Dynamic CAN Message Authentication via Time-Dependent Key Splitting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional in-vehicle systems using fixed keys for CAN message authentication are vulnerable to attacks, as the fixed key can be cracked, compromising the security of the in-vehicle network.
Innovation Solution
A communication method that generates an authentication key based on a shared key and a time segment value using a block encryption algorithm, allowing for secure encryption and authentication of CAN messages without additional load, by broadcasting a Global Sessional Number (GSN) to all ECUs and using it to create a unique authentication key for each time segment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a fixed key is used for CAN message authentication, then the authentication process is simple, but the security is weak and the fixed key is likely to crack
Solution Approach 1:
The patent transforms the static fixed key into a dynamic authentication key that changes with each time segment. The authentication key is generated by combining a shared key with a time segment value (GSN) using a block encryption algorithm, making the key dynamic and time-dependent. This resolves the contradiction by maintaining operational simplicity while significantly improving security through key dynamism.
Solution Approach 2:
The patent changes the parameter of the authentication key from fixed to variable. By introducing the time segment value (GSN) as a changing parameter and using block encryption algorithms, the authentication key becomes time-dependent and unique for each time segment. This parameter change enables both simple authentication processes and enhanced security resistance against cracking.
2Reliability
If encryption and authentication are performed on CAN messages, then information transmission security is improved, but the message load increases
Solution Approach 1:
The patent merges the authentication key generation process with the existing CAN message transmission framework. The authentication key is derived from the shared key and time segment value that are already part of the system architecture, avoiding the need for separate key transmission channels. This merging approach enhances security while avoiding additional message load.
Solution Approach 2:
Each ECU autonomously generates its own authentication key using the shared key and the broadcast time segment value through block encryption. This self-service mechanism eliminates the need for key distribution messages between ECUs, achieving enhanced security without increasing message load.
3Reliability
If a time segment value is broadcast to all ECUs for authentication key generation, then security against replay attacks is improved, but the system complexity increases
Solution Approach 1:
The patent implements periodic action by dividing time into segments and broadcasting a new time segment value (GSN) at the beginning of each time segment. This periodic update mechanism provides resistance against replay attacks, as old authentication keys become invalid after each time segment. The block encryption algorithm ensures that each time segment generates a unique authentication key, achieving security without excessive system complexity.
Data Source
Figure 1
Figure 2
Figure 3~5
AI summary
This application discloses a communication method and an electronic device, and belongs to the field of vehicle-mounted communications technologies, to improve information transmission security. The method includes: determining an authentication key based on a first value and a shared key; splitting the authentication key to obtain a first key and a second key; assembling a CAN frame by using the first key and the second key, where the first key is used to encrypt a valid data payload, and the second key is used to randomize a location of a CRC bit in a data payload field; and sending the CAN frame to a second ECU through a CAN bus, where the first value is a value broadcast by a manager based on a time segment, and the shared key is a key shared by all ECUs in a vehicle. The method is used to perform authentication on a CAN message sent between electronic control units ECUs in an in-vehicle system.