VulCAN Efficient Component Authentication andSoftware Isolation for Automotive Control Networks

Jo Van Bulck Jan Tobias Muumlhlberg and Frank Piessensjovanbulck|jantobiasmuehlbergcskuleuvenbeimec-DistriNet KU Leuven Celestijnenlaan 200A B-3001 Belgium

ACSAC December 2017

empty

Secure Automotive Computing with VulCAN

2 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

Modern cars can be hackedbull Network of more than 50 ECUsbull Multiple communication networksbull Remote entry pointsbull Limited built-in security mechanisms Miller amp Valasek ldquoRemote exploitation of an unaltered passenger vehiclerdquo 2015

VulCAN brings strong security toautomotive computingbull Message authenticationbull Strong software securitybull Trusted Computing software component

isolation and cryptographybull Applicable in ICS IoT

empty

Secure Automotive Computing with VulCAN

VulCAN Generic design to exploit light-weight trusted computing in CAN-basedembedded control networksImplementation based on Sancus [NVBM+17] we implement strengthen andevaluate authentication protocols vatiCAN [NR16] and LeiA [RG16]

3 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Attacking the CAN

Complex bus system with many ECUs and gateways to other communicationsystems no protection against message injection or replay attacksrarr Message Authentication specified in AUTOSAR proposals vatiCAN LeiAno efficient and cost-effective implementations yet

4 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Attacking CAN Message Authentication

What about Software SecurityLack of security mechanisms on light-weight ECUs leverages softwarevulnerabilities attackers may be able to bypass encryption and authenticationrarr Software Component Authentication amp Isolation

5 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestation

bull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetwork

bull Rogue ECUs software attackers and errors in untrusted code cannot interferewith security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Sancus Strong and Light-Weight Embedded Security [NVBM+17]Extends TIrsquos MSP430 withstrong security primitivesbull Software Component

Isolationbull Cryptography amp Attestationbull Secure IO through isolation

of MMIO ranges

Efficientbull Modular le 2 kLUTsbull Authentication in microsbull + 6 power consumption

Cryptographic key hierarchyfor software attestationIsolated components are typically very small (lt 1kLOC)Sancus is Open Source httpsdistrinetcskuleuvenbesoftwaresancus

7 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Secure Automotive Computing with VulCAN

VulCAN Generic design to exploit light-weight trusted computing in CAN-basedembedded control networksImplementation based on Sancus [NVBM+17] we implement strengthen andevaluate authentication protocols vatiCAN [NR16] and LeiA [RG16]

3 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Attacking the CAN

Complex bus system with many ECUs and gateways to other communicationsystems no protection against message injection or replay attacksrarr Message Authentication specified in AUTOSAR proposals vatiCAN LeiAno efficient and cost-effective implementations yet

4 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Attacking CAN Message Authentication

What about Software SecurityLack of security mechanisms on light-weight ECUs leverages softwarevulnerabilities attackers may be able to bypass encryption and authenticationrarr Software Component Authentication amp Isolation

5 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestation

bull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetwork

bull Rogue ECUs software attackers and errors in untrusted code cannot interferewith security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Sancus Strong and Light-Weight Embedded Security [NVBM+17]Extends TIrsquos MSP430 withstrong security primitivesbull Software Component

Isolationbull Cryptography amp Attestationbull Secure IO through isolation

of MMIO ranges

Efficientbull Modular le 2 kLUTsbull Authentication in microsbull + 6 power consumption

Cryptographic key hierarchyfor software attestationIsolated components are typically very small (lt 1kLOC)Sancus is Open Source httpsdistrinetcskuleuvenbesoftwaresancus

7 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Attacking the CAN

Complex bus system with many ECUs and gateways to other communicationsystems no protection against message injection or replay attacksrarr Message Authentication specified in AUTOSAR proposals vatiCAN LeiAno efficient and cost-effective implementations yet

4 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Attacking CAN Message Authentication

What about Software SecurityLack of security mechanisms on light-weight ECUs leverages softwarevulnerabilities attackers may be able to bypass encryption and authenticationrarr Software Component Authentication amp Isolation

5 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestation

bull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetwork

bull Rogue ECUs software attackers and errors in untrusted code cannot interferewith security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Sancus Strong and Light-Weight Embedded Security [NVBM+17]Extends TIrsquos MSP430 withstrong security primitivesbull Software Component

Isolationbull Cryptography amp Attestationbull Secure IO through isolation

of MMIO ranges

Efficientbull Modular le 2 kLUTsbull Authentication in microsbull + 6 power consumption

Cryptographic key hierarchyfor software attestationIsolated components are typically very small (lt 1kLOC)Sancus is Open Source httpsdistrinetcskuleuvenbesoftwaresancus

7 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Attacking CAN Message Authentication

What about Software SecurityLack of security mechanisms on light-weight ECUs leverages softwarevulnerabilities attackers may be able to bypass encryption and authenticationrarr Software Component Authentication amp Isolation

5 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestation

bull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetwork

bull Rogue ECUs software attackers and errors in untrusted code cannot interferewith security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Sancus Strong and Light-Weight Embedded Security [NVBM+17]Extends TIrsquos MSP430 withstrong security primitivesbull Software Component

Isolationbull Cryptography amp Attestationbull Secure IO through isolation

of MMIO ranges

Efficientbull Modular le 2 kLUTsbull Authentication in microsbull + 6 power consumption

Cryptographic key hierarchyfor software attestationIsolated components are typically very small (lt 1kLOC)Sancus is Open Source httpsdistrinetcskuleuvenbesoftwaresancus

7 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestation

bull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetwork

bull Rogue ECUs software attackers and errors in untrusted code cannot interferewith security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Sancus Strong and Light-Weight Embedded Security [NVBM+17]Extends TIrsquos MSP430 withstrong security primitivesbull Software Component

Isolationbull Cryptography amp Attestationbull Secure IO through isolation

of MMIO ranges

Efficientbull Modular le 2 kLUTsbull Authentication in microsbull + 6 power consumption

Cryptographic key hierarchyfor software attestationIsolated components are typically very small (lt 1kLOC)Sancus is Open Source httpsdistrinetcskuleuvenbesoftwaresancus

7 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetwork

bull Rogue ECUs software attackers and errors in untrusted code cannot interferewith security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Sancus Strong and Light-Weight Embedded Security [NVBM+17]Extends TIrsquos MSP430 withstrong security primitivesbull Software Component

Isolationbull Cryptography amp Attestationbull Secure IO through isolation

of MMIO ranges

Efficientbull Modular le 2 kLUTsbull Authentication in microsbull + 6 power consumption

Cryptographic key hierarchyfor software attestationIsolated components are typically very small (lt 1kLOC)Sancus is Open Source httpsdistrinetcskuleuvenbesoftwaresancus

7 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Overview Vulcanising Distributed Automotive Applications

bull Critical application components in enclaves software isolation + attestationbull Authenticated CAN messages over untrusted system softwarenetworkbull Rogue ECUs software attackers and errors in untrusted code cannot interfere

with security but may harm availability

6 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Sancus Strong and Light-Weight Embedded Security [NVBM+17]Extends TIrsquos MSP430 withstrong security primitivesbull Software Component

Isolationbull Cryptography amp Attestationbull Secure IO through isolation

of MMIO ranges

Efficientbull Modular le 2 kLUTsbull Authentication in microsbull + 6 power consumption

Cryptographic key hierarchyfor software attestationIsolated components are typically very small (lt 1kLOC)Sancus is Open Source httpsdistrinetcskuleuvenbesoftwaresancus

7 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Sancus Strong and Light-Weight Embedded Security [NVBM+17]Extends TIrsquos MSP430 withstrong security primitivesbull Software Component

Isolationbull Cryptography amp Attestationbull Secure IO through isolation

of MMIO ranges

Efficientbull Modular le 2 kLUTsbull Authentication in microsbull + 6 power consumption

Cryptographic key hierarchyfor software attestationIsolated components are typically very small (lt 1kLOC)Sancus is Open Source httpsdistrinetcskuleuvenbesoftwaresancus

7 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Sancus Strong and Light-Weight Embedded Security [NVBM+17]Extends TIrsquos MSP430 withstrong security primitivesbull Software Component

Isolationbull Cryptography amp Attestationbull Secure IO through isolation

of MMIO ranges

Efficientbull Modular le 2 kLUTsbull Authentication in microsbull + 6 power consumption

Cryptographic key hierarchyfor software attestationIsolated components are typically very small (lt 1kLOC)Sancus is Open Source httpsdistrinetcskuleuvenbesoftwaresancus

8 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

N = Node SP = Software Provider DeployerSM = protected Software Module

Unprotected

Ent

rypo

int

Code amp constants Unprotected

SM text section

Protected data

SM protected data section

Unprotected

Mem

ory

KNSPSM SM metadata

Layout Keys

ProtectedstorageareaKN

empty

VulCAN Security Objectives

Protocol requirements

1 Message authenticationrArr MAC(id payload)

2 Lightweight cryptographyrArr symmetric keys

3 Replay attack resistancerArr nonces and session keys

4 Backwards compatibilityrArr MAC over separate CAN id

vatiCAN [NR16] and LeiA [RG16]

System requirements (with Sancus PMA)

1 Real-time compliancerArr hardware-level crypto

2 Software isolationrArr application + driver enclaves

3 Software attestationrArr trusted in-vehicle attestation server

4 Dynamic keyECU updaterArr via attestation server

5 Secure legacy ECU integrationrArr CAN gateway shielding

9 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives

Protocol requirements

1 Message authenticationrArr MAC(id payload)

2 Lightweight cryptographyrArr symmetric keys

3 Replay attack resistancerArr nonces and session keys

4 Backwards compatibilityrArr MAC over separate CAN id

vatiCAN [NR16] and LeiA [RG16]

System requirements (with Sancus PMA)

1 Real-time compliancerArr hardware-level crypto

2 Software isolationrArr application + driver enclaves

3 Software attestationrArr trusted in-vehicle attestation server

4 Dynamic keyECU updaterArr via attestation server

5 Secure legacy ECU integrationrArr CAN gateway shielding

9 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Demo ScenariorArr distributed authenticated path from keypad to shielded instrument clusterrArr automotive CAN is challenging ndash VulCAN is applicable to other domains

rarr

10 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain

bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]

bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server Boot + Session Key Provisioning

bull Challenge-response attestation + encrypted session key distributionbull Preserve motorist safety via secure boot + exclusive vehicle ignition

12 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server ECU Replacement

bull Untrusted network connectionrarr public key cryptographybull Store software module keys for offline use

13 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Future Work amp Research ChallengesImplement vehicle attestation server

bull ARM TrustZone vs Intel SGX no remote networkrarr enclave integrity withstatic root-of-trust (secure boot)

bull SPONGENT crypto performs bad in softwarebull Work-in-progress Rust-SGX [DDL+17] memory-safe implementation

Availability and real-time guarantees on compromised ECUs

rarr protected scheduler [VBNMP16] network availability out of scope (or partitionvia gateway)

Formalise authentic execution [NMP17] guarantees

rarr unified framework to interactdeploy enclaves on heterogeneous networkedplatforms

14 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives amp Summary

15 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives

Protocol requirements

1 Message authenticationrArr MAC(id payload)

2 Lightweight cryptographyrArr symmetric keys

3 Replay attack resistancerArr nonces and session keys

4 Backwards compatibilityrArr MAC over separate CAN id

vatiCAN [NR16] and LeiA [RG16]

System requirements (with Sancus PMA)

1 Real-time compliancerArr hardware-level crypto

2 Software isolationrArr application + driver enclaves

3 Software attestationrArr trusted in-vehicle attestation server

4 Dynamic keyECU updaterArr via attestation server

5 Secure legacy ECU integrationrArr CAN gateway shielding

9 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Demo ScenariorArr distributed authenticated path from keypad to shielded instrument clusterrArr automotive CAN is challenging ndash VulCAN is applicable to other domains

rarr

10 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain

bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]

bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server Boot + Session Key Provisioning

bull Challenge-response attestation + encrypted session key distributionbull Preserve motorist safety via secure boot + exclusive vehicle ignition

12 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server ECU Replacement

bull Untrusted network connectionrarr public key cryptographybull Store software module keys for offline use

13 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Future Work amp Research ChallengesImplement vehicle attestation server

bull ARM TrustZone vs Intel SGX no remote networkrarr enclave integrity withstatic root-of-trust (secure boot)

bull SPONGENT crypto performs bad in softwarebull Work-in-progress Rust-SGX [DDL+17] memory-safe implementation

Availability and real-time guarantees on compromised ECUs

rarr protected scheduler [VBNMP16] network availability out of scope (or partitionvia gateway)

Formalise authentic execution [NMP17] guarantees

rarr unified framework to interactdeploy enclaves on heterogeneous networkedplatforms

14 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives amp Summary

15 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Demo ScenariorArr distributed authenticated path from keypad to shielded instrument clusterrArr automotive CAN is challenging ndash VulCAN is applicable to other domains

rarr

10 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain

bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]

bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server Boot + Session Key Provisioning

bull Challenge-response attestation + encrypted session key distributionbull Preserve motorist safety via secure boot + exclusive vehicle ignition

12 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server ECU Replacement

bull Untrusted network connectionrarr public key cryptographybull Store software module keys for offline use

13 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Future Work amp Research ChallengesImplement vehicle attestation server

bull ARM TrustZone vs Intel SGX no remote networkrarr enclave integrity withstatic root-of-trust (secure boot)

bull SPONGENT crypto performs bad in softwarebull Work-in-progress Rust-SGX [DDL+17] memory-safe implementation

Availability and real-time guarantees on compromised ECUs

rarr protected scheduler [VBNMP16] network availability out of scope (or partitionvia gateway)

Formalise authentic execution [NMP17] guarantees

rarr unified framework to interactdeploy enclaves on heterogeneous networkedplatforms

14 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives amp Summary

15 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain

bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]

bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server Boot + Session Key Provisioning

bull Challenge-response attestation + encrypted session key distributionbull Preserve motorist safety via secure boot + exclusive vehicle ignition

12 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server ECU Replacement

bull Untrusted network connectionrarr public key cryptographybull Store software module keys for offline use

13 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Future Work amp Research ChallengesImplement vehicle attestation server

bull ARM TrustZone vs Intel SGX no remote networkrarr enclave integrity withstatic root-of-trust (secure boot)

bull SPONGENT crypto performs bad in softwarebull Work-in-progress Rust-SGX [DDL+17] memory-safe implementation

Availability and real-time guarantees on compromised ECUs

rarr protected scheduler [VBNMP16] network availability out of scope (or partitionvia gateway)

Formalise authentic execution [NMP17] guarantees

rarr unified framework to interactdeploy enclaves on heterogeneous networkedplatforms

14 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives amp Summary

15 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain

bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]

bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server Boot + Session Key Provisioning

bull Challenge-response attestation + encrypted session key distributionbull Preserve motorist safety via secure boot + exclusive vehicle ignition

12 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server ECU Replacement

bull Untrusted network connectionrarr public key cryptographybull Store software module keys for offline use

13 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Future Work amp Research ChallengesImplement vehicle attestation server

bull ARM TrustZone vs Intel SGX no remote networkrarr enclave integrity withstatic root-of-trust (secure boot)

bull SPONGENT crypto performs bad in softwarebull Work-in-progress Rust-SGX [DDL+17] memory-safe implementation

Availability and real-time guarantees on compromised ECUs

rarr protected scheduler [VBNMP16] network availability out of scope (or partitionvia gateway)

Formalise authentic execution [NMP17] guarantees

rarr unified framework to interactdeploy enclaves on heterogeneous networkedplatforms

14 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives amp Summary

15 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]

bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server Boot + Session Key Provisioning

bull Challenge-response attestation + encrypted session key distributionbull Preserve motorist safety via secure boot + exclusive vehicle ignition

12 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server ECU Replacement

bull Untrusted network connectionrarr public key cryptographybull Store software module keys for offline use

13 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Future Work amp Research ChallengesImplement vehicle attestation server

bull ARM TrustZone vs Intel SGX no remote networkrarr enclave integrity withstatic root-of-trust (secure boot)

bull SPONGENT crypto performs bad in softwarebull Work-in-progress Rust-SGX [DDL+17] memory-safe implementation

Availability and real-time guarantees on compromised ECUs

rarr protected scheduler [VBNMP16] network availability out of scope (or partitionvia gateway)

Formalise authentic execution [NMP17] guarantees

rarr unified framework to interactdeploy enclaves on heterogeneous networkedplatforms

14 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives amp Summary

15 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Performance Evaluation Round-Trip Time Experiment

Scenario Cycles Time Overhead

Legacy 20250 101 ms ndashvatiCAN (extrapolated) 121992 610 ms 502Sancus+vatiCAN unprotected 35236 176 ms 74Sancus+vatiCAN protected 36375 182 ms 80Sancus+LEIA unprotected 42929 215 ms 112Sancus+LEIA protected 43624 218 ms 115

Sender Receiverping

ping_auth

pong

pong_auth

computeMACpinд

computeMACponд

computeMACpinд

computeMACponдro

und-trip

time

bull Hardware-level crypto +400 performance gain bull Modest ~5 performance impact for software isolation [VBNMP15 MNP15]bull LeiArsquos extended CAN id usage comes at a cost (SPI-based CAN transceiver)

11 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server Boot + Session Key Provisioning

bull Challenge-response attestation + encrypted session key distributionbull Preserve motorist safety via secure boot + exclusive vehicle ignition

12 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server ECU Replacement

bull Untrusted network connectionrarr public key cryptographybull Store software module keys for offline use

13 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Future Work amp Research ChallengesImplement vehicle attestation server

bull ARM TrustZone vs Intel SGX no remote networkrarr enclave integrity withstatic root-of-trust (secure boot)

bull SPONGENT crypto performs bad in softwarebull Work-in-progress Rust-SGX [DDL+17] memory-safe implementation

Availability and real-time guarantees on compromised ECUs

rarr protected scheduler [VBNMP16] network availability out of scope (or partitionvia gateway)

Formalise authentic execution [NMP17] guarantees

rarr unified framework to interactdeploy enclaves on heterogeneous networkedplatforms

14 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives amp Summary

15 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server Boot + Session Key Provisioning

bull Challenge-response attestation + encrypted session key distributionbull Preserve motorist safety via secure boot + exclusive vehicle ignition

12 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server ECU Replacement

bull Untrusted network connectionrarr public key cryptographybull Store software module keys for offline use

13 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Future Work amp Research ChallengesImplement vehicle attestation server

bull ARM TrustZone vs Intel SGX no remote networkrarr enclave integrity withstatic root-of-trust (secure boot)

bull SPONGENT crypto performs bad in softwarebull Work-in-progress Rust-SGX [DDL+17] memory-safe implementation

Availability and real-time guarantees on compromised ECUs

rarr protected scheduler [VBNMP16] network availability out of scope (or partitionvia gateway)

Formalise authentic execution [NMP17] guarantees

rarr unified framework to interactdeploy enclaves on heterogeneous networkedplatforms

14 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives amp Summary

15 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Attestation Server ECU Replacement

bull Untrusted network connectionrarr public key cryptographybull Store software module keys for offline use

13 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Future Work amp Research ChallengesImplement vehicle attestation server

bull ARM TrustZone vs Intel SGX no remote networkrarr enclave integrity withstatic root-of-trust (secure boot)

bull SPONGENT crypto performs bad in softwarebull Work-in-progress Rust-SGX [DDL+17] memory-safe implementation

Availability and real-time guarantees on compromised ECUs

rarr protected scheduler [VBNMP16] network availability out of scope (or partitionvia gateway)

Formalise authentic execution [NMP17] guarantees

rarr unified framework to interactdeploy enclaves on heterogeneous networkedplatforms

14 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives amp Summary

15 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Future Work amp Research ChallengesImplement vehicle attestation server

bull ARM TrustZone vs Intel SGX no remote networkrarr enclave integrity withstatic root-of-trust (secure boot)

bull SPONGENT crypto performs bad in softwarebull Work-in-progress Rust-SGX [DDL+17] memory-safe implementation

Availability and real-time guarantees on compromised ECUs

rarr protected scheduler [VBNMP16] network availability out of scope (or partitionvia gateway)

Formalise authentic execution [NMP17] guarantees

rarr unified framework to interactdeploy enclaves on heterogeneous networkedplatforms

14 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives amp Summary

15 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

VulCAN Security Objectives amp Summary

15 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Thank you Questionshttpsdistrinetcskuleuvenbesoftwarevulcan

httpsgithubcomsancus-pmavulcan

16 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

References I

AUTOSAR Specification 43Specification of module secure onboard communicationhttpswwwautosarorgstandardsclassic-platformrelease-43software-architecturesafety-and-security2016

Y Ding R Duan L Li Y Cheng Y Zhang T Chen T Wei and H WangPoster Rust sgx sdk Towards memory safety in intel sgx enclave 10 2017

J T Muumlhlberg J Noorman and F PiessensLightweight and flexible trust assessment modules for the Internet of ThingsIn ESORICS rsquo15 vol 9326 of LNCS pp 503ndash520 Springer 2015

C Miller and C ValasekRemote exploitation of an unaltered passenger vehicleBlack Hat USA 2015

J Noorman J T Muumlhlberg and F PiessensAuthentic execution of distributed event-driven applications with a small TCBIn STM rsquo17 vol 10547 of LNCS pp 55ndash71 Heidelberg 2017 Springer

S Nuumlrnberger and C Rossowndash vatiCAN ndash Vetted authenticated CAN busIn Cryptographic Hardware and Embedded Systems ndash CHES rsquo16 18th International Conference Santa Barbara CA USA August 17-192016 Proceedings pp 106ndash124 Berlin Heidelberg 2016 Springer Berlin Heidelberg

17 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

References II

J Noorman J Van Bulck J T Muumlhlberg F Piessens P Maene B Preneel I Verbauwhede J Goumltzfried T Muumlller and F FreilingSancus 20 A low-cost security architecture for IoT devicesACM Transactions on Privacy and Security (TOPS) 2071ndash733 2017

A-I Radu and F D GarciaLeiA A lightweight authentication protocol for CANIn Computer Security ndash ESORICS rsquo16 21st European Symposium on Research in Computer Security Heraklion Greece September 26-302016 Proceedings Part II pp 283ndash300 Cham 2016 Springer International Publishing

J Van Bulck J Noorman J T Muumlhlberg and F PiessensSecure resource sharing for embedded protected module architecturesIn WISTP rsquo15 vol 9311 of LNCS pp 71ndash87 Springer 2015

J Van Bulck J Noorman J T Muumlhlberg and F PiessensTowards availability and real-time guarantees for protected module architecturesIn MASS rsquo16 MODULARITY Companion 2016 pp 146ndash151 New York 2016 ACM

18 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation

empty

Appendix vatiCAN Nonce Generator Birthday Attack

(128 bit key + 32 bit nonce + msg)rarr 64 bit MAC

packet lossrArr reset all nonces to random global value every 50 ms

k-near nonce collision probability

p(n k d) asymp 1minus (d minus nk minus 1)dnminus1(d minus n(k + 1))

with d = 232 (vatiCAN nonce size)

19 19 Van Bulck Muumlhlberg Piessens VulCAN Vehicular Component Authentication and Software Isolation