SUHC-LSP: A Self-Updating Hash Chain Layered Security Protocol for In-Vehicle CAN Networks

The foundation of modern vehicle control relies on Electronic Control Units (ECUs) communicating via the Controller Area Network (CAN). However, CAN was not designed with security in mind. Limited bandwidth and lack of security make CAN vulnerable, while centralized solutions like AUTOSAR SecOC suffer from high latency. To solve this problem, we propose a novel security protocol named Self-Updating Hash Chain Layered Security Protocol (SUHC-LSP), which uses a “space-time coupled” frame structure to fit a robust authentication code into the limited CAN data field. Unlike conventional schemes that require explicit freshness negotiation during routine operation, SUHC-LSP adopts a self-updating hash-chain mechanism in which chain evolution proceeds autonomously under normal conditions. In addition, SUHC-LSP introduces a self-updating hash chain mechanism that enables freshness iteration during steady-state operation. Traditional AUTOSAR SecOC configuration schemes require additional synchronization messages and freshness counter management, whereas the approach proposed in this paper eliminates the resulting bandwidth overhead while adhering to the 8-byte CAN payload limit and ensuring message authenticity and integrity. In addition, a risk-adaptive two-layer architecture is designed to balance fast speed for local messages and strong encryption for cross-domain messages. BAN-logic and ProVerif verification show that the protocol preserves authentication, freshness, secrecy, and event-correspondence properties under the stated assumptions. Experiments on an STM32 platform show that, in a 4-device prototype, the computational overheads are 1.61 ms for intra-domain communication and 0.83 ms for inter-domain communication. Moreover, analytical overhead comparison indicates that the proposed protocol has lower sensitivity to network scale than the compared schemes.