Configurable cryptographic controller area network (can) device

Patent metadata

Field	Value
Publication number	US-2016344552-A1
Application number	US-201514954638-A
Country	US
Kind code	A1
Filing date	Nov 30, 2015
Priority date	May 22, 2015
Publication date	Nov 24, 2016
Grant date	—

Abstract

Embodiments of a device and method are disclosed. In an embodiment, a CAN device includes a security module connected between a CAN bus interface of a CAN transceiver and a microcontroller communications interface of the CAN transceiver and an operational mode controller connected between the security module and the CAN bus interface. The security module is configured to perform a security function on data traffic received from the CAN bus interface or from the microcontroller communications interface. The operational mode controller is configured to set an operational mode for the CAN transceiver such that a CAN Flexible Data-rate (FD) frame or a corresponding CAN frame is output from the CAN bus interface. An identifier of the CAN FD frame is the same as an identifier of the corresponding CAN frame.

First claim

What is claimed is:

1 . A Controller Area Network (CAN) device comprising:
a security module connected between a CAN bus interface of a CAN transceiver and a microcontroller communications interface of the CAN transceiver, wherein the security module is configured to perform a security function on data traffic received from the CAN bus interface or from the microcontroller communications interface; and an operational mode controller connected between the security module and the CAN bus interface, wherein the operational mode controller is configured to set an operational mode for the CAN transceiver such that a CAN Flexible Data-rate (FD) frame or a corresponding CAN frame is output from the CAN bus interface, and wherein an identifier of the CAN FD frame is the same as an identifier of the corresponding CAN frame.

2 . The CAN device of claim 1 , wherein the security module is a programmable cryptographic module configured to execute security software programs to process a data payload that is carried by a plurality of data signals received through the microcontroller communications interface or through the CAN bus interface.

3 . The CAN device of claim 2 , wherein the programmable cryptographic module is configured to generate a Cipher-based Message Authentication Code (CMAC) digest and a counter value based on the data payload.

4 . The CAN device of claim 3 , further comprising a CAN FD protocol controller connected to the microcontroller communications interface and to the operational mode controller, wherein the CAN FD protocol controller is configured to combine the payload with the CMAC digest and the counter value to generate the CAN FD frame.

5 . The CAN device of claim 4 , wherein the CAN FD protocol controller is further configured to generate the CAN frame.

6 . The CAN device of claim 2 , wherein the programmable cryptographic module comprises:
a security core configured to execute security software routines; and a memory device configured to store security configuration information for the security software routines.

7 . The CAN device of claim 5 , further comprising a CAN protocol decoder configured to extract the data payload from the data signals received through the microcontroller communications interface, and wherein the security core is further configured to process the data payload to generate a Cipher-based Message Authentication Code (CMAC) digest and a counter value.

8 . The CAN device of claim 7 , further comprising a CAN FD protocol controller connected to the microcontroller communications interface and to the operational mode controller, wherein the CAN FD protocol controller is configured to combine the payload with the CMAC digest and the counter value to generate the CAN FD frame.

9 . The CAN device of claim 8 , wherein the CAN FD protocol controller is further configured to generate the CAN frame that has the same packet identification number as the CAN FD frame.

10 . The CAN device of claim 1 , wherein the operational mode controller comprises an AND gate and first and second multiplexers, and wherein selection signals to the first and second multiplexers comprise an output signal of the AND gate and a control signal from a control terminal of the operational mode controller.

11 . The CAN device of claim 10 , wherein input signals to the AND gate comprise the control signal and an acknowledgement signal, wherein input signals to the first multiplexer comprise the CAN FD frame and the CAN frame, and wherein input signals to the second multiplexer comprise the CAN FD frame and an output signal from the first multiplexer.

12 . The CAN device of claim 1 , wherein the CAN microcontroller communications interface comprises a receive data (RXD) interface, a transmit data (TXD) interface and a Serial Peripheral Interface (SPI)/Inter-Integrated Circuit(I2C)/Direct Memory Access (DMA) interface.

13 . A CAN transceiver comprising the CAN device of claim 1 , the CAN bus interface, the microcontroller communications interface, a transmitter, and a receiver.

14 . An electronic control unit comprising the CAN transceiver of claim 13 and a microcontroller, wherein the microcontroller communications interface of the CAN transceiver is used for communications with the microcontroller.

15 . A Controller Area Network (CAN) transceiver comprising:
a CAN bus interface having a CAN high (CANH) bus interface and a CAN low (CANL) bus interface; a CAN microcontroller communications interface having a receive data (RXD) interface, a transmit data (TXD) interface and a Serial Peripheral Interface (SPI)/Inter-Integrated Circuit(I2C)/Direct Memory Access (DMA) interface; a programmable cryptographic module connected between the CAN bus interface and the CAN microcontroller communications interface, wherein the programmable cryptographic module is configured to perform a security function on data traffic received from the CAN bus interface or from the CAN microcontroller communications interface; and an operational mode controller connected between the programmable cryptographic module and the CAN bus interface, wherein the operational mode controller is configured to set an operational mode for the CAN transceiver such that a CAN Flexible Data-rate (FD) frame or a corresponding CAN frame is output from the CAN bus interface, and wherein an identifier of the CAN FD frame is the same as an identifier of the corresponding CAN frame.

16 . The CAN transceiver of claim 15 , wherein the programmable cryptographic module comprises:
a security core comprising at least one of a hardware-based Advanced Encryption Standard (AES) engine, a hardware-based Secure Hash Algorithm (SHA) engine, a hardware-based counter and a hardware-based true random number generator; and a memory device configured to store security configuration information for the security core.

17 . The CAN transceiver of claim 16 , further comprising a CAN protocol decoder configured to extract the data payload from the data signals received through the CAN microcontroller communications interface, and wherein the security core is further configured to process the data payload to generate a Cipher-based Message Authentication Code (CMAC) digest and a counter value.

18 . The CAN transceiver of claim 17 , further comprising a CAN FD protocol controller connected to the CAN microcontroller communications interface and to the operational mode controller, wherein the CAN FD protocol controller is configured to:
combine the payload with the CMAC digest and the counter value to generate the CAN FD frame; and generate the CAN frame that has the same packet identification number as the CAN FD frame.

19 . The CAN transceiver of claim 15 , wherein the operational mode controller comprises an AND gate and first and second multiplexers, wherein selection signals to the first and second multiplexers comprise an output signal of the AND gate and a control signal from a control terminal of the operational mode controller, wherein input signals to the AND gate comprise the control signal and an acknowledgement signal, wherein input signals to the first multiplexer comprise the CAN FD frame and the CAN frame, and wherein input signals to the second multiplexer comprise the CAN FD frame and an output signal from the first multiplexer.

20 . A method for operating a Controller Area Network (CAN) device, the method comprising:
performing a security function on data traffic received from a CAN bus interface of a CAN transceiver or from a micr

Assignees

• Nxp Bv

Inventors

• Sharma Vibhu

Classifications

• H04L9/3242 Primary

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L12/40032 Primary

  Details regarding a bus interface enhancer · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title