Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: We're looking at the paper: "Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks".

Elias: Here's the gist of the paper. The gist This work focuses on eliminating timing-side channels in real-time safety-critical cyber-physical network protocols like Controller Area Networks (CAN) by proposing a novel schedule obfuscation strategy called Hide-n-Seek to prevent schedule-based attacks such as bus-off attacks.

Nadia: The development cycle of real-time cyber-physical systems (CPSs), like automotive, generally considers safety and timeliness as their first-class design criteria.

Elias: This determinism exposes timing information about task executions and therefore corresponding message transmissions via the network buses.

Nadia: The Control Area Network (CAN) is a preferred target for schedule-based attacker type man-in-the-middle attacks.

Paper summary: Nadia: So we're looking at this paper titled "Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks" by Sunandan Adhikary and his team. It tackles timing side channels in real-time safety critical protocols like CAN, which is really important because these systems, like in cars, have to be absolutely deterministic.

Elias: Exactly. The core issue here is that the predictable scheduling decisions in automotive Electronic Control Units expose timing information about when tasks run and when messages are sent over those network buses connecting all the ECUs and actuators. That determinism can be exploited by schedule based attacks, which can lead to denial of service or man-in-the-middle scenarios.

Priya: It sounds like this paper is zeroing in on how timing information leaks through the CAN bus because the scheduling itself is too predictable for an attacker to hide behind. What's the main proposal here?

Nadia: The authors propose a new schedule obfuscation strategy they call Hide-n-Seek, which involves skipping certain control task executions and related data transmissions, while also randomly shifting where a victim task instance appears in the schedule.

Elias: They are trying to eliminate that timing information leakage by changing the execution pattern itself, aiming to hide the safety critical messages from an attacker who is trying to launch a schedule based attack.

Priya: And they aren't just randomly shuffling things; they are actually contemplating the performance of the control task, specifically bounding how many control execution skips are allowed while still keeping it functional. That's a key detail we need to look at, because performance is everything in real time systems.

Nadia: Right. They analytically show how this attack aware skipping and randomization reduces the attack success probability by demonstrating that under their approach, P(ASObf) is reduced significantly compared to static schedules or other schedule randomization techniques.

Elias: The paper specifically shows that applying this strategy at execution instances where maximum ASPs are observed in a static task schedule results in zero ASP at those corresponding CAN transmission slots, which means any bus-off attack attempt during those periods gets detected.

Priya: So, what does this mean practically for someone just listening to the show? It suggests that even if you have a deterministic system like an ABS or traction control unit, you can actively hide its communication timing from an attacker trying to cause a bus-off condition.

Paper summary: Nadia: It means the system can detect those attempts because the obfuscation strategy is designed not just to hide information but also to act as a detection mechanism for these specific attacks.

Elias: The Hide-n-Seek strategy involves three distinct obfuscation strategies depending on what they analyze during a reconnaissance period, starting with skipping victim task instances in descending order of their attack success probability.

Priya: That sounds like a layered defense because they have different actions planned for different situations, which is good because it's not just one simple randomization technique.

Nadia: If the first strategy doesn't work, they move to skipping higher priority tasks that are more critical, transmitting a control message with an ID less than mv before the victim task instance arrives.

Elias: And if both of those fail, the third strategy kicks in where they select the victim task itself first among tasks of the same priority that fall within what they call the attack window.

Priya: So, it’s a dynamic response based on what they observe during reconnaissance—skipping tasks, dropping higher priority messages early, or just prioritizing their own victim task execution when things get tight. What about the initial modeling part?

Nadia: Before getting into the obfuscation details, they provide a background on typical automotive control tasks and how those are modeled to meet stability and performance requirements. They use a closed-loop safety critical CPS model where an estimator task estimates the plant's state vector x, and then a control task calculates the required input u for transmission via the CAN bus.

Elias: That modeling setup, using linear time invariant LTI closed-loop systems described in Eq. one to capture the progression of that plant controller closed-loop, sets up exactly what they are trying to protect with this scheduling strategy <ref:2306.09206#pg1>.

Priya: So they're working within the context of these established CPS models for things like ABS or electronic stability control, and their solution is trying to layer security on top of that predictable model.

Nadia: The overall implication here is that we can implement a lightweight framework, this Hide-n-Seek approach, to apply these attack aware transformations directly onto the task execution schedules of ECUs to effectively obfuscate the CAN message schedule.

Paper summary: Elias: That framework aims to reduce the bus-off attack success probability and it also incorporates a method specifically designed to detect such attempts as they happen.

Priya: But I want to bring up what they admit about their approach. They mention that previous solutions, like simple schedule randomization, have been shown where the increase in entropy of schedule randomization doesn't actually guarantee a reduced attack success probability, and randomizing without knowing the attacker's strategy might even increase system penetrability.

Nadia: That’s a fair point because it highlights why their specific approach is important; they aren't just randomizing blindly, they are using information about the attacker's strategy to guide the obfuscation.

Elias: They are proposing an attack aware schedule randomization strategy, AAwSOS, which instruments the ECU schedule to hide timing leakage from an attacker who is attempting a schedule based attack like bus-off.

Priya: It’s interesting that they focus on making it lightweight because they acknowledge that other solutions might carry additional installation costs or rely on trusted modules that could be compromised, which would defeat their intrusion detection system.

Nadia: Exactly. The goal is to provide a practical defense mechanism against these schedule based attacks without introducing massive overhead or relying on perfect hardware trust.

Elias: So, moving toward the conclusion, the paper titled "Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks" by Adhikary and colleagues focuses on providing this lightweight algorithmic framework called Hide-n-Seek.

Priya: It seems like they've put together a concrete way to make deterministic systems less vulnerable by dynamically manipulating the task schedule based on real time observations of potential attack success probabilities.

Nadia: And it incorporates a method for detection, which is the bus-off attack attempt itself, making it more than just a hiding mechanism; it’s an active defense tool.

Elias: The implication is that for safety critical cyber physical networks like CAN in automotive systems, we have a way to reduce the success probability of schedule based attacks through this targeted obfuscation.

Priya: It shows that manipulating the timing information through schedule modification can be effective against these specific types of attacks when done intelligently and with performance constraints in mind.

Nadia: So, the authors have created a tangible framework for applying attack aware transformations to ECU schedules to secure CAN communication timing.

Conclusion: Nadia: So, we've seen how this paper proposes a method to hide CAN message timing information using something called Hide-n-Seek, which is designed to stop those schedule based bus off attacks.

Elias: Yeah, the authors are Sunandan Adhikary and his team. They’re tackling that determinism issue in real time systems.

Priya: So, what does this actually mean for the folks who just need to keep their cars on the road or their machines running safely?

Nadia: It means we can make those safety critical CAN messages less obvious to attackers by changing how they are scheduled based on what an attacker is trying to do.

Elias: They’re using these three specific skipping and randomization strategies depending on what they see during their reconnaissance period.

Priya: So, the numbers show that this approach cuts down the chance of a bus off attack happening significantly compared to just randomly messing with the schedule.

Nadia: Exactly, they show a reduction in that attack success probability by using these tailored steps instead of just blind randomization.

Elias: The main point is this lightweight framework called Hide-n-Seek which applies these attack aware transformations to the ECU schedules.

Priya: It’s interesting that they focus on making it lightweight because other solutions might be too much hassle or rely on stuff you can't trust.

Nadia: They want a practical defense mechanism that doesn't add a ton of overhead while still being effective against these schedule based attacks.

Elias: It really shows how manipulating the timing information through schedule modification can be an effective way to secure CAN communication timing.