Controller area network traffic flow confidentiality
A transmitter device of a bus-based communication system may add one or more padding bits, associated with providing traffic flow confidentiality for communication of a payload on a communication bus, either to the payload on a transport layer, or to one or more first frames on a data link layer. The one or more first frames may include a transport layer payload associated with the payload. The transmitter device may transmit one or more second frames, including a data link layer payload associated with the one or more first frames, on the communication bus. A receiver device of the bus-based communication system may receive the one or more second frames on the communication bus. The receiver device may process the one or more padding bits from either the one or more first frames on the data link layer, or from the payload on the transport layer.
1. A device comprising:
a transmitter; and
one or more processors configured to:
generate, on a transport layer, one or more first frames based on a payload, each of the one or more first frames including a first header,
wherein the one or more first frames include an authentication tag associated with the one or more first frames, and
wherein the authentication tag represents an indication that a frame of the one or more first frames was intended to be transmitted to a receiver;
generate, on a data link layer, one or more second frames based on the one or more first frames, each of the one or more second frames including a second header;
add one or more padding bits, associated with providing traffic flow confidentiality for communication of the payload on a communication bus, to at least one of:
the payload, on the transport layer, or
the one or more first frames, on the data link layer; and
transmit the one or more second frames on the communication bus,
wherein a separator is used to separate the one or more padding bits from the one or more first frames when the one or more padding bits are added to the one or more first frames on the data link layer.
2. The device of claim 1 , wherein the device is included in a bus-based communication system that uses at least one of:
a controller area network (CAN) protocol,
a CAN with flexible data-rate protocol, or
a CAN extra large protocol.
3. The device of claim 1 , wherein the one or more processors, when adding the one or more padding bits to the payload on the transport layer, are further configured to:
add a payload length indicator to the payload;
encrypt a result of adding the payload length indicator; and
add the one or more padding bits to the payload to generate a transport layer payload.
4. The device of claim 1 , wherein the one or more processors, when adding the one or more padding bits to the payload on the transport layer, are further configured to:
receive information indicating a total padded payload length; and
add the one or more padding bits to the payload based on the information indicating the total padded payload length.
5. The device of claim 1 , wherein the first header includes an indication that a transport layer payload starts with a payload length indicator when the one or more padding bits are added to the payload on the transport layer.
6. The device of claim 1 , wherein the one or more processors, when adding the one or more padding bits to the one or more first frames on the data link layer are further configured to:
encrypt a result of adding the one or more padding bits to the one or more first frames to generate a data link layer payload.
7. The device of claim 1 , wherein the one or more processors, when adding the one or more padding bits to the one or more first frames on the data link layer are further configured to:
receive information indicating a total length to be transmitted on the communication bus, the information indicating the total length being received from the transport layer; and
add the one or more padding bits to the one or more first frames based on the information indicating the total length to be transmitted on the communication bus.
8. The device of claim 1 , wherein information that identifies a length of a transport layer payload is included in the first header when the one or more padding bits are added to the one or more first frames on the data link layer.
9. The device of claim 1 , wherein an encrypted payload length indicator is included in the second header when the one or more padding bits are added to the one or more second frames on the data link layer.
10. A device, comprising:
a receiver; and
one or more processors configured to:
receive one or more second frames on a communication bus,
wherein the one or more second frames include a second header;
extract, on a data link layer, a data link layer payload from the one or more second frames,
wherein the data link layer payload includes one or more first frames;
provide the one or more first frames to a transport layer,
wherein the one or more first frames include a first header;
extract, on the transport layer, a transport layer payload from the one or more first frames;
process one or more padding bits, associated with providing traffic flow confidentiality for communication of a payload on the communication bus, from at least one of:
the one or more first frames, on the data link layer, or
the payload, on the transport layer; and
determine the payload based on the transport layer payload.
11. The device of claim 10 , wherein the device is included in a bus-based communication system that uses at least one of:
a controller area network (CAN) protocol,
a CAN with flexible data-rate (CAN FD) protocol, or
a CAN extra large protocol.
12. The device of claim 10 , wherein the one or more processors, when processing the one or more padding bits from the payload on the transport layer, are further configured to:
decrypt, on the transport layer, the transport layer payload;
determine, on the transport layer, a payload length indicator based on a result of decrypting the transport layer payload; and
remove the one or more padding bits based on the payload length indicator.
13. The device of claim 10 , wherein the first header includes an indication that the transport layer payload starts with a payload length indicator when the one or more padding bits are processed from the payload on the transport layer.
14. The device of claim 10 , wherein the one or more processors, when processing the one or more padding bits from the one or more first frames on the data link layer, are further configured to:
decrypt, on the data link layer, the data link layer payload to determine the one or more first frames and the one or more padding bits.
15. The device of claim 10 , wherein information that identifies a length of the transport layer payload is included in the first header when the one or more padding bits are processed from the one or more first frames, on the data link layer.
16. The device of claim 10 , wherein an encrypted payload length indicator is included in the second header when the one or more padding bits are processed from the one or more first frames, on the data link layer.
17. The device of claim 10 , wherein a separator is used to separate the one or more padding bits from the one or more first frames when the one or more padding bits are processed from the one or more first frames, on the data link layer.
18. A method, comprising:
generating, by a device and on a transport layer, one or more first frames based on a payload, each of the one or more first frames including a first header,
wherein the one or more first frames include an authentication tag associated with the one or more first frames, and
wherein the authentication tag represents an indication that a frame of the one or more first frames was intended to be transmitted to a receiver;
generating, by the device and on a data link layer, one or more second frames based on the one or more first frames, each of the one or more second frames including a second header;
adding, by the device, one or more padding bits, associated with providing traffic flow confidentiality for communication of a payload on a communication bus, to at least one of:
the payload, on the transport layer, or
the one or more second frames, on the data link layer; and
transmitting the one or more second frames on the communication bus,
wherein a separator is used to separate the one or more padding bits from the one or more first frames when the one or more padding bits are added to the one or more first frames on the data link layer.
19. The method of claim 18 , wherein the device is included in a bus-based communication system using one of:
a controller area network (CAN) protocol,
a CAN with flexible data-rate protocol, or
a CAN extra large protocol.
20. The method of claim 18 , wherein the first header includes an indication that a transport layer payload starts with a payload length indicator when the one or more padding bits are added to the payload on the transport layer.