KR20220052477A - Counterattack method against hacked node in can bus physical layer, recording medium and system for performing the method - Google Patents

Abstract

A counterattack method against a hacked node in a controller area network (CAN) bus physical layer comprises the steps of: setting node IDs (NIDs), which are different unique IDs, to a plurality of nodes connected to a CAN bus line, respectively; determining an error frame when at least one of a node using a forged NID, a node using another NID, and a node using a non-existent NID is found; increasing counts of a transmit error counter (TEC) and a receive error counter (REC) of a transmitting node and a receiving node whenever an error frame is generated; and placing, in a bus-off state, a node with a TEC or a REC greater than a set threshold, and blocking the same. Therefore, if a malicious data frame is detected on a CAN bus, an intrusion detection system can increase the counter of errors in an internal attacking node to separate the same from the CAN bus, thereby defending against a malicious attack.

Description

Coping method of node hacked in CAN bus physical layer, recording medium and system for performing it

The present invention relates to a method for coping with a node hacked in a CAN bus physical layer, a recording medium and a system for performing the same, and more particularly, when a malicious data frame is detected on the CAN bus, the intrusion detection system detects an error of an internal attack node It is about techniques to defend against malicious attacks by incrementing a counter and disconnecting it from the bus.

Most automobiles today are connecting ECUs (Electronic Control Units) inside the vehicle based on a CAN (Controller Area Network) bus. One of the characteristics of the CAN bus is that the addresses of nodes participating in communication do not exist. This has many advantages such as simultaneous transmission and multiple transmission, but at the same time provides security vulnerabilities.

If one of the nodes participating in the communication is hacked to transmit a malicious data frame, it is very difficult to block the node because it is not known which node transmitted the data frame. If such malicious data frames cannot be prevented, normal communication may be prevented by overloading the CAN bus, or other nodes may be attacked to perform actions that may be dangerous to users.

Specifically, as one of the characteristics of the CAN communication protocol, the nodes connected to the CAN bus do not have addresses, so one of the nodes participating in the communication is hacked by a hacker and a malicious data frame There is a difficulty in identifying which electronic control device is the problem even if it is transmitted.

A hacked node can overload the CAN bus by sending malicious data frames, malfunction other nodes, or steal other normal nodes, which can be a great risk to user safety. Therefore, it is necessary to prepare for an accident by identifying malicious nodes occurring on the CAN bus and responding quickly.

JP 4232603 B2 KR 10-1332339 B1 KR 10-2009-0065260 A

J. Lee and S. Lee, "Design and Verification of Automotive CAN Controller," j.inst.Korean.electr. electron.eng, vol.21, no.2, 2017. DOI: 10.7471/ikeee.2017.21.2.162

Accordingly, the technical task of the present invention was conceived in this regard, and an object of the present invention is to provide a coping method of a node hacked in the CAN bus physical layer so that it can respond immediately to various attack scenarios.

Another object of the present invention is to provide a recording medium in which a computer program for performing a method of coping with a hacked node in the CAN bus physical layer is recorded.

Another object of the present invention is to provide a system for performing a coping method of a hacked node in the CAN bus physical layer.

A method for dealing with a node hacked in the CAN bus physical layer according to an embodiment for realizing the object of the present invention is a unique ID that is different for a plurality of nodes connected to a CAN (Controller Area Network) bus line. setting a Node ID (NID); determining an error frame when at least one of a node using a forged NID, a node using another NID, and a node using a non-existent NID is found; increasing counts of Transmit Error Counter (TEC) and Receive Error Counter (REC) of a transmitting node and a receiving node whenever the error frame is generated; and blocking a node having a TEC or REC greater than a set threshold by bus-off (off).

In an embodiment of the present invention, in the step of determining the error frame, when a node using a forged NID is found, a node with an impersonated NID may detect hacking.

In an embodiment of the present invention, in the step of determining the error frame, an Intrusion Detection System (IDS), an intrusion detection system, detects hacking when a node using another NID or a node using a non-existent NID is found. can

In an embodiment of the present invention, the step of setting the NID, which is a different unique ID, for each of the plurality of nodes connected to the CAN bus line may include setting the lower 4 bits of the message ID area to the NID value when transmitting the data frame. there is.

In an embodiment of the present invention, the step of increasing the counts of TECs and RECs of the transmitting node and the receiving node each time the error frame is generated includes: when the error frame is generated, the TEC of the transmitting node is incremented by 8; In the case of a node, the REC of the node that generated the first error frame can be increased by 8, and the REC of other nodes can be increased by 1.

In an embodiment of the present invention, the method of dealing with a node hacked in the CAN bus physical layer may further include: decrementing the counts of TECs and RECs of the transmitting node and the receiving node whenever a message is successfully transmitted. there is.

In an embodiment of the present invention, the step of blocking a node in which the TEC or REC becomes greater than a set threshold by bus-off may separate the node when the TEC or REC of the node becomes greater than 256.

In a computer-readable storage medium according to an embodiment for realizing another object of the present invention, a computer program for performing a method for coping with a hacked node in the CAN bus physical layer is recorded.

A system for coping with a hacked node in a CAN bus physical layer according to an embodiment for realizing another object of the present invention is connected to a CAN (Controller Area Network) bus line and NID (Node) which is a different unique ID, respectively. a plurality of nodes to which ID) is set; an Intrusion Detection System (IDS) that analyzes the contents of a data frame loaded on the CAN bus line to determine whether it is a hacked node; Each time the error frame is generated, the TEC (Transmit Error Counter) and REC (Receive Error Counter) counts of the sending node and the receiving node are incremented, and whenever a message is successfully transmitted, the TEC and REC of the sending node and the receiving node counter to decrement the count of; and a Node Expulsion System (NES) that is mounted on the plurality of nodes and the IDS, respectively, and blocks a node having a TEC or REC greater than a set threshold by bus-off.

In an embodiment of the present invention, in the coping system of a node hacked in the CAN bus physical layer, when a node using a forged NID is found, the NES of the node to which the impersonated NID is set may detect hacking.

In an embodiment of the present invention, in the coping system of a node hacked in the CAN bus physical layer, when a node using another NID or a node using a non-existent NID is found, the NES of the IDS can detect hacking there is.

In an embodiment of the present invention, the NID of each node may be set in the lower 4 bits of the message ID area when transmitting a data frame.

According to the coping method of the hacked node in the CAN bus physical layer, when a malicious data frame is detected on the CAN bus, the intrusion detection system increments the error counter of the internal attack node and separates it from the bus to prevent malicious attacks.

By setting the NID (Node ID) of the IDS (Intrusion Detection System) and CAN (Controller Area Network) controller, it is possible to immediately respond to any network attack that may occur on the CAN bus. Accordingly, it is possible to increase user safety and enhance security performance.

1 is a block diagram of a system for coping with a hacked node in a CAN bus physical layer according to an embodiment of the present invention.
FIG. 2 is a table showing a data range that can be transmitted according to the MID and DLC of the node to which the NID is set in FIG. 1 .
3 is a diagram illustrating state changes of nodes according to TEC and REC.
4 is a view showing a process of coping with a general attack according to the present invention.
5 is a diagram showing a process of coping with a spoofing attack according to the present invention.
6 is a flowchart of a coping method of a node hacked in a CAN bus physical layer according to an embodiment of the present invention.
7 is a diagram showing a simulation waveform of an operation to cope with a general attack according to the present invention.
8 is a diagram showing a simulation waveform of an operation to cope with a spoofing attack according to the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0010] Reference is made to the accompanying drawings, which show by way of illustration specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention are different but need not be mutually exclusive. For example, certain shapes, structures, and characteristics described herein may be implemented in other embodiments with respect to one embodiment without departing from the spirit and scope of the invention. In addition, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the following detailed description is not intended to be taken in a limiting sense, and the scope of the present invention, if properly described, is limited only by the appended claims, along with all scope equivalents to those claimed. Like reference numerals in the drawings refer to the same or similar functions throughout the various aspects.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

1 is a block diagram of a system for coping with a hacked node in a CAN bus physical layer according to an embodiment of the present invention. FIG. 2 is a table showing a data range that can be transmitted according to the MID and DLC of the node to which the NID is set in FIG. 1 .

In the CAN (Controller Area Network) bus physical layer according to the present invention, when a malicious data frame is detected on the CAN bus, the intrusion detection system increases the error counter of the internal attack node. We propose a technique to prevent malicious attacks by separating them from the bus. For example, a CAN controller equipped with the technique proposed in the present invention can be implemented using Verilog HDL.

1, the system 1 according to the present invention includes a plurality of nodes (Node A, B, C, D) connected to a CAN bus line, an Intrusion Detection System (IDS), a counter (not shown) and an NES ( Node Expulsion System).

The plurality of nodes (Nodes A, B, C, and D) are connected to a controller area network (CAN) bus line, and a unique ID (NID) that is different from each other is set.

In the present invention, NID (Node ID), which is a unique ID of a different person, is set before all nodes start communication as shown in FIG. 1 . When transmitting a data frame, if the lower 4 bits of the message ID area are filled with an NID value and transmitted, the NID acts as a fingerprint, so it is possible to know which node is transmitting the data frame.

The CAN bus according to the present invention additionally connects an Intrusion Detection System (IDS), which is an intrusion detection system. As shown in FIG. 2, the range of data that can be transmitted is pre-determined according to MID (Message ID) and DLC (Data Length Code). Set in , and update IDS and nodes in advance.

The IDS determines whether the node has been hacked by analyzing the contents of the data frame loaded on the CAN bus line.

The counter increments the TEC (Transmit Error Counter) and REC (Receive Error Counter) counts of the sending node and the receiving node whenever the error frame is generated, and each time a message is successfully transmitted, the Decrease the count of TEC and REC.

The NES is mounted on the plurality of nodes and the IDS, respectively, and blocks a node having a TEC or REC greater than a set threshold by bus-off.

All nodes of the CAN bus have TEC (Transmit Error Counter) and REC (Receive Error Counter), and by using these, a node with frequent errors does not interfere with transmission and reception of other nodes.

If any node finds an error, it generates an error frame, at which time the TEC of the transmitting node is increased by 8. In the case of the receiving node, the REC of the node that first generated the error frame increases by 8, and the REC of the other node increases by 1.

On the other hand, if the message is successfully transmitted, the TEC and REC of the sending node and the receiving node are each decreased by 1. 3 shows node state changes according to TEC and REC. In the error active state, normal transmission/reception is performed, but when TEC or REC is 128 or higher, the error passive state becomes error-passive, and transmission/reception is somewhat restricted.

In particular, when the TEC exceeds 256, the bus is turned off, automatically disconnected from the bus, and transmission and reception are prohibited. The present invention proposes a technique for preventing a node transmitting a malicious data frame from overloading the bus or attacking other nodes by making the node that transmits a malicious data frame in a bus-off state using this.

CAN Bus Attack Scenarios There are three main attack scenarios in the CAN bus. After occupying a node, a message pattern can be identified through sniffing, and a malicious data frame can be transmitted through a general attack. may overload the node or cause other nodes to malfunction.

In addition, a spoofing attack that transmits a malicious data frame while pretending to be another node may be performed. For example, the attack scenario is as follows.

As Scenario 1, sniffing is to identify patterns by looking at messages communicating on the bus using nodes occupied through hacking. No harm is done to the CAN bus at this stage.

As Scenario 2, a normal attack detects a message pattern through sniffing and then sends a malicious data frame using the occupied node. Scenario 3 is a spoofing attack. The general attack and the spoofing attack are the same in that they transmit a malicious data frame, but the spoofing attack differs in that the occupied node pretends to be another node.

The Node Expulsion System (NES), which is a function to expel a hacked node by sending an error frame, is a function added to the present invention that is not present in a general CAN bus.

As an embodiment, the NES may be implemented by adding a circuit for outputting an error frame to the CAN controller when a specific condition is satisfied. In the present invention, the NES is installed in both each node and the IDS.

In the present invention, since sniffing does not adversely affect the bus immediately, no special measures are taken. However, in a general attack, when an occupied node transmits a malicious data frame as shown in FIG. 4 , the IDS analyzes the contents of the data frame and detects that the node has been hacked.

After that, since the NES installed in the IDS continues to transmit error frames whenever the node transmits, the node is blocked from transmitting and the TEC increases and the bus goes off.

Specifically, it is a process of coping with an attack in which a hacked node sends a malicious data frame to overload the CAN bus or malfunctions other nodes. IDS continuously monitors the CAN bus. ① When the Malicious node transmits MID=0x102, DLC=4b0010, Data=0x2000, ② IDS sees something different from the previously updated table and the node currently transmitting the data frame It is judged as a hacked node.

③ The IDS that detects the hacked node transmits an error frame, and ④ the Malicious node that receives the error frame while transmitting the data frame increases its TEC. Another attack, an attack that steals other normal nodes, cannot occur because all nodes have unique NIDs set and cannot be changed.

On the other hand, in the spoofing attack, when the occupied node forges the NID and transmits a malicious data frame as shown in FIG. 5, the same NID as itself was found in the forged node (that is, the node using the forged NID originally). It detects that the node has been hacked.

From then on, the NES attached to the forged node continues to transmit an error frame whenever the node transmits, so the node is blocked from transmitting and the TEC is increased, resulting in a bus-off state.

In the present invention, when a malicious data frame is detected on the CAN bus, the intrusion detection system increases the error counter of the internal attack node and separates it from the bus, thereby preventing malicious attacks.

6 is a flowchart of a coping method of a node hacked in a CAN bus physical layer according to an embodiment of the present invention.

The coping method of a node hacked in the CAN bus physical layer according to the present embodiment may proceed in substantially the same configuration as the system 1 of FIG. 1 . Accordingly, the same components as those of the system 1 of FIG. 1 are given the same reference numerals, and repeated descriptions are omitted.

In addition, the coping method of a node hacked in the CAN bus physical layer according to the present embodiment may be executed by software (application) for coping with a node hacked in the CAN bus physical layer.

In the present invention, when a malicious data frame is detected on the CAN bus, the intrusion detection system increments the error counter of the internal attack node and separates it from the bus to prevent malicious attacks.

Referring to FIG. 6 , in the method of coping with a node hacked in the CAN bus physical layer according to the present embodiment, a Node ID (NID) which is a unique ID different from each other for a plurality of nodes connected to a controller area network (CAN) bus line. ) is set (step S10). When transmitting a data frame, the lower 4 bits of the message ID area can be set as the NID value.

When at least one of a node using a forged NID, a node using a different NID, and a node using a non-existent NID is found, it is determined as an error frame (step S20).

Since each node has its own NID set, when a node using a forged NID is found, the impersonated node with the NID set can detect hacking.

On the other hand, if a node using a different NID or a node using a non-existent NID is found, the Intrusion Detection System (IDS), an intrusion detection system, can detect hacking.

Whenever the error frame is generated, the TEC (Transmit Error Counter) and REC (Receive Error Counter) counts of the transmitting node and the receiving node are incremented (step S30).

When the error frame is generated, the TEC of the transmitting node may be increased by 8, and in the case of the receiving node, the REC of the node that first generated the error frame may be increased by 8, and the REC of the other node may be increased by 1.

On the other hand, each time a message is successfully transmitted, the counts of the TEC and REC of the sending node and the receiving node may be decremented.

When the TEC or REC becomes greater than the set threshold (step S40), the node is blocked by bus-off (step S50). For example, if a node's TEC or REC becomes greater than 256, that node can be detached.

According to the coping method of the hacked node in the CAN bus physical layer, when a malicious data frame is detected on the CAN bus, the intrusion detection system increments the error counter of the internal attack node and separates it from the bus to prevent malicious attacks.

By setting the NID (Node ID) of the IDS (Intrusion Detection System) and CAN (Controller Area Network) controller, it is possible to immediately respond to any network attack that may occur on the CAN bus. Accordingly, it is possible to increase user safety and enhance security performance.

Hereinafter, simulation results for verifying the performance of the present invention will be described. In the present invention, NES is installed in the existing CAN controller, designed with Verilog HDL, and simulated with ModelSim. The NIDs of the four CAN nodes were set to 4, 8, 16, and 32, and since sniffing does not have an immediate adverse effect, only two types of attacks, a normal attack and a spoofing attack, were simulated.

7 is a case of dealing with a general attack. At first, it operates normally, but after a certain period of time, the IDS detects the occupied node 4 (NID=32), and whenever node 4 transmits a data frame, the IDS Increases the TEC of node 4 by generating an error frame. After that, every time node 4 transmits, the IDS continues to increment the TEC, making it bus off.

8 shows a case of coping with a spoofing attack, where an occupied node 4 (NID=32) steals node 1 (NID=4) and transmits a data frame. However, since node 1 has detected its own NID even though it is not transmitting, it recognizes it as an attack and generates an error frame to increase the TEC of node 4. After that, whenever node 4 steals node 1 (NID=4), node 1 keeps increasing the TEC to make the bus off.

In the CAN bus, even if one of the nodes is hacked and transmits a malicious data frame, it is difficult to identify which node is the problem. The present invention proposes a method capable of coping with various attack scenarios that may occur in the CAN bus by modifying the existing CAN controller.

Such a method of dealing with a node hacked in the CAN bus physical layer may be implemented as an application or implemented in the form of program instructions that may be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc. alone or in combination.

The program instructions recorded in the computer-readable recording medium are specially designed and configured for the present invention, and may be known and available to those skilled in the computer software field.

Examples of the computer-readable recording medium include hard disks, magnetic media such as floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, and magneto-optical media such as floppy disks. media), and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like.

Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules for carrying out the processing according to the present invention, and vice versa.

Although the above has been described with reference to the embodiments, those skilled in the art can variously modify and change the present invention within the scope without departing from the spirit and scope of the present invention described in the claims below you will understand

Most automobiles today use a CAN (Controller Area Network) communication protocol to connect major electronic control units (ECUs) inside the vehicle in a bus topology manner. The present invention identifies malicious nodes occurring on the CAN bus and prepares for accidents by promptly responding, so it can be usefully used for ECUs and other devices of automobiles using CAN communication.

1: Coping system of hacked node in CAN bus physical layer

Claims (12)

setting a Node ID (NID) which is a unique ID different from each other for a plurality of nodes connected to a controller area network (CAN) bus line;
determining an error frame when at least one of a node using a forged NID, a node using another NID, and a node using a non-existent NID is found;
increasing counts of Transmit Error Counter (TEC) and Receive Error Counter (REC) of the transmitting node and the receiving node whenever the error frame is generated; and
A method of coping with a node hacked in a CAN bus physical layer, including; blocking a node in which the TEC or REC becomes larger than a set threshold by bus-off (off).
The method of claim 1, wherein the determining of the error frame comprises:
How to deal with a hacked node in the CAN bus physical layer, in which a node with an impersonated NID detects the hack when a node using a forged NID is found.
The method of claim 1, wherein the determining of the error frame comprises:
How to deal with a hacked node in the CAN bus physical layer, in which the Intrusion Detection System (IDS), an intrusion detection system, detects a hack when a node using a different NID or a node using a non-existent NID is found.
The method of claim 1, wherein the step of setting NIDs, which are different unique IDs, for a plurality of nodes connected to the CAN bus line, respectively,
How to deal with a hacked node in the CAN bus physical layer by setting the lower 4 bits of the message ID area to the NID value when transmitting the data frame.
The method of claim 1, wherein each time the error frame is generated, incrementing counts of TECs and RECs of the transmitting node and the receiving node comprises:
When the error frame is generated, the TEC of the transmitting node is increased by 8, and in the case of the receiving node, the REC of the node that first generated the error frame is increased by 8 and the REC of the other node is increased by 1. How to deal with hacked nodes in .
The method of claim 1,
Each time a message is successfully transmitted, decrementing the counts of TECs and RECs of the transmitting node and the receiving node.
According to claim 1, wherein the step of blocking by bus-off (off) the node in which the TEC or REC becomes larger than a set threshold,
How to deal with a hacked node in the CAN bus physical layer, which separates the node when the node's TEC or REC becomes greater than 256.
A computer-readable storage medium in which a computer program for performing the method of coping with a hacked node in the CAN bus physical layer according to claim 1 is recorded.
a plurality of nodes connected to a controller area network (CAN) bus line and each having a different unique ID (NID) set;
an Intrusion Detection System (IDS) that analyzes the contents of a data frame loaded on the CAN bus line to determine whether a node has been hacked;
Whenever the error frame is generated, the TEC (Transmit Error Counter) and REC (Receive Error Counter) counts of the sending node and the receiving node are incremented, and whenever a message is successfully transmitted, the TEC and REC of the sending node and the receiving node counter to decrement the count of; and
NES (Node Expulsion System) that is mounted on the plurality of nodes and IDS, respectively, and blocks a node in which TEC or REC becomes larger than a set threshold by bus-off (Node Expulsion System); coping system.
10. The method of claim 9,
When a node using a forged NID is found, the NES of the node with the impersonated NID detects the hack. A system for responding to a hacked node in the CAN bus physical layer.
10. The method of claim 9,
A system for coping with a hacked node in a CAN bus physical layer, wherein the NES of the IDS detects hacking when a node using another NID or a node using a non-existent NID is found.
10. The method of claim 9,
The NID of each node is set in the lower 4 bits of the message ID field when transmitting the data frame, the coping system of the hacked node in the CAN bus physical layer.

Images