Automated CAN Message Translation Without Proprietary DBC Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing automotive cybersecurity measures are inadequate for scalable and automated reverse-engineering of Controller Area Network (CAN) bus data, limiting the ability to identify and address vulnerabilities in vehicle systems, and current security through obscurity paradigms are inefficient against CAN injection attacks.
Innovation Solution
The LibreCAN translator system, comprising three phases: signal extraction and alignment (Phase 0), message translation (Phase 1), and message identification (Phase 2), uses smartphone sensors and OBD-II data to automatically translate and reverse-engineer CAN messages, identifying vehicle parameters and functions without requiring proprietary DBC files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual reverse-engineering of CAN bus protocol is used, then attack precision is improved, but productivity deteriorates due to tedious process and lack of scalability
Solution Approach 1:
The system enables automated self-service by having the LibreCAN translator automatically reverse-engineer CAN bus protocols without requiring manual intervention. The tool autonomously analyzes CAN messages, extracts signal definitions, and generates translated output, replacing the previously manual reverse-engineering process and enabling scalable vulnerability research.
2Measurement precision
If proprietary DBC files are used for CAN message translation, then measurement precision is improved, but adaptability deteriorates due to OEM-proprietary and model-specific limitations
Solution Approach 1:
The system creates a universal copy mechanism that replicates the functionality of proprietary DBC files without requiring the actual proprietary files. The LibreCAN translator generates translated CAN messages by copying the structure and semantics of vehicle-specific protocols into a standardized format, enabling cross-OEM compatibility and model independence while maintaining translation accuracy.
3Reliability
If security through obscurity paradigm is used, then reliability is improved, but device complexity deteriorates due to outdated and infeasible security measures
Solution Approach 1:
The system replaces the outdated mechanical security approach (security through obscurity relying on secret DBC files) with an automated software-based translation mechanism. The LibreCAN translator uses algorithmic reverse-engineering and cross-correlation analysis to translate CAN messages, substituting the need for secret proprietary files with a transparent, automated process that maintains security while reducing architectural complexity.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
One commonality among most vehicular security attacks reported to date is that they ultimately require write access to the CAN bus. In order to cause targeted and intentional changes in the vehicle behavior, malicious CAN injection attacks require knowledge of the CAN message format. However, since this format is proprietary to OEMs and can differ even among different models of a single make of vehicle, one must manually reverse-engineer the CAN message format of each vehicle they target. To mitigate this difficulty, an automated CAN message translator is presented.