Journal of Information Processing Vol.25 220–228 (Feb.

2017)
[DOI: 10.2197/ipsjjip.25.220]

Regular Paper

Automotive Attacks and Countermeasures on LIN-Bus

Junko Takahashi1,a) Yosuke Aragane1 Toshiyuki Miyazawa2 Hitoshi Fuji1

Hirofumi Yamashita3,b) Keita Hayakawa3 Shintarou Ukai3 Hiroshi Hayakawa3
Received: May 26, 2016, Accepted: November 1, 2016

Abstract: This paper presents a security analysis of the Local Interconnect Network (LIN) that is used in assembly
units such as seats, steering wheels, and doors in vehicles. Recently, the number of security threats to in-vehicle net-
works such as the Controller Area Network has increased. In contrast, there have been no reports that evaluate the
security of LIN in detail. The security analysis of LIN is important because it is used in units related to seats, steering
wheels, etc. and it is at risk for an attack. In this paper, we present the first evaluation on the security of LIN. We present
case studies of attacks that use the characteristics of a commonly-used error handling mechanism. In the attacks, the
attacker intentionally stops communication using the error handling mechanism and sends a false response in place of
a valid one. We experimentally show the feasibility of the attacks using a vehicle microcontroller. Furthermore, we
present countermeasures against the attacks. The results of this study show that there is vulnerability to attack when the
error handling mechanism is simply designed. We believe that this study will contribute to improvements in security
of in-vehicle communications.

Keywords: vehicle security, in-vehicle protocol, LIN, error handling mechanism

doors [11], there is the possibility for a significant threat. For

1. Introduction example, while the vehicle is moving on the highway, the user
Modern vehicles already contain a number of microcontrollers could be exposed to risk if an attacker maliciously tampered with
that are responsible for crucial components such as the control the controls related to the steering wheel or doors. Although the
of the engine, brakes, and steering wheel. Recent vehicle tech- possibility of an attack on LIN is briefly described in a previ-
nologies such as automated driving assistance have been achieved ous study [3], detailed attack methods and the countermeasures
through advances in microcontrollers. Each microcontroller in were not shown. Furthermore, LIN uses the master-slave method
a vehicle communicates through an in-vehicle network such as which is different from that of CAN. Therefore, it is difficult to
the Controller Area Network (CAN), Local Interconnect Network simply apply the CAN attack method to LIN.
(LIN), or FlexRay. These networks are applied to vehicle func- In this paper, we evaluate the resistance of LIN to an attack that
tions related to, for example, the engine, body, or multimedia con- leads to malicious control of a vehicle*1 . We present case studies
trol based on their essential technical properties and application of attacks, in which the attacker can send a false message with the
areas. receiver identifying it a valid one using a general error handling
Recently, some investigations have highlighted security risks mechanism [13], [14].
to in-vehicle communications such as CAN because they are not Although LIN is commonly used in a CAN subnetwork, recent
designed considering security [1], [2], [3], [4], [5]. These stud- hacking techniques [1], [15] could make it easier to gain accesses
ies showed that any arbitrary action could be induced by sending to the LIN bus through the CAN-bus node. We also perform ex-
a false message to the CAN bus. Some detection and preven- perimental analysis of the proposed attacks using a vehicle mi-
tion mechanisms such as message authentication code (MAC) on crocontroller in which the LIN protocol is implemented. Further-
CAN were also proposed in Refs. [6], [7], [8], [9] and specifica- more, we propose countermeasures for the attack.
tions for the MAC on the bus were developed by the automo- The remainder of this paper is organized as follows. An
tive open system architecture (AUTOSAR), which is a world- overview of LIN is given and previous work is described in Sec-
wide development partnership of vehicles (specification version tions 2 and 3, respectively. We describe the concept behind the
is 4.2.2) [10].
On the other hand, if an attacker can intentionally control the *1 A preliminary version of this paper was published in the conference pro-
communications on LIN, which is used in steering wheels and ceedings of SCIS 2016 [12]. In this paper, we change the constructions
of sections and delete the redundant representations for reader-friendly
compared to Ref. [12]. Furthermore, we reveal that the attack regarding
1
NTT Secure Platform Laboratories, Musashino, Tokyo 180–8585, Japan the header collisions described in Section 4.2.3 of Ref. [12] is not effec-
2
NIPPON TELEGRAPH AND TELEPHONE CORPORATION, tive. Thus, we correct this attack method and the successful attack is
Chiyoda, Tokyo 100–8116, Japan described in Section 5.3 in this paper. Corresponding to the above, we
3
DENSO CORPORATION, Kariya, Aichi 448–8661, Japan delete the countermeasure regarding the header resending in Section 6
a)
[email protected] (3) of Ref. [12] and we describe a countermeasure in Section 7.3 which
b)
HIROHUMI H [email protected] is devised after the SCIS conference.


c 2017 Information Processing Society of Japan 220
Journal of Information Processing Vol.25 220–228 (Feb. 2017)

Fig. 1 LIN message frame.

study in Section 4 and the case studies of the attacks on LIN in

Section 5. We present experimental results of the proposed at- Fig. 2 LIN transmission method.
tacks in Section 6 and propose countermeasures in Section 7. Fi-
nally, we conclude the paper in Section 8. 1 sends the response and slave node 2 receives the response) as
indicated by (B) in Fig. 2. A response without the header will be
2. LIN Specifications
simply dropped in the transmission of LIN.
This section gives an overview of LIN [16].
3. Related Work
2.1 Introduction to LIN In this section, we describe related work. Because the in-
LIN is developed by the LIN consortium to create a standard vehicle protocols are not designed considering security, it is pos-
for low cost and low-end multiplexed communications in auto- sible to implement some attacks such as spoofing and denial-of-
motive networks. Typical applications for LIN include assembly service (DoS) attacks that are famous in the IT field. In previous
units such as seats, doors, engines, and steering wheels [11] with studies, most papers focus on the CAN-bus security, and attack
typical data rates of up to 20 kbps. LIN is based on a master/slave methods were proposed in Refs. [1], [2], [4], [5]. In Refs. [1], [4],
architecture that comprises a single master node and numerous hacking techniques to inject a false message into the CAN bus
slave nodes connected using a single wire. LIN uses a time trig- using the diagnostic interface of the vehicle were introduced and
ger method that employs a priori fixed time schedule, which is they showed that an arbitrary action could be performed. Hoppe,
the key property of LIN. The master node has the time schedule Kiltz, and Dittmann [2] showed several automotive system vul-
that decides when and which message frame shall be transmitted nerabilities such as in the window lift and airbag control using
in the bus. real automotive hardware and presented short-term countermea-
sures. They also showed basic attack principles from the aspect
2.2 Message Frame of automotive IT security [5].
Message frames consist of a header provided by the master Regarding the investigation of the security of other in-vehicle
node and a response provided by the master/slave node as shown networks, the security of FlexRay was studied in Ref. [17]. The
in Fig. 1. The header consists of a break field that is used to sig- security on the LIN bus was briefly introduced in Ref. [3]. In the
nal the beginning of a new frame. The sync byte field is a field attack on LIN, the authors described the attack possibility where
with the data value of 0x55 that is used by the slave node for each slave node would be completely deactivated by introducing
clock synchronization. The protected identifier (PID) field of the well-directed false sleep frames. The slave nodes still remains
header consists of two sub-fields: the frame identifier (bits 0 to the sleep mode until a wake-up mode is requested from the mas-
5) and the parity (bits 6 and 7). The PID denotes the contents of ter node. They also described that modifying the sync byte field
a specific message but not the destination. The data field of the to any value is another attack point.
response stores up to 8 bytes of data. The checksum is used for
4. Concept Behind Study
verification so that the node receives data correctly.
In this section, we describe the difficulty of the attacks against
2.3 Transmission Method LIN and the concept of the proposed attacks.
Several frame types for transmission are used in LIN. Here,
we describe the unconditional frame that is used in this inves- 4.1 Difficulty of Attacks Against LIN
tigation. The unconditional frame is the most commonly used In the LIN-bus, in order to implement some malicious behav-
and it carries data. An example transmission method is shown ior, we must be able to (1) inject a false response in which a part
in Fig. 2. In the example, slave node 2 performs a task based on of data is changed to any value into the bus depending on the
the response sent from slave node 1. At this time, LIN uses the kinds of data and (2) do so at any timing.
master-slave method. Using this method, slave node 1 can only Regarding (1), to validate such a false response, we need to
send a response based on the header send from the master node. inject it after a header is sent from the master node. However, it
The timing of the header is controlled by the time schedule of the is difficult to change a part of data of the false response by sim-
master node. At the beginning, the master node sends a header ply injecting it in the bus because it may collide with the correct
including the PID (0x00 in this case) which indicates the sender response that is sent after the header.
or the receiver as indicated by (A) in Fig. 2. The header is broad- Regarding (2), to control the timing of the sequence of the mes-
cast in the bus and all nodes receive it. The node corresponding sage which causes not to do normal operations, it is difficult to
to the PID sends a response or receives it (in this case, slave node manipulate the time schedule because we need to physically ac-


c 2017 Information Processing Society of Japan 221
Journal of Information Processing Vol.25 220–228 (Feb. 2017)

cess the master node and tamper with it based on the details of
the implementation method of the master node which we cannot
obtain in general.

4.2 Concept Behind Proposed Attacks

In order to inject any value of a false response at any time, we
employ the characteristics of the error handling mechanism. In
this mechanism, the slave node (sender) stops sending a response
when the data in the bus are different from the sent data in the re-
sponse while monitoring the bus level and waits the next header.
Such kind of errors is known as bit errors. This type of error han-
dling mechanism is commonly used and implemented in the LIN Fig. 3 Attacker induces collision between response sent from slave node 1
protocol [13], [14]. In fact, we intentionally generate a collision and false response.
between the responses to induce the bit error and inject a false re-
sponse after an error occurs. Thus, we can send any value of the Here, we consider that slave node 1 sends a response correspond-
false response after the collisions occur because the sender stops ing to the header including the PID (0x00) and slave node 2 (at-
sending the correct response and the receiver accepts the false re- tack target) receives it to perform some behavior. The details of
sponse as a valid one. Although sending a false response as a the attack method are given below.
valid one is sufficient to warrant risk, we also consider attacks in (a) The attacker creates a false response that has different val-
which the sequence of the transmission of the response is manip- ues than the correct response from the n-th byte when the attacker
ulated by generating the header collisions without tampering with wants to forge a response from the (n + 1)-th byte.
the time schedule of the master node. In order to validate the false response, the header, including the
PID that indicates slave node 1 sends a response, must be sent in
5. Evaluations of Attacks on LIN the bus. Then, the attacker waits until the master node sends the
In this section, we describe the assumptions in the study and header that corresponds to the response of the attack target or the
the proposed attacks that lead to the malicious behavior. attacker creates the header and sends it.
(b) Corresponding to the header (0x00 as example), slave node
5.1 Study Assumptions 1 sends a response as shown in Fig. 3.
Here, we describe the assumptions in the study. (c) At this time, the attacker sends a false response at the same
• The sender slave node monitors the LIN bus in terms of bytes time that slave node 1 sends a response. Then, a collision oc-
to determine whether the sent response is equal to the value curs at the n-th byte. Slave node 1 detects the bit error that the
in the bus. If they do not match, the slave node detects the bus level is different from the response, and subsequently stops
bit error and stops sending the response [13], [14]. transmitting the response based on the error handling mechanism.
• An unconditional frame is used in the LIN transmission. Then, the attacker continuously sends the false response from the
• The attacker can inject false headers/responses into the LIN (n + 1)-th byte.
bus through physical or logical access to the LIN bus while We note that when collisions between two responses occur, the
each node normally functions based on the time schedule. value in the bus is electrically 0 in the physical layer, i.e., the
As an example, since the master node is usually connected dominant level takes priority. Then, the data in the bus where the
to CAN [18], it is possible for the attacker to gain accesses collision occurs at the i-th byte will be Ri &Ri where Ri is the i-th
to LIN through the master node using recent hacking tech- byte of the response sent from the slave node, R i is the i-th byte of
niques [1], [15]. the false response sent from the attacker, and & is a bitwise AND.
• The attacker can guess the sequence of the message in the (d) Then, slave node 2 receives and stores the false response
time schedule including the message frame that the attacker from the (n + 1)-th byte as the valid one. We note that the attacker
targets. needs to calculate the correct checksum in order that slave node 2
• The attacker can read and interpret the PID of the headers accepts the false response as the valid one. The attacker can cal-
and the responses transmitted in the targeted LIN. It is pos- culate the correct checksum by guessing the response transmitted
sible to intercept them because the transmission of LIN is not in the bus.
encrypted. The attacker can guess the contents of the head- The time chart of the header, the response sent from slave node
ers and the responses through analysis based on the vehicle 1, the false response sent from the attacker and the data in the bus
behavior [4]. is shown in Fig. 4. In the figure, we simply describe the data field
in the response. We consider that the response is sent with the
5.2 (1) Proposed Attacks That Induce Collision Between Re- least significant byte first. Based on the figure, the attacker can
sponses send any value of the false response after the second byte.
In this section, we propose attacks that can inject any value of As is shown in the above, if the control data is set in the first
the false responses by generating collisions between the correct byte, the attack can not necessarily affect the automotive control
and false responses. The attack procedures is shown in Fig. 3. because the first byte cannot be changed to the value which the


c 2017 Information Processing Society of Japan 222
Journal of Information Processing Vol.25 220–228 (Feb. 2017)

Fig. 4 Time chart of data from master node, slave node 1, attacker, and data
in bus when a collision occurs between the first byte of responses. Fig. 5 Attacker injects a false header to send a false message at any timing.
The value of the first byte in bus will be 0xA0 (= 0xAA & 0xA0).

attacker likes. However, to the best of our knowledge, it is often

the case that the significant control data is set to the byte after the
second byte in the data field of the response. Therefore, we think
that the proposed attack is practical and it can affect the control
system even when the first byte is corrupted by the collision.
In the above attack, the attacker intentionally injects a false re-
sponse to cause the error handling mechanism to initiate and stops
the transmission from the slave node 1. We note that the bit error
can be caused by other techniques such as inverting a bit or some
bits at the first byte of the response using an electric signal to set
the bus level to dominant or recessive*2 . Then, slave node 1 de-
tects the error and stops the transmission. The subsequent attack Fig. 6 After collision between headers, attacker injects a false response.
procedures are the same as that described above.
(c) Then, the header in the bus becomes the value 0x00 after
5.3 (2) Proposed Attacks That Induce Collision Between the collision and each slave node receives this changed header
Headers value.
We present a more complex attack method such as an attack (d) When the value of the header changes, slave node 1 sends
that changes the sequence of the response without tampering the a response corresponding to the received header.
time schedule of the master node. Slave node 2 sends a response under normal conditions; how-
In addition to injecting any value of the message in the bus, ever, the header is changed due to the collision caused by the at-
we need to cause a collision between headers to change the se- tacker. Thus, slave node 1, which is not the normal sender, sends
quence of the message. The attack procedures are shown in Fig. 5 a response.
and Fig. 6 and we show the attack to induce any value of the re- (e) At the same time that slave node 1 sends a response, the at-
sponse at any time as follows. In this case, under normal condi- tacker injects a false response that is different from the n-th byte
tions, slave node 2 sends a response that corresponds to the PID of the response sent from slave node 1.
(0x01); however, we change the sequence of the message where (f) In the same way as described in Section 5.2, slave node 2
slave node 1 (the PID is 0x00) sends a response to make slave receives a false response as the valid one.
node 2 receive a false response and perform abnormal behavior. The time chart of the header, the correct response, the false
(a) The attacker sets a false header (including the PID 0x00 response and the data in the bus is shown in Fig. 7. The figure
as an example) to let slave node 2 (attack target) receive the re- shows that the attacker can send a false response after changing
sponse*3 . The master node sends the header (including the PID the sender of the response, i.e., the sequence of the message.
0x01) based on the time schedule. In the above attack, we note that the attacker cannot change any
(b) At this time, the attacker injects a false header (including value of the header because the dominant value, 0, takes priority
the PID 0x00) at the same time that the master node sends the in the physical layer when a collision occurs. However, once the
header. attacker can change the value of the header, he can change the
*2 In Ref. [12], we describe this content in the independent section (Sec- sequence of the transmission of the message without tampering
tion 4.2.2 in Ref. [12]). However, the essence of the attack is almost the with the time schedule of the master node.
same with the attack using the collisions of the response. Thus, we merge
In Sections 5.2 and 5.3, we describe the attacks in which any
the description in Section 4.2.2 of Ref. [12] in this section.
*3 In Ref. [12], we describe that the attacker sets a false header which is not value of the response can be transmitted at any timing. We note
assigned to any node after the collisions. However, this is not correct and that the attacker can also perform a DoS attack using this attack
the attack is not effective because any node does not receive the response
if the attacker sets so. Thus, we change the setting of the false header technique. In fact, the attacker can skip any response in the time
and the attack procedures in the following steps. schedule by intentionally causing an error because the slave node


c 2017 Information Processing Society of Japan 223
Journal of Information Processing Vol.25 220–228 (Feb. 2017)

stops transmitting a response when it detects an error. Then, the normal values of the response, we do not cause the rapid change
attacker can also perform attacks that simply stop any response in of the response and we can send the same response correspond-
the time schedule. ing to the same header twice in the attack. Thus, it is difficult to
mitigate the attacks by the mechanisms from (a) to (c).
5.4 Discussions Regarding Safety Mechanisms
In this section, we discuss assumptions regarding safety mech- 5.5 Practical Threats Posed by Proposed Attacks
anisms on performing the proposed attack and effectiveness of In this section, we mention the practical threats posed by the
the attack on them. The safety mechanisms are generally imple- proposed attacks. When the significant control data is set after
mented in the automotive system to detect the system failure and the second byte of the response, the attacker continuously injects
recover to the safe status. the false response using the proposed method through any access
We assume that the following general mechanisms are imple- to the LIN bus to induce the malicious behavior in the real sit-
mented in the system regarding the occurrence of errors such as uations. As concrete examples, we consider the controls of the
bit errors. sliding door and the steering wheel lock in which LIN is gen-
( 1 ) The node (sender) which detects errors shift to the safe sta- erally used. In these cases, we think that the attacker can hold
tus. the sliding door open and can affect the control of driving safely
( 2 ) The node (sender) which detects errors sends an abnormal by the lock of steering wheel while the vehicle is moving using
signal which means the occurrence of the errors to all nodes the proposed attacks. Thus, the malicious behavior caused by the
including the receiver. Then, they shift to the safe status. attack results in the significant practical threats.
Regarding (1), although the sender can shift the safe status,
6. Experimental Results
other nodes including the receiver cannot detect the error. Thus,
it is difficult to mitigate the attacks by this mechanism. Regard- This section describes the experimental results of the attacks.
ing (2), depending on the kinds of the abnormal signal and how To verify the feasibility of the proposed attacks, we experimen-
to shift the safe status after each node receives its signal, it is pos- tally analyze the attack when the attacker injects a value of the
sible to mitigate the attacks. The details of how to mitigate the response as in Section 5.2 as an example using a vehicle micro-
attacks are described in Section 7.3. controller.
In addition to the above safety mechanism, we assume that the An overview of the experimental configuration is shown in
safety mechanisms which are commonly used are implemented Fig. 8. Details of the equipment used in the experiments are given
in the system. in Table 1. The experimental conditions are as follows.
(a) When the slave node (receiver) receives the response includ- • For both slave nodes and the attacker node, we use the same
ing the invalid values which are not defined by the specifica- evaluation boards with the microcontroller and transceiver
tions, it discards the response and waits the next header. IC to send a false response at the same time as the slave
(b) When the slave node (receiver) receives the response which node.
means the rapid change when the system does not assume • We implement the error handling mechanism in the slave
such a change, it discards the response and waits the next node in which it monitors the bus level and stops the trans-
header. mission when an error is detected.
(c) The master node continuously sends the same header twice.
Thus, the slave node (receiver) verifies whether two re-
sponses, corresponding to the header, are the same. If two
responses do not match, the receiver discards them and it
waits the next header.
The proposed attack does not induce the system failure and the
malicious behavior can be caused with the acceptable range of
the system. In fact, regarding (a) to (c) in the above, we use the

Fig. 7 Time chart of data from master node, attacker, and data in bus when
a collision between headers occurs. Fig. 8 Overview of experimental configuration.


c 2017 Information Processing Society of Japan 224
Journal of Information Processing Vol.25 220–228 (Feb. 2017)

Fig. 9 Experimental results of waveform of header and response transmitted in the bus. (a) Waveform
of message frame in normal communications. (b) Waveform of message frame in communication
when attack is performed. Collision occurs at the first byte and a false response is transmitted to
the bus after the collision.

Table 1 Equipment used in experiment. the header is constantly transmitted to the bus. We consider
Equipment Product Name and Model Number that the attack node sends a false response when it receives
the header including 0x1A.
Oscilloscope Agilent DSO6012A
In the experiment, when the header is sent from the master
DC Power Supply Kikusui Electronics Corp., PMP16-1QU
node, both the slave node and the attack node send responses at
PC (Slave Node) CPU: Intel Core i7 2.60 GHz, OS: Windows 7 (64 bits), the same time, and then, a collision occurs. The experimental re-
Software: CANoe V8.2
sults measured using the oscilloscope are shown in Fig. 9 in the
case of normal communications and the commnuications when
• We use the simulation software CANoe V8.2 from Vector the attack is performed. In Fig. 9 (a), we show that the response
Informatik [19] as the slave node (sender) and use VN8950 sent from the slave node, 0xAAAAAAAA, is transmitted normally.
which is the hardware interface of the LIN bus including the On the other hand, in Fig. 9 (b), we observe that false response
LIN transceiver [20]. 0xA0020304 sent from the attacker is transmitted when the first
• We use an oscilloscope to measure the waveform of the byte collision occurs. We note that we observe a collision, in
header, the response, and the false response transmitted in which two small peaks appear, at the second bit and at the fourth
the bus. bit of the first byte as shown in Fig. 9 (b). The detailed value is
• We set the time base to 50 ms and baud rate to 19,200 bps as shown in Fig. 10 when the collisions occur. In the figure, the
the LIN conditions, and use LIN protocol version 2.X. value in the bus is 0xA0 (= 0xAA & 0xA0) after the collision.
• We set the PID of the header corresponding to the slave node To verify that the value of the false response is received by the
to 0x1A, the response from the slave node as the 4-byte data slave node (subscriber), we observe data measured in the PC. The
0xAAAAAAAA, and the false response from the attacker as the response in the bus measured using CANoe is shown in Fig. 11
4-byte data 0xA0020304, as an example. Each response is and we observe that the false response is received at the PC as the
transmitted with the least significant byte first. valid one.
• We use a time schedule that includes the header (the PID Therefore, based on the experimental results, we show that the
0x1A) from the master node. The response corresponding to proposed attack is effective using the error handling mechanism.


c 2017 Information Processing Society of Japan 225
Journal of Information Processing Vol.25 220–228 (Feb. 2017)

7.3.1 Effectiveness of Countermeasures When Collisions

Occur Between Responses
We describe attacks that induce a collision between responses
as described in Section 5.2 when the above countermeasure is
implemented in LIN to show the effectiveness of the countermea-
sures.
1. As described in Section 5.2, the attacker injects a false re-
Fig. 10 Collision between the first byte of response 0xAA (= 1010 1010)
sponse at the same time that slave node 1 sends a response that
and false response 0xA0 (= 1010 0000). Value 0xA0 (= 0xAA & corresponds to the header (PID is 0x04 as example) from the mas-
0xA0) is transmitted in the bus. The byte of the response is trans- ter node. At this time, slave node 1 detects the error at the first
mitted with the least significant bit first.
byte and immediately sends an abnormal signal in which the re-
maining 8 bytes (7-byte data and 1-byte checksum) are all 0x00.
Even if the attacker sends a false response after the second byte,
it is overwritten with the abnormal signal because the dominant 0
takes priority in the bus. Then, the attacker cannot send any value
of the false response after the second byte.
Fig. 11 Response data measured in CANoe. 2. Next, we describe how to notify all nodes that an abnor-
mal situation occurred and each node returns to normal status
7. Countermeasures when errors do not continuously occur. Based on the time sched-
ule, the master node sends the next header. At this time, slave
In this section, we describe countermeasures against the pro-
node 1 sends a response (all 8-byte data are 0x00 and the 1-byte
posed attacks in Section 5*4 .
checksum) that indicates that an abnormal situation occurred to
the master node regardless of the value of the header.
7.1 Byte Assignment in Response
3. When the master node receives the response described in 2,
We set the significant data to the first byte of the response so
it sends the specific PID of the header such as 0x00. When each
that values are not changed to those the attacker likes. In the at-
slave node receives the header including PID 0x00, they shift to
tack, it is difficult to change the first byte of a response that is
the safe status. Here, the safe status indicates that a part of the
involved in a collision occurs and it is only possible to change
functions of the vehicle cannot be active, i.e., the car seat posi-
the bytes after a collision. As an example, it is better that we as-
tion cannot be adjusted while the car is moving, for example.
sign the significant byte, which indicates the control system, to
4. The master node resends the header (including PID 0x04)
the first byte of the response.
and monitors performances of slave node 1. If slave node 1 sends
an abnormal signal to the bus very frequently, the bus for slave
7.2 Implementation of Message Authentication Code
node 1 is logically turned off and the vehicle alarm display in-
(MAC)
forms the driver that an abnormal situation occurred.
In the same way as in CAN, a message authentication code
If slave node 1 normally sends a response that corresponds to
(MAC) can protect LIN from an attack and make it difficult for
the header (including the PID 0x04) from the master node, the
the slave node to receive a false response as the valid one.
master node decides that slave node 1 is normal and it sends the
However, it is not easy to implement the MAC in LIN from the
header including the PID 0xFB (calculated by 6-bit ID 0x3B and
aspect of the MAC calculation time in the slave node.
2-bit parity 0x11) as an example, which indicates deactivation of
the safe status. When each node receives a header including PID
7.3 Sending Abnormal Signal When Error is Detected
0xFB, it shifts the status from safe to normal.
We propose countermeasures that can be implemented easily
We note that, in step 3, the master node can notify the slave
based on the normal processing of the LIN protocol.
node to shift from safe status using the header which includes a
When the slave node detects that the bus level does not match
bit indicating the shift to the safe status. As examples, we assign
the sent response while monitoring the bus, it sends an abnormal
the least significant bit to indicate the shift to the safe status, i.e.,
signal that indicates that an abnormal situation occurred and all
bit 1 means normal status and bit 0 means the shift to safe sta-
nodes shift to a safe status. Moreover, when an error is not con-
tus. After the master node receives an abnormal signal from slave
tinuously detected in the slave node, each node returns from safe
node 1, the master node sends the next header including PID 0x10
status to normal status.
as an example based on the time schedule. Each slave node de-
tects that the least significant bit of the PID is 0. It then shifts the
*4 In Section 6 (3) of Ref. [12], we describe the countermeasures regard- status from safe to normal. When slave node 1 normally sends
ing resending the header against the attack using the header collisions a response and the master node decides that slave node 1 should
(Section 4.2.3 of Ref. [12]). However, the attack using the header col-
lisions in Ref. [12] is not effective as mentioned before. Thus, in this return to normal status, the master node sends the next header in-
paper, we do not describe the countermeasures of resending the header cluding the PID in which the least significant bit is 0 based on the
because it is not appropriate. Furthermore, compared to Ref. [12], we
devise a countermeasure which is effective on both attacks in Section 5.2
time schedule. In this case, each slave node can return to normal
and Section 5.3 and describe it in Section 7.3 in this paper. status.


c 2017 Information Processing Society of Japan 226
Journal of Information Processing Vol.25 220–228 (Feb. 2017)

7.3.2 Effectiveness of Countermeasures When Header Col- Control Units, Technical White Paper, IOActive (2014).
lision Occurs [5] Hoppe, T., Kiltz, S. and Dittmann, J.: Automotive IT-Security as
a Challenge: Basic Attacks from the Black Box Perspective on the
Here, we describe attacks that induce a collision between head- Example of Privacy Threats, International Conference on Computer
ers as described in Section 5.3 when the above countermeasure is Safety, Reliability, and Security (SAFECOMP 2009), LNCS 5775,
pp.145–158 (2009).
implemented in LIN to show the effectiveness of the countermea- [6] Bittl, S.: Attack Potential and Efficient Security Enhancement of Au-
sures. tomotive Bus Networks Using Short MACs with Rapid Key Change,
Nets4Cars/Nets4Trains/Nets4Aircraft 2014, LNCS 8435, pp.113–125
As described in Section 5.3, the attacker injects a false header (2014).
at the same time the master node sends a header (including the [7] Herrewege, A.V., Singelee, D., Verbauwhede, I.: CANAuth - A
Simple, Backward Compatible Broadcast Authentication Protocol for
PID 0x05 as an example). At this time, the master node detects CAN bus, Proc. Workshop on Embedded Security in Cars (escar 2011)
an error in which the value of the header in the bus is different (2011).
[8] Wolf, M.: Security Engineering for Vehicular IT Systems, Vehicu-
from that it sent while monitoring the bus. Then, the master node lar Security Mechanism, Vieweg+Teubner (2009), ISBN: 978-3-8348-
sends a response in which the 8-byte data are all 0x00. Therefore, 0795-3 (Print).
[9] Larson, U.E., Nilsson, D.K. and Jonsson, E.: An Approach to
if the attacker sends a false response after injecting a false header, Specification-based Attack Detection for In-Vehicle Networks, 2008
the former is overwritten with the responses in which all 8-byte IEEE Intelligent Vehicles Symposium, pp.220–225, IEEE Computer
Society (2008).
data are 0x00 and the attacker cannot send any value of the false [10] AUTOSAR: Specification of Module Secure Onboard Communica-
response. The subsequent processing is the same as that 3 and 4 tion AUTOSAR Release 4.2.2 (online), available from http://www.
autosar.org/fileadmin/files/releases/4-2/software-architecture/safety-
in Section 7.3.1. and-security/standard/AUTOSAR SWS
Thus, the above countermeasures protect from the attack de- SecureOnboardCommunication.pdf (accessed 2016-05-12).
scribed in Sections 5.2 and 5.3 so that an abnormal signal over- [11] Stelzer, J.: LIN bus emerging standard for body control apps (online),
available from http://www.eetasia.com/ARTICLES/2004SEP/B/
writes the false response from the attacker. Furthermore, this 2004SEP16 NTEK ID TA.pdf?SOURCES=DOWNLOAD
countermeasure includes a function in which each node can return (accessed 2016-05-12).
[12] Takahashi, J., Aragane, Y., Miyazawa, T., Fuji, H., Yamashita, H.,
to normal status from the safe status when an abnormal situation Hayakawa, K., Ukai, S. and Hayakawa, H.: Automotive Attacks and
does not continuously persist. Countermeasures on LIN-Bus, Symposium on Cryptography and In-
formation Security, Kumamoto, Japan (2016), 4F2-5, 8 pages (in
Japanese).
8. Conclusions [13] FUJITSU AN704-00007-2v0-E, 16-BIT MICROCONTROLLER
F2 MC-16FX Family MB96600 series, How to control LIN commu-
This paper presented a security analysis of LIN. We presented nication.
case studies of attacks that can induce malicious behavior by in- [14] National Instruments, Introduction to the Local Interconnect Network
(LIN) Bus, White Paper, Publish Date: Nov. 03 (2011).
jecting any value of the false response in time using the error [15] Rippel, E.: Embedded Security Challenges in automotive designs,
handling mechanism. We performed experimental analysis of the Proc. Workshop on Embedded Security in Cars (escar 2008) (2008).
[16] ISO/DIS 17987-3, Road vehicles – Local Interconnect Network (LIN)
proposed attacks and verified the feasibility of the attacks using a – Part 3: Protocol specification (Nov. 2013).
vehicle microcontroller. The results showed that the attacks were [17] Nilsson, D.K., Larson, U.E., Picasso, F. and Jonsson, E.: A First Sim-
successful, i.e., we sent a false response in the LIN bus and the ulation of Attacks in the Automotive Network Communications Pro-
tocol FlexRay, Proc. International Workshop on Computational Intel-
receiver node accepted the false response as the valid one. Fur- ligence in Security for Information Systems (CISIS 2008), Advances in
thermore, we presented countermeasures that can be easily imple- Soft Computing, Vol.53, pp.84–91 (2009).
[18] STMicroelectronics, Microcontroller Division Applications, AN1278
mented based on the processing of the LIN protocol. We pointed APPLICATION NOTE LIN (LOCAL INTERCONNECT NET-
out a vulnerability if the error handling mechanism, which is not WORK) SOLUTION.
[19] Vector Informatik, CANoe/DENoe V8.2.
generally determined in the protocol specification, was simply [20] Vector Informatik, VN8950: CAN/LIN/J1708 module with ana-
designed. Depending on the situation, we consider that the LIN log/digital IO expandability.
protocol specification requires updating in regard to security. We
consider that the attack concept and the countermeasures pre-
sented in this study can be applied to other in-vehicle protocols.
We believe that this study will contribute to improvements in se- Junko Takahashi received her B.S. and
curity of vehicle communications. M.S. degrees in physics from Waseda
University, Japan, in 2004 and 2006,
References respectively, and Ph.D. degree in engi-
[1] Koscher, K., Czeskis A., Roesner, F., Patel, S., Kohno, T., Checkoway, neering from the University of Electro-
S., McCoy, D., Kantor, B., Anderson, D., Shacham, H. and Savage, S.: Communications, Japan, in 2012. She
Experimental Security Analysis of a Modern Automobile, 2010 IEEE
Symposium on Security and Privacy (SP), IEEE Computer Society, joined NTT Information Sharing Platform
pp.447–462 (2010). Laboratories, Nippon Telegraph and Tele-
[2] Hoppe, T., Kiltz, S. and Dittmann, J.: Security Threats to Automo-
tive CAN Networks – Practical Examples and Selected Short-Term
phone Corporation in 2006. Currently, she is a researcher with
Countermeasures, International Conference on Computer Safety, Re- NTT Secure Platform Laboratories. She is a member of IEICE
liability, and Security (SAFECOMP 2008), LNCS 5219, pp.235–248
(2008).
and IPSJ. Her main research interest is the security of embedded
[3] Wolf, M., Weimerskirch, A. and Paar, C.: Secure In-Vehicle Commu- systems such as side-channel analysis and automotive security.
nication, Embedded Security in Cars, Lemke, K., Paar, C. and Wolf, She was awarded the SCIS 2008 Paper Prize.
M. (Eds.), pp.95–109, Springer-Verlag Berlin Heidelberg (2006),
ISBN-10 3-540-28384-6 (Print).
[4] Valasek, C. and Miller, C.: Adventures in Automotive Networks and


c 2017 Information Processing Society of Japan 227
Journal of Information Processing Vol.25 220–228 (Feb. 2017)

Yosuke Aragane is Senior research en- Keita Hayakawa received his B.S. and
gineer, supervisor, NTT R&D planning M.S. degrees in Electronic Engineering
department. He received his M.S. and from Nagoya University, Japan, in 2009
Ph.D. degrees from Tokyo Institute of and 2011, respectively. He joined DENSO
Technology in 1997 and 2005. He joined Corporation in 2011. Currently, he is an
NTT Multimedia Network Laboratories engineer with DENSO Corporation. His
in 1997, where he worked on intelligent main research interest is the Automotive
transportation systems. Since 2003, he Cyber Security form 2014.
has been with NTT Information Sharing Platform Laboratories
and NTT Secure Platform Laboratories focusing on cybersecurity
research. During 2008–2011, he was also with the IT Innovation Shintaro Ukai received his B.S. and
department, NTT East Corporation. He was a director of NTT- M.S. degrees in Electronic engineering
CERT, the representative CSIRT of NTT group. He is a member from Ritsumeikan University, Japan, in
of IEEE, ACM, IPSJ, and IEICE. 2012 and 2014, respectively. He joined
DENSO Corporation in 2014. Currently,
he is an engineer with DENSO Corpora-
Toshiyuki Miyazawa is Manager, Secu- tion. His main research interest is the Au-
rity Strategy Section, NTT Technology tomotive Cyber Security form 2014.
Planning Department. He received his
B.E. and M.S. degrees in mathematics
from Waseda University, Tokyo, in 2000 Hiroshi Hayakawa received his B.S. and
and 2003, respectively. Since joining NTT M.S. degrees in Electronic engineering
Information Sharing Platform Laboratory from Osaka University, Japan, in 1991 and
in 2003, he has been engaged in R&D of 1993, respectively. He joined DENSO
information security, especially of public key cryptography and Corporation in 1993. Currently, he is an
security protocols. From 2008 to 2011, he was with the IT Inno- engineer with DENSO Corporation. His
vation Department at NTT EAST. He is a member of the Japan main research interest is the Automotive
Society for Industrial and Applied Mathematics. He received the Cyber Security form 2000.
SCIS Paper Award from the Institute of Electronics, Information
and Communication Engineers (IEICE) in 2007.

Hitoshi Fuji is Executive Manager, Data

Security Project, NTT Secure Platform
Laboratories. He received his B.E. and
M.E. degrees from Tokyo University of
science in 1991 and 1993, respectively.
Since joining NTT in 1993, he had been
engaged in research on software engineer-
ing, network security and information se-
curity. He also earned Ph.D. in informatics.

Hirofumi Yamashita received his B.S.

and M.S. degrees in Mechanical Engi-
neering from Mie University, Japan, in
2000 and 2002, respectively. He joined
DENSO Corporation in 2002. Currently,
he is an engineer with DENSO Corpora-
tion. His main research interest is the Au-
tomotive Cyber Security form 2012.


c 2017 Information Processing Society of Japan 228