A CAN bus security protection method, device and storage medium

Abstract

The present invention provides a CAN bus security protection method, device and storage medium, designs a lightweight security enhanced CAN bus system, implements double protection of ID anonymous transmission and data field obfuscation for data frames on the bus, so that bus information is only recognized, received and decoded by mutually authenticated senders and receivers during transmission. The present invention includes: the sender generates a random number and sends a session initial frame in the bus; the receiver receives the session initial frame and verifies the identity of the sender; the two parties negotiate and communicate the session key and the subsequent hash key chain; the two parties use the hash key chain to perform anonymous and continuous ID updates of subsequent call data frames; the sender uses the key chain and the combined encoding scheme to shuffle and replace the data field; the receiver uses the key chain and the combined decoding technology to obtain the original data and execute it.

Description

Technical Field

[0001] The invention belongs to the field of automobile CAN bus communication, and in particular relates to a CAN bus security protection method, device and storage medium. Background Art

[0002] Developed in the early 1980s, the Controller Area Network (CAN) has been the communication standard for in-vehicle networks since 2008 due to its robustness and low cost. However, CAN is designed primarily to ensure reliable communication, with data packets broadcast on the bus without source / destination addresses, lacking any local encryption, authentication, or other security protections commonly used in other networks. As a result, attackers can easily eavesdrop on CAN messages to obtain desired data, or inject fake CAN messages with spoofed IDs or content. This can lead to violations of confidentiality, integrity, and availability.

[0003] CAN bus frame ID anonymity and encryption methods based on traditional cryptography are two common solutions for protecting the CAN bus. ID anonymity is used to protect bus broadcast frames, so that eavesdroppers on the bus cannot obtain the frame content they want by monitoring the original ID. In the past, a work that proposed ID anonymity was to use a hash chain to change the ID of the CAN message. This work uses the same key to achieve changes in the ID hash chain throughout the session, and there are the following vulnerabilities. Once the current ID and session key are captured, subsequent ID monitoring attacks can be easily implemented. At the same time, it is not clear how it can achieve error self-recovery when there are multiple receivers.

[0004] At the same time, there are some existing studies based on lightweight encryption mechanisms to protect CAN bus data. However, encryption may cause large delays on resource-limited ECUs, which is unacceptable for safety-critical vehicle real-time systems. On the other hand, encryption that is too light is vulnerable to brute force attacks. Another encryption method to ensure the security of the CAN bus is to add authentication, such as using a message authentication code (MAC). However, since the data field in the CAN message is limited to 8 bytes, only truncated MACs can be used, and smaller MACs increase the probability of forgery through collisions. In addition, given that the signal values ​​in the data field are the same, traditional encryption methods may produce the same password information. Although the one-time password (OTP) scheme can introduce sufficient randomness by XOR, it is necessary to use a one-time key that is not shorter than the information being sent. If such a key is used for more than one message, then the attacker can XOR the consecutive password information and easily infer the plaintext. In addition, if the attacker somehow knows the plaintext, he may have the opportunity to crack the key. Therefore, existing solutions are not enough to protect CAN. Without increasing anonymity and randomness, even an unbreakable password mechanism cannot prevent all attacks, such as replay attacks. Summary of the invention

[0005] Purpose of the invention: The technical problems to be solved by the present invention mainly include realizing dynamic anonymity of identifiers (IDs) on a control area network (CAN) bus and obfuscation protection of data fields.

[0006] The present invention aims to solve the ID anonymity problem by utilizing an ID hash chain with a dynamic key, so that the change of the ID is closely related not only to the previous ID but also to the change of the key chain. It also implements the error recovery mechanism of the receiver, including self-recovery when an error occurs in the current session and error recovery when a receiver misses multiple sessions in the case of multiple receivers.

[0007] At the same time, in order to solve the defects of traditional encryption and shuffling on the CAN bus, it is proposed to use a shuffling scheme for the bus data to increase the randomness of the communication process. However, the traditional shuffling scheme has many invalid exchanges for the data bit string of the present invention. Therefore, the second point of the present invention proposes an improved shuffling scheme to achieve efficient data obfuscation.

[0008] The present invention specifically provides a CAN bus security protection method based on mobile target defense technology, comprising the following steps:

[0009] Step 1: The sender's Electronic Control Unit (ECU) generates a random number and sends a session initialization frame in the CAN bus to indicate the start of the session;

[0010] The receiver receives the session initialization frame and verifies the identity of the sender. The sender and receiver negotiate the communication session key and calculate the hash key chain consisting of the communication key in their respective ECUs.

[0011] Step 2: The sender and the receiver use a hash key chain composed of communication keys to anonymously and continuously update the ID of the data frame during the session communication. The sender uses the calculated anonymous ID to send the frame to the bus, and the receiver calculates the expected anonymous ID in advance and updates it to the next anonymous ID after receiving it.

[0012] Step 3: The sender first uses a cyclic redundancy check (CRC) to calculate the checksum of the original data and puts it in the CRC field of the data frame, and then uses a hash key chain and a combined encoding and decoding scheme to shuffle and permute the original data field before sending it;

[0013] Step 4: The receiver uses the hash key chain and reverse combination encoding and decoding scheme corresponding to the sender's data replacement to obtain the original data and perform an integrity check.

[0014] Furthermore, in step 1,

[0015] The random number carried by the session initial frame is generated locally by the sender's electronic control unit ECU using a random number generation function combined with a sending timestamp, and other parameters are shared in the initial frame, including the maximum number of frames for the session and the granularity of randomization (each frame or multiple frames implement subsequent hash key chain updates). The hash output in the session initial frame is calculated by combining session parameters such as the random number, the maximum number of frames for the session, and the granularity of randomization with the key bound to the original ID, where the original ID is the communication ID used by the sender's electronic control unit ECU and the receiver's electronic control unit ECU when no anonymous ID communication is performed, the session parameters are specified by the sender, and the key is only negotiated and stored in advance by the sender's electronic control unit ECU and the receiver's electronic control unit ECU, and is not sent on the bus;

[0016] When the sender decides to refresh the session, it sends the session initialization frame again on the bus to start a new session, and this time carries the anonymous ID of the previous session to prevent replay attacks.

[0017] Furthermore, in step 1,

[0018] When the receiver receives the session initialization frame, it performs the same hash output calculation based on the key bound to the original ID stored by the receiver and the parameters carried in the session initialization frame. If the calculation result is the same as the hash output field data in the session initialization frame, the receiver successfully implements the sender identity authentication. Otherwise, an active error flag will be issued in the bus to notify the bus that the authentication has failed.

[0019] After successful authentication, the sender and receiver will jointly calculate the session key of the current session. The session key is a hash calculation combining the random number, the session number, and the key bound to the original ID saved by the sender and receiver.

[0020] Furthermore, in step 2,

[0021] The communication key corresponds to the data frame one by one and is calculated by chain hashing the session key. On this basis, the sender and receiver start from the original ID and combine the chained communication key to realize the hash change of the anonymous dynamic ID chain.

[0022] If the time when the receiver does not receive the expected frame exceeds a threshold (generally based on five times the time of a periodic message), the error recovery method designed by the present invention is started, and the frame filter is configured to receive frames on all buses, and a chain is used in the receiver's electronic control unit ECU to backwardly calculate the subsequent expected IDs, and the subsequent expected IDs are stored as a set; if the captured ID is in the set, the frame filter is updated; if the intra-session recovery fails, wait until the next time the sender sends the initial frame of the session, and if the remaining receivers do not issue an error flag, the receiver directly calculates the session key for subsequent communication.

[0023] Furthermore, in step 3,

[0024] The sender performs CRC check on the original data to be sent and puts it into the data frame. Then, the original data bit string is encoded into position array and the numerical index corresponding to the position array is obtained using the combination number summation formula; the forward offset of the index is realized based on the communication key corresponding to the current frame; the index is decoded using the reverse scheme to obtain the shuffled bit string, which is put into the data field of the data frame for sending.

[0025] Furthermore, in step 4,

[0026] After the receiver monitors the expected frame whose ID is the one it expects to receive in the bus, it chooses to accept the expected frame and performs a reverse shuffle operation on the data bit string in the received data frame, first position-encodes the original data bit string to obtain the shuffled numerical index, reversely shifts the communication key corresponding to the expected frame to obtain the original index, and position-decodes again to obtain the original data bit string;

[0027] The CRC checksum is calculated for the original data obtained by reverse shuffling, and compared with the checksum carried by the CRC field in the data frame to obtain the authenticity of the data. If it is authentic, the subsequent data content is parsed and executed, otherwise an error signal is issued in the bus to ask the sender to resend the data information.

[0028] The present invention also provides a CAN bus safety protection device, comprising:

[0029] The session initialization module is used to control the sender's electronic control unit ECU to generate a random number and send a session initialization frame in the CAN bus to indicate the start of the session; the receiver receives the session initialization frame and verifies the sender's identity, the sender and the receiver negotiate the communication session key and calculate the hash key chain composed of the communication key in their respective ECUs

[0030] The data update module is used to control the sender and the receiver to use the hash key chain composed of the communication key to anonymously and continuously update the ID of the data frame during the session communication. The sender uses the calculated anonymous ID to send the frame to the bus, and the receiver calculates the expected anonymous ID in advance and updates it to the next anonymous ID after receiving it.

[0031] A redundancy check calculation module is used to control the sender to use a cyclic redundancy check CRC to calculate the checksum of the original data and place it in the CRC field of the data frame, and use a hash key chain and a combined encoding and decoding scheme to shuffle and replace the original data field before sending;

[0032] The integrity check module is used to control the receiver to use the hash key chain and reverse combination encoding and decoding scheme corresponding to the data replacement implemented by the sender to obtain the original data and perform integrity check.

[0033] The present invention also provides a storage medium storing a computer program or instruction, and when the computer program or instruction is executed, the method described is implemented.

[0034] Beneficial effects: The present invention realizes the anonymity of frame ID on the CAN bus. The frames in the bus can only be identified by the sender and the receiver, which can resist eavesdropping attacks on the bus. At the same time, it provides the identity authentication of the sender and the error recovery effect when errors occur in the anonymization process.

[0035] The present invention realizes the obfuscation function of the data field at the same time, ensures the confidentiality of the data on the bus through a shuffling scheme based on combinatorial mathematics, and indicates the unbiasedness of the shuffling scheme through proof, while providing integrity check for the receiver. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments, and the above and / or other advantages of the present invention will become more clear.

[0037] Figure 1 It is a structural diagram of the present invention.

[0038] Figure 2 This is a schematic diagram of the specific method of ID anonymity.

[0039] Figure 3 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0040] The present invention relates to an authentication and data security method for bus communication, and belongs to a solution for realizing security protection of data frames on a bus by utilizing the idea of ​​mobile target defense, and specifically relates to a solution based on hash chain and combinatorial mathematics to realize the anonymity of data frames and the shuffling function of data fields to protect bus transmission.

[0041] The technical solution adopted by the present invention is a CAN bus security protection method based on mobile target defense technology, specifically a CAN bus protection protocol based on ID anonymity and data shuffling, such as Figure 1 , Figure 3 As shown, the following steps are included:

[0042] Step 1, session initialization: includes negotiation between the sender and receiver of the session key to start the session and sharing of session-related parameters.

[0043] Step 2, ID anonymity: Use dynamically changing communication keys to achieve continuous ID changes, so that the frame ID on the bus is unrecognizable to everyone except the sender and receiver, achieving anonymity.

[0044] Step 3, data shuffling: Use a shuffling scheme based on combinatorial mathematics and a changing communication key to change the original data of the bus frame to achieve the obfuscation effect of data shuffling.

[0045] Step 4, integrity check and error recovery: The receiver performs an integrity check on the data received from the bus to determine whether it has been modified. If the receiver does not receive the expected frame within a certain time range, it automatically performs error recovery.

[0046] Furthermore, the step 1 comprises the following steps:

[0047] (1.1) First, the sender and receiver need to store the ID and key k (i.e., key) in the ECU's tamper-proof memory in advance. Each frame ID i All with a key k iThe frames are bound to each other, and only the ECU itself can read the key. Only the ECU that knows the frame ID and its key can send or receive this type of frame. An ECU can send and receive frames with more than two IDs. For example, ECU No. 1, that is, ECU1 wants to receive frames with identifiers ID2 and ID3 sent by ECU No. 2, that is, ECU2, and frames with ID4 sent by ECU3. To achieve this, ECU1 and ECU2 need to save ID2, ID3 and the corresponding keys k2, k3, and ECU1 and ECU3 need to save ID4 and k4.

[0048] (1.2) When a session needs to be started for communication, the sending ECU will broadcast a session initialization frame with the following format: Figure 1 As shown above, the main contents include ID 0 , ID pre , FLAG, N, MAC. Among them, ID 0 Represents the original ID stored in the sending ECU, ID pre The last anonymous ID used in the previous session is recorded (in the first session, ID pre =ID 0 ), FLAG indicates that the session initialization frame is the beginning of a new session, N is a random number generated by the sender ECU at the beginning of the session, and MAC is the hash output generated by the hash function f1 for the following parameters:

[0049] MAC=f1(ID pre ,N,FLAG,k i )

[0050] (1.3) The receiver listens to the ID on the bus 0 Receive the frame and use the FLAG, N and ID carried by the frame pre , combined with its own stored k i , using the same equation as above to calculate the hash output, once the two hash outputs are the same, the receiver confirms that the initial frame of this session is valid, otherwise the receiver will issue an active error flag to notify the authentication failure. The success of this method is based on k i It will not be shared on the bus and is unknown to attackers. After successful authentication, the sender and receiver will calculate the session key K in the ECU. δ , where δ represents the count value of this session, that is, the number of session updates since the session was initialized, the initial value is 1, and the session key K δ The calculation formula is as follows:

[0051] K δ =f1(N,k i ,δ)

[0052] Through the above steps, the sender and receiver can complete the negotiation of the session key, and the subsequent communication key depends on this session key for dynamic update.

[0053] (1.4) When a session ends (for example, the maximum value of the frame counter is reached), the sender will send a new session initialization frame to start a new session. At the same time, before the maximum number of frame counters is reached (usually a 24-hour frame count value, different IDs correspond to different values), the sender can terminate the current session at any time to start a new session.

[0054] Furthermore, the specific method of ID anonymity in step 2 is as follows: Figure 2 As shown, the following steps are included:

[0055] (2.1) In the first communication after key negotiation, the sender δ Perform a hash to get As the first communication key. Then perform the original ID on the original data frame to be sent. 0 The PID is divided into the PID (Priority-ID) which indicates the priority of the data frame to be sent on the bus and the DID (Dynamic-ID) which indicates the anonymous change part. In the subsequent communication, the PID remains unchanged and only the DID is dynamically chained. The original ID of the first data frame to be sent, i.e. ID 0 Hash to get the dynamic anonymous DID 1′ , truncated to the length of the frame DID field DID 1 And concatenate it with PID to get AID 1 , which is the first anonymous ID. The first communication ID after the session negotiation is completed uses AID 1 , combined with the shuffled data in step 3 1 (i.e. the first piece of data to be sent after the frame is shuffled) is sent to the bus.

[0056] (2.2) In subsequent communications, use the same scheme as in step (2.1) above to identify the anonymous ID of the last data frame sent to the bus, i.e., AID n-1 Perform chained anonymous changes as shown in the following formula:

[0057]

[0058] in The last communication key The result of a hash operation is that f2 is the same hash function as f1, and a new dynamic anonymous result DID is calculated.n′ , and DID n′ The length is truncated to meet the required length of DID and concatenated with PID to generate a new anonymous ID result AID n , AID n As an anonymous ID and the shuffled data in step 3 n After being combined, they are sent to the bus.

[0059] (2.3) The de-anonymization process at the receiver is to determine whether the frame monitored on the bus is needed by the ECU. The receiver uses the same anonymization process as the sender (i.e. steps (2.1) and (2.2)) to calculate the currently expected anonymous frame ID, after which the receiver's frame filter is updated to the currently expected ID. Once the frame represented by the expected ID is monitored on the bus, the receiver ECU accepts the frame and immediately performs the calculation of the above step (2.2) to update the frame filter.

[0060] Furthermore, the step 3 comprises the following steps:

[0061] (3.1) The sender first needs to encode the original data field. Assume that the original data is a bit string s with a length of N. The bit string is represented as a position array I s :

[0062] I s =[I s (1), I s (2)...I s (K)]

[0063] Where K represents the number of '1' in the bit string, and the value I in the array s (i) represents the position of the i-th '1' in the bit string, i∈[1, K], I s (i)∈[0,N-1].

[0064] After the sender obtains the position array representing the data field, it uses the following combination number summation formula to encode the data field into indexes. According to the formula,

[0065]

[0066] (3.2) Index s Perform communication key based on the current frame The offset, The calculation method of is mentioned in (2.2) above. In order to prevent data from crossing the boundary, the modulus operation is used to obtain the new index value index′ s :

[0067]

[0068] (3.3) The new index value index′ after the offset s Decode and restore to bit string form. The decoding process is the opposite of the encoding process. The new index value is calculated to obtain the new position array I′ s The process of restoring it to a bit string. From the currently selectable maximum binomial coefficient Start, if the current index value index′ s Greater than or equal to the binomial coefficient Add the current position K to the new position array I' s In the example, the current position K is selected as '1' by the bit string, and the index value is subtracted from the binomial coefficient. and update, while decreasing the binomial coefficient Otherwise, just decrement N to compare the next binomial coefficient value; until the current index value index′ s When it is reduced to 0, the calculation stops and the new position array I' s Converted into a bit string. Since this technical solution can achieve the same number of '0' and '1' in the corresponding bit string during encoding and decoding, but in different positions, even if the index value is different, the data shuffling function is realized. The sender then fills the decoded bit string into the data field of the sent CAN frame and broadcasts the frame to the bus with the anonymous ID.

[0069] (3.4) After the receiver receives the expected frame through anonymous ID identification, it adopts the reverse idea of ​​(3.1) to (3.3), that is, it encodes the value of the CAN frame data field into an index, reversely offsets the communication key corresponding to the current frame to obtain the original index value, and then decodes the original index value to achieve reverse shuffling of the data field and restore the data content.

[0070] Further, the step 4 comprises the following steps:

[0071] (4.1) After the receiver successfully reverse shuffles the data field, it performs a CRC-based integrity check on the data field. By design, the CRC field contains the checksum of the original data, not the shuffled data. Therefore, the CAN controller is modified to check the CRC immediately after recovering the data. The sender performs a CRC check on the original data and puts it into the CRC field before shuffling the data field and sending it. After the receiver obtains the reverse shuffled data, it calculates the CRC checksum and compares it to verify the integrity and authenticity of the frame.

[0072] (4.2) The receiver also maintains a special timer (or counter) during communication to record the duration of not receiving the expected ID frame. If the duration exceeds a predefined threshold, generally based on five missed periodic messages, the error recovery process within the session begins. At this time, the receiver's frame filter is configured to accept all frames and set the expected ID to AID. i , and the currently received frame set is {AID x , AID x+1 ...AID x+j}, the receiver recursively calculates the AID i The hash value is used to match the ID in the frame set. If the expected value happens to appear in the frame set, the receiver updates the frame filter to the next valid hash value in the chain, and error recovery is successful.

[0073] (4.3) If the error recovery fails within the session, or the receiver is reset from a bus off fault, the current session has ended and is in a new session at the time of reset. In this case, error recovery needs to wait until the next session initialization by the sender ECU. When the receiver receives a session initialization frame from the expected ID, the receiver does not participate in the identity authentication of the sender of the session frame because the receiver cannot verify the ID. pre If other receivers in the current bus do not raise any objection to the session initialization frame, the session initialization frame is accepted by default, and a new round of session communication is carried out after calculating a new session key.

[0074] The present invention also provides a CAN bus safety protection device, comprising:

[0075] The session initialization module is used to control the sender's electronic control unit ECU to generate a random number and send a session initialization frame in the CAN bus to indicate the start of the session; the receiver receives the session initialization frame and verifies the sender's identity, the sender and the receiver negotiate the communication session key and calculate the hash key chain composed of the communication key in their respective ECUs

[0076] The data update module is used to control the sender and the receiver to use the hash key chain composed of the communication key to anonymously and continuously update the ID of the data frame during the session communication. The sender uses the calculated anonymous ID to send the frame to the bus, and the receiver calculates the expected anonymous ID in advance and updates it to the next anonymous ID after receiving it.

[0077] A redundancy check calculation module is used to control the sender to use a cyclic redundancy check CRC to calculate the checksum of the original data and place it in the CRC field of the data frame, and use a hash key chain and a combined encoding and decoding scheme to shuffle and replace the original data field before sending;

[0078] The integrity check module is used to control the receiver to use the hash key chain and reverse combination encoding and decoding scheme corresponding to the data replacement implemented by the sender to obtain the original data and perform integrity check.

[0079] The present invention also provides a storage medium storing a computer program or instruction, and when the computer program or instruction is executed, the method described is implemented.

[0080] As described above, the apparatus according to the embodiment of the present application can be implemented in various terminal devices, such as a server of a distributed computing system. In one example, the apparatus according to the embodiment of the present application can be integrated into the terminal device as a software module and / or a hardware module. For example, the apparatus can be a software module in the operating system of the terminal device, or can be an application developed for the terminal device; of course, the apparatus can also be one of the many hardware modules of the terminal device.

[0081] Alternatively, in another example, the apparatus and the terminal device may also be separate terminal devices, and the apparatus may be connected to the terminal device via a wired and / or wireless network, and transmit the interactive information in accordance with an agreed data format.

[0082] Experimental results: The present invention was tested on the CAN bus, and the main performance indicators were the shuffle time overhead during operation and the degree of anonymity and confusion achieved. The average shuffle time of the sender and receiver was 3.1μs and 3.06μs, respectively, of which the encoding, offset, and decoding time of the sender were 1.21μs, 0.6μs, and 1.28μs, respectively, and the receiver was 1.19μs, 5.99μs, and 1.27μs, respectively, which can meet the timeliness requirements of the millisecond-level periodic messages of the bus data frame. The anonymous ID can pass all 16 tests of the NIST random suite, and the data entropy value representing the degree of confusion is increased from the original 0.6993 to 0.8286 after shuffling.

[0083] The present invention provides a CAN bus security protection method, device and storage medium. There are many methods and ways to implement the technical solution. The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the protection scope of the present invention. All components not specified in this embodiment can be implemented by existing technologies.

Claims

1. A CAN bus security protection method, characterized in that: The following steps are involved: Step 1: The sender electronic control unit ECU generates a random number and sends a session initialization frame in the CAN bus to indicate the start of the session; The receiver receives the session initialization frame and verifies the identity of the sender. The sender and receiver negotiate the communication session key and calculate the hash key chain consisting of the communication key in their respective ECUs. Step 2: The sender and the receiver use a hash key chain composed of communication keys to anonymously and continuously update the ID of the data frame during the session communication. The sender uses the calculated anonymous ID to send the frame to the bus, and the receiver calculates the expected anonymous ID in advance and updates it to the next anonymous ID after receiving it. Step 3: The sender uses the cyclic redundancy check CRC to calculate the checksum of the original data and puts it in the CRC field of the data frame, and uses the hash key chain and combined encoding and decoding scheme to shuffle and permute the original data field before sending it; Step 4: The receiver uses the hash key chain and the reverse combination encoding and decoding scheme corresponding to the data replacement implemented by the sender to obtain the original data and perform an integrity check; The specific method of ID anonymization in step 2 includes the following steps: Step (2.1) In the first communication after key negotiation, the sender δ Perform a hash to get As the first communication key; then the original ID is calculated for the original data frame to be sent 0 The segmentation is divided into PID, which indicates the bus priority of the data frame to be sent, and DID, which indicates the anonymous change part. In the subsequent communication, PID remains unchanged, and only DID is dynamically chained. The original ID of the first data frame to be sent, i.e. ID 0 Hash to get the dynamic anonymous DID 1′ , truncated to the length of the frame DID field DID 1 And concatenate it with PID to get AID 1 , which is the first anonymous ID; the first communication ID after the session negotiation is completed uses AID 1 , combined with the shuffled Data in the subsequent step 3 1 Send to the bus; Step (2.2) uses the same scheme as step (2.1) in subsequent communications to identify the anonymous ID of the last data frame sent to the bus, i.e., AID n-1 Make a chained anonymous mutation like this: in The last communication key The result of a hash operation is that f2 is the same hash function as f1, and a new dynamic anonymous result DID is calculated. n′ , and DID n′ The length is truncated to meet the required length of DID and concatenated with PID to generate a new anonymous ID result AID n , AID n As an anonymous ID and the shuffled data in step 3 n After combining, they are sent to the bus; The de-anonymization process at the receiver in step (2.3) is to determine whether the frame monitored on the bus is needed by the ECU; the receiver uses the same anonymization process as the sender to calculate the currently expected anonymous frame ID, after which the receiver's frame filter is updated to the currently expected ID. Once the frame represented by the expected ID is monitored on the bus, the receiver ECU accepts the frame and immediately performs the calculation in step (2.2) to update the frame filter; Step 3 specifically includes the following steps: Step 3-1, the sender first encodes the original data field: assume that the original data is a bit string s with a length of N, and represent the bit string s as a position array I s : I s =[I s (1),I s (2)…I s (K)] Where K represents the number of 1s in the bit string, and the value I in the array s (i) represents the position of the i-th 1 in the bit string, i∈[1,K], I s (i)∈[0,N-1]; After the sender obtains the position array representing the data field, it uses the following combination number summation formula to encode the data field into an index index s , according to the formula Step 3-2, index s Perform communication key based on the current frame The offset is obtained by using the modulus operation to get the new index value index′ s : Step 3-3, the new index value index′ after the offset s Decode and restore to bit string form. The decoding process is the opposite of the encoding process. It is to calculate the new position array I′ with the new index value s The process of restoring it to a bit string starts from the current maximum binomial coefficient Start, if the current index value index′ s Greater than or equal to the binomial coefficient Add the current position K to the new position array I' s In the example, the current position K is selected as 1 by the bit string, and the index value is subtracted from the binomial coefficient. and update, while decreasing the binomial coefficient Otherwise, just decrement N to compare the next binomial coefficient value; until the current index value index′ s When it is reduced to 0, the calculation stops and the new position array I' s Convert to a bit string; Step 3-4, after the receiver receives the expected frame through anonymous ID identification, it adopts the reverse method of steps 3-1 to 3-3, that is, encodes the value of the CAN frame data field into an index, reversely offsets the communication key corresponding to the current frame to obtain the original index value, and then decodes the original index value to achieve reverse shuffling of the data field and restore the data content.

2. The method according to claim 1, characterized in that In step 1, the random number carried by the session initial frame is generated locally by the sender electronic control unit ECU using a random number generation function combined with a sending timestamp, and other parameters are shared in the initial frame, wherein the other parameters include the maximum number of frames of the session and the granularity of randomization; the hash output in the session initial frame is calculated by the session parameters combined with the key bound to the original ID, wherein the original ID is the communication ID used by the sender electronic control unit ECU and the receiver electronic control unit ECU when anonymous ID communication is not performed, the session parameters are specified by the sender, and the key is only negotiated and stored in advance by the sender electronic control unit ECU and the receiver electronic control unit ECU of the communication, and is not sent in the bus; When the sender decides to refresh the session, it sends the session initialization frame again on the bus to start a new session, and this time carries the anonymous ID of the previous session to prevent replay attacks.

3. The method according to claim 2, characterized in that In step 1, when the receiver receives the session initialization frame, it performs the same hash output calculation in combination with the key bound to the original ID stored by the receiver and the parameters carried in the session initialization frame. If the calculation result is the same as the hash output field data in the session initialization frame, the receiver successfully implements the sender identity authentication. Otherwise, an active error flag will be issued in the bus to notify the bus that the authentication has failed. After successful authentication, the sender and receiver will jointly calculate the session key of the current session. The session key is a hash calculation combining the random number, the session number, and the key bound to the original ID saved by the sender and receiver.

4. The method according to claim 3, characterized in that In step 2, the communication key corresponds to the data frame one by one, and is obtained by chain hash calculation of the session key. The sender and the receiver start from the original ID and combine the communication key of the chain to realize the hash change of the anonymous dynamic ID chain; If the time when the receiver does not receive the expected frame exceeds the threshold, the error recovery method starts: the frame filter is configured to receive frames on all buses, and the subsequent expected IDs are calculated backward using a chain in the receiver's electronic control unit ECU, and the subsequent expected IDs are stored as a set; if the captured ID is in the set, the frame filter is updated; if the intra-session recovery fails, wait until the next time the sender sends the session initial frame, and if the remaining receivers do not issue an error flag, the receiver directly calculates the session key for subsequent communication.

5. The method according to claim 4, characterized in that In step 3, the sender performs CRC check on the original data to be sent and puts it into the data frame, then performs position array encoding on the original data bit string and uses the combination number summation formula to obtain the numerical index corresponding to the position array; the forward offset of the index is realized based on the communication key corresponding to the current frame; the index is decoded using the reverse scheme to obtain the shuffled bit string, which is put into the data field of the data frame for sending.

6. The method according to claim 5, characterized in that In step 4, after the recipient listens to the expected frame whose ID is what it expects to receive in the bus, it chooses to accept the expected frame and performs a reverse shuffle operation on the data bit string in the received data frame. It first position-encodes the original data bit string to obtain the shuffled numerical index, reversely offsets the communication key corresponding to the expected frame to obtain the original index, and then position-decodes it again to obtain the original data bit string.

7. The method according to claim 6, characterized in that Step 4 also includes: calculating the CRC checksum of the original data obtained by reverse shuffling, and comparing it with the checksum carried by the CRC field in the data frame to obtain the authenticity of the data. If it is authentic, the data content is parsed and executed, otherwise an error signal is sent in the bus to ask the sender to resend the data information.

8. A CAN bus safety protection device, characterized in that: include: The session initialization module is used to control the sender's electronic control unit ECU to generate a random number and send a session initialization frame in the CAN bus to indicate the start of the session; the receiver receives the session initialization frame and verifies the sender's identity, and the sender and the receiver negotiate the communication session key and calculate the hash key chain composed of the communication key in their respective ECUs; The data update module is used to control the sender and the receiver to use the hash key chain composed of the communication key to anonymously and continuously update the ID of the data frame during the session communication. The sender uses the calculated anonymous ID to send the frame to the bus, and the receiver calculates the expected anonymous ID in advance and updates it to the next anonymous ID after receiving it. The specific method of ID anonymity includes the following steps: Step (2.1) In the first communication after key negotiation, the sender δ Perform a hash to get As the first communication key; then the original ID is calculated for the original data frame to be sent 0 The segmentation is divided into PID, which indicates the bus priority of the data frame to be sent, and DID, which indicates the anonymous change part. In the subsequent communication, PID remains unchanged, and only DID is dynamically chained. The original ID of the first data frame to be sent, i.e. ID 0 Hash to get the dynamic anonymous DID 1′ , truncated to the length of the frame DID field DID 1 And concatenate it with PID to get AID 1 , which is the first anonymous ID; the first communication ID after the session negotiation is completed uses AID 1 , combined with the shuffled Data in the subsequent step 3 1 Send to the bus; Step (2.2) uses the same scheme as step (2.1) in subsequent communications to identify the anonymous ID of the last data frame sent to the bus, i.e., AID n-1 Make a chained anonymous mutation like this: in The last communication key The result of a hash operation is that f2 is the same hash function as f1, and a new dynamic anonymous result DID is calculated. n′ , and DID n′ The length is truncated to meet the required length of DID and concatenated with PID to generate a new anonymous ID result AID n , AID n As an anonymous ID and the shuffled data in step 3 n After combining, they are sent to the bus; The de-anonymization process at the receiver in step (2.3) is to determine whether the frame monitored on the bus is needed by the ECU; the receiver uses the same anonymization process as the sender to calculate the currently expected anonymous frame ID, after which the receiver's frame filter is updated to the currently expected ID. Once the frame represented by the expected ID is monitored on the bus, the receiver ECU accepts the frame and immediately performs the calculation in step (2.2) to update the frame filter; The redundancy check calculation module is used to control the sender to use the cyclic redundancy check CRC to calculate the checksum of the original data and put it in the CRC field of the data frame, and use the hash key chain and the combined encoding and decoding scheme to shuffle and replace the original data field before sending; specifically, it includes the following steps: Step 3-1, the sender first encodes the original data field: assume that the original data is a bit string s with a length of N, and represent the bit string s as a position array I s : I s =[I s (1),I s (2)…I s (K)] Where K represents the number of 1s in the bit string, and the value I in the array s (i) represents the position of the i-th 1 in the bit string, i∈[1,K], I s (i)∈[0,N-1]; After the sender obtains the position array representing the data field, it uses the following combination number summation formula to encode the data field into an index index s , according to the formula Step 3-2, index s Perform communication key based on the current frame The offset is obtained by using the modulus operation to get the new index value index′ s : Step 3-3, the new index value index′ after the offset s Decode and restore to bit string form. The decoding process is the opposite of the encoding process. It is to calculate the new position array I′ with the new index value s The process of restoring it to a bit string starts from the current maximum binomial coefficient Start, if the current index value index′ s Greater than or equal to the binomial coefficient Add the current position K to the new position array I' s In the example, the current position K is selected as 1 by the bit string, and the index value is subtracted from the binomial coefficient. and update, while decreasing the binomial coefficient Otherwise, just decrement N to compare the next binomial coefficient value; until the current index value index′ s When it is reduced to 0, the calculation stops and the new position array I' s Convert to a bit string; Step 3-4: After the receiver receives the expected frame through anonymous ID identification, it adopts the reverse method of steps 3-1 to 3-3, that is, it encodes the value of the CAN frame data field into an index, reversely offsets the communication key corresponding to the current frame to obtain the original index value, and then decodes the original index value to achieve reverse shuffling of the data field and restore the data content; The integrity check module is used to control the receiver to use the hash key chain and reverse combination encoding and decoding scheme corresponding to the data replacement implemented by the sender to obtain the original data and perform integrity check.

9. A storage medium, characterized in that: A computer program or instruction is stored, and when the computer program or instruction is executed by a computer, the method according to any one of claims 1 to 7 is implemented.

Images