CN111385286A - Method and corresponding device for protecting vehicles from cyberattacks - Google Patents

Abstract

Described herein is a method for protecting a vehicle CAN communication network from network attacks, the CAN communication network comprising a CAN bus and a plurality of nodes, the nodes being associated in a signal exchange relationship with the CAN bus and at least partially with a unit for controlling a vehicle function; the method comprises the following operations: analyzing contents of the CAN messages transmitted between the nodes to identify illegal CAN messages; and blocking illegal messages; the blocking operation comprises rendering the illegal message invalid for an integrity check performed by the CAN controller of the node by inserting a corrupt bit sequence identified as erroneous by the CAN controller to obtain a corrupted message; wherein a sequence of corrupt bits is inserted into an integrity check field, in particular a CRC field, of an illegal CAN message at a bit time, the value of the bit time being such that the illegal message separator field is aligned in time with the corresponding separator of an error message generated by a network node receiving the illegal message comprising the corrupt sequence.

Description

Method and corresponding device for protecting vehicles from cyberattacks

technical field

The present invention relates to a technique for protecting a vehicle CAN (Controller Area Network) communication network from network attacks, the vehicle CAN communication network comprising a CAN bus and a plurality of nodes in a signal exchange relationship with the CAN a bus associated and at least partially associated with a unit for controlling vehicle functions;

The above techniques include the following operations:

analyzing the content of CAN messages transmitted between nodes of the plurality of nodes in order to identify illegal CAN messages; and

blocking said illegal messages,

Said blocking operation comprises causing said illegal message to be relevant to the CAN control by said node by inserting a corrupted bit sequence which is identified as erroneous by said CAN controller, in particular by replacing part of the original bit sequence with a corrupted sequence. Invalid in terms of integrity checks performed by the server to obtain corrupted messages.

The CAN bus (used as a communication bus in motor vehicles) is a serial and multi-bus type of communication, where each bus (also called a "node") connected to the bus is able to send and receive messages and resolve issues due to multiple Any conflict caused by simultaneous access of two transport nodes.

As shown in Figure 1A, the nodes 11 capable of communicating on the CAN bus 10 typically include:

a CAN transceiver 12, which is associated with the CAN bus 10 via the transmission line TT and the reception line TR and is configured to manage the appropriate levels of the CAN bus (physical layer of the OSI model);

- a CAN controller 13, which is connected to the CAN transceiver 12 via respective transmission lines CT and receive lines CR and is configured to manage the logic level and serialization of the CAN bus 10 (data link layer of the OSI model) ;as well as

- A microcontroller 14, which contains the logic for sending and receiving messages (management of the OSI layer above the data link layer).

Figure 1A shows one of the possible implementations which envisages having the CAN controller 13 and the microcontroller 14 in the same System-on-Chip 15, with the CAN transceiver on a separate chip superior.

As shown in FIG. 1 , it is known to install a device 16 between the CAN controller 13 and the CAN transceiver 12 for protection from network attacks. The protection device 16 processes (especially analyzes) the messages transmitted between the CAN controller 13 and the CAN transceiver 12, identifies illegal or malicious messages, and implements a method for blocking the injection of these malicious messages on the CAN bus in different use cases , described in Figures 2, 3, 4 and 5.

In particular, in FIG. 1B , the protection device 16 receives CAN messages on the transmission line CT from the CAN controller 13 to the protection device 16 , and analyzes and filters the messages via the aforementioned blocking operation, so that the protection device 16 The line between the CAN transceiver 12 is the filtered transmission line DT on which the CAN messages processed by the protection device 16 are transmitted. In the opposite direction, CAN messages from the transceiver 12 arrive at the protection device on the receive line CR connecting these modules and are processed at the protection device 16 and transmitted by the protection device 16 on the filtered receive line DR to CAN controller 13 .

In particular, FIG. 2 shows a situation where a vehicle network 20 is given comprising a plurality of nodes 11 ₁ , . . . , 11 _n representing, for example, a vehicle control unit, such as an ECU (Electronic Control Unit), eg Engine control units and control units for lighting, air conditioning, transmission, ABS, suspension and other processor modules dedicated to other vehicle services. Of these multiple nodes 11 ₁ , . . . , 11 _n , the node 11 ₁ is a protected node, ie a node equipped with a protection device 16, and it is represented in the figure that the protected node 11 ₁ is malicious and will be malicious ie the situation in which an illegal CAN message or CAN frame MF is injected into the vehicle network 20 . Such a use case is, for example, the case where, for example, the microcontroller 14 has been violated by other communication channels, such as wireless channels, as can happen for nodes corresponding to infotainment/telematics units. In this case, the presence of the protection device 16 prevents these messages MF from reaching the vehicle network 20 , ie preventing these messages MF from reaching the other non-protected nodes 11 ₂ , . . . , 11 _n .

FIG. 3 shows the situation in which a malicious CAN message MF is injected by the vehicle network 20 , ie by one of the nodes not provided with a protection device, ie by one of the unprotected nodes 11 ₂ , . . . , 11 _n , in particular by the node 11 ₂ injection situation. FIG. 3 represents a situation where any node of the vehicle network 20 is violated. In this case, the presence of the protection device ₁₆ prevents messages not related to the respective protected CAN node 111 from being processed by the microcontroller 14, where the protection device 16 itself is installed on the respective protected CAN node ₁₁₁ .

FIG. 4 shows the use of the protection device 16 within the CAN gateway 18 . This configuration makes it possible to isolate two different CAN networks 20A and 20B having respective nodes 11A ₁ , . . . , 11A _n and _{11B 1} , . Unprotected, and this configuration makes it possible to guarantee filtering of CAN frames transported between one network and the other. In the particular case of FIG. 4 , the protection device 16 blocks illegal messages MF transmitted by the network 20A and prevents them from spreading over the network 20B. Obviously, the protection device 16 can also block illegal CAN messages MF transmitted by the nodes of the network 20B through the gateway 18 to the network 20A.

Background technique

US Patent Application No. US 2015/191136 A1 describes a protection device operating on the CAN bus of a motor vehicle, which envisages blocking messages in transit whose parameters meet the criteria for illegal messages. Blocking is performed by rendering the illegal message invalid for the validity check performed by the CAN controller, i.e. by The insertion of bit sequences (i.e. stuffing bits) that the controller recognizes as erroneous, in particular, corrupts illegal messages by inserting stuffing errors through sequences that do not obey the bit stuffing rules envisaged by the CAN protocol, causing the CAN controller to ignore these illegal messages without passing the CAN network to deliver them. However, the handling of the number of padding bits may create a time misalignment between the corrupted message (sent over the bus) and the framing error message generated by the CAN node that received the corrupted message.

SUMMARY OF THE INVENTION

It is an object of the present invention to provide a monitoring method that will enable invalidation of illegal messages while ensuring proper alignment.

According to the invention, the above-mentioned objects are achieved thanks to a protection method and a corresponding protection device having the features particularly mentioned in the appended claims.

Description of drawings

The present invention will be described with reference to the accompanying drawings, provided by way of non-limiting example only, in which:

- Figures 1A and 1B, Figure 2, Figure 3, Figure 4 have been described previously;

- Figure 5 shows a functional block diagram of a protection device implementing the method described herein;

- Figure 6 is a diagram schematically representing the CAN messages processed by the protection device;

- Figures 7A, 7B and 7C are schematic representations of the protection device described herein in three operational steps of the method; and

- Figure 8 is a flow chart illustrating the operation of the method described herein.

Detailed ways

Figure 5 shows a functional block diagram of the protection device 26 according to the invention. The protection device 26 is represented as being arranged between the CAN controller 13 and the CAN transceiver 12 in a protected node of the CAN network 10 , as eg arranged in the configuration of FIG. ₃ of the node 111 . The solutions described here have nothing to do with the CAN version (CAN2.0 or CAN-FD) applied on it, and for ease of illustration, only the solutions corresponding to the CAN2.0 version are described.

The protection device 26 comprises a firewall module 261 which normally receives the sequence of CAN messages M sent on the receive line CR and on the transmission line CT and sends CAN messages on the filtered receive line DR and on the filtered transmission line DT A filtered sequence of messages. As mentioned above, the message M may be an illegal message MF. As described more fully below, the filtered sequence may contain CAN messages M themselves, may contain corrupt messages MF' obtained from illegal messages MF, or may be corrupted by both legal messages M and illegal messages MF (schema described below). B2) The application is completely blocked.

Therefore, the firewall module 261 described above is configured to:

- extracting the information content of the CAN message M conveyed on the transmission line CT or the receiving line CR;

- analysis of the above-mentioned information content; for example, this includes comparing the values of the fields of the CAN messages M in transit with the set of firewall rules R stored in the rules storage module 262, which represents a database of rules, the firewall module 261 at least The rules database can be accessed for reading;

- invalidation of the CAN message M in transit if it is identified as an illegal CAN message MF on the basis of its content; in case the analyzed message M is identified as an illegal message MF while the illegal message MF is still being transmitted on the CAN bus , invalidating the CAN message M in transit is obtained by performing its destruction according to blocking modes (eg, B1 and B2, described in more detail below) during transmission by the protection device 26 .

As mentioned above, the protection device 26 also includes a rules database 262 containing rules R applied by the firewall 261 to the analyzed CAN messages (ie in transit) to identify illegal messages MF. CAN messages M in transit from transmit line CT and from receive line CR may be subject to the same set of rules R in rules database 262, or rules database 262 may contain two sets of rules applied independently on receive CR and transmit CT.

The protection device 26 also includes an operation storage module 263 , ie a dedicated storage area for storing a log of operations B performed by the protection device 26 on the CAN bus 10 . The protection device 26 accesses the aforementioned module 263 to write operation B performed by the protection device on the CAN bus 10 . Log B contains statistics about firewall 261 activity (such as the number of illegal frames MF corrupted on the transmission line CT, the number of illegal frames corrupted on the receive line CR), which can be queried through the configuration interface 264, which 264 can access the operational storage module 263 for reading, as shown in FIG. 5 .

As mentioned above, the protection device 26 includes a configuration interface 264 for defining filtering rules R applied by the firewall 261 and stored in the module 262 . In particular, the configuration interface may receive the filtering configuration of the protection device 26, ie the rules R, from an external communication interface (not shown in the figure). The configuration interface 264 is in a data exchange relationship with the rules database 262, in which it writes, for example, a set of rules R for filtering through firewalls, and as described above, the configuration interface 264 is in a data exchange relationship with the operation storage module 263, for example with It is used to read the data in the operation log of the firewall 261 .

Associated with the configuration interface 264 is an authentication module 265 configured to check the authenticity of the filtering configuration received from the external communication interface, eg, via digital signature and data encryption mechanisms.

The protection device 26 is typically configured to implement a filter that blocks malicious and irrelevant CAN messages, allowing only legitimate data to pass through.

The distinction between legitimate and illegal messages can be configured based on the use destination of the protection device 26 and can be defined by the following distinction parameter C:

C1: CAN message identifier;

C2: CAN message length;

C3: transmission time, eg frequency in case of periodic messages;

C4: message content; this parameter is only used for diagnostic type messages;

C5: Vehicle Status; this parameter is only used for diagnostic type messages; and

C6: Percentage of bus used per unit time.

The protection device 26 is configured to generally apply a set of rules R to non-diagnostic and diagnostic messages, on which further and specific filtering rules are applied in case a frame in transit is identified as a diagnostic type.

Furthermore, the protection device 26 is configured in particular by the firewall module 261 for implementing one of the following two message blocking modes:

selective blocking mode B1 whereby all and only illegal CAN messages MF are blocked; and

Mode B2 is completely blocked, whereby all CAN messages (both legitimate messages M and illegal messages MF) are blocked.

Complete blocking mode B2 can be configured for the following usage modes:

a first usage mode BC1 in which the full blocking mode B2 is enabled or disabled;

The second usage mode BC2, if full blocking mode B2 is enabled, can define in the protection device 26 the type of violation and the number of violations and the time during which the blocking mode remains active, for each specified violation type, once its , the full blocking mode B2 must be activated; in the second usage mode B2, one or more deactivation parameters are therefore defined in a list including the type of violation, the number of violations and the deactivation time.

Complete blocking mode B2 enables the i-th node 11 _i or the network (eg 20B in Fig. 4) to be disconnected from the CAN bus 10 for virtually any period of time, which may even be virtually infinite depending on the configuration, so in After a set period of time, the node 11 _i or the network is completely isolated, or the node 11 _i recovers the communication capability.

The mechanism by which the protection device 26 blocks illegal CAN messages enables a zero-delay mode. This advantageously uses the protection device 26 in all applications where the propagation delay introduced by the additional filter element (eg actually the protection device 26) will be minimized.

As mentioned above, the zero-delay message filtering mode implemented by the protection device 26 envisages taking advantage of the integrity checking mechanisms already present in the CAN bus in this way: by invalidating illegal CAN messages MF during transmission on the CAN bus ( i.e. destroy the illegal CAN message), so that the receiving node will ignore the above illegal message MF already at the digital level of the CAN controller 13 (i.e. the data link layer), where the digital level of the CAN controller 13 (i.e. the data link layer) ) performs a message integrity check without passing the message to the microcontroller 14 (and to the upper layers of the OSI stack). Therefore, even under ideal conditions of zero analysis time, the zero-delay mode described above is completely different from the way the filter element receives-analyze-retransmits, as the filter element receives-analyze-retransmits the typical behavior of a gateway, where the filter element is in In any case, the message must be waited for termination before analyzing the message, and if the message is legitimate and must be retransmitted, again engage in bus contention and arbitration (after analysis), thereby introducing a retransmission equal to at least the message itself Additional delay for duration. Furthermore, since the filtering element must be able to win the CAN bus contention so that it can retransmit previously analyzed messages, this additional delay may be significantly longer, and its upper limit is due to the nature of the CAN protocol, so its upper limit is In theory infinite, this is the case if higher priority messages are to be transmitted by other network nodes.

Conversely, the zero-delay mode implemented by the protection device 26 enables the inspection of CAN messages in transit (ie during transmission or reception by the node on which the device 26 is installed), thus making it possible to:

- take immediate action by destroying the message if the message is unlawful, even before the transmission or reception of the message is terminated; and

- If the message is legitimate, leave it unchanged so that it doesn't affect its delivery time.

The process of zero-delay filtering of CAN frames by the first selective blocking mode B1 or the second full blocking mode B2 carried out by the protection device 26 specifically includes two operations, which are so as not to change The transmission time of CAN messages and does not lead to malicious nodes appearing as illegal messages have been successfully sent.

The first operation is operation Fl, which is performed by the protection device 26 to block the message in transit by corrupting the bit sequence of the CAN message itself.

The second operation is operation F2, which consists of concealing the corruption of the illegal CAN message transmitted by the malicious CAN node from the malicious CAN node (the malicious CAN node transmitting the illegal CAN message MF intercepted by the protection device 26), and therefore by The integrity check implemented in the CAN controller blocks CAN messages.

Since the protection device 26 and the protection method implemented by the device 26 guarantee the simultaneity between the end of the transmission of the illegal CAN message and the end of the transmission of the error message, the illegal CAN messages are corrupted by operation F1 performed by protection device 26, while error messages are corrupted by the above-mentioned corrupted illegal CAN message (ie as a result of detecting an error condition introduced by protection device 26 into a malicious CAN message in order to corrupt it) by One or more receiving CAN nodes 11 ₁ , . . . , 11 _n (other than the node comprising the protection device 26 applying the blocking operation F1 to the illegal message MF and the CAN node other than the CAN node injecting the illegal message MF) send.

This simultaneity represents an aspect that is the basis for preventing triggering of misaligned superpositions of sent messages, as misaligned superpositions would result in constant corruption of data on the CAN bus 10, frequently occupying the bus, and eventually leading to communication interruptions.

The protection method implemented by the protection device by destroying the operation of F1 and hiding F2 makes use of the specific structure of the data and error type messages of the CAN protocol.

In particular, a message of data type consists of a portion S of consecutive bits listed in Table 1 below.

Table 1

In the CAN bus standard, the structure of the part S of the message of the data type is known per se.

Error-type messages include active-type messages and passive-type messages. For active errors, the structure of the message is shown in Table 2 below.

Table 2

Conversely, for passive errors, the structure of the message is shown in Table 3 below.

table 3

A situation involving active errors is shown by way of example in FIG. 6 . Denoted by MF is an illegal CAN message being transmitted, and denoted by MF' is a corrupted message which has at its end an error message EM which is a CAN message of the response error type, the error The message EM is sent by one of the receiving nodes after a corruption has been detected by an integrity check implemented by its CAN controller.

Furthermore, denoted by bt is the bit-time axis, and denoted by NV is the signal written by the protection device 26 in the illegal CAN message MF. Denoted by Si is the internal signal generated by the protection device. In particular, the signal Si is the signal DT in the protection device 26 if a message is being transmitted, or alternatively the signal DR of the protection device 26 if a message is being received.

In order here to ensure simultaneity between the end of the transmission of the illegal CAN message MF of the data type corrupted by the protection device 26 and the end of the transmission of the corresponding message EM of the response error type by any of the receiving nodes 11, ie for For the ITM (intermittent) fields of the above-mentioned messages to be aligned and superimposed (field S8 for the illegal message MF and field SE3 for the error message EM), it is necessary to be at the exact insertion point, ie at the bit of the illegal message MF Inserts an error condition at a specific value of time bt. In particular, this is performed by replacing part of the original bit sequence with a corrupted sequence to obtain a corrupted message.

The exact insertion point at which a corrupt sequence consisting of six consecutive bits (NV) is to be inserted is uniquely determined by the format of the data packet and by the rules of the CAN protocol and requires the use of logical resources/modules dedicated to The calculation of the insertion point and the calculation of the polarity of the bits constituting the above-mentioned destruction sequence NV.

In particular, in order to calculate the starting point of a sequence of six consecutive bits within a CRC (Cyclic Redundancy Check) field and the (dominant or recessive) polarity of the bits that make up it, the protection device 26 particularly The firewall module 261 is provided with one or more logical modules/elements designed or configured to:

- Calculate the value of the CRC field S5 dynamically (at runtime) in order to predict the number of padding bits that will appear in the CRC field;

- analyze the content of the CRC field reconstructed in the previous step, also taking into account the bits before the CRC, in order to evaluate the number of padding bits that will be present in the CRC field (ie message M, field S5 of MF); since the CRC field is the data Correlated (and thus also changes at runtime like data), so the exact insertion point of the breaking sequence is also dynamically determined.

Referring to Figure 6, the exact insertion point of the corrupt sequence is instant bt _j -5, and the instant bt _j is the instant when the receiving node detects a stuffing error condition (SPE). In the figure, the last bit immediately before the first bit of the corruption sequence is denoted by bt _j -6 in order to emphasize the fact that the corruption sequence must have the opposite polarity to this bit.

therefore:

- the CAN node 11 receiving the corrupt message MF will respond with an error message EM (as for the fields SE1, SE2, SE3 shown in the example as active errors; otherwise, for passive errors, use the fields SP1, SP2, SP3), the error message EM starts at bit time bt _j +1 immediately after bit time bt _j at the point where the stuffing error condition SPE occurs; more specifically, as shown in _FIG . Error message EM; in the case of multiple receiving nodes, each receiving node _11i transmits an error-type CAN message EM whose error frame is superimposed exactly on the error frame;

- the end of the error message (or superimposed error message) i.e. the partial SE3 ITM is time aligned with the corresponding ITM field S8 of the illegal message MF, the partial SE3 ITM contains a field of recessive bits (in particular three bits) which is used with As a separator between messages, ie as a break field, the illegal message MF is simultaneously retransmitted unaltered to the sending malicious node.

Even if it is assumed that the length of each field of the frame of the data type of the CAN message is the same, the length of the CAN message may vary based on the contents of the above-mentioned fields due to possible insertion of padding bits. Therefore, the protection device 26 is configured to dynamically calculate for each CAN message the point bt _j -5 of the CRC field at which a sequence of six consecutive bits of the same polarity must be inserted if the frame MF must be corrupted nv. The protection device 26 is configured to dynamically calculate for each CAN message the point bt _j -5 of the CRC field that needs to insert a sequence NV of six consecutive bits with the same polarity and the polarity of the bits of the sequence NV, which must be inserted in the frame MF. In the case of destruction, the polarity of the bits of the above sequence NV must be opposite to the polarity of bits bt _j -6.

As mentioned above, another basic operation performed by the protection device 26 consists of concealing F2 the destruction of the above-mentioned illegal CAN messages from malicious CAN nodes (the malicious CAN nodes transmitting illegal CAN messages intercepted by the protection device 26), and thus by It is blocked by the integrity check implemented in the CAN controller.

In the case where the protection device 26 corrupts an illegal frame MF, if the protection device 26 does not conceal the corruption, the sequence NV is inserted at the insertion point bt _j -5 of the CRC field S5 of the illegal frame MF and the padding is determined at point bt _j Error condition SPE, the filling error condition SPE will be detected by the CAN node that has sent the malicious frame MF, as a result, the transmission of the malicious frame MF will be interrupted, and the frame of the error type EM will be transmitted (not with the error type sent by all other receiving nodes. All other frames are aligned) and will then attempt to retransmit the same malicious frame.

The operation F2 of concealing the message corruption process in transmission is processed as shown in FIG. 7 , wherein the CAN controller element 13 and the CAN transceiver element 12 represented are, for example, protected CAN belonging to the protection device 26 on which the protection device 26 is mounted. those elements _of node 111, and the protected CAN node sends a malicious message MF (this is the case for a violation of the host of the CAN node on which the protection device 26 is installed). In particular, since every bit of the CAN message MF transmitted on the transmission line CT is also reread on the receive line CR, the protection device 26 operates as described below, on the transmission line CT having identified a malicious arrival at the device 26 After the frame MF (see FIG. 7A ), the above-mentioned destruction operation of the malicious frame MF is performed in two steps.

In the first step shown in Figure 7B, on the host side, i.e. towards the malicious node (transmission line CT and filtered receive line DR), the illegal CAN message MF is replicated without changing the bits on the filtered receive line DR stream, while on the CAN bus side downstream of the transceiver 12, i.e. towards the non-malicious receiving node, i.e. on the filtered transmission line DT and on the unfiltered receive line CR, the illegal message MF is corrupted in an appropriate way by modifying its bit stream , to obtain the corrupted message MF'.

In a second step (shown in FIG. 7C ), on the host side, ie towards the malicious node, the protection device 26 , via a message that correctly receives the OR on the line DR ( FIG. 7C ), is notified by the other nodes 11 of the network 20 . ₂ , . . . , 11 _n correctly receive the message to simulate the CAN bus, in particular via sending the dominant bit during the bit time ACK position; meanwhile, on the CAN bus side, the protection device 26 via the error envisaged by the CAN protocol Frame EM, the false warning issued on line CR is blocked by the other nodes 11 of the network that have received the destruction message MF'.

The operation F2 of concealing the destruction process of the message in transit is also applicable in the case of receiving an illegal message, i.e. by a CAN node 111 other _than the protected CAN node 111 _on which the protection device 26 is installed to be different from the situation in which the message is received In the case of messages sent in a manner similar to that shown in Figures 7A, 7B and 7C, the features of the CAN protocol have been represented above and in Figures 7C. In particular, in this case, the message MF to be sent, copied to the malicious node, which should be transmitted on the wire DT by duality, is unnecessary; i.e., no copy action is performed, but the OR is correctly received The message is sufficient to provide evidence of correct reception of the malicious message (this time on the CAN bus 10).

Accordingly, a method for preventing cyber attacks in a vehicular CAN communication network 20 includes the following operations, wherein the vehicular CAN communication network 20 includes a CAN bus 10 and a plurality of nodes 11 associated with the CAN bus 10 in a handshake relationship with the CAN bus 10 and associated at least in part with a unit for controlling vehicle functions, said method comprising the operation of analyzing the content of CAN messages M in transmissions between nodes of said plurality of nodes 11 to identify illegal CAN messages MF , and block the illegal message MF through the blocking mode B1, B2, wherein the blocking operation through the blocking mode B1, B2 includes causing the illegal message MF to be processed by the CAN controller 13 of the node 11. Invalid for integrity checking, i.e. corrupting it by inserting F1 which is identified as wrong by said CAN controller 13 as a corrupted bit sequence NV to obtain corrupted message MF', specifically envisaged at bit time bt _j -5 The corrupted bit sequence NV described by F1 is inserted in the integrity check field S5 of the illegal CAN message MF, in particular the CRC field, the value of the bit time bt _j -5 is such that the delimiter field of the illegal message (i.e. the ITM, especially the is an interrupt field consisting of three recessive bits) is aligned in time with the corresponding separator field of the error message EM, which is generated by the node of the network 20 that receives the illegal message MF, which includes the Destroy sequence NV. It should be noted that the above insertion operation is performed by replacing a part of the original bit sequence, in particular a part of the integrity check field S5, with a corrupted bit sequence, i.e. bit sequence NV, in particular the polarity and time of this bit sequence NV. The bits at time bt _j -6 are of opposite polarity, and the bit at time bt _j -6 precedes the bit at time bt _j -5 to obtain the corrupted or illegal message MF'.

The method then includes:

- extracting the information content of the message M in transit during transmission;

- an analysis of the information content according to the firewall rule R set; and

- In case said analysis of the information content identifies a message M that is analyzed as an illegal message MF, invalidating the message M to obtain a corrupted message MF'.

The described method then includes selecting whether to apply the operation that renders the F1 illegal message MF invalid at least according to mode B1 which selectively blocks all and only illegal CAN messages MF, or whether to apply the operation according to mode B2 which completely blocks all CAN messages. The operation that renders F1 illegal messages MF invalid is applied, regardless of whether these CAN messages are legal messages M or illegal messages MF.

The described method then envisages the possibility that said operation to invalidate the illegal message MF would comprise an operation to hide the operation of F2 inserting said operation of the corrupt bit NV from the CAN node or CAN network sending the illegal CAN message MF by the following steps, The steps are:

Send the illegal CAN message MF without any change, especially without the copying of the sequence NV, to the CAN node 11 transmitting the illegal message MF, or do not take any copying action for the CAN network 10 transmitting the illegal message MF; as well as

For the case of illegal messages being transmitted by CAN node 11 or CAN bus 10, respectively, simulate CAN bus 10 or CAN node 11, notify one or more receiving nodes to correctly receive illegal messages MF, A CAN node or CAN network to block the error message EM associated with the illegal message MF.

Based on the rules R stored in the storage module 262 , the above-mentioned operations are carried out by the protection device 26 , in particular by its firewall module 261 .

For this purpose, in a variant embodiment, the protection device 26 can be arranged between the CAN controller 13 and the CAN transceiver 12 of the CAN node, which is thus a protected node, even if it is itself a malicious node.

In a further variant embodiment, the protection device 26 may be arranged between the two CAN networks 20A, 20B in association with the gateway 18 .

As previously mentioned, protection device 26 has a configuration interface, interface 264, which can define firewall rules R via the following lists and parameters:

- A whitelist, i.e. a list of authorized or permitted elements for permitted messages (in any direction) applied under the given vehicle conditions; each item of this list contains the following fields:

a) an identifier;

b) length;

c) transmission and violation threshold parameters;

d) message type (diagnostic/non-diagnostic)

- Whitelist of allowed diagnostic services (this list only applies to diagnostic type messages);

- blacklist, i.e. a list of unauthorized or disallowed elements of the diagnostic service, which are not allowed in a given vehicle condition (this list only applies to diagnostic type messages);

- "Whitelist/Blacklist Violation Threshold" for activating full blocking mode;

- a "bus occupancy threshold" for activating full blocking mode; and

- "Information on detected vehicle condition" for determining what the status is (eg current speed above 5km/h), to be used together with "Blacklist for diagnostic services" and "Whitelist" for allowed messages.

The firewall rules R set by the above parameters and lists are stored in the table of the storage module 262 and can be updated by adding new firewall rules R or by overwriting and/or eliminating existing firewall rules R. The protection device 26 stores all the statistical information B corresponding to the activity of the firewall (the number of illegal frames destroyed on the line DT, the number of illegal frames destroyed on the line DR, etc.) in the storage module 263, and as shown in Fig. 5 As shown, it can be consulted via a configuration interface 264 that can access the module 263 .

For each CAN message M of the data frame or remote frame type, the application of the firewall rules R defined and contained in the storage module 262 is implemented. A schematic diagram of the filtering process is shown in FIG. 8 .

According to the flowchart of FIG. 8 , an embodiment of the protection program 100 executed by the protection device 26 is described as an example.

After the start 105 of the process, in step 110, the firewall 261 extracts the message identifier (ID, 11/29 bits) from the arbitration field S2 of the CAN message M in transit, associates the message identifier with the "white list" The corresponding fields are compared for the vehicle's condition set. If the message identifier is present, the next step 120 is performed; otherwise, the message M is considered an illegal message MF and control passes to step 180.

In step 120, the firewall 261 extracts the message length (DLC, 4 bits) from the control field S3 of the CAN message M in transmission, and compares the message length with the corresponding field of the "white list". If the length is correct, the next step 130 is performed; otherwise, the CAN message M is considered an illegal message MF and control passes to step 180 .

In step 130, the time elapsed since the last time the same message was received is measured based on the identifier and compared to a configured time threshold, e.g. a time interval defined between a maximum time Tmax and a minimum time Tmin, Or go through a stage, etc., also related to the order in which the timing rules are violated. If the elapsed time since the last reception of the same message falls within the allowed interval, or does not fall within the allowed interval but the number of detected violations is below a given threshold (all these parameters are removed from the "whitelist" extraction, parameters like the time interval), then the next step 135 is performed;

In step 135, a check is made to verify that the message M is of the diagnostic type. If not, control passes to step 160 where the state of the vehicle is updated. If so, the value of the diagnostic service is extracted from the "data" field in step 140 and checked to see if it exists in the "diagnostic service whitelist" stored in module 262. If it exists, the next step 150 is performed; otherwise, the CAN message M is considered an illegal message MF, and control passes to step 180 .

In step 150, the value of the diagnostic service is extracted from the data field S4 and checked to see if it exists in the "diagnostic service blacklist" set for the state of the vehicle (see step 160). If it exists, the message M is treated as an illegal message MF, and control passes to step 180; otherwise, it is treated as a legitimate message, and the next step 160 of updating the vehicle state is performed.

In step 160, the "information on detection of vehicle condition" is used with the arbitration field and data field of message M to update the internal information representing the vehicle condition. Specifically, in step 160, a check is made to verify whether an update of the vehicle status is necessary. The discriminator for evaluating whether to update the vehicle state is included in the set of rules R. The check is based on the arbitration field and the data field of the frame in transit.

Next, in step 170, the value of the occupied bus is updated from the total length of the message and compared with the "bus occupancy threshold". If the message does not comply with these thresholds, the CAN message M is considered an illegal message MF and control passes to step 180 . Otherwise, process 100 terminates in step 195 .

Thus, generally, the operations performed by the firewall 261 to extract the information content of a CAN message M in transit on the transmission line CT or on the receive line CR and the analysis of the information content include one or more of operations 110, 120, 130, 135, 140, 150, 170.

In step 180, since the CAN message M is considered to be an illegal message MF, it is decided whether to activate blocking mode B1 or blocking mode by combining the detected violation type with the "threshold for whitelist/blacklist violation" B2.

In step 190, information about the validity of the message and the blocking mode to be implemented (whether B1 or B2) is sent to the firewall module 261, which performs the blocking mode by destroying F1 and hiding F2 (i.e. Action required to completely block (B1) or block (B2)).

The protection device 26 envisages the possibility of operating using both single-frame diagnostic messages and multi-frame diagnostic messages. In the case of a multi-frame diagnostic message, if the first frame of the message chain is identified as malicious, the protection device 26 can block this message and all subsequent messages that make up the multi-frame message via step 135 . Therefore, a counter exists in the protection device 26 to keep track of how many CAN frames have passed on the CAN bus and to determine when to terminate the sabotage process for a particular diagnostic service.

Thus, from the above description, the advantages of the proposed solution appear clearly.

The described apparatus and method prevent any temporal misalignment between the corrupted message (sent on the bus) and the erroneous frame message generated by the CAN node receiving the corrupted message.

Furthermore, the described apparatus and method make it possible to conceal, by appropriate concealment procedures, corrupt operations from CAN nodes that have sent illegal frames. This can prevent automatic retransmission by malicious CAN nodes, which would result in occupation of the CAN bus.

The described apparatus and method make it possible not to introduce any delay in the transmission of the CAN message, thus ensuring that it is used in a transparent manner by the CAN nodes involved.

The apparatus and methods described herein make it possible to also operate with diagnostic type CAN messages. Thanks to dedicated control logic, if the diagnostic service is identified as malicious, it is possible to identify a multi-frame type of diagnostic message sequence and invalidate the entire message chain.

Claims (11)

1. A method for protecting a vehicle CAN (Controller Area Network) communication network (20) from network attacks, the vehicle CAN communication network (20) comprising a CAN bus (10) and a plurality of nodes (11), so said node (11) is associated with said CAN bus (10) in a handshake relationship and is at least partially associated with a unit for controlling vehicle functions; The method includes the following operations: analyzing the content of CAN messages (M) transmitted between nodes of the plurality of nodes (11) to identify illegal CAN messages (MF); and Block (B1, B2) the illegal message (MF); The blocking operation (B1, B2) comprises: causing (F1, F2) the illegal message (MF) by inserting (F1) a corrupt bit sequence (NV) identified by the CAN controller (13) as an error invalid for the integrity check performed by the CAN controller (13) of said node (11) to obtain a corrupted message (MF'), The method is characterized by: Inserting (F1) the corrupted bit sequence (NV) into the integrity check field (S5), in particular the CRC field, of the illegal CAN message (MF) at the bit time (bt _j -5), the bit time ( The value of bt _j -5) is such that the delimiter field (ITM) of the illegal message is related to the error generated by the node of the network (20) receiving the illegal message (MF) including the destruction sequence (NV). The corresponding delimiters of the message (EM) are aligned in time. 2. The method according to claim 1, characterized in that the method comprises: - extracting the information content of the message (M) in transit during transmission; - analysis of the above information content against the set of firewall rules (R); and - invalidating (F1, F2, 190) the analysed message (M) in case said analysis of the information content identifies the analysed message (M) as an illegal message (MF) to obtain a corrupted message (MF') . 3. The method according to claim 1, characterized in that at least according to a mode (B1) of selectively blocking all and only illegal CAN messages (MF) or according to a mode of completely blocking all CAN messages (M, MF) (B2), a selection (180) of whether or not to apply the operation of invalidating the illegal message (MF) (F1, F2, 190) is performed. 4. The method according to any one of claims 1 to 3, characterized in that the operation of rendering the illegal message (MF) invalid (F1, F2, 190) comprises the following steps from transmitting an illegal CAN message ( The CAN node (11) or CAN network (10) of MF) hides (F2) the operation of the operation of inserting the destruction bit sequence (NV), and the steps are: Send the illegal CAN message (MF) copied without any change to the CAN node (11) transmitting the illegal message (MF), or take no action on the CAN network (10) transmitting the illegal message (MF) copy actions; and In the case of transmission of illegal messages through CAN node (11) or CAN network (10), simulate the CAN bus (10) or CAN node (11), respectively, and notify a receiving node or multiple receiving nodes that the illegal message is correctly received (MF ) and at the same time block the error message (EM) associated with the illegal message (MF) for the CAN node (11) or CAN network (10) transmitting the illegal message (MF). 5. The method according to any one of claims 2 to 4, characterized in that the set of firewall rules (R) comprises one or more of the following lists and parameters: - Whitelist for allowed messages applied under given vehicle conditions; - Whitelist of allowed diagnostic services; - a blacklist of disallowed diagnostic services applied under the given vehicle conditions; - whitelist and blacklist violation thresholds for activating full block mode (B2); - the occupancy threshold of the CAN bus (10) for activating the full blocking mode (B2); and - Information on vehicle condition detection indicating the vehicle condition for evaluating the blacklist for the diagnostic service and for the whitelist for allowing messages. 6. The protection method according to claim 5, characterized in that the protection method comprises one or more of the following operations of analyzing the information content of the CAN message (M): - extracting (110) the message identifier and comparing the message identifier with the corresponding fields of the whitelist for the given vehicle condition; - extracting (120) the message length, comparing the message length with the corresponding field of the whitelist; - measure (130) the time that has elapsed since the last reception of the same message and compare the elapsed time to a time threshold in order to: a) if the message is of the diagnostic type, check if the message exists in the whitelist of the diagnostic service; and b) if the message is of the diagnostic type, extract the value of the diagnostic service and check whether the message exists in the blacklist of the diagnostic service for the given vehicle condition; - Update the bus occupancy value and compare the updated bus occupancy value with the bus occupancy threshold. 7. The protection method according to any one of the preceding claims, characterized by the last bit (bt _j -6) immediately preceding the first bit (bt _j -5) of the destruction sequence (NV) Has a polarity opposite to that of the first bit (bt _j -5) of the destruction sequence (NV). 8. A device for preventing network attacks in a vehicle CAN (Controller Area Network) communication network (20), the vehicle CAN communication network (20) comprising a CAN bus (10) and a plurality of nodes (11), the nodes (11) Associated in a handshake relationship with the CAN bus (10) and at least partly associated with a unit for controlling vehicle functions, characterized in that the device is configured according to one of claims 1 to 7 one or more of the methods described. 9. The protection device according to claim 8, characterized in that the protection device comprises: A firewall module (261) configured to perform at least the following operations: analyzing the content of CAN messages (M), and causing illegal messages (MF) to be detected by the CAN controller (13) of the node (11) ) is invalid for the integrity checks performed (F1, F2); and A storage module, the storage module is used for storing the rule (R) set of the firewall. 10. The protection device according to claim 8 or 9, characterized in that the protection device (26) is arranged between the CAN controller (13) of the CAN node and the CAN transceiver (12). 11. The protection device according to claim 8 or 9, characterized in that the protection device (26) is arranged between two CAN networks (20A, 20B) in association with a gateway (18).

Images