A Periodic Authentication Scheme for Safety/Security Co-Design on CAN Buses

With an increasing number of interconnected vehicles, it has become easier for an attacker to gain remote access to in-vehicle buses like CAN and, hence, security measures become necessary. However, most existing attempts to secure CAN either modify the hardware, which leads to increased costs, or apply encryption/authentication, which negatively impacts the timing behavior on the bus. In particular, when using authentication, new data (i.e., an authentication tag) is added, resulting in larger payloads. As a consequence, multiple CAN frames need to be sent (instead of only one) for each message, introducing extra delays and potentially leading to deadline misses. To address this problem, we propose a safety/security co-design approach based on combining a technique we call periodically authenticated encryption (PAE) with plausibility checks. The main idea is to not authenticate each and every message transmitted on CAN, but only with a certain configurable frequency. This way, less authentication tags are sent, which reduces the overhead. Plausibility checks are then used to determine whether non-authenticated messages sent in between two authenticated ones have been altered by an attack, e.g., whether the transmitted values exceed a given range or do not match previous ones. We then illustrate the benefits of the proposed approach on two realistic case studies consisting of emergency braking and adaptive cruise control.