Automated can message translator
AssigneeThe Regents of the University of Michigan
InventorsKang G. Shin, Mert Dieter Pese
Life of this patent
Estimating the term…
Abstract
One commonality among most vehicular security attacks reported to date is that they ultimately require write access to the CAN bus. In order to cause targeted and intentional changes in the vehicle behavior, malicious CAN injection attacks require knowledge of the CAN message format. However, since this format is proprietary to OEMs and can differ even among different models of a single make of vehicle, one must manually reverse-engineer the CAN message format of each vehicle they target. To mitigate this difficulty, an automated CAN message translator is presented.
Claims13
A computer-implemented method for translating messages sent over a vehicle network, comprising:
- receiving, by a computer processor, raw data sent over the vehicle network during a monitoring period;
- partitioning, by the computer processor, the raw data into a plurality of messages, where each message in the plurality of messages includes a message identifier;
- grouping, by the computer processor, the plurality of messages into multiple message groups, where each message group includes messages with a unique message identifier amongst the plurality of message groups;
- receiving, by the computer processor, tagged data sent over the vehicle network during the monitoring period, where the tagged data includes an identifier for a given vehicle parameter and is formatted in accordance with a standardized protocol;
- determining, by the computer processor, a similarity measure between the tagged data and each message group in the plurality of message groups;
- identifying, by the computer processor, one or more message groups in the plurality of message groups having a high correlation with the tagged data;
- and
- determining, by the computer processor, a data format for the given vehicle parameter in the plurality of messages from the one or more identified message groups.
A computer-implemented method for identifying message identifiers associated with a particular vehicle function, comprising:
- capturing, by a computer processor, reference data sent over a vehicle network of a vehicle while an engine of the vehicle is off and no vehicle functions are performed in the vehicle;
- partitioning, by the computer processor, the reference data into a plurality of reference messages to form a reference state, where each message in the plurality of reference messages includes a message identifier and payload data;
- capturing, by the computer processor, event data sent over the vehicle network while a particular vehicle function is performed in the vehicle and an engine of the vehicle is off;
- partitioning, by the computer processor, the event data into a plurality of candidate messages, where each message in the plurality of candidate messages includes a message identifier and payload data;
- removing, by the computer processor, candidate messages from the plurality of candidate messages, where the payload data from the candidate messages removed from the plurality of candidate messages matches payload data for at least one of the references messages in the plurality of references messages;
- identifying, by the computer processor, additional candidate messages in the plurality of candidate messages, where the message identifier and the payload data is the same amongst the additional candidate messages;
- removing, by the computer processor, additional candidate messages from the plurality of candidate messages;
- and
- associating, by the computer processor, message identifiers for messages remaining in the plurality of candidate message with the particular vehicle function.
Dependencies are inferred from the claim text.