CAN-SQUARE - Decimeter Level Localization of Electronic Control Units on CAN Buses

The CAN bus survived inside cars for more than three decades due to its simplicity and effectiveness while protecting it calls for solutions that are equally simple and effective. In this work we propose an efficient mechanism that achieves decimeter-level precision in localizing Electronic Control Units (ECUs) on the CAN bus. The proposed methodology requires two connections at the ends of the bus and a single rising edge, i.e., the start of a dominant bit. Since several such rising edges are present in every frame, malicious devices may be easily localized with high accuracy from single frame injections. Our methodology requires only elementary computations, e.g., additions and multiplications, which are trivial to perform and implement. We prove the feasibility of the proposed methodology inside a real car and perform more demanding experiments in a laboratory setup where we record modest overlaps only between nodes that are 10 cm apart. We prove resilience against replacement and insertion attacks as well as against temperature variations in the range of 0-60 degrees C.