KR101734505B1 - Method and apparatus for detecting attack in vehicle network - Google Patents

Abstract

According to one aspect of the present invention, a method for detecting an attack in a vehicle network by using an attack detection device connected to a vehicle network comprises: a step of allowing the attack detection device to receive a message from the network and obtain the voltage value of a signal including the message; a step of obtaining an identifier (ID) of the received message; a step of comparing the obtained voltage value with a predetermined voltage range according to the ID of the received message; and a step of determining that an attack has occurred if the obtained voltage value is not included in the normal voltage range as a result of the comparison.

Description

[0001] METHOD AND APPARATUS FOR DETECTING ATTACK IN VEHICLE NETWORK [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention [0002] The present invention relates to a communication method of a vehicle network, and more particularly, to a method and apparatus for detecting an external attack in a vehicle internal network.

Vehicles are made up of several parts, and in recent years, many parts are made up of electronic equipment and controlled by an electronic control unit (ECU).

Many parts such as engine, transmission and airbag are dispersed in various parts of the vehicle. Therefore, in order to control them effectively, control commands are transmitted in the vehicle using CAN (Controller Area Network) communication and LIN (Local Interconnect Network) .

In the conventional vehicle, since the CAN communication or the LIN communication is used in a closed network environment, there is a problem that the security function is not applied and merely verifies whether there is an error in transmission.

In recent years, the communication inside the vehicle has changed from the conventional closed network to the open network. However, there is not enough technology to prepare for hacking such as an external attack. In particular, the CAN communication protocol does not have the sender and receiver identification information, There is a problem that security is very weak because it does not exist separately.

In addition, CAN communication is designed without consideration of security technology, so there is a limitation in terms of scalability to apply a new type of security method while maintaining compatibility with existing devices.

In CAN, methods to utilize the message authentication code mainly to prevent the device (node, ECU, etc.) infected by the newly installed or hacking by falsifying the data or disguising it as the transmission of the normal device are presented .

These methods should use secure cryptographic algorithms such as hash functions, mechanisms for managing keys between ECUs, identity authentication between nodes using secret keys, key generation and key authentication / management functions.

However, since it requires a high computational complexity to implement them, it may constitute a problem in a vehicular embedded system which requires real-time control and is composed of limited computing resources and memory.

In order to overcome the above-mentioned problems, the present invention overcomes the limitations of the extensibility by additionally introducing a hardware security module that processes security-related operations separately. However, in order to apply it to an existing network, There is a problem that development and installation costs increase.

SUMMARY OF THE INVENTION The present invention has been made in view of the technical background as described above, and it is an object of the present invention to provide a method and apparatus for improving security by detecting an attack of a vehicle network using a protocol of existing CAN communication without adding an authentication method for new hardware or security The purpose is to provide.

The objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood by those skilled in the art from the following description.

According to another aspect of the present invention, there is provided a method for detecting an attack of a vehicle network using an attack detection apparatus connected to a vehicle network, the method comprising: And obtaining a voltage value of a signal including the message; Confirming an identifier (ID) of the received message; Comparing a predetermined voltage range according to the obtained voltage value and an identifier of the received message; And determining that an attack is detected if the obtained voltage value is not included in the normal voltage range as a result of the comparison.

According to another aspect of the present invention, there is provided an apparatus for detecting an attack in a vehicle network, comprising: a message receiver for receiving a message from a network and obtaining a voltage value of a signal including the message; A message identifying unit for identifying an identifier of the received message; A voltage determination unit for comparing a predetermined voltage range according to the obtained voltage value and the identifier of the message stored in the storage unit; A control unit for determining an attack if the obtained voltage value is not included in the normal voltage range as a result of the comparison by the voltage determination unit, and controlling the output of the result to the output unit as a result; A result output unit for informing an attack result to the network under the control of the control unit; And a storage unit for storing a normal voltage range and a boundary voltage range of a message signal reflecting a voltage drop value depending on a distance between each node connected to the network and the following attack detection apparatuses.

According to the present invention, there is an effect that the security of a vehicle can be enhanced by blocking an attack on a vehicle network without modifying other modules in the existing vehicle or the CAN protocol.

1 shows a data frame structure of a CAN protocol;
2 is a structural view of a vehicle internal network using a conventional CAN protocol.
3 is a structural view of a vehicle internal network in which an apparatus for detecting an attack of a vehicle network is installed according to an embodiment of the present invention.
4 is a structural view of an apparatus for detecting an attack of a vehicle network according to an embodiment of the present invention.
5 is a flowchart of an attack detection method for a vehicle network according to another embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. As used herein, the terms " comprises, " and / or "comprising" refer to the presence or absence of one or more other components, steps, operations, and / Or additions.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 shows a data frame structure of the CAN protocol.

Basically, CAN is composed of a multi-master network and transmits a message in CSMA / CD & AMP (Carrier Sense Multiple Access / Collision Detection with Arbitration on Message Priority).

Since the message addressing scheme is used, messages can be distinguished only by a message identifier (ID), but identification information of a transmission node is not used. That is, it is an unknown structure from which ECU the message is transmitted.

In the CAN protocol, the arbitration field is composed of 11 bits (CAN 2.0A) or 29 bits (CAN 2.0E), depending on whether the standard is CAN 2.0A or the extension standard CAN 2.0B.

The structure of the field according to each standard is shown in the following Tables 1 and 2.

Field name Length (bits) Contents Start-of-frame (SOF) One Notice the start of frame Identifier 11 A unique identifier and priority for the message. Remote transmission request (RTR) One 0 for data frame, 1 for remote request frame Identifier extension bit (IDE) One 0 in base frame format (1 in extended) Reserved bit (r0) One Reserved bit, unconditionally set to 0 Data length code (DLC) 4 Represents data length of 0 ~ 8 bytes Data field 0 to 64 Data to be transmitted having a predetermined length in the DLC CRC 15 Cyclic redundancy test CRC delimiter One Must be set to 1 ACK slot One Transmitter is set to 1 and receiver is set to 0 ACK delimiter One Must be set to 1 End-of-frame (EOF) 7 Must be set to 1

Field name Length (bits) Contents Start-of-frame (SOF) One Notice the start of frame Identifier A 11 The first unique identifier and priority of the message. Substitute remote request (SRR) One Must be set to 1 Identifier extension bit (IDE) One Since this is an extended frame, it must be set to 1, and a total of 29 bits of identifier is used. Identifier B 18 The second unique identifier and priority of the message. Remote transmission request (RTR) One 0 for data frame, 1 for remote request frame Reserved bits (r1, r0) One Reserved bit, unconditionally set to 0 Data length code (DLC) 4 Represents data length of 0 ~ 8 bytes Data field 0 to 64 Data to be transmitted having a predetermined length in the DLC CRC 15 Cyclic redundancy test CRC delimiter One Must be set to 1 ACK slot One Transmitter is set to 1 and receiver is set to 0 ACK delimiter One Must be set to 1 End-of-frame (EOF) 7 Must be set to 1

The ECUs (Electronic Control Units) that constitute each node of the CAN check whether the bus of the CAN is Busy or Idle, and then transmit the message. If multiple nodes send data to the bus at the same time and a message collision occurs, the identifier (Identifier or Identifier A, B) in the arbitration field is checked and the priority is determined. At this time, the lower the identifier value of the message, the higher the transmission priority, and only the node having the highest priority message acquires the right to use the CAN bus. A node with a low priority message is put into a wait state, and after a high priority message transmission is completed, the node attempts to retransmit on the next bus cycle.

A representative security vulnerability of this CAN protocol is that it is very vulnerable to message forgery attacks because there is no sender and recipient identification information in the message and there is no separate field for authentication.

2 shows the structure of a general in-vehicle network 200 using CAN.

The network 200 has a structure (bus topology) in which a plurality of ECU nodes 222, 224, 226, and 228 are connected to a single CAN bus 210. Terminal resistors 232 and 234 are provided at both ends of the bus 210 to prevent reflection phenomenon at the terminal or the breakdown point of the bus 210.

As described above, only the node having the highest priority among the first node 222 to the fourth node 228 can access the bus 210 to transmit the message and the other nodes can transmit the next bus 210 ) Cycle.

FIG. 3 shows a structure of an in-vehicle network in which an apparatus 300 for detecting an attack of a vehicle network is installed according to an embodiment of the present invention.

The attack detection device 300 of the vehicle network can access a conventional CAN bus 210 and receive a message transmitted from each node.

Even if the attack detection apparatus 300 receives and analyzes the message, it does not know which node sent the message because there is no field in the message to identify the sender.

However, since the lengths (L ₁ , L ₂ , L ₃ , and L ₄ ) from the attack detection device 300 to the respective nodes are different as shown in FIG. 3, 210 are different. Since the resistance value is proportional to the length of the physical bus 210, the degree of the voltage drop depends on the difference in the resistance value depending on the length of the bus 210.

With this phenomenon, it is possible to confirm whether a message transmitted to the CAN bus 210 is a message transmitted from a normal node. That is, since the message transmitted from the abnormal node is different from the case where the length for reaching the attack detection apparatus 300 is transmitted from the normal node, it is determined whether the message is abnormal due to the attack by calculating the voltage difference calculated according to Equation (1) can do.

Since the voltage drop value V _drop is determined by the current (I _wire ) and the resistance (R _wire ) value flowing in the bus 210, the node 1 222 to the node 4 228 have the voltage drop value The message due to an abnormal node has a voltage drop value different from the voltage drop caused by the node 1 222 to the node 4 224. Therefore, the voltage drop value of the message is calculated to distinguish the message sent from the abnormal node .

To this end, the automotive network attack detection apparatus 300 includes a micro controller unit (MCU), an analog-to-digital converter (ADC) and an error detection unit A CAN controller capable of generating an error frame that can be notified at any time.

4 shows a structure of an apparatus 300 for detecting an attack of a vehicle network according to an embodiment of the present invention.

The attack detection apparatus 300 includes a message receiving unit 310, a message identifying unit 320, a voltage determining unit 330, a control unit 340, a result output unit 350, and a storage unit 360.

The message receiving unit 310 receives the message signal of the physical CAN bus 210, converts it into a CAN message, and simultaneously performs sampling on the voltage value of the message signal.

The message identifying unit 320 can determine the node that transmitted the message based on the ID of the message received by the message receiving unit 310. [

The voltage determining unit 330 corrects the voltage values of the message signal sampled by the message receiving unit 310 through a filter and then calculates an average of the sampled values and determines whether the average value falls within a normal voltage range or a boundary voltage range do.

For this, the voltage determination unit 330 stores the normal voltage range and the boundary voltage range of the message signal according to the distance between the message transmission node determined by the message ID in the message identification unit 320 and the attack detection apparatus 300, .

The storage unit 360 stores the normal voltage range and the boundary voltage range according to each message ID, taking into account the voltage drop due to the distance difference from each node to the attack detection apparatus 300. The steady voltage range value and the boundary voltage range value stored in the storage unit 360 may be updated by applying the moving average method to the voltage value of the new message received by the attack detection apparatus 300 instead of the fixed value.

The reason why the moving average is used for the stored voltage value is that the temperature in the vehicle changes from time to time and thus the resistance value between each node and the attack detecting apparatus 300 changes, to be.

Equation (2) represents a change in resistance according to the temperature in the vehicle.

는 온도에 따른 도체의 저항 변화 계수로, 도체의 종류에 따라 달라지며 전선으로 많이 쓰이는 구리의 경우

Ω/℃이다. T는 현재 온도이고, T_ref는 R_ref를 측정했을때의 기준 온도를 나타낸다.R (T) is the resistance of the conductor with temperature T, and R _ref is a reference resistance at a specific temperature, typically set at 20 ° C.

Is the coefficient of resistance change of conductor according to temperature, it depends on the kind of conductor,

Ω / ° C. T is the current temperature and T _ref is the reference temperature when R _ref is measured.

By applying the moving average value to the stored voltage range, it is possible to actively adapt to a sensitive situation change such as a temperature change.

The voltage range stored in the storage unit 360 may be individually stored in consideration of a voltage drop that varies for each node or may be stored separately by adjusting a message transmission voltage for each node in consideration of a voltage drop, May be constant. It is possible to identify only one voltage range without distinguishing what the message transmitting node is, by adjusting the voltage received by the attack detecting device 300 constantly, and it is possible to simplify the determination of the attack.

The steady voltage range refers to a range of voltage that reflects the voltage drop value depending on the distance between the transmitting node and the attack detecting device 300 in consideration of the voltage sampling error of the message receiving unit 310 and the like.

Although the boundary voltage range does not fall within the normal voltage range, since the in-vehicle temperature or noise on the bus 210 may affect the voltage drop, the voltage range necessary to lower the probability of mis- it means.

The control unit 340 performs processing of the attack detection device 300 according to the determination result of the voltage determination unit 330.

Basically, it can be judged as an attack if it is not in the normal voltage range, but it can be judged as an attack only when the count value exceeds a predetermined threshold value by setting an attack detection count value. The voltage value temporarily changes due to external noise or the like.

A moving average method or the like can be used as a method of updating and updating the normal voltage range stored in the storage unit 360 by using the sampled voltage value.

When the determined voltage value belongs to the boundary voltage range, it requests retransmission of the message to confirm the attack. If the voltage value does not fall within the normal or boundary voltage range, it increases the attack detection counter without judging the message modulation by the attack.

If the count value exceeds the threshold value after the attack detection counter is increased, it is determined that the message is modulated due to an attack. If the count value is below the threshold value, control is performed to request the result output unit 350 to request the message output retransmission Waiting to receive CAN messages.

If the voltage value determined by the voltage determination unit 330 falls within the normal voltage range, the result output unit 350 determines that the message is a normal message and does not perform any operation. If the attack detection count value exceeds the threshold value, It is determined that the message is modulated by the attacker, so that it is determined that the attack is an attack, and a message is transmitted to each node or a warning to the driver of the vehicle can be made.

Notifying each attack is also possible by transmitting a CAN message to the network. However, if there is an attack, a message informing an attack may be falsified by an attacker. Therefore, the result output unit 350 and the node Can be used.

5 is a flowchart illustrating a method of detecting an attack of a vehicle network according to another embodiment of the present invention.

The attack detection apparatus 300 receives all the CAN messages transmitted to the CAN bus (S510) and also obtains the voltage value of the received message by sampling and obtains the average value of the sampled voltage values.

After receiving the CAN message, the ID of the message is confirmed (S520), and it is confirmed whether the message is transmitted from a node on the network, and the comparison with the previously stored voltage value is performed (S530).

The range of the voltage value corresponding to the node identified by the message ID is set in advance in the storage unit of the attack detection apparatus 300 Calculated or measured and stored.

If the sampled voltage value is compared with the normal range of the voltage value corresponding to the stored message ID (S540), the normal range stored in the storage unit is compared with the sampled voltage value And updates the moving average by a method of calculating a moving average (S542).

If the sampled voltage value is not within the normal range, it is determined whether the sampled voltage value is within the boundary range (S550). If the sampled voltage value is not within the normal range, the attack detection count value is increased (S552).

The reason for not judging an attack immediately when there is not a boundary range is that the voltage value of a message may be erroneously measured due to temperature change or noise of the vehicle network.

If it is determined in step S554 that the count value exceeds the threshold value, the attack is determined to be an attack and the attack is notified in step S556. If the count value does not exceed the threshold value, It is requested to retransmit the message (S572).

If it is determined that it is in the boundary range (S550), it is determined whether it is the value belonging to the initial boundary range or the retransmitted message (S560).

If it is the first time that it is determined to belong to the boundary range, the voltage value determined to belong to the current boundary range is stored for comparison with the voltage value of the retransmitted message in step S570, and the retransmission of the message is requested in step S572.

If the voltage value is determined to belong to the boundary range by retransmission, the voltage value is compared with the voltage value stored in the previous boundary range (S562), and it is determined whether the voltage value has moved in the direction corresponding to the normal range (S564) The voltage value is stored again (S570) and a message retransmission is requested (S572). If the voltage value approaches the normal range due to the retransmission, it may belong to the normal range at the next retransmission.

If it is determined that there is a possibility of an attack, the attack detection count value is increased (S552), and the attack is determined according to the count value (S554).

By using the above-described attack detection device and security method of the vehicle network, the security of the vehicle can be enhanced by blocking attacks against the vehicle network without modification of the CAN protocol or other modules in the existing vehicle.

While the present invention has been described in detail with reference to the accompanying drawings, it is to be understood that the invention is not limited to the above-described embodiments. Those skilled in the art will appreciate that various modifications, Of course, this is possible. Accordingly, the scope of protection of the present invention should not be limited to the above-described embodiments, but should be determined by the description of the following claims.

Claims (12)

A method for detecting an attack in a vehicle network using an attack detection device connected to a vehicle network,
The attack detection device receiving a message from the network and obtaining a voltage value of a signal including the message;
Confirming an identifier (ID) of the received message;
Comparing a predetermined voltage range according to the obtained voltage value and an identifier of the received message; And
Determining that an attack is made if the obtained voltage value is not included in the normal voltage range;
And detecting an attack of the vehicle network. 2. The method of claim 1, wherein the determining comprises:
Increasing the attack detection count value if the obtained voltage value is not included in the normal voltage range, and determining that the attack is detected when the attack detection count value exceeds a preset threshold value
A method of detecting an attack in a car network. 2. The method of claim 1, wherein the determining comprises:
Determining whether the obtained voltage value is included in the boundary voltage range if the obtained voltage value is not included in the normal voltage range,
And requesting the network to retransmit the message if the obtained voltage value is included in the boundary voltage range
A method of detecting an attack in a car network. 4. The method of claim 3, wherein the determining comprises:
Determining whether the received message is a message based on the retransmission request if the acquired voltage value is not included in the boundary voltage range,
Storing the acquired voltage value and requesting retransmission of the message to the network if the message is not a message based on the retransmission request,
And if the voltage value obtained by the retransmission is closer to the steady voltage range than the stored voltage value, if the message is a message based on the retransmission request, Requesting retransmission of the received message again, and determining that the attack is not close to the normal voltage range
A method of detecting an attack in a car network. 2. The method of claim 1, wherein the determining comprises:
If the obtained voltage value is included in the normal voltage range, it is determined that the voltage value is not an attack, and the normal voltage range is updated by reflecting the obtained voltage value to the normal voltage range
A method of detecting an attack in a car network. 6. The method of claim 5,
Updating the steady-state voltage range may involve using a moving average method
A method of detecting an attack in a car network. A message receiving unit for receiving a message from a network and obtaining a voltage value of a signal including the message;
A message identifying unit for identifying an identifier of the received message;
A voltage determination unit for comparing a predetermined voltage range according to the obtained voltage value and the identifier of the message stored in the storage unit;
A control unit for determining an attack if the obtained voltage value is not included in the normal voltage range as a result of the comparison by the voltage determination unit, and controlling the output of the result to the output unit as a result;
A result output unit for notifying each node or driver connected to the network of an attack result under the control of the control unit; And
A storage unit for storing a normal voltage range and a boundary voltage range of a message signal reflecting a voltage drop value depending on a distance between each node connected to the network and a following attack detection apparatus;
And an attack detection unit for detecting an attack of the vehicle network. 8. The apparatus of claim 7, wherein the control unit
Increasing the attack detection count value if the acquired voltage value is not included in the normal voltage range, and determining that the attack is detected when the attack detection count value exceeds a preset threshold value
Of a vehicle network. 8. The apparatus of claim 7, wherein the control unit
Determining whether the obtained voltage value is included in the boundary voltage range if the obtained voltage value is not included in the normal voltage range,
And requesting the network to retransmit the message if the obtained voltage value is included in the boundary voltage range
Of a vehicle network. 10. The apparatus of claim 9, wherein the control unit
Determining whether the received message is a message based on the retransmission request if the acquired voltage value is not included in the boundary voltage range,
Storing the acquired voltage value and requesting retransmission of the message to the network if the message is not a message based on the retransmission request,
And if the voltage value obtained by the retransmission is closer to the steady voltage range than the stored voltage value, if the message is a message based on the retransmission request, Requesting retransmission of the received message again, and determining that the attack is not close to the normal voltage range
Of a vehicle network. 8. The apparatus of claim 7, wherein the control unit
If the obtained voltage value is included in the normal voltage range, it is determined that the voltage value is not an attack and the normal voltage range is updated by reflecting the obtained voltage value to the normal voltage range
Of a vehicle network. 12. The method of claim 11,
Updating the steady-state voltage range may involve using a moving average method
Of a vehicle network.

Images