A Roundup of the Latest Developments in CAN Security

Cars are getting “smarter” and more connected by the day, which is great news for the productivity and entertainment extras you’ve been dreaming of—from voice texting to touchscreen interfaces and video screens to turning your car into a rolling WiFi hotspot. But it’s also great news for hackers, who have more opportunities than ever to compromise the security of connected cars.

While most instances of hacking have been fairly mild, the scope of what is possible once a car has been hacked is more than a little troubling: from something as simple as blasting cold air from the AC vents or activating the windshield wiper fluid mechanism to critically disabling a car’s airbags and brakes.

While vehicle security has always been a major issue, vehicle cybersecurity is a burgeoning industry. One of the leading lights in vehicle cybersecurity is IOActive, perhaps best known for their high-profile car hacking stunt that ran a car off the road with a Wired journalist inside. Of course, IOActive has diligently noted vehicle vulnerabilities to highlight the issue to car manufacturers while also helping to solve and patch these vulnerabilities.

With the auto industry now taking cybersecurity more seriously, innovative security measures for connected cars are in evidence, not least for CAN-connected components. The standards committees – Kvaser staff participate in a number of these – are also working on ways to improve the security of the physical and logical interfaces of networked ECUs. For example, the OBDII interface used for diagnostic purposes (which comes under the ISO 15765 standard) is under review, with security mechanisms being introduced in the next version.

Here are some recent CAN-related developments in vehicle cybersecurity: 

• Arilou and Green Hills Software have joined forces to ensure that communications between ECUs and a vehicle’s CAN bus are secured, preventing any CAN bus-targeted malicious attacks. They hope to accomplish this by implementing Arilou’s Intrusion Detection and Prevention System (IDPS) on Green Hills’ INTEGRITY® real-time operating system (RTOS).

• Argus, Elektrobit and NXP are collaborating on the first complete software-hardware security solution to deliver comprehensive protection against sophisticated cyberattacks. These three entities will combine NXP’s secure CAN transceiver, which detects and prevents malicious activity at the CAN bus level with Argus’ Intrusion Detection and Prevention Software (IDPS), which mines data and timing heuristics to detect potentially malicious activity, and Elektrobit’s cadian Sync software, which enables real-time over-the-air (OTA) updates throughout the vehicle, including critical updates to ECUs based on the detections of the NXP Secure CAN Transceiver and Argus IDPS.

• CiA’s CAN Cyber Security group issued their 2019 CAN security recommendations, which include adding security to all communication layers using hardware solutions like NXP’s TJA115x secure CAN/CAN FD transceiver family to add message monitoring and flood protection, and using CANcrypt to add security just above the data link layer.