A Novel Authentication and Key Agreement Scheme for In-Vehicle Networks

Controller area network (CAN) bus is the most widely used protocol for in-vehicle networks, but it lacks security mechanism in design and is susceptible to various attacks. In addition, the on-board diagnostic port (OBD-II) is the physical access point of the CAN bus. However, adversaries can inject messages into the CAN bus through this port, thereby maliciously controlling the vehicle. Aiming at the above problems, this paper proposes a novel authentication and key agreement scheme for in-vehicle networks. Specifically, the proposed scheme considers the issue of secure communication on the CAN bus and the device access issue of the OBD-II port. Static random access memory physical unclonable function (SRAM PUF) is used to perform electronic control unit (ECU) authentication, group key distribution and data frame authentication, ensuring the authenticity of the ECU and the confidentiality and integrity of the data frame. It can also resist replay, physical and other attacks. Besides, we design the authentication and key agreement protocols of external devices in two scenarios respectively to prevent external devices from injecting malicious messages into the CAN bus through the OBD-II port. Finally, we use Scyther and Go language to verify the proposed scheme. The verification results demonstrate that the proposed scheme is not only able to achieve various security goals, but also proves the correctness of its logic. Compared with existing group-based schemes, this scheme has moderate computational and communication overhead overall, but has obvious advantages in key update and authentication of external devices, which can fulfill the low-latency and resource-constrained requirements of in-vehicle networks.