CAN Packet Authentication Using Divided MACs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current MAC methods in vehicle CAN networks are inefficient due to limited space in CAN frames for MAC data, leading to reduced data size and difficulty in applying them to latency-sensitive systems like vehicle brakes or airbags, and they do not provide immediate authentication, causing latency issues.
Innovation Solution
A method involving the division of MACs into parts, performing linear operations between them to generate new authentication MACs, which are then transmitted in a way that allows for efficient authentication using minimal data, effectively doubling the effective MAC size and reducing latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If general MAC data is inserted into the CAN frame, then authentication security is improved, but the size of the CAN data is reduced to less than half of 64 bits and latency increases
Solution Approach 1:
The patent divides a full 64-bit MAC into multiple smaller parts (e.g., two 32-bit parts or four 16-bit parts). These divided MAC parts are transmitted interspersed with message data in the CAN frame, allowing authentication without requiring a continuous large block of space and reducing latency by enabling parallel transmission of message and authentication data.
Solution Approach 2:
The patent merges message data and divided MAC parts together in the same CAN frame transmission. By combining useful message data with authentication data in an interleaved manner, the system achieves both information transmission and authentication simultaneously, improving efficiency and reducing latency.
2Reliability
If general MAC data is inserted into the CAN frame, then authentication security is improved, but the space in the CAN frame is insufficient and data size is reduced
Solution Approach 1:
The patent segments the MAC into smaller parts that can be distributed throughout the CAN frame alongside message data. This segmentation allows the full authentication capability to be achieved without requiring a large contiguous space, effectively utilizing the available 64-bit CAN frame capacity.
Solution Approach 2:
Instead of allocating space sequentially (message data first, then MAC), the patent uses a dimensional approach by interleaving MAC parts throughout the message data in the time/domain dimension. This allows efficient packing of both message and authentication data within the fixed 64-bit frame without reducing overall data throughput.
3Productivity
If divided MAC parts are transmitted interspersed with message data, then authentication efficiency is improved, but the complexity of MAC generation and verification increases
Solution Approach 1:
The patent performs preliminary division of the MAC into parts before transmission. The sender pre-processes the MAC by dividing it into smaller segments and stores them in the appropriate order, making the transmission process straightforward. The receiver similarly pre-prepares by having the capability to extract and reassemble the divided MAC parts in the correct sequence for verification.
Data Source
AI summary
A method and apparatus for authenticating packets in a controller area network (CAN) are disclosed. The method includes transmitting messages using a mixture of message authentication codes (MACs) in a controller area network (CAN). In addition, a first MAC is generated using a first message and the first MAC is divided into a first MAC part and a second MAC part. A second MAC is generated using a second message and the second MAC is divided into a third MAC part and a fourth MAC part. A linear operation is performed between the second MAC part and the third MAC part to generate a first authentication MAC. The first message is transmitted with the first MAC part and the second message is transmitted with the first authentication MAC.