Abstract:In recent years, the security of automotive Cyber-Physical Systems (CPSs) is facing urgent threats due to the widespread use of legacy in-vehicle communication systems. As a representative legacy bus system, the Controller Area Network (CAN) hosts Electronic Control Units (ECUs) that are crucial for the vehicles functioning. In this scenario, malicious actors can exploit the CAN vulnerabilities, such as the lack of built-in authentication and encryption schemes, to launch CAN bus attacks (e.g., suspension, injection, and masquerade attacks) with life-threatening consequences (e.g., disabling brakes). In this article, we present TACAN (Transmitter Authentication in CAN), which provides secure authentication of ECUs on the legacy CAN bus by exploiting the covert channels, without introducing CAN protocol modifications or traffic overheads (no extra bits or CAN messages are used). TACAN turns upside-down the originally malicious concept of covert channels and exploits it to build an effective defensive technique that facilitates transmitter authentication via a centralized, trusted Monitor Node. TACAN consists of three different covert channels for ECU authentication: 1) the Inter-Arrival Time (IAT)-based, leveraging the IATs of CAN messages; 2) the Least Significant Bit (LSB)-based, concealing authentication messages into the LSBs of normal CAN data; and 3) a hybrid covert channel, exploiting the combination of the first two. In order to validate TACAN, we implement the covert channels on the University of Washington (UW) EcoCAR (Chevrolet Camaro 2016) testbed. We further evaluate the bit error, throughput, and detection performance of TACAN through extensive experiments using the EcoCAR testbed and a publicly available dataset collected from Toyota Camry 2010. We demonstrate the feasibility of TACAN and the effectiveness of detecting CAN bus attacks, highlighting no traffic overheads and attesting the regular functionality of-ECUs.

ID Hopping CAN Controller Design with Obfuscated Priority Assignment.

IDH-CAN: A Hardware-Based ID Hopping CAN Mechanism with Enhanced Security for Automotive Real-Time Applications

Hitchhike: Riding control on preambles

Hitchhike: A Preamble-Based Control Plane for SNR-Sensitive Wireless Networks.

Multi-variant Network Address Hopping to Defend Stealthy Crossfire Attack

ShuffleCAN: Enabling Moving Target Defense for Attack Mitigation on Automotive CAN

Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks

Security Enhancement for Real-Time Parallel In-Vehicle Applications by CAN FD Message Authentication

Intrusion detection and defence for CAN bus through frequency anomaly analysis and arbitration mechanism

Security Enhancement for Real-Time Independent In-Vehicle CAN-FD Messages in Vehicular Networks

Secure and Low-Delay CAN-FD Communication in Embedded Microcontroller: A Cooperative Swapping Approach

CANCloak: Deceiving Two ECUs with One Frame

CANflict: Exploiting Peripheral Conflicts for Data-Link Layer Attacks on Automotive Networks

TACAN: Transmitter Authentication through Covert Channels in Controller Area Networks

A Hop to Hop Controlled Hierarchical Multicast Congestion Control Mechanism

Covert Channel-Based Transmitter Authentication in Controller Area Networks

CANsec: A Practical in-Vehicle Controller Area Network Security Evaluation Tool

An Optimization Method for Encrypting CAN Messages

CANAttack: Assessing Vulnerabilities within Controller Area Network

An Entropy Analysis based Intrusion Detection System for Controller Area Network in Vehicles

Security-Aware CAN-FD Message Packing in Intelligent Automotive Cyber-Physical Systems