Application of Deep Packet Inspection Technology in Automotive Networks

By Christopher Mash, Senior Director, Automotive Applications and Architecture, Marvell

Look inside any car today and you ’ll see an increasing number of networked devices. Of course, many of the key applications that use network capabilities in the car aren’t as visible, but that doesn’t make them any less important. The use of network protocols has grown significantly over the past decade, in part due to the growth in the number of electronic control units (ECUs) that handle many specific functions , such as adaptive cruise control, anti-lock brakes, and central locking functions .

With the increasing demand for bandwidth , multiple new networking standards and topologies have been introduced in the car. This has resulted in multiple technologies and standards for communication between ECUs, including CAN, CAN-FD, FlexRay, LIN, and MOST, and even other technologies and standards such as USB and LVDS. Sensor data sharing can be achieved in a specific way according to different bus networking methods, such as CAN and LIN , which are transmitted in a shared bus manner without any device-level data exchange (or forwarding). In the past five years , more complex functions in the car driven by advanced driver assistance systems (ADAS) have required higher levels of connectivity. The throughput of data transmission has increased significantly , while lower network latency is also required, which has prompted people to consider which network technology should be adopted . This trend is very consistent with the growth , the improvement of Wi-Fi network capabilities, and the support for the future ease of use of vehicle -to- everything ( V2X) systems. It is perhaps not surprising that Ethernet has become the de facto vehicle networking protocol standard for new vehicles. Legacy network protocols will continue to be used for some time, so it is important to increase support for these legacy network protocols in the Ethernet ecosystem . IEEE 1722 has defined a method to encapsulate traditional communications (such as CAN and LIN) in Ethernet packets, with the goal of making Ethernet the premier automotive networking technology . With its long history of use outside of the automotive sector , Ethernet has impressive capabilities that will help simplify the complexity of automotive networks.

The wiring harness is one of the top five most expensive and heaviest components in a car, so using a single proven network will help reduce cost and weight . Both the 100Mbps and 1Gbps automotive Ethernet standards already require a pair of unshielded copper cables for transmission.

The increase in Internet connectivity in cars also brings potential network attack surfaces and intrusion points, making security more important , but it also opens up the possibility of Ethernet switches providing more network functions by analyzing data flows . For embedded developers, it is very challenging to analyze all incoming data in real time at line speed without introducing any delays with limited computing resources. In order to implement the necessary protection or other functions, a set of predetermined rules are required to detect data packets, which can be specifically executed based on specified data values ​​or conditions , such as new audio/video applications and time -critical or sensitive network demand scenarios .

In a traditional Ethernet switch, the decision about which port a packet should be forwarded to is based on Layer 2 (L2) of the OSI network model, see Figure 1.

Figure 1: OSI model and packet forwarding.

In Figure 1, if the source address (SA) of an incoming frame has not been previously recorded , it is added to the address database along with the incoming port number of the frame. If the destination address (DA) already exists in the lookup table of the bridge, the packet is forwarded accordingly, otherwise the frame is flooded . For many years, IEEE standards governing the protocols used at L2, such as 802.1 MAC bridges, VLANs, and port-based network access control standards, have focused on the first 16 bytes of the Ethernet frame. These standards have also continued to evolve, with recent additions including Ethernet Audio Video Bridging (AVB) and time - sensitive networking standards such as 802.1AS. In particular, the need for deterministic networking in the automotive environment is becoming increasingly urgent to ensure timely and reliable data transmission in the network . Locking all ECUs to a single master clock source and maintaining AV content quality are just two examples, and more enhanced capabilities are being introduced to facilitate the inspection of OSI layer 3 information, such as IPv4/IPv6 packet priority and IPv4/IPv6 snooping.

While the above techniques are generally sufficient for automotive Ethernet applications, there is a need for greater flexibility and the ability to inspect packets in real-time “ wire speed ” to enable advanced packet classification, debug/diagnostics and security features. However, implementing Deep Packet Inspection (DPI) is a trade-off for the limited space and sensitive budgets of automotive applications . In the past, it was not possible to achieve this wire-speed packet classification, primarily due to the need for a large number of compute-intensive devices that took up more board space and increased the bill of materials (BoM). However, Marvell’s industry-leading secure Gigabit Ethernet switches can provide this capability in a compact package using a DPI engine derived from enterprise networking .

The DPI engine uses a technology called Ternary Content Addressable Memory (TCAM) . TCAM receives packet data and compares its contents to predefined filters to find matching events. Based on the match or mismatch result, the DPI engine can determine the subsequent processing . This method provides three possibilities for matching binary data (hence the name tri- state ), each data bit can be set to 0, 1 or " X " don't care . The " don't care " rule is very useful for setting masks and can easily check multiple data segments. By placing a large number of parallel arrays within the bridge pipeline , TCAM supports classification and modification of data line rates on multiple ports simultaneously. Depending on the specific configuration , the processing of TCAM can extend to some bytes in the packet header and even the payload area. DPI can perform operations such as changing the destination port of the packet, dropping the frame, mirroring the frame to another port, changing the frame or queue priority, etc.  

Let’s look at three use cases for DPI in the car . The first is for debugging/diagnostics. The Ethernet On-Board Diagnostics (OBD) interface is designed as a 100BASE-TX port with a speed of 100Mbps. While this seems to be suitable for most applications, the reality is that the contention rate in a fully utilized switch will generate data transmission rates exceeding 100Mbps, so it is impossible to mirror all frames in the switch without affecting the performance of the actual data flow. This causes packet loss , so not all packets can be mirrored. Another approach is to use DPI to identify and classify only the frames of interest, see Figure 2. In this example, the problem is the Precision Time Protocol (PTP) frames. The DPI rule can be set to mirror PTP messages on all ports to the OBD port, for example, by configuring the EtherType (0x88F7) or MSG ID. Even if the switch is operating at maximum load, all PTP related frames will be mirrored to the OBD port.

 Figure 2: Using TCAM for debug/diagnostic applications.

Another application of DPI is security. Identifying legitimate Ethernet packets can consume a lot of computing resources of the CPU located in the data path. This means that the processing power required to achieve real-time, low-latency classification will exceed the space, B O M and processing power that most automotive environments can provide . However, TCAM provides a way to check whether each packet entering the Ethernet switch is in the correct network format.

Figure 3: Wireshark screenshot showing unacceptable TCAM packet loss.

In the example shown in Figure 3, the TCAM mask is set to allow only incoming packets within a range of MAC DA, SA, and VLAN IDs , which are destination address 00:01:02:XX:XX:XX (matches all MAC DA addresses in the range of 00:01:02:00:00:00 to 00:01:02:FF:FF:FF), source address 00:11:22:XX:XX:XX (matches all MAC SA addresses in the range of 00 :11:22:00:00:00 to 00:11:22:FF:FF:FF), and VLAN ID: 0x0XX (matches all VLAN IDs from 0x000 to 0x0FF).

This example only uses L2 information from the packet, however, the TCAM can also use L3, L4 or higher layer information as part of the TCAM match with appropriate configuration .

TCAM provides the only cost-effective, low-latency and resource -efficient way to inspect every packet entering the switch. Packets that fail the above inspection can be discarded or processed in other ways.

In the final use case , DPI is used to perform routing decisions on Ethernet data packets . As mentioned earlier, the move is to integrate many different traditional automotive network protocols (such as LIN and CAN) into Ethernet, and the long-term goal is to reduce the complexity and cost of automotive networks. Although there are gateways to implement this type of packetization , once they have completed the packet , a forwarding decision must be made. Using DPI provides a way to make forwarding decisions based on the data within the packet . The format of the data packet has been defined according to IEEE1722-2016, so TCAM can be used to classify the data packet (such as CAN) and use the CAN_BUS_ID and CAN_IDENTIFIER to create routing actions accordingly.

Using TCAM-based DPI technology in the automotive network environment can open up many new applications, standards and functions that were not previously commercially viable. As connected cars become a reality, manufacturers are facing huge challenges in how to incorporate more functions in terms of security while reducing the complexity of the network environment . DPI makes it possible to achieve both goals .