CAN Transceiver Throttle Logic for Denial of Service Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In-vehicle CAN bus networks are vulnerable to denial of service attacks, particularly through message flooding, which prevents other nodes from sending messages due to high-priority message bursts.
Innovation Solution
A method and device that decode CAN message identifiers, calculate weighted values based on priority, and throttle transmissions if the weighted value exceeds a threshold, using a CAN transceiver integrated circuit with throttle logic to stop or slow down message transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If high-priority CAN messages are allowed to transmit freely, then message priority and responsiveness are improved, but the network becomes vulnerable to denial of service attacks through message flooding
Solution Approach 1:
The throttle logic continuously monitors the running weighted value of transmitted messages and dynamically adjusts transmission based on feedback from this metric. When the running weighted value approaches the threshold, transmission is throttled, creating a closed-loop control system that prevents flooding while maintaining priority-based communication
Solution Approach 2:
The system changes the parameter of message transmission rate dynamically based on the running weighted value. By adjusting the transmission parameter (allowing or blocking messages) based on the calculated weighted sum, the system adapts to prevent denial of service attacks while maintaining normal high-priority communication
2Reliability
If throttling is applied to prevent message flooding, then network security is improved, but normal high-priority message transmission may be delayed
Solution Approach 1:
The weighting function applies different weights to different message priorities locally. High-priority messages receive higher weights that cause the running weighted value to reach the threshold faster, triggering earlier throttling. This local differentiation ensures that throttling protects against flooding while preserving time-critical high-priority message transmission
Solution Approach 2:
The throttling mechanism is dynamic rather than static. The system continuously calculates the running weighted value and adjusts transmission permissions in real-time based on current network conditions. This dynamic approach allows normal high-priority traffic to pass through with minimal delay while preventing coordinated flooding attacks
3Difficulty of detecting and measuring
If a running weighted value threshold system is implemented, then denial of service attack detection is improved, but device complexity increases
Solution Approach 1:
The CAN decoder and throttle logic work together in a self-service manner where the decoder provides decoded message data and the throttle logic autonomously calculates weighted values, accumulates the running sum, and makes transmission decisions. This self-contained approach improves attack detection while managing complexity through integrated functionality
Solution Approach 2:
The patent merges the CAN decoding functionality with the throttling control logic into an integrated system. By combining these functions and sharing the decoded message data between them, the system achieves effective attack detection without proportionally increasing overall device complexity
Data Source
AI summary
Embodiments of a device and method are disclosed. In an embodiment, a method for controlling CAN traffic is disclosed. The method for controlling CAN traffic involves decoding bits of an identifier of a CAN message from a TXD path, obtaining a weighted value using the decoded bits of the identifier, adding the weighted value to a running weighted value for received CAN messages, and throttling transmission of CAN messages via the TXD path if the running weighted value exceeds a pre-established threshold.