is a little longer than the one of the foreground-background mode. Moreover, compared with the CAN protocol, the periodic message has a better real-time performance under the TTCAN protocol, while the nonperiodic message has a worse one.

This paper presents a new configuration for in-vehicle networks to increase the reliability of the communication between electronic control units (ECU) and to improve the safety level of a vehicle. Basically, the CAN (Controller Area Network) protocol is assumed for the data communication in vehicles but more reliable communication can be guaranteed by adding the ZigBee communication function to each ECU. To show the validity and the performance of the presented network configuration for some network faults, the Electronic Stability Control (ESC) operation is analyzed by using an ECU-In-the-Loop Simulation (EILS). The experimental set-up for EILS of ESC system consists of two 32-bit microcontroller boards which can be communicated with the CAN or the ZigBee protocol. A 7-DOF (Degrees Of Freedom) vehicle model and ESC algorithm is implemented on each microcontroller. It is shown by the experimental results that ESC using the high reliability CAN system can achieve the same performance as using only CAN protocol without disconnected CAN bus.KeywordsIn-vehicle networkController area networkReliabilityFault toleranceElectronic stability control

<span lang="EN-US">Real-time communication is important in control network. In real-time communication, message need to be delivered from source to destination within specification. Embedded Ethernet and Controller Area Network (CAN) protocol can be used in control network to achieve hard real-time communication. For embedded Ethernet protocol, Carrier Sense Multiple Access with Collision Detection (CSMA/CD) is the media access control (MAC) used to control data transmission between nodes in network. Back-off algorithm in CSMA/CD is used to handle packet collisions and retransmission. For CAN protocol, it is communication protocol developed mainly for automotive application. It has priority arbitration to handle collisions and retransmission. In this project, embedded Ethernet network models and CAN network models are developed and simulated in MATLAB Simulink software. Several back-off algorithms, which are Binary Exponential Backoff (BEB), Linear Back-off Algorithm, Exponential-Linear back-off Algorithm and Logarithm Back-off Algorithm are proposed and implemented into Embedded Ethernet network model to evaluate the performance. Both embedded Ethernet and CAN network models are extended to 3 nodes, 10 nodes, and 15 nodes to evaluate performance at different network condition. The performance criteria evaluated and discussed are average delay and jitter of packets. The results show that in network with high number of nodes, Linear Back-off Algorithm and Exponential-Linear back-off Algorithm shows improvement in packets delay and jitter. For CAN network, the packet jitter is relatively low.</span>

Abstract- Modern vehicles use the Electronics Control Unit (ECU) to control and monitor all the activities within the vehicle. The number of ECUs are increasing as the complexity of vehicles increases. All the ECUs present in the vehicles are communicated with each other via CAN protocol. Any malfunction in the ECU or abnormal behaviour of ECU is detected or understood by diagnostic services. CAN Protocol does not have advanced features like Diagnostic. The CAN protocol covers only the Physical and Data link layer of the OSI model. There is a need for a standardised diagnostic protocol which can use CAN as underlying technology. Standardised diagnostic protocols used in the automotive domain are On Board Diagnostics (OBD) and Unified Diagnostic services (UDS). UDS protocol is defined under the ISO 14229 standard and provides a standardized framework for in-vehicle communication and fault diagnosis. This project focuses on the design and implementation of the UDS protocol on an embedded system using STM32F407 microcontrollers. The project involves developing a diagnostic communication system between Electronic Control Units (ECUs) Light Control Module (LCM) and Tester tool connected over a CAN bus. Keywords- Unified Diagnostic Services (UDS), ISO 14229, Electronic Control Unit (ECU), Body Control Module (BCM), Light Control Module (LCM), Controller Area Network (CAN), Diagnostic Trouble Code (DTC), Routine Control Identifier (RID), Data Identifier (DID), ISO-TP (Transport Protocol)

Controller Area Network (CAN) is the main bus network that connects electronic control units in automobiles. Although CAN protocols have been revised to improve the vehicle safety, the security weaknesses of CAN have not been fully addressed. Security threats on automobiles might be from external wireless communication or from internal malicious CAN nodes mounted on the CAN bus. Despite of various threat sources, the security weakness of CAN is the root of security problems. Due to the limited computation power and storage capacity on each CAN node, there is a lack of hardware-efficient protection methods for the CAN system without losing the compatibility to CAN protocols. To save the cost and maintain the compatibility, we propose to exploit the built-in CAN fault confinement mechanism to detect the masquerade attacks originated from the malicious CAN devices on the CAN bus. Simulation results show that our method achieves the attack misdetection rate at the order of 10-5 and reduces the encryption latency by up to 68% over the complete frame encryption method.

The paper addresses the security service infrastructure included in the controller area network (CAN) standard, proposing the incorporation of a confidentiality service for that kind of network. Regarding security, CAN currently supports only a special kind of data transfer service, namely safety, for error detection, signalling, and self checking. Nevertheless, as CAN has become more diverse, complex and integrated into other kinds of networks, it must provide higher security services, such as confidentiality, especially for its bus, which is the most attack-prone point on CAN. Taking into account, on one hand, the security services defined by ISO and, on the other hand, the security services defined by CAN, the paper proposes to incorporate a confidentiality service to CAN based on RC4, which is a lightweight symmetric stream cipher algorithm. The paper then presents the clock cycles required for encrypting different data sizes of the CAN frame in the 87C196CB, which is a microcontroller with integrated CAN 2.0 serial interface.