CANBUS cybersecurity firewall
A method to create a serial wire speed firewall that can monitor and enforce security policy on a CAN buy network and prevent cyber-attacks.
1 . An apparatus comprising:
a processor; and
memory coupled with the processor, the memory storing executable instructions that when executed by the processor cause the processor to effectuate operations comprising:
obtaining a Controller Area Network (CAN) bus frame based on a signal on a serial bus of a CAN bus system of a vehicle, wherein the signal is associated with an application, and wherein the CAN bus frame includes sub-frame data elements;
determining that one or more of the sub-frame data elements in the CAN bus frame corresponds to one or more terms in a policy rule; and
based on the determining, sending an indication of a drop action to be implemented by one or more apparatuses of the CAN bus system, wherein the policy rule specifies that a drop action is to be performed after a threshold number of alert actions have been indicated for CAN bus frames associated with the application within a period of time without any allow actions having been indicated for CAN bus frames associated with the application within that period of time, such that a drop action is not performed if an allow action is indicated for one or more CAN bus frames associated with the application within that period of time.
2 . The apparatus of claim 1 , wherein the sub-frame data elements comprise an arbitration field, a control field, and a data field.
3 . The apparatus of claim 2 , wherein the arbitration field, the control field, and the data field are presented in the CAN bus frame in sequential order.
4 . The apparatus of claim 1 , wherein the policy rule used is based on a type of the application.
5 . The apparatus of claim 1 , wherein the application relates to an audio system, an airbag system, a navigation system, or a vehicle theft system.
6 . The apparatus of claim 1 , wherein the processor is included in an electronic control unit (ECU).
7 . The apparatus of claim 1 , wherein the one or more terms are pre-provisioned terms.
8 . The apparatus of claim 1 , wherein the operations further comprise causing a warning to be output responsive to an alert action having been indicated for the signal or another signal.
9 . The apparatus of claim 1 , wherein the one or more apparatuses include a serial bus enforcement module.
10 . A method comprising:
obtaining, by a processing system including a processor, a Controller Area Network (CAN) bus frame based on a signal on a serial bus of a CAN bus system of a vehicle, wherein the signal is associated with an application, and wherein the CAN bus frame includes sub-frame data elements;
determining, by the processing system, that one or more of the sub-frame data elements in the CAN bus frame corresponds to one or more pre-provisioned terms in a policy rule; and
based on the determining, sending, by the processing system, an indication of a drop action to be implemented by one or more apparatuses of the CAN bus system, wherein the policy rule specifies that a drop action is to be performed after a threshold number of alert actions have been indicated for CAN bus frames associated with the application within a period of time without any allow actions having been indicated for CAN bus frames associated with the application within the period of time, such that a drop action is avoided if an allow action is indicated for one or more CAN bus frames associated with the application within that period of time.
11 . The method of claim 10 , wherein the sub-frame data elements comprise an arbitration field, a control field, and a data field.
12 . The method of claim 11 , wherein the arbitration field, the control field, and the data field are presented in the CAN bus frame in sequential order.
13 . The method of claim 10 , wherein the policy rule used is based on a type of the application.
14 . The method of claim 10 , wherein the application relates to an audio system, an airbag system, a navigation system, or a vehicle theft system.
15 . The method of claim 10 , wherein the processing system comprises an electronic control unit (ECU).
16 . The method of claim 10 , further comprising causing, by the processing system, a warning to be output responsive to an alert action having been indicated for the signal or another signal.
17 . The method of claim 10 , wherein the one or more apparatuses include a serial bus enforcement module.
18 . A non-transitory computer readable storage medium storing computer executable instructions that when executed by a computing device cause said computing device to effectuate operations comprising:
deriving a Controller Area Network (CAN) bus frame based on a signal on a serial bus of a CAN bus system of a vehicle, wherein the signal is associated with an application, and wherein the CAN bus frame includes sub-frame data elements;
determining that one or more of the sub-frame data elements in the CAN bus frame corresponds to one or more terms in a policy rule; and
based on the determining, sending an indication of a drop action to be implemented by one or more apparatuses of the CAN bus system, wherein the policy rule specifies that a drop action is to be performed after a threshold number of alert actions have been indicated for CAN bus frames associated with the application within a period of time without any allow actions having been indicated for CAN bus frames associated with the application within the period of time, such that a drop action is avoided if an allow action is indicated for one or more CAN bus frames associated with the application within that period of time.
19 . The non-transitory computer readable storage medium of claim 18 , wherein the sub-frame data elements comprise an arbitration field, a control field, and a data field.
20 . The non-transitory computer readable storage medium of claim 18 , wherein the one or more apparatuses include a serial bus enforcement module.