CAN Bus-Off Attack Detection Using Arbitration Voltage Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Controller Area Network (CAN) protocols are vulnerable to bus-off attacks that disrupt communication by exploiting error handling mechanisms, leading to nodes being forcibly switched to a bus-off state, which can compromise vehicle safety.
Innovation Solution
A method involving a computing device that monitors CAN messages for voltage levels during arbitration to detect bus-off attacks by comparing voltage levels with preset norms, identifying attacker nodes, and responding with error messages to deactivate them.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If voltage level monitoring during arbitration is implemented to detect bus-off attacks, then attack detection capability is improved, but device complexity increases
Solution Approach 1:
The patent introduces a monitoring node as an intermediary component that specifically watches voltage levels during arbitration phases. This mediator node separates the detection function from normal communication nodes, enabling attack detection without requiring all nodes to become complex detection devices. The monitoring node acts as a specialized observer that triggers alerts when abnormal voltage patterns indicate bus-off attacks.
Solution Approach 2:
The patent monitors changes in voltage level parameters during the arbitration phase of CAN communication. By tracking voltage variations that deviate from expected patterns (such as abnormal dominant bit durations or unexpected voltage levels), the system detects attacks without needing complex analysis. This parameter-based approach transforms a security problem into a measurable physical quantity comparison.
2Loss of time
If real-time voltage level comparison is performed during CAN communication, then attack response time is improved, but energy consumption increases
Solution Approach 1:
The patent implements periodic voltage level sampling specifically during the arbitration phase of CAN messages rather than continuous monitoring. Since arbitration occurs at known intervals in the communication protocol, the monitoring system activates only during these phases, reducing overall energy consumption while maintaining timely attack detection capability when attacks are most likely to manifest.
Solution Approach 2:
The system performs preliminary voltage level comparisons during the arbitration phase before full message transmission begins. By detecting abnormalities early in the communication sequence (during arbitration rather than during data transmission), the system can trigger alerts and responses before the attack fully propagates, reducing response time while limiting energy expenditure to only the critical detection window.
Data Source
AI summary
Disclosed is a method of detecting and responding to an attack, the method being performed by a computing device, the method including: obtaining a Controller Area Network (CAN) message from a bus of a CAN; obtaining a first voltage level based on the CAN message; and comparing the first voltage level with a preset normal voltage level to determine whether there is an attack.