Search Results

Since 2001, all sensitive information of U.S. Federal Agencies has been protected by strong encryption mandated by the Federal Information Processing Standards (FIPS) 140-2 Security Requirements. The requirements specify a formal certification process. The process ensures that validated encryption modules have implemented the standard, and have passed a rigorous testing and review processes. Today, this same strong security protection has become possible for vehicle networks using modern, cost-effective encryption in hardware. This paper introduces the motivation and context for the encryption diagnostics security in terms of all vehicles in general, not just trucks which use SAE J1939 communications. Several practical scenarios for using such encryption hardware and the advantages of using hardware compared to software private-key encryption and public-key encryption are described.

This paper will provide an Overview of Automotive Cyber Security Standards related to the Vehicle OBD-II Data Link. The OBD-II Connector Attack Tree is described with respect to the SAE J3138 requirements for Intrusive vs. non-Intrusive Services. A proposed test method for SAE J3138 is described including hardware and software scripting. Finally, example test results are reviewed and compared with a potential threat boundary.

CAN bus network proved to be efficient and dynamic for small compact cars as well as heavy-duty vehicles (HDV). However, HDVs are more susceptible to malicious attacks due to lack of security in their intra-vehicle communication protocols. SAE proposed a new standard named J1939-91C for CAN-FD networks which provides methods for establishing trust and securing mutual messages with optional encryption. J1939-91C ensures message authenticity, integrity, and confidentiality by implementing complex cryptographic operations including hash functions and random key generation. In this paper, the three main phases of J1939-91C, i.e., Network Formation, Rekeying, and Message Exchange, are simulated and tested on Electronic Control Units (ECUs) supporting CAN-FD network. Numerous test vectors were generated and validated to support SAE J1939-91C. The mentioned vectors were produced by simulating different encryption and hashing algorithms with variable message and key lengths.

The University of Detroit Mercy Vehicle Cyber Engineering (VCE) Laboratory together with The University of Arizona is supporting Secure Vehicle Embedded Systems research work and course projects. The University of Detroit Mercy VCE Laboratory has established several testbeds to cover experimental techniques to ensure the security of an embedded design that includes: data isolation, memory protection, virtual memory, secure scheduling, access control and capabilities, hypervisors and system virtualization, input/output virtualization, embedded cryptography implementation, authentication and access control, hacking techniques, malware, trusted computing, intrusion detection systems, cryptography, programming security and secure software/firmware updates.

Connectivity is becoming increasingly prevalent in the automotive industry, and with that comes a growing awareness among consumers and regulators of the potential risks. Present-day automobiles are becoming smart and more software-driven. Conversely, every line of code equals a possible threat to the vehicle, the passenger, or the original equipment manufacturer (OEM). To hit the brakes on the alarming increase in cyber threats, government bodies have introduced standards and regulations globally. The United Nations Economic Commission for Europe (UNECE) WP.29 R155 & R156 regulations and International Organization for Standardization/Society of Automotive Engineers (ISO/SAE) 21434 standards are becoming mandatory for all OEMs and are designed to ensure that vehicle functionalities work as intended and are built to mitigate safety risks.