PLI-TDC: Super Fine Delay-Time Based Physical-Layer Identification with Time-to-Digital Converter for In-Vehicle Networks

Ohira, Shuji; Desta, Araya Kibrom; Arai, Ismail; Fujikawa, Kazutoshi

doi:10.1145/3433210.3437530

Cited by 10 publications

(6 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…the rise and fall times of the CAN signal. In the end, they report a minimum delay resolution of 219ps, which is sufficient to measure the slow 500 kbps CAN bus signal with comparatively high jitter in [ODAF21]. However, that resolution would not be sufficient for this work, where jitter was observed to be usually less than 100ps.…”

Section: Jitter and Its Measurementmentioning

confidence: 93%

“…Others have already explored to analyze timing variations of communication channels in the form of jitter, but not to extract secret data. More specifically, in [ODAF21] an identification approach is shown that measures jitter on an automotive CAN bus by using an FPGA-based TDC sensor. This jitter is used to uniquely identify the respective transmitter of the message by detecting its typical jitter characteristics, influenced by (systematic) manufacturing process variations.…”

Section: Jitter and Its Measurementmentioning

confidence: 99%

“…Timing differences that can be measured from another system were so far leveraged for attacks in a more classical way, when the respective cryptographic implementation was not constant time [BT11]. What has been shown is that timing jitter in a Controller Area Network (CAN) bus signal can be used to identify a hardware device, due to respective manufacturing process variations of the device [ODAF21].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

JitSCA: Jitter-based Side-Channel Analysis in Picoscale Resolution

Schoos,

Meschkov,

Tahoori

et al. 2023

TCHES

View full text Add to dashboard Cite

In safety and security conscious environments, isolated communication channels are often deemed necessary. Galvanically isolated communication channels are typically expected not to allow physical side-channel attacks through that channel. However, in this paper, we show that they can inadvertently leak side channel information in the form of minuscule jitter on the communication signal. We observe worst-case signal jitter within 54 ± 45 ps using an FPGA-based receiver employing a time-to-digital converter (TDC), which is a higher time resolution than a typical oscilloscope can measure, while in many other systems such measurements are also possible. A transmitter device runs a cryptographic accelerator, while we connect an FPGA on the receiver side and measure the signal jitter using a TDC. We can indeed show sufficient side-channel leakage in the jitter of the signal by performing a key recovery of an AES accelerator running on the transmitter. Furthermore, we compare this leakage to a power side channel also measured with a TDC and prove that the timing jitter alone contains sufficient side-channel information. While for an on-chip power analysis attack about 27k traces are needed for key recovery, our cross-device jitter-based attack only needs as few as 47k traces, depending on the setup. Galvanic isolation does not change that significantly. That is an increase by only 1.7x, showing that fine-grained jitter timing information can be a very potent attack vector even under galvanic isolation. In summary, we introduce a new side-channel attack vector that can leak information in many presumably secure systems. Communication channels can inadvertently leak information through tiny timing variations, known as signal jitter. This could affect millions of devices and needs to be considered.

show abstract

Section: Jitter and Its Measurementmentioning

confidence: 93%

Section: Jitter and Its Measurementmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

JitSCA: Jitter-based Side-Channel Analysis in Picoscale Resolution

Schoos,

Meschkov,

Tahoori

et al. 2023

TCHES

View full text Add to dashboard Cite

show abstract

“…The clock-based IDS proposed in [3] uses the periodical nature of many CAN messages to detect anomalies as well as to fingerprint ECUs. The scheme proposed in [47] measures devicespecific delay time as a mechanism for anomaly detection. In particular, the delay is measured with a resolution that is implemented on FPGAs as measurement using software may miss messages when processing.…”

Section: A Intrusion Detection System For Canmentioning

confidence: 99%

A Binarized Neural Network Approach to Accelerate in-Vehicle Network Intrusion Detection

Zhang

Yan

2022

IEEE Access

View full text Add to dashboard Cite

Controller Area Network (CAN) is the de facto standard for in-vehicle networks. However, it is inherently vulnerable to various attacks due to the lack of security features. Intrusion detection systems (IDSs) are considered effective approaches to protect in-vehicle networks. IDSs based on advanced deep learning algorithms have been proposed to achieve higher detection accuracy. However, those systems generally involve high latency, require considerable memory space, and often result in high energy consumption. To accelerate intrusion detection and also reduce memory and energy costs, we propose a new IDS system using Binarized Neural Network (BNN). Compared to full-precision counterparts, BNNs can offer faster detection, smaller memory cost, and lower energy consumption. Moreover, BNNs can be further accelerated by leveraging Field-Programmable Grid Arrays (FPGAs) since BNNs cut down the hardware consumption. The proposed IDS is based on a BNN model that suits CAN traffic messages and takes advantage of sequential features of messages rather than each individual message. We also explore various design choices of BNN, including increasing network width and depth, to improve accuracy as BNNs typically sacrifice accuracy. The performance of our IDS is evaluated with four different real vehicle datasets. Experimental results show that the proposed IDS reduces the detection latency (3 times faster) on the same CPU platform while maintaining acceptable detection rates compared with full-precision models. We also examine the proposed IDS on multiple platforms, and our results show that using FPGA hardware reduces the detection latency dramatically (128 times faster) with lower power consumption compared to an embedded CPU device. Furthermore, we evaluate BNNs with different designs. Our experimental results demonstrate that wider or deeper models definitely improve accuracy at the cost of increased latency and model sizes to varying degrees. Applications are recommended to choose the appropriate model design they need depending on available resources they have.

show abstract

“…An IDS on a CAN bus dynamically analyzes characteristics of CAN messages and detects an intrusion if it finds anomalies. Many features have been proposed for this purpose (6), such as CAN voltage levels (7,8), signal propagation time (9), and bit time (10,11). We focus on methods that rely on the timestamp of CAN messages (4,5), which have the advantages of being passive and not requiring hardware other than a CAN receiver for monitoring in-vehicle signals.…”

Section: Introductionmentioning

confidence: 99%

A Model for CAN Message Timestamp Fluctuations to Accurately Estimate Transmitter Clock Skews

Gay,

Matsumoto

2024

IJAE

View full text Add to dashboard Cite

Modern in-vehicle networks may contain tens of Electronic Control Units (ECUs) connected over several Controller Area Network (CAN) buses. To protect vehicles from cyberattacks, researchers have proposed various security countermeasures, including intrusion detection systems (IDS). Because real clock sources are imperfect, ECUs transmit messages with a period slightly different from the ideal period. This difference is referred to as clock skew, and previous research suggests that IDS may detect anomalies when they observe that an ECU transmits periodic CAN messages with a different clock skew than expected. We argue that previously proposed approaches rely on an incomplete model and may yield inaccurate results when applied to a real vehicle. This is problematic for automotive technologies, which must be reliably deployed in millions of safety-critical systems. We propose an improved model for the fluctuations of CAN message timestamps and apply it to a real vehicle, where we are able to improve the accuracy of ECU clock skew estimations.

show abstract

PLI-TDC: Super Fine Delay-Time Based Physical-Layer Identification with Time-to-Digital Converter for In-Vehicle Networks

Cited by 10 publications

References 19 publications

JitSCA: Jitter-based Side-Channel Analysis in Picoscale Resolution

JitSCA: Jitter-based Side-Channel Analysis in Picoscale Resolution

A Binarized Neural Network Approach to Accelerate in-Vehicle Network Intrusion Detection

A Model for CAN Message Timestamp Fluctuations to Accurately Estimate Transmitter Clock Skews

Contact Info

Product

Resources

About