CAN Diagnostic Session Validation Against Vehicle State Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern vehicles and machinery are vulnerable to diagnostic cyber-attacks through their Controller Area Network (CAN) buses, which can be exploited by malicious actors to disrupt operations or inject harmful software updates.
Innovation Solution
A method and device are introduced to secure machinery by enforcing a diagnostic policy that maps diagnostic requests and their sub-functions to associated vehicle states, using a table to validate compatibility. When an incompatible diagnostic request is detected, an interfering diagnostic request is initiated to mitigate the attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If diagnostic requests are allowed on CAN bus without state validation, then diagnostic operations can be performed freely, but the system becomes vulnerable to cyber attacks and harmful operations
Solution Approach 1:
The system performs preliminary validation of diagnostic requests against a policy table before executing them. The policy table pre-defines which diagnostic functions are allowed in which vehicle states, so validation occurs in advance rather than reacting to attacks after they occur.
Solution Approach 2:
A policy table acts as an intermediary layer between diagnostic requests and ECU execution. This table stores predefined rules mapping diagnostic functions to allowed vehicle states, serving as a mediator that filters and validates requests before they reach the ECUs.
2Reliability
If a policy validation system is implemented, then cyber attacks are detected and mitigated, but the system complexity increases due to policy tables and validation logic
Solution Approach 1:
The policy validation system is implemented within the ECU itself, allowing each ECU to autonomously validate incoming diagnostic requests against its own policy table. This self-service approach distributes the validation logic across multiple ECUs rather than requiring a centralized complex validation system.
3Reliability
If interfering diagnostic requests are sent in response to invalid requests, then attacks are mitigated by forcing ECU reset, but normal diagnostic operations may be disrupted
Solution Approach 1:
The system applies preliminary anti-action by sending interfering diagnostic requests in response to detected invalid requests. This counter-action forces the ECU to reset or abort the malicious operation before it can cause harm, proactively neutralizing the threat rather than reacting after damage occurs.
Data Source
AI summary
The disclosure is of a device and a method of securing machinery supporting controller area network protocol from diagnostics based attacks, by enforcing a diagnostic policy mapping diagnostics requests and their sub-function to associated vehicle states, for example by using a table of diagnostic function identifiers and associated valid vehicle states. When a diagnostic request and Sub-Function are marked valid for the vehicle state, the diagnostic operation is valid. When a diagnostic request and Sub-Function are marked not valid for the vehicle state, the diagnostic operation is not valid, and aborted.