  In recent years, the security of automotive Cyber-Physical Systems (CPSs) is
facing urgent threats due to the widespread use of legacy in-vehicle
communication systems. As a representative legacy bus system, the Controller
Area Network (CAN) hosts Electronic Control Units (ECUs) that are crucial
vehicle functioning. In this scenario, malicious actors can exploit CAN
vulnerabilities, such as the lack of built-in authentication and encryption
schemes, to launch CAN bus attacks with life-threatening consequences (e.g.,
disabling brakes). In this paper, we present TACAN (Transmitter Authentication
in CAN), which provides secure authentication of ECUs on the legacy CAN bus by
exploiting the covert channels, without introducing CAN protocol modifications
or traffic overheads. TACAN turns upside-down the originally malicious concept
of covert channels and exploits it to build an effective defensive technique
that facilitates transmitter authentication via a centralized, trusted Monitor
Node. TACAN consists of three different covert channels for ECU authentication:
1) the Inter-Arrival Time (IAT)-based; 2) the Least Significant Bit
(LSB)-based; and 3) a hybrid covert channel, exploiting the combination of the
first two. In order to validate TACAN, we implement the covert channels on the
University of Washington (UW) EcoCAR (Chevrolet Camaro 2016) testbed. We
further evaluate the bit error, throughput, and detection performance of TACAN
through extensive experiments using the EcoCAR testbed and a publicly available
dataset collected from Toyota Camry 2010. We demonstrate the feasibility of
TACAN and the effectiveness of detecting CAN bus attacks, highlighting no
traffic overheads and attesting the regular functionality of ECUs.
