Prevention of Controller Area Network (CAN) Attacks on Electric Autonomous Vehicles
Source abstract
Abstract
The importance of vehicle security has increased in recent years in the automotive field, drawing the attention of both the industry and academia. This is due to the rise in cybersecurity threats caused by (1) the increase in vehicle connectivity schemes, such as the Internet of Things, vehicle-to-x communication, and over-the-air updates, and (2) the increased impact of such threats because of the added functionalities that are controlled by vehicle software. These causes and threats are further amplified in autonomous vehicles, which are generally equipped with more electronic control units (ECUs) that are connected through controller area networks (CANs). Due to the holistic nature of CANs, attacks on the networks can affect the functionality of all vehicle ECUs and the whole system. This can lead to a breach of privacy, denial of services, alteration of vehicle performance, and exposure to safety threats. Although cryptographic encryption and authentication algorithms and intrusion detection systems (IDS) are currently being used to detect and prevent CAN bus attacks, they have certain limitations. Therefore, this study proposed a mitigation scheme that can detect and prevent such attacks at the ECU level, which could address the limitations of existing algorithms. This study proposed the usage of a secure boot scheme to detect and prevent the execution of malicious codes, as the presence of one or more ECUs with a malicious code is the root cause of most CAN bus attacks. Secure boot schemes apply cryptographic data integrity algorithms to ensure that only authentic and untampered software can run on the vehicle’s ECUs. The selection of an appropriate cryptographic algorithm is important because it affects the secure boot schemes’ security level and performance. Therefore, this study also tested and compared the performance of the proposed secure boot scheme with five different data security algorithms implemented using the hardware security module (HSM) of the TC399 32-bit AURIX™ TriCore™ microcontroller through an electric autonomous vehicle’s control unit. The tests showed that the two most favorable schemes with the selected hardware are the secure boot scheme with the cipher-based message authentication code (CMAC), because it possesses the highest performance with an execution rate of 26.07 (ms/MB), and the secure boot scheme with the elliptic curve digital signature algorithm (ECDSA), because it provides a higher security level with an acceptable compromise in speed. This study also introduced and tested a novel variation of the ECDSA algorithm based on the CMAC algorithm, which was found to have a 19% performance gain over the standard ECDSA-based secure boot scheme.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Vehicular Ad Hoc Networks (VANETs) · Autonomous Vehicle Technology and Safety · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Mechatronics Engineering Department, Faculty of Engineering, Ain Shams University, Cairo 11517, Egypt
Siemens Digital Industries Software, Integrated Electrical Systems Segment, Cairo 11835, Egypt
References (55)
Show source-provided references
1. Currie, R. (2015). Developments in Car Hacking, SANS Institute. Tech. Rep., Dec.
2. Cyberattacks and Countermeasures for In-Vehicle Networks10.1145/3431233 ↗
3. Khan, J. (2017, January 4–5). Vehicle network security testing. Proceedings of the 2017 3rd IEEE International Conference on Sensing, Signal Processing and Security, ICSSS 2017, Chennai, India.10.1109/SSPS.2017.8071577 ↗
4. Hoppe, T., Kiltz, S., and Dittmann, J. (2008). Lecture Notes in Computer Science, Proceedings of the International Conference on Computer Safety, Reliability, and Security, Newcastle upon Tyne, UK, 22–25 September 2008, Springer.
5. Embedded systems security-an overview10.1007/s10617-008-9027-x ↗
6. Hoppe, T., Kiltz, S., Lang, A., and Dittmann, J. (2007, January 27–28). Exemplary automotive attack scenarios: Trojan horses for Electronic Throttle Control System (ETC) and replay attacks on the power window system. Proceedings of the VDI/VW Gemeinschaftstagung Automotive Security, Wolfsburg, Germany.
7. Checkoway, S., McCoy, D., Kantor, B., Anderson, D., Shacham, H., and Savage, S. (2011, January 8–12). Comprehensive experimental analyses of automotive attack surfaces. Proceedings of the 20th USENIX Security Symposium, San Francisco, CA, USA.
8. Huang, T., Zhou, J., Wang, Y., and Cheng, A. (2017). Lecture Notes in Computer Science, Proceedings of the International Conference on Information Security Practice and Experience, Melbourne, VIC, Australia, 13–15 December 2017, Springer.
9. Iehira, K., Inoue, H., and Ishida, K. (2018, January 12–15). Spoofing attack using bus-off attacks against a specific ECU of the CAN bus. Proceedings of the CCNC 2018—2018 15th IEEE Annual Consumer Communications and Networking Conference, Las Vegas, NV, USA.10.1109/CCNC.2018.8319180 ↗
10. Remote Exploitation of an Unaltered Passenger Vehicle
11. A survey on security attacks and defense techniques for connected and autonomous vehicles10.1016/j.cose.2021.102269 ↗
12. Siddiqui, A.S., Plusquellic, Y.G.J., and Saqib, F. (2017, January 6–9). Secure communication over CANBus. Proceedings of the 2017 IEEE 60th International Midwest Symposium on Circuits and Systems (MWSCAS), Boston, MA, USA.10.1109/MWSCAS.2017.8053160 ↗
13. Nilsson, D.K., Larson, U.E., and Jonsson, E. (2008, January 11–14). Efficient in-vehicle delayed data authentication based on compound message authentication codes. Proceedings of the IEEE Vehicular Technology Conference, Marina Bay, Singapore.10.1109/VETECF.2008.259 ↗
14. Entropy based Anomaly Detection System to Prevent DDoS Attacks in Cloud
15. Identifying ECUs Using Inimitable Characteristics of Signals in Controller Area Networks10.1109/TVT.2018.2810232 ↗
16. CANintelliIDS: Detecting In-Vehicle Intrusion Attacks on a Controller Area Network Using CNN and Attention-Based GRU10.1109/TNSE.2021.3059881 ↗
17. NovelADS: A Novel Anomaly Detection System for Intra-Vehicular Networks10.1109/TITS.2022.3146024 ↗
18. Multiple Observation HMM-Based CAN Bus Intrusion Detection System for In-Vehicle Network10.1109/ACCESS.2023.3265018 ↗
19. A novel intrusion detection model for the CAN bus packet of in-vehicle network based on attention mechanism and autoencoder10.1016/j.dcan.2022.04.021 ↗
20. Yu, T., Hua, G., Wang, H., Yang, J., and Hu, J. (2022, January 16–20). Federated-LSTM based Network Intrusion Detection Method for Intelligent Connected Vehicles. Proceedings of the IEEE International Conference on Communications, Seoul, Republic of Korea.10.1109/ICC45855.2022.9838655 ↗
21. Taslimasa, H., Dadkhah, S., Neto, E.C.P., Xiong, P., Iqbal, S., Ray, S., and Ghorbani, A.A. (2023, January 6–8). ImageFed: Practical Privacy Preserving Intrusion Detection System for In-Vehicle CAN Bus Protocol. Proceedings of the 2023 IEEE 9th International Conference on Big Data Security on Cloud, IEEE International Conference on High Performance and Smart Computing, and IEEE International Conference on Intelligent Data and Security, BigDataSecurity-HPSC-IDS 2023, New York, NY, USA.10.1109/BigDataSecurity-HPSC-IDS58521.2023.00031 ↗
22. A Cyber Security Evaluation Framework for In-Vehicle Electrical Control Units10.1109/ACCESS.2021.3124565 ↗
23. Tyger, J.D., and Yee, B. (1991). Dyad: A System for Using Physically Secure Coprocessors, School of Computer Science, Carnegie Mellon University. Technical Report CMU-CS-91-140R.
24. Profentzas, C., Gunes, M., Nikolakopoulos, Y., Landsiedel, O., and Almgren, M. (2019, January 29–31). Performance of secure boot in embedded systems. Proceedings of the 15th Annual International Conference on Distributed Computing in Sensor Systems, DCOSS 2019, Santorini Island, Greece.10.1109/DCOSS.2019.00054 ↗
25. Groll, A., Holle, J., Wolf, M., and Wollinger, T. (2010, January 25–29). Next generation of automotive security: Secure hardware and secure open platforms. Proceedings of the 17th ITS World Congress, Busan, Republic of Korea.
26. Nasahl, P., and Timmers, N. (2019). Attacking AUTOSAR using Software and Hardware Attacks, Escar.
27. Lee, K.S. (2021, January 12–15). Considerations for Cyber Security Implementation in Autonomous Vehicle Systems. Proceedings of the International Conference on Control, Automation and Systems, Jeju, Republic of Korea.10.23919/ICCAS52745.2021.9649850 ↗
28. Li, Y., Zhang, Y., Li, P., and Guo, P. (2015, January 19–20). An efficient trusted chain model for real-time embedded systems. Proceedings of the 2015 11th International Conference on Computational Intelligence and Security, CIS 2015, Shenzhen, China.10.1109/CIS.2015.109 ↗
29. Secure Boot Revisited: Challenges for Secure Implementations in the Automotive Domain
30. Löhr, H., Sadeghi, A.R., and Winandy, M. (2010, January 15–18). Patterns for secure boot and secure storage in computer systems. Proceedings of the ARES 2010—5th International Conference on Availability, Reliability, and Security, Krakow, Poland.10.1109/ARES.2010.110 ↗
31. Matheus, K., and Konigseder, T. (2017). Automotive Ethernet, Cambridge University Press.10.1017/9781316869543 ↗
32. Kim, D., Shin, E., Park, J.S., Lee, K., Gui, K.C., and Scheibert, K. (2017). Secure Boot Implementation for Hard Real-Time Powertrain System, SAE. SAE Technical Paper.10.4271/2017-01-1656 ↗
33. Mihalache, A., and Bedoucha, F. (2023, February 11). Need to Take Cybersecurity into Account in Secure ECUs. [Online]. Available online: https://hal.archives-ouvertes.fr/hal-03331273.
34. Gui, Y., Siddiqui, A.S., and Saqib, F. (2018, January 19–22). Hardware Based Root of Trust for Electronic Control Units. Proceedings of the Conference Proceedings—IEEE SOUTHEASTCON, SoutheastCon 2018, St. Petersburg, FL, USA.10.1109/SECON.2018.8479266 ↗
35. Kumar, V.B.Y., Gupta, N., Chattopadhyay, A., Kasper, M., Kraus, C., and Niederhagen, R. (2020, January 9–13). Post-Quantum Secure Boot. Proceedings of the 2020 Design, Automation and Test in Europe Conference and Exhibition, DATE 2020, Grenoble, France.10.23919/DATE48585.2020.9116252 ↗
36. Marzougui, S., and Krämer, J. (2019, January 26–29). Post-quantum cryptography in embedded systems. Proceedings of the ACM International Conference Proceeding Series, Canterbury, UK.10.1145/3339252.3341475 ↗
37. Ultra Super Fast Authentication Protocol for Electric Vehicle Charging Using Extended Chaotic Maps10.1109/TIA.2022.3184668 ↗
38. Dworkin, M. (2022, December 19). Hash Functions, Available online: https://csrc.nist.gov/projects/hash-functions.
39. (2015). Secure Hash Standard (Standard No. FIPS PUB 180-4).
40. Cryptographic Hash Functions: A Review
41. (2008). The Keyed-Hash Message Authentication Code (Standard No. FIPS PUB 198-1).
42. Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec
43. Krawczyk, H., Bellare, M., and Canetti, R. (2023, March 12). HMAC: Keyed-Hashing for Message Authentication; RFC 2104, February 1997. Available online: https://www.rfc-editor.org/info/rfc2104.10.17487/rfc2104 ↗
44. Akevren, S., Krawczyk, D.H., and Eronen, P. (2023, July 21). HMAC-Based Extract-and-Expand Key Derivation Function (HKDF). Internet Engineering Task Force, IETF, RFC 5869. Available online: https://rfc-editor.org/rfc/rfc5869.txt.
45. Dworkin, M. (2023, March 12). Recommendation for Block Cipher Modes of Operation. National Institute of Standards and Technology Special Publication 800-38A 2001 ED, vol. X, no. December 2005, Available online: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-38a.pdf.
46. Song, J.H., Poovendran, R., and Lee, J.I.T. (2023, March 12). RFC 4493: The AES-CMAC Algorithm. Network Working Group. Available online: https://tools.ietf.org/html/rfc4493.
47. Semiconductors, N.X. (2023, July 21). AN10922 Symmetric key diversifications. July 2019. Available online: https://www.nxp.com/docs/en/application-note/AN10922.pdf.
48. Gallagher, P.D., and Romine, C. (2023, March 12). FIPS PUB 186-4 Digital Signature Standard (DSS), Encyclopedia of Cryptography and Security, Available online: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf.
49. Pornin, T. (2023, July 21). RFC 6979: Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA). RFC. August 2013. Available online: https://datatracker.ietf.org/doc/html/rfc6979.10.17487/rfc6979 ↗
50. Efficient and secure ECDSA algorithm and its applications: A survey
51. Moriarty, K., Kaliski, B., Jonsson, J., and Rusch, A. (2023, March 12). PKCS #1: RSA Cryptography Specifications, Version 2.2. RFC 8017. November 2016. Available online: https://www.rfc-editor.org/rfc/rfc8017.10.17487/RFC8017 ↗
52. Barker, E., Barker, W., Burr, W., Polk, W., and Smid, M. (2007). Recommendation for Key Management SP 800-57 Part 1: General Revision 3, NIST Special Publication.10.6028/NIST.SP.800-57p1r2007 ↗
53. Firmware Security Module10.1007/s41635-021-00114-4 ↗
54. Rodgman, D. (2022, July 17). Mbed TLS 2.28.0. Available online: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.0.
55. Reier, L. (2020). Security Concept and Evaluation of an Off-Highway Electronic Control Unit. [Master’s Thesis, Technische Universität Wien].