Identifier Randomization: An Efficient Protection Against CAN-Bus Attacks

Abstract

The Cyber-Physical Architecture of vehicles is composed of sensors, actuators, and electronic control units all communicating over shared communication buses. For historical reasons the internal communication buses, as the Controller Area Network (CAN), do not implement security mechanisms; the communications are assumed to be “trusted.” Recently these trusted relations have been challenged and leveraged to launch cyber-physical attacks against modern vehicles. As a result, it becomes urgent to enhance the security features of vehicles and notably the robustness of the CAN bus which represents an important channel of attacks.

In this work we develop identifier randomization procedures whose aim is to protect the CAN protocol from reverse-engineering, replay, and injection attacks. The idea behind this proposition is to constantly change the message identifiers in a random fashion in a way that both sender and receiver can recover the original message identifier but not the adversary. We present the main challenges of the CAN-ID randomization solution, we highlight the weaknesses of state-of-the-art solutions presented in other scientific papers, and we propose and study candidate solutions to overcome these weaknesses. To compare our solutions to state-of-the-art solution, we propose to use the entropy and the conditional entropy as a metrics of security. Results show that the randomization functions that we propose outperform the state-of-the-art solution in terms of both entropy and conditional entropy.

Appendix

Let id_o be a random variable representing original identifiers whose outcome is id₁, id₂, …, id_N with probabilities P(id₁), P(id₂), …, P(id_N). We consider a second random variable id_r representing randomized identifiers whose outcome is in [0, 2ⁿ − 1].

1.1 Entropy of Fixed Mapping

The entropy of the fixed mapping solutions (IA-CAN, equal intervals, frequency intervals) is the following:

• IA-CAN: H_IA-CAN(id_r) = H(id_o) + a

• Equal Intervals: H_EI(id_r) = H(id_o) + n −log₂(N)

• Frequency Intervals: H_FI(id_r) = n

Proof

According to the fixed mapping randomization functions (IA-CAN, equal intervals, frequency intervals), each identifier id_i is randomized over a fixed interval I_i of width W(I_i). We begin by computing the probability that the random variable id_r takes the value x ∈ [0, 2ⁿ]:

$$\displaystyle \begin{aligned} P(id_r=x) =\sum_{i=1}^N P(id_r=x | id_i ) \times P(id_i)\end{aligned} $$

The conditional probability of id_r knowing the original identifier id_o = id_i:

$$\displaystyle \begin{aligned} P(id_r=x | id_i ) = \frac{1_{I_i} (x) }{W(I_i)}\end{aligned} $$

$$\displaystyle \begin{aligned} H(id_r) &= \sum_{x \in [0,2^n -1]} P(id_r=x) \times \log_2 \left(\frac{1}{P(id_r=x)}\right)\\ &= \sum_{ x \in [0,2^n -1]} \left[\sum_{i =1}^{N} P(id_i) \frac{1_{I_i} (x)}{W(I_i)} \right] \times \log_2 \left(\frac{1}{\left[\sum_{j =1}^{N} P(id_j) \frac{1_{I_j} (x)}{W(I_j)} \right] }\right)\\ &= \sum_{i =1}^{N} \sum_{ x \in [0,2^n -1]} P(id_i) \frac{1_{I_i} (x)}{W(I_i)} \times \log_2 \left(\frac{1}{\left[\sum_{j =1}^{N} P(id_j) \frac{1_{I_j} (x)}{W(I_j)} \right] }\right) \end{aligned} $$

$$\displaystyle \begin{aligned} H(id_r) &= \sum_{i =1}^{N} \sum_{ x \in I_i} P(id_i) \frac{1_{I_i} (x)}{W(I_i)} \times \log_2 \left(\frac{1}{\left[\sum_{j =1}^{N} P(id_j) \frac{1_{I_j} (x)}{W(I_j)} \right] }\right)\\ \end{aligned} $$

Since the intervals I_i are nonoverlapping: $\forall x \in I_i, \forall j \neq i \rightarrow 1_{I_j} (x) = 0$

We can thus simplify the expression: $\forall x \in I_i, \forall j \neq i \rightarrow \sum _{j =1}^{N} P(id_j) \frac {1_{I_j} (x)}{W(I_j)} = P(id_i) \frac {1_{I_i} (x)}{W(I_i)}$

$$\displaystyle \begin{aligned} H(id_r) &= \sum_{i =1}^{N} \sum_{ x \in I_i} P(id_i) \frac{1_{I_i} (x)}{W(I_i)} \times \log_2 \left(\frac{1}{P(id_i) \frac{1_{I_i} (x)}{W(I_i)}}\right)\\ &= \sum_{i =1}^{N} \sum_{ x \in I_i} P(id_i) \frac{1}{W(I_i)} \times \log_2 \left(\frac{1}{P(id_i) \frac{1}{W(I_i)}}\right) \end{aligned} $$

• IA-CAN entropy: ∀i ∈ [1, N], W(I_i) = 2^a

  $$\displaystyle \begin{aligned}H(id_r) = \sum_{i=1}^N \sum_{x \in I_i } P(id_i) \frac{1 }{2^a} \times \log_2 \left(\frac{1}{P(id_i) \frac{1}{2^a}}\right) = H(id_o) + a\end{aligned}$$

• Equal interval entropy: $\forall i \in [1,N],\ W(I_i) = \frac {2^n}{N}$

  $$\displaystyle \begin{aligned}H(id_r) = \sum_{i=1}^N \sum_{x \in I_i } P(id_i) \frac{1}{\frac{2^n}{N}} \times \log_2 \left(\frac{1}{P(id_i) \frac{1}{\frac{2^n}{N}}}\right) = H(id_o) + n - \log_2(N)\end{aligned}$$

• Frequency interval entropy: ∀i ∈ [1, N], W(I_i) = 2ⁿ × P(id_i)

  $$\displaystyle \begin{aligned}H(id_r) = \sum_{i=1}^N \sum_{x \in I_i } P(id_i) \frac{1}{ 2^n \times P(id_i)} \times \log_2 \left(\frac{1}{P(id_i) \frac{1}{2^n \times P(id_i)}}\right) = n\end{aligned}$$

□

1.2 Conditional Entropy of Fixed Mapping

The conditional entropy of randomized identifiers knowing the original identifiers of the fixed mapping solutions (IA-CAN, equal intervals, frequency intervals) is the following:

• IA-CAN: H_IA-CAN(id_r|id_o) = a

• Equal Intervals: H_EI(id_r|id_o) = n −log₂(N)

• Frequency Intervals: H_FI(id_r|id_o) = n − H(id_o)

Proof

$$\displaystyle \begin{aligned} H(id_r|id_o) &= H(id_r,id_o) - H(id_o)\\ H(id_r,id_o) &=\sum_{x\in[0,2^n-1]} \sum_{i=0}^N P(id_r=x, id_o=id_i) \log_2\left(\frac{1}{P(id_r=x,id_o=id_i)}\right)\\\end{aligned} $$

$$\displaystyle \begin{aligned} P(id_r=x, id_o=id_i) = \left\{ \begin{array}{lll} P(id_i) \times \frac{1}{w(I_i)} &,& x \in I_i\\ 0 &,& {\mathrm{elsewhere}} \\ \end{array} \right. \end{aligned}$$

$$\displaystyle \begin{aligned} H(id_r,id_o) &=\sum_{i=0}^N \sum_{x\in I_i} \frac{P(id_i)}{w(I_i)} \log_2\left(\frac{1}{P(id_i) \frac{1}{w(I_i)}}\right)\\ H(id_r,id_o) &= H(id_r)\\ H(id_r|id_o) & = H(id_r)- H(id_o)\\\end{aligned} $$

$$\displaystyle \begin{aligned} \hspace{-4.5pc}\begin{array}{lll} \mbox{- IA-CAN conditional entropy }&:& H(id_r | id_o) = a \\ \mbox{- Equal interval conditional entropy}&:& H(id_r | id_o) = n - \log_2(N) \\ \mbox{- Frequency interval conditional entropy}&:& H(id_r | id_o) = n - H(id_o) \\ \end{array} \end{aligned}$$

□

1.3 Entropy of Dynamic Intervals

Let $id_o^t$ be a Markov chain over the space of original identifiers (id₁, id₂, …id_N). And the matrix M presented in Eq. (25) be its transition matrix. Let id_r be the random variable over [0, 2ⁿ − 1], generated using the dynamic interval randomization strategy applied to $id_o^t$. We have H_DI(id_r) = n

Proof

$$\displaystyle \begin{aligned} &H(id_r) = \sum_{x \in [0,2^n -1]} P(id_r=x) \times \log_2 \left(\frac{1}{P(id_r=x)}\right) \\ &P(id_r=x) = \sum_i^N P(id_r=x | id_o^t=id_i) \times P(id_o^t=id_i) \\ &P(id_r=x) = \sum_i^N \sum_j^N P(id_r=x | id_i^t , id_j^{t+1}) \times P(id_j^{t+1} | id_i^t) \times P(id_i^t) \\ &P(id_r=x | id_i^t , id_j^{t+1}) = \frac{ 1_{I_{i,j}} (x) }{ W(I_{i,j}) } \end{aligned} $$

where $W(I_{i,j})= P(id_j^{t+1} | id_i^t) \times 2^{n} is\ the\ width\ of\ the\ interval\ I_{i,j}$

$$\displaystyle \begin{aligned} P(id_r=x) &= \sum_i^N \sum_j^N \frac{ 1_{I_{i,j}} (x) }{ W(I_{i,j}) } \times P(id_j^{t+1} | id_i^t) \times P(id_i^t) \\ &= \sum_i^N \sum_j^N \frac{ 1_{I_{i,j}} (x) }{ P(id_j^{t+1} | id_i^t) \times 2^{n} } \times P(id_j^{t+1} | id_i^t) \times P(id_i^t) \\ &= \sum_i^N \sum_j^N \frac{ 1_{I_{i,j}} (x) }{ 2^{n} } \times P(id_i^t) \end{aligned} $$

$\forall x \in [0,2^n -1 ], \sum _j^N 1_{I_{i,j}} (x) = 1$

$$\displaystyle \begin{aligned} P(id_r=x) &= \sum_i^N \frac{ 1}{ 2^{n} } \times P(id_i^t) = \frac{ 1}{ 2^{n} } \\ H(id_r) &= \sum_{ x \in [0,2^n -1]} \frac{ 1}{ 2^{n} } \times \log_2 \left(\frac{ 1}{ 2^{n} }\right)\\ H(id_r)& = n \end{aligned} $$

□

1.4 Entropy of Arithmetic Masking

Proof

$$\displaystyle \begin{aligned}H(id_r) = \sum_{x \in [0,2^n -1]} P(id_r = x) \log_2\left(\frac{1}{P(id_r = x)}\right)\end{aligned}$$

$$\displaystyle \begin{aligned} P(id_r = x) = \left\{ \begin{array}{lll} \sum_{i=0}^{x} \frac{P(id_i)}{2^n -N +1} &,& x \in [0,N-2]\\ \frac{1}{2^n -N+1} &,& x \in [N-1, 2^n - N] \\ \sum^{N-1}_{i=x-2^n +N} \frac{P(id_{i})}{2^n -N+1} &,& x \in [2^n -N +1 , 2^n-1]\\ \end{array} \right. \end{aligned}$$

$$\displaystyle \begin{aligned} H(id_r) =& \sum_{x \in [N-1, 2^n - N]} \frac{1}{2^n -N+1} \times \log_2 (2^n -N+1)\\ &+ \sum_{x \in [0,N-2]} \left[\sum_{i=0}^{x} \frac{P(id_i)}{2^n -N+1}\right] \times \log_2 \left(\frac{1} {\sum_{i=0}^{x} \frac{P(id_i)}{2^n -N+1} }\right) \\ & + \sum_{x \in [2^n -N+1,2^n-1]} \left[\sum^{N-1}_{i=x-2^n +N} \frac{P(id_{i})}{2^n -N+1}\right]\\ &\times \log_2 \left(\frac{1}{ \sum^{N-1}_{i=x-2^n +N} \frac{P(id_{i})}{2^n -N+1} }\right)\\ H(id_r) = &\frac{2^n -2(N-1)}{2^n -N+1} \log_2 (2^n -N+1) + \sum_{x \in [0,N-2]} \left[\sum_{i=0}^{x} \frac{P(id_i)}{2^n -N+1}\right]\\ &\times \log_2 \left(\frac{1} {\sum_{i=0}^{x} \frac{P(id_i)}{2^n -N+1} }\right) \\ &+ \left[\sum_{i=x+1}^{N-1} \frac{P(id_{i})}{2^n -N+1}\right] \times \log_2 \left(\frac{1} {\sum_{i=x+1}^{N-1} \frac{P(id_{i})}{2^n -N+1}}\right)\\ H(id_r) = &\frac{2^n -2(N-1)}{2^n -N+1} \log_2 (2^n -N+1)\\ &+ \sum_{x \in [0,N-2]} \frac{1}{2^n -N+1} \log_2(2^n -N+1) \\ &+ \sum_{x \in [0,N-2]} \sum_{i=0}^{x} \frac{P(id_i)}{2^n -N +1} \times \log_2 \left(\frac{1} {\sum_{i=0}^{x} P(id_i) }\right)\\ &+ \sum_{i=x+1}^{N-1} \frac{P(id_i)}{2^n -N +1} \times \log_2 \left(\frac{1} {\sum_{i=x+1}^{N-1} P(id_{i})}\right)\\ H(id_r) = &\frac{2^n -2(N-1)}{2^n -N+1} \log_2 (2^n -N+1) + \frac{N-1}{2^n -N+1} \log_2(2^n -N+1) \\ &+ \frac{1}{2^n -N +1} \sum_{x \in [0,N-2]} \sum_{i=0}^{x} P(id_i) \times \log_2 \left(\frac{1} {\sum_{i=0}^{x} P(id_i) }\right)\\ &+ \sum_{i=x+1}^{N-1} P(id_i) \times \log_2 \left(\frac{1} {\sum_{i=x+1}^{N-1} P(id_{i})}\right)\\ H(id_r) = &\frac{2^n -N+1}{2^n -N+1} \log_2 (2^n -N+1) \\ &+ \frac{1}{2^n -N +1} \sum_{x \in [0,N-2]} \sum_{i=0}^{x} P(id_i) \times \log_2 \left(\frac{1} {\sum_{i=0}^{x} P(id_i) }\right)\\ &+ \sum_{i=x+1}^{N-1} P(id_i) \times \log_2 \left(\frac{1} {\sum_{i=x+1}^{N-1} P(id_{i})}\right)\\ H(id_r) = &\log_2 (2^n -N+1) + \frac{1}{2^n -N +1}\sum_{x \in [0,N-2]} \sum_{i=0}^{x} P(id_i)\\ &\times \log_2 \left(\frac{1} {\sum_{i=0}^{x} P(id_i) }\right) + \sum_{i=x+1}^{N-1} P(id_i)\\ &\times \log_2 \left(\frac{1} {\sum_{i=x+1}^{N-1} P(id_{i})}\right) \end{aligned} $$

□

1.5 Conditional Entropy of Arithmetic

The arithmetic masking conditional entropy is:

$$\displaystyle \begin{aligned} H_{AM}(id_r | id_o) = \log_2 (2^n -N+1) \end{aligned}$$

Proof

$$\displaystyle \begin{aligned} P(id_r = x | id_o = id_i) &= \frac{1_{[i-1,2^n -N +i-1]} } {2^n -N +1} \\ H_{AM}(id_r | id_o) &= \sum_{i=0}^N P(id_i) H(id_r | id_o = id_i) \\ H_{AM}(id_r | id_o) &= \sum_{i=0}^N P(id_i) \sum_{x \in [i-1,2^n -N +i-1]} P(id_r = x | id_o = id_i)\\ &\times \log_2\left(\frac{1}{ P(id_r = x | id_o = id_i) }\right) \\ H_{AM}(id_r | id_o) &= \sum_{i=0}^N P(id_i) \sum_{x \in [i-1,2^n -N +i-1]} \frac{1} {2^n -N +1} \log_2\left(\frac{1}{ \frac{1} {2^n -N +1} }\right) \\ H_{AM}(id_r | id_o) &= \sum_{i=0}^N P(id_i) \log_2(2^n -N +1) \\ H_{AM}(id_r | id_o) &= \log_2(2^n -N +1) \end{aligned} $$

□

1.6 Fixed Mapping Optimality Proof

If we adopt a fixed mapping randomization strategy, the optimal solution in terms of conditional entropy is the frequency interval solutions.

Proof

In the context of fixed mapping, we want to find the best decomposition of intervals that maximizes the conditional entropy. We previously showed that the conditional entropy of all fixed mapping solutions can be expressed as H(id_r|id_o) =∑_{i ∈ [1,N]}P(id_i) ×log₂(W_i), where I_i is the randomization interval of id_i of width W(I_i). For the fixed mapping solutions, the intervals are nonoverlapping. Besides the width of each interval I_i is positive (W(I_i) ≥ 0) and their sum equals 2ⁿ. Thus we define the following problem:

$$\displaystyle \begin{aligned}\underset{\{I_i\}, i \in [1,N]}{\operatorname{Argmax}} H(id_r|id_o) = \sum_i P(id_i) \times \log_2(W_i)\end{aligned}$$

Subject to the following constraints:

$$\displaystyle \begin{aligned} \begin{array}{lll} h_0 &: &\sum_{i \in [1,N]} W_i - 2^n = 0 \\ h_i &: &\forall i \in [1,N], - W_i \leq 0 \\ \end{array} \end{aligned}$$

To find the solution to this problem, we use the Lagrangian multiplier:

$$\displaystyle \begin{aligned}\mathcal{L} (W_1,\dots,W_N,\lambda_1,\dots\lambda_N,\lambda_0) = H(id_r|id_o) + \sum_{j=0}^{N} \lambda_j h_j\end{aligned}$$

and solve the equation system: $\frac {\partial \mathcal {L} }{\partial W_i} = 0, \quad\forall i \in [1,N]$

$$\displaystyle \begin{aligned}\frac{\partial \mathcal{L}}{\partial W_i} (W_1,\dots,W_N,\lambda_1,\dots\lambda_N,\lambda_0) = \frac{\partial H} {\partial W_i} + \sum_{j=0}^{N} \lambda_j \frac{\partial h_j}{\partial W_i}\end{aligned}$$

$$\displaystyle \begin{aligned}\forall i \in [0,N] : \lambda_i \times h_i = 0\end{aligned}$$

$$\displaystyle \begin{aligned} \begin{array}{lll} h_0 &: &\sum_{i \in [1,N]} W_i - 2^n = 0 \\ h_i &: &\forall i \in [1,N], - W_i \leq 0 \\ \end{array} \end{aligned}$$

We have: $\frac {\partial H} {\partial W_i} = P(id_i) \times \frac {1} {W_i}$ and $\frac {\partial h_0}{\partial W_i} = 1$ and $\frac {\partial h_j}{\partial W_i} = -1$ if (i = j), 0 otherwise

$$\displaystyle \begin{aligned}\forall i \in [1,N] : P(id_i) \times \frac{1} {W_i} + \lambda_0 - \lambda_i = 0\end{aligned}$$

$$\displaystyle \begin{aligned}\forall i \in [1,N]: \lambda_i \times h_i = 0\end{aligned}$$

Resolving this system of equations gives:

$$\displaystyle \begin{aligned}\lambda_i = 0, \quad\forall i \in [1,N]\end{aligned}$$

$$\displaystyle \begin{aligned}\lambda_0 = \frac {-1} {2^n }\end{aligned}$$

Hence:

$$\displaystyle \begin{aligned}\Rightarrow \forall i \in [1,N] : W_i = P(id_i) \times 2^n\end{aligned}$$

□