{'fraction_non_alphanumeric': 0.02941353142582544, 'fraction_numerical': 0.00728830867188595, 'mean_word_length': 4.680618744313012, 'pattern_counts': {'":': 0, '<': 1, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 5, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Probing Attacks on Physical Layer Key Agreement for Automotive Controller Area Networks (Extended Version)

Efficient key management for automotive networks (CAN) is a critical element, governing the adoption of security in the next generation of vehicles. A recent promising approach for dynamic key agreement between groups of nodes, Plug-and-Secure for CAN, has been demonstrated to be information theoretically secure based on the physical properties of the CAN bus. In this paper, we illustrate side-channel attacks, leading to nearly-complete leakage of the secret key bits, by an adversary that is capable of probing the CAN bus. We identify the fundamental characteristics that lead to such attacks and propose techniques to minimize the information leakage at the hardware, controller and system levels.


I. INTRODUCTION
Over the past few years, an increase in the number of connectivity interfaces on a traditional automobile has drawn the attention of the security community. Several high profile attacks have been demonstrated on the modern car by academic and industrial researchers, e.g. [1]- [5]. These attacks are primarily facilitated by the lack of security (authentication, encryption) in the existing architecture of the controller area network (CAN). Concurrently, several techniques have been proposed for integrating security into the current architecture, [6]- [9].
Similar to traditional secure systems, several of these techniques rely on secure provisioning of symmetric keys within the nodes on the CAN bus. However, secure and robust provisioning, maintenance and update of cryptographic keys within the automotive supply chain can be incur significant overhead, and may require changes to the automotive manufacturing and servicing facilities. Several commercial systems to enable such a process have been proposed, e.g. in [10].
Dynamic generation and distribution of keys in a secure manner can provide an alternative (or reduce the functional requirements) of traditional provisioning systems. One promising approach, Plug-and-Secure for CAN (PnS-CAN), has been recently proposed towards this goal, in [11], [12]. A key advantage of the Plug-and-Secure scheme is the utilization of inherent physical layer properties of the CAN bus to provide security guarantees for key agreement between groups of nodes.
Cryptographic systems that are provably secure in the computational model have often been compromised by exploiting characteristics of their physical implementation. Physical characteristics such as timing differences, power leakage, and other features or radiation can provide a covert communication medium, side-channels, leaking system information to an adversary. Several attacks have been demonstrated on traditional systems using side channels, e.g. in [13]- [16]. Comprehensive analysis of a system to identify and exploit such side-channels can be difficult. It has been observed from traditional systems that prevention of such attacks can add significant overhead to system design and negatively impact performance.
In this paper, we demonstrate that other properties of physical layer the CAN bus can be utilized to violate the security of the PnS-CAN system by an adversary capable of probing the CAN bus. Here we discuss several voltage, timing and transient characteristics based side-channels that can be used to attack the system and partially extract the secret keys. We then propose countermeasures that can be implemented at different levels of the system, namely low level hardware changes, controller modifications and system level changes. Our methods align well with existing system configuration and result in little overhead.

A. Our Contributions
We investigate the side-channels for the two-party PnS-CAN protocol proposed in [11]. Our contributions are as follows, • We identify characteristics of the CAN bus that can be utilized to extract the secret key during execution of the PnS-CAN protocol. We outline a general methodology to map existing CAN identification techniques to attack our scheme. We further demonstrate the attack of the system due to one of the non-trivial feature, i.e. timing characteristics. • We propose countermeasures that can be included in the transceiver hardware or the CAN controller to minimize such leakage. • For key agreement between groups using the PnS-CAN protocol, we propose system level changes that can be used to further reduce the side-channel leakage.

B. Related Work
Side-channels: Since the initial results of Kocher [13], a lineage of work has been created to utilize the state based differences in a physically observable phenomenon, such as timing, power, etc, to estimate the secret state. Several attacks have been demonstrated on traditional systems using timing characteristics [13], [17], power characteristics [14], and a variety of other side-channels [15], [16]. Our results extend this line of work and utilize the differences in the physical characteristics between various participating nodes to extract the secret key. To the best of our knowledge, there is no work in literature to identify low-level attacks on the PnS-CAN scheme.
A critical difference of our work from existing side-channel literature is that traditionally, side-channel attacks extract a pre-existing secret key based on usage of the key. In our work however, we extract the secret key during its derivation phase, i.e. prior to storage. Thus, existing methods can be applied in conjunction with our work to extract any secret bits that remain.
Intrusion detection systems (IDS) based on CAN signal characteristics: The lack of node-identity and authentication in the traditional CAN protocol has led several researchers to utilize physical signal (or device) characteristics as a fingerprint to identify the transmitting nodes. These results, e.g. in [18]- [20], highlight the existence of subtle, yet identifiable differences between the transmissions from different nodes on the CAN bus. Though such features have been explored and utilized to obtain very robust identification features in traditional network domains, i.e. wireless networks, Ethernet based networks or aquatic networks, they are in very early stages of investigation for CAN.
Since the PnS-CAN system relies on the inability of an adversary to identify the transmitter, any fingerprint associated with the transmitter of a node can be used to attack PnS-CAN. It should be noted that these results were investigated in context of increasing system security by designing an IDS based on the identified features. However, in our case, these features are utilized to attack the system. The authors in [19] use simple features such as meansquare error between bit samples, and convolution amplitude to fingerprint and identify the ECUs. However, the performance of these mechanisms is highly dependent on the message value, which can vary significantly for our schemes. This was improved in [18] by using several time domain and frequency domain features of the transmitted signals. The authors in [20] further improve the results and utilize a variety of classifiers, ranging from simple binary support vector machines (SVM) to multi-layered convolutional neural network (CNN) to identify the ECUs. They demonstrate that despite using low precision hardware for sensing, they can achieve improvement over traditional classifiers by utilizing powerful methods such as CNN. Intuitively, these identification mechanisms can be utilized to break the PnS system. There are however several challenges and simplifications that additionally apply to the PnS system. For example, these systems rely on classification of a message frame consisting of a single transmitter and synchronization source. However, for the PnS-CAN system, this assumption does not apply directly. On the other hand, simpler features may be used due to a slightly different structure of the problem.

C. Organization
The remainder of the paper is organized as follows. In Section II, we describe the basic PnS-CAN system and the adversarial model. We provide an overview of the useful physical characteristics in Section III, and demonstrate an attack on an unprotected system. We propose several countermeasures to prevent these attacks in Section IV. In Section V, we discuss the practical applicability of our countermeasures and future directions.

A. Notation
We adhere to the following notation for the paper. For two nodes nodeN 1 , nodeN 2 executing the protocol, we denote by x − y, the simultaneous transmission of x by the primary node, i.e. nodeN 1 and y by nodeN 2 . Here, a, b are logical bits, i.e. x, y ∈ {0, 1}. We denote by GW , the central entity that controls (or initiates) the execution of the key agreement protocol. Such a functionality is typically performed by the central gateway in the network.

B. CAN Bus Physical Layer
CAN bus, the primary communication network for most modern day cars, is a broadcast medium consisting of a series of nodes connected via a twisted-pair cable with termination impedance at either end. It has two logical states, the dominant '0' state, where the bus is driven by a voltage, and the recessive '1' state, where the bus is grounded. If two nodes transmit a bit simultaneously, the effective state of the bus is dominant '0' if any of the nodes transmits the dominant bit. Thus, the bus acts as a logical AND gate between inputs from the nodes.
The CAN bus utilizes differential signaling to transmit the data. In the CAN standard, when transmitting the dominant bit 0 on the bus, the output pins of the nodes, CANH and CANL, are driven to different voltage levels, and the difference from CANH to CANL is the output of the CAN bus. Similarly, transmission of a recessive bit 1 occurs when CANH and CANL are not driven, and will have similar voltage levels.

C. System Model
As this work focuses on attacking the PnS-CAN protocol, it inherits the system requirements for successfully building that system, as enumerated in [12]. We expect the typical automotive network (CAN) to be comprised of heterogeneous nodes, i.e. nodes from different manufacturers or families. Since the PnS-CAN protocols are based on simultaneous transmission by two nodes, all write operations on the bus during the key agreement phase use ECU pairs. Thus, the ECUs require modified CAN controllers that allow simultaneous transmission of data during this phase. However, during regular operation, the network operates in a CAN-compliant manner, and hence has only single node transmitting during a frame.

D. Adversarial Model
We consider an arbitrarily powerful adversary that is capable of observing the variation of CAN bus signals with high voltage precision and timing resolution. Such an adversary can be simply realized by an eavesdropper who accesses the wires directly using a high precision oscilloscope. An alternate means could be through a regular ECU connected to the CAN bus with a high precision analog-to-digital (A/D) converter at the input and a modified CAN controller capable of sampling the bus at a high frequency. In a car, such nodes can be connected to the OBD-II diagnostics port. A representation of the CAN bus with adversarial presence is illustrated in Fig.  1.
The goal of this work is to demonstrate the existence of sidechannels. Even though such powerful adversaries are capable of actively injecting or modifying signals, we consider the adversarial behavior to be restricted to passive observations. However, we assume that the adversary is capable of observing the system for an arbitrarily long time. During regular system operation, we assume that the adversary is capable triggering the ECU of its choice to transmit. However, we assume that such selective modifications cannot be made during execution of the PnS-CAN protocol. Further, we assume that the adversary cannot control the content of the transmissions.
For this paper, we limit the adversarial access to a single point on the network. It should be noted that multiple points of observation can undoubtedly increase the leakage. However, since in an unmodified system, a single adversary is sufficient for complete compromise, we leave the consideration of multiple probes to future analysis. For our attacks, we assume the location of the adversary to be carefully selected and fixed. An adversary can theoretically improve its observations by adaptively changing its observation point.

E. Experimental Setup
Our experimental setup utilizes an FPGA (Altera Cyclone-V) based implementation of PnS-TwoParty scheme described in Protocol 1, implemented into a modified CAN controller. The modified controller generates fully compliant CAN2.0 frames that can be accepted by any traditional CAN controller. The test network consists of 16 nodes, using custom designed transceiver boards that utilize the FPGA digital outputs, connected via the standard CAN twisted pair cable.
The typical CAN architecture, consists of several subnetworks of ECUs connected by one or more powerful nodes that act as gateway nodes (GW ). However, for our system, the nodes are connected in a single chain with the GW at one end. This setup closely emulates one subnet of the network found in most modern cars. We use a commercial USB-CAN module to monitor the bus traffic. We use an Agilent 6012A oscilloscope to probe the bus and record the samples for offline processing.

F. PnS-CAN Scheme
The PnS-CAN scheme described in [11], [12], enables key agreement between multiple nodes connected to the CAN bus. For completeness, here we present a brief overview of the fundamental operations of the two-party and linear groupkey schemes from [12]. We include specific implementation aspects, that aid our attacks, in the protocol definition. For detailed discussion about the security aspects of the original scheme, the reader is referred to [12].
The PnS-CAN scheme between two nodes utilizes the wired AND property of the CAN bus to mask the bits simultaneously transmitted by the nodes. The security of this scheme is based on the inability of an eavesdropper to differentiate between transmissions that result in the same logical output on the bus, i.e. combinations that result in the dominant (0) output.
The operation of the basic two party protocol between nodeN 1 and nodeN 2 , using random seeds r 1 , r 2 is illustrated as Protocol 1. In this, a secret bit is generated between nodeN 1 and nodeN 2 when one of the nodes transmits a logical 0 (dominant bit) while the other transmits a logical 1 (recessive bit). Note that an ideal adversary is unable to identify which of the two nodes, nodeN 1 or nodeN 2 transmitted the dominant bit. The group key scheme described in [12] utilizes the PnS-TwoParty protocol between successive nodes to form a PnS chain. It was demonstrated that pairwise interactions between consecutive ECUs are sufficient to share the key with the group. Consider a group G K = {N 1 , N 2 , . . . , N K } of K nodes. The group key scheme can be described as Protocol 2: GroupKey-Linear: 1) The group communication order . . , N K } is broadcast to all participants by the central gateway (GW ). 2) First, nodeN 1 performs PnS-TwoParty with nodeN 2 to establish a key k 12 .
2) The bits in each chunk are interleaved with their complements to produce packets of size equal to the maximum payload, namely Note for interleaving, each 0 bit is replaced by 01 and 1 is replaced by 10. 3) nodeN 1 initiates the transmission by using a dedicated PnS-CAN header and p 1 (1) as payload. nodeN 2 synchronizes to the header and simultaneously transmits packet p 2 (1) during the payload phase. For compliance with regular CAN frames, each node dynamically performs bit stuffing and CRC computation based on the bus outputs. 4) nodeN 1 and nodeN 2 sample the first logical bus output sequence as b(1). The bits are de-interleaved to identify the the result of the original and complement transmission. Location within the transmitted chunk, where both the noninverted and inverted bits produced a 0 in the bus output, are secret from an ideal eavesdropper. These are considered as secret bits and the remaining bits are discarded. 5) The resulting sequence at nodeN 1 (remaining bits in the chunk) are always inverse of the sequence at nodeN 1 . Thus nodeN 2 inverts its sequence to obtain a sequence of secret bits identical to nodeN 1 . The process is repeated from 3 until the desired number of secret bits are generated.
Protocol 1: Practical two-party PnS protocol 3) Then nodeN 2 utilizes the result k 12 as the seed to generate its random sequences and performs PnS-TwoParty with nodeN 3 . 4) The process continues till nodeN K is reached. The final key is the group key shared between all nodes. It can be observed, that the security of the group key protocol depends on the security of the pairwise PnS-TwoParty scheme. We note that in systems, where the adversaries only have high-level (software) access to the nodes, they can only observe the logical output of the bus as determined by a single (or three) transceiver samples. Thus, though perfect obfuscation of the bit values in PnS-TwoParty is theoretically possible, it cannot be guaranteed for most practical systems where the adversaries may observe multiple high-resolution bus samples.

III. ATTACKS ON PNS-CAN
To illustrate the properties that can be exploited to mount a successful attack, consider the PnS-TwoParty system. As described in Section II-F, a secret bit results when one of the nodes transmits the dominant bit 0, i.e. drives the bus, and the other node transmits the recessive bit 1, i.e. performs no action. Even though, in the PnS-CAN system, nodes transmit messages as full frames, for each bit of significance (secret bit), only a single node is driving the bus. Thus identification of the transmitting node effectively leaks the bit, as the bit is 0 if the driving node is primary participant and 1 otherwise.
For example, consider a PnS interaction between nodeN 1 and nodeN 2 using the random sequences {0, 1, 1, 0} and {1, 0, 0, 1} respectively. This results in 4 shared secret bits, i.e. key = 0110. The bit observations on the bus corresponding to these would comprise of 8 bits (random bits interleaved with the complement).
Here, b 1 results from nodeN 1 transmitting a dominant bit and nodeN 2 a recessive bit. Thus if the adversary can identify nodeN 1 as the active node during b 1 , it can learn that the first secret bit is 0. Next, we describe the phenomenon that can be used to differentiate between various transmitters based on physical properties of the CAN bus.

A. Physical Characteristics
Similar to other electrical systems, in an automotive network will have differences in characteristics of the driver and network between an observer and the transmitters. We illustrate 3 phenomena that can be utilized to differentiate between bits transmitted by different nodes.
Steady state characteristics -One of the advantages of using differential signaling for CAN transmissions, is that it enables devices with varying electrical characteristics to be utilized on the same bus without any additional compensation circuitry. While this improves the design and robustness of the bus, the different characteristics also enables= identification of the transmitter, leading to leakage of the bits. For a transmitted bit, differences in steady state characteristics can be attributed to several factors, 1) Difference in driver circuits -Transceivers from different manufacturers (or even different models of the same manufacturer) can have different drive characteristics and output voltage range of the CANH and CANL pins. This can be due to different circuits, components or load impedance. Thus an adversary measuring the absolute voltage on CANH and CANL lines with respect to a common ground reference can distinguish between the dominant transmissions from different nodes. For example, consider a realization of the network in Fig. 1  3) Different physical locations -Even nodes with identical drivers and operating voltages can seem different from the view of an intermediate observer in the network. This is due to the differences in the effective impedance of the network segment between the two transceivers and the observer point. For a typical CAN bus scenario, several factors can contribute to these differences, e.g. different length of wires between the nodes and the observer, or different number of intermediate nodes. In Fig. 2b, we illustrate the differential voltage of two nodes at varying distances (over 1m difference) from the observer. In a typical CAN network, the difference in distance can be over 30mThough this difference appears small in comparison to other phenomenon, it can be useful in many scenarios One of the benefits of transient characteristics is that they can vary widely even for similar nodes placed symmetrically with respect to an observer. As illustrated in Fig. 3a, observations by an adversary that is symmetrically placed in Fig. 1 relative to two identical transmitters can be clearly distinguished, based on time domain characteristics. However, a disadvantage of the transient characteristics is that they cannot be compared directly, and the performance is highly dependent on the features that are derived for identification. Several such features have been enumerated in [18].
Timing characteristics -The typical propagation delay for the twisted pair cable used as the physical medium for the CAN bus is 5ns/m. Thus for a traditional network of length upto 50m, the difference in the time the transmitter drives (or releases) the bus and an observer observes a signal transition can be up to 250ns. Though such delays are accommodated within the CAN bit timing specification for correct sampling of the bit value, they can be exploited by an adversary to identify the transmitter of a bit.
The relative bit timing observed by an adversary for two transmitters can be influenced by two factors, namely the difference in propagation delay between the observer and the transmitters and the synchronization offset between the transmitters. In Fig. 3b, we illustrate the observations of an adversary that is symmetrically placed relative to two identical transmitters. However, as it can be seen, even a propagation difference of 0.02% of the bit timing is sufficient to distinguish between the dominant transmission from the left node and the right node, i.e. the scenario of secret bit generation, 1 − 0 followed by 0 − 1 transmission in PnS-CAN. Each PnS interaction occurs between two nodes in the network. As discussed earlier, the attack on the PnS-CAN system simply reduces to identification of the transmitting node for each individual bit of the frame. Since there are just two nodes in each PnS-CAN round, the adversary simply needs to distinguish between the signals transmitted from the two nodes (binary hypothesis testing). Here, we present a general outline of the attack methodology that the an attacker may follow.
(Data Collection) The adversary can observe the signal transmission on the bus for a long duration prior to the attack. Note that the any CAN-compatible node can synchronize to the transmitter and identify and sample individual bits in a transmitted frame. Consider that the adversary samples each bit k times. We denote these bit observations by T = {x −∞ , . . . , x 0 }, where x i ∈ X k = R k is a vector of samples of the bit from the bus. We assume that the system has M ECUs connected to the bus. Thus the observations x i correspond to transmissions from any of the M ECUs over a period of time. For traditional CAN networks, such data is not labeled as the packets do not contain identifying information. However, an adversary can generate labels for the data by activating known ECUs and observing their output.
(Classifier Training) An adversary trains classification functions, D Ni,Nj : X n k → {0,0} n , for each pair of labels N i , N j , that estimate the the sequence of transmitters based on the input observations. We note that using {0,0} represents the process of differentiating between the transmitters, rather than identification. This represents a larger class of classifiers, as any classifier that can correctly assign the labels, can also differentiate between the transmitters. The adversary can train the classification functions directly from T , using a variety of supervised or unsupervised techniques, e.g. binary support vector machines (SVM), LSTM, Convolutional Neural Networks [21].
For scenarios where the node does not have knowledge cannot acquire knowledge of the participating nodes or where the training data is unlabeled, the node may train a generalized decision function D 0,0 : X n k → {0,0} n , that uses a classification function preceded by a selection approach (such as maximum likelihood based estimator) select the best function. Clearly, the performance of a generalized classifier is sub optimal compared to the classifier for a particular pair of nodes. Thus an adversary, without apriori knowledge of the transmitters has a significant disadvantage.
(PnS-CAN compromise) During PnS-CAN operation, for an adversary to extract the key, it does not require perfect identification of the node identity. Since the PnS system involves just two ECUs at any time, its task is to simply distinguish between the transmissions from the two participating ECUs. Consider the scenario where two nodes N i , N j execute the PnS protocol to produce n bits. The adversary observes the k sample values for each of the n bits as x i = {s 1 (i), s 2 (i), . . . , s k (i)}, 1 ≤ i ≤ n and uses the classifier D Ni,Nj (or general classifier in scenarios where N i , N j is unknown) and obtains a sequence of estimates (T 1 ,T 2 , . . . ,T n ) ∈ {0,0} n .
For PnS-CAN, classification without correct labeling of the nodes still reveals the complete secret (or its inverse). Thus the disadvantage of the weaker adversary is simply 1 bit of entropy, which is insignificant and results in violation of system security. We note that methods from CAN identification literature, e.g. from [18]- [20], [22], can be directly mapped to this generalized outline to attack the PnS-CAN scheme. However, the accuracy may be lower since the identification is for a single bit rather than a group of bits (frame).

C. Timing Based Attack Evaluation
We demonstrate an attack on the PnS-CAN scheme using the timing characteristics described in Section III-A. Our choice of the timing parameter is governed by several factors 1) Timing represents a phenomenon that is independent of the node characteristics. In fact, it depends only on synchronization and propagation aspects. Thus it can be applied to all networks. 2) Timing attacks demonstrate the vulnerability of the unprotected system against a very simple adversary. 3) The timing component represents a feature that has not been specifically evaluated in [22]. Other features from [22] can be directly applied to attack PnS-CAN via our framework described in Section III-B.
We utilize the oscilloscope to obtain samples of the differential bus voltage at 125M samp/s. The transitions are identified by as points of large change in bus voltage (greater than the CAN trigger) followed by a steady state over atleast half the bit width. We utilize the 50% point of the transition to compute the rise time, fall time and latency.
First, we investigate the separability of the nodes by measuring the propagation delays of the nodes synced with respect to the observation point. In Table I, we enumerate the propagation delays from each node. Intuitively, nodes that have similar propagation delay would be difficult to differentiate (in the perfectly synchronized scenario). Further, in Table II, we enumerate combinations of nodes have the least (and maximum) overlap. Such nodes pairs correspond to the nodes with the largest (and smallest) adversarial advantage.
In Fig 4, we illustrate a snapshot of the CAN protocol between two nodes as observed by an adversary. Intuitively, the attack exploits the difference in propagation delays by synchronizing to one of the transceivers and estimating the transmitter based on the rise and fall time offset. There are two key features of the PnS-CAN implementation that aid our analysis.
1) The initiating node transmits the PnS header and the secondary node synchronizes to the initiating node. Since only a single node is transmitting during the header phase, it is easy to estimate the timing variation for the synchronous bits. 2) As described in Section II-F, the random bits are interleaved with the inverted bits. This introduces dependence in successive transmissions as it enables only certain transitions during the PnS phase. This can be utilized to estimate the bits in some cases.
The detailed attack is be described as Attack PnS-TwoParty. We utilized this to identify the secret key for 12 pairs of nodes in our setup. With minor modification of the threshold parameters between different iterations, we were able to successfully identify all the secret bits exchanged between each pair.

Attack: PnS-TwoParty
1) The adversary synchronizes to the first 1 to 0 transition, i.e. start of frame bit (SOF). The transmitting node is the referred to as the primary node.
2) The adversary utilizes the first 19 bits of the header to estimate the expected variation parameters of transition times (µ p , σ p ).

Start of the PnS data frame 3) If the bit value has changed, compute the transition time.
Compute the bit triggering the transition by comparing the transition time to a threshold τ , where τ is a function of (µ p , σ p ). Soft synchronization 5) If the secondary node ever triggers a recessive to dominant transition, resync to the secondary node and switch the roles of the primary and secondary nodes. This is depicted by (r) in Fig. 4.

IV. COUNTERMEASURES FOR PNS-CAN
As discused, the PnS-CAN module is susceptible to a range of characterization attacks due to consistency of the features of the physical signals from individual nodes. While this is good for robustness of the system, the CAN standard allows for significant variation of these properties. Thus, intuitively, we design the countermeasures to add controlled noise to the physical signals, such that signals from different nodes are indistinguishable for an adversary. The goal of the noise addition is to minimize the adversarial advantage between nodes.
Here, we propose mitigations at different levels of abstractions, namely the transceiver hardware level, CAN controller level and the system level. At the hardware and controller level, the goal is to minimize the adversarial advantage between all ECUs either by adding noise or improving cooperation between the nodes. At the system level, the goal is to minimize adversarial advantage by restricting interaction between highly identifiable nodes. It should be noted that the performance of the countermeasures proposed here is highly dependent on the CAN properties. Thus, they are proposed with the goal of minimizing the leakage, rather than provably eliminating it. We leave as an open problem, the design

A. Activating Multiple ECUs
The voltage observed by an adversary is a function of strength of the current source and impedance of the network between the observer and the current source. For a nonuniform network, this directly relates to the physical positions of source and the observer. To prevent identification by the adversary, voltage can be varied for each transmission of the dominant bit by using a random number of current sources, located at different points in the network.
Our experimental results demonstrate that the observations at a single point due to dominant bits from multiple transceivers is different. Such a phenomenon can also be observed in box (c) of Fig 4. In Table III, we enumerate the output at the observer due to simultaneous transmissions from different transceivers connected to the bus. For increased variations, we performed experiments using 3 different transceiver families, i.e. nodeN 1 (MCP2551), nodeN 2 (TJA1040) and nodeN 3 (TJA1041).
Similar to variation in sources, adding a random number of sink nodes may vary the observation by an adversary. In the regular setting, each node on the bus that is not transmitting acts as a sink. Thus, we can vary the number of sinks on the bus by adding the capability of electrical isolation of non-participating nodes. Thus any transceiver with such a capability can be in 3 distinct modes, i.e. transmitting a dominant signal, transmitting a recessive bit (or just passive), or electrically isolated. In Table IV, we outline the voltage observations of the adversary for different states of the tri-state nodes. The 'X denotes a transceiver that is electrically isolated. Ideally, with N transceivers, we can obtain 3 N − 2 N different voltage levels. The variation of voltage levels with a bit can decrease the probability of its identification. We outline a few architectures to utilize this feature to prevent adversarial information leakage.
(Hardware level) Multiple transceivers per controller -The simplest method to vary the number of active transceivers is by equipping each node with multiple transceivers. For each dominant transmission, the transciver can select any combination of transceiver states to transmit the bit. Similarly for recessive bit transmission, the transceivers can be toggled between the isolated and receiving mode. If each controller is equipped with N transceivers with isolation capability, the node can output upto 3 N − 2 N voltage levels for the dominant transmission and 2 N − 1 levels for recessive bit transmission. Thus, for each PnS transmission that is usable as a secret, i.e. one of the nodes transmitting a dominant bit and the other transmitting a recessive bit, the system can cycle between  (3 N − 2 N )(2 N − 1) voltage levels. Thus, even a system with 2 transceivers per controller, the adversary would observe 15 different voltage levels for each transmission from the node pair.
Though this countermeasure incurs additional cost, one of the advantages of hardware level countermeasures is that they can be implemented independent of the controller. Thus, the frequency of switching between different transceiver states can be higher than the bit rate, effectively causing several noisy variations over the bit period.
(Controller level) Passive cooperation -A lower cost alternative to adding new transceivers is by enabling the nodes connected to the network to cooperate with the transmitting nodes during the PnS-CAN protocol. Each node that does not need to observe signals on the CAN bus can at random time instances, isolate its transceiver (i.e. the 'X' state). Note, that since this done only during the PnS-CAN data transmission phase, it does not violate the CAN requirement of nodes listening for critical frames. For nodes with multiple transceivers, this can be implemented without the controller signals, if one of the transceivers always stays connected.
(Controller level) Active cooperation -A node typically monitors the CAN bus by sampling the bus at a high frequency. If it detects a transition from recessive to the dominant state, it can choose to (based on a random choice) actively assist the transmitter by randomly transitioning between the idle and dominant state for the remainder of the bit duration.
(System level) Active cooperation -If the PnS-CAN protocol is executed between a group of nodes, as described in Section II-F, all nodes in the chain that precede the currently active nodes are aware of the expected transmissions by one of the participants. Thus, active cooperation may be provided by such nodes during the expected dominant bit transmission, by synchronously transmitting a 0. For systems that utilize cooperation at this level, the adversarial advantage between nodes becomes a function of their position within the chain. Thus, the adversarial advantage between a pair of nodes decreases as their position moves further down the chain. As demonstrated by the attack mechanism in Section III-C, since the nodes synchronize at the beginning of each frame, the transitions for a bit occur within a well defined and distinct time interval, leading to easy classification. Thus, addition of random jitter to each dominant bit transmitted can decrease the probability of identification by the adversary. To achieve this, for each node, nodeN i , we introduce a jitter interval (t l Ni , t h Ni ), over which the node uniformly adjust its bit start time and correspondingly adjusts the bit duration. The variation of the intervals allows a system designer to minimize the leakage within the jitter tolerance bounds of the system.
In Fig. 5, we illustrate the different system parameters that govern the leakage to an adversary for 2 nodes. We define propagation delay from nodeN i to the adversary is t i a , i = 1, 2, and the propagation delay from nodeN 1 to nodeN 2 as t 12 . Assuming that the nodes are synchronized to a common reference point r, we represent by t ra , t r1 , t r2 the offset of the nominal bit start time relative to the common reference. Further, we consider t 2 p to represent the processing time of the bus signal through the circuit of nodeN 2 . If the adversary observes transitions from nodeN 1 and nodeN 2 , the difference in the observation times of the both the transitions,t 12 , can be expressed aŝ Here,t 12 determines the ability of the adversary to differentiate between the two transmitters. Based on the location of the adversary, the delay varies from 2t 12 +t 2 p in region R 1 to t 2 p in region R 3 . If the nodes utilized the jitter-intervals to determine the start times of the bits, the adversary would observe the bit transition times as samples from the two distributions, over the support sets I 1 = (t l 1 , t h 1 ), I 2 = (t l 2 +t 12 , t h 2 +t 12 ), for each node nodeN 1 , nodeN 2 respectively. The leakage to the adversary is determined by its ability to distinguish between a sample from I 1 and I 2 . Thus the goal of the system designer is to increase the overlap between the two intervals. The nodes minimize the offset as follows, 1) Prior to PnS-CAN, each node estimates the propagation delay to the communicating node based on a recessive to dominant transition from the other node. 2) The nodes disable soft re-synchronization during the CAN frame transmission. The secondary node nodeN 2 keeps itself synchronized to the primary node nodeN 1 for the duration of the PnS execution.
3) The nodes select a parameter α based on the propagation delay and maximum permissible jitter. 4) The nodes set the jitter intervals as (t l 1 , t h 1 ) = (0, αt 12 ) and (t l 2 , t h 2 ) = (−αt 12 , 0). The start time of the bit is picked uniformly from the interval. For practical scenarios, the intervals I 1 and I 2 cannot be defined to overlap completely. Thus, it is not possible to completely eliminate leakage to the adversary. However, by increasing the overlap, we decrease the adversarial advantage.

C. System Level -Tree-Based Group Key Scheme
It is clear that the leakage between different pairs of nodes, varies significantly. An alternative mechanism to reduce adversarial leakage would be to prevent (or minimize) interaction between highly susceptible nodes. Consider the scenario of establishing a key between a group of nodes using the GroupKey-Linear protocol in Section II-F. Intuitively, the order of the node communication can be modified to prevent leakage prone nodes from communicating. First we consider the following modification to the GroupKey-Linear, for organization of the nodes in a tree-like structure.

GroupKey-Tree:
1) The group communication order . . , N k } is broadcast to all participants by the gateway (GW ). 2) First, N 1 performs PnS with N 2 to establish a key.
Then N 2 utilizes the result to perform PnS with any N i , i ≤ 2 and updates the key. Proceeding forward, N j will performs PnS with any n i , i < j.
3) The process continues till n k is reached and the group key is generated. Functionally, the GroupKey-Tree protocol is equivalent to GroupKey-Linear. The GroupKey-Tree scheme presented here should not be confused with the tree-based scheme presented by the original authors in [12], as that utilizes a binary balanced tree. We have no such constraints here. It should be noted that for both GroupKey-Tree and GroupKey-Linear, the number of interactions between the nodes are the same. Thus GroupKey-Tree introduces no additional communication overhead.
Successive interactions leak information to an adversary, and such leakage is dependent upon the participants. Thus intuitively, the each node in G K , instead of communicating with a fixed single node, can select the node from a pool that minimizes adversarial leakage. We utilize the adversarial advantage described in Section III-B to establish a leakage-aware node order for group key generation as follows, 1. Mapping -First, the GW maps the network and the adversarial advantage between all pairs of nodes {1, 2, . . . , M }. The adversarial advantage can be represented as weights of the edges of a fully connected graph K M , where the ECUs represent the vertices. Thus, the GW learns the weighted graph. This can be performed by several methods, i.e determined offline during system installation and programmed into the GW , or using observing network data to dynamically determine classification functions to compute the adversarial advantage.
2. Ordering -For any given group G K , the GW , using the graph obtained during mapping, reorders the nodes such that the overall leakage is minimized. For the GroupKey-Tree scheme, the node order takes the form of a tree. The criteria of minimization can be varied based on the countermeasures for pairwise PnS and adversarial restrictions.
We define by K M [G K ], the subgraph induced in K M by G K . Thus, for key generation using GroupKey-Tree, the process of defining the node order using K M [G K ] is tantamount to finding the minimum spanning tree over the graph. Define T as the set of all possible spanning trees of the graph K M [G K ]. We define the node ordering problem as finding T * ∈ T that solves, where (i, j) is the edge in the tree and d i,j is the adversarial advantage for nodes i and j. This minimizes the maximum cost path in the tree. For a group key scheme over the tree, leakage at any step would leak the entire key. Intuitively, we want to ensure that the weakest path in the scheme does not leak sufficient information to the adversary. Computationally, this requires the adversary to compute the min-max spanning tree over K M [G K ]. Since every minimum spanning tree is also a min-max spanning tree, the solutions that minimize total leakage also minimize the max-link leakage. Thus it is both computationally and performance optimal to simply compute the minimum spanning tree over the subgraph. Several well known algorithms are present in literature for such optimization, e.g. Prim's algorithm [23], Kruskal's algorithm [24].
3. Rank assignment -Once the order of communication has been determined by the GW , can be communicated to the members of the group. As discussed in Section III-B, the lack of knowledge about the node order would force the adversary to use a generic classification function D 0,0 , thus effectively decreasing the adversarial advantage. Thus, the GW can use 'privacy preserving' methods to distribute the node order. This can be achieved by several mechanisms based on the adversarial assumptions and pre-shared knowledge between the GW and the nodes.
As an example, consider a system using the authenticated variant of the PnS-CAN scheme, [12]. Here, the GW shares a secret (cryptographic key) with each node. Thus a node can utilize this key to mask the identity of each node, and hence the overall order of the nodes. Consider f (·, ·) to be a cryptographic pseudorandom function (PRF). Thus, the order of the group {N O1 , . . . , N O K } may be communicated as where r ← {0, 1} n represents a nonce.

V. DISCUSSION
The goal of the discussion in this paper is twofold. Firstly, it demonstrates that even simple physical features can be utilized to compromise the PnS-CAN scheme. Secondly it illustrates simple techniques that can be utilized to modify the physical characteristics and reduce the information leakage. We emphasize that neither of these investigations is intended to represent the comprehensive attack vectors or defense mechanisms.
For example, given the robustness of the CAN protocol, one can imagine that there are a series of fundamental component variations that can be utilized to add noise to the characteristics discussed here. Similarly, future results in classification and learning theory can be utilized to improve the performance of the adversary beyond what has been discussed here.
There are several open questions that remain with the countermeasures discussed here. For example, there are fundamental trade-offs that can be investigated between the countermeasures. As an example, addition sufficient jitter to the bit timing for effectiveness, while maintaining robust sampling between the farthest nodes may require operation of the system at a lower speed. However, this improves the observability of the adversary and significantly impacts transients (and any associated countermeasures). Further, improved countermeasures can be developed by identifying correlations between the adversarial advantage and physical features. While we have studied certain empirical dependencies, a comprehensive analysis can yield better insight into identification of dominant physical characteristics that can be modified.
For our attacks and countermeasures, we utilized a simple laboratory setup to emulate the CAN system. A real deployment of the system is subject to far more noisy conditions and many subtle electrical effects, e.g. transmission line phenomenon, that are not accurately in our setup. Thus even though this work serves as a proof-of-concept, the investigation of these attacks and countermeasures can yield different results in a real system, and warrants further investigation.
The countermeasures discussed here span several implantation layers and components. While simple hardware and controller changes can uniformly improve the system security for all the nodes, they require changes to the CAN transceivers or controllers, which may not be very desirable in a real system. Further, for deployment of such systems in highly regulated environments, such as automotive, the new changes would have to be thoroughly tested to not impact the system reliability. This can significantly increase the cost of implementing such countermeasures.
On the other hand, system level changes can be easily implemented, but have impact on leakage for limited scenarios. In a practical system, the designer would deploy several additional mechanisms in addition to the countermeasures proposed here.
For example, there may be system level mechanisms that limit the data gathering ability of an adversary. Since the performance of the distinguishing functions used by an adversary depends on the training data available to it, lack of data can reduce the leakage. Similarly, the system designer may electrically isolate common access mechanisms, such as the OBD-II port to limit the observation of physical characteristics. As discussed briefly, the lack of apriori knowledge about the participants of the protocol can reduce adversary performance by limiting the distinguishing functions that can be used. Such masking techniques could be implemented by designer at a system level in addition to the proposed countermeasures.

A. Conclusion
While the PnS-CAN scheme is a promising mechanism for generating group keys, it is highly susceptible to probing attacks by even simple adversaries. We presented a general methodology for attacking the system and demonstrated a simple timing based attack. We discussed several sources of physical identifiers that can be used by an adversary. We proposed several mechanisms to mask these identifiers at the hardware, CAN controller and system level. This work serves as a proof-of-concept for the existence of attacks on the PnS-CAN schemes and the the ability of the system designer to prevent them.

APPENDIX A NODE DISTANCE
To characterize the difference in leakage between different nodes, we define the adversarial advantage for interaction between two nodes (N i , N j ), as probability of successfully distinguishing between them, i.e. identify the transmitting node, based on the bus observations. For practical scenarios, we can define the adversarial advantage based on the performance of the trained classification functions defined in Section III-B, applied to empirical data. We define by x Nj i , the samples of transmissions of bit i from node N j . Thus we define the adversarial advantage for nodes (N i , N j ) as, d Ni,Nj = 1 4 P r D i,j (x N1 1 , x N1 2 ) = (0, 0) + P r D i,j (x N1 1 , x N2 2 ) = (0,0) + P r D i,j (x N2 1 , x N1 2 ) = (0,0) where P r denotes the probability over all random choices made in the decision function.
In (2), we assume each sequence is equi-probable, which is typically the case for the PnS-CAN protocol. For scenarios where information about the participating node is not available, we define a generalized adversarial advantage dg i,j by using the generalized decision function D 0,0 in place of D i,j . Clearly, dg i,j ≤ d i,j for all nodes.
Such a notion of distance can be used to quantitatively measure the impact of the countermeasures implemented by the system designer. Alternatively, this can provide a numerical measure of the adversarial strength for any optimization that the designer may choose to perform.