# US 2018/0025156 A1 · Anti-Spoofing Defense System for a Can Bus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0025156 A1 - Document ID: US20180025156A1 - Status: Published application - Kind: A1 - Application number: 15/654,740 - Filed: 2017-07-20 - Published: 2018-01-25 - Earliest claimed: 2016-07-21 - Assignees: Ramot at Tel-Aviv University Ltd. - Applicants: Ramot at Tel-Aviv University Ltd. - Inventors: Tsvika Dagan; Avishai Wool - Web page: https://patentgrep.com/patent/US20180025156A1 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 21/55: Detecting local intrusion or implementing counter-measures - H04L 63/1458: {Denial of Service} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A processor is configured to identify a first impersonating message, transmitted over a Controller Area Network (CAN) bus by an attacking node connected to the bus, that appears to originate from a source other than the attacking node, to transmit via a transceiver, in response to identifying the first impersonating message, a stream of messages over the bus, until a defense message belonging to the stream collides with, and trumps, a second impersonating message from the attacking node, and to drive the attacking node, subsequently, into an error-passive state in which an ability of the attacking node to communicate over the bus is limited relative to before entering the error-passive state, by repeatedly retransmitting the defense message over the bus in sync with retransmissions of the second impersonating message by the attacking node, such that the defense message collides with, and trumps, multiple subsequent instances of the second impersonating message. ## Claims ### Claim 1 A system, comprising: at least one transceiver; and at least one processor, configured: to identify a first impersonating message, transmitted over a Controller Area Network (CAN) bus by an attacking node connected to the bus, that appears to originate from a source other than the attacking node, to transmit via the transceiver, in response to identifying the first impersonating message, a stream of messages over the bus, until a defense message belonging to the stream collides with, and trumps, a second impersonating message from the attacking node, and to drive the attacking node, subsequently to the defense message colliding with and trumping the second impersonating message, into an error-passive state in which an ability of the attacking node to communicate over the bus is limited relative to before entering the error-passive state, by repeatedly retransmitting the defense message over the bus in sync with retransmissions of the second impersonating message by the attacking node, such that the defense message collides with, and trumps, multiple subsequent instances of the second impersonating message. ### Claim 2 (depends on 1) The system according to claim 1, wherein the first impersonating message appears to originate from the system. ### Claim 3 (depends on 1) The system according to claim 1, wherein the attacking node, in response to the defense message colliding with and trumping a final one of the instances of the second impersonating message, repeatedly transmits a passive-error flag over the bus, and wherein the processor is further configured to drive the attacking node into a bus-off state in which the attacking node cannot communicate over the bus, by transmitting, over the bus, a plurality of passive-error-flag-trumping messages that collide with, and trump, respective instances of the passive-error flag. ### Claim 4 (depends on 3) The system according to claim 3, wherein the processor is configured to drive the attacking node into the error-passive state by causing an error counter of the attacking node to be increased to a first threshold, and to drive the attacking node into the bus-off state by causing the error counter of the attacking node to be further increased to a second threshold. ### Claim 5 (depends on 1) The system according to claim 1, wherein the defense message collides with the second impersonating message by virtue of beginning during the same bit-time slot as does the second impersonating message. ### Claim 6 (depends on 1) The system according to claim 1, wherein the defense message trumps the second impersonating message by virtue of including a dominant bit, as defined by a communication protocol used on the bus, during the same bit-time slot as a recessive bit belonging to the second impersonating message. ### Claim 7 (depends on 6) The system according to claim 6, wherein the defense message includes the dominant bit in a data field of the defense message. ### Claim 8 (depends on 7) The system according to claim 7, wherein the defense message includes only dominant bits in the data field. ### Claim 9 (depends on 6) The system according to claim 6, wherein the defense message includes the dominant bit in a data length code (DLC) field of the defense message. ### Claim 10 (depends on 9) The system according to claim 9, wherein the defense message includes only dominant bits in the DLC field. ### Claim 11 (depends on 1) The system according to claim 1, wherein the system comprises at least one electronic control unit (ECU) comprising the transceiver and the processor. ### Claim 12 (depends on 1) The system according to claim 1, wherein the first impersonating message appears to originate from the source other than the attacking node by virtue of including a message ID that is associated with the source. ### Claim 13 (depends on 12) The system according to claim 12, wherein each of the messages in the stream of defense messages includes the message ID that is included by the first impersonating message. ### Claim 14 (depends on 1) The system according to claim 1, wherein the processor is configured to transmit the stream of messages with a minimum spacing, between successive messages of the stream, that is allowed by a communication protocol used on the bus. ### Claim 15 A system, comprising: at least one transceiver; and at least one processor, configured: to identify a first impersonating message, transmitted over a Controller Area Network (CAN) bus by an attacking node connected to the bus, that appears to originate from a source other than the attacking node, to drive the attacking node, in response to identifying the first impersonating message, into an error-passive state in which an ability of the attacking node to communicate over the bus is limited, relative to before entering the error-passive state, and to drive the attacking node, subsequently to driving the attacking node into the error-passive state, into a bus-off state in which the attacking node cannot communicate over the bus, by transmitting, over the bus, a plurality of passive-error-flag-trumping messages that collide with, and trump, respective instances of a passive-error flag that the attacking node transmits over the bus. ### Claim 16 A method, comprising: identifying a first impersonating message, transmitted over a Controller Area Network (CAN) bus by an attacking node connected to the bus, that appears to originate from a source other than the attacking node; in response to identifying the first impersonating message, transmitting a stream of messages over the bus, until a defense message belonging to the stream collides with, and trumps, a second impersonating message from the attacking node; and subsequently to the defense message colliding with and trumping the second impersonating message, driving the attacking node into an error-passive state in which an ability of the attacking node to communicate over the bus is limited, relative to before entering the error-passive state, by repeatedly retransmitting the defense message over the bus in sync with retransmissions of the second impersonating message by the attacking node, such that the defense message collides with, and trumps, multiple subsequent instances of the second impersonating message. ### Claim 17 (depends on 16) The method according to claim 16, wherein the attacking node, in response to the defense message colliding with and trumping a final one of the instances of the second impersonating message, repeatedly transmits a passive-error flag over the bus, and wherein the method further comprises driving the attacking node into a bus-off state in which the attacking node cannot communicate over the bus, by transmitting, over the bus, a plurality of passive-error-flag-trumping messages that collide with, and trump, respective instances of the passive-error flag. ### Claim 18 (depends on 17) The method according to claim 17, wherein driving the attacking node into the error-passive state comprises driving the attacking node into the error-passive state by causing an error counter of the attacking node to be increased to a first threshold, and wherein driving the attacking node into the bus-off state comprises driving the attacking node into the bus-off state by causing the error counter of the attacking node to be further increased to a second threshold. ### Claim 19 (depends on 17) The method according to claim 17, wherein the identifying is performed by a first defending node, and wherein transmitting the passive-error-flag-trumping messages comprises transmitting at least some of the passive-error-flag-trumping messages by at least one second defending node. ### Claim 20 (depends on 19) The method according to claim 19, further comprising, using the first defending node, instructing the at least one second defending node to transmit the at least some of the passive-error-flag-trumping messages. ### Claim 21 (depends on 16) The method according to claim 16, wherein the defense message collides with the second impersonating message by virtue of beginning during the same bit-time slot as does the second impersonating message. ### Claim 22 (depends on 16) The method according to claim 16, wherein the defense message trumps the second impersonating message by virtue of including a dominant bit, as defined by a communication protocol used on the bus, during the same bit-time slot as a recessive bit belonging to the second impersonating message. ### Claim 23 (depends on 22) The method according to claim 22, wherein the defense message includes the dominant bit in a data field of the defense message. ### Claim 24 (depends on 23) The method according to claim 23, wherein the defense message includes only dominant bits in the data field. ### Claim 25 (depends on 22) The method according to claim 22, wherein the defense message includes the dominant bit in a data length code (DLC) field of the defense message. ### Claim 26 (depends on 25) The method according to claim 25, wherein the defense message includes only dominant bits in the DLC field. ### Claim 27 (depends on 16) The method according to claim 16, wherein the first impersonating message appears to originate from the source other than the attacking node by virtue of including a message ID that is associated with the source. ### Claim 28 (depends on 27) The method according to claim 27, wherein each of the messages in the stream of defense messages includes the message ID that is included by the first impersonating message. ### Claim 29 (depends on 16) The method according to claim 16, wherein transmitting the stream of messages comprises transmitting the stream of messages with a minimum spacing, between successive messages of the stream, that is allowed by a communication protocol used on the bus. ### Claim 30 A method, comprising: identifying a first impersonating message, transmitted over a Controller Area Network (CAN) bus by an attacking node connected to the bus, that appears to originate from a source other than the attacking node; in response to identifying the first impersonating message, driving the attacking node into an error-passive state in which an ability of the attacking node to communicate over the bus is limited, relative to before entering the error-passive state; and subsequently to driving the attacking node into the error-passive state, driving the attacking node into a bus-off state in which the attacking node cannot communicate over the bus, by transmitting, over the bus, a plurality of passive-error-flag-trumping messages that collide with, and trump, respective instances of a passive-error flag that the attacking node transmits over the bus.