Protected Message Reproduction for Counter-Synced ECU Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge in bus simulation for testing control devices is that secured messages with monotonically increasing counter values and authentication codes cannot be easily replayed due to authentication and encryption algorithms, preventing correct message playback and authentication testing, especially when counter values mismatch between different bus systems.
Innovation Solution
A playback unit manipulates recorded messages by generating new counter values and authenticators using a communication description and encryption information, allowing secure messages to be accepted by receiver devices, even when counter values and authenticators are outdated, by separating message components and recalculating them based on current values and algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secured messages with monotonically increasing counter values and authentication codes are recorded for playback, then message security and authentication are improved, but message playback capability deteriorates because counter values mismatch between recorded data and receiver control units
Solution Approach 1:
The playback unit pre-processes recorded secured messages by extracting the payload and separating it from the original counter value and authenticator before playback. This preliminary separation allows the system to later generate new authentication data matching the receiver's current counter value, enabling successful playback while maintaining security.
Solution Approach 2:
The secured message is divided into distinct components: payload data, counter value, and authenticator. The playback unit selectively processes these segments by preserving the payload while regenerating the authentication elements (counter value and authenticator) to match the receiver control unit's current state, thus resolving the playback incompatibility.
2Ease of operation
If authentication is disabled in the receiver ECU to enable playback of recorded messages, then message playback capability is improved, but authentication testing capability deteriorates
Solution Approach 1:
The playback unit acts as an intermediary that generates forged but valid-appearing secured messages with updated counter values and authenticators. These intermediary messages allow playback to proceed while the receiver ECU's authentication mechanism remains active and functional, enabling both playback and authentication testing simultaneously.
3Ease of operation
If the authenticator value is regenerated using a different counter value, then message playback compatibility is improved, but message authentication validity deteriorates because the encrypted authenticator no longer matches the original counter value
Solution Approach 1:
The playback unit changes the counter value parameter from the recorded message to match the receiver control unit's current counter value. It then uses this new counter value along with the original payload to regenerate a new authenticator through the same authentication algorithm, ensuring the regenerated message is both playable and authentically valid.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and reproduction unit (D) for sending protected messages via a communication system to a receiver device to be tested, wherein the reproduction unit is connected via the communication system to the device to be tested, wherein the reproduction unit is configured to receive first protected messages to be reproduced, to remove a first counter value (Z) and a first authenticator (MAC) from the first protected messages, and to use a second counter value, an encryption algorithm and a key to generate a second authenticator, and wherein the reproduction unit is configured to add the second counter value and the second authenticator to the first messages in order to generate second protected messages, and wherein the reproduction unit is further configured to send the second protected messages via the communication system to the receiver device to be tested.