Selective MAC Authentication for CAN Network Security

Solution Overview

Problem

Current CAN network systems face high processing loads due to performing MAC authentication on every frame, including both legitimate and potentially malicious ones, which can lead to delays and inefficiencies, especially when attacks are not detected.

Innovation Solution

Implement a communication method where MAC authentication is only performed on frames with IDs that have been detected as under attack, using a report frame to update authentication flags and transmit authentication information only for affected IDs, thereby reducing unnecessary authentication processing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If MAC authentication is performed on every frame received by each device, then network security is improved, but processing load and time consumption increase significantly

Engineering Contradiction:

Improvenetwork securityVSAvoidprocessing efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent applies local quality by making authentication processing selective rather than universal. Each communication device maintains a local attack detection result that determines whether authentication is performed on incoming frames. Only frames from IDs flagged as attack sources undergo MAC verification, while normal frames are processed without authentication overhead, creating localized security enforcement at specific network points rather than system-wide application.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent implements partial action by performing MAC authentication only on a subset of frames identified as potential attack vectors. Instead of applying authentication to all frames (excessive action), the system selectively applies it only to frames from IDs that have been detected as attack sources, reducing unnecessary processing while maintaining security against identified threats.

Inventive Principle:

Principle #16Partial or excessive action

2Reliability

If authentication processing is performed on all frames including legitimate ones, then unauthorized access is prevented, but processing delays occur for normal communication

Engineering Contradiction:

Improveaccess controlVSAvoidcommunication delay

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies local quality by making authentication processing selective rather than universal. Each communication device maintains a local attack detection result that determines whether authentication is performed on incoming frames. Only frames from IDs flagged as attack sources undergo MAC verification, while normal frames are processed without authentication overhead, creating localized security enforcement at specific network points rather than system-wide application.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent implements partial action by performing MAC authentication only on a subset of frames identified as potential attack vectors. Instead of applying authentication to all frames (excessive action), the system selectively applies it only to frames from IDs that have been detected as attack sources, reducing unnecessary processing while maintaining security against identified threats.

Inventive Principle:

Principle #16Partial or excessive action

3Reliability

If all devices transmit and receive authentication information for every frame, then security verification is comprehensive, but network load increases

Engineering Contradiction:

Improveauthentication coverageVSAvoidnetwork traffic volume

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent applies local quality by making authentication processing selective rather than universal. Each communication device maintains a local attack detection result that determines whether authentication is performed on incoming frames. Only frames from IDs flagged as attack sources undergo MAC verification, while normal frames are processed without authentication overhead, creating localized security enforcement at specific network points rather than system-wide application.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent extracts the authentication requirement from the general frame processing flow and applies it only to specific cases. By separating authentication processing from normal frame handling and applying it only to frames from detected attack sources, the system removes unnecessary authentication traffic from legitimate communication while maintaining security verification where needed.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS10270768B2Communication system, communication method, and communication device

Publication Date: 2019.04.23 FUJITSU LTD

AI summary

A communication system includes a first communication device that determines, using identification information on a frame, whether to receive the frame, and a second communication device that belongs to a network identical to the first communication device. A report frame includes a detection of an attack on the network and target identification information that is identification information included in a frame used to perform the attack. When the first communication device receives a report frame from the second communication device, the first communication device sets the frame including the target identification information to be an authentication processing target. Upon transmitting a transmission frame set to be the authentication processing target, the first communication device transmits authentication information generated from the transmission frame along with the transmission frame.