Vehicles cannot be secured while the in-vehicle network remains insecure. The growing number of attacks reported each year shows that in-vehicle buses are not isolated from the outside world. By exploiting their lack of security, adversaries can gain control over virtually any functionality inside the car. We discuss the most promising approaches for assuring security on the controller area network (CAN) bus after a decade of attacks and security proposals. Most of the proposals are based on cryptographic mechanisms, but some exploit the physical layer or even the physical characteristics of the controllers. The surveyed solutions prove a significant degree of maturity and sophistication, which suggests that the moment for adoption and standardization by the industry has come.

In the recent years, countless security concerns related to automotive systems were revealed either by academic research or real life attacks. While current attention was largely focused on passenger cars, due to their ubiquity, the reported bus-related vulnerabilities are applicable to all industry sectors where the same bus technology is deployed, i.e., the CAN bus. The SAE J1939 specification extends and standardizes the use of CAN to commercial vehicles where security plays an even higher role. In contrast to empirical results that attest such vulnerabilities in commercial vehicles by practical experiments, here we determine that existing shortcomings in the SAE J1939 specifications open road to several new attacks, e.g., impersonation, DoS, DDoS, etc. Taking advantage of an industry-standard CANoe based simulation, we demonstrate attacks with potential safety critical effects that are mounted while still conforming to the SAE J1939 standard specification. We discuss countermeasures and security enhancements by including message authentication mechanisms. Finally, we evaluate and discuss the impact of employing these mechanisms on the overall network communication.

We fingerprint 54 ECUs from 10 cars, one of them being a heavy-duty vehicle that is compliant to the SAE J1939 standard. These later specifications implemented in commercial vehicles offer concrete sender addresses in every CAN frame, making physical characteristics easier to link to specific ECUs. This is not the case for traffic collected inside passenger cars where the allocation of CAN bus identifiers is non-uniform, without explicit sender and receiver addresses, making ECU identification more challenging. While previous research has shown good separation between ECUs even when single features are used, e.g., skews or maximum voltage level, prior results are based on a small number of cars, while our larger experimental basis proves that single features are likely insufficient to separate between a large number of ECUs. Concretely, for a crisp separation, at least four features seem to be needed, i.e., mean voltage, max voltage, bit time and plateau time, while clock skews or any single voltage feature lead to overlaps. We provide clear experimental bounds on the intra and inter-distances regarding skews and voltage features, not neglecting environmental variations which may occur when the car is running.

Since the first reports on its lack of security, the Controller Area Network (CAN) was in focus for numerous research works. A specific area of research has employed physical layer characteristics that can be used to uniquely identify network nodes. But there are common downsides in existing approaches such as vulnerabilities in front of attacks involving node replacement or insertion or the inability to locate the intruder node within the network. In this work, we propose a new intrusion detection system for CAN which is based on monitoring the propagation time of the physical signals sent on the bus. Indeed, quite a number of recent works addressed the use of physical or timing characteristics to identify network nodes or to create covert channels. In our approach, by accounting for intrinsic delay characteristics of the bus and by monitoring the difference in signal arrival time at the two bus ends, we can identify nodes by location-related differential delays and provide relevant information for estimating the relative location of a transmitter node on the bus. The results of our experimental evaluation show that our approach provides very high identification rates and accurate localization in case of attacks from compromised nodes. The ability to detect attacks that replace an existing node or plug new adversarial nodes on the bus is also illustrated along with discussions on estimating sender location in these cases.

The security of vehicle communication buses and electronic control units has received much attention in the recent years. However, while essential for practical deployments, the problem of securely exchanging cryptographic keys between electronic control units on the CAN bus received little attention so far. In this work, we evaluate group extensions of a regular key exchange protocol, i.e., the elliptic curve version of the Diffie-Hellman protocol, by using both a standardized NIST elliptic curve as well as the faster, more recently proposed Four $\mathbb {Q}$ curve. We deploy protocol implementations and determine crisp performance bounds on real-world automotive-grade platforms with Infineon and ARM cores. For an up-to-date analysis, we use both CAN and its more recent extension CAN-FD as communication layers. Roughly, the computational runtime of the key exchange protocol scales logarithmically or linearly with the number of nodes, depending on the protocol version. The computational time proves to be more critical than bandwidth due to the more demanding elliptic curve operations.

Security has become critical for in-vehicle networks as they carry safety-critical data from various components, e.g., sensors or actuators, and current research proposals were quick to react with cryptographic protocols designed for in-vehicle buses, e.g., CAN (Controller Area Network). Obviously, the majority of existing proposals are built on cryptographic primitives that rely on a secret shared key. However, how to share such a secret key is less obvious due to numerous practical constraints. In this work, we explore in a comparative manner several approaches based on a group extension of the Diffie–Hellman key-exchange protocol and identity-based authenticated key agreements. We discuss approaches based on conventional signatures and identity-based signatures, garnering advantages from bilinear pairings that open road to several well-known cryptographic constructions: short signatures, the tripartite Diffie–Hellman key exchange and identity-based signatures or key exchanges. Pairing-based cryptographic primitives do not come computationally cheap, but they offer more flexibility that leads to constructive advantages. To further improve on performance, we also account for pairing-free identity-based key exchange protocols that do not require expensive pairing operations nor explicit signing of the key material. We present both computational results on automotive-grade controllers as well as bandwidth simulations with industry-standard tools, i.e., CANoe, on modern in-vehicle buses CAN-FD and FlexRay.