Introduction

Heavy-duty vehicles (HDV), maritime vessels, and agricultural machinery rely on J1939, NMEA 2000, and ISOBUS protocols for communication. These protocols are built on the Controller Area Network (CAN) standard, which lacks inherent security mechanisms. CAN messages are transmitted in plaintext, without authentication or integrity verification, making them vulnerable to attacks such as eavesdropping, spoofing, and denial-of-service (DoS).

Given the critical role of these networks, various cybersecurity solutions have been proposed. While the SAE J1939-91C standard introduces cryptographic security, it is based on CAN-FD and is not compatible with legacy systems. To address these challenges, we have developed a security solution that integrates encryption and authentication into J1939, NMEA 2000, and ISOBUS, without requiring additional hardware acceleration.

Security Challenges in CAN-Based Networks

CAN-based networks are susceptible to several cyber threats due to their broadcast nature and lack of built-in security measures. The main security vulnerabilities include:

• Eavesdropping – Attackers can intercept plaintext CAN messages and gain insights into network operations.
• Spoofing – Malicious nodes can impersonate legitimate devices, injecting false messages into the network.
• Replay Attacks – Attackers can capture and resend legitimate messages to manipulate vehicle behavior.
• Denial of Service (DoS) – Attackers can flood the CAN bus with high-priority messages, disrupting communication.

Due to the increasing number of devices in industrial and maritime environments, network congestion is another growing issue. The CAN protocol has limited bandwidth (250-500 kbps for standard implementations), and the rise in connected devices further constrains network performance.

Secure Communication with Encryption

To mitigate these vulnerabilities, our solution introduces an encryption mechanism at the protocol level, ensuring that J1939, NMEA 2000, and ISOBUS messages remain protected. Unlike standard encryption methods that add significant overhead, our approach optimizes performance while maintaining security.

The implementation is based on an authenticated encryption algorithm, ensuring both data confidentiality and integrity. A key feature is its ability to handle encrypted and unencrypted messages simultaneously, allowing for gradual network migration to fully secure communication.

• Minimal impact on network bandwidth – Encrypted messages remain close in size to plaintext messages. More detailed results can be ob tained in the next section.
• No additional key exchange overhead – Ensures security without excessive traffic.
• Resistant to eavesdropping and replay attacks – Protects against the most common CAN-based threats.

OSI Layer Model and Solution Implementation

OSI Model and CAN-Based Networks

The Open Systems Interconnection (OSI) model defines a standard networking framework consisting of seven layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application. J1939, NMEA 2000, and ISOBUS protocols implement five layers of this model:

1. Physical Layer – Defines electrical and physical specifications for CAN communication.
2. Data Link Layer – Handles frame structure, error detection, and arbitration.
3. Network Layer – Manages addressing and routing of messages between multiple networks.
4. Transport Layer – Responsible for message segmentation and reassembly.
5. Application Layer – Defines data structures, message formats, and protocol-specific communication rules.

However, these protocols lack a Presentation Layer, which is crucial for data encryption and compression. Our solution introduces a new Presentation Layer to handle encryption while maintaining compatibility with existing CAN-based networks.

Encryption Implementation in the Presentation Layer

The Presentation Layer is added between the Transport and Application Layers and is responsible for encryption and decryption of messages. This ensures that CAN frames are secured before transmission and decrypted upon reception.

Our solution uses ASCON, a lightweight cryptographic algorithm optimized for embedded systems. ASCON is designed for authenticated encryption, ensuring both data confidentiality and integrity while maintaining low processing overhead. Its main features include:

• Efficient encryption and authentication using a sponge-based construction.
• Minimal computational resources required, making it ideal for low-power embedded devices.
• Resistance to side-channel attacks, ensuring a high level of security.
• Optimized for high-speed communication, reducing the impact on CAN bus performance.

By integrating ASCON encryption into the Presentation Layer, J1939, NMEA 2000, and ISOBUS messages are secured without affecting network compatibility.

Implementation Across Different Systems

The library is designed to be highly portable, allowing deployment across different types of systems:

Our custom CAN driver for Baremetal ensures low-latency processing of CAN packets while handling interrupt-driven event processing.

Communication and API

The library provides two methods of interaction:

• Callback Functions – Event-driven model for processing received CAN messages.
• Standard API Interface – Allows applications to send and receive encrypted messages programmatically.

This flexibility ensures easy integration into existing automotive, industrial, and maritime systems.

Configuration and Operating Modes

The library supports multiple operating modes, allowing it to be customized based on network requirements:

• Transparent Mode – Pass-through communication with optional encryption.
• Fully Encrypted Mode – Ensures all messages are encrypted before transmission.
• Hybrid Mode – Allows mixed encrypted and plaintext communication.

These configurations make the solution scalable and adaptable for different use cases.

Results: latency and overhead

To assess the efficiency of the encryption implementation within the Presentation Layer, we conducted performance measurements focusing on encryption time, decryption time, overall transmission latency, and network overhead. The goal was to ensure that adding encryption does not introduce unacceptable delays or significantly impact CAN network utilization.

Encryption and Decryption Time

One of the key requirements for securing J1939, NMEA 2000, and ISOBUS communication is ensuring that encryption and decryption operations are fast enough to meet real-time constraints. Measurements show that:

• Encryption and decryption together take between 4 microseconds and 160 microseconds, depending on the message size.
• The fastest encryption+decryption time (4 µs) is observed for small messages (e.g., control signals or sensor data).
• Larger messages, such as J1939 diagnostic
• Despite variations in message size, the total encryption+decryption time remains well below 1 millisecond, ensuring real-time compatibility with CAN-based systems.

Transmission Latency

When transmitting encrypted messages over a CAN bus network, the additional processing time for encryption and decryption does not introduce noticeable delays in message delivery. Even in high-traffic conditions, the measured end-to-end latency (encryption, transmission, and decryption) consistently remains under 1 millisecond. This makes the solution suitable for applications where low-latency communication is critical, such as industrial automation, maritime navigation, and vehicle diagnostics.

Network Overhead and Message Size Impact

Since encryption adds metadata (such as an authentication tag) to ensure data integrity and protection against replay attacks, it is important to evaluate the impact of this additional information on CAN network efficiency. The measured size overhead varies depending on message type, encryption block size, and message distribution patterns:

• Overhead ranges from 5% to 15%
• Smaller messages (such as sensor data packets) experience a slightly higher relative overhead due to the fixed authentication tag size.
• Larger messages (such as J1939 diagnostic messages) see a lower relative overhead since encryption metadata accounts for a smaller percentage of the total message size.
• The encryption process ensures that minimal additional traffic is generated, preserving CAN bandwidth efficiency.

6. Conclusion

By integrating encryption into J1939, NMEA 2000, and ISOBUS, our solution enhances network security while minimizing performance impact. The Presentation Layer, which implements encryption and authentication, ensures protection against eavesdropping, spoofing, and replay attacks without introducing significant overhead. The ability to support both encrypted and plaintext communication allows for a gradual transition to a fully secure network without disrupting existing systems.

Performance evaluations demonstrate that the encryption process is highly efficient and does not compromise real-time communication. The encryption and decryption times range from 4 microseconds for small messages to 160 microseconds for larger messages, such as J1939 diagnostic frames exceeding 1700 bytes. Even under high network load, the total end-to-end latency remains under 1 millisecond, ensuring compliance with strict real-time requirements.

Additionally, the encryption mechanism introduces minimal network overhead, which varies between 5% and 15%, depending on message size and distribution. Smaller messages experience a slightly higher relative overhead due to the fixed authentication tag, while larger messages see a lower impact. However, overall CAN bandwidth utilization remains efficient (larger messages have higher latency, but lower overhead), making this solution suitable for industrial, agricultural, and maritime applications where communication performance is critical.

Future developments will further strengthen security by expanding encryption support to ISO-TP, CANopen, and CAN FD, enabling secure communication beyond J1939, NMEA 2000, and ISOBUS. Furthermore, the introduction of a Secure Hardware Convertor will provide data protection by encrypting all CAN traffic without need for the library implementation

These results demonstrate that secure communication can be achieved without compromising network performance, making this encryption library a viable, scalable, and efficient solution for protecting CAN-based communication systems.