Device and method for generating and authentication checking at least one data packet to be transmitted in a bus system (BU), in particular a bus system of a motor vehicle

Abstract

The invention relates to a device and a method for generating at least one data packet (DP1, DP2, DP3, DP4) (K1, K2, BC1, BC2, X) to be transmitted in a bus system (BU), in particular a bus system of a motor vehicle (Kfz), wherein (S1) before transmitting the at least one data packet (DP1) comprising a message (MSG) to be included in the data packet (DP1), the bus subscriber (SG7) transmitting the data packet (DP1) generates a message authentication code (CMAC) also to be included in the data packet (DP1) by using a first encryption device (BC1) by: - ​​generating an encrypted message code (CMAC1) from the message (MSG) using a first encryption method (BC1) using a first key (K1), - generating an encrypted count (CYPH) from a count (Count++) using a second encryption method (BC2) using a second key (K2), and - A message authentication code (CMAC) to be transmitted is generated from the encrypted message code (CMAC1) and the encrypted count (CYPH) using a logical operation (X); and an apparatus and method for performing an authentication check on such a data packet at the receiving end.

Description

Technical Field

[0001] The invention relates to a device and a method for generating (at the transmitter) and performing an authentication check (at the receiver) on at least one data packet to be transmitted in a bus system (BU), in particular a bus system of a motor vehicle (Kfz). Background Art

[0002] The following public documents are related to the secure transmission of messages:

[0003] [1] W. Zimmermann, R. Schmidgal, Bussysteme in der Fahrzeugtechnik [Bus systems in vehicle engineering], 4th edition, Vieweg+Teubner 2011

[0004] [2]AUTOSAR Specification of Secure Onboard Communication, Version 4.3.1, www.autosar.com [3]Yang, G., Zhu, B., Suder, V., Aagaard, MD, Gong, G: The SIMECK Family of Block Ciphers, Cryptographic Hardware and Embedded Systems - CHES 2011 (pp. 342-357). 2015 Berlin Heidelberg, Springer-Verlag. pdf available at eprint.iacr.org.

[0005] A message authentication code "MAC" can be used to ensure the integrity of a transmitted message, similar to a checksum. In the case of a cryptographic MAC (i.e., CMAC), this can only be calculated at the receiving end if the key is known. Thus, a receiving bus subscriber who also possesses the key can check the authenticity of the message content. The message itself is transmitted in unencrypted form together with the MAC or CMAC. Summary of the invention

[0006] The object of the present invention is to efficiently implement secure communication in a bus system of a vehicle.

[0007] This object is achieved by the subject matter of each independent patent claim, in particular at the transmitter and at the receiver, in each case implemented as a method and an apparatus. Embodiments of the invention can effectively allow secure communication in a network of vehicles. The method can, for example, effectively allow a message authentication code CMAC transmitted in a replay-resistant manner to be authenticated at the receiver of a data packet.

[0008] Particularly advantageous embodiments of the invention are indicated in the dependent claims and in the description.

[0009] According to an embodiment of the invention, the count can be, for example, generated using a counter, for example representing the number of messages transmitted and / or received via the bus system, in particular since the last restart of the bus system to the present day (this can be particularly easy to implement, for example in software), or the count can be a timer value of at least one timer, in particular available on multiple or all bus subscribers (this can increase safety, in particular when the same time / timer value is available on multiple bus subscribers).

[0010] According to an embodiment of the present invention, the authentication check at the recipient can in particular use a threshold when comparing the currently received message count with the previously received message count, and the threshold is preferably set to a higher value than other normal operations after the bus system is restarted, which can optimize security according to the situation.

[0011] The bus system (in particular a CAN bus, or a CAN-FD bus, or a LIN bus, or a SPI bus, or an Ethernet bus, or an I2C bus) can be provided for communication between the ECUs. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Further features and advantages of some advantageous embodiments of the invention emerge from the following description of exemplary embodiments of the invention, with reference to the accompanying drawings, in which some possible embodiments of the invention are presented by way of example in a simplified and schematic manner:

[0013] Figure 1 shows a motor vehicle having a network according to the invention in the form of a bus system having a plurality of bus subscribers,

[0014] Figure 2 The structure of a data packet to be transmitted and the generation of the parts of the data packet which can usually be used in a conventional bus system are shown.

[0015] Figure 3 shows a message contained in each of four data packets in a conventional bus system and possible values ​​of a message authentication code, and, for example, a truncated freshness value transmitted in the data packet,

[0016] Figure 4The steps and apparatus according to an exemplary embodiment of the present invention (at the transmitting and receiving sides) are shown.

[0017] Figure 5 The message and the value of the message authentication code contained in each of four data packets according to an exemplary embodiment of the present invention are shown by way of example, as well as calculated intermediate values ​​which are not transmitted in the data packets, for example. DETAILED DESCRIPTION

[0018] Figure 1 For some embodiments of the present invention, a simplified description is schematically shown of how data packets DP1, DP2, DP3, DP4 (e.g., in particular PDUs or protocol data units, or in particular in a CAN bus, also called frames, in particular data frames) are typically transmitted from a bus subscriber SG7 transmitting data packets DP1, DP2, DP3, DP4 to a bus subscriber SG6 receiving data packets DP1, DP2, DP3, DP4 of a bus system BU (which has multiple bus subscribers / ECUs SG1 to SG10) in a network (e.g., a bus BU, in particular a CAN bus and / or a LIN bus and / or other bus systems) of a motor vehicle Kfz (e.g., a car or a truck), which data packets DP1, DP2, DP3, DP4 can be used, for example, to control a motor Mot or a door opener TOeff1, Toeff2 (connected to the bus subscribers) or to transmit data from sensors, etc.

[0019] The structure of the data packets DP1 , DP2 , DP3 , DP4 is described in de.wikipedia.org / wiki / Controller_Area_Network using the example of a network in the form of a CAN bus.

[0020] Figure 2 A general and simplified illustration is provided of the use of a message authentication code (MAC) (transmitted in truncated form as CMAC) by the transmitting bus subscriber SG7, the use of the MAC being intended to ensure the integrity of the transmitted data packets DP1, DP2, DP3, which is similar to a checksum, for example, i.e. allowing an authentication check of the transmitted data packets DP1, DP2, DP3, DP4 at the receiving bus subscriber SG6 of the data packets.

[0021] A message authentication code (MAC, known, for example, from de.wikipedia.org / wiki / Message_Authentication_Code) is generated from a message MSG (ie, the user data to be transmitted and / or the DATA field in a data packet) having a length of M bytes (bytes, for example, each comprising 8 bits; M, for example = 8), i.e.,

[0022] - using a (e.g. symmetric) encryption method f (e.g. AES-128) which uses a key KEY (which is known to the transmitting bus subscriber SG7 and the receiving bus subscriber SG6) and a freshness value FV (e.g. in the form of a (message) counter or a timestamp), i.e. in simplified form:

[0023] MAC=f(MSG,FV,Key).

[0024] The transmitting bus subscriber SG7 transmits the following to the receiving bus subscriber SG6 in a data packet DP1 (or DP2 or DP3 or DP4 or DP0), for example:

[0025] - the (user data) message MSG itself (e.g. in unencrypted form) of length M in bytes,

[0026] - and a truncated (to a byte length F) freshness value FV (the reference numeral for this truncation is Trunc), called the truncated freshness value or TFV after truncation (e.g. in unencrypted form),

[0027] - and a truncated (to byte length N) (referenced Trunc) message authentication code MAC (referred to as CMAC after this truncation).

[0028] M, F, N are natural numbers, for example fixed values ​​which are used in each case for all data packets.

[0029] Without knowing the key Key, it is not possible to calculate the transmitted truncated (to length N) message authentication code CMAC.

[0030] The receiving bus subscriber, which also possesses the key Key, can use the received truncated message authentication code CMAC to check the authenticity of the content of the message MSG.

[0031] If data packets DG1 , DG2 , DG3 with the same message content MSG are transmitted repeatedly, the result is also always the same message authentication code MAC and therefore also always the same transmitted truncated message authentication code CMAC.

[0032] To avoid such duplications (replay attacks), the message may contain a constantly changing value (truncated freshness value TFV), such as a sufficiently long counter (counter for data packets DP1, DP2, DP3), a timestamp (for sending the message) or a random value FV, or a truncated TFV.

[0033] One commonly used authentication method is Secure On-board Communication (SecOC), which is described in the reference [2] [Autosar] mentioned at the outset and is used for secure real-time communication in a vehicle, for example via the machine CAN.

[0034] The standard SecOC method according to [2] provides resource-efficient authentication of messages (PDUs) containing critical data and also provides assurance of message freshness to prevent replay attacks. Basic symmetric encryption is used for transmission (TX-ECU, Figure 1 SG7 in) and receiving RX-ECU ( Figure 1 The typical CAN bus and the CAN-FD extension are also particularly suitable as communication media.

[0035] Figure 2 A schematic representation for generating an authentic message by a cryptographic authenticator function according to [2] is shown. In order to be robust against replay attacks, the freshness value FV must change with each transmission, even if the message MSG is unchanged. Therefore, FV is typically, for example, a monotonic counter with a sufficiently long word length, or a timestamp representing a global time known to multiple or all bus subscribers. In this representation, both the freshness value and the calculated MAC are truncated for efficiency reasons.

[0036] Usually use Figure 2 In a typical CAN bus shown with a maximum of 8 bytes per message, for example, the length [M, F, N]=[4, 1, 3] is used in order not to exceed the maximum number of data bytes (of data packet DP1) of 8.

[0037] The truncation itself then requires that the untruncated freshness value FV (i.e., a longer monotonic counter or timestamp) in the receiving bus subscriber be kept up to date or synchronized with the transmitting bus subscriber, which can be quite problematic, e.g. during startup (of the bus system). If the CMAC in the receiving bus subscriber is not equal to the transmitted value, the entire message will be rejected as not authentic.

[0038] Although the alternative option of not truncating avoids synchronization issues altogether, this requires higher bandwidth or transfer time on the bus.

[0039] Figure 3 An example of the standard SecOC method is shown using the table (copied here for simplicity),

[0040] The parts of the data packet DP1 have the following lengths (in bytes): M=4, F=1, N=3,

[0041] and wherein the encryption method f (= "authenticator") is in the form of AES-128,

[0042] And there is also the key Key = 0x2b7e151628aed2a6abf7158809cf4f3c.

[0043]

[0044] The transmitted message MSG is in each case "0x00000000"; a freshness value (e.g. a counter of the number of sent data packets DP1, DP2, DP3, DP4) FV, a message authentication code (MAC)

[0045] And the truncated message authentication code CMAC is as shown.

[0046] Figure 3 The example in shows different values ​​for each truncated message authentication code CMAC (each having a length of N=3 bytes) for a constant message MSG=0, the difference being due to the variation of the freshness value FV (counter or timestamp).

[0047] This effectively prevents replay attacks and authenticity is ensured by knowing the key in the transmitting and receiving bus subscribers. As a result of the truncation, now only the lower byte of the TFV (because F=1) is transmitted, which means that the information about the upper byte of the FV is ensured by additional synchronization.

[0048] In addition to monotonic counters, for example, a timestamp encoding a global time (e.g., the number of seconds since January 1, 2019) is also suitable as a freshness value. This solution is suitable for messages that wish to be authenticated every second; the timestamp will only overflow after approximately 136 years.

[0049] Due to the frequency tolerances of commonly used oscillators, even when timestamping is used, adequate synchronization of the global time in the network must be ensured by additional communications frequently enough.

[0050] In this respect, the method and the device according to the invention represent an alternative approach.

[0051] Exemplary embodiments of the present invention are described below.

[0052] Figure 4 Some exemplary embodiments of the present invention are shown.

[0053] - how (in step S1 ) before transmitting, a transmitting bus subscriber SG7 (transmitting a data packet such as DP1 ) can generate from a (user data) message MSG to be included in the data packet DP1 a message authentication code CMAC also to be included in the data packet DP1 ,

[0054] - (in step S2) how a network, in particular a (CAN etc.) bus system BU, can be used to transmit a data packet DP1 (which in particular contains or only contains a message MSG and a message authentication code CMAC) from a transmitting bus subscriber SG7 (of DP1, DP2, DP3, DP4 etc.) to a receiving bus subscriber SG6 (of DP1, DP2, DP3, DP4 etc.),

[0055] - (in step S3) the receiving bus subscriber SG6 (receiving a data packet such as DP1) can perform an authentication check on the data packet DP1 using the message MSG contained in the received data packet DP1 and the message authentication code CMAC (also contained in DP1).

[0056] In step S1, before transmitting, the transmitting bus subscriber SG6 (transmitting a data packet such as DP1) generates a message authentication code CMAC from the (user data) message MSG to be included in the data packet DP1, also to be included in the data packet DP1, by:

[0057] - generating an encrypted message code CMAC1 from the message MSG using a first encryption method (BC1) implemented in a first encryption device BC1 with a first key K1,

[0058] - using the second encryption method (BC2) implemented in the second encryption device BC2 to generate an encrypted count CYPH from the count Count++ (in particular the timer value of the counter or timer for the transmitted / received messages DP1, DP2, DP3, DP4) by means of the second key K2, - using the "exclusive OR" (=XOR) logic operation X using the (XOR) logic device X to generate the message authentication code CMAC (to be transmitted via the bus system BU) from the encrypted message code CMAC1 and the encrypted count CYPH.

[0059] The formula for illustrating the encryption of the transmitting bus subscriber SG7 (before transmitting the data packet) may be as follows:

[0060] CMAC1=BC1(MSG,K1)

[0061] CYPH=BC2(Count,K2)

[0062]

[0063] One embodiment of the present invention may be implemented at the transmitting party as a method or apparatus according to S1.

[0064] One embodiment of the present invention may be implemented at the receiving end as a method or apparatus according to S3.

[0065] An embodiment of the present invention may also be implemented as a method or apparatus according to the combination of S1+S2+S3.

[0066] Therefore, it is proposed to generate a replay-resistant CMAC on the transmitting side in step S1. BC1 is, for example, a block cipher algorithm for generating CMAC1 from a message MSG of length M bytes using key K1. BC2 is, for example, a block cipher algorithm with key K2 and a counter that increments with each transmission, and whose block length is N, for example equal to the length of CMAC1, i.e., for example N=4, BC1=AES, BC2=SIMECK.

[0067] In step S2, the network, in particular the (CAN, etc.) bus system BU, is used to transmit such (one or more) data packets DP1 (in particular containing or only containing the message MSG and the message authentication code CMAC) from the transmitting bus subscriber SG6 (DPI, DP2, DP3, DP4, etc.) to the receiving bus subscriber SG6 (DP1, DP2, DP3, DP4, etc.).

[0068] In step S3, the receiving bus subscriber SG6 (receiving a data packet such as DP1) may perform an authentication check on the data packet DP1 using the message MSG contained in the received data packet DPI and the message authentication code CMAC (also contained in DP1) by:

[0069] - another first encryption device BC1 (e.g. the same as BC1 of the transmitter SG7),

[0070] -XOR logic device X,

[0071] -Decryption device BC2 -1 (the minus one operation on BC2 is the opposite of the encryption device BC2) and

[0072] - Comparison means VG (eg considering a threshold value for the count difference (RX-Count[n] minus RX-Count[n-1]) of, for example, 1 or 2 or 3 or 4 or 5 or more).

[0073] In step 3, a first encryption device BC1 (another one, e.g. operating in the same way as the transmitter's BC1) generates an encrypted message code CMAC1 using a key K1 (e.g. asymmetric or symmetric and / or the same as known to the transmitter SG7) using the message MSG contained in the data packet DP1 received (by the receiving bus subscriber SG6).

[0074] Using the message authentication code CMAC contained in the received data packet DP1 and the encrypted message code CMAC1, an intermediate value CIPH is generated using a (XOR) logic device X.

[0075] Using the decryption device BC2 -1 (The operation of subtracting one from BC2 is, for example, the opposite of the encryption device BC2) The currently received message count RX-Count[n] (n=the number of currently received messages DP1, i.e., here n=1) is generated from the intermediate value CIPH, and the previously received message count RX-Count[n-1] (n=the number of currently received messages DP1, i.e., currently n=1) is subtracted from the currently received message count using the subtraction device Sub (determined accordingly for the data packet DP0 received before the data packet DP1).

[0076] The comparison device VG compares the difference between the currently received message count RX-Count[n] and the previously received message count RX-Count[n-1] with 1 or with a threshold value S, and if the difference is one or less than the threshold value S, the received data packet DP1 is defined as authenticated, but if the difference is greater than one or greater than the threshold value S, the received data packet DP1 is defined as not authenticated.

[0077] Therefore, step S3 or Figure 4 The device in the lower middle part shows a schematic representation for authenticating the anti-replay CMAC at the receiving side SG6. BC1 is a block cipher algorithm for generating CMAC1 from the message MSG using the key K1. BC2 is a block cipher algorithm with the key K2. The last received value RX-Count[n-1] is used to check, for example, whether the currently received counter RX-Count[n] complies with the authentication acceptable tolerance range 0. <RX-Count<S。

[0078] The threshold value S may be set to a higher value (eg S=2 . . . 5) compared to other normal operation (eg S=1) during or after a restart, in particular a reboot (eg of a network / bus system BU).

[0079] The encryption device BC1 and the encryption device BC2 can be different from each other or can also be the same. The encryption methods BC1, BC2 can be different from each other or can also be the same. The keys K1, K2 can be different from each other or can also be the same.

[0080] Advantageously, on multiple or all bus subscribers (e.g. SG6, SG7), the encryption device BC1 is the same, the encryption device BC2 is the same, the encryption methods BC1, BC2 are the same, the key k1 is the same, and the key k2 is the same, particularly when symmetric encryption is used; on the other hand, if asymmetric encryption is used, it is advantageous that the encryption and decryption performed by all subscribers match each other.

[0081] The formula for illustrating the encryption, decryption and authentication check of the receiving bus subscriber SG6 may be as follows:

[0082]

[0083] Instead of according to Figure 2 and Figure 3 Reference notation "FV" is used for freshness values ​​when discussing more conventional methods, and reference notation "Count++" is used to represent counts in the description according to the exemplary embodiment of the present invention for the sake of distinction.

[0084] The count Count++ may be generated using, for example, a counter that is incremented with each transmission, for example a block length N equal to the length of the transmitted message authentication code CMAC1, for example N=4, BC1=AES, BC2=SIMECK, encrypted count CYPH.

[0085] Figure 5 Using a table (copied here for simplicity), an exemplary embodiment according to the present invention (e.g., according to Figure 4 ), as well as examples of values ​​that the contained message MSG and the contained message authentication code CMAC in the data packets DP1, DP2, DP3, DP4 in the method and / or apparatus of ), as well as values ​​that the encrypted message code CMAC1 (not contained in DP1), the count Count++ (not contained in DP1) and the intermediate value CIPH (not contained in DP1) can have:

[0086] M=4, N=4, BC1: AES-128, BC2 SIMECK32[3]

[0087] K1=0x2b7e151628aed2a6abf7158809cf4f3c,

[0088] K2 = 0x1918111009080100,

[0089] MSG CMAC1 Count CIPH CMAC 0x00000000 0x0c6bf77d 0x00000000 0x20dd44f0 0x2cb6b38d 0x00000000 0x0c6bf77d 0x00000001 0x2b3ec7e7 0x2755309a 0x00000000 0x0c6bf77d 0x00000100 0x8a48dfef 0x86232892 0x00000000 0x0c6bf77d 0x00000101 0x1a54d0ef 0x163f2792 .

[0090] Figure 5The example in shows that for a constant message MSG=0, the CMAC1 values ​​are also constant (as expected), but these values ​​are not transmitted. However, the different CMAC values ​​are caused by changes in the counter value (Count+++) or timer of the message counter (on the transmitting bus subscriber SG7, for the data packets DP1, DP2, DP3, DP4 transmitted by the transmitting bus subscriber (e.g. since the last bus reset and / or via the data bus, etc.); and / or on the receiving bus subscriber SG6, for the data packets DP1, DP2, DP3, DP4 received by the receiving bus subscriber (e.g. since the last bus reset and / or via the data bus).

[0091] The CMAC value is transmitted; this effectively prevents replay attacks, and authenticity is ensured by knowing the secret key in both the sender and the receiver. Figure 2 and Figure 3 Compared to the example using the common approach in , here the counter is not truncated, which means that no additional synchronization is required.

[0092] Since the method according to the invention has longer counter and CMAC values ​​compared to the standard SecOC method, the security against brute force attacks can be higher. In addition, a freely selectable tolerance S can be set in the receiver, which makes it possible to tolerate counter deviations at startup, for example so that counter deviations greater than 1 are allowed immediately after startup.

[0093] Another possible advantage is the possible saving of computing time with constant messages, which is often the case for automotive or IoT applications. The message-dependent CMAC1 can then be calculated, for example, in advance; depending on the value of the counter CIPH can be used, for example, with lightweight block cipher methods with lower runtime and resource requirements.

[0094] A commonly used standard CMAC algorithm BC1 is currently AES-128, which is supported in hardware in the case of larger controllers. Depending on the network used or the communication on the ECU (LIN, CAN, CAN-FD, SPI, I2C) [1], various LW block cipher algorithms can be considered for various μCs; by way of illustration, algorithms from the SIMECK family [3] can be used here:

[0095]

[0096] The abbreviations used may, for example, have the following meanings:

[0097] BC Block Cipher Algorithm

[0098] CAN, CAN-FD Controller Area Network, CAN Flexible Data-rate

[0099] CMAC Cryptographic Message Authentication Code

[0100] Count "freshness" counter

[0101] CYPH ciphertext

[0102] HSM Hardware Security Module

[0103] LIN Lean Information Network

[0104] LW Lightweight

[0105] MSG Message

[0106] SecOC Secure In-Vehicle Communications.

Claims

1. A method for generating (K1, K2, BC1, BC2, X) at least one data packet (DP1, DP2, DP3, DP4) to be transmitted in a bus system (BU), in, (S1) Before transmitting the at least one data packet (DP1) containing the message (MSG) to be included in the data packet (DP1), the bus subscriber (SG7) transmitting the data packet (DP1) generates a message authentication code (CMAC) also to be included in the data packet (DP1) using a first encryption device (BC1) by: - generating an encrypted message code (CMAC1) from the message (MSG) using a first encryption method (BC1) with a first key (K1), - generating an encrypted count (CYPH) from the count (Count++) using a second encryption method (BC2) with a second key (K2), and - generating a message authentication code (CMAC) to be transmitted from the encrypted message code (CMAC1) and the encrypted count (CYPH) using a logic operation (X), wherein the message authentication code (CMAC) to be transmitted is generated from the encrypted message code (CMAC1) and the encrypted count (CYPH) using an exclusive OR logic operation (X), A replay-resistant message authentication code is generated at the transmitting party, wherein the first encryption method (BC1) is a block cipher algorithm for generating an encrypted message code (CMAC1) from a message (MSG) having a length of M bytes using the first key (K1), and the second encryption method (BC2) is a block cipher algorithm having a block length of N and having the second key (K2) and a counter that increments with each transmission.

2. The method according to claim 1, characterized in that The bus system (BU) is a bus system of a motor vehicle (Kfz).

3. The method according to claim 1, characterized in that The count (Count++) is a value generated using a counter (Za) and represents the number of messages (DP1, DP2, DP3, DP4) transmitted and / or received via the bus system (BU), Alternatively, the count is a timer value of at least one timer (Ti).

4. The method according to claim 3, characterized in that The value indicates the number of messages (DP1, DP2, DP3, DP4) which have been transmitted and / or received via the bus system (BU) since the last restart of the bus system (BU).

5. The method according to claim 3, characterized in that The timer value is available on multiple or all bus subscribers (SG1 .. SG10).

6. A method for performing an authentication check (K1, K2, BC1, X, BC2) on at least one data packet (DP1, DP2, DP3, DP4) received via a bus system (BU) -1 ,Sub,VG) method, in, (S3) A bus subscriber (SG6) receiving at least one data packet (DP1) - generating an encrypted message code (CMAC1) from a message (MSG) contained in a received data packet (DP1) using a first encryption method (BC1) with a first key (K1), - generating, using the logic device (X), an intermediate value (CIPH) from the transmitted message authentication code (CMAC) also contained in the received data packet (DP1) and the generated encrypted message code (CMAC1), -Use a decryption device (BC2 -1 )Use decryption (BC2 -1 ) generates the currently received message count (RX-Count[n]) from the intermediate value (CIPH), - comparing (VG; S) the currently received message count (RX-Count[n]) with a previously received message count (RX-Count[n-1]) determined for a data packet (DP0) received before the data packet (DP1), - Using the difference between the currently received message count (RX-Count[n]) and the previously received message count (RX-Count[n-1]) as a basis for defining a received data packet (DP1) as authenticated or unauthenticated.

7. The method according to claim 6, characterized in that The bus system (BU) is a bus system of a motor vehicle (Kfz).

8. The method according to claim 6, characterized in that The at least one data packet (DP1, DP2, DP3, DP4) is a previously generated (SG7) data packet (DP1, DP2, DP3, DP4) as claimed in one of claims 1 to 5.

9. The method according to claim 6, in, The difference between the currently received message count (RX-Count[n]) and the previously received message count (RX-Count[n-1]) is used as a basis for defining the received data packet (DP1) as authenticated or unauthenticated in the following manner: Only if the difference is greater than one or greater than a threshold value (S), the received data packet (DP1) is considered unauthenticated.

10. The method according to claim 9, characterized in that The threshold value (S) is set to a higher value (S=2 . . . 5) after a restart of the bus system (BU) than in otherwise normal operation (S=0; S=1).

11. The method according to any one of claims 6 to 10, in, The exclusive-OR logic operation (X) generates an intermediate value (CIPH) using the logic device (X) from the transmitted message authentication code (CMAC) also contained in the received data packet (DP1) and the generated encrypted message code (CMAC1).

12. The method according to any one of claims 6 to 10, characterized in that A plurality of bus subscribers (SG1 . . SG10) of the bus system (BU) use the same first encryption method (BC1) and / or the same first key (K1) and / or the same second encryption method (BC2) and / or the same second key (K2).

13. The method according to claim 12, characterized in that A bus subscriber (SG6) receiving a data packet (DP1) and a bus subscriber (SG7) transmitting a data packet (DP1) use the same first encryption method (BC1) and / or the same first key (K1) and / or the same second encryption method (BC2) and / or the same second key (K2).

14. The method according to claim 12, characterized in that A plurality of bus subscribers (SG1 . . SG10) of the bus system (BU) derive the second key (K2) from the result CMAC1 of the first cryptographic method (BC1).

15. The method according to claim 14, characterized in that The bus subscriber (SG6) receiving the data packet (DP1) and the bus subscriber (SG7) transmitting the data packet (DP1) derive the second key (K2) from the result CMAC1 of the first encryption method (BC1).

16. The method according to any one of claims 6 to 10, characterized in that The timer value (Count++) representing time information related to the global time is distributed securely, ie authentically and confidentially, from one subscriber (SG7) to all other subscribers (SG1..SG10) in the network.

17. A device for generating (K1, K2, BC1, BC2, X) at least one data packet (DP1, DP2, DP3, DP4) to be transmitted in a bus system (BU), in, a first encryption device (BC1) provided by the bus subscriber (SG7) transmitting the data packet (DP1) and designed to generate, before transmitting the at least one data packet (DP1), a message authentication code (CMAC) from a message (MSG) to be included in the data packet (DP1) and also to be included in the data packet (DP1) to be transmitted, To do this, on the transport bus subscriber (SG7): a first encryption device (BC1) designed to generate an encrypted message code (CMAC1) from the message (MSG) using a first encryption method (BC1) with a first key (K1), a second encryption device (BC2) designed to generate an encrypted count (CYPH) from the count (Count++) by means of a second key (K2) using a second encryption method (BC2), and - the logic device (X) is designed to generate a message authentication code (CMAC) from the encrypted message code (CMAC1) and the encrypted count (CYPH) using a logic operation (X), wherein the message authentication code (CMAC) to be transmitted is generated from the encrypted message code (CMAC1) and the encrypted count (CYPH) using an exclusive OR logic operation (X), A replay-resistant message authentication code is generated at the transmitting party, wherein the first encryption method (BC1) is a block cipher algorithm for generating an encrypted message code (CMAC1) from a message (MSG) having a length of M bytes using the first key (K1), and the second encryption method (BC2) is a block cipher algorithm having a block length of N and having the second key (K2) and a counter that increments with each transmission.

18. The device according to claim 17, characterized in that The device is used to carry out the method according to one of claims 1 to 5 .

19. The device according to claim 17, characterized in that The bus system (BU) is a bus system of a motor vehicle (Kfz).

20. A method for performing an authentication check (k1, k2, BC1, X, BC2) on at least one data packet (DP1, DP2, DP3, DP4) received via a bus system (BU) -1 , Sub, VG) device, in, (S1) at a bus subscriber (SG6) receiving at least the data packet (DP1), a first encryption device (BC1) designed to generate an encrypted message code (CMAC1) from a message (MSG) contained in a received data packet (DP1) by means of a first key (K1) using a first encryption method (BC1), - the logic device (X) is designed to generate an intermediate value (CIPH) from the generated encrypted message code (CMAC1) and the message authentication code (CMAC) contained in the received data packet (DP1), -Decryption device (BC2 -1 ) is designed to determine the current received message count (RX-Count[n]) of the current data packet (DG1) from the intermediate value (CIPH), - The comparison device (VG) is designed to use the difference between the current received message count (RX-Count[n]) and the previous received message count (RX-Count[n-1]) determined for the data packet (DP0) received before the data packet (DP1) as the basis for defining the received data packet (DP1) as authenticated or unauthenticated.

21. The device according to claim 20, characterized in that The device is a device as claimed in any one of claims 17 to 19.

22. The device according to claim 20, characterized in that The device is used to carry out a method according to one of method claims 6 to 16 .

23. The device according to claim 20, characterized in that The bus system (BU) is a bus system of a motor vehicle (Kfz).

24. The device according to any one of claims 17 to 23, characterized in that The bus system is a CAN bus or a CAN-FD bus or a LIN bus or a SPI bus or an I2C bus, and / or is provided for communication between ECUs.

Images