Practical security solutions for serial data bus networks

Thesis

For decades, manufacturers incorporated computers into vehicles, weapon systems, and numerous pieces of modern infrastructure, networking them together via serial data bus networks. These networks took direct control away from the operator in the name of efficiency and safety, but we now know this bargain came at the cost of security. By having no authentication in the design, anyone communicating on the network can create harmful effects. The natural solution to this problem is to redesign these networks to support authentication, but abandoning decades of vital infrastructure would be unfathomably expensive. The only option is to continue using our existing equipment, but to develop a way to add security in an efficient and cost effective manner. However, there are an innumerable number of ways to design and implement a serial data bus network. This thesis lays out a methodology for taking a serial data bus network, understanding it, and designing a security patch for it. To illustrate the utility of our methodology, we implement two proof-of-concept intrusion detection systems. The first improves upon existing CAN detection techniques by using a standardized data field to abstract the state of the system. The second takes advantage of the architecture of MIL-STD-1553 to more efficiently detect new messages on the network. Our protocol-specific approach is emphasized by our development of new attacks on the CAN protocol. Finally, this thesis produces an evaluation framework for the prevention and detection systems increasingly being deployed to these vehicle and weapon system networks. Our framework generates a score for defenders, such that they know exactly what attacks and attack vectors their system can detect and prevent. By looking at multiple protocols, from ground vehicles to fighter aircraft, we highlight how a protocol targeted security approach creates more accurate, more efficient, and more practical technology, to detect even the most advanced attackers.

Authors: Rogers, M

• DOI: 10.5287/ora-j55k0nrag
• Type of award: DPhil
• Level of award: Doctoral
• Awarding institution: University of Oxford
• Language: English
• Keywords: MIL-STD-1553; cybersecurity; infrastructure; IDS; vehicle cybersecurity; CAN
• Subjects: Computer security; Cyberinfrastructure