Lightweight Fragment-Level Integrity Verification for CAN-Based OTA Using Micro-Hash Chains

Abstract

The Over-The-Air (OTA) firmware updates are crucial for today's vehicles for remote management and deployment of software components. However, commonly employed intravehicle communication interfaces such as the Controller Area Network (CAN) do not have built-in security features, including authentication and encryption, and thus, are susceptible to attacks from adversaries. In the case of the CAN-based OTA systems, firmware is fragmented because of the limitations of payload size. Fragmentation creates the attack vector for adversaries who could inject their own malicious fragments while maintaining the correct structure of the message, including offsets and checksums. Conventional integrity checks like the Cyclic Redundancy Check (CRC) cannot recognize such attacks. This paper proposes a lightweight fragment-level verification scheme relying on the micro-hash chain with the use of BLAKE2s-256 hashing and Ed25519 digital signatures. Such an approach allows progressive verification of integrity of firmware fragments as well as end-to-end authenticity. Evaluation of the proposed scheme with the use of hardware components - ESP32 nodes with the MCP2515 CAN controller - shows that the method is capable of recognizing attacks at the injection point with no overhead in computation.