Energy-Efficient Adaptive Zero Trust Security for Automotive CAN Networks
Modern vehicles communicate via 100+ electronic control units (ECUs) exchanging thousands of CAN messages per second. However, the CAN protocol design sidelined security. Existing solutions force an untenable choice, meaning that lightweight cryptography offers insufficient protection, while strong schemes such as RSA-4096 impose 30 CPU units per message, which is far beyond what resource-constrained automotive hardware can sustain continuously. Therefore, we present the Adaptive Zero Trust Security Framework (AZSF), a dynamic orchestration layer that scales the authentication strength in proportion to real-time threat levels. A two-stage intrusion detector, combining constant-time heuristic filtering with logistic regression, solves 75-80% of traffic at minimal cost. At the same time, a Kalman-filtered trust estimator converts noisy anomaly signals into stable and actionable scores. These scores drive selection across five authentication levels, ranging from a lightweight checksum to RSA-4096, and are coupled with a fivecondition graduated mitigation policy. The simulation results in the Car Hacking Dataset show that our AZSF approach achieves 97.0% energy savings and a 90.4% reduction in processing overhead relative to static RSA-4096. We also observed zero false negatives and a mean authentication latency of 0.32 ms. A 24-hour simulation shows that AZSF consumes only 28.64% of a standard vehicle battery, compared to 964% of the baseline approach, thus establishing the feasibility of deployment in resource-constrained ECUs.