As more software modules and external interfaces are getting added on vehicles, new attacks and vulnerabilities are emerging. Researchers have demonstrated how to compromise in-vehicle Electronic Control Units (ECUs) and control the vehicle maneuver. To counter these vulnerabilities, various types of defense mechanisms have been proposed, but they have not been able to meet the need of strong protection for safety-critical ECUs against in-vehicle network attacks. To mitigate this deficiency, we propose an anomaly-based intrusion detection system (IDS), called Clock-based IDS (CIDS). It measures and then exploits the intervals of periodic in-vehicle messages for fingerprinting ECUs. The thus-derived fingerprints are then used for constructing a baseline of ECUs' clock behaviors with the Recursive Least Squares (RLS) algorithm. Based on this baseline, CIDS uses Cumulative Sum (CUSUM) to detect any abnormal shifts in the identification errors - a clear sign of intrusion. This allows quick identification of in-vehicle network intrusions with a low false-positive rate of 0.055%. Unlike state-of-the-art IDSs, if an attack is detected, CIDS's fingerprinting of ECUs also facilitates a rootcause analysis; identifying which ECU mounted the attack. Our experiments on a CAN bus prototype and on real vehicles have shown CIDS to be able to detect a wide range of in-vehicle network attacks.

/pdf/fingerprinting-electronic-control-units-for-vehicle-3tirundcfi.pdf

Fingerprinting electronic control units for vehicle intrusion detection

The enhancements being developed by the Time-Sensitive Networking Task Group as part of IEEE 802.1 emerge as the future of real-time communication over Ethernet networks for automotive and industrial application domains. In particular IEEE 802.1Qbv is key to enabling timeliness guarantees via so-called time-aware shapers. In this paper, we address the computation of fully deterministic schedules for 802.1Qbv-compliant multi-hop switched networks. We identify and analyze key functional parameters affecting the deterministic behaviour of real-time communication under 802.1Qbv and, based on a generalized configuration of these parameters, derive the required constraints for computing offline schedules guaranteeing low and bounded jitter and deterministic end-to-end latency for critical communication flows. Furthermore, we discuss several optimization directions and concrete configurations exposing trade-offs against the required computation time. We also show the performance of our approach via synthetic network workloads on top of different network configurations.

Scheduling Real-Time Communication in IEEE 802.1Qbv Time Sensitive Networks

Assume-guarantee reasoning has long been advertised as an important method for decomposing proof obligations in system verification. Refinement mappings (homomorphisms) have long been advertised as an important method for solving the language-inclusion problem in practice. When confronted with large verification problems, we therefore attempted to make use of both techniques. We soon found that rather than offering instant solutions, the success of assume-guarantee reasoning depends critically on the construction of suitable abstraction modules, and the success of refinement checking depends critically on the construction of suitable witness modules. Moreover, as abstractions need to be witnessed, and witnesses abstracted, the process must be iterated. We present here the main lessons we learned from our experiments, in form of a systematic and structured discipline for the compositional verification of reactive modules. An infrastructure to support this discipline, and automate parts of the verification, has been implemented in the tool MOCHA.

You assume, we guarantee : Methodology and case studies

Contemporary vehicles are getting equipped with an increasing number of Electronic Control Units (ECUs) and wireless connectivities. Although these have enhanced vehicle safety and efficiency, they are accompanied with new vulnerabilities. In this paper, we unveil a new important vulnerability applicable to several in-vehicle networks including Control Area Network (CAN), the de facto standard in-vehicle network protocol. Specifically, we propose a new type of Denial-of-Service (DoS), called the bus-off attack, which exploits the error-handling scheme of in-vehicle networks to disconnect or shut down good/uncompromised ECUs. This is an important attack that must be thwarted, since the attack, once an ECU is compromised, is easy to be mounted on safety-critical ECUs while its prevention is very difficult. In addition to the discovery of this new vulnerability, we analyze its feasibility using actual in-vehicle network traffic, and demonstrate the attack on a CAN bus prototype as well as on two real vehicles. Based on our analysis and experimental results, we also propose and evaluate a mechanism to detect and prevent the bus-off attack.

https://dl.acm.org/doi/pdf/10.1145/2976749.2978302

Error Handling of In-vehicle Networks Makes Them Vulnerable

Networks are a core element of many industrial and automation systems at present. Often these networks transport time- and safety-critical messages that control physical processes. Thus, timely and guaranteed delivery is an essential property of networks for such critical systems. Over the past decade, a variety of network solutions have evolved to satisfy said properties. However, these solutions are largely incompatible with each other and many system architects are forced to deploy different solutions in parallel due to their different capabilities. IEEE 802.1 Time-Sensitive Networking (TSN) is a standardization group that enhances IEEE networking standards, most prominently Ethernet-based networks, with said properties and has the unique potential to evolve as a cross-industry mainstream networking technology. In this survey paper, we give an overview of TSN in industrial communication and automation systems and discuss specific TSN standards and projects in detail as well as their applicability to various industries.

A Perspective on IEEE Time-Sensitive Networking for Industrial Communication and Automation Systems

This book to offers a hands-on guide to designing, analyzing and debugging a communication infrastructure based on the Controller Area Network (CAN) bus. Although the CAN bus standard is well established and currently used in most automotive systems, as well as avionics, medical systems and other devices, its features are not fully understood by most developers, who tend to misuse the network. This results in lost opportunities for better efficiency and performance. These authors offer a comprehensive range of architectural solutions and domains of analysis. It also provides formal models and analytical results, with thorough discussion of their applicability, so that it serves as an invaluable reference for researchers and students, as well as practicing engineers.

Understanding and Using the Controller Area Network Communication Protocol: Theory and Practice

FlexRay is a new high-bandwidth communication protocol for the automotive domain, providing support for the transmission of time-critical periodic frames in a static segment and priority-based scheduling of event-triggered frames in a dynamic segment. The design of a system scheduling with communication over the FlexRay static segment is not an easy task because of protocol constraints and the demand for extensibility and flexibility. We study the problem of the ECU and FlexRay bus scheduling synthesis from the perspective of the application designer, interested in optimizing the scheduling subject to timing constraints with respect to latency- or extensibility-related metric functions. We provide solutions for a task and signal scheduling problem, including different task scheduling policies based on existing industry standards. The solutions are based on the Mixed-Integer Linear Programming optimization framework. We show the results of the application of the method to case studies consisting of an X-by-wire system on actual prototype vehicles.

/pdf/schedule-optimization-of-time-triggered-systems-53vt4o6mp7.pdf

Schedule Optimization of Time-Triggered Systems Communicating Over the FlexRay Static Segment

/pdf/understanding-and-using-the-controller-area-network-14wz5qyrwy.pdf

Understanding and Using the Controller Area Network Communication Protocol

System and method for optimizing a data flow diagram based on access pattern information are described. Access pattern information for a data flow diagram may be received. The data flow diagram may include a plurality of interconnected actors, e.g., functional blocks, visually indicating functionality of the data flow diagram. The access pattern information may include one or more of: input pattern information specifying cycles on which tokens are consumed by at least one of the actors, or output pattern information specifying cycles on which tokens are produced by at least one of the actors. A program that implements the functionality of the data flow diagram may be generated based at least in part on the access pattern information.

Optimization of a data flow program based on access pattern information

FlexRay is a new communication protocol for automotive systems, providing support for transmission of periodic messages in static segments and priority-based scheduling of event-triggered messages in dynamic segments. The design of a FlexRay schedule is not an easy task because of protocol constraints and demands for extensibility and flexibility. We study the problem of FlexRay bus scheduling from the perspective of the application designer, interested in optimizing the performance of application related timing metrics or extensibility. We provide solutions for different task scheduling policies on existing industry standards based on a mixed integer linear programming (MILP) framework.

Arkadeb Ghosal

Papers

Understanding and Using the Controller Area Network Communication Protocol: Theory and Practice

Schedule Optimization of Time-Triggered Systems Communicating Over the FlexRay Static Segment

Understanding and Using the Controller Area Network Communication Protocol

Optimization of a data flow program based on access pattern information

Scheduling the FlexRay bus using optimization techniques