Trillium Certainly Can Encrypt CAN Bus

MADISON, Wis. — Until the recent wave of carmakers rolling out more and more connected cars for the consumer market, cyber security was always a matter of indifference to car OEMs and Tier Ones. Now, it’s a big deal.

Fresh in everyone’s memory are several celebrated hacking incidents this past summer. These include the vulnerabilities found in Chrysler Jeeps, which resulted in Chrysler’s recall of 1.4 million vehicles, and a flaw in General Motors’ OnStar RemoteLink system, through which a hacker found a way to remotely unlock doors and start engines.

As Egil Juliussen, director research & principal analyst at IHS Automotive, pointed out in a recent presentation to the automotive industry, “Hacking research has shown that nearly all access points can be compromised.” To cope with this reality, technology suppliers are beginning to launch a number of cyber security solutions, he said. They range from hardware security to CAN (Controller Area Network) bus firewalls and ECU software monitoring.

(Source: IHS Automotive)

But what the world hasn’t seen yet – and Juliussen hasn’t seen either – is a technology capable of encrypting CAN bus itself.

That’s about to change, according to Trillium, a Japan-based start-up headed by David Uze, former CEO of Freescale Japan. Uze told EE Times this week that a small team of Trillium engineers has developed what it calls SecureCAN -- “a CAN bus encryption and key management system for protecting payloads less than 8bytes.” 

Essential to this assertion is a claimed ability to handle data “in 8bytes,” instead of the 128-bit block the Rijndael algorithm needs for AES-based encryptions.

Because of its ultra-light weight block cipher, Trillium’s SecureCAN can encrypt CAN (and LIN) messages in real time, claimed Uze. More specifically, Trillium’s symmetric block cipher and key management system allows SecureCAN to “encrypt, transmit and decrypt within the 1ms threshold,” he said, which is required for automotive CAN bus real-time applications.

Trillium with a dozen employees is a self-funded company that’s been in existence a little over a year. The company has received investment of an undisclosed sum from semi-government Japanese organization called NEDO (New Energy and Industrial Technology Development), according to Uze. The firm’s engineering team includes a security expert who previously worked for Motorola.

Trillium’s SecureCAN “isn’t a vaporware,” stressed Uze. “We will be demonstrating it in Intrepid Control Systems’ booth” at the IEEE Standards Association (IEEE-SA) Ethernet & IP @ Automotive Technology Day (Oct. 27-28) next week in Yokohama.

CAN Bus Encryption(Source: Trillium)Click here for larger image

No panaceaTrillium does not claim that protecting CAN bus is a panacea for automotive cyber security.

“Absolutely, you must have a gateway firewall,” said Uze. But, as with any security, no system can afford to have a single point of failure. “You need multiple layers of security measures,” he explained. 

But Uze noted, “CAN is a native unencrypted bus.” CAN bus doesn’t implement any security features. Further, with CAN bus, it’s possible to access every function of the car, including control locks, steering and brakes. All that accessibility makes CAN bus a perfect playground for hackers.

Gene Carter, director of product management/marketing at Security Innovation, told EE Times, “CAN bus was invented as a very robust bus that works in an noisy environment more than 20 years ago, when nobody in the automotive industry envisioned cars getting hacked.”

As far as he is aware, “CAN is an old technology with limited data streams. It isn't possible to use encryption of any meaningful size.” Noting that he hasn’t seen Trillium’s solutions, Carter said, “If this company has a way of handling encryption and key management on an existing CAN bus, that is a pretty significant development.”

What Trillium deliversAside from its ultra-light weight and variable block and key sizes, the Trillium cipher’s claim to fame is that it leverages three different algorithms, according to Uze. They include “substitution, transposition and time multiple” algorithms.

(Source: Trillium)

Perhaps the biggest innovation is a key management system called “Dynamic Key-Lock Pairing,” said Uze. Every time a car’s ignition is turned on, it generates a new shared master key, which lasts as long as the car’s ignition is on. However, Trillium can change cipher text at random intervals – “even multiple times per second” – by using its frequency channel-hopping feature. As it keeps changing its encoded data, it increases the chances of defeating the different strategies deployed by hackers, he explained.   

TrilliumCipher Encryption Visualized(Source: Trillium)

The fact that the firm’s solution is software-based is another advantage, Uze said. “When broken, we can update the firmware – including the kernel, and flash it wirelessly.”

Asked about encrypting CAN bus, Timo van Roermund, security architect, NXP Semiconductor’s business unit Automotive, told EE Times, “Key management is definitely an important aspect [of it], when crypto is used to protect messages that are exchanged between ECUs.” However, he cautioned, “Different OEMs may take different approaches to ‘setup’ and manage their in-vehicle networks.” After all, “There is no (de-facto) standard approach for key management, yet.”

Carter also has a few questions for Trillium. “Of course, they might have thought about these things already… but I think the system still needs an asymmetric solution for key exchange, in addition to its symmetric block cipher. For security, authentication is essential.” 

There also has to be careful control of security privileges, to prevent applications that impersonate diagnostics, for example, Carter pointed out. “Yes, flashing updates is great, but that means hackers can also exploit the same flashing feature,” he added.

The bottom line is that “defense in depth is always better than one magic bullet,” he said.

Replacing CAN Bus?The automotive industry isn’t oblivious to the potential vulnerability of CAN bus.

Some OEMs are said to be looking into replacing CAN bus with CAN FD (flexible data-rate), originally developed by Bosch.

NXP’s van Roermund told EE Times that one of the main security concerns for in-vehicle networks is “message integrity and authenticity.” You don’t want an attacker to inject or modify messages, and to protect against such attacks, you need to apply message authentication.

But “adding this authentication data is typically challenging in existing vehicle network architectures, where there is usually limited spare bandwidth available,” said van Roermund. “CAN FD may offer a solution here because it increases the available bandwidth.”

Meanwhile, IHS Automotive’s Juliussen, who said he hasn’t looked at CAN FD carefully, noted, “it may be too little too late.”

Trillium’s Uze, while acknowledging CAN FD’s ability to handle larger messages, observed that car OEMs “are hesitating” to replace CAN with CAN FD. Noting some models of the Mercedes S class, for example, have 120 to 130 CAN transceivers inside a vehicle, Uze said that an upgrade to CAN FD – whose cost differential is $1 – would cost Tier Ones at least $120 or more. In contrast, Trillium’s proposition is to “put our kernel” in each transceiver at 10 cents, so that the cost to Tier Ones would be just $12, Uze explained.

Over the long run, however, carmakers are looking to install Ethernet, partly to answer some security issues. “That is one reason Ethernet is likely to get market share in the future,” said Juliussen.

Different ways to protect vehiclesIn protecting connected cars from hackers, NXP’s security architect, van Roermund, pointed out several different countermeasures Tier Ones or OEMs may consider.   

He explained that they include a mix of the following:

Isolating in-vehicle electronics from external interfaces, with firewallsApplying strict access control to only allow known/trusted entities (partial) access to in-vehicle systemsFurther adapting in-vehicle networks, in which systems with similar criticality are clustered in separate networks, to better isolate safety-critical systems from othersProtecting messages exchanged over in-vehicle networks using cryptography (authentication, and maybe also encryption)Using intrusion detection/prevention systems (IPS/IDS) to detect and possibly counter attacksProtecting the ECUs (microcontrollers and their software) themselves through secure boot, secure update, and other measuresBut as far as CAN bus protection is concerned, Juliussen noted, “Argus, which looks at CAN-bus messages is an alternative [way to protect CAN bus], and Argus is getting a lot of attention and investment money.” Argus, an Israel-based cyber-security company focused on automotive, has raised $26 million in a series B funding round. Argus is said to provide carmakers a unique Intrusion Prevention System (IPS) which prevents a vehicle’s critical components from being hacked in real time.

How broadly can SecureCAN be applied?Uze said, “Our software exists at an application layer. It’s chipset and operating system are agnostic.”

Trillium originally used Freescale’s MCU for SecureCAN. It runs on both MQX RTOS developed by Synopsys, and ARM’s mbed RTOS. “We also recently ported SecureCAN to STMicroelectronics MCU, to its bare metal,” said Uze. “The porting took only two or three days. It was very easy.”

Trillium filed a U.S. patent application in September for the company’s IP.

Uze said, “Immediately thereafter, we had a chance to present the technology in Detroit to GM, Ford, Fiat Chrysler, Continental, and others.” He added, “As you can imagine, there was great interest in our SecureCAN.”

How fast the auto industry might embrace SecureCAN is anybody’s guesses. As Carter pointed out, “The crypto community, in general, is very conservative.” Likewise, automotive industry is equally conservative. Carter observed that with something as new as SecureCAN, the crypto and auto industries most likely “want to test it and poke at it” for a long time.