Securing CAN-Based ISO 11783 communications in agricultural vehicles using OPC UA

• A novel OPC UA implementation which does not use Ethernet/IP but rather CAN bus. • OPC UA security features function over a CAN-based network. • Encryption and authentication is enabled for inter-machine comms in agriculture. • It is possible to share secret data but it is too slow to be of practical use for real-time data updates. • Frequent rekeying via OPC UA allows encryption via CAN with low overhead. The ISO 11783 standard defines machine-to-machine communications via 250 kbit/s CAN bus, however, it does not define any cybersecurity framework. The lack of cybersecurity can be problematic because an ISO 11783 Task Controller and implement must share sensitive information, such as yield rates, unencrypted and commands are sent without authentication of their origin. The OPC UA standard defines a robust cybersecurity framework and OPC UA is standardised in such a way as to allow alternate transport layers to be utilised. A program is presented which modifies the open-source OPC UA library open62541 to open an OPC UA secure channel between devices connected via an ISO 11783 network. This allows signed and encrypted data transfer between an implement and a Task Controller but with a large overhead compared to standard ISO 11783 messages. It is shown that this secure channel can be used to share session keys when the machines are not actively working (such as during headland turns) and that these session keys can be used for alternate cybersecurity algorithms with lower overhead. A proof-of-concept is presented which uses an open62541 client and server to share keys securely over an ISO 11783 network when the implement’s sections are turned off and uses the Blowfish algorithms to encrypt CAN frames to encrypt data transfer between the Task Controller and implement without increasing the number of frames that must be sent.