Network Message Translator for Secure CAN FD Transmission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Controller Area Network (CAN) and CAN Flexible Data (FD) protocols lack built-in security features, making it difficult to authenticate nodes, especially in automotive applications where multiple suppliers are involved and security modifications are complex.
Innovation Solution
A network message translator that operates in the physical layer, translating messages from a first frame format to a second frame format with additional security bits, allowing for secure data transmission at a faster bit rate without violating data time window constraints, thereby enabling security features like message authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security features are added to CAN protocol messages, then message authentication capability is improved, but message frame complexity increases
Solution Approach 1:
The patent introduces a translator device as an intermediary component that sits between the host processor and the CAN bus. This translator automatically adds security features (authentication tags, encryption) to messages without requiring modifications to the host processor or other network nodes. The translator mediates between the simple existing message format and the secure communication requirement, resolving the contradiction by centralizing security functionality in a dedicated component rather than complicating the message frames themselves.
Solution Approach 2:
The translator creates copies of original messages and adds security features to these copies before transmitting them on the CAN bus. The host processor continues to operate with simple, unmodified message formats, while the translator generates secure versions for transmission. This copying approach allows security features to be added without increasing the complexity of the original message frames or requiring changes to existing nodes.
2Reliability
If additional security bits are added to messages, then authentication capability is improved, but data transmission time window constraints are violated
Solution Approach 1:
The translator dynamically changes the bit rate parameter during message transmission. It transmits the initial portion of the message (including identifier and control fields) at the standard CAN bit rate to maintain compatibility with time window constraints, then switches to a faster bit rate for transmitting the data portion with security features. This parameter change allows more data bits to be transmitted within the same time window, resolving the contradiction between adding security bits and maintaining time constraints.
Solution Approach 2:
The transmission system transitions from a static, single bit rate mode to a dynamic, multi-rate mode. The translator adjusts the bit rate based on the message phase and content, using faster rates for security-critical data portions and standard rates for compatibility portions. This dynamic adaptation allows the system to accommodate additional security bits without violating the fixed time window constraints of the CAN protocol.
3Reliability
If nodes are modified to include security features, then authentication is improved, but network compatibility and ease of deployment worsen
Solution Approach 1:
The translator serves as an intermediary that centralizes security functionality, allowing security features to be added to the network without modifying existing nodes. Instead of requiring all nodes to be redesigned with authentication capabilities, the translator intercepts messages from unmodified nodes, adds security features, and transmits them securely. This approach dramatically simplifies network deployment, as existing nodes can be deployed as-is and security is added transparently by the translator.
Solution Approach 2:
The translator is designed to work with multiple CAN protocol versions and message formats, providing universal compatibility. It can translate between different frame formats (CAN 2.0, CAN FD), handle various security protocols, and interface with different host processors. This multi-functionality allows the same translator device to be deployed across diverse networks without requiring node-specific modifications, greatly enhancing ease of manufacture and deployment.
Data Source
AI summary
Systems, methods, circuits and computer-readable mediums for a network message translator are disclosed. In an embodiment, a device includes a host processor and a translator. The host processor is configured to process messages and the translator is operable to: receive a first message from the host processor, the first message having a first frame format that is associated with a data time window; translate the first message into a first translated message having a second frame format such that the first translated message includes additional bits based on the second frame format; and sending the first translated message on a bus based on the second frame format such that the first translated message is sent on the bus during the data time window.