IEEE Consumer Electronics Magazine - November/December 2019 - 102

Special Section on Emerging Paradigms in Vehicular Cybersecurity

Use of PUFs in Communication
Approaches have been proposed in the literature for integrating PUFs with vehicular communication systems. One such approach uses an
optical PUF as part of a nonforwardable authentication scheme for vehicle-to-vehicle communication.9 Another approach is to incorporate a PUF
into individual ECUs.10 The use of PUF allows for
the creation of an authentication method for connected ECUs. A built-in authentication method
makes it much harder for an attacker to insert a
malicious ECU into one of the communication
networks on the vehicle. This would help to eliminate the threat of an attacker attaching a malicious ECU to the network that could then be used
to send erroneous messages within the network.
PUF in Vehicle to Vehicle Communication
Researchers have proposed a way to use PUFs
as part of a larger communication system that is
capable of avoiding adversary coalition attacks.9 In
a coalition attack, two or more adversaries impersonate the sender and receiver by intercepting
messages and then forwarding them to their
intended recipients. In the presented scenario, a
given vehicle is communicating with other nearby
vehicles. The recipients of these communications
are authenticated using sensors to optically bind
each communication with the correct vehicle. Visually binding to other vehicles allows the vehicle to
know the relative location of each vehicle with
which it is communicating. This knowledge can be
leveraged to aid in the vehicle responding to warning messages from said vehicles. By forwarding
messages, adversaries can trick targeted vehicles
into visually binding to the adversary intercepting
and forwarding messages instead of the actual
intended recipient of the messages. Even if the
adversaries in a coalition attack simply forward the
intercepted messages without any sort of tampering, the attacked vehicle can still misidentify an
adversary as the vehicle with which it is communicating. This could prove dangerous when attacked
vehicles attempt to respond to warnings about
emergency maneuvers such as emergency braking.
The researchers propose to create a message
authentication method that is nonforwardable
and, therefore, not susceptible to coalition
attacks. Vehicles are assigned certificates from a
trusted CA, which contain physical characteristic

102

to aid in identifying the vehicle and CRPs. A vehicle wishing to establish communication sends its
certificate to a given vehicle. The receiving vehicle extracts the information from the certificate
and configures a laser to the challenge parameters contained in the certificate. The receiving
vehicle uses its laser to stimulate the optical PUF
on the sending vehicle and records the response.
The receiving vehicle is able to authenticate the
sending vehicle if the recorded response sufficiently matches the response contained in the
certificate. The receiving vehicle then sends its
certificate to the sending vehicle and the process
is repeated with swapped roles to allow the sending vehicle to authenticate the receiving vehicle.

Integration of PUFs and ECUs
Syed et al.10 present a way of preventing
denial of service attacks within the CAN bus by
implementing the ability to authenticate connected ECUs. The proposed method is based on
assigning an ID to each ECU connected to the
CAN bus. Each of the IDs is associated with specific CRPs of the PUFs that are incorporated into
each ECU. A centralized reference monitor (RM)
securely stores copies of the IDs and CRPs for
each ECU within a TPM. All of this data is determined and loaded when the vehicle itself is being
built. Any ECU wishing to communicate along
the CAN bus must first be authenticated by the
RM. A similar method has been proposed in the
article by Siddiqui et al.11 where the PUFs in individual ECUs are used to generate a private-public key pair for each ECU and a central server.
The key pairs are used to first enroll each
ECU's ID with the server. After enrollment, the
server authenticates communication sessions
between ECUs.

DISCUSSION AND CONCLUDING
REMARKS
Even the basic hardware security primitives
of TPMs, HSMs, and PUFs have their own security vulnerabilities. Hardware modules can have
weaknesses caused by design flaws. Recently,
researchers revealed two attacks against TPMs
that exploit previously unknown design flaws
that require firmware updates to prevent.12
Additionally, many common cryptographic
algorithms used by TPMs and HSMs such as

IEEE Consumer Electronics Magazine

IEEE Consumer Electronics Magazine - November/December 2019

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - November/December 2019