CN114154134A - Method for extracting physical fingerprint information in CAN equipment signal - Google Patents
Method for extracting physical fingerprint information in CAN equipment signal Download PDFInfo
- Publication number
- CN114154134A CN114154134A CN202111505886.1A CN202111505886A CN114154134A CN 114154134 A CN114154134 A CN 114154134A CN 202111505886 A CN202111505886 A CN 202111505886A CN 114154134 A CN114154134 A CN 114154134A
- Authority
- CN
- China
- Prior art keywords
- waveform
- signal
- sequence
- frame
- extracting
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 27
- 230000000630 rising effect Effects 0.000 claims abstract description 19
- 238000000605 extraction Methods 0.000 claims abstract description 15
- 238000012952 Resampling Methods 0.000 claims abstract description 10
- 238000005311 autocorrelation function Methods 0.000 claims abstract description 9
- 238000001514 detection method Methods 0.000 claims abstract description 8
- 238000007906 compression Methods 0.000 claims abstract description 7
- 238000009499 grossing Methods 0.000 claims abstract description 7
- 230000006835 compression Effects 0.000 claims abstract description 5
- 230000001360 synchronised effect Effects 0.000 claims abstract description 5
- 238000005070 sampling Methods 0.000 claims description 16
- 108010076504 Protein Sorting Signals Proteins 0.000 claims description 9
- 238000004364 calculation method Methods 0.000 claims description 5
- 230000005540 biological transmission Effects 0.000 claims description 4
- 238000004458 analytical method Methods 0.000 claims description 3
- 238000007493 shaping process Methods 0.000 claims description 3
- 238000013144 data compression Methods 0.000 claims description 2
- 238000010586 diagram Methods 0.000 description 7
- 238000004891 communication Methods 0.000 description 6
- 238000004519 manufacturing process Methods 0.000 description 3
- 230000007246 mechanism Effects 0.000 description 3
- 230000008569 process Effects 0.000 description 3
- 230000009545 invasion Effects 0.000 description 2
- 239000003990 capacitor Substances 0.000 description 1
- -1 inductors Substances 0.000 description 1
- 238000002955 isolation Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
- G06F13/38—Information transfer, e.g. on bus
- G06F13/42—Bus transfer protocol, e.g. handshake; Synchronisation
- G06F13/4282—Bus transfer protocol, e.g. handshake; Synchronisation on a serial bus, e.g. I2C bus, SPI bus
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2218/00—Aspects of pattern recognition specially adapted for signal processing
- G06F2218/08—Feature extraction
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Small-Scale Networks (AREA)
Abstract
The invention discloses a method for extracting physical fingerprint information in CAN equipment signals, which comprises the following steps: acquiring a differential signal on a CAN gateway side bus by using signal acquisition equipment to obtain an original waveform; positioning the initial position of the frame signal; performing clock synchronization on the original waveform from a frame starting position; resampling the original waveform by using a synchronous signal to obtain an ideal waveform; respectively cutting a rising signal part and a falling signal part in the original waveform by a symbol width, splicing the rising signal part and the falling signal part together to form a characteristic waveform, and forming a reference waveform from an ideal waveform in the same way; and respectively calculating autocorrelation functions of the characteristic waveform and the reference waveform, subtracting the characteristic waveform and the reference waveform to obtain a difference value W, and performing numerical compression and smoothing on the difference value W to obtain the physical fingerprint of the equipment. The invention CAN realize the extraction of the physical fingerprint information in the CAN equipment signal, finally realize the identity authentication and the intrusion detection of the ECU equipment on the CAN bus, and improve the safety of CAN bus access.
Description
Technical Field
The invention relates to the technical field of communication and information security, in particular to a method for extracting physical fingerprint information in CAN equipment signals.
Background
With the development of information modernization and industrial modernization, various devices in the automobile industry and industrial control field are equipped with ECU devices to realize automation and intelligent control. At the same time, the CAN protocol is a de facto standard for ECU communication due to its simplicity and reliability. Although the CAN protocol has high performance and reliability in communication, it is originally designed only in the field of industrial control, and therefore, the CAN protocol is originally designed only for communication contents and formats between modules, and security in communication is not considered. For example, data is directly transmitted in a clear text manner on the CAN bus, and any device accessing the CAN bus CAN send data to other devices on the bus without a relevant terminal authentication mechanism. Also for this reason, the on-board CAN bus CAN be easily attacked, for example, an attacker CAN easily control any one component on the vehicle CAN bus, including the engine, the dashboard, the radio, and even the ABS system, and CAN also interfere with the normal operation of all devices on the entire CAN bus.
At present, some methods are used for detecting ECU equipment invading a CAN bus, but the methods mainly focus on designing an algorithm of an invasion detection system, and carry out warning prompt on a user of the CAN bus system when finding that the message possibly sent by the invasion equipment is possible by monitoring message transmission content on the CAN bus in real time so as to take corresponding measures. Although the methods CAN detect whether the vehicle-mounted CAN bus has intrusion, the methods cannot locate the intrusion device and determine which ECU devices are carrying out intrusion or attack, so that the identity of an attacker cannot be identified and the source cannot be traced. It is important to be able to accurately, efficiently and quickly locate the identity of an attacker because it provides more effective assistance in forensics, isolation, and repair. Therefore, the conventional CAN bus intrusion detection scheme cannot meet the current requirement on safety performance.
The invention provides a physical fingerprint extraction method based on terminal equipment on a CAN bus, which CAN be used for more effectively identifying the intrusion equipment. Because the CAN controller and the driver include a plurality of electronic components, such as capacitors, inductors, and semiconductor triodes, and the electronic components bring various differences due to different manufacturing processes, different manufacturing environments, and other factors in the production process, the differences cause differences in output signals of the CAN controller and the driver, and the output signals are collected, analyzed, and subjected to feature extraction to be used as physical fingerprints of the current CAN device. And the physical fingerprints obtained by the method correspond to the CAN equipment one by one and cannot be tampered. The fingerprint extraction method provided by the text is irrelevant to the content of data sent by CAN equipment and has data independence.
Disclosure of Invention
In order to solve various safety problems caused by the fact that the CAN protocol lacks an identity authentication mechanism and attacks cannot trace the source, the invention provides a method for extracting physical fingerprint information in CAN equipment signals, which comprises the following steps:
step 3, clock synchronization: starting from the frame starting position located in the step 2, establishing a window sequence, and synchronizing each symbol of the frame by using the window sequence to form a synchronization signal;
step 4, resampling: shaping and energy normalizing the original waveform y (n), then resampling the original waveform y (n) by using the synchronous signal, and carrying out level reconstruction on a resampling result according to a decision threshold to obtain an ideal waveform x (n);
step 6, intercepting the data fields of the original waveform y (n) and the ideal waveform x (n) according to the analysis result;
and 7, extracting a characteristic waveform: respectively extracting rising signal part and falling signal part of the original waveform y (n) to obtain BTTyAnd TTBySplicing to form a characteristic waveform O (n); the ideal waveforms x (n) are respectively subjected to rising signalExtracting the signal part and the falling signal part to obtain BTTxAnd TTBxSplicing to form a reference waveform R (n);
and 8, feature extraction: and respectively carrying out autocorrelation operation on the characteristic waveform O (n) and the reference waveform R (n), then calculating a difference value to obtain a waveform W, and carrying out numerical compression and smoothing on the waveform W to obtain the physical fingerprint characteristics of the CAN equipment signal.
Preferably, in step 1, signals on the bus are collected at a gateway position on the CAN bus, the collected signals are differential signals between two paths of signals of a high-bit data line CAN _ H and a low-bit data line CAN _ L on the CAN bus, and the collected differential signals are stored to obtain an original waveform y (n) and a signal sequence y (n) of the CAN signals.
Preferably, in step 1, the acquired signal is a piece of data with fixed content or data with random content. Fixed data means data of fixed content, for example, 0x1010 repeatedly transmitted by a device, and random data means random content transmitted by a device.
Preferably, in step 2, the energy detection includes determining the start position of the frame using a threshold level, where the threshold level is 1/2 of the difference between the high and low levels of the frame.
Preferably, in step 3, the length of the window sequence is the number N of sampling points used by one symbol, N is a ratio of a sampling rate of the signal acquisition device to a data transmission rate of the CAN device, where the baud rate B of the CAN device and the sampling rate F of the signal acquisition device are known, and the position of each symbol in the signal sequence y (N) is located according to the number N of sampling points and the start position of the frame.
Preferably, in the step 4, the decision threshold level is taken from a level decision result at a middle position of each symbol, i.e. an N/2 position, as the level of the current symbol.
Preferably, the data field is taken from the sequence of waveforms in each data frame from the first symbol after the DLC section to the first symbol before the CRC section.
Preferably, in step 7, the original waveform is detected by detecting the rising edge and the falling edgey (n) extracting the falling signal portion to form TTBySequence, extracting rising signal part from original waveform y (n) to form BTTySequence of TTBySequence and BTTySplicing the sequences to form a characteristic waveform O (n); extracting the falling signal part from the ideal waveform x (n) to form TTBxSequence, for ideal waveform x (n), extracting rising signal portion to form BTTxSequence of TTBxSequence and BTTxThe sequence concatenation constitutes the reference waveform r (n).
Preferably, in step 8, the formula for calculating the waveform W is as follows:
whereinIs the autocorrelation function of the characteristic waveform o (n),and (3) taking an autocorrelation function of a reference waveform R (n), wherein l is time shift, compressing and smoothing W to obtain a physical fingerprint of the current CAN equipment signal, and smoothing W to obtain the physical fingerprint characteristic of the equipment.
Preferably, the numerical compression process uses the formula: w ═ log (| W |), l ═ 1,2,3 ….
Compared with the prior art, the invention has the following advantages:
1. compared with an intrusion detection algorithm, the method has a unique identity authentication and attack tracing mechanism, and can better realize access control with more complete functions.
2. Using a separate rising edge falling signal portion as a source of the signature weakens the dependency on the data transmission content.
3. The equipment physical fingerprint extraction method is simple in calculation process and real-time, and additional calculation load cannot be formed on other equipment on the CAN bus.
4. The existing CAN protocol and the existing CAN bus circuit do not need to be modified, and the backward compatibility characteristic is good.
5. The method for extracting the physical fingerprint in the CAN equipment signal CAN extract the equipment physical fingerprint in the CAN signal sent by the ECU terminal equipment on the CAN bus, thereby carrying out identity authentication and attack tracing on the terminal equipment on the CAN bus.
Drawings
FIG. 1 is a schematic diagram of a physical fingerprint extraction process of a CAN device according to the present invention;
FIG. 2 is a schematic diagram of an original waveform collected by the present invention;
FIG. 3 is a diagram illustrating the clock synchronization result of the present invention;
FIG. 4 is a diagram illustrating the data field extraction result of the present invention;
FIG. 5 is a schematic diagram of a falling signal portion extraction according to the present invention;
FIG. 6 is a schematic diagram of a rising signal portion extraction according to the present invention;
FIG. 7 is a graph of the difference between the autocorrelation of the signature and the reference waveform of the present invention;
FIG. 8 is a diagram of physical fingerprints of different devices according to the present invention.
Detailed Description
In order to make the technical details and technical advantages of the present invention more apparent, the following technical solutions are described in more detail with reference to the accompanying drawings. In particular, the figures and the detailed operations used herein are only intended to illustrate the invention, but not to limit it.
As shown in fig. 1, the method for extracting physical fingerprint information from a CAN device signal according to the present invention includes the following steps:
Step 3, clock synchronization: the frame is clock-synchronized, a window sequence is established from the start position of the frame located in the previous step, the window size is one symbol length, namely 20 sampling points, and then each symbol of the frame is synchronized by using the window sequence to form a synchronization signal.
Step 4, resampling: firstly, shaping an original waveform, then performing energy normalization, then resampling the original waveform by using a synchronous signal, and finally performing level reconstruction on a resampling result according to a decision threshold to obtain an ideal waveform x (n), wherein the finally obtained ideal waveform is shown in figure 3.
And 6, extracting a data domain waveform according to the analysis result: for the collected CAN frame original waveform y (n) and ideal waveform x (n), the data field refers to all symbol sequences in a first symbol interval from the first symbol after the DLC section to the first symbol before the CRC section, if filling symbols are included, which are specified in the CAN protocol, and the total number of the symbol sequences is 66 symbols and 1320 sampling points. The specific extraction results are shown in FIG. 4.
And 7, extracting a characteristic waveform: extracting rising signal part and falling signal part of the original waveform y (n) to obtain BTTyAnd TTByThe concatenation constitutes the signature o (n). Similarly, the ideal waveform x (n) is extracted into a rising signal part and a falling signal part to obtain BTTxAnd TTBxThe concatenation constitutes the reference waveform r (n). Specifically, for the falling edge process, the second half period of the previous symbol of each falling edge is included until the first half period of the next symbol, and the specific extraction result is shown in fig. 5. The rising edge process should include the second half of the symbol period before each rising edge, and the specific extraction result is shown in fig. 6. It should be noted that, the length of each of the rising signal portion and the falling signal portion is one symbol length, i.e. 20 sampling points, and finally all the extracted results need to be pieced together into a complete sequence, which has 520 sampling points and 26 symbols.
And 8, extracting characteristics: firstly, calculating an autocorrelation function of a characteristic waveform O (n), then calculating an autocorrelation function R (n) of a reference waveform, subtracting the autocorrelation function R (n) from the autocorrelation function R (n) to obtain W, wherein the calculation formula is as follows:
the calculation of W is shown in fig. 7. And performing numerical compression and smoothing after obtaining W, wherein the data compression is performed by using a formula W' log (| W |), l 1,2, and 3 …, and the final physical fingerprint extraction result of different devices is shown in fig. 8.
The technical means disclosed in the scheme of the invention are not limited to the technical means disclosed in the above embodiments, and equivalent or similar changes to the invention are still within the protection scope of the invention for those skilled in the technical field related to communication and information security.
Claims (10)
1. A method for extracting physical fingerprint information in CAN equipment signals is characterized by comprising the following steps:
step 1, data acquisition: collecting and storing signals on a CAN bus to obtain a CAN signal sequence Y (n) and an original waveform y (n);
step 2, positioning the initial position of the frame: carrying out energy detection on the CAN signal sequence Y (n) and positioning the initial position of a frame;
step 3, clock synchronization: starting from the frame starting position located in the step 2, establishing a window sequence, and synchronizing each symbol of the frame by using the window sequence to form a synchronization signal;
step 4, resampling: shaping and energy normalizing the original waveform y (n), then resampling the original waveform y (n) by using the synchronous signal, and carrying out level reconstruction on a resampling result according to a decision threshold to obtain an ideal waveform x (n);
step 5, analyzing CAN data: analyzing the reconstructed CAN ideal waveform according to a CAN frame protocol format, and simultaneously checking whether the reconstructed CAN ideal waveform is a complete frame;
step 6, intercepting the data fields of the original waveform y (n) and the ideal waveform x (n) according to the analysis result;
and 7, extracting a characteristic waveform: respectively extracting rising signal part and falling signal part of the original waveform y (n) to obtain BTTyAnd TTBySplicing to form a characteristic waveform O (n); extracting rising signal part and falling signal part of the ideal waveform x (n) respectively to obtain BTTxAnd TTBxSplicing to form a reference waveform R (n);
and 8, feature extraction: and respectively carrying out autocorrelation operation on the characteristic waveform O (n) and the reference waveform R (n), then calculating a difference value to obtain a waveform W, and carrying out numerical compression and smoothing on the waveform W to obtain the physical fingerprint characteristics of the CAN equipment signal.
2. The method for extracting physical fingerprint information from CAN device signals according to claim 1, wherein in step 1, signals on the bus are collected at a gateway position on the CAN bus, the collected signals are differential signals between two signals of a high-bit data line CAN _ H and a low-bit data line CAN _ L on the CAN bus, and the collected differential signals are stored to obtain an original waveform y (n) and a signal sequence y (n) of the CAN signals.
3. The method of claim 1, wherein the collected signal in step 1 is a piece of data with fixed content or random content.
4. The method of claim 1 wherein the energy detection in step 2 comprises determining the start position of the frame using a threshold level, the threshold level being 1/2 of the difference between the high and low levels of the frame.
5. The method according to claim 1, wherein in step 3, the length of the window sequence is N sampling points used by a symbol, where N is a ratio of a sampling rate of a signal acquisition device to a data transmission rate of the CAN device, and wherein baud rate B of the CAN device and sampling rate F of the signal acquisition device are known, and the position of each symbol in the signal sequence y (N) is located according to the number N of sampling points and a start position of a frame.
6. The method as claimed in claim 1, wherein in the step 4, the decision threshold level is obtained from a level decision result at a middle position of each symbol, i.e. N/2 position, as the level of the current symbol.
7. The method of claim 1 wherein the data field is taken from a waveform sequence in each data frame from the first symbol after the DLC section to the first symbol before the CRC section.
8. The method of claim 1, wherein in step 7, by detecting the rising edge and the falling edge,extracting the falling signal part from the original waveform y (n) to form TTBySequence, extracting rising signal part from original waveform y (n) to form BTTySequence of TTBySequence and BTTySplicing the sequences to form a characteristic waveform O (n); extracting the falling signal part from the ideal waveform x (n) to form TTBxSequence, for ideal waveform x (n), extracting rising signal portion to form BTTxSequence of TTBxSequence and BTTxThe sequence concatenation constitutes the reference waveform r (n).
9. The method of claim 1, wherein in step 8, the formula for calculating the waveform W is as follows:
whereinIs the autocorrelation function of the characteristic waveform o (n),and (3) performing numerical compression and smoothing on the waveform W to obtain the physical fingerprint of the current CAN equipment signal, wherein l is time shift and is an autocorrelation function of a reference waveform R (n).
10. The method of extracting physical fingerprint information in CAN device signal of claim 9, wherein the numerical compression process uses the formula: w 'is log (| W |), where a positive value is taken for time shift l in the W calculation formula, and W' is the value after data compression.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202111505886.1A CN114154134B (en) | 2021-12-10 | Method for extracting physical fingerprint information in CAN equipment signal |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202111505886.1A CN114154134B (en) | 2021-12-10 | Method for extracting physical fingerprint information in CAN equipment signal |
Publications (2)
Publication Number | Publication Date |
---|---|
CN114154134A true CN114154134A (en) | 2022-03-08 |
CN114154134B CN114154134B (en) | 2024-11-19 |
Family
ID=
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111683035A (en) * | 2020-02-12 | 2020-09-18 | 华东师范大学 | Vehicle-mounted ECU intrusion detection method and system based on CAN bus differential signal level characteristics |
CN113158157A (en) * | 2021-04-01 | 2021-07-23 | 东南大学 | Method for extracting equipment fingerprint information in wired network card signal |
CN113359666A (en) * | 2021-05-31 | 2021-09-07 | 西北工业大学 | Deep SVDD (singular value decomposition) based vehicle external intrusion detection method and system |
CN113709118A (en) * | 2021-08-11 | 2021-11-26 | 西安交通大学 | Physical intrusion equipment positioning method and system for multi-equipment cooperative wave-launching inspection |
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111683035A (en) * | 2020-02-12 | 2020-09-18 | 华东师范大学 | Vehicle-mounted ECU intrusion detection method and system based on CAN bus differential signal level characteristics |
CN113158157A (en) * | 2021-04-01 | 2021-07-23 | 东南大学 | Method for extracting equipment fingerprint information in wired network card signal |
CN113359666A (en) * | 2021-05-31 | 2021-09-07 | 西北工业大学 | Deep SVDD (singular value decomposition) based vehicle external intrusion detection method and system |
CN113709118A (en) * | 2021-08-11 | 2021-11-26 | 西安交通大学 | Physical intrusion equipment positioning method and system for multi-equipment cooperative wave-launching inspection |
Non-Patent Citations (1)
Title |
---|
代寿刚;干莽;宋占伟;: "基于FPGA的CAN总线故障分析仪", 吉林大学学报(信息科学版), no. 05, 15 September 2012 (2012-09-15) * |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
SG10201900339QA (en) | Computing device and method for detecting malicious domain names in a network traffic | |
CN108737318B (en) | OFDM signal identification method and system based on signal structure characteristics | |
US11683323B2 (en) | Method and device for authenticating a message transmitted via a bus | |
CN106850511B (en) | Method and device for identifying access attack | |
CN114154134B (en) | Method for extracting physical fingerprint information in CAN equipment signal | |
CN114154134A (en) | Method for extracting physical fingerprint information in CAN equipment signal | |
CN104270331A (en) | BPSK signal blind identification result effectiveness evaluation method based on HOUGH transformation | |
CN117459186B (en) | Communication method applied to low-voltage electric leakage locator | |
CN118171161A (en) | Transformer online fault diagnosis method and system based on multi-feature voiceprint atlas | |
CN112637029A (en) | Method and device for extracting CAN data frame signal in vehicle | |
CN112560629A (en) | Smart phone key detection method based on 1D-CNN | |
CN113627215B (en) | ECU (electronic control unit) identification method based on CAN (controller area network) signal characteristics and storage medium | |
CN115347978B (en) | Method, device and storage medium for identifying AIS frame header data | |
CN114690745B (en) | Intrusion detection method of CAN bus in vehicle | |
JP7480862B2 (en) | MOBILE BODY, INFORMATION PROCESSING APPARATUS, INFORMATION PROCESSING METHOD, AND PROGRAM | |
CN113395296B (en) | FPGA-based vehicle-mounted network intrusion detection system and message bit time acquisition method | |
CN110336638A (en) | A kind of short-term burst signal detecting method based on time-frequency figure | |
CN116827641A (en) | Vehicle-mounted CAN bus abnormal flow detection tracing method and system | |
CN107404452B (en) | BPSK demodulation method and device, and receiver | |
CN104890625A (en) | Novel anti-theft system of for vehicle | |
KR101673050B1 (en) | Detecting method for malicious intrusion through network by monitoring signal of electronic apparatus and vehicle for detecting malicious intrusion through network by analysing signal of ecu | |
CN109412901B (en) | Method and system for detecting continuity of acquired data based on time domain processing | |
CN113221863A (en) | Encryption protocol identification method, system and medium based on electromagnetic space period statistics | |
CN114298135B (en) | CAN data reverse analysis method and device based on difference method and electronic equipment | |
CN112712046A (en) | Wireless charging equipment authentication method based on equipment hardware fingerprint |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant |