Spoofing Attack on Clock Based Intrusion Detection System in Controller Area Networks

The Controller Area Network (CAN) protocol is still a de-facto standard for in-vehicle communication between Electronic Control Units (ECUs). The CAN protocol lacks basic security features such as absence of sender node information, absence of authentications mechanism and the plug and play nature of the network. The payload in a CAN data packet is very small i.e. 8 bytes, therefore, implementation of cryptographic solutions for data integrity verification is not feasible. Various methods have been proposed for ECU identification, one of the methods is clock intrusion detection system (CIDS) [14]. The proposed method is based on authenticating the message sender by estimating the unique characteristics of the clock crystal. In an asynchronous network, the clocking information in a transmitted payload is entirely dependent upon the crystal which invokes the clock. These unique characteristics exists because of the asymmetry in the microstructure of the material. The challenge is to correctly estimate these unique characteristics. Authors proposed the technique to estimate the parameters sufficient enough to prove the clock uniqueness. This method is efficient in detecting the advanced variants of source spoofing attacks. In this paper, we have analyzed the design and architecture of the proposed method and found different weaknesses in the gist of the technique. These weaknesses are present in the mathematical model and can easily be exploited under the same threat models which have been used to evaluate CIDS previously. These vulnerabilities attack the assumption that constructed mathematical model of the sender node at monitoring or receiver is unique. We have proved it that exploiting the proposed vulnerabilities is sufficient to construct the same model for the traffic stream generated from the compromised node. As a proof of concept, we have proposed an attack, clock-spoofing attack, which can be used easily to bypass the CIDS by replicating the clock parameters, hence challenging the assumed uniqueness of clock parameters. Under our observations and the analysis of the found weaknesses, we have concluded that current approach to realize CIDS or similar solutions are defective and are prone to the advanced spoofing attacks. To mitigate against such advanced attacks, we have proposed an idea of authenticating the ECU’s based on the immutable unique fingerprints in the electrical signals at physical layer. Electrical devices leave unique fingerprints in the transmitted signal due to natural asymmetry of the material, which can be used to fingerprint the source. As per the CAN transmission at physical level, these are the dominant bits which are transmitted instead of the recessive bits. So, a statistical analysis of the dominant bits in the Proceedings of the 2018 Ground Vehicle Systems Engineering and Technology Symposium (GVSETS) Spoofing Attack on Clock Based Intrusion Detection System in Controller Area Networks, Tayyab, et al. Page 2 of 13 received physical signal will contain the unique characteristics of the transmitter which can be used for designing an efficient and highly accurate Intrusion Detection System for CAN Bus. We have discussed this idea briefly. INTRODUCTION The Controller Area Network (CAN) is commonly used networking protocol in the embedded systems’ world and can be found in various industries e.g. automotive, aerospace applications and the industrial plants [1]. It is the primary backbone for the in-vehicle communication. A modern vehicle consists of many embedded devices, also known as Electronic Control Units (ECUs), which are responsible for carrying a broad range of functionalities and implementing the advanced features. These functions range from collecting the data from numerous sensors, like Tire Pressure Monitoring System (TPMS), to the controlling different mechanical parts like Engine Control Module (ECM) [2,3]. Many functionalities and the features are possible due to the communication between different ECUs, which is made possible due to the robust and the reliable CAN bus. CAN is a legacy protocol for embedded networking which was developed in 1980s, hence, lacks the basic security features by the design. The most important of which is the absence of the sender information in the message packet. Moreover, the concise design of packet forbids the implementation of modern source authentication techniques as well. Due to the bus-based topology of the network, every node has the capability to receive and transmit the traffic in network. All these weaknesses combined, lead to a variety of the spoofing attacks [4]. If an ECU on the bus is compromised it can be used to transmit the malicious packets on the bus. Charlie Miller and Chris Valasek could take down the FCA Jeep on the highway by remotely injecting the malicious packets from a compromised node on the CAN bus [2,5,6]. The broadcast nature of the CAN protocol makes it possible for any node to sniff the traffic and then replaying the traffic on the bus [7,8]. Such kind of attacks are still feasible even in the most of modern vehicle if the CAN bus is exposed to the attacker by any means. The small size of the data payload in a CAN packet makes it entirely infeasible for the cryptographic solutions of the message authentication. E.g. the data field in the CAN data packets is 8 bytes but the smallest message authentication code MAC requires at least 16 bytes field which twice as big as the actual data. Implementation of any such solution deteriorates the performance and robustness of the CAN protocol. The connectivity features like WiFi, Bluetooth, In-vehicle Infotainment Systems etc. are increasing the attack surfaces for the vehicles as well. Keeping in view the CAN compromises, the researchers have proposed many solutions for invehicle networks security at different layers e.g. physical layer [14,23] and data link layer by using various types of message authentication methods [7,15,16,22]. Different methods have been proposed by researchers for security of vehicle. One of the proposed method is Clock based Intrusion Detection System (CIDS), this method is efficient in detecting a broad range of spoofing attacks. In this paper, we have analyzed the architecture of the proposed method and have found the potential vulnerabilities inherent to the design and basic mathematical assumptions. If exploited, these vulnerabilities can be used to fabricate a spoofing attack which can easily bypass the CIDS. Based on our analysis and vulnerabilities, we have concluded that the current modeling of clock characteristics is infeasible and will have the limitations always. Instead, we have briefly overviewed another physical fingerprinting method based on the electrical signals in order to authenticate the message transmitter. This paper is organized as follows, section II provides an overview of CAN-Bus protocol, section III is an overview of CIDS. In section IV we have discussed the potential weaknesses and proposed attack to bypass these vulnerabilities. Proceedings of the 2018 Ground Vehicle Systems Engineering and Technology Symposium (GVSETS) Spoofing Attack on Clock Based Intrusion Detection System in Controller Area Networks, Tayyab, et al. Page 3 of 13 Section V provides our method which is used for identifying the ECUs based upon statistical characteristics. CAN-BUS PROTOCOL: AN OVERVIEW The CAN bus consists of the twisted pair cable, as a medium of the signal propagation, known as CAN High and CAN Low. Variants of CAN signaling is used to achieve different data rates. For automotive applications, generally, the CAN bus data rate is set to 500 kbps. At this speed, to transmit bit ’1’, also known as the recessive bit, both the CAN Low and CAN High wires operate at approximately 2.5 volts; while, for the transmission of the ’0’, also known as the dominant bit, CAN High wire is drawn towards the 5V and the CAN Low is drawn towards the 0 volts Figure 1. The CAN bus is a broadcast-based networking topology where all of the nodes on the bus receive the message. The message packets do not contain the information regarding the sender and the receiver. The message packets are identified by the Arbitration Field also known as CAN ID. This field is used for prioritizing the messages, the lower the ID, the higher is the priority. When different nodes happen to send the message at the same time, the bus arbitration kicks in. In that case, the message with the lower ID is transmitted. Based on the type of the messages, the CAN packets can be classified as the data frame, control frame and error frame. The data frame is the focus of this paper. Shown in Fig. 2 is the structure of the CAN data frame. The Arbitration Field, also known as ID, is an identifier which used for the identification of the message. Its length is 11-bit (standard CAN protocol) or 29-bit (CAN-extended protocol). The DLC field indicate the length of the data field (in bytes). The DLC field is 3 bit long, therefore, the standard CAN can support a maximum of 8 bytes of the data field. The CAN data packet also includes the CRC field which is used for detecting the transmission errors, e.g., bit flipping. Figure 1: CAN-bus differential signal representations In in-vehicle CAN network, the messages of a particular ID are transmitted by a certain Electronic Control Unit (ECU). By observing the characteristics of the messages of a specific ID, we can fingerprint the sender ECU of these messages. Researchers have proposed different characteristics and techniques to fingerprint each node in the network and use it to link the CAN packet to the sender node. Figure 2: CAN protocol standard format Researchers have proposed the techniques based on the cryptographic applications as well for securing the traffic in CAN protocol [7,15,16 &23]. But as mentioned, the limited bandwidth and performance overheads in the embedded world of limited resources, are the primary hurdles in adopting