CANSentry: Securing CAN-Based Cyber-Physical Systems against Denial and Spoofing Attacks

Abstract

The Controller Area Network (CAN) has been widely adopted as the de facto standard to support the communication between the ECUs and other computing components in automotive and industrial control systems. In its initial design, CAN only provided very limited security features, which is seriously behind today’s standards for secure communication. The newly proposed security add-ons are still insufficient to defend against the majority of known breaches in the literature. In this paper, we first present a new stealthy denial of service (DoS) attack against targeted ECUs on CAN. The attack is hardly detectable since the actions are perfectly legitimate to the bus. To defend against this new DoS attack and other denial and spoofing attacks in the literature, we propose a CAN firewall, namely CANSentry, that prevents malicious nodes’ misbehaviors such as injecting unauthorized commands or disabling targeted services. We implement CANSentry on a cost-effective and open-source device, to be deployed between any potentially malicious CAN node and the bus, without needing to modify CAN or existing ECUs. We evaluate CANSentry on a testing platform built with parts from a modern car. The results show that CANSentry successfully prevents attacks that have shown to lead to safety-critical implications.

A Proof of Theorem 2

Theorem 2

Let $I_{m}$ be the lowest arbitration ID accepted by DFA M, any (partial) ID output from M cannot win arbitration against a target ID $I_t$ that has higher priority than $I_m$ (i.e., $I_t<I_m$).

Proof

Assume that the adversary attempts to spoof arbitration ID $I_s$ ($I_s<I_t$) to win against $I_t$. Let Bit(S, i) be the i-th bit of string S. If the longest common prefix of $I_m$, $I_s$, and $I_t$ is an i-bit string P, then the first i bits of $I_s$ would be accepted in M (since $Prefix(I_s, i)=Prefix(I_m, i)$) and sent to CAN accordingly. $I_t$ and $I_s$ would tie in the first i bits of arbitration (since $Prefix(I_s, i)=Prefix(I_t, i)$). At bit $i+1$, we have the following three conditions:

• If $Bit(I_s, i+1)<Bit(I_m, i+1)$, $I_s$ will be rejected by M, since: (1) $I_s$ cannot be accepted by the DFA branch that contains $I_m$, since $Bit(I_s, i+1)\ne Bit(I_m, i+1)$; (2) if there exist another DFA branch (with ID $I_n$) that accepts $Bit(I_s, i+1)$, then we have $I_n<I_m$ (since they are identical in the first i bits and $I_n<I_m$ at bit $i+1$). This violates our assumption that $I_{m}$ be the lowest arbitration ID accepted by M. Therefore, such $I_n$ and the corresponding DFA branch does not exist. $I_s$ will be rejected by M, and $I_t$ wins arbitration against $I_s$.

• If $Bit(I_s, i+1)>Bit(I_m, i+1)$, then we have $I_s>I_m$, since they are identical in the first i bits and $I_s>I_m$ at bit $i+1$. This violates our assumption that $I_s<I_t<I_m$.

• If $Bit(I_s, i+1)=Bit(I_m, i+1)$, then $Bit(I_s, i+1)$ will be sent to the bus. Meanwhile, we need $Bit(I_s, i+1)\ne Bit(I_t, i+1)$, otherwise $Prefix(I_s, i+1)$ is a longer common prefix than P. In case $Bit(I_s, i+1)> Bit(I_t, i+1)$, $I_s$ would lose arbitration against $I_t$. In case $Bit(I_s, i+1)<Bit(I_t, i+1)$, then we have $I_m=I_s<I_t$. This violates our assumption that $I_t<I_m$.

In summary, with the existence of M, any (partial) output generated by $I_s<I_m$ cannot win arbitration against a higher priority ID $I_t<I_m$.    $\square$