[论文解读] Security in Automotive Networks: Lightweight Authentication and Authorization

Philipp Mundhenk, Andrew Paverd+5 more|mediaTUM – the media and publications repository of the Technical University Munich (Technical University Munich)|Mar 10, 2017

Vehicular Ad Hoc Networks (VANETs)参考文献 30被引用 59

一句话总结

本文提出 LASAN，一种轻量级、形式化可验证的车载网络认证与授权框架，能够在满足实时约束和生命周期集成的前提下工作。

ABSTRACT

With the increasing amount of interconnections between vehicles, the attack surface of internal vehicle networks is rising steeply. Although these networks are shielded against external attacks, they often do not have any internal security to protect against malicious components or adversaries who breach the network perimeter. To secure the in-vehicle network, all communicating components must be authenticated, and only authorized components should be allowed to send and receive messages. This is achieved using an authentication framework. Cryptography is widely used to authenticate communicating parties and provide secure communication channels (e.g., Internet communication). However, the real-time performance requirements of in-vehicle networks restrict the types of cryptographic algorithms and protocols that may be used. In particular, asymmetric cryptography is computationally infeasible during vehicle operation. In this work, we address the challenges of designing authentication protocols for automotive systems. We present Lightweight Authentication for Secure Automotive Networks (LASAN), a full lifecycle authentication approach. We describe the core LASAN protocols and show how they protect the internal vehicle network while complying with the real-time constraints and low computational resources of this domain. Unlike previous work, we also explain how this framework can be integrated into all aspects of the automotive lifecycle, including manufacturing, vehicle maintenance, and software updates. We evaluate LASAN in two different ways: First, we analyze the security properties of the protocols using established protocol verification techniques based on formal methods. Second, we evaluate the timing requirements of LASAN and compare these to other frameworks using a new highly modular discrete event simulator for in-vehicle networks, which we have developed for this evaluation.

研究动机与目标

• 通过保护车载通信来应对互联车辆中日益增长的内部攻击面。
• 开发一种轻量级、实时的认证与授权协议，适用于资源受限的ECU。
• 将安全协议集成到汽车产品生命周期中，包括制造和更新。
• 提供形式化安全验证和性能评估，以证明相较现有方案的实用性。

提出的方法

• 介绍 LASAN 的概念和两阶段安全设计，以将对称（快速）操作与非对称（慢速）操作分离。
• 通过基于 PKINIT 的密钥交换定义 ECU 身份验证，安全模块充当受信任的权威。
• 详细说明流授权和流密钥的集中管理，以实现组播/广播安全。
• 提出在汽车生命周期内用于制造、维护和软件更新的集成流程。
• 使用 Scyther 协议分析工具对 LASAN 进行形式化验证。
• 使用模块化离散事件模拟器评估时序和带宽，并与 TLS 和 TESLA 进行比较。

实验结果

研究问题

• RQ1 在满足实时约束和有限的 ECU 资源条件下，如何在车载网络中实现认证与授权？
• RQ2 集中式安全模块是否能够在不进行逐对握手的情况下实现可扩展的组播安全通信？
• RQ3 LASAN 的形式化安全保证如何，其在车载网络中的性能与 TLS 和 TESLA 相比如何？
• RQ4 LASAN 如何在汽车产品生命周期中集成，包括制造与更新？
• RQ5 在现实车载条件下，LASAN 的时延和带宽影响是什么？

主要发现

• 使用 Scyther 形式化验证工具可对 LASAN 的认证与授权协议进行安全性验证。
• 通过新的模块化离散事件模拟器对 LASAN 的实时性能进行评估，并与 TLS 和 TESLA 进行比较。
• 通过利用固定的汽车网络结构和组播消息，框架尽量降低带宽和计算成本。
• LASAN 将安全流程贯穿汽车生命周期，包括 ECUs 的安全交换和软件更新。
• 该设计将快速对称操作与较慢的非对称操作分离，以保持实时通信约束。