Smart CAN Cable -- Another proposal of intrusion prevention system (IPS) for in-vehicle networks
•
0 likes•28 views
Many ideas of IDS for vehicles were already proposed so far. Most of them can only detect anomaly CAN message. Still, they cannot detect which ECU is compromised because any ECUs cannot identify the ECU that sends illegal messages for the specification of CAN protocol. Now we propose the Smart CAN cable that identifies the ECU that sends malicious messages. The Smart CAN cable has two kinds of functions. One is a CAN-IDS. The CAN-IDS identifies an illegal message, and it broadcasts the hash value of the illegal message to CAN-BUS. Another is an identifying module. The identifying module is to memorize hash values of the messages and its sender ECU. When the identifying module receives the hash value from the CAN-IDS, it broadcasts the sender ECU information to CAN-BUS if it finds the hash value in its own memory. We can cut the sender ECU from CAN BUS, control the stream, or handle other workarounds after identifying the sender ECU that sends illegal messages. This paper shows how the Smart CAN cable works, and its advantages and disadvantages.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Smart CAN Cable -- Another proposal of intrusion prevention system (IPS) for in-vehicle networks
Similar to Smart CAN Cable -- Another proposal of intrusion prevention system (IPS) for in-vehicle networks (20)
More from Mocke Tech
More from Mocke Tech (13)
Recently uploaded
Recently uploaded (20)
Smart CAN Cable -- Another proposal of intrusion prevention system (IPS) for in-vehicle networks
- 1. We provide IT total solutions based on advanced security technologies. supports your Business LAC Kiyotaka ATSUMI, Ryoichi KIDA IoT Technology Laboratory, Cyber Grid Japan, LAC Co., Ltd. © 2018 LAC Co., Ltd. Masaya Uwatoko, Narumi HIRAI, Yuki MIZUNO NetAgent Co., Ltd. Smart CAN Cable Another proposal of intrusion prevention system (IPS) for in-vehicle networks Symposium on Cryptography and Information Security, January 23-26, 2018
- 2. © 2018 LAC Co., Ltd. 2 SCIS2018 in Niigata Acknolegement We thank Alps System Integration Co., Ltd. very much. This project did not succeed without their helps.
- 3. © 2018 LAC Co., Ltd. 3 SCIS2018 in Niigata Outline 1. Background 2. Smart CAN Cable a) Structure b) Sequence c) Performance 3. Discussion 4. Demonstration
- 4. © 2018 LAC Co., Ltd. 4 SCIS2018 in Niigata Background How do we identify an illegal message on CAN BUS so far? ECU IPS ECU ECU … Blacklist / Whitelist Corrupted message Unlikely message Irregular message during cyclic messages Somehow a suspicious message... OK. Let us assume that IDS can identify the illegal message. OBD-II ECU
- 5. © 2018 LAC Co., Ltd. 5 SCIS2018 in Niigata Background How do we intercept the illegal message? ECU IPS ECU ECU … Overwrite the illegal message with an error message ... Huh? Is it really possible? How do we get back control from the attacker? OBD-II ECU
- 6. © 2018 LAC Co., Ltd. 6 SCIS2018 in Niigata Smart CAN Cable: Structure CAN cable and connector (just example) 北斗電子： RC-Carキット http://www.hokutodenshi.co.jp/7/HSBRH850F1L100.htm#rccar We can install something.
- 7. © 2018 LAC Co., Ltd. 7 SCIS2018 in Niigata Smart CAN Cable: Structure Our Proposal Connector … Connector Connector Connector Connector ECU IPS ECU ECU ECU Smart CAN Cable Smart CAN Cable identifies the sender ECU. Smart CAN Cable is controlable that the ECU sends a message or not. OBD-II
- 8. © 2018 LAC Co., Ltd. 8 SCIS2018 in Niigata Smart CAN Cable: Structure Smart CAN Cable is like just a CAN Cable with connector. Advantage ➢ ECU does not need to modify for the security. We can apply the Smart CAN cable to the cars in the market. ➢ Smart CAN Cable can gather responsibility of the security. ● Disadvantage ➢ A little more space and code. ➢ Signal may be delayed (for now).
- 9. © 2018 LAC Co., Ltd. 9 SCIS2018 in Niigata Smart CAN Cable: Structure Inside of Connector ECU Transceiver Repeater CAN BUS Controller Ring Buffer Transceiver ● Record a hash value of a message from ECU into its own ring buffer. ● Search the hash value in its own ring buffer when IPS sends the hash value. ● Order to stop to relay any messages to repeater after it finds the hash value. Controller role
- 10. © 2018 LAC Co., Ltd. 10 SCIS2018 in Niigata Smart CAN Cable: Sequence Normal sequence IDS ECU1 Connector1 ECU2 ECU3 CAN BUS Connector2 Connector3 Connector0 Normal message Hash value of the message
- 11. © 2018 LAC Co., Ltd. 11 SCIS2018 in Niigata Smart CAN Cable: Sequence Normal sequence IDS ECU1 Connector1 ECU2 ECU3 CAN BUS Connector2 Connector3 Connector0 Normal message Hash value of the message
- 12. © 2018 LAC Co., Ltd. 12 SCIS2018 in Niigata Smart CAN Cable: Sequence Normal sequence IDS ECU1 Connector1 ECU2 ECU3 CAN BUS Connector2 Connector3 Connector0 Good! Normal message Hash value of the message
- 13. © 2018 LAC Co., Ltd. 13 SCIS2018 in Niigata Smart CAN Cable: Sequence Sequence of identifying an illegal message IDS ECU1 Connector1 ECU2 ECU3 CAN BUS Compromised Connector2 Connector3 Connector0 Illegal message Hash value of the illegal message Information of compromised ECU
- 14. © 2018 LAC Co., Ltd. 14 SCIS2018 in Niigata Smart CAN Cable: Sequence Sequence of identifying an illegal message IDS ECU1 Connector1 ECU2 ECU3 CAN BUS Compromised Connector2 Connector3 Connector0 Illegal message Hash value of the illegal message Information of compromised ECU
- 15. © 2018 LAC Co., Ltd. 15 SCIS2018 in Niigata Smart CAN Cable: Sequence Sequence of identifying an illegal message IDS ECU1 Connector1 ECU2 ECU3 CAN BUS Compromised Connector2 Connector3 Connector0 Illegal message Hash value of the illegal message Information of compromised ECU Bad!
- 16. © 2018 LAC Co., Ltd. 16 SCIS2018 in Niigata Smart CAN Cable: Sequence Sequence of identifying an illegal message IDS ECU1 Connector1 ECU2 ECU3 CAN BUS Compromised Connector2 Connector3 Connector0 Illegal message Hash value of the illegal message Information of compromised ECU Bad!
- 17. © 2018 LAC Co., Ltd. 17 SCIS2018 in Niigata Smart CAN Cable: Sequence Sequence of identifying an illegal message IDS ECU1 Connector1 ECU2 ECU3 CAN BUS Compromised Connector2 Connector3 Connector0 Illegal message Hash value of the illegal message Information of compromised ECU Bad! ＝ ≠ ≠ Identified
- 18. © 2018 LAC Co., Ltd. 18 SCIS2018 in Niigata Smart CAN Cable: Sequence Sequence of identifying an illegal message IDS ECU1 Connector1 ECU2 ECU3 CAN BUS Compromised Connector2 Connector3 Connector0 Illegal message Hash value of the illegal message Information of compromised ECU Bad! ＝ Cut Identified
- 19. © 2018 LAC Co., Ltd. 19 SCIS2018 in Niigata Smart CAN Cable: Performance Hash value: CRC32 (4byte) Ring buffer size: 1024 records Passing through a connector: 400μs(Max) Checking a hash value in the ring buffer: 50μs(Ave) Collision rule: A loser message is forgotten.
- 20. © 2018 LAC Co., Ltd. 20 SCIS2018 in Niigata Discussion: Open Points Passing through speed is very slow ● To approximately wire-speed... Else better collision rule ● No idea for it Vulnerability of Smart CAN Cable ● Must implement blacklist/whitelist ● About tamper resistance of smart CAN cable
- 21. © 2018 LAC Co., Ltd. 21 SCIS2018 in Niigata Demonstration: Structure Steering Angle Commander C Connector ECU CAN BUS Speed Commander C brake Commander C Drive Motor and LED C C IDS Attacker C
- 22. © 2018 LAC Co., Ltd. 22 SCIS2018 in Niigata Demonstration: Structure
- 23. © 2018 LAC Co., Ltd. 23 SCIS2018 in Niigata Demonstration: Structure
- 24. © 2018 LAC Co., Ltd. 24 SCIS2018 in Niigata Demonstration
- 25. We provide IT total solutions based on advanced security technologies. supports your Business LAC Thank you. Any Questions ? © 2018 LAC Co., Ltd.