Divided MAC Authentication for Low-Latency CAN Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing message authentication code (MAC) methods in vehicle controller area networks (CAN) face challenges in reducing latency and increasing reliability, particularly in applications sensitive to latency like vehicle brakes and airbags, due to limited space in CAN frames for MAC data and difficulty in applying these methods to critical systems.
Innovation Solution
A method and apparatus for transmitting and receiving messages using divided message authentication codes (MACs) in CAN, where MAC data is periodically or aperiodically divided and sequentially inserted into multiple frames, allowing for simultaneous transmission and accumulation of MAC data for increased reliability, with a controller comprising a message management module, authentication module, and transceiver module to manage and authenticate these divided MACs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If general MAC data is inserted into the CAN frame, then message authentication is achieved, but the size of the CAN data is reduced to less than half of the maximum 64 bits
Solution Approach 1:
The patent divides the 64-bit CAN frame data into multiple subblocks (e.g., first subblock, second subblock, third subblock) and applies different authentication operations to each subblock. This segmentation allows the full 64 bits to be utilized for authentication purposes while maintaining security, resolving the contradiction between authentication reliability and data size utilization.
2Reliability
If MAC method is applied to vehicle CAN, then security is improved, but latency increases making it difficult to apply to critical systems like brakes or air bags
Solution Approach 1:
The patent performs authentication operations on divided subblocks in parallel or in an optimized sequence, where preliminary authentication checks can be performed on critical data portions without waiting for complete MAC verification. This preliminary action reduces the effective authentication time for latency-sensitive applications while maintaining overall security integrity.
Solution Approach 2:
The patent applies different authentication depths to different data subblocks, performing full authentication on some portions and simplified or skipped authentication on others based on their criticality. This partial action approach reduces overall authentication latency for non-critical data while maintaining security for essential vehicle control messages.
3Reliability
If MAC data is divided and sequentially inserted into multiple CAN frames, then reliability is increased, but device complexity increases
Solution Approach 1:
The patent segments both the data and the authentication process into corresponding subblocks, where each subblock is authenticated independently using the same MAC algorithm. This systematic segmentation reduces the perceived complexity by providing a modular, repeatable authentication pattern that can be implemented through standardized processing steps.
Data Source
AI summary
A method of transmitting K messages using divided message authentication codes (MACs) in a controller area network (CAN) includes: generating a MAC using a first message and a specific MAC, performing a first operation with respect to j using j-th messages subsequent to the first message and a second MAC part of the generated MAC, performing a second operation with respect to j using a result of the performed first operation and a j-th subblock subsequent to a first MAC subblock among K MAC subblocks obtained by dividing a first MAC part of the generated MAC, transmitting the first message along with the first MAC subblock, and transmitting K-1 j-th messages in an order of j, each of the j-th messages being transmitted along with a j-th result of the performed second operation.