More Related Content Similar to Smart CAN Cable -- Another proposal of intrusion prevention system (IPS) for in-vehicle networks (20) More from Mocke Tech (13) Smart CAN Cable -- Another proposal of intrusion prevention system (IPS) for in-vehicle networks1. We provide IT total solutions
based on advanced security technologies.
supports your Business
LAC
Kiyotaka ATSUMI, Ryoichi KIDA
IoT Technology Laboratory,
Cyber Grid Japan,
LAC Co., Ltd.
© 2018 LAC Co., Ltd.
Masaya Uwatoko, Narumi HIRAI,
Yuki MIZUNO
NetAgent Co., Ltd.
Smart CAN Cable
Another proposal of intrusion prevention
system (IPS) for in-vehicle networks
Symposium on Cryptography and Information Security,
January 23-26, 2018
2. © 2018 LAC Co., Ltd.
2
SCIS2018 in Niigata
Acknolegement
We thank Alps System Integration Co., Ltd. very much.
This project did not succeed without their helps.
3. © 2018 LAC Co., Ltd.
3
SCIS2018 in Niigata
Outline
1. Background
2. Smart CAN Cable
a) Structure
b) Sequence
c) Performance
3. Discussion
4. Demonstration
4. © 2018 LAC Co., Ltd.
4
SCIS2018 in Niigata
Background
How do we identify an illegal message on CAN BUS so far?
ECU
IPS
ECU ECU
…
Blacklist / Whitelist
Corrupted message
Unlikely message
Irregular message during cyclic messages
Somehow a suspicious message...
OK. Let us assume that IDS can identify the illegal message.
OBD-II
ECU
5. © 2018 LAC Co., Ltd.
5
SCIS2018 in Niigata
Background
How do we intercept the illegal message?
ECU
IPS
ECU ECU
…
Overwrite the illegal message with an error message
...
Huh? Is it really possible?
How do we get back control from the attacker?
OBD-II
ECU
6. © 2018 LAC Co., Ltd.
6
SCIS2018 in Niigata
Smart CAN Cable: Structure
CAN cable and connector (just example)
北斗電子: RC-Carキット
http://www.hokutodenshi.co.jp/7/HSBRH850F1L100.htm#rccar
We can install
something.
7. © 2018 LAC Co., Ltd.
7
SCIS2018 in Niigata
Smart CAN Cable: Structure
Our Proposal
Connector …
Connector
Connector
Connector Connector
ECU
IPS
ECU ECU
ECU
Smart CAN Cable
Smart CAN Cable identifies the sender ECU.
Smart CAN Cable is controlable that the ECU sends a
message or not.
OBD-II
8. © 2018 LAC Co., Ltd.
8
SCIS2018 in Niigata
Smart CAN Cable: Structure
Smart CAN Cable is like just a CAN Cable with
connector.
Advantage
➢
ECU does not need to modify for the security.
We can apply the Smart CAN cable to the cars in the market.
➢
Smart CAN Cable can gather responsibility of the
security.
●
Disadvantage
➢
A little more space and code.
➢
Signal may be delayed (for now).
9. © 2018 LAC Co., Ltd.
9
SCIS2018 in Niigata
Smart CAN Cable: Structure
Inside of Connector
ECU
Transceiver
Repeater
CAN BUS
Controller
Ring Buffer
Transceiver
● Record a hash value of
a message from ECU
into its own ring buffer.
● Search the hash value
in its own ring buffer
when IPS sends the
hash value.
● Order to stop to relay
any messages to
repeater after it finds
the hash value.
Controller role
10. © 2018 LAC Co., Ltd.
10
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Normal sequence
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Connector2 Connector3
Connector0
Normal message
Hash value of the message
11. © 2018 LAC Co., Ltd.
11
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Normal sequence
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Connector2 Connector3
Connector0
Normal message
Hash value of the message
12. © 2018 LAC Co., Ltd.
12
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Normal sequence
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Connector2 Connector3
Connector0
Good!
Normal message
Hash value of the message
13. © 2018 LAC Co., Ltd.
13
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU
14. © 2018 LAC Co., Ltd.
14
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU
15. © 2018 LAC Co., Ltd.
15
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU
Bad!
16. © 2018 LAC Co., Ltd.
16
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU
Bad!
17. © 2018 LAC Co., Ltd.
17
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU
Bad!
=
≠ ≠
Identified
18. © 2018 LAC Co., Ltd.
18
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU
Bad!
=
Cut
Identified
19. © 2018 LAC Co., Ltd.
19
SCIS2018 in Niigata
Smart CAN Cable: Performance
Hash value: CRC32 (4byte)
Ring buffer size: 1024 records
Passing through a connector: 400μs(Max)
Checking a hash value in the ring buffer: 50μs(Ave)
Collision rule: A loser message is forgotten.
20. © 2018 LAC Co., Ltd.
20
SCIS2018 in Niigata
Discussion: Open Points
Passing through speed is very slow
●
To approximately wire-speed...
Else better collision rule
●
No idea for it
Vulnerability of Smart CAN Cable
●
Must implement blacklist/whitelist
●
About tamper resistance of smart CAN cable
21. © 2018 LAC Co., Ltd.
21
SCIS2018 in Niigata
Demonstration: Structure
Steering Angle
Commander
C
Connector ECU
CAN BUS
Speed
Commander
C
brake
Commander
C
Drive
Motor and LED
C
C IDS
Attacker
C
22. © 2018 LAC Co., Ltd.
22
SCIS2018 in Niigata
Demonstration: Structure
23. © 2018 LAC Co., Ltd.
23
SCIS2018 in Niigata
Demonstration: Structure
24. © 2018 LAC Co., Ltd.
24
SCIS2018 in Niigata
Demonstration
25. We provide IT total solutions
based on advanced security technologies.
supports your Business
LAC
Thank you. Any Questions ?
© 2018 LAC Co., Ltd.