In-Vehicle Network Anti-Fraud via MAC Key Update
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing in-vehicle network systems using the CAN protocol face challenges in effectively resisting brute-force attacks and handling fraudulent frame transmissions due to limitations in data length for message authentication codes (MAC), which can lead to potential malicious control of vehicle systems.
Innovation Solution
An anti-fraud method and system that includes fraud-sensing electronic control units (ECUs) capable of verifying message authentication codes and updating MAC keys, ensuring secure transmission by detecting and mitigating fraudulent frames within the in-vehicle network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a message authentication code (MAC) is added to the data field in a CAN frame to prevent fraudulent control, then authentication capability is improved, but the data length available for MAC storage is insufficient, making the system vulnerable to brute-force attacks
Solution Approach 1:
The patent moves the MAC storage from the data field (one-dimensional constraint) to the identifier field, utilizing the extended ID space in CAN 2.0B protocol. This dimensional shift allows storing a 32-bit MAC in the identifier field instead of being constrained by the limited data field space, thereby preventing brute-force attacks while maintaining authentication capability.
Solution Approach 2:
The patent changes the parameter of MAC length from the conventional short length to 32 bits, and changes the storage location parameter from data field to identifier field. These parameter changes enable the MAC to be sufficiently long to resist brute-force attacks while fitting within the CAN frame structure.
2Object-affected harmful factors
If a 32-bit MAC is stored in the identifier field to resist brute-force attacks, then security against brute-force attacks is improved, but compatibility with existing CAN systems may deteriorate
Solution Approach 1:
The patent implements a dynamic approach where the system can operate in different modes: using the full 32-bit MAC for enhanced security when needed, or using a shortened MAC version for backward compatibility with existing systems. This dynamic adaptability allows the system to balance security requirements with compatibility constraints.
Solution Approach 2:
The patent segments the 32-bit MAC into different usable portions. The full 32-bit MAC provides maximum security, while a shortened version (e.g., using only part of the identifier field) can be used for compatibility with legacy systems. This segmentation allows flexible deployment based on specific system requirements.
3Reliability
If message authentication is implemented in the in-vehicle network, then fraud detection capability is improved, but the complexity of the communication protocol increases
Solution Approach 1:
The patent makes the identifier field serve multiple functions: it continues to identify the message source and type as in traditional CAN, while simultaneously storing the 32-bit MAC for authentication. This multi-functionality eliminates the need for separate authentication fields, thereby reducing protocol complexity while maintaining fraud detection capability.
Solution Approach 2:
The authentication mechanism uses the existing CAN frame structure and identifier field without requiring additional hardware or external authentication services. The MAC is generated and verified using the same ECU resources that handle normal communication, making the system self-sufficient and avoiding added complexity from external authentication infrastructure.
Data Source
Figure 1
Figure 2
Figure 3~5
AI summary
An anti-fraud method for use in an in-vehicle network system including a plurality of electronic control units that exchange data frames, each having added thereto a MAC, via a bus includes a receiving step of receiving a data frame transmitted on the bus, a verification step of generating a MAC by using data and verifying that the data frame received in the receiving step has added thereto the MAC, and an update processing step of performing an update process on the data used for generating the MAC in a case where verification has failed in the verification step.