# Prevention of Controller Area Network (CAN) Attacks on Electric Autonomous Vehicles
###### Abstract
This further expands the attack surface as an attack on a single ECU can be transferred to other ECUs that communicate with the attacked ECU. Hence, a malicious code injection attack or a code reprogramming attack on a single ECU can affect all ECUs connected to the CAN, which, depending on the vehicle architecture, could be the whole system. A CAN bus was introduced to vehicles to enable real-time communication between the vehicles' ECUs to enhance the functionalities, performance, comfort, and safety of the vehicles. Although the CAN bus is designed for safe communication, it is not designed for secure communication, which has led to various vulnerabilities, such as the deficiency in network segmentation, the lack of device authentication, and the absence of data encryption [1]. Such vulnerabilities can be exploited by attackers, who have access to the network, to gain knowledge of private information, alter the vehicle's behavior, impersonate an ECU, and perform a denial-of-service (DoS) attack. An attacker can gain access to an ECU by adding a malicious code to an existing ECU that performs the attack, or by introducing a malicious ECU to the network. Between these two paths of attacks, the path of adding a malicious code to an existing ECU is more dangerous because it can be performed remotely without the need for physical access to the vehicle, and it can be scaled to other vehicles that contain the same vulnerability. Existing mitigation schemes against CAN bus attacks rely on cryptographic algorithms for encryption and authentication, or on machine learning and deep learning algorithms implemented in intrusion detection systems (IDS). Although both of these types of algorithms are capable of preventing or detecting CAN bus attacks, each has its limitations. Cryptographic encryption and authentication algorithms introduce latency in communication, rely on the secrecy and strength of the used key, may require changes to all CAN nodes, and may alter CAN bus behavior. IDS systems lack mitigation actions, are not able to detect all attacks, introduce communication latency, rely on data training, and may not detect minor deviation attacks. Because of the mentioned limitations, this paper suggests the usage of a mitigation scheme that detects and mitigates attacks at the ECU level rather than at the network level. The proposed secure boot scheme is able to detect and stop attacks at an early stage by detecting the presence of a malicious code in an ECU that is connected to the CAN bus and preventing the execution of that malicious code. This prevents the manipulation of the CAN bus that may have resulted from the malicious code. The contributions of this manuscript are as follows: (1) It presents a secure boot scheme to eradicate the root cause of most CAN bus attacks by detecting and mitigating the presence of malicious code in all vehicle ECUs that are connected to the bus. (2) It implements and tests five different variants of the suggested secure boot scheme, using the TC399 32-bit AURIX(tm) TriCore(tm) microcontroller via the usage of a productized ready-to-deploy software. The five tested variants are the hash variant, hash-based message authentication code (HMAC) variant, cipher-based message authentication code (CMAC) variant, elliptic curve digital signature algorithm (ECDSA) variant, and RSA signature scheme with appendix-probabilistic signature scheme (RSASSA PSS) variant. (3) It compares the results of the tested variants and concludes that the most appropriate variants to be used are the CMAC variant, as it is the fastest, and the ECDSA variant, as it provides higher security than the CMAC variant with an acceptable speed downgrade. (4) It introduces a new secure boot variant that is based on the novel ECDSA-CMAC data integrity algorithm,which results in a 19% increase in performance over the traditional hash-based ECDSA variant.