(A) countermeasure against spoofing and DoS attacks based on message sequence and temporary ID in CAN

Abstract

The development of Information and Communications Technologies (ICT) has affected various fields such as big data, mobile, wearable, and so on. In addition, the automotive field has been affected by ICT, and Electronic Control Units (ECU) have been introduced to control vehicles efficiently. A network for communication between ECUs was necessary, because each ECU cannot operate alone, necessitating data exchange. As a result, vehicle network protocols have been introduced such as Controller Area Network (CAN), Local Interconnect Network (LIN), and FlexRay. Due to this, ECUs can efficiently transfer data to other ECUs making vehicle control more efficient. Among these, CAN is a standard vehicle network protocol, and almost all vehicles use CAN as their vehicle network protocol. Although CAN has been widely used, its security is very vulnerable, because of its characteristics such as the broadcast environment and arbitration process in CAN. By using vulnerable characteristics, spoofing and denial of service (DoS) attacks can be easily performed in CAN. To solve this vulnerability of CAN, many ideas have been suggested such as intrusion detection systems (IDS), hashed message authentication codes, AES, which is a type of cryptography algorithm, and so on. However, the suggested security solutions in CAN have some problems such as the increase of traffic, effect of existing systems, adoption costs, etc. In addition, because some ideas were not properly verified due to the characteristics of vehicles, these ideas cannot guarantee its efficiency or effectiveness. In this paper, a security gateway that modifies the existing gateway in CAN is suggested for its improved defense against spoofing and DoS attack. In case of spoofing attack, it defends using a sequence of messages based on the driver's behavior. By making a table that stores a sequence of messages based on the driver's behavior, spoofing attacks can be detected and whether a message is an attack can be determined through a verification process using SipHash. Furthermore, a temporary ID using a seed and SipHash can be used to defend against DoS attacks. To verify our proposed idea, OMNeT++, which is a network simulator, is used. The suggested idea shows a high detection rate and low traffic increase. In addition, in the case of a DoS attack, the suggested idea shows that a DoS attack has no effect by analyzing the frame drop rate.