KR102148453B1 - Controller area network system and message authentication method - Google Patents

Abstract

A CAN system and message authentication method are disclosed. The CAN system includes a plurality of ECUs (Electronic Control Units) that transmit and receive messages to and from each other, and a gateway that generates a session key generation random number and transmits it to a plurality of ECUs, and the plurality of ECUs is based on the received session key generation random number. A key is generated, and the first ECU among the plurality of ECUs generates a first MAC based on the generated session key and the MAC generated random number, and sends a message including the generated first MAC and the MAC generated random number among the plurality of ECUs. 2 Transmits to the ECU, and the second ECU generates a second MAC based on the generated session key and the received MAC-generated random number, and determines whether the received first MAC and the generated second MAC are identical to the received message. To authenticate.

Description

CAN system and message authentication method {CONTROLLER AREA NETWORK SYSTEM AND MESSAGE AUTHENTICATION METHOD}

The present disclosure relates to a CAN system and a message authentication method, and more particularly, to a CAN system and a message authentication method for authenticating a message to securely transmit and receive messages between ECUs.

In order to maximize safety and efficiency, modern vehicles include many electronic parts in addition to mechanical parts and hydraulic systems. Along with the increase in electronic parts, the number of ECUs (Electronic Control Units) that control electronic parts is increasing, and in-vehicle communication is used to connect and control ECUs.

Networks mainly used in the three major sectors of the vehicle (powertrain, chassis, and body) are CAN (Controller Area Network), LIN (Local Interconnect Network), and FlexRay, and minimize manufacturing costs, real-time processing, automation, and distributed processing. It is a network where CAN is widely used in demanding vehicles.

CAN is a multi-master network and transmits messages in the CSMA/CD&AMP (Carrier Sense Multiple Access/Collision Detection with Arbitration on Message Priority) method. The CAN node (e.g., ECU) first determines whether the bus is busy (idle, busy) and then sends a message. When data from multiple nodes flows into the bus at the same time and a transmission conflict occurs, CAN determines the transmission priority by comparing the value of the identifier (Arbitration Field) (or message ID), and only the node with the highest priority message Acquire permission to use this CAN bus. In this case, the lower the ID of the message, the higher the transmission priority. A node with a low-priority message enters the standby state and tries to retransmit in the next bus cycle. In other words, only one node can access the CAN bus at a moment, and as described above, only the highest priority message is continuously transmitted by comparing the priority based on the identifier (Arbitration Field), and all other nodes are waiting ( transition to listening) mode. Because CAN uses a message address method, messages can be identified only by an identifier (Arbitration Field), and identification information of a transmitting node is not used.

In the past, the CAN protocol designed for a closed network type of in-vehicle network did not need to consider countermeasures against external hacking or malicious control operations, so there were no security measures. Therefore, in the current in-vehicle network, which is changing to an open network, security technology due to the increase in external attack threat is inadequate, and a method to supplement the vulnerability for an attack is not defined in the standard protocol.

The CAN protocol is very vulnerable to message forgery attacks because there is no sender and receiver identification information, and there is no separate field for authentication. In addition, because the CAN protocol adopts a broadcast communication method without security, an attacker can easily eavesdrop on messages in the network, and can perform replay and masquerade attacks that retransmit or modulate the received contents.

Recently, for the security of the CAN protocol, an encryption-based authentication method, a group-based unanimous authentication method, a MAC-based authentication method, and a group MAC authentication method have been proposed.

An authentication method based on encryption (using a private key and a public key) may be considered, but the encryption method requires a large amount of computation and is difficult to apply because it requires modification of hardware and CAN frames. The group-based unanimous authentication method has a problem in that a new application layer must be implemented in the current CAN protocol to verify the authentication of members within the group. Since the MAC-based authentication method generates and uses the key to be used in advance, there is a problem that the ECU memory size is limited and the key must be generated again after authentication. In the group MAC authentication method, when the number of nodes increases, it is difficult to obtain the advantages of group MAC authentication, and when the number of groups increases, key management becomes difficult.

Accordingly, there is a need for a message authentication method of a CAN system that can be applied and smoothly operated without changing the current CAN protocol.

The present disclosure is to solve the above-described problems, and an object of the present disclosure is to provide a CAN system and a message authentication method that can be applied without changing the current CAN protocol, have high scalability, and are robust against attack by an attacker.

According to an embodiment of the present disclosure for achieving the above object, a controller area network (CAN) system generates a plurality of electronic control units (ECUs) that transmit and receive messages to and from each other, and a random number for generating a session key to generate the plurality of It includes a gateway that transmits to the ECU, wherein the plurality of ECUs generate a session key based on the received session key generation random number, and the first ECU of the plurality of ECUs is based on the generated session key and MAC generated random number. Thus, a first MAC (Message Authentication Code) is generated, and a message including the generated first MAC and the MAC generated random number is transmitted to a second ECU among the plurality of ECUs, and the second ECU is the generated session. A second MAC is generated based on a key and the received MAC generated random number, and the received message is authenticated by determining whether the received first MAC and the generated second MAC are identical.

And, the first ECU generates a message transmission key based on the session key and the MAC generated random number, generates a first MAC based on the generated message transmission key, the MAC generated random number and data, and the generation The first MAC, the MAC generated random number, and the data may be included in the data field of the message and transmitted to the second ECU.

Further, the second ECU generates a message reception key based on the session key and a MAC generated random number included in the data field of the received message, and generates the generated message reception key and the MAC included in the data field. A second MAC may be generated based on the random number and the data.

In addition, the gateway may update the session key generation random number every preset time.

Also, the gateway may update the session key based on the updated session key generation random number and a hash function.

In addition, the gateway generates an update transmission key based on the session key and a session update MAC generated random number, and generates a first update MAC based on the generated update transmission key, the session update MAC random number, and update data. , The generated first update MAC, the updated session key generation random number, the session update MAC generation random number, and the update data may be included in a data field of an update message and transmitted to the plurality of ECUs.

Meanwhile, each of the plurality of ECUs generates an update reception key based on the session key and a random number of session update MAC generation included in the data field of the received update message, and the generated update reception key, included in the data field. Generates a second update MAC based on the generated random number of generated session update MAC and the update data, and authenticates the received update message by determining whether the received first update MAC and the generated second update MAC are identical And, the session key may be updated based on the updated session key generated random number and a hash function.

According to an embodiment of the present disclosure for achieving the above object, in the message authentication method of the CAM system, a gateway generates a session key generation random number and transmits it to a plurality of ECUs, and the received session by the plurality of ECUs. Generating a session key based on a key generation random number, generating, by a first ECU among the plurality of ECUs, a first MAC based on the generated session key and a MAC generated random number, and the first ECU Transmitting a message including a first MAC and the MAC-generated random number to a second ECU among the plurality of ECUs, wherein the second ECU generates a second MAC based on the generated session key and the received MAC-generated random number. Generating, and authenticating the received message by determining, by the second ECU, whether the received first MAC and the generated second MAC are identical.

And, in the step of generating the first MAC, a message transmission key is generated based on the session key and the MAC generated random number, and a first MAC is generated based on the generated message transmission key, the MAC generated random number, and data. And, in the step of transmitting to the second ECU, the generated first MAC, the MAC-generated random number, and the data may be included in a data field of the message and transmitted to the second ECU.

In addition, generating the second MAC includes generating a message reception key based on the session key and a MAC generated random number included in the data field of the received message, and including the generated message reception key, in the data field. A second MAC may be generated based on the generated MAC random number and the data.

Meanwhile, the message authentication method of the CAM system further includes updating the session key, and in the updating of the session key, the gateway may update the session key generation random number every preset time.

In the updating of the session key, the gateway may update the session key based on the updated session key generation random number and a hash function.

In addition, in the updating of the session key, the gateway generates an update transmission key based on the session key and a session update MAC generated random number, and based on the generated update transmission key, the session update MAC generated random number, and update data. A first update MAC is generated, and the generated first update MAC, the updated session key generation random number, the session update MAC generation random number, and the update data are included in a data field of an update message and transmitted to the plurality of ECUs. I can.

In addition, in the updating of the session key, each of the plurality of ECUs generates an update reception key based on the session key and a session update MAC generated random number included in the data field of the received update message, and the generated update Generates a second update MAC based on a reception key, the session update MAC generation random number included in the data field, and the update data, and determines whether the received first update MAC and the generated second update MAC are identical Accordingly, the received update message may be authenticated, and the session key may be updated based on the updated session key generation random number and a hash function.

As described above, the CAN system and the message authentication method generate a MAC based on a current key and a random number every time a message is transmitted, so that high security can be obtained.

In addition, the CAN system and the message authentication method change the key used to generate the MAC every certain period, so it can respond to the attacker's random attack.

In addition, the CAN system and message authentication method can be applied without modifying the existing CAN protocol.

In addition, the CAN system and message authentication method can be applied without modification of the algorithm even if the CAN system is changed.

In addition, the CAN system and message authentication method do not require a lot of resources, can authenticate messages in a short time, and can be compatible with existing devices.

1 is a diagram illustrating a CAN system according to an embodiment of the present disclosure.
FIG. 2 is a diagram illustrating a key generation method and a hash pool using a hash chain according to an embodiment of the present disclosure.
3 is a timing diagram illustrating a process of transmitting and authenticating a message between ECUs according to an embodiment of the present disclosure.
4 is a timing diagram illustrating a process of updating a session key according to an embodiment of the present disclosure.
5 is a flowchart of a message authentication method of a CAM system according to an embodiment of the present disclosure.

Hereinafter, various embodiments will be described in more detail with reference to the accompanying drawings. The embodiments described in this specification may be variously modified. Certain embodiments may be depicted in the drawings and described in detail in the detailed description. However, specific embodiments disclosed in the accompanying drawings are only intended to facilitate understanding of various embodiments. Accordingly, the technical idea is not limited by the specific embodiments disclosed in the accompanying drawings, and it should be understood to include all equivalents or substitutes included in the spirit and scope of the invention.

Terms including ordinal numbers such as first and second may be used to describe various elements, but these elements are not limited by the above-described terms. The above-described terms are used only for the purpose of distinguishing one component from other components.

In the present specification, terms such as "comprises" or "have" are intended to designate the presence of features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, but one or more other features. It is to be understood that the presence or addition of elements or numbers, steps, actions, components, parts, or combinations thereof, does not preclude in advance. When a component is referred to as being "connected" or "connected" to another component, it is understood that it may be directly connected or connected to the other component, but other components may exist in the middle. Should be. On the other hand, when a component is referred to as being "directly connected" or "directly connected" to another component, it should be understood that there is no other component in the middle.

Meanwhile, a "module" or "unit" for a component used in the present specification performs at least one function or operation. And, the "module" or "unit" may perform a function or operation by hardware, software, or a combination of hardware and software. In addition, a plurality of "modules" or a plurality of "units" excluding "module" or "unit" that must be performed in specific hardware or performed by at least one control unit may be integrated into at least one module. Singular expressions include plural expressions unless the context clearly indicates otherwise.

In addition, in describing the present invention, when it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be abbreviated or omitted. Meanwhile, each embodiment may be implemented or operated independently, but each embodiment may be implemented or operated in combination.

1 is a diagram illustrating a controller area network (CAN) system according to an embodiment of the present disclosure.

Referring to FIG. 1, the CAN system 100 includes a gateway 110 and one or more Electronic Control Units (ECUs) 120-1, 120-2, 120-3, 120-4, and 120-5. Each ECU At least one ECU (120-1, 120-2, 120-3, 120-4, 120-5) transmits and receives messages to each other. For example, if the first ECU 120-1 transmits a message including information on the ECU to process the message and priority information in a broadcasting method, the remaining ECUs 120-2 and 120-3 , 120-3, 120-4, 120-5) receives the message transmitted from the first ECU 120-1, and processes the received message according to the priority of only a specific ECU based on the information included in the message. do. Also, the first ECU 120-1 processes messages received from other ECUs according to the same method. That is, each of the ECUs 120-1, 120-2, 120-3, 120-4, and 120-5 may perform the role of a sender and a receiver according to a situation.

The gateway 110 connects the CAN system 100 with other external systems or networks, manages a session, and transmits an update message to each ECU for changing a key used when generating a message authentication code (MAC). The session refers to the time interval from the time point when the start point of the session key of the hash pool to be used when generating the MAC for message authentication is changed to the next time point. The starting point of the session key used for MAC generation is different for each session. If the CAN system 100 does not apply the session and continuously uses the chain session key after fixing the starting order of the key to be used at a specific point in the hash pool, the CAN system 100 It is bound to be vulnerable to brute forcing attacks. Accordingly, the CAN system 100 can be robust against a total attack by setting up a session so that the starting point of the session key can be periodically changed in the hash pool having the key without hash collision.

The gateway 110 transmits an update message to all ECUs 120-1, 120-2, 120-3, 120-4, and 120-5. The gateway 110 does not directly include the key in the message and transmits it, but rather a random number for each ECU (120-1, 120-2, 120-3, 120-4, 120-5) to select a session key (session The message is transmitted by including the key generation random number). That is, the gateway 110 generates a session key generation random number (r _g (j)) for message authentication and transmits it to each ECU (120-1, 120-2, 120-3, 120-4, 120-5). do.

And, each of the plurality of ECUs (120-1, 120-2, 120-3, 120-4, 120-5) is based on the session key generated random number (r _g (j)) received from the gateway 110 Generate the key (K ^j ). Thereafter, among a plurality of ECUs (120-1, 120-2, 120-3, 120-4, 120-5), the sender ECU is the generated session key (K ^j ) and the MAC generated random number (r _e (M _k )). A MAC is generated on the basis of, and a message including the generated MAC and the MAC generated random number (r _e (M _k )) is transmitted to the recipient ECU. As described above, the sender ECU of the CAN system 100 transmits a message to all ECUs in a broadcasting method, but only a specific ECU related to the transmitted message among the plurality of ECUs that received the message processes the received message. In conclusion, the sender ECU sends the message to the receiver ECU.

The receiver ECU generates a MAC based on the generated session key (K ^j ) and the received MAC generated random number (r _e (M _k )). Then, the recipient ECU determines whether the received MAC and the generated MAC are identical, and if they are the same, authenticates the message.

A detailed process by which the recipient ECU authenticates the message and a process by which the gateway updates the key will be described later.

FIG. 2 is a diagram illustrating a key generation method and a hash pool using a hash chain according to an embodiment of the present disclosure.

The hash pool refers to a set of session keys used in MAC generation. A hash pool is created with the same hash chain (or hash function), and refers to a set of keys generated by executing a hash function n consecutive times rather than storing a key in memory. That is, the i-th session key of the first ECU and the hash chain and the i-th session key of the hash chain of the second ECU are the same. So, it's like every ECU has one virtual hash pool.

The key usage direction of the hash chain of the hash pool is different from that of the one-way hash function. That is, the key usage direction of the hash chain of the present disclosure is the same as the generation direction. When a hash pool consisting of a one-way hash chain key, which is mainly used for authentication, is used, a certain amount of hash keys are repeated due to hash collisions after sufficient time, and an ECU with limited memory has a hash pool that has sufficient hash keys without collision. There is a limit to storing.

The CAN system of the present disclosure can solve the problem of exposing a key start point by using a random number of a gateway to determine a MAC generation key in a hash pool having a hash collision-free key without applying a one-way hash chain.

)를 선택할 수 있다.The gateway transmits a session key generation random number (r _g (j)) to each ECU, and each ECU uses the same session key (K ^j ) generated based on the received session key generation random number (r _g (j)). do. The generated session key (K ^j ) is valid only in the current session j, and when the session is changed (changed from session j to session j+1), each ECU generates an updated session key newly received from the gateway (r _g (j+ 1)) can perform the hash chain function. The gateway may update the session key generation random number every preset time. Therefore, each ECU has a new hash pool session key (

) Can be selected.

Below, the process of authenticating a message when sending a message from the sender ECU to the receiver ECU will be described in detail.

3 is a timing diagram illustrating a process of transmitting and authenticating a message between ECUs according to an embodiment of the present disclosure.

Referring to FIG. 3, a first ECU 120-1 and a second ECU 120-2 are shown. The first ECU 120-1 may be a sender ECU, and the second ECU 120-2 may be a receiver ECU.

)를 생성한다(S320). 메시지 전송키(

)는 현재 세션키(K^j)에서 MAC 생성 난수(r₁(M₁))의 크기 만큼 해시 함수를 사용하여 생성될 수 있다. 메시지 전송키(

)는 송신하려는 단일 메시지에서만 유효하다. 제1 ECU(120-1)는 제1 MAC를 생성한다(S330). 제1 MAC는 데이터, MAC 생성 난수(r₁(M₁)) 및 메시지 전송키(

)에 해시 함수를 사용하여 생성될 수 있다. 제1 ECU(120-1)는 메시지의 데이터 필드에 데이터, MAC 생성 난수(r₁(M₁)) 및 제1 MAC를 포함시켜 제1 메시지(M₁)를 제2 ECU(120-2)로 전송한다(S340).The first ECU 120-1 generates a MAC-generated random number (r ₁ (M ₁ )) to transmit the first message (M ₁ ) (S310). The first ECU 120-1 is based on the current session key (K ^j ) and the MAC generated random number (r ₁ (M ₁ )).

) Is generated (S320). Message transmission key (

) Can be generated using a hash function as much as the size of the MAC generated random number (r ₁ (M ₁ )) in the current session key (K ^j ). Message transmission key (

) Is only valid for a single message to be sent. The first ECU 120-1 generates a first MAC (S330). The first MAC is data, a MAC generated random number (r ₁ (M ₁ )) and a message transmission key (

) Can be created using a hash function. The first ECU 120-1 includes data, a MAC-generated random number (r ₁ (M ₁ )) and a first MAC in the data field of the message, and sends the first message M ₁ to the second ECU 120-2. It is transmitted to (S340).

)를 생성한다(S350). 메시지 수신키(

)는 현재 세션키(K^j)에서 수신된 MAC 생성 난수(r₁(M₁))의 크기 만큼 해시 함수를 사용하여 생성될 수 있다. 제2 ECU(120-2)는 제2 MAC를 생성한다(S360). 제2 MAC는 데이터, 수신된 MAC 생성 난수(r₁(M₁)) 및 생성된 메시지 수신키(

)에 해시 함수를 사용하여 생성될 수 있다. 제2 ECU(120-2)는 MAC를 인증한다(S370). 제2 ECU(120-2)는 수신된 제1 MAC와 생성된 제2 MAC를 비교하여 동일한지 여부를 판단한다. 제2 ECU(120-2)는 제1 MAC와 제2 MAC가 동일하면 수신된 제1 메시지를 처리하고, 동일하지 않으면 수신된 제1 메시지를 버린다. 상술한 과정을 통해 CAN 시스템은 송수신되는 메시지를 인증할 수 있다.The second ECU 120-2 receives the first message M ₁ from the first ECU 120-1. The second ECU 120-2 is based on the MAC generated random number (r ₁ (M ₁ )) included in the first message (M ₁ ), the message receiving key (

) Is generated (S350). Message receiving key (

) Can be generated using a hash function as much as the size of the MAC generated random number (r ₁ (M ₁ )) received from the current session key (K ^j ). The second ECU 120-2 generates a second MAC (S360). The second MAC is data, the received MAC generated random number (r ₁ (M ₁ )) and the generated message reception key (

) Can be created using a hash function. The second ECU 120-2 authenticates the MAC (S370). The second ECU 120-2 compares the received first MAC with the generated second MAC and determines whether they are the same. If the first MAC and the second MAC are the same, the second ECU 120-2 processes the received first message, and if not, discards the received first message. Through the above-described process, the CAN system can authenticate the transmitted/received message.

Meanwhile, the CAN system may update the current session key (K ^j ) every preset time for security. The following describes the process of updating the session key by the CAN system.

4 is a timing diagram illustrating a process of updating a session key according to an embodiment of the present disclosure.

)를 생성할 수 있다(S415). 갱신 전송키(

)는 현재 세션키(K^j)에서 세션 갱신 MAC 생성 난수(r_g(M₂))의 크기 만큼 해시 함수를 사용하여 생성될 수 있다. 게이트웨이(110)는 제1 갱신 MAC를 생성한다(S420). 제1 갱신 MAC은 갱신 데이터, 세션 갱신 MAC 생성 난수(r_g(M₂)) 및 갱신 전송키(

)에 해시 함수를 사용하여 생성될 수 있다. 게이트웨이(110)는 메시지의 데이터 필드에 갱신 데이터, 세션 갱신 MAC 생성 난수(r_g(M₂)), 갱신된 세션키 생성 난수(r_g(j+1)) 및 제1 갱신 MAC를 포함시켜 세션 갱신 메시지(M₂)를 제1 내지 제3 ECU(120-1, 120-2, 120-3)로 전송할 수 있다(S425). 즉, 게이트웨이(110)는 갱신된 세션키 생성 난수(r_g(j+1))를 포함하는 세션 갱신 메시지(M₂)를 모든 ECU에 브로드캐스트할 수 있다. 그리고, 게이트웨이(110)는 갱신된 세션키 생성 난수(r_g(j+1))에 해시 함수를 사용하여 새로운 세션키(K^j+1)를 생성하고, 현재 세션키(K^j)를 새로운 세션키(K^j+1)로 변경할 수 있다(S430).4, a gateway 110, a first ECU 120-1, a second ECU 120-2, and a third ECU 120-3 are illustrated. The gateway 110 may generate an updated session key generation random number (r _g (j+1)) to change the session at regular intervals (S405). The gateway 110 may generate a session update MAC generation random number (r _g (M ₂ )) to transmit the session update message (M ₂ ) (S410). The gateway 110 is based on the current session key (K ^j ) and the session update MAC generated random number (r _g (M ₂ )).

) Can be generated (S415). Update transfer key (

) Can be generated using a hash function as much as the size of the session update MAC random number (r _g (M ₂ )) in the current session key (K ^j ). The gateway 110 generates a first update MAC (S420). The first update MAC is the update data, the session update MAC generation random number (r _g (M ₂ )), and the update transmission key (

) Can be created using a hash function. The gateway 110 includes update data, a session update MAC random number (r _g (M ₂ )), an updated session key generation random number (r _g (j+1)), and a first update MAC in the data field of the message. The session update message M ₂ may be transmitted to the first to third ECUs 120-1, 120-2 and 120-3 (S425 ). That is, the gateway 110 may broadcast a session update message M ₂ including the updated session key generation random number r _g (j+1) to all ECUs. In addition, the gateway 110 generates a new session key (K ^j+1 ) using a hash function on the updated session key generation random number (r _g (j+1)), and creates a new session key (K ^j ). It can be changed with the session key (K ^j+1 ) (S430).

The first to third ECUs 120-1, 120-2, and 120-3 may receive a session update message M ₂ from the gateway 110. Each of the plurality of ECUs 120-1, 120-2, and 120-3 may authenticate the session update message M ₂ and change the session key in the same manner. Hereinafter, a representative description will be given centering on the first ECU 120-1.

)를 생성할 수 있다(S435). 갱신 수신키(

)는 현재 세션키(K^j)에서 수신된 세션 갱신 MAC 생성 난수(r_g(M₂))의 크기 만큼 해시 함수를 사용하여 생성될 수 있다. 제1 ECU(120-1)는 제2 갱신 MAC를 생성할 수 있다(S440). 제2 갱신 MAC는 갱신 데이터, 수신된 세션 갱신 MAC 생성 난수(r_g(M₂)) 및 생성된 갱신 수신키(

)에 해시 함수를 사용하여 생성될 수 있다. 제1 ECU(120-1)는 MAC를 인증할 수 있다(S445). 제1 ECU(120-1)는 수신된 제1 갱신 MAC와 생성된 제2 갱신 MAC를 비교하여 동일한지 여부를 판단할 수 있다. 제1 ECU(120-1)는 제1 갱신 MAC와 제2 갱신 MAC가 동일하면 수신된 세션 갱신 메시지(M₂)를 처리하고, 동일하지 않으면 수신된 세션 갱신 메시지(M₂)를 버릴 수 있다. 세션 갱신 메시지(M₂)가 인증되면 제1 ECU(120-1)는 세션변경 절차를 수행할 수 있다. 제1 ECU(120-1)는 수신한 세션키 생성 난수(r_g(j+1))의 크기 만큼 해시 함수를 사용하여 새로운 세션키(K^j+1)를 생성하고, 현재 세션키(K^j)를 새로운 세션키(K^j+1)로 변경할 수 있다(S450).The first ECU 120-1 is based on the session update MAC generation random number (r _g (M ₂ )) included in the session update message (M ₂ ).

) Can be generated (S435). Update receiving key (

) May be generated using a hash function as much as the size of the session update MAC generation random number (r _g (M ₂ )) received from the current session key (K ^j ). The first ECU 120-1 may generate a second update MAC (S440). The second update MAC is the update data, the received session update MAC generated random number (r _g (M ₂ )) and the generated update receiving key (

) Can be created using a hash function. The first ECU 120-1 may authenticate the MAC (S445). The first ECU 120-1 may compare the received first update MAC and the generated second update MAC to determine whether they are the same. The first ECU 120-1 may process the received session update message M ₂ if the first update MAC and the second update MAC are the same, and discard the received session update message M ₂ if they are not the same. . When the session update message M ₂ is authenticated, the first ECU 120-1 may perform a session change procedure. The first ECU 120-1 generates a new session key (K ^j+1 ) using a hash function as much as the size of the received session key generation random number (r _g (j+1)), and the current session key (K ^j ) can be changed to a new session key (K ^j+1 ) (S450).

So far, an embodiment of the message authentication method of the CAN system has been described. The flow chart of the message authentication method is described below.

5 is a flowchart of a message authentication method of a CAM system according to an embodiment of the present disclosure.

The gateway generates a session key generation random number (r _g (j)) and transmits it to a plurality of ECUs (S510). The plurality of ECUs generate a session key (K ^j ) based on the received session key generation random number (r _g (j)) (S520). The generated session key (K ^j ) is valid only in the current session (session j).

)를 생성하고, 메시지 전송키(

), MAC 생성 난수(r_e(M_k)) 및 데이터에 기초하여 제1 MAC를 생성한다.Among the plurality of ECUs, the first ECU (sender ECU) generates a first MAC based on the generated session key K ^j and the MAC generated random number r _e (M _k ) (S530). The first ECU is based on a session key (K ^j ) and a MAC generated random number (r _e (M _k )).

), and the message transmission key (

), a MAC generated random number (r _e (M _k )), and a first MAC based on data.

The first ECU transmits a message (M _k ) including the generated first MAC and a MAC generated random number (r _e (M _k )) to a second ECU (recipient ECU) among the plurality of ECUs (S540). The first ECU includes the first MAC, the MAC-generated random number r _e (M _k ), and data in the data field of the message M _k and transmits it to the second ECU.

)를 생성하고, 메시지 수신키(

), MAC 생성 난수(r_e(M_k)) 및 데이터에 기초하여 제2 MAC를 생성한다.The second ECU generates a second MAC based on the generated session key (K ^j ) and the received MAC generated random number (r _e (M _k )) (S550). The second ECU is based on the session key (K ^j ) and the MAC-generated random number (r _e (M _k )) included in the data field of the received message (M _k ).

), and a message receiving key (

), a second MAC is generated based on the MAC generated random number (r _e (M _k )) and data.

The second ECU authenticates the received message by determining whether the received first MAC and the generated second MAC are identical (S560). The second ECU 120-2 compares the first MAC and the second MAC to determine whether they are the same. If the first MAC and the second MAC are the same, the second ECU 120-2 processes the received message, and if not, discards the received message. Through the above-described process, the CAN system can authenticate the transmitted/received message.

The message authentication method of the CAN system according to the various embodiments described above may be provided as a computer program product. The computer program product may include the S/W program itself or a non-transitory computer readable medium in which the S/W program is stored.

The non-transitory readable medium refers to a medium that stores data semi-permanently and can be read by a device, not a medium that stores data for a short moment, such as a register, cache, or memory. Specifically, the above-described various applications or programs may be provided by being stored in a non-transitory readable medium such as a CD, DVD, hard disk, Blu-ray disk, USB, memory card, and ROM.

In addition, although the preferred embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above, and the technical field to which the present invention belongs without departing from the gist of the present invention claimed in the claims. In addition, various modifications are possible by those of ordinary skill in the art, and these modifications should not be individually understood from the technical spirit or prospect of the present invention.

100: CAN system 110: Gateway
120-1, 120-2, 120-3, 120-4, 120-5: ECU

Claims (14)

A plurality of electronic control units (ECUs) for transmitting and receiving messages to and from each other; And
Includes; a gateway for generating a session key generation random number and transmitting it to the plurality of ECUs,
The plurality of ECUs,
Generate a session key based on the received session key generation random number,
The first ECU among the plurality of ECUs,
Generates a first MAC (Message Authentication Code) based on the generated session key and the MAC generated random number, and transmits a message including the generated first MAC and the MAC generated random number to a second ECU among the plurality of ECUs And
The second ECU,
A second MAC is generated based on the generated session key and the received MAC generated random number, and the received message is authenticated by determining whether the received first MAC and the generated second MAC are identical,
The gateway,
Updates the session key generation random number every preset time, updates the session key based on the updated session key generation random number and hash function, and generates an update transmission key based on the session key and session update MAC generation random number And generates a first update MAC based on the generated update transmission key, the session update MAC generation random number, and update data, and the generated first update MAC, the updated session key generation random number, and the session update MAC generation A controller area network (CAN) system that includes a random number and the update data in a data field of an update message and transmits it to the plurality of ECUs. The method of claim 1,
The first ECU,
Generates a message transmission key based on the session key and the MAC generated random number, generates a first MAC based on the generated message transmission key, the MAC generated random number, and data, the generated first MAC, the MAC A CAN system that includes the generated random number and the data in a data field of the message and transmits it to the second ECU. The method of claim 2,
The second ECU,
A message reception key is generated based on the session key and a MAC generated random number included in the data field of the received message, and based on the generated message reception key, the MAC generated random number included in the data field, and the data CAN system to generate a second MAC. delete delete delete The method of claim 1,
Each of the plurality of ECUs,
An update reception key is generated based on the session key and a session update MAC generation random number included in the data field of the received update message, and the generated update reception key, the session update MAC generation random number included in the data field, and Generate a second update MAC based on the update data, determine whether the received first update MAC and the generated second update MAC are identical to authenticate the received update message, and generate the updated session key CAN system for updating the session key based on a random number and a hash function. Generating, by the gateway, a random number for generating a session key and transmitting it to a plurality of ECUs;
Generating, by the plurality of ECUs, a session key based on the received session key generation random number;
Generating, by a first ECU among the plurality of ECUs, a first MAC based on the generated session key and a MAC generated random number;
Transmitting, by the first ECU, a message including the generated first MAC and the MAC-generated random number to a second ECU among the plurality of ECUs;
Generating, by the second ECU, a second MAC based on the generated session key and the received MAC generated random number;
Authenticating the received message by determining, by the second ECU, whether the received first MAC and the generated second MAC are identical;
Updating the session key; further comprising,
The step of updating the session key,
The gateway updates the session key generation random number every preset time, the gateway updates the session key based on the updated session key generation random number and hash function, and the gateway generates the session key and session update MAC Generates an update transport key based on a random number, generates a first update MAC based on the generated update transport key, the session update MAC generated random number, and update data, the generated first update MAC, the updated session A message authentication method of a CAM system, including a key generation random number, the session update MAC generation random number, and the update data in a data field of an update message and transmitting them to the plurality of ECUs. The method of claim 8,
The step of generating the first MAC,
Generate a message transmission key based on the session key and the MAC generated random number, generate a first MAC based on the generated message transmission key, the MAC generated random number and data,
The step of transmitting to the second ECU,
A message authentication method of a CAM system for including the generated first MAC, the MAC generated random number, and the data in a data field of the message and transmitting the data to the second ECU. The method of claim 9,
The step of generating the second MAC,
A message reception key is generated based on the session key and a MAC generated random number included in the data field of the received message, and based on the generated message reception key, the MAC generated random number included in the data field, and the data Message authentication method of a CAM system that generates a second MAC. delete delete delete The method of claim 8,
The step of updating the session key,
Each of the plurality of ECUs generates an update reception key based on the session key and a random number of session update MAC generations included in the data field of the received update message, and the generated update reception key, the update reception key included in the data field. A second update MAC is generated based on the session update MAC generated random number and the update data, and the received update message is authenticated by determining whether the received first update MAC and the generated second update MAC are identical, A message authentication method of a CAM system for updating the session key based on the updated session key generation random number and a hash function.

Images