On Frame Fingerprinting and Controller Area Networks Security in Connected Vehicles

Abstract

Modern connected vehicles are equipped with a large number of sensors, which enable a wide range of services that can improve overall traffic safety and efficiency. However, remote access to connected vehicles also introduces new security issues affecting both inter and intra-vehicle communications. In fact, existing intra-vehicle communication systems, such as Controller Area Network (CAN), lack security features, such as encryption and secure authentication for Electronic Control Units (ECUs). Instead, Original Equipment Manufacturers (OEMs) seek security through obscurity by keeping secret the proprietary format with which they encode the information. Recently, it has been shown that the reuse of CAN frame IDs can be exploited to perform CAN bus reverse engineering without physical access to the vehicle, thus raising further security concerns in a connected environment. This work investigates whether anonymizing the frames of each newly released vehicle is sufficient to prevent CAN bus reverse engineering based on frame ID matching. The results show that, by adopting Machine Learning techniques, anonymized CAN frames can still be fingerprinted and identified in an unknown vehicle with an accuracy of up to 80 %.

Preventing Frame Fingerprinting in Controller Area Network Through Traffic Mutation

“…The frame fingerprinting approach presented in [11] revolves around four distinctive aspects of the CAN traffic: the payload length, the dynamic behavior of the payload bits, the sending frequency, and the frame priority. The approach in [11] makes the following assumption regarding the frame priority: the attribution of new sets of frame IDs in newly released vehicle models should preserve their priority. This leaves no space for manipulation against frame fingerprinting.…”

“…Recently, it was demonstrated that fully automated reverse engineering can be achieved by finding a correspondence between the frames of a target vehicle and the ground truth of previously reverse engineered vehicles. The match can be found based on the ID of frames (if it has been preserved in the target vehicle [10]), or through ML fingerprinting (if the ID has been changed/anonymized [11]).…”

“…On the one hand, this deviation (or offset) from the defined sending frequency can be used as an intrusion detection mechanism [18]. On the other hand, the frame sending period and the corresponding offset can be exploited as a feature for frame fingerprinting, as demonstrated in [11].…”

“…The Bit Flip Rate (BFR) is then calculated as BFC/(f − 1), where f is the length of F [6]. The work in [11] demonstrates that the number of bits that flip at least once during the trace and the mean BFR constitute valuable features to fingerprint the frames. In the current work, we perform morphing on the payload bits to hide the patterns associated to the BFR.…”

“…To address these concerns, in a subsequent work [11] we consider the scenario in which a new set of frame IDs is attributed to each newly released vehicle model. In other words, the IDs of frames transporting the same information and sent by the same ECU models present in any two different vehicle models are distinct.…”