End-to-end communication security
In one implementation, a method for providing end-to-end communication security for a controller area network (CANbus) in an automotive vehicle across which a plurality of electronic control units (ECU) communicate is described. Such an automotive vehicle can include, for example, a car or truck with multiple different ECUs that are each configured to control various aspects of the vehicle's operation, such as an infotainment system, a navigation system, various engine control systems, and/or others.
1. A computer-implemented method for monitoring and controlling a plurality of electronic control units (ECUs) in a population of vehicles, the method comprising:
receiving, at a first ECU in a vehicle among the population, a first message from a second ECU in the vehicle;
determining, at a runtime of the first ECU, that the vehicle is in a potentially unsafe condition;
deleting, after determining that the vehicle is in the potentially unsafe condition, a cryptographic key associated with the first or second ECU;
receiving, at the first ECU, a second message from the second ECU;
detecting, at the first ECU and while the vehicle is in the potentially unsafe condition, an invalid cryptographic value associated with the second message; and
ignoring, using a security layer specific to the second ECU and based on the detecting, communications to the second ECU associated with the invalid cryptographic value.
2. The method of claim 1 , further comprising providing, from the first ECU, an alert indicating a real-time context of the vehicle.
3. The method of claim 2 , wherein the real-time context is a statistical outlier outside of a normal operation of the first ECU.
4. The method of claim 1 , wherein the first ECU is externally connected to a network outside the vehicle.
5. The method of claim 1 , wherein the second ECU is responsible for an engine function of the vehicle.
6. The method of claim 1 , wherein a valid cryptographic value is associated with the first message.
7. The method of claim 1 , wherein the first message has a first CAN message ID associated with the first message.
8. The method of claim 7 , wherein the first ECU persistently listens for messages having the first CAN message ID.
9. The method of claim 1 , wherein the invalid cryptographic value is a CAN message ID associated with the second message.
10. The method of claim 9 , wherein the CAN message ID is further associated with the second ECU.
11. A system for monitoring and controlling a plurality of electronic control units (ECUs) in a population of vehicles, comprising:
at least one processor configured to execute ECU software and security software; and
at least one memory storing the ECU software and the security software, wherein the security software includes instructions for performing operations including:
receiving, at a first ECU in a vehicle among the population, a first message from a second ECU in the vehicle;
determining, at a runtime of the first ECU, that the vehicle is in a potentially unsafe condition;
deleting, after determining that the vehicle is in the potentially unsafe condition, a cryptographic key associated with the first or second ECU;
receiving, at the first ECU, a second message from the second ECU;
detecting, at the first ECU and while the vehicle is in the potentially unsafe condition, an invalid cryptographic value associated with the second message; and
ignoring, using a security layer specific to the second ECU and based on the detecting, communications to the second ECU associated with the invalid cryptographic value.
12. The system of claim 11 , the operations further including providing, from the first ECU, an alert indicating a real-time context of the vehicle.
13. The system of claim 12 , wherein the real-time context is a statistical outlier outside of a normal operation of the first ECU.
14. The system of claim 11 , wherein the first ECU is externally connected to a network outside the vehicle.
15. The system of claim 11 , wherein the second ECU is responsible for an engine function of the vehicle.
16. The system of claim 11 , wherein the cryptographic key is based on a physically unclonable function (PUF) of the first or second ECU.
17. The system of claim 11 , wherein the first message has a first CAN message ID associated with the first message.
18. The system of claim 17 , wherein the first ECU persistently listens for messages having the first CAN message ID.
19. The system of claim 11 , wherein the invalid cryptographic value is a CAN message ID associated with the second message.
20. The system of claim 19 , wherein the CAN message ID is further associated with the second ECU.