论文标题
OBD人工：一种用于汽车加密狗的模块化协议不可知的防火墙，以增强隐私和安全性
Man-in-the-OBD: A modular, protocol agnostic firewall for automotive dongles to enhance privacy and security
论文作者
论文摘要
汽车的第三方加密狗，例如从保险公司可以通过标准化的OBD-II接口提取敏感数据，甚至可以将命令发送到汽车。由于缺乏消息身份验证机制，这会导致有关与恶意设备的联系的主要安全漏洞。因此，我们通过在第三方加密狗和汽车的OBD-II界面之间放置中间人，应用模块化，无关的防火墙方法。在此特权网络位置的情况下，我们演示了如何通过OBD-II接口访问的数据流如何进行修改或限制。我们可以通过使用我们的精细粒度可配置的重写规则（专门用于工作协议不可知的规则，可以修改消息内容或延迟消息的到来。我们已经在OBD-II接口上实施了可配置防火墙的模块化方法，并成功地对市场上可用的第三方加密狗进行了测试。因此，我们的方法使一个安全层可以增强加密狗用户的汽车隐私和安全性，由于缺少有关电子控制单元级别的消息身份验证，因此具有很高的相关性。
Third-party dongles for cars, e.g. from insurance companies, can extract sensitive data and even send commands to the car via the standardized OBD-II interface. Due to the lack of message authentication mechanisms, this leads to major security vulnerabilities for example regarding the connection with malicious devices. Therefore, we apply a modular, protocol-independent firewall approach by placing a man-in-the-middle between the third-party dongle and the car's OBD-II interface. With this privileged network position, we demonstrate how the data flow accessible through the OBD-II interface can be modified or restricted. We can modify the messages contents or delay the arrival of messages by using our fine-granular configurable rewriting rules, specifically designed to work protocol agnostic. We have implemented our modular approach for a configurable firewall at the OBD-II interface and successfully tested it against third-party dongles available on the market. Thus, our approach enables a security layer to enhance automotive privacy and security of dongle users, which is of high relevance due to missing message authentications on the level of the electronic control units.
