Covert Channel-Based Transmitter Authentication in Controller Area Networks

Abstract

In recent years, the security of automotive Cyber-Physical Systems (CPSs) is facing urgent threats due to the widespread use of legacy in-vehicle communication systems. As a representative legacy bus system, the Controller Area Network (CAN) hosts Electronic Control Units (ECUs) that are crucial for the vehicles functioning. In this scenario, malicious actors can exploit the CAN vulnerabilities, such as the lack of built-in authentication and encryption schemes, to launch CAN bus attacks (e.g., suspension, injection, and masquerade attacks) with life-threatening consequences (e.g., disabling brakes). In this paper, we present TACAN (Transmitter Authentication in CAN), which provides secure authentication of ECUs on the legacy CAN bus by exploiting the covert channels, without introducing CAN protocol modifications or traffic overheads (no extra bits or CAN messages are used). TACAN turns upside-down the originally malicious concept of covert channels and exploits it to build an effective defensive technique that facilitates transmitter authentication via a centralized, trusted Monitor Node. TACAN consists of three different covert channels for ECU authentication: 1) the Inter-Arrival Time (IAT)-based, leveraging the IATs of CAN messages; 2) the Least Significant Bit (LSB)-based, concealing authentication messages into the LSBs of normal CAN data; and 3) a hybrid covert channel, exploiting the combination of the first two. In order to validate TACAN, we implement the covert channels on the University of Washington (UW) EcoCAR (Chevrolet Camaro 2016) testbed. We further evaluate the bit error, throughput, and detection performance of TACAN through extensive experiments using the EcoCAR testbed and a publicly available dataset collected from Toyota Camry 2010. We demonstrate the feasibility of TACAN and the effectiveness of detecting CAN bus attacks, highlighting no traffic overheads and attesting the regular functionality of ECUs.

CINNAMON: A Module for AUTOSAR Secure Onboard Communication

“…Among the software solutions is TACAN [33], a covertchannel based solution. It shares a master key between an ECU and the Monitor Node to generate shared session keys.…”

Wyner wiretap‐like encoding scheme for cyber‐physical systems

“…The covert traffic is encoded within the output noise of the covertly-transmitting sensor, whose distribution is indistinguishable from that of a benign sensor. Finally, in [34], Ying et al utilised covert channels to build an effective defensive technique that facilitates transmitter authentication via a trusted monitor node for automotive applications. In particular, the authors presented transmitter authentication for controller area network (TACAN), which provides secure authentication of electronic control units (ECUs) by exploiting the covert channels without introducing CAN protocol modifications or traffic overheads.…”

Shape of the Cloak: Formal Analysis of Clock Skew-Based Intrusion Detection System in Controller Area Networks

“…Security solutions for CAN can be broadly classified into schemes that add cryptographic measures to the CAN bus [8]- [10], [18] and anomaly-based IDSs that 1) analyze the traffic on the CAN bus including message contents [19]- [21], timing/frequency [15], [22]- [25], entropy [26], and survival rates [27], 2) exploit the physical characteristics of ECUs extracted from in-vehicle sensing data [28]- [30] or measurements [11], [13], [14], [31], [32], and 3) exploit the characteristics of the CAN protocol, such as the remote frame [33]. Compared to the CAN traffic, it is more difficult for adversaries to imitate the physical characteristics of ECUs, such as the mean squared error of voltage measurements [11].…”