Broadcast Bus Message Authentication via Identifier Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Broadcast bus networks lack intrinsic security measures to authenticate messages, making them vulnerable to unauthorized messages and attacks, especially in less secure environments, and existing solutions like message authentication codes incur significant computational and communication overhead.
Innovation Solution
A communication apparatus with a network monitoring unit, comparing unit, and message destroyer is implemented to detect and prevent unauthorized messages by using exclusive message identifiers and altering the message body to mark it as erroneous, leveraging the CAN bus's non-destructive bitwise arbitration mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If message authentication codes or digital signatures are appended to transmitted messages, then security and authenticity of messages is improved, but computational overhead and communication overhead increase significantly
Solution Approach 1:
The system pre-assigns exclusive message identifiers to each node during network initialization. This preliminary action eliminates the need for runtime authentication computations, as nodes can immediately verify message authenticity by checking whether the message identifier matches the pre-assigned exclusive identifier of the sending node.
Solution Approach 2:
The invention extracts the authentication function from complex cryptographic operations and implements it through simple identifier verification. By separating the authentication mechanism from the message content and using dedicated exclusive identifiers, the system achieves security without the computational burden of traditional authentication methods.
2Reliability
If message authentication codes or digital signatures are appended to transmitted messages, then security and authenticity of messages is improved, but communication overhead increases due to larger message size
Solution Approach 1:
The authentication mechanism is extracted from the message content itself. Instead of appending authentication data to messages, the system uses dedicated exclusive message identifiers that are inherently part of the message structure, eliminating the need for additional authentication fields and reducing communication overhead.
Solution Approach 2:
The system uses lightweight message identifiers as disposable authentication tokens. These identifiers are simple, easy to transmit, and provide sufficient authentication capability without the complexity and size of traditional authentication codes, thus minimizing communication overhead.
3Reliability
If cryptographic measures are implemented in all nodes of the broadcast bus network, then security is improved, but device complexity and cost increase
Solution Approach 1:
The system implements security with local quality by assigning each node a specific exclusive message identifier tailored to its role and communication patterns. Nodes only need to verify messages with their assigned identifiers rather than implementing general-purpose cryptographic verification, simplifying the device complexity while maintaining security.
Solution Approach 2:
The invention changes the authentication parameter from complex cryptographic operations to simple identifier matching. By transforming the authentication mechanism into a parameter-based verification system using exclusive message identifiers, the system reduces node implementation complexity while preserving security guarantees.
4Reliability
If traditional authentication methods are used, then message authenticity is verified, but authentication delays occur which are unacceptable in critical applications
Solution Approach 1:
Authentication credentials (exclusive message identifiers) are established in advance during network initialization. This preliminary action allows nodes to perform immediate verification of incoming messages without any runtime authentication computation, eliminating authentication delays entirely and enabling real-time critical applications.
Solution Approach 2:
The invention replaces the mechanical cryptographic verification process with a simpler identifier matching mechanism. This substitution eliminates the computational steps required for traditional authentication methods, reducing authentication time to minimal processing delays and making the system suitable for time-critical applications.
Data Source
AI summary
A communication apparatus for preventing the broadcasting of unauthorized messages on a broadcast bus network, the communication apparatus comprising:a first memory adapted to store first information;a second memory adapted to store second information;a monitoring unit adapted to:monitor the bus for processing messages being broadcasted on the bus, andoutput a third information and fourth informationa comparing unit adapted to compare the first information with the third information and the second information with the fourth information; and,a message destroyer adapted to:when:the first information matches with the third information, andthe second information does not match with the fourth information, causing the body of the current message to be altered while the current message is being broadcasted on the bus.