Abstract: Provided herein are systems and methods for authenticating controlled area network (CAN) transmissions using physical layer characteristics. In one or more examples, a device that is configured to authenticate CAN transmissions can be connected to an existing CAN. The device can be configured to undergo a training phase in which average transition waveforms of one or more electronic control units (ECUs) are created. When the device is in operation, each CAN transmission received by the device can be compared against the average transition waveforms to determine the ECU that is most likely to have sent the transmission. In one or more examples, the identified most likely ECU can be compared against the ECU identified by an arbitration ID of the transmission. If there is a mismatch then in one or more examples the device can alert to the possibility of a suspicious ECU transmission.

Abstract: Provided herein are systems and methods for authenticating controlled area network (CAN) transmissions using physical layer characteristics. In one or more examples, a device that is configured to authenticate CAN transmissions can be connected to an existing CAN. The device can be configured to undergo a training phase in which average transition waveforms of one or more electronic control units (ECUs) are created. When the device is in operation, each CAN transmission received by the device can be compared against the average transition waveforms to determine the ECU that is most likely to have sent the transmission. In one or more examples, the identified most likely ECU can be compared against the ECU identified by an arbitration ID of the transmission. If there is a mismatch then in one or more examples the device can alert to the possibility of a suspicious ECU transmission.

Abstract: The present disclosure relates to suppressing malicious transmissions by overriding frames on a Controller Area Network (CAN) bus. In an embodiment, a method operates by determining when a frame arrives at a CAN bus. A determination of whether to override the frame is made based on an arbitration ID of the frame received from the CAN bus. In response to determining to override the frame, a predetermined sequence of bits is transmitted on the CAN bus during transmission of a data length code (DLC) field in the frame. A message to complete the frame is generated based on the predetermined sequence of bits. Then, the message is transmitted on the CAN bus.

Abstract: The present disclosure relates to suppressing malicious transmissions by overriding frames on a Controller Area Network (CAN) bus. In an embodiment, a method operates by determining when a frame arrives at a CAN bus. A determination of whether to override the frame is made based on an arbitration ID of the frame received from the CAN bus. In response to determining to override the frame, a predetermined sequence of bits is transmitted on the CAN bus during transmission of a data length code (DLC) field in the frame. A message to complete the frame is generated based on the predetermined sequence of bits. Then, the message is transmitted on the CAN bus.