On-board safety diagnostic system and method based on authority control

Abstract

The present invention discloses a vehicle-mounted safety diagnosis method and system based on authority control, including a DoIP diagnosis server and a DoIP diagnosis client. The DoIP diagnosis server and the DoIP diagnosis client perform two-way authentication; at the same time, an authority signature file is defined to control the diagnostic behavior of the authenticated DoIP diagnosis client and the DoIP diagnosis server; after passing the two-way authentication, a session key exchange is performed; encrypted diagnosis is performed through the exchanged session key, and the diagnostic operation in the process is controlled by the diagnosis authority file. The present invention solves the problem of illegal DoIP client access through two-way authentication. All diagnostic operations are encrypted authentication operations to prevent data from being maliciously tampered with; the authority signature file ensures that the diagnostic client is authorized by the OEM manufacturer, and the vehicle will not accept unauthorized diagnostic client connections and will not process unauthorized diagnostic behaviors.

Description

Technical Field

[0001] The present invention relates to an on-board network diagnostic technology, and in particular to an on-board safety diagnostic system and method based on authority management and control. Background Art

[0002] DoIP (Diagnostic communication over Internet Protocol) is based on the Ethernet communication protocol to transmit the data of the UDS protocol. It is also a protocol itself, and the protocol specification is defined by ISO13400. Since DoIP can transmit a large amount of data and has a fast response speed, and can perform remote diagnosis and OTA through Ethernet, DoIP has gradually replaced the traditional CAN and other bus methods and become an inevitable trend for vehicle network diagnosis. However, while ensuring the efficiency of diagnosis, it is also necessary to ensure the information security of the diagnosis process.

[0003] The ISO13400 specification defines a security diagnostic mode that encrypts data by starting a TLS TCP_DATA socket on the DoIP Server node.

[0004] However, if any malicious person gets the diagnostic instrument and connects it to the vehicle OBD or connects to the DoIP TCP service port through OTA, unauthorized access will occur, and further diagnosis of the vehicle will be performed to obtain vehicle information or perform diagnostic attacks on the vehicle. For a vehicle with a universal DoIP protocol, it is extremely simple to perform diagnostic attacks through the above methods, such as some car repair shops or online shopping universal diagnostic instruments. Summary of the invention

[0005] In order to solve the deficiencies in the prior art, the object of the present invention is to provide a vehicle safety diagnostic system and method based on authority management.

[0006] To achieve the purpose of the present invention, the technical solution adopted by the present invention is:

[0007] An on-board safety diagnostic system based on authority management and control includes a DoIP diagnostic server and a DoIP diagnostic client, wherein the DoIP diagnostic server is connected to the vehicle, and the DoIP diagnostic client is connected to the DoIP diagnostic instrument;

[0008] The DoIP diagnostic server and the DoIP diagnostic client perform two-way authentication; at the same time, the permission signature file is defined to control the diagnostic behavior of the authenticated DoIP diagnostic client and DoIP diagnostic server;

[0009] After passing the two-way authentication, the vehicle selects the appropriate encryption algorithm through the DoIP diagnostic server, and sends it after encrypting it with the client public key; the DoIP diagnostic instrument obtains the encryption algorithm through the DoIP diagnostic client private key, and generates a session key at the same time, and sends it after encrypting it with the server public key; the vehicle obtains the session key through the DoIP diagnostic server private key; encrypted diagnosis is performed through the exchanged session keys, and the diagnostic operations in the process are controlled by the diagnostic authority file.

[0010] Furthermore, the vehicle is equipped with a built-in diagnostic certificate, a private key, and an OEM-defined permission signature file when it leaves the factory.

[0011] Furthermore, the permission signature file is signed and authorized by the OEM manufacturer, and the permission signature file is distributed to the DoIP diagnostic instrument authorized by the OEM manufacturer.

[0012] Furthermore, the two-way authentication process is:

[0013] The DoIP diagnostic instrument verifies the legitimacy of the DoIP diagnostic server certificate received by the DoIP diagnostic client, and parses it to obtain the server public key; at the same time, it verifies whether the signature private key of the DoIP diagnostic server permission signature file is the same as the DoIP diagnostic client permission signature file;

[0014] The DoIP diagnostic client sends the DoIP diagnostic client certificate, the DoIP diagnostic client permission signature file, and the encryption algorithm supported by the client;

[0015] The DoIP diagnostic server verifies the legitimacy of the DoIP diagnostic client certificate and parses it to obtain the client public key; at the same time, it verifies whether the signature private key of the DoIP diagnostic client permission signature file is the same as the DoIP diagnostic server permission signature file.

[0016] A vehicle safety diagnosis method based on authority management and control, comprising the steps of:

[0017] (1) If there is no DoIP diagnostic client permission signature file on the DoIP diagnostic instrument, edit the permission file and apply for the corresponding permission signature file from the OEM manufacturer of the vehicle;

[0018] (2) The OEM manufacturer reviews the DoIP diagnostic instrument information and the content of the permission file. If they are all legal, they are signed and the corresponding permission signature file is generated and sent to the DoIP diagnostic instrument for use;

[0019] (3) The DoIP diagnostic client is started, a TLS socket is created, and the SN and MAC information are verified to be consistent with the definition in the permission signature file;

[0020] (4) The DoIP diagnostic server is started, a TLS socket is created, and the SN and MAC information are verified to be consistent with the definition in the permission signature file;

[0021] (5) The DoIP diagnostic client and the DoIP diagnostic server request to establish a TLS socket connection;

[0022] (6) The DoIP diagnostic server returns the DoIP diagnostic server certificate and the DoIP diagnostic server permission signature file;

[0023] (7) The DoIP diagnostic instrument verifies the legitimacy of the DoIP diagnostic server certificate received by the DoIP diagnostic client, and parses it to obtain the server public key; at the same time, it verifies whether the signature private key of the DoIP diagnostic server permission signature file is the same as the DoIP diagnostic client permission signature file;

[0024] (8) The DoIP diagnostic client sends the DoIP diagnostic client certificate, the DoIP diagnostic client permission signature file, and the encryption algorithm supported by the client;

[0025] (9) The DoIP diagnostic server verifies the legitimacy of the DoIP diagnostic client certificate and parses it to obtain the client public key; at the same time, it verifies whether the signature private key of the DoIP diagnostic client permission signature file is the same as the DoIP diagnostic server permission signature file;

[0026] (10) The vehicle selects a suitable encryption algorithm through the DoIP diagnostic server and encrypts it using the client public key before sending it out;

[0027] (11) The DoIP diagnostic instrument obtains the encryption algorithm through the DoIP diagnostic client private key, generates a session key, and encrypts it with the server public key before sending it out;

[0028] (12) The vehicle obtains the session key through the DoIP diagnostic server private key and completes the session key exchange;

[0029] (13) Encrypted diagnosis is performed through the exchanged session key, and the diagnostic operations in the process are controlled by the diagnostic authority file.

[0030] Furthermore, in step (2), after the diagnostic operation permission file is completed, the signature authorization is completed through OEM review, and all diagnostic operations are reviewed as legal operations; the permission signature file is uniquely bound to the client.

[0031] Furthermore, in step (13), during the encrypted diagnosis process, any diagnostic behavior not defined in the permission signature file should not be allowed.

[0032] The beneficial effect of the present invention is that, compared with the prior art, the present invention makes up for the defect of only authenticating vehicles in the ISO13400 specification through a two-way authentication method, adds authentication of DoIP clients, and solves the problem of illegal DoIP client access. All diagnostic operations of the present invention are encrypted authentication operations, which ensure the confidentiality of diagnostic data and the behavior of malicious tampering of data.

[0033] The present invention ensures that the diagnostic client is authorized by the OEM manufacturer through the permission signature file, and the diagnostic operations performed are also authorized by the OEM manufacturer. The vehicle will not accept unauthorized diagnostic client connections, and will not process unauthorized diagnostic behaviors. The permission signature file of the present invention can be dynamically defined and updated, and the OEM can reasonably define the diagnostic behaviors of different DoIP diagnostic instruments / OTA clients according to the diagnostic type. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a flow chart of the vehicle-mounted safety diagnostic method based on authority management described in the present invention. DETAILED DESCRIPTION

[0035] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of this application.

[0036] The in-vehicle safety diagnostic system based on authority management described in the present invention includes a DoIP diagnostic server and a DoIP diagnostic client. The DoIP diagnostic server is connected to the vehicle, and the DoIP diagnostic client is connected to the DoIP diagnostic instrument / OTA client. In addition to authenticating the DoIP diagnostic server, the system also authenticates the DoIP diagnostic client.

[0037] At the same time, the authority control signature file is defined to control the diagnostic behavior of the authenticated DoIP diagnostic client and DoIP diagnostic server, to ensure the legitimacy of the DoIP diagnostic client connected to the vehicle and the legitimacy of the diagnostic operation of the DoIP diagnostic client.

[0038] After passing the two-way authentication, the vehicle selects the appropriate encryption algorithm through the DoIP diagnostic server, and sends it after encrypting it with the client public key; the DoIP diagnostic instrument obtains the encryption algorithm through the DoIP diagnostic client private key, and generates a session key at the same time, and sends it after encrypting it with the server public key; the vehicle obtains the session key through the DoIP diagnostic server private key; encrypted diagnosis is performed through the exchanged session keys, and the diagnostic operations in the process are controlled by the diagnostic authority file.

[0039] When the vehicle leaves the factory, the certificate, private key, and diagnostic authority signature file defined by the OEM manufacturer should be built-in for vehicle security authentication and behavioral authority control during the diagnostic process. The diagnostic authority signature file is signed and authorized by the OEM manufacturer's private key, and the DoIP diagnostic instrument authorized by the OEM manufacturer is distributed with a reasonable diagnostic authority signature file for two-way authority verification and diagnostic authority control between the vehicle and the DoIP diagnostic instrument.

[0040] like Figure 1 As shown, the vehicle-mounted safety diagnosis method based on authority control described in the present invention, taking the DoIP diagnostic instrument as an example, includes the following steps:

[0041] (1) The DoIP diagnostic instrument selects the DoIP diagnostic client to be connected. If the DoIP diagnostic instrument does not have the DoIP diagnostic client permission signature file client_perm.p7s, you need to edit the permission file and apply for the corresponding permission signature file from the OEM manufacturer of the vehicle;

[0042] (2) The OEM manufacturer reviews the DoIP diagnostic instrument information and permission file contents. If they are all legal, they are signed and the corresponding permission signature file client_perm.p7s is generated and sent to the DoIP diagnostic instrument for use;

[0043] After the diagnostic operation permission file is completed, the signature authorization is completed through OEM review, and the diagnostic operations are reviewed as legal operations; the permission signature file is uniquely bound to the client; at the same time, the file is protected from malicious tampering through the signature. The above complete diagnostic permission signature file definition can be used to control the diagnostic client and the entire diagnostic process.

[0044] The sample file defines the allowed diagnostic operation as 0x19 (ReadDTCInformation) subFunction (0x01-0x0a), and the remaining DTC information read operations should not be sent by the client and parsed by the server; the 0x35 (RequestUpload) operation is defined, and the md5 of the uploaded file is a9b18b46ae58486270c16e67c950fb57 as well as the uploaded address and memory information.

[0045] (3) The DoIP diagnostic client is started, a TLS socket is created, and the SN, MAC and other information are verified to be consistent with the definition in the permission signature file client_perm.p7s;

[0046] (4) The DoIP diagnostic server is started, a TLS socket is created, and the SN, MAC and other information are verified to be consistent with the definition in the permission signature file server_pem.p7s;

[0047] (5) The DoIP diagnostic client and the DoIP diagnostic server request to establish a TLS socket connection;

[0048] (6) The DoIP diagnostic server returns the DoIP diagnostic server certificate server.crt and the DoIP diagnostic server permission signature file server_pem.p7s;

[0049] (7) The DoIP diagnostic instrument verifies the legitimacy of the DoIP diagnostic server certificate server.crt received by the DoIP diagnostic client, and parses it to obtain the server public key; at the same time, it verifies whether the signature private key of server_pem.p7s is the same as that of client_pem.p7s. After this step is completed, the diagnostic instrument can confirm that both the DoIP diagnostic client and the DoIP diagnostic server have obtained OEM authorization;

[0050] (8) The DoIP diagnostic client sends the DoIP diagnostic client certificate client.crt, the DoIP diagnostic client permission signature file client_pem.p7s, and the encryption algorithm supported by the client;

[0051] (9) The DoIP diagnostic server verifies the legitimacy of the DoIP diagnostic client certificate client.crt and parses it to obtain the client public key. At the same time, it verifies whether the signature private key of client_pem.p7s is the same as that of server_pem.p7s. After this step is completed, the vehicle can confirm that both the DoIP client and the DoIP server have obtained OEM authorization.

[0052] (10) The vehicle selects a suitable encryption algorithm through the DoIP diagnostic server and encrypts it using the client public key before sending it out;

[0053] (11) The DoIP diagnostic instrument obtains the encryption algorithm through the DoIP diagnostic client private key client.key, and generates a session key at the same time, which is encrypted with the server public key and then sent out;

[0054] (12) The vehicle obtains the session key through the DoIP diagnostic server private key server.key. After this step is completed, the session key exchange is completed;

[0055] (13) Encrypted diagnosis is performed through the exchanged session key, and all diagnostic operations in the process are controlled by the diagnostic authority file.

[0056] During the encrypted diagnostic process in step 13 of the above process, diagnostic behaviors not defined in the permission signature file should not be allowed, such as the sending of the diagnostic instrument and the receiving and parsing of the vehicle.

[0057] The beneficial effect of the present invention is that, compared with the prior art, the present invention makes up for the defect of only authenticating vehicles in the ISO13400 specification through a two-way authentication method, adds authentication of DoIP clients, and solves the problem of illegal DoIP client access. All diagnostic operations of the present invention are encrypted authentication operations, which ensure the confidentiality of diagnostic data and the behavior of malicious tampering of data.

[0058] The present invention ensures that the diagnostic client is authorized by the OEM manufacturer through the permission signature file, and the diagnostic operations performed are also authorized by the OEM manufacturer. The vehicle will not accept unauthorized diagnostic client connections, and will not process unauthorized diagnostic behaviors. The permission signature file of the present invention can be dynamically defined and updated, and the OEM can reasonably define the diagnostic behaviors of different diagnostic instruments according to the diagnostic type.

[0059] The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, but not to limit the scope of protection of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the scope of protection of the present invention.

Claims

1. A vehicle safety diagnostic system based on authority management, characterized in that: It includes DoIP diagnostic server and DoIP diagnostic client. The DoIP diagnostic server is connected to the vehicle, and the DoIP diagnostic client is connected to the DoIP diagnostic instrument. The DoIP diagnostic server and the DoIP diagnostic client perform two-way authentication; at the same time, a diagnostic authority signature file is defined to control the diagnostic behavior of the authenticated DoIP diagnostic client and DoIP diagnostic server; After passing the two-way authentication, the vehicle selects the appropriate encryption algorithm through the DoIP diagnostic server, encrypts it with the client public key and sends it out; the DoIP diagnostic instrument obtains the encryption algorithm through the DoIP diagnostic client private key, and generates a session key at the same time, encrypts it with the server public key and sends it out; the vehicle obtains the session key through the DoIP diagnostic server private key; encrypted diagnosis is performed through the exchanged session key, and the diagnostic operations in the process are controlled by the diagnostic authority signature file; The vehicle is equipped with a built-in diagnostic certificate, private key, and diagnostic authority signature file defined by the OEM when it leaves the factory; The diagnostic authority signature file is signed and authorized by the OEM manufacturer, and the diagnostic authority signature file is distributed to the DoIP diagnostic instrument authorized by the OEM manufacturer; The two-way authentication process is: The DoIP diagnostic instrument verifies the legitimacy of the DoIP diagnostic server certificate received by the DoIP diagnostic client, and parses it to obtain the server public key; at the same time, it verifies whether the signature private key of the DoIP diagnostic server diagnostic authority signature file is the same as the DoIP diagnostic client diagnostic authority signature file; The DoIP diagnostic client sends the DoIP diagnostic client certificate, the DoIP diagnostic client diagnostic authority signature file, and the encryption algorithm supported by the client; The DoIP diagnostic server verifies the legitimacy of the DoIP diagnostic client certificate and parses it to obtain the client public key; at the same time, it verifies whether the signature private key of the DoIP diagnostic client diagnostic authority signature file is the same as the DoIP diagnostic server diagnostic authority signature file.

2. A vehicle safety diagnosis method based on authority control, characterized in that: Includes steps: (1) If there is no DoIP diagnostic client diagnostic authority signature file on the DoIP diagnostic instrument, edit the authority file and apply for the corresponding diagnostic authority signature file from the OEM manufacturer of the vehicle; (2) The OEM manufacturer reviews the DoIP diagnostic instrument information and permission file contents. If they are all legal, they are signed and the corresponding diagnostic permission signature file is generated and sent to the DoIP diagnostic instrument for use; (3) The DoIP diagnostic client is started, a TLS socket is created, and the SN and MAC information are verified to be consistent with the definition in the diagnostic authority signature file; (4) The DoIP diagnostic server is started, a TLS socket is created, and the SN and MAC information are verified to be consistent with the definition in the diagnostic authority signature file; (5) The DoIP diagnostic client and the DoIP diagnostic server request to establish a TLS socket connection; (6) The DoIP diagnostic server returns the DoIP diagnostic server certificate and the DoIP diagnostic server diagnostic authority signature file; (7) The DoIP diagnostic instrument verifies the legitimacy of the DoIP diagnostic server certificate received by the DoIP diagnostic client, and parses it to obtain the server public key; at the same time, it verifies whether the signature private key of the DoIP diagnostic server diagnostic authority signature file is the same as the DoIP diagnostic client diagnostic authority signature file; (8) The DoIP diagnostic client sends the DoIP diagnostic client certificate, the DoIP diagnostic client diagnostic authority signature file, and the encryption algorithm supported by the client; (9) The DoIP diagnostic server verifies the legitimacy of the DoIP diagnostic client certificate and parses it to obtain the client public key; at the same time, it verifies whether the signature private key of the DoIP diagnostic client diagnostic authority signature file is the same as the DoIP diagnostic server diagnostic authority signature file; (10) The vehicle selects a suitable encryption algorithm through the DoIP diagnostic server and encrypts it using the client public key before sending it out; (11) The DoIP diagnostic instrument obtains the encryption algorithm through the DoIP diagnostic client private key, generates a session key, and encrypts it with the server public key before sending it out; (12) The vehicle obtains the session key through the DoIP diagnostic server private key and completes the session key exchange; (13) Encrypted diagnosis is performed through the exchanged session key, and the diagnostic operations in the process are controlled by the diagnostic authority signature file.

3. The vehicle-mounted safety diagnosis method based on authority control according to claim 2 is characterized in that: In step (2), after the diagnostic operation permission file is completed, the signature authorization is completed through OEM review, and all diagnostic operations are reviewed as legal operations; the diagnostic permission signature file is uniquely bound to the client.

4. The vehicle-mounted safety diagnosis method based on authority control according to claim 2 is characterized in that: In step (13), during the encrypted diagnosis process, any diagnostic behavior not defined in the diagnostic authority signature file should not be allowed.

Images