FlexRay Analysis, Configuration Parameter Estimation, and Adversaries

113 Pages·2017·10.61 MB·English

by  Markus Iversen Huse

FlexRay Analysis, Configuration
Parameter Estimation, and Adversaries
Markus Iversen Huse
Master of Science in Cybernetics and Robotics
Submission date: June 2017
Supervisor: Sverre Hendseth, ITK
Norwegian University of Science and Technology
Department of Engineering Cybernetics

i
Project Description
Inthispaper,theauthorpresentsananalysisofatime-triggeredautomotivecommunionnetwork.
TheprojectwascarriedoutincollaborationwithWayAS,andtheprojectvehicleusedwasamodel
year 2016 Mini One with a FlexRay communication network. The paper seeks to investigate
the possibility of manipulating the original network communication in FlexRay. In order to
accomplishthis,theauthorshall:
• DevelopthenecessarytoolsinordertoanalysetheFlexRaycommunicationnetwork.
• ValidatetheinformationwiththeinherenterrordetectionandformatofaFlexRayframe.
• EstimateFlexRayconfigurationparameters.
• InvestigateFlexRaymessagecontent.
• Researchthepossibilityofperformingaman-in-the-middleattackonFlexRay.
Trondheim,04.06.2017
MarkusIversenHuse
ii
iii
Acknowledgments
IwouldliketoespeciallythankThorHenningAmdahlforprovidingtechnicalassistance,
academicdiscussionsandinspiringperspectives.
Further,IwouldliketothankWayASforpermittingaccesstoatestvehicleinordertoanalyse
theon-boardnetwork.
Inaddition,IwouldliketoexpressmysincerethanktoSIMCOandSteinHåkonLerdalenfor
supportingmewiththispaperbyprovidingtestingequipment,andtechnicalassistance.
IwouldalsoliketothankAmelieFritschforacademicsupportthroughoutthedurationofthis
project.
Finally,IwouldliketothankSverreHendsethforsupervisingthispaperandforallowingthis
researchtobeconducted.
iv
v
Summary
Thispaperinvestigatesthetime-triggeredautomotivecommunicationprotocolFlexRay.Included
isastudyofon-boardelectronicvehicularsystems,whichfocusesonpossiblevulnerabilities
connectedtonetworkeddatatransmissions.
Inordertoprovideinformationaboutthenetworkcommunicationandconfigurationparam-
eters,aFlexRayanalysissoftwarewasdeveloped.
TheanalysissoftwareisvalidatedusingtheoriginalFlexRayframeformatfromtheprotocol
specificationandthecyclicredundancycheck(CRC)providedinthedatatransmission. Addi-
tionally,theresultsfromthenetworkanalysisarecomparedtothecommunicationofaFlexRay
networkwheretheconfigurationparametersandtheframecontentareknown. TheFlexRay
analysissoftwarewasthenusedtoinvestigatetheFlexRaynetworkofanactualvehicle.
Finally, based on the theory and experience from working with FlexRay, multiple adver-
sarysolutionsarepresented,aswellassolutionsformanipulatingframecontentofreal-time
communicationinaFlexRaynetwork.
vi
vii
Sammendrag
DenneoppgavenbeskriverbilkommunikasjonsprotokollenFlexRayogelektroniskekjøretøysys-
temermedetfokuspåmuligesårbarhetertilknyttetdataoverføring.
Forågiinformasjonomdatakommunikasjonenognettverks-konfigurasjonsparametrenei
FlexRay,bleetanalyseprogramforFlexRayutviklet.
Analyseprogrammet valideres ved bruk av det originale FlexRay-datarammeformatet og
densykliskeredundanskontrollen(CRC)imeldingsinnholdetidataoverføringen. Analysenble
sammenlignetmedkommunikasjonenietnettverkderkonfigurasjonsparametreneogmeld-
ingsinnholdet er kjent. FlexRay-analyseprogrammet ble videre brukt til å analysere nettverk-
skommunikasjonenietfungerendekjøretøy.
Tilslutt, basertpåteorienogerfaringeneopparbeidetunderoppgaven, blirflereFlexRay-
nettverksmotstanderepresentert,itilleggtilløsningerforåmanipuleremeldingsinnholdettil
FlexRay-meldingerisanntid.
viii