Vehicle ECU Message Authentication for Secure Counter Synchronization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vehicle control systems lack effective methods to ensure secure and reliable communication synchronization among electronic control units (ECUs) in vehicles, particularly in the presence of potential attacks from malicious third parties, which can lead to disabled vehicle functions.
Innovation Solution
Implementing a message authentication code (MAC) system using trip and reset counters to authenticate messages exchanged between ECUs, ensuring synchronization is confirmed without relying solely on trip counters, and enabling secure communication by verifying freshness values and shared keys, thereby enhancing resistance to attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If message authentication using trip counters is implemented, then security against malicious attacks is improved, but system complexity increases due to synchronization requirements among ECUs
Solution Approach 1:
The authentication system is segmented into multiple independent counter types (trip counters, reset counters, freshness values) that can be selectively used. This allows the system to divide the authentication mechanism into manageable parts, reducing overall complexity while maintaining security through layered verification approaches.
Solution Approach 2:
The system performs preliminary synchronization checks and counter validations before main authentication operations. By pre-verifying counter values and synchronization status, the system avoids complex real-time synchronization during critical authentication moments, thereby reducing operational complexity.
2Reliability
If synchronization confirmation is performed among ECUs, then communication reliability is improved, but processing time increases due to additional verification steps
Solution Approach 1:
The system performs partial synchronization verification by checking only critical counter values (such as reset counters or freshness values) rather than all possible parameters. This selective verification approach maintains communication reliability for essential functions while reducing the time penalty associated with comprehensive synchronization checks.
Solution Approach 2:
The patent introduces intermediary counter values (reset counters, freshness values) that mediate between ECUs to confirm synchronization. These intermediaries provide quick verification markers that reduce the time required for direct ECU-to-ECU synchronization negotiations, thereby maintaining reliability with reduced processing time.
3Reliability
If multiple counter types are used for authentication, then resistance to attacks is improved, but device complexity increases due to additional counters and verification logic
Solution Approach 1:
Different counter types (trip counters, reset counters, freshness values) are assigned to different authentication contexts and security requirements. Critical authentication paths use more robust counter verification, while less sensitive paths use simpler checks. This localized quality approach enhances attack resistance where needed without uniformly increasing complexity across all system operations.
Solution Approach 2:
The system dynamically changes authentication parameters by selecting which counter types to verify based on the specific communication context and security requirements. This allows the device to adapt its complexity level - using multiple counter types when high security is needed and fewer counters during routine operations, thereby balancing attack resistance with device complexity.
Data Source
AI summary
A system includes a plurality of in-vehicle devices and having a function of determining abnormality of communication in the devices by authenticating a message including data, a first counter counted each time a power source is turned on, and a second counter incremented over time. The system includes an authentication unit for performing, when a message including control data to be exchanged between the devices is authenticated, authentication on a message sent and received between the devices and including at least the control data and the first counter by using at least the control data and the first counter, in which when it is confirmed whether synchronization is achieved between the devices, the authentication unit is for performing authentication on a message sent and received between the devices and not including the first counter but including the second counter by using the second counter without using the first counter.