Abstract:
본발명은 CAN 네트워크에서패킷을인증하는방법에관한것으로, 보다상세히는분할및 혼합된메시지인증코드를이용한효율적인인증방법및 이를위한장치에관한것이다. 본발명의일 실시예에따른 CAN 네트워크에서메시지를혼합메시지인증코드(MAC)를이용하여전송하는방법은제 1 메시지를이용하여제 1 MAC을생성하는단계; 상기제 1 MAC을제 1 부분 MAC 및제 2 부분 MAC으로분할하는단계; 제 2 메시지를이용하여제 2 MAC을생성하는단계; 상기제 2 MAC을제 3 부분 MAC 및제 4 부분 MAC으로분할하는단계; 상기제 2 부분 MAC 및상기제 3 부분 MAC을선형연산하여제 1 인증 MAC을생성하는단계; 상기제 1 메시지를상기제 1 부분 MAC과함께전송하는단계; 및상기제 2 메시지를상기제 1 인증 MAC과함께전송하는단계를포함할수 있다.
Abstract:
A controller area network (CAN) packet automatic analysis method according to the present invention, which comprises the steps of sorting packets related to the performance of a specific function among data packets used in CAN, and comparing and analyzing the change of packet data values with time on the graph, enables a simple and efficient analysis on the function, the type and the operation method of the packet. [Reference numerals] (AA) Start; (BB) End; (ST10) Input data and perform a function?; (ST11) Read a log file and write ID array; (ST12) Calculate a data variation value (A) before performing the function; (ST13) Calculate a difference (B) of average data amount by section before and during performing the function; (ST14) Record and store the variation according to the time relative to a packet satisfying with 'B/A > Threshold value'; (ST15) Performing analysis?; (ST16) Display an analysis result; (ST17) Section '1' increase; (ST18) Section end?
Abstract:
The present invention relates to a device for detecting an attack on a vehicle network and a method thereof and is to provide to a device for detecting an attack on a vehicle network and a method thereof which accumulatively counts packets by each device (ID) connected to a vehicle network bus, calculates the accumulated value by accumulating an inspected value (S) whenever accumulatively counting packets and determines that an attack is occurred if the average accumulated value calculated by dividing the accumulated value by the accumulated counting does not exceed a first threshold value. For the purpose, in a vehicle network environment in which devices, having a priority for packet transmission, connected to a vehicle network bus include: a packet collection unit for collecting packets transmitted through the vehicle network bus; a packet counting unit for accumulatively counting the number of packets collected by the packet collection unit; an inspected value calculation unit for calculating an inspected value based on a time difference between packets having the same ID; an accumulated value calculation unit for calculating an accumulated value by adding the inspected value which is calculated by the inspected value calculation unit to the previous inspected value; an average accumulated value calculation unit for calculating the average accumulated value by dividing the accumulated value calculated by the accumulated value calculation unit by accumulated counting value by the packet counting unit; and an attack determination unit for determining the existence of attack based on the average accumulated value calculated by the average accumulated value calculation unit. [Reference numerals] (10) Packet collection unit; (20) Packet counting unit; (30) Inspected value calculation unit; (40) Accumulated value calculation unit; (50) Average accumulated value calculation unit; (60) Attack determination unit; (70) Control unit