Another Look at the Connection between CAN Signal Ringing & In-Vehicle ECU Identification

Abstract

We revisit the problem of Electronic Control Unit (ECU) identification from signal characteristics in the physical layer of in-vehicle Controller Area Network (CAN). Ringing is oscillation of a signal in signal processing and prior work has already noticed the ringing force in identifying ECUs via differ-ential CAN signaling. However, they either count on advanced do-main transformations or turn out to be fragile once CAN topology alters (e.g., the length of the stub lines, the number of connected ECUs, etc). The paper further dissects the connection between the ringing intensity and signal characteristics, based on which we can procure robust ECU identification scheme (and IDS, intrusion detection system) independent of CAN topology without any mathematical transformations. We first look into the factors enlarging signal ringing, and then abstract the characterization of ringing intensity where rising edges (from recessive to dominant states) and falling edges (from dominant to recessive states) make distinct contributions to ECU identification. The rising edges (along with dominant states) suffice to fingerprint the ECUs, whereas the falling edges pitch in shaky performance (correlated strongly to CAN topology). The unique contribution of the former can thereby be isolated to construct robust mechanisms for ECU identification and IDS. Robustness and accuracy of the resulting approach are validated on not only prototype implementations (with diverse portfolio in 3/6/9/13 ECUs and 1/2/3-meter stub lines) but real vehicles. Concrete comparisons among prior work and ours are also conducted and substantiate our argumentation and mechanisms.