Abstract:In recent years, the security of automotive Cyber-Physical Systems (CPSs) is facing urgent threats due to the widespread use of legacy in-vehicle communication systems. As a representative legacy bus system, the Controller Area Network (CAN) hosts Electronic Control Units (ECUs) that are crucial for the vehicles functioning. In this scenario, malicious actors can exploit the CAN vulnerabilities, such as the lack of built-in authentication and encryption schemes, to launch CAN bus attacks (e.g., suspension, injection, and masquerade attacks) with life-threatening consequences (e.g., disabling brakes). In this article, we present TACAN (Transmitter Authentication in CAN), which provides secure authentication of ECUs on the legacy CAN bus by exploiting the covert channels, without introducing CAN protocol modifications or traffic overheads (no extra bits or CAN messages are used). TACAN turns upside-down the originally malicious concept of covert channels and exploits it to build an effective defensive technique that facilitates transmitter authentication via a centralized, trusted Monitor Node. TACAN consists of three different covert channels for ECU authentication: 1) the Inter-Arrival Time (IAT)-based, leveraging the IATs of CAN messages; 2) the Least Significant Bit (LSB)-based, concealing authentication messages into the LSBs of normal CAN data; and 3) a hybrid covert channel, exploiting the combination of the first two. In order to validate TACAN, we implement the covert channels on the University of Washington (UW) EcoCAR (Chevrolet Camaro 2016) testbed. We further evaluate the bit error, throughput, and detection performance of TACAN through extensive experiments using the EcoCAR testbed and a publicly available dataset collected from Toyota Camry 2010. We demonstrate the feasibility of TACAN and the effectiveness of detecting CAN bus attacks, highlighting no traffic overheads and attesting the regular functionality of-ECUs.

Unsupervised Time Series Extraction from Controller Area Network Payloads

Application-Layer Anomaly Detection Leveraging Time-Series Physical Semantics in CAN-FD Vehicle Networks

ACTT: Automotive CAN Tokenization and Translation

Covert Channel-Based Transmitter Authentication in Controller Area Networks

Detecting CAN Masquerade Attacks with Signal Clustering Similarity

Online Real-Time Estimation of Response Time for Periodic Messages in Controller Area Networks

TCE-IDS: Time Interval Conditional Entropy- Based Intrusion Detection System for Automotive Controller Area Networks

CAN-FT: A Fuzz Testing Method for Automotive Controller Area Network Bus

TACAN: Transmitter Authentication through Covert Channels in Controller Area Networks

Development of an Autonomous Reverse Engineering Capability for Controller Area Network Messages to Support Autonomous Control Retrofits

Exploiting the Shape of CAN Data for In-Vehicle Intrusion Detection

An Entropy Analysis based Intrusion Detection System for Controller Area Network in Vehicles

Detecting Masquerade Attacks in Controller Area Networks Using Graph Machine Learning

Intrusion detection and defence for CAN bus through frequency anomaly analysis and arbitration mechanism

CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data

Performance comparison of timing-based anomaly detectors for Controller Area Network: a reproducible study

Practical IDS on In-vehicle Network Against Diversified Attack Models

ByCAN: Reverse Engineering Controller Area Network (CAN) Messages from Bit to Byte Level

CANsec: A Practical in-Vehicle Controller Area Network Security Evaluation Tool

Driving Behavior Analysis through CAN Bus Data in an Uncontrolled Environment

Towards a CAN IDS based on a neural-network data field predictor