TEAM Integrity: Transparent Enforcement of Automotive Message Integrity

The CAN protocol, which serves as the nervous system for most modern automotive vehicles, was not designed with security in mind. Electronic Control Units (ECUs) accept any message on the bus as trusted, leaving them vulnerable for attacks that spoof messages, cause denial of service, or impersonate legitimate devices. In the proposed Transparent Enforcement of Automotive Message Integrity (TEAM Integrity), Red Balloon Security (RBS), Inc. and its subcontractor, Colorado State University (CSU), will implement a no-false-positive Intrusion Detection System (IDS) that has minimal performance overhead and no functional impact. This will be achieved through the introduction of security features and cryptographic authentication capabilities directly in ECU firmware binaries. In particular, TEAM Integrity will introduce Source Address message filtering and Cipher-based Message Authentication Code (CMAC) cryptographic capabilities for CAN/J1939 authentication purposes in the binary firmware of ECUs. This will realize an IDS that operates on data relating to contents of CAN messages, message frequency, and CMAC authentication values. Any detected intrusion will be reported using Parameter Group Numbers (PGNs) for Data Security, Imposter Parameter Group Alert, and Diagnostic Messages as defined in the SAE Recommended Practice J1939-73 Diagnostics. The effort will build on top of proven prior work from RBS and CSU, on the topics of firmware binary modification, and introduction of security features for CAN/J1939 in ECUs, respectively. The proposed security features have been explored by CSU, albeit employing additional hardware modules installed in front of ECUs, making the approach hard to scale and labor-intensive. RBS will leverage the advanced firmware binary analysis and modification/rewriting capabilities of its Open Firmware Reverse Analysis Konsole (OFRAK) framework to incorporate these capabilities directly in ECU firmware binaries. As such, the TEAM Integrity approach facilitates deployment and adoption for existing and new ECUs, as it does not require the introduction of additional hardware components on vehicles or access to the source code of ECU firmware. The resulting security-enabled firmware binaries will be tested on a hardware testbed developed by CSU. The testbed, including a unique research truck (part of the research fleet at CSU), will be used to assess the functionality and performance of RBS-introduced modifications on the baseline functionality of the target ECU device.