Vehicle-mounted diagnosis security access method and system based on heterogeneous computing power transfer

Abstract

The invention is suitable for the technical field of automotive electronics, provides a vehicle-mounted diagnosis security access method and system based on heterogeneous computing power transfer, and aims to solve the problems of timeout, blocking real-time control and the like when a low-computing-power edge node executes high-strength asymmetric signature verification. The system is composed of a service interaction layer, a security routing layer, a core computing power layer and a board-level high-speed link. The method comprises the following steps: a target edge node receives a diagnosis request, requests a 32-byte challenge value from a gateway and feeds back the challenge value; after a 64-byte ECDSA signature is received, NRC 0x78 is sent, and data are packaged to initiate computing power transfer; the gateway converts the protocol and transmits the protocol to the SoC; the SoC executes signature verification based on the NIST P-256 and feeds back a result; and the target edge node unlocks the authority. According to the method, edge hardware does not need to be upgraded, the UN R155 compliance requirement is met at low cost, and diagnosis efficiency and vehicle real-time control safety are guaranteed.

Description

Technical Field

[0001] This invention belongs to the field of automotive electronics technology, and in particular relates to a method and system for secure access to vehicle diagnostics based on heterogeneous computing power transfer. Background Technology

[0002] As vehicle electronic and electrical architecture evolves from a distributed CAN bus architecture to a centralized architecture based on domain controllers and area controllers, asymmetric encryption-based identity authentication has replaced traditional symmetric encryption as the mainstream technology to address the increasingly severe cybersecurity threats in the Internet of Vehicles (IoV).

[0003] However, existing vehicle body or chassis domain architectures typically employ a heterogeneous multi-core design: the central domain controller integrates a high-performance SoC with powerful computing capabilities, while the numerous actuator nodes distributed at the vehicle edge still use cost-sensitive, low-computing-power MCUs. This results in a severe technological gap between the high demands of safety algorithms and the limited computing resources available to edge nodes.

[0004] The core drawback of a full-network hardware upgrade solution is its extremely high cost, requiring the deployment of expensive high-end chips on dozens of edge nodes, which contradicts the principle of cost reduction and efficiency improvement for automakers. The disadvantage of an edge-software solution is that it sacrifices diagnostic efficiency and driving safety; prolonged computational congestion can cause high-priority control tasks to fail to respond in a timely manner, posing serious security risks. Summary of the Invention

[0005] The purpose of this invention is to provide a vehicle diagnostic secure access method based on heterogeneous computing power transfer, which aims to solve the technical problems existing in the prior art as identified in the background art.

[0006] This invention is implemented as follows: a secure access method for vehicle diagnostics based on heterogeneous computing power transfer, comprising the following steps:

[0007] The target edge node receives a security access request sent by an external diagnostic instrument and returns a challenge value to the external diagnostic instrument.

[0008] After receiving the digital signature submitted by the external diagnostic instrument, the target edge node sends a negative response code (NRC 0x78) to the external diagnostic instrument and initiates a computing power transfer request.

[0009] The gateway control unit transmits the challenge value and the digital signature in the computing power transfer request to the high-performance computing unit.

[0010] The high-performance computing unit uses a preset public key to perform an elliptic curve digital signature algorithm verification operation on the challenge value and the digital signature, generates a verification result status code and feeds it back.

[0011] The gateway control unit forwards the signature verification result status code to the target edge node, and the target edge node unlocks security access permissions based on the signature verification result status code.

[0012] Furthermore, the specific steps of returning the challenge value to the external diagnostic instrument include: the target edge node initiating a challenge value generation request to the gateway control unit; the gateway control unit calling its internally integrated true random number generator to generate a random number sequence of 32 bytes as the challenge value and feeding it back to the target edge node; and the target edge node encapsulating the challenge value in a UDS positive response message (0x67 01) and sending it back to the external diagnostic instrument.

[0013] Furthermore, the initiation of the computing power transfer request specifically includes: the target edge node packaging the session context information and the received digital signature, and encapsulating them into a CAN or CAN-FD protocol frame and sending it to the gateway control unit.

[0014] Furthermore, the step of transmitting the challenge value and the digital signature in the computing power transfer request to the high-performance computing unit specifically includes: the gateway control unit stripping the protocol header of the vehicle network layer, extracting the payload of the challenge value and the digital signature, re-encapsulating it into a board-level communication protocol format, and routing it to the high-performance computing unit via the SPI bus.

[0015] Furthermore, the execution of the elliptic curve digital signature algorithm verification operation specifically includes: the high-performance computing unit performing a verification operation on the input 32-byte challenge value and 64-byte signature data based on the NISTP-256 elliptic curve parameters.

[0016] A vehicle diagnostic security access system based on heterogeneous computing power transfer, the system comprising a business interaction layer, a security routing layer, and a core computing power layer;

[0017] The business interaction layer is deployed on the target edge node and is used to receive security access requests sent by external diagnostic instruments and return challenge values ​​to external diagnostic instruments. After receiving the digital signature submitted by the external diagnostic instrument, it sends a negative response code (NRC 0x78) to the external diagnostic instrument and initiates a computing power transfer request. It also unlocks security access permissions according to the received signature verification result status code.

[0018] The secure routing layer is deployed in the gateway control unit and is used to pass through the challenge value and digital signature in the computing power transfer request from the business interaction layer to the core computing power layer, and forward the signature verification result status code from the core computing power layer to the business interaction layer; the secure routing layer is also used to respond to the challenge value generation request from the business interaction layer and call its internally integrated true random number generator to generate the challenge value.

[0019] The core computing layer is deployed on a high-performance computing unit and is used to perform elliptic curve digital signature algorithm verification operation on the received challenge value and digital signature using a pre-set public key, and generate a verification result status code.

[0020] The secure routing layer is connected to the core computing layer via the SPI bus.

[0021] The beneficial effects of this invention are:

[0022] 1. Extremely low-cost security upgrade: Without replacing a large number of low-end edge MCU chips, the entire vehicle can be made to meet UN R155 regulations simply by upgrading the gateway software, which greatly reduces the hardware costs for OEMs.

[0023] 2. Lightning-fast authentication experience: Utilizing the powerful computing power of the SoC, the authentication process, which originally required hundreds of milliseconds, is compressed to the millisecond level, ensuring the high efficiency of production line flashing and after-sales diagnostics.

[0024] 3. Decoupling and Security: The signature verification logic is converged to the SoC core layer, and a centralized secure storage strategy is adopted to manage the keys. Even if hackers break through the physical defenses of the edge nodes or intrude into the application layer of the SoC, the root key cannot be stolen or tampered with because it is stored in an isolated area protected by the underlying layer. Attached Figure Description

[0025] Figure 1 This is a diagram illustrating the overall architecture of an on-board diagnostic secure access system based on heterogeneous computing power transfer.

[0026] Figure 2 A complete interactive timing and data flow process diagram provided for embodiments of the present invention;

[0027] Figure 3 The ECDSA verification image provided in this embodiment of the invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0029] This invention discloses an enhanced UDS secure access method and system based on a heterogeneous domain controller architecture, which addresses the problems of diagnostic session timeouts, real-time control task blocking, and insufficient security of legacy protocols caused by insufficient computing power in traditional automotive-grade MCUs when performing high-strength asymmetric encryption authentication. The system consists of a business interaction layer, a secure routing layer, and a core computing power layer, and is equipped with a high-speed board-level interconnect link to achieve cross-chip computing power collaboration. The business interaction layer is deployed on the target edge node with limited computing power. It is responsible for the maintenance of the UDS protocol stack and session management. It requests a 32-byte extended challenge value from the gateway controller. When it detects that the 64-byte ECC digital signature input from the outside exceeds its processing capacity, it immediately sends a response suspension frame (NRC 0x78) to maintain the session and triggers an internal computing power transfer request. The security routing layer is deployed on the gateway control unit. As a communication hub connecting the edge and the center, it is responsible for the conversion of heterogeneous network protocols and asynchronous task scheduling. It reassembles the CAN / CAN-FD computing power transfer request from the vehicle network into an SPI data frame adapted for board-level communication and establishes a low-latency transparent transmission channel between the edge node and the computing center. The core computing power layer relies on a high-performance SoC to perform ECC-P256 elliptic curve signature verification operation on the transparent signature data. It completes complex large number multiplication calculations and outputs Boolean verification results in milliseconds. Ultimately, the system drives the security state machine within the business interaction layer to switch the session from a locked state to an unlocked state and grant access to protected resources based on the returned verification results. This achieves dual protection of high-level asymmetric encryption for full vehicle diagnostics and real-time vehicle control security without upgrading the hardware costs of edge nodes.

[0030] like Figure 1 and Figure 2 As shown, the vehicle diagnostic security access system based on heterogeneous computing power transfer described in this invention consists of a service interaction layer, a security routing layer, and a core computing power layer. It also utilizes a board-level high-speed interconnect link (SPI bus) to achieve cross-chip computing power collaboration. The specific implementation and deployment of each layer are as follows:

[0031] Business Interaction Layer: Deployed on target edge nodes with limited computing power (low-frequency, low-resource microcontrollers MCUs). This layer integrates the UDS protocol stack and is responsible for maintaining the UDS protocol stack and session management. Specifically, it includes functions such as receiving secure access requests from external diagnostic instruments, requesting 32-byte extended challenge values ​​from the gateway control unit, encapsulating and sending response messages, identifying digital signatures and triggering computing power transfer requests.

[0032] Secure routing layer: Deployed in the gateway control unit (Gateway MCU), it serves as a communication hub connecting the edge and the center. It integrates CAN / CAN-FD protocol modules, SPI protocol modules, and a task scheduler. It is responsible for the conversion of heterogeneous network protocols (CAN / CAN-FD and SPI), asynchronous task scheduling, and recording of request source node context information, so as to realize low-latency pass-through between edge nodes and the core computing power layer.

[0033] Core computing power layer: Relying on the high-performance computing unit (SoC) in the domain controller, the SoC has a powerful central processing unit and high-frequency general computing capabilities. It has a protected storage partition (accessible only to authorized system-level programs) to store the pre-set ECC public key. It also integrates the ECC-P256 elliptic curve signature verification algorithm logic, which can complete complex large number multiplication calculations in milliseconds.

[0034] II. Specific Implementation Steps of the Method

[0035] In this embodiment, the external diagnostic instrument communicates with the target edge node and the gateway control unit via a CAN bus, while the gateway control unit communicates with the high-performance computing unit (SoC) via an SPI bus. The elliptic curve signature verification algorithm adopts the NISTP-256 standard. The specific implementation steps are as follows:

[0036] Step 1: Receiving Security Access Requests and Returning Challenge Values ​​(Level 1 Business Interaction Layer)

[0037] The external diagnostic instrument sends a secure access request message to the target edge node through the OBD interface. This message conforms to the UDS protocol standard and the message format is UDS Service 0x27, Sub-function 0x01.

[0038] The UDS protocol stack of the target edge node performs a preliminary check on the received message format to confirm the validity of the service ID (0x27) and sub-function code (0x01); if the current target edge node is already in an unlocked state, it directly returns an all-zero seed; if the check passes and the node is in a locked state, it triggers a secure access sequence and sends a challenge value generation request to the gateway control unit.

[0039] After receiving the challenge value generation request, the gateway control unit responds to the internal request by calling its internally integrated True Random Number Generator (TRNG) to generate a random number sequence with a length of 32 bytes (256-bit). This random number sequence has a high entropy value, which can eliminate the risk of replay attacks caused by the predictability of random numbers from the source.

[0040] The gateway control unit feeds back the generated 32-byte random number sequence as a challenge value to the target edge node;

[0041] After receiving the challenge value, the target edge node temporarily stores it in the session context of RAM and encapsulates the 32-byte challenge value in the data field of the UDS positive response message (0x67 01), and sends it back to the external diagnostic tool via the CAN bus to complete the first phase handshake.

[0042] Step 2: Digital Signature Receipt and Computing Power Transfer Request Initiation

[0043] After receiving the 32-byte challenge value, the external diagnostic instrument uses a preset private key to perform ECDSA signature operation on the challenge value, generating a 64-byte digital signature containing r and s components. The external diagnostic instrument then submits the 64-byte digital signature to the target edge node by sending a key message (UDS Service 0x27, Sub-function 0x02).

[0044] Upon receiving the 0x2702 message, the target edge node first checks the Data Payload Length (DLC). If the payload length is 64 bytes, it identifies it as an asymmetric encryption authentication request. Since the target edge node itself does not have an ECC hardware acceleration engine, the software predicts that the verification time of this 64-byte digital signature will exceed the P2 Server threshold (50ms). Therefore, it immediately sends a negative response code 0x7F 27 78 (NRC: Response Pending) to the external diagnostic instrument, forcibly resetting the diagnostic instrument's timeout timer and informing the external device that "the request is being processed" to prevent the session from being interrupted unexpectedly.

[0045] The target edge node packages the current session context information (32-byte Challenge) with the received data to be verified (64-byte Signature), encapsulates the data packet into a CAN / CAN-FD protocol frame, and the frame header contains a "computing power transfer request" identifier ID, which is then sent to the gateway control unit of the security routing layer through the vehicle network.

[0046] Step 3: Pass through the computing power transfer request (Level 2 security routing layer)

[0047] After receiving an Internal Req: Verify ECC request from the target edge node, the Gateway MCU first performs a protocol conversion operation. The gateway strips the protocol header of the vehicle network layer (CAN / CAN-FD), extracts the payload containing the challenge and signature, and repackages it into a board-level communication protocol format.

[0048] The gateway establishes a high-speed board-level channel with the high-performance computing unit (SoC), directly routing the repackaged encrypted data stream to the SoC via the SPI data pass-through (SPITransfer: ECC Data) mechanism. During this process, the gateway's task scheduler synchronously records the context information of the requesting source node, preparing for the subsequent accurate backtracking of asynchronous computation results to the edge nodes, thereby completing cross-chip data scheduling within milliseconds.

[0049] Step 4: ECC-P256 Elliptic Curve Verification Calculation (Level 3 Core Computing Layer)

[0050] The SoC receives transparent data packets from the gateway via the SPI interface. After verification, it decapsulates and extracts a 32-byte challenge value and a 64-byte digital signature. Simultaneously, the SoC's main control program initiates the key loading process. The pre-configured ECC public key is stored in a protected memory partition within the SoC. Only authorized system-level programs can read this key; no external application or third-party plugin can access or modify this area, thus ensuring the security of the root key in a general computing environment.

[0051] The SoC's high-performance computing core, based on NISTP-256 elliptic curve parameters, performs the following operations on the input 32-byte challenge value and 64-byte signature data (r and s components) through software algorithm logic: Figure 3 As shown:

[0052] Parameter validity check: Verify whether the r and s components are within the valid range [1, n-1] of the elliptic curve order n. If any value exceeds this range, the verification fails.

[0053] Modular Inverse and Scalar Calculation: The SoC uses large number arithmetic logic to calculate the modular inverse w of s, and then uses the challenge value e, the signature component r, and the modular inverse w to calculate and generate two intermediate scalars u1 and u2. Where w = s -1 (mod n), u1=(e*w)(mod n), u2=(r*w)(mod n).

[0054] Double scalar dot product: The SoC performs elliptic curve dot product and dot addition operations to calculate P(x, y) on the curve: P = u1·G + u2·Q. Where G is the base point of the curve and Q is the loaded preset public key.

[0055] Extract the x-coordinate of the calculated point P. pThe value of the curve modulo n is compared with the received signature component r. Based on the comparison result, the hardware engine generates a verification result status code. If they match, a verification pass status code is generated; otherwise, a verification failure status code is generated. This status code is then written to the input register, read by the SoC main program, and sent back.

[0056] Step 5: Verification result feedback and secure access unlocking

[0057] This step involves the return of results from Level 3 to Level 2 and then to Level 1, aiming to complete the trust chain transfer from the core computing power layer to the business interaction layer and perform the final permission unlocking.

[0058] Step 5.1 Verification result feedback (Level 3 → Level 2)

[0059] After completing the signature verification calculation, the SoC located in the Level 3 core computing layer immediately writes the generated signature verification result status code (Pass / Fail) into the transmission buffer. Subsequently, the SoC, acting as an SPI slave, responds to the gateway's clock signal and feeds back the result status word to the gateway control unit in the Level 2 security routing layer via the board-level high-speed SPI bus.

[0060] Step 5.2 Authorization Instruction Mapping (Level 2 → Level 1)

[0061] The gateway retrieves the source address of the request and converts the board-level verification result into an internal "authorization command" that can be recognized by the vehicle network, and then accurately routes it back to the target edge node through the CAN / CAN-FD network.

[0062] Step 5.3 State Machine Transition and Permission Granting (Level 1)

[0063] After confirming receipt of a valid authorization command, the target edge node immediately drives its internal security state machine to jump to the unlocked state, officially opening access to protected resources such as Flash programming or DID writing, and finally sends a standard UDS positive response message (0x6702) to the external diagnostic instrument, completing the closed loop of the entire enhanced security access process.

[0064] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0065] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

[0066] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A secure access method for vehicle diagnostics based on heterogeneous computing power transfer, characterized in that, The method includes: The target edge node receives a security access request sent by an external diagnostic instrument and returns a challenge value to the external diagnostic instrument. After receiving the digital signature submitted by the external diagnostic instrument, the target edge node sends a negative response code to the external diagnostic instrument and initiates a computing power transfer request. The gateway control unit transmits the challenge value and the digital signature in the computing power transfer request to the high-performance computing unit. The high-performance computing unit uses a preset public key to perform an elliptic curve digital signature algorithm verification operation on the challenge value and the digital signature, generates a verification result status code and feeds it back. The gateway control unit forwards the signature verification result status code to the target edge node, and the target edge node unlocks security access permissions based on the signature verification result status code.

2. The method according to claim 1, characterized in that, The specific details of returning challenge values ​​to external diagnostic instruments include: The target edge node sends a challenge value generation request to the gateway control unit; The gateway control unit calls the true random number generator integrated within the gateway control unit to generate a random number sequence of 32 bytes as a challenge value and feeds it back to the target edge node; The target edge node encapsulates the challenge value in a positive response message and sends it back to the external diagnostic tool.

3. The method according to claim 1, characterized in that, The specific steps of initiating the computing power transfer request include: The target edge node packages the session context information with the received digital signature and encapsulates it into a vehicle network protocol frame, which is then sent to the gateway control unit.

4. The method according to claim 1 or 3, characterized in that, The vehicle network protocol frame is either a CAN protocol frame or a CAN-FD protocol frame.

5. The method according to claim 1, characterized in that, The step of transmitting the challenge value and the digital signature in the computing power transfer request to the high-performance computing unit specifically includes: The gateway control unit strips the protocol header of the vehicle network layer, extracts the challenge value and digital signature payload, repackages them into a board-level communication protocol format, and routes them to the high-performance computing unit through a board-level high-speed channel.

6. The method according to claim 1, characterized in that, The board-level high-speed channel is the SPI bus.

7. The method according to claim 1, characterized in that, The execution of the elliptic curve digital signature algorithm for signature verification specifically includes: The high-performance computing unit performs signature verification operations on the input 32-byte challenge value and 64-byte signature data based on NISTP-256 elliptic curve parameters, including r-components and s-components. The signature verification operations include: Verify whether the r-component and s-component are within the valid range [1, n-1] of the elliptic curve order n; Calculate the modular inverse of the s component w=s -1 (mod n); Two intermediate scalars u1 and u2 are generated using the challenge value e, component r, and modular inverse w, where u1 = (e * w) (mod n) and u2 = (r * w) (mod n). Perform elliptic curve dot multiplication and dot addition operations to calculate the point P(x,y) on the curve: P=u1·G+u2·Q, where G is the base point of the curve and Q is the loaded preset public key; Extract the x-coordinate of the calculated point P. p The value obtained by taking the modulo of the curve order n is compared with the received signature component r to generate a signature verification result status code.

8. A method and system for secure access to vehicle diagnostics based on heterogeneous computing power transfer, characterized in that, The system includes: The business interaction layer, the security routing layer, and the core computing power layer; The business interaction layer is deployed on the target edge node and is used to receive security access requests sent by external diagnostic instruments and return challenge values ​​to external diagnostic instruments. After receiving the digital signature submitted by the external diagnostic instrument, it sends a negative response code to the external diagnostic instrument and initiates a computing power transfer request. It also unlocks security access permissions based on the received signature verification result status code. The secure routing layer is deployed in the gateway control unit and is used to pass through the challenge value and digital signature in the computing power transfer request from the business interaction layer to the core computing power layer, and forward the signature verification result status code from the core computing power layer to the business interaction layer. The core computing layer is deployed on a high-performance computing unit and is used to perform elliptic curve digital signature algorithm verification operation on the received challenge value and digital signature using a pre-set public key, and generate a verification result status code.

9. The system according to claim 8, characterized in that, The secure routing layer is also used to respond to the challenge value generation request of the business interaction layer, and call the true random number generator integrated inside the secure routing layer to generate a random number sequence of 32 bytes as the challenge value to be fed back to the business interaction layer.

10. The system according to claim 8, characterized in that, The secure routing layer is connected to the core computing layer via the SPI bus.

Images