CAN Fuzzing Apparatus for Targeted ECU Vulnerability Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing CAN fuzzing technologies are inefficient due to the time-consuming process of transmitting random input values and the difficulty in monitoring the response of specific ECUs in a shared CAN environment.
Innovation Solution
A CAN fuzzing apparatus and method that identifies a target CAN ID based on a PID code, calculates a bit flip rate for each bit in the CAN message, detects unused and sensor fields, generates fuzzing CAN messages by inputting preset values into these fields, and monitors the response of the ECU.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional CAN fuzzing technology transmits random input values through CAN communication, then vulnerability checking of ECU is performed, but the process takes a huge amount of time and it is difficult to monitor the response of a specific ECU
Solution Approach 1:
The patent segments the CAN message data field into multiple sub-fields (first sub-field, second sub-field, third sub-field, fourth sub-field) and systematically fuzzes each segment separately. This segmentation allows targeted vulnerability testing of specific ECU functions without transmitting complete random messages, significantly reducing the total number of messages needed while maintaining comprehensive vulnerability checking capability.
Solution Approach 2:
The patent changes the fuzzing approach from random value generation to systematic parameter variation. By identifying specific sub-fields that correspond to particular ECU functions and varying only those parameters while keeping other fields constant, the method reduces the fuzzing space from 2^64 possible messages to a manageable subset, thereby reducing time consumption while maintaining reliability.
2Reliability
If conventional CAN fuzzing technology transmits random input values through CAN communication, then vulnerability checking of ECU is performed, but it is difficult to monitor the response of a specific ECU in a shared communication channel environment
Solution Approach 1:
The patent segments the CAN message into distinct sub-fields and associates each with specific ECU functions. By targeting specific sub-fields, the system can isolate and monitor responses from particular ECUs in the shared communication channel, making it easier to detect and measure ECU responses without interference from other ECUs.
Solution Approach 2:
The patent uses the structured sub-field decomposition as an intermediary mechanism to facilitate selective monitoring. By organizing the data field into identifiable sub-fields with known meanings, the system creates a mediator that enables precise tracking of which ECU is responding to which message, simplifying the detection of specific ECU responses in the shared channel.
3Adaptability or versatility
If conventional CAN fuzzing technology generates 2^64 fuzzing CAN messages by inputting arbitrary values into data field, then comprehensive coverage is achieved, but the time required for fuzzing becomes huge
Solution Approach 1:
The patent divides the 64-bit data field into four 16-bit sub-fields, each corresponding to different ECU functions. Instead of fuzzing all 2^64 possible combinations, the system fuzzes each sub-field independently and systematically, achieving comprehensive coverage of relevant ECU functions with a much smaller message set. This segmentation reduces the fuzzing time while maintaining adaptability to different ECU configurations.
Solution Approach 2:
The patent applies partial action by focusing fuzzing efforts only on the necessary sub-fields that correspond to actual ECU functions, rather than exhaustively fuzzing all possible 64-bit combinations. By identifying and targeting only the relevant portions of the data field, the system achieves sufficient coverage without the excessive time consumption of complete brute-force fuzzing.
Data Source
AI summary
A controller area network (CAN) fuzzing apparatus for a vehicle includes a communication device having a CAN communication interface, and a controller configured to identify a target CAN identifier (ID) to be diagnosed based on a parameter identifier (PID) code, generate a plurality of CAN messages for fuzzing by inputting a preset value into an unused field or a sensor field in a data field of a CAN message corresponding to the target CAN ID, and perform CAN fuzzing based on the plurality of CAN messages for fuzzing.