Method of authenticating can packets using mixture of MACs and apparatus for implementing the same

Patent metadata

Field	Value
Publication number	US-9787677-B2
Application number	US-201514632467-A
Country	US
Kind code	B2
Filing date	Feb 26, 2015
Priority date	Oct 2, 2014
Publication date	Oct 10, 2017
Grant date	Oct 10, 2017

Abstract

A method and apparatus for authenticating packets in a controller area network (CAN) are disclosed. The method includes transmitting messages using a mixture of message authentication codes (MACs) in a controller area network (CAN). In addition, a first MAC is generated using a first message and the first MAC is divided into a first MAC part and a second MAC part. A second MAC is generated using a second message and the second MAC is divided into a third MAC part and a fourth MAC part. A linear operation is performed between the second MAC part and the third MAC part to generate a first authentication MAC. The first message is transmitted with the first MAC part and the second message is transmitted with the first authentication MAC.

First claim

What is claimed is:

1. A method of transmitting messages using a mixture of message authentication codes (MACs) for authentication of messages in a vehicle controller area network (CAN) including a plurality of CAN controllers equipped in a vehicle, the method comprising:
generating, by a sending controller among the plurality of CAN controllers, a first MAC using a first message;
dividing, by the sending controller, the first MAC into a first MAC part and a second MAC part;
generating, by the sending controller, a second MAC using a second message;
dividing, by the sending controller, the second MAC into a third MAC part and a fourth MAC part;
performing, by the sending controller, a linear operation between the second MAC part and the third MAC part to generate a first authentication MAC;
transmitting, by the sending controller, the first message along with the first MAC part, but not the second MAC part, to a receiving controller among the plurality of CAN controllers;
transmitting, by the sending controller, the second message along with the first authentication MAC to the receiving controller;
authenticating, by the receiving controller, the first and second messages based on the first MAC part and the first authentication MAC; and
performing, by the receiving controller, an operation in the vehicle according to the first and second messages in response to authenticating the first and second messages.

2. The method according to claim 1 , wherein the dividing of the first MAC includes dividing, by the controller, the first MAC into the MAC parts having about the same size and the dividing of the second MAC includes dividing, by the controller, the second MAC into the MAC parts having about the same size.

3. The method according to claim 2 , wherein the first MAC part corresponds to a first half of the first MAC, and the second MAC part corresponds to a second half of the first MAC.

4. The method according to claim 2 , wherein the third MAC part corresponds to a first half of the second MAC, and the fourth MAC part corresponds to a second half of the second MAC.

5. The method according to claim 1 , wherein the linear operation is an exclusive OR (XOR) operation.

6. A method of receiving messages using a mixture of message authentication codes (MACs) for authentication of messages in a vehicle controller area network (CAN) including a plurality of CAN controllers equipped in a vehicle, the method comprising:
receiving, by a receiving controller among the plurality of CAN controllers, a first frame including a first message and a first authentication MAC from a sending controller among the plurality of CAN controllers;
calculating, by the receiving controller, a first MAC using the first message;
dividing, by the controller, the first MAC into a first MAC part and a second MAC part;
comparing, by the receiving controller, the first authentication MAC with the first MAC part to partially authenticate the first message;
receiving, by the receiving controller, a second frame including a second message and a second authentication MAC from the sending controller;
calculating, by the receiving controller, a second MAC using the second message;
dividing, by the receiving controller, the second MAC into a third MAC part and a fourth MAC part;
performing, by the receiving controller, a linear operation between the second MAC part and the second authentication MAC to calculate the third MAC part;
comparing, by the receiving controller, the divided third MAC part and the calculated third MAC part to partially authenticate the second message; and
performing, by the receiving controller, an operation in the vehicle according to the first and second messages in response to authenticating the first and second messages.

7. The method according to claim 6 , further comprising:
performing, by the controller, a linear operation between the second authentication MAC and the divided third MAC part to calculate the second MAC part; and
comparing, by the controller, the calculated second MAC part and the divided second MAC part to authenticate the first message.

8. The method according to claim 7 , wherein the first MAC part corresponds to a first half of the first MAC, and the second MAC part corresponds to a second half of the first MAC.

9. The method according to claim 7 , wherein the third MAC part corresponds to a first half of the second MAC, and the fourth MAC part corresponds to a second half of the second MAC.

10. The method according to claim 6 , further comprising:
determining, by the controller, that the first message is authenticated when the divided third MAC part and the calculated third MAC part are identical.

11. The method according to claim 6 , wherein the dividing of the first MAC includes dividing, by the controller, the first MAC into the MAC parts having the same size and the dividing of the second MAC includes dividing, by the controller, the second MAC into the MAC parts having the same size.

12. The method according to claim 6 , wherein the linear operation is an exclusive OR (XOR) operation.

13. The method according to claim 6 , further comprising:
comparing, by the controller, results of partially authenticating the first and second messages with a predetermined determination rule to determine a frame in which an error occurs.

14. A controller for transmitting messages using a mixture of message authentication codes (MACs) for authentication of messages in a vehicle controller area network (CAN) including a plurality of CAN controllers equipped in a vehicle, the controller comprising:
a memory configured to store program instructions; and
a processor configured to execute the program instructions, which when executed cause the processor to:
generate a first message and a second message;
generate a first MAC using the first message;
divide the first MAC into a first MAC part and a second MAC part;
generate a second MAC using the second message;
divide the second MAC into a third MAC part and a fourth MAC part;
perform a linear operation between the second MAC part and the third MAC part to generate a first authentication MAC;
transmit the first message together with the first MAC part, but not the second MAC part, to a receiving controller among the plurality of CAN controllers; and
transmit the second message along with the first authentication MAC to the receiving controller,

wherein the receiving controller authenticates the first and second messages based on the first MAC part and the first authentication MAC and performs an operation in the vehicle according to the first and second messages in response to authenticating the first and second messages.

15. The controller according to claim 14 , wherein the program instructions when executed further cause the processor to divide the first MAC into the MAC parts having about the same size and divides the second MAC into the MAC parts having about the same size.

16. The controller according to claim 15 , wherein the first MAC part corresponds to a first half of the first MAC, and the second MAC part corresponds to a second half of the first MAC.

17. The controller according to claim 15 , wherein the third MAC part corresponds to a first half of the second MAC, and the fourth MAC part corresponds to a second half of the second MAC.

18. The controller according to claim 14 , wherein the linear operation is an exclusive OR (XOR) operation.

19. A controller for receiving messages using a mixture of message authentication codes (MACs) for auth

Assignees

• Hyundai Motor Co Ltd
• Kia Motors Corp
• Industry-Academic Coop Found Chosun Univ
• Snu R&Db Foundation

Inventors

• Jung Ho Jin
• Lee Chung Hi
• Yoo Ho
• Lee Byoung Wook
• Ahn Hyun Soo
• Kim Ho Youn
• Moon Young Sik
• Woo Jun Young
• Kim Young Sik
• Lee Kang Seok
• No Jong Seon

Classifications

• H04L9/32 Primary

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/162

  at the data link layer · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04W80/02

  Data link layer protocols · CPC title