RAPIDSEA Secure CAN Library
Production-Ready CAN Bus Encryption and Authentication Library with Encryption, Authentication, and Replay Protection - AUTOSAR SecOC Compatible
Production-Ready CAN Bus Encryption and Authentication Library with Encryption, Authentication, and Replay Protection - AUTOSAR SecOC Compatible
Classic CAN has no built-in security. Every frame is transmitted in plaintext, unauthenticated, and freely replayable, a design decision made decades before Bluetooth, Wi-Fi, cellular modems, and OBD-II dongles turned the CAN bus into a networked, remotely reachable attack surface.
A CAN bus encryption and authentication library closes this gap in software, without waiting for a silicon respin or a full AUTOSAR migration. RAPIDSEA Secure CAN Library adds encryption, authentication, and anti-replay protection to every frame, built on the same class of cryptographic primitives referenced by AUTOSAR SecOC.
The result: an ECU that can prove a frame came from a trusted sender, has not been tampered with in transit, and has not been captured and replayed by an attacker, all inside the 8-byte CAN payload constraint.
RAPIDSEA Secure CAN Library is a portable C99 software library that encrypts and authenticates Classic CAN 2.0A/B and CAN-FD frames, supporting both 11-bit and 29-bit identifiers, without requiring an RTOS or an AUTOSAR stack underneath it.
It ships as one header and three source files, sitting directly above your existing CAN driver, so it drops into a bare-metal, RTOS-based, or Linux-based ECU project in under a day.
Because every ECU is not on the same roadmap, the library is delivered two ways: as a standalone, AUTOSAR-independent library for teams that want security now without re-architecting their software, and as an AUTOSAR-compatible module, packaged as a Complex Device Driver (CDD) or integrated with the AUTOSAR Crypto Service Manager (CSM) and SecOC layer, for OEMs and Tier-1s standardized on AUTOSAR Classic or Adaptive platforms. Either way, the underlying protection stays the same.
Every CAN frame is encrypted and authenticated together, using AES-128, so its content stays confidential and any tampering or forgery is caught before it is trusted.
Captured frames cannot be recorded and retransmitted later; every frame is checked for freshness before it is ever accepted.
Full encryption and authentication add just one linked frame per secured message, a fixed cost you can budget for at design time.
Optional hooks let you offload cryptographic processing to on-chip HSM hardware to reduce CPU load on gateway and high-traffic ECUs.
Runs standalone on bare-metal or RTOS today, or can be delivered as an AUTOSAR CDD / SecOC-integrated module on request.
An 8-byte CAN payload has no room left over for full-strength encryption plus an authentication check, so RAPIDSEA Secure CAN Library uses a secured message scheme, built on a linked pair of CAN frames, to deliver full-strength protection without exceeding the classic CAN frame size.
Every secured message is both encrypted and authenticated before it reaches the bus, and the receiver verifies authenticity before any payload is accepted, so a tampered or forged frame is rejected without ever being trusted by the application.
The only bus-load cost of full encryption and authentication is one additional linked frame per message, a fixed, predictable overhead that automotive network designers can budget for at design time.
RAPIDSEA Secure CAN Library is built against the CAN-specific threat categories mapped through an ISO 21434 threat analysis and risk assessment (TARA). Each attack class below is closed by a specific mechanism in the library, not by obscurity.
| Attack Vector | RAPIDSEA Defence | Result |
|---|---|---|
| Eavesdropping / Bus Sniffing | Full payload encryption | Blocked |
| Frame Injection / Forgery | Cryptographic authentication check on every frame | Blocked |
| Replay Attack | Sequence-based freshness check on every frame | Blocked |
| Signal Tampering | Authentication check detects any bit-level change before payload is accepted | Blocked |
| Cross-Channel Attack (gateway pivot) | Per-channel keys and independent freshness tracking | Blocked |
| Fuzzing Attack | Authentication check fails closed before payload is parsed | Blocked |
| Man-in-the-Middle (MitM) | Encrypted and authenticated frame pairing rejects any unverified insertion | Blocked |
| Suspension / ECU Masquerade | Freshness tracking and key binding detect a missing or impersonating ECU | Blocked |
Three source files, one header, no BSW, no RTOS dependency. Drop RAPIDSEA Secure CAN Library above your existing CAN driver and start encrypting and authenticating frames the same day, guided by our documentation and reference integration examples.
AUTOSAR SecOC Profile 1 typically uses a short, truncated authentication check and no encryption. RAPIDSEA Secure CAN Library delivers full payload encryption plus a substantially stronger authentication check, and for OEMs standardized on AUTOSAR, it can be delivered as an AUTOSAR-compatible CDD or integrated with the Crypto Service Manager and SecOC layer instead of replacing it.
Validated on Renesas RH850 and RL78, NXP i.MX RT1064 and LPC1788, and tested end-to-end with PEAK PCAN-USB and Vector VN1610 hardware plus CANalyzer traces, so the security you integrate is the security that has already been road-tested.
RAPIDSEA Secure CAN Library is built for true platform independence, pre-validated across the most widely adopted RTOS and embedded environments, from bare-metal microcontrollers to full-scale Linux systems and AUTOSAR Classic BSW stacks. Its hardware-agnostic, portable C99 architecture ensures thread-safe operation with minimal porting effort across all supported platforms.
| Environment | Status |
|---|---|
| Bare-metal (no OS) | Supported ✅ |
| FreeRTOS | Supported ✅ |
| Zephyr RTOS | Supported ✅ |
| Azure RTOS / ThreadX | Supported ✅ |
| Embedded Linux (SocketCAN) | Supported ✅ |
| Windows (testing / simulation) | Supported ✅ |
Authenticates speed, RPM, and warning-lamp signals so a spoofed cluster message cannot mask a real fault or falsify a reading to the driver.
Encrypts and authenticates door lock, window, and immobilizer commands, closing the relay-attack and command-injection paths exposed by infotainment and telematics gateways.
Protects safety-relevant sensor and actuator frames from tampering and replay, supporting the freedom-from-interference goals of an ISO 26262 safety case.
Terminates and re-originates encrypted, authenticated CAN sessions at the domain boundary, preventing an attacker who reaches one bus segment from pivoting to another.
Secures BMS-to-VCU and charge-controller CAN traffic, protecting cell-voltage, current, and state-of-charge data from tampering during charge sessions.
Adds encryption and authentication to J1939 PGNs on trucks, buses, and off-highway vehicles, closing a gap increasingly targeted by fleet-level cyberattacks.
RAPIDSEA Secure CAN Library has been validated against the tools automotive security and network teams already use for bus analysis, functional testing, and cryptographic conformance checking.
Validation Toolchain
The following industry-standard tools and test vector suites are used to verify the encryption, authentication, and replay-protection behavior of the library:
| Tool | Purpose |
|---|---|
| PEAK PCAN-USB Adapter | Frame-level bus capture and injection testing |
| Vector VN1610 | High-fidelity CAN/CAN-FD interfacing for conformance testing |
| Vector CANalyzer | Trace analysis and bus-load measurement |
| NIST Reference Test Vectors | Cryptographic conformance testing against published reference vectors |
| Built-in Self-Test Suite | Automated verification of cryptographic correctness at startup |
| Renesas RH850/D1M1A EVB | Target hardware validation on automotive-grade silicon |
| NXP i.MX RT1064 EVK | Target hardware validation on gateway-class processors |
Threat analysis & risk assessment audits mapped to ISO 21434 & UN R155 for automotive cybersecurity homologation.
Chain-of-trust secure boot and key provisioning services for ECUs, designed to work alongside Secure CAN Library.
Pair Secure CAN Library with our UDS, J1939, OBD2, and CAN IVN stacks for a complete in-vehicle communication suite.
Offload cryptographic processing to on-chip HSM hardware to reduce CPU load.
RAPIDSEA Secure CAN Library is a portable C99 software library that adds encryption, authentication, and anti-replay protection to Classic CAN and CAN-FD frames.
