Many ideas of IDS for vehicles were already proposed so far. Most of them can only detect anomaly CAN message. Still, they cannot detect which ECU is compromised because any ECUs cannot identify the ECU that sends illegal messages for the specification of CAN protocol. Now we propose the Smart CAN cable that identifies the ECU that sends malicious messages. The Smart CAN cable has two kinds of functions. One is a CAN-IDS. The CAN-IDS identifies an illegal message, and it broadcasts the hash value of the illegal message to CAN-BUS. Another is an identifying module. The identifying module is to memorize hash values of the messages and its sender ECU. When the identifying module receives the hash value from the CAN-IDS, it broadcasts the sender ECU information to CAN-BUS if it finds the hash value in its own memory. We can cut the sender ECU from CAN BUS, control the stream, or handle other workarounds after identifying the sender ECU that sends illegal messages. This paper shows how the Smart CAN cable works, and its advantages and disadvantages.

1. We provide IT total solutions
based on advanced security technologies.
supports your Business
LAC
Kiyotaka ATSUMI, Ryoichi KIDA
IoT Technology Laboratory,
Cyber Grid Japan,
LAC Co., Ltd.
© 2018 LAC Co., Ltd.
Masaya Uwatoko, Narumi HIRAI,
Yuki MIZUNO
NetAgent Co., Ltd.
Smart CAN Cable
Another proposal of intrusion prevention
system (IPS) for in-vehicle networks
Symposium on Cryptography and Information Security,
January 23-26, 2018

2. © 2018 LAC Co., Ltd.
2
SCIS2018 in Niigata
Acknolegement
We thank Alps System Integration Co., Ltd. very much.
This project did not succeed without their helps.

3. © 2018 LAC Co., Ltd.
3
SCIS2018 in Niigata
Outline
1. Background
2. Smart CAN Cable
a) Structure
b) Sequence
c) Performance
3. Discussion
4. Demonstration

4. © 2018 LAC Co., Ltd.
4
SCIS2018 in Niigata
Background
How do we identify an illegal message on CAN BUS so far?
ECU
IPS
ECU ECU
…

Blacklist / Whitelist

Corrupted message

Unlikely message

Irregular message during cyclic messages

Somehow a suspicious message...
OK. Let us assume that IDS can identify the illegal message.
OBD-II
ECU

5. © 2018 LAC Co., Ltd.
5
SCIS2018 in Niigata
Background
How do we intercept the illegal message?
ECU
IPS
ECU ECU
…

Overwrite the illegal message with an error message

...

Huh? Is it really possible?

How do we get back control from the attacker?
OBD-II
ECU

6. © 2018 LAC Co., Ltd.
6
SCIS2018 in Niigata
Smart CAN Cable: Structure
CAN cable and connector (just example)
北斗電子： RC-Carキット
http://www.hokutodenshi.co.jp/7/HSBRH850F1L100.htm#rccar
We can install
something.

7. © 2018 LAC Co., Ltd.
7
SCIS2018 in Niigata
Smart CAN Cable: Structure
Our Proposal
Connector …
Connector
Connector
Connector Connector
ECU
IPS
ECU ECU
ECU
Smart CAN Cable

Smart CAN Cable identifies the sender ECU.

Smart CAN Cable is controlable that the ECU sends a
message or not.
OBD-II

8. © 2018 LAC Co., Ltd.
8
SCIS2018 in Niigata
Smart CAN Cable: Structure

Smart CAN Cable is like just a CAN Cable with
connector.

Advantage
➢
ECU does not need to modify for the security.
We can apply the Smart CAN cable to the cars in the market.
➢
Smart CAN Cable can gather responsibility of the
security.
●
Disadvantage
➢
A little more space and code.
➢
Signal may be delayed (for now).

9. © 2018 LAC Co., Ltd.
9
SCIS2018 in Niigata
Smart CAN Cable: Structure
Inside of Connector
ECU
Transceiver
Repeater
CAN BUS
Controller
Ring Buffer
Transceiver
● Record a hash value of
a message from ECU
into its own ring buffer.
● Search the hash value
in its own ring buffer
when IPS sends the
hash value.
● Order to stop to relay
any messages to
repeater after it finds
the hash value.
Controller role

10. © 2018 LAC Co., Ltd.
10
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Normal sequence
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Connector2 Connector3
Connector0
Normal message
Hash value of the message

11. © 2018 LAC Co., Ltd.
11
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Normal sequence
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Connector2 Connector3
Connector0
Normal message
Hash value of the message

12. © 2018 LAC Co., Ltd.
12
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Normal sequence
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Connector2 Connector3
Connector0
Good!
Normal message
Hash value of the message

13. © 2018 LAC Co., Ltd.
13
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU

14. © 2018 LAC Co., Ltd.
14
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU

15. © 2018 LAC Co., Ltd.
15
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU
Bad!

16. © 2018 LAC Co., Ltd.
16
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU
Bad!

17. © 2018 LAC Co., Ltd.
17
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU
Bad!
＝
≠ ≠
Identified

18. © 2018 LAC Co., Ltd.
18
SCIS2018 in Niigata
Smart CAN Cable: Sequence
Sequence of identifying an illegal message
IDS
ECU1
Connector1
ECU2 ECU3
CAN BUS
Compromised
Connector2 Connector3
Connector0
Illegal message
Hash value of the illegal message
Information of compromised ECU
Bad!
＝
Cut
Identified

19. © 2018 LAC Co., Ltd.
19
SCIS2018 in Niigata
Smart CAN Cable: Performance

Hash value: CRC32 (4byte)

Ring buffer size: 1024 records

Passing through a connector: 400μs(Max)

Checking a hash value in the ring buffer: 50μs(Ave)

Collision rule: A loser message is forgotten.

20. © 2018 LAC Co., Ltd.
20
SCIS2018 in Niigata
Discussion: Open Points

Passing through speed is very slow
●
To approximately wire-speed...

Else better collision rule
●
No idea for it

Vulnerability of Smart CAN Cable
●
Must implement blacklist/whitelist
●
About tamper resistance of smart CAN cable

21. © 2018 LAC Co., Ltd.
21
SCIS2018 in Niigata
Demonstration: Structure
Steering Angle
Commander
C
Connector ECU
CAN BUS
Speed
Commander
C
brake
Commander
C
Drive
Motor and LED
C
C IDS
Attacker
C

22. © 2018 LAC Co., Ltd.
22
SCIS2018 in Niigata
Demonstration: Structure

23. © 2018 LAC Co., Ltd.
23
SCIS2018 in Niigata
Demonstration: Structure

24. © 2018 LAC Co., Ltd.
24
SCIS2018 in Niigata
Demonstration

25. We provide IT total solutions
based on advanced security technologies.
supports your Business
LAC
Thank you. Any Questions ?
© 2018 LAC Co., Ltd.