Data obfuscation method, device, electronic device and readable storage medium

Abstract

The present application provides a data obfuscation method, device, electronic device and readable storage medium, the method comprising: obtaining data link layer data in a controller area network; the data link layer data comprises a data field and data identification information; performing obfuscation processing on the data field and the data identification information to obtain an obfuscated data field and obfuscated data identification information corresponding to the data link layer data; sending the obfuscated data field and the obfuscated data identification information to the controller area network data link layer; so that the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node; and so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain data link layer data; reverse obfuscation processing is a reverse processing process of obfuscation processing. The above technical solution can enhance the security of controller area network data link layer and occupy less computing resources.

Description

Technical Field

[0001] The present application relates to the field of vehicle network information security technology, and in particular to a data obfuscation method, device, electronic device and readable storage medium. Background Art

[0002] At present, the security protection of the Controller Area Network (CAN) is mainly at the application layer, such as Security Onboard Communication (SecOC) and End to End (E2E). However, the onboard security communication technology and end-to-end technology cannot protect the CAN data link layer data. The CAN data link layer data will be directly exposed to the network, making it possible for the CAN reverse engineering to capture the CAN data link layer data during a certain operation, and then determine the bytes or bits of the signal corresponding to the operation by observing and analyzing the data identification information and the bytes or bits of the data field that change when the operation occurs. After repeated operations, the entire CAN communication matrix can be reversely cracked, posing a security risk.

[0003] Controller area networks usually use microcontroller units (MCUs) as computing platforms. Therefore, data security protection of the data link layer of the controller area network must be implemented based on the MCU. However, the computing resources of the MCU are limited. If key encryption is used to protect the data link layer data of the controller area network, it will lead to insufficient computing resources.

[0004] Therefore, the Controller Area Network (CAN) data link layer data requires a lightweight information security protection mechanism to enhance the security of the CAN data link layer data, occupy less computing resources, avoid direct exposure of data identification information and data fields to the network, and prevent the CAN communication matrix from being cracked through CAN reverse engineering. Summary of the invention

[0005] In order to overcome the defects of the above-mentioned prior art, the present application provides a data obfuscation method, device, electronic device and readable storage medium, which can enhance the security of controller local area network data link layer data and occupy less computing resources.

[0006] In order to solve the above technical problems, this application provides the following technical solutions:

[0007] On the one hand, an embodiment of the present application provides a data obfuscation method, including:

[0008] Acquire data link layer data in the controller area network; the data link layer data includes data fields and data identification information;

[0009] Obfuscating the data field and the data identification information to obtain an obfuscated data field and obfuscated data identification information corresponding to the data link layer data;

[0010] The obfuscated data field and the obfuscated data identification information are sent to the controller area network data link layer; so that the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node; and so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

[0011] In an exemplary embodiment, the obfuscating the data field and the data identification information to obtain the obfuscated data field and the obfuscated data identification information corresponding to the data link layer data includes:

[0012] An XOR operation is performed on the data field and the data identification information to obtain the obfuscated data field and the obfuscated data identification information.

[0013] In an exemplary embodiment, the sending of the obfuscated data field and the obfuscated data identification information to a controller area network data link layer; causing the controller area network data link layer to send the obfuscated data field and the obfuscated data identification information to a receiving node; and causing the receiving node to perform reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data, includes:

[0014] The obfuscated data field and the obfuscated data identification information are sent to a controller area network data link layer; the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node; and the receiving node performs an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information.

[0015] In an exemplary embodiment, performing an XOR operation on the data field and the data identification information to obtain the obfuscated data field and the obfuscated data identification information includes:

[0016] Performing a hash operation on the data field to obtain data field summary information;

[0017] Performing an XOR operation on the data field summary information and the data identification information to obtain the obfuscated data identification information;

[0018] Performing a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information;

[0019] An XOR operation is performed on the obfuscated data identification summary information and the data field to obtain the obfuscated data field.

[0020] In an exemplary embodiment, the sending of the obfuscated data field and the obfuscated data identification information to a controller area network data link layer; so that the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node; and so that the receiving node performs an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information, including:

[0021] The obfuscated data field and the obfuscated data identification information are sent to the controller area network data link layer; so that the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to the receiving node; so that the receiving node performs a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information; so that the receiving node performs an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field; so that the receiving node performs a hash operation on the data field to obtain data field summary information; and so that the receiving node performs an XOR operation on the data field summary information and the obfuscated data identification information to obtain the data identification information.

[0022] On the other hand, an embodiment of the present application provides a data obfuscation method, including:

[0023] Receiving an obfuscated data field and obfuscated data identification information sent by a controller area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by a sending node to the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the obfuscation processing performed by the sending node on the data field and the data identification information; the data field and the data identification information are obtained by the sending node;

[0024] Reverse obfuscation processing is performed on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

[0025] In an exemplary embodiment, the receiving of the obfuscated data field and the obfuscated data identification information sent by the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by a sending node to the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the obfuscation processing performed by the sending node on the data field and the data identification information; the data field and the data identification information are obtained by the sending node, including:

[0026] The obfuscated data field and the obfuscated data identification information sent by the controller area network data link layer are received; the obfuscated data field and the obfuscated data identification information are sent by the sending node to the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the sending node performing an XOR operation on the data field and the data identification information; the data field and the data identification information are acquired by the sending node.

[0027] In an exemplary embodiment, performing reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data includes:

[0028] An XOR operation is performed on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information.

[0029] In an exemplary embodiment, the receiving the obfuscated data field and the obfuscated data identification information sent by the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by the sending node to the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the sending node performing an XOR operation on the data field and the data identification information; the data field and the data identification information are obtained by the sending node, including:

[0030] Receive the obfuscated data field and the obfuscated data identification information sent by the controller local area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by the sending node to the controller local area network data link layer; the obfuscated data field is determined based on the sending node performing an XOR operation on the obfuscated data identification summary information and the data field; the obfuscated data identification summary information is determined based on the sending node performing a hash operation on the obfuscated data identification information; the obfuscated data identification information is determined based on the sending node performing an XOR operation on the data field summary information and the data identification information; the data field summary information is determined based on the sending node performing a hash operation on the data field; the data field and the data identification information are acquired by the sending node.

[0031] In an exemplary embodiment, performing an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information includes:

[0032] Performing a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information;

[0033] Performing an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field;

[0034] Performing a hash operation on the data field to obtain data field summary information;

[0035] An XOR operation is performed on the data field summary information and the obfuscated data identification information to obtain the data identification information.

[0036] On the other hand, an embodiment of the present application provides a data obfuscation device, the device comprising:

[0037] A data acquisition module, used to acquire data link layer data in the controller area network; the data link layer data includes data fields and data identification information;

[0038] An obfuscation processing module, used to perform obfuscation processing on the data field and the data identification information to obtain an obfuscated data field and obfuscated data identification information corresponding to the data link layer data;

[0039] The first data sending module is used to send the obfuscated data field and the obfuscated data identification information to the controller local area network data link layer; so that the controller local area network data link layer sends the obfuscated data field and the obfuscated data identification information to the receiving node; and so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is the reverse processing process of the obfuscation processing.

[0040] On the other hand, an embodiment of the present application provides a data obfuscation device, the device comprising:

[0041] A second data receiving module is used to receive an obfuscated data field and obfuscated data identification information sent by a controller area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by a sending node to the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the obfuscation processing performed by the sending node on the data field and the data identification information; the data field and the data identification information are obtained by the sending node;

[0042] A reverse obfuscation processing module is used to perform reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

[0043] On the other hand, an embodiment of the present application provides an electronic device, characterized in that it includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed based on the processor to implement the data obfuscation method as described in any one of the above items.

[0044] On the other hand, an embodiment of the present application provides a computer-readable storage medium, in which at least one instruction or at least one program is stored, and the at least one instruction or the at least one program is loaded and executed based on a processor to implement the data obfuscation method as described in any one of the above claims.

[0045] By adopting the above technical solution, the present application has the following beneficial effects:

[0046] The present application provides a data obfuscation method, device, electronic device and readable storage medium, which performs obfuscation processing on data fields and data identification information through a sending node to obtain obfuscated data fields and obfuscated data identification information, and then sends the obfuscated data fields and obfuscated data identification information to a controller area network data link layer, and then sends the obfuscated data fields and obfuscated data identification information to a receiving node through the controller area network data link layer, and performs reverse obfuscation processing on the obfuscated data fields and obfuscated data identification information through the receiving node to obtain the data fields and data identification information, and the reverse obfuscation processing is the reverse processing process of the obfuscation processing. The technical solution of the present application can effectively enhance the security of controller area network data link layer, prevent the communication matrix of the controller area network from being cracked through the controller area network reverse engineering, and can achieve effective protection of controller area network data link layer data without involving key exchange or certificate authentication, and does not rely on a specific controller area network data format, occupies less computing resources, can be adaptively deployed according to specific implementation, and has high compatibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technical accounts in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0048] Figure 1 Schematic diagram of an implementation environment of a data obfuscation method provided in an embodiment of the present application

[0049] Figure 2 A flowchart of a data obfuscation method provided in an embodiment of the present application;

[0050] Figure 3 A flowchart of another data obfuscation method provided in an embodiment of the present application;

[0051] Figure 4 A data format diagram of a data obfuscation method provided in an embodiment of the present application;

[0052] Figure 5 An example flow chart of a data obfuscation method provided in an embodiment of the present application;

[0053] Figure 6 A schematic diagram of a data obfuscation method provided in an embodiment of the present application Figure 1 ;

[0054] Figure 7 A schematic diagram of a data obfuscation method provided in an embodiment of the present application Figure 2 ;

[0055] Figure 8 A schematic diagram of a data obfuscation method provided in an embodiment of the present application Figure 3 ;

[0056] Fig. 9 A structural framework of a data obfuscation device provided in an embodiment of the present application Figure 1 ;

[0057] Fig.10 A structural framework of a data obfuscation device provided in an embodiment of the present application Figure 2 ;

[0058] Fig.11 A structural framework of a data obfuscation device provided in an embodiment of the present application Figure 3 ;

[0059] Fig.12 A hardware structure block diagram of an electronic device running a data obfuscation method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technical accounts in this field without making creative work are within the scope of protection of this application.

[0061] The term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure or characteristic that may be included in at least one implementation of the present application. In the description of the embodiments of the present application, it should be understood that the orientation or positional relationship indicated by the terms "upper", "lower", "top", "bottom", etc. is based on the orientation or positional relationship shown in the accompanying drawings, which is only for the convenience of describing the present application and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application. In addition, the terms "first" and "second" are used only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, the features defined as "first" and "second" may include one or more of the features explicitly or implicitly. Moreover, the terms "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or device.

[0062] See also Figure 1 , which is a schematic diagram of an implementation environment of a data obfuscation method provided in an embodiment of the present application. Figure 1 As shown, the implementation environment may include at least a sending node, a controller area network data link layer and a receiving node, and the sending node, the controller area network data link layer and the receiving node may be connected via wireless communication, and the present application does not limit this. For example, the sending node may send obfuscated data fields and obfuscated data identification information to the controller area network data link layer via wireless communication, and the controller area network data link layer may send the obfuscated data fields and the obfuscated data identification information to the receiving node via wireless communication.

[0063] It should be noted that Figure 1 Just an example.

[0064] See also Figure 2 , which is a flow chart of a data obfuscation method provided in an embodiment of the present application. The method can be used for Figure 1In the implementation environment of the embodiment. This specification provides method operation steps as described in the embodiment or flowchart, but may include more or fewer operation steps based on routine or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many orders, and does not represent the only execution order. When the actual system or server product is executed, it can be executed in sequence or in parallel (for example, in a parallel processor or multi-threaded processing environment) according to the method shown in the embodiment or the drawings. Specifically, Figure 2 As shown, the method may include:

[0065] Step S1001: The sending node obtains data link layer data in the controller area network; the data link layer data includes a data field and data identification information;

[0066] Optionally, the data field is a controller area network effective information load, and the data identification information is an identifier.

[0067] Step S1002: the sending node performs obfuscation processing on the data field and the data identification information to obtain the obfuscated data field and obfuscated data identification information corresponding to the data link layer data;

[0068] Specifically, the sending node performs an XOR operation on the data field and the data identification information to obtain the obfuscated data field and the obfuscated data identification information.

[0069] Step S1003: the sending node sends the obfuscated data field and the obfuscated data identification information to the controller area network data link layer;

[0070] Step S1004: the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node;

[0071] Step S1005: the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

[0072] Specifically, the receiving node performs an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information.

[0073] A data obfuscation method described in this embodiment performs obfuscation processing on a data field and data identification information by a sending node to obtain an obfuscated data field and obfuscated data identification information, and then sends the obfuscated data field and obfuscated data identification information to a controller local area network data link layer, and then sends the obfuscated data field and obfuscated data identification information to a receiving node through the controller local area network data link layer, and performs reverse obfuscation processing on the obfuscated data field and obfuscated data identification information by the receiving node to obtain the data field and data identification information, and the reverse obfuscation processing is the reverse processing process of the obfuscation processing. The technical solution of the present application can effectively enhance the security of controller area network data link layer data, prevent the communication matrix of the controller area network from being cracked through reverse engineering of the controller area network, and achieve effective protection of controller area network data link layer data without involving key exchange or certificate authentication. It is not dependent on a specific controller area network data format, occupies less computing resources, can be adaptively deployed according to the specific implementation, has high compatibility, and is compatible with all current controller area network data formats, including traditional controller area networks (Classical CAN), controller area networks with flexible data bit rates (CAN FD), and controller area networks with extra-long data fields (CAN XL).

[0074] See also Figure 3 , which is a flow chart of another data obfuscation method provided in an embodiment of the present application, the method may further include:

[0075] Step S2001: The sending node obtains data link layer data in the controller area network; the data link layer data includes a data field and data identification information;

[0076] Step S2002: the sending node performs a hash operation on the data field to obtain data field summary information;

[0077] Specifically, the data field summary information is summary information of a fixed length obtained after a hash operation is performed on the data field of any length.

[0078] Step S2003: the sending node performs an XOR operation on the data field summary information and the data identification information to obtain the obfuscated data identification information;

[0079] Step S2004: the sending node performs a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information;

[0080] Specifically, the obfuscated data identification summary information is summary information of a fixed length obtained by performing a hash operation on the obfuscated data identification information of any length.

[0081] Step S2005: the sending node performs an XOR operation on the obfuscated data identification summary information and the data field to obtain the obfuscated data field;

[0082] Step S2006: the sending node sends the obfuscated data field and the obfuscated data identification information to the controller area network data link layer;

[0083] Step S2007: the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node;

[0084] Step S2008: the receiving node performs a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information;

[0085] Step S2009: the receiving node performs an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field;

[0086] Step S2010: the receiving node performs a hash operation on the data field to obtain data field summary information;

[0087] Step S2011: the receiving node performs an XOR operation on the data field summary information and the obfuscated data identification information to obtain the data identification information.

[0088] Another data obfuscation method described in this embodiment implements obfuscation processing of the data field and the data identification information through a combination of hash operation and XOR operation, as well as reverse obfuscation processing of the obfuscated data field and the obfuscated data identification information, which can effectively enhance the security of the data link layer of the controller area network and prevent the communication matrix of the controller area network from being cracked through reverse engineering of the controller area network. Data obfuscation is implemented only through a combination of hash operation and XOR operation. Compared with the security mechanism involving key exchange or certificate authentication, less computing resources are required, and it is suitable for deployment in a microcontroller unit. It does not rely on a specific controller area network data format, occupies less computing resources, can be adaptively deployed according to the specific implementation, has high compatibility, and is compatible with all current controller area network data formats, including the traditional controller area network (Classical CAN), the controller area network with flexible data bit rate (CAN FD), and the controller area network with extra long data field (CAN XL).

[0089] In an optional embodiment, the above step S2003 includes:

[0090] In a case where the number of bits of the data field summary information is greater than the number of bits of the data identification information, the sending node truncates the data field summary information based on the number of bits of the data identification information to obtain first target data field summary information; the first target data field summary information is summary information whose number of bits is equal to the number of bits of the data identification information;

[0091] The sending node performs an XOR operation on the first target data field summary information and the data identification information to obtain the obfuscated data identification information; or,

[0092] When the number of bits of the data field summary information is equal to the number of bits of the data identification information, the sending node performs an XOR operation on the data field summary information and the data identification information to obtain the obfuscated data identification information; or

[0093] In a case where the number of bits of the data field summary information is less than the number of bits of the data identification information, the sending node performs concatenation processing on the data field summary information based on the number of bits of the data identification information to obtain second target data field summary information; the second target data field summary information is summary information having the same number of bits as the number of bits of the data identification information;

[0094] The sending node performs an XOR operation on the second target data field summary information and the data identification information to obtain the obfuscated data identification information.

[0095] For example, the data field is calculated using the secure hash algorithm-256 (SHA-256) to obtain 256-bit data field summary information, and the number of bits of data identification information involved in the obfuscation process is only 8 bits, then the last 8 bits of the data field summary information can be taken and the 8-bit data identification information can be XORed; or,

[0096] The data field is calculated using cyclic redundancy check-8 (CRC-8) to obtain 8-bit data field summary information, and the number of bits of data identification information involved in the obfuscation process is 11 bits. Therefore, based on the 8-bit data field summary information, the first 3 bits of the data field summary information are concatenated to construct an 11-bit data field summary information and perform an XOR operation on the 11-bit data identification information.

[0097] In an optional embodiment, the above step S2005 includes:

[0098] In a case where the number of bits of the obfuscated data identification summary information is greater than the number of bits of the data field, the sending node truncates the obfuscated data identification summary information based on the number of bits of the data field to obtain first target obfuscated data identification summary information; the first target obfuscated data identification summary information is summary information whose number of bits is equal to the number of bits of the data field;

[0099] The sending node performs an XOR operation on the first target obfuscated data identification summary information and the data field to obtain the obfuscated data field; or,

[0100] When the number of bits of the obfuscated data identification summary information is equal to the number of bits of the data field, the sending node performs an XOR operation on the obfuscated data identification summary information and the data field to obtain the obfuscated data field; or

[0101] In a case where the number of bits of the obfuscated data identification summary information is less than the number of bits of the data field, the sending node performs concatenation processing on the obfuscated data identification summary information based on the number of bits of the data field to obtain second target obfuscated data identification summary information; the second target obfuscated data identification summary information is summary information whose number of bits is equal to the number of bits of the data field;

[0102] The sending node performs an XOR operation on the second target obfuscated data identification summary information and the data field to obtain the obfuscated data field.

[0103] For example, the obfuscated data identification summary information is calculated using SHA-256 to obtain 256-bit obfuscated data identification summary information, and the number of bits of the data field involved in the obfuscation process is only 64 bits. In this case, the last 64 bits of the obfuscated data identification summary information can be XORed with the 64-bit data field; or,

[0104] The obfuscated data identification summary information is calculated using SHA-256 to obtain 256-bit obfuscated data identification summary information, and the number of bits of the data field involved in the obfuscation process is 16384 bits (2048 bytes). Therefore, the 256-bit obfuscated data identification summary information can be cyclically concatenated to construct a 16384-bit obfuscated data identification summary information and perform an XOR operation with the 16384-bit data field.

[0105] In an optional embodiment, the above step S2009 includes:

[0106] In a case where the number of bits of the obfuscated data identification summary information is greater than the number of bits of the obfuscated data field, the receiving node truncates the obfuscated data identification summary information based on the number of bits of the obfuscated data field to obtain third target obfuscated data identification summary information;

[0107] The receiving node performs an XOR operation on the third target obfuscated data identification summary information and the obfuscated data field to obtain the data field; or,

[0108] In a case where the number of bits of the obfuscated data identification summary information is equal to the number of bits of the obfuscated data field, the receiving node performs an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field; or,

[0109] In a case where the number of bits of the obfuscated data identification summary information is less than the number of bits of the obfuscated data field, the receiving node performs concatenation processing on the obfuscated data identification summary information based on the number of bits of the obfuscated data field to obtain fourth target obfuscated data identification summary information;

[0110] The receiving node performs an XOR operation on the fourth target obfuscated data identification summary information and the obfuscated data field to obtain the data field.

[0111] Specifically, the third target obfuscated data identification summary information is summary information whose bit number is equal to the bit number of the obfuscated data field; the fourth target obfuscated data identification summary information is summary information whose bit number is equal to the bit number of the obfuscated data field.

[0112] For example, the obfuscated data identification summary information is calculated using SHA-256 to obtain 256-bit obfuscated data identification summary information, and the number of bits of the obfuscated data field involved in the reverse obfuscation process is only 64 bits. In this case, the last 64 bits of the obfuscated data identification summary information can be taken and XORed with the 64-bit obfuscated data field; or,

[0113] The obfuscated data identification summary information is calculated using SHA-256 to obtain 256-bit obfuscated data identification summary information, and the number of bits of the obfuscated data field involved in the reverse obfuscation process is 16384 bits (2048 bytes). Therefore, the 256 bits of the obfuscated data identification summary information can be cyclically concatenated to construct a 16384-bit obfuscated data identification summary information and perform an XOR operation on the 16384-bit obfuscated data field.

[0114] In an optional embodiment, the above step S2011 includes:

[0115] In a case where the number of bits of the data field summary information is greater than the number of bits of the obfuscated data identification information, the receiving node truncates the data field summary information based on the number of bits of the obfuscated data identification information to obtain third target data field summary information;

[0116] The receiving node performs an XOR operation on the third target data field summary information and the obfuscated data identification information to obtain the data identification information; or,

[0117] When the number of bits of the data field summary information is equal to the number of bits of the obfuscated data identification information, the receiving node performs an XOR operation on the data field summary information and the obfuscated data identification information to obtain the data identification information; or,

[0118] In a case where the number of bits of the data field summary information is less than the number of bits of the obfuscated identifier, the receiving node performs concatenation processing on the data field summary information based on the number of bits of the obfuscated data identification information to obtain fourth target data field summary information;

[0119] The receiving node performs an XOR operation on the fourth target data field summary information and the obfuscated data identification information to obtain the data identification information.

[0120] Specifically, the third target data field summary information is summary information whose bit number is equal to that of the obfuscated data identification information; and the fourth target data field summary information is summary information whose bit number is equal to that of the obfuscated data identification information.

[0121] For example, the data field is calculated using SHA-256 to obtain 256-bit data field summary information, and the number of bits of obfuscated data identification information involved in the reverse obfuscation process is only 8 bits. In this case, the last 8 bits of the data field summary information can be taken and XORed with the 8-bit obfuscated data identification information; or,

[0122] The data field is calculated using CRC-8 to obtain 8-bit data field summary information, and the number of bits of obfuscated data identification information involved in the reverse obfuscation process is 11 bits. Therefore, based on the 8-bit data field summary information, the first 3 bits of the data field summary information are concatenated to construct an 11-bit data field summary information and perform an XOR operation with the 11-bit obfuscated data identification information.

[0123] In an optional embodiment, in any of the above-mentioned data obfuscation methods, the sending node performs obfuscation processing on the data field and the data identification information to obtain the obfuscated data field and obfuscated data identification information corresponding to the data link layer data, including:

[0124] The sending node truncates the data identification information to obtain first target identification information and second target identification information; the first target identification information is identification information in the data identification information that meets a preset condition, and the second target identification information is identification information in the data identification information other than the first target identification information;

[0125] The sending node performs obfuscation processing on the data field and the first target identification information to obtain the obfuscated data field and the obfuscated data identification information;

[0126] Accordingly, the sending node sends the obfuscated data field and the obfuscated data identification information to the controller area network data link layer, including:

[0127] The sending node sends the second target identification information, the obfuscated data field and the obfuscated data identification information to the controller area network data link layer;

[0128] Accordingly, the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data, including:

[0129] The receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data field and the first target identification information;

[0130] The receiving node concatenates the first target identification information and the second target identification information to obtain the data identification information.

[0131] Specifically, considering the diagnostic compatibility and network management convenience based on the controller area network, only some bits of the data identification information can be obfuscated, that is, the unobfuscated bits do not participate in the above-mentioned obfuscation processing and reverse obfuscation processing, and only participate in the construction of complete data identification information after the obfuscation processing and reverse obfuscation processing are completed.

[0132] For example, the diagnostic data identification information is an 11-bit identifier of 0x7XX (XX represents an arbitrary value of 1 byte). In order to avoid additional development work for the off-board diagnostic instrument, the sending node and the receiving node do not process the diagnostic data identification information and the corresponding data field; for other data identification information, in order to avoid obfuscation caused by obfuscation, the data identification information is 0x7XX, which makes the receiving node believe that the obfuscated data identification information is diagnostic data identification information, and then does not perform reverse obfuscation processing to cause reception errors. Therefore, only the last 8 bits of the data identification information are involved in the obfuscation processing and the reverse obfuscation processing process, and the first 3 bits are spliced ​​to form the complete data identification information after the obfuscation processing and the reverse obfuscation processing process are completed.

[0133] The above data obfuscation method is described below by using an embodiment. This embodiment only represents one of the possible implementation methods and does not mean that it can only be implemented according to the following embodiment.

[0134] In a vehicle model communication matrix, the identifier 0x320 represents the data sent by the instrument, where the last bit of the third byte represents the driver's seat belt signal, where 0 represents "no seat belt", and 1 represents "seat belt". The data format is shown in Figure 4 .

[0135] Assuming that the vehicle state is stable at a certain moment, the above data is:

[0136] 0x320 0x01 0x23 0x45 0x67 0x89 0xAB 0xCD 0xEF

[0137] That means "fasten your seat belts".

[0138] If the data link layer data of the controller area network of the vehicle model does not adopt the data obfuscation method of this application, when the attacking account attempts to unlock the driver's seat belt, the last bit of the third byte of the data field corresponding to the identifier 0x320 will be found to change through the reverse engineering of the controller area network, that is:

[0139] 0x320 0x01 0x23 0x45 0x66 0x89 0xAB 0xCD 0xEF

[0140] Then the attacking account can now know that in the communication matrix of this vehicle model, the last bit of the third byte of the data field corresponding to the identifier 0x320 represents the driver's seat belt signal. Similarly, the entire communication matrix can be reversely cracked.

[0141] See also Figure 5If the data link layer data of the controller area network of the vehicle model adopts the data obfuscation method of the present application, taking into account the diagnostic compatibility, only the last 8 bits of the identifier are involved in the obfuscation processing and the reverse obfuscation processing process, and the hash operation algorithm adopts SHA-256. Since the length of the data field summary information and the identifier summary information are both longer than the length of the identifier and the data field, the last 8 bits of equal length are taken by truncation for XOR operation.

[0142] For the sending node, the data field is calculated using SHA-256 to obtain the data field summary information, namely:

[0143] 0x55C53F5D490297900CEFA825D0C8E8E9532EE8A118ABE7D8570762CD38BE9818

[0144] The obfuscated partial identifier is 0x20, then the last 8 bits of the data field summary information are XORed with the partial identifier to obtain the obfuscated partial identifier, which is 0x38. The obfuscated partial identifier summary information is:

[0145] 0x2C624232CDD221771294DFBB310ACA000A0DF6AC8B66B696D90EF06FDEFB64A3

[0146] The data field is 64 bits long, so the last 64 bits of the obfuscated identifier summary information are XORed with the data field to obtain the obfuscated data field, namely:

[0147] 0x56 0x24 0x27 0xAA 0xB1 0x15 0x55 0xF7

[0148] The unobfuscated part of the identifier is concatenated with the obfuscated part, and the final identifier is 0x338. Then the data sent by the sending node at the controller area network data link layer after using the data obfuscation method is:

[0149] 0x338 0x56 0x24 0x27 0xAA 0xB1 0x15 0x55 0xF7

[0150] For the receiving node, the data can be restored according to the reverse obfuscation process of the receiving node mentioned above.

[0151] When the attacking account attempts to unlock the driver's seat belt, the data to be sent by the sending node is:

[0152] 0x320 0x01 0x23 0x45 0x66 0x89 0xAB 0xCD 0xEF

[0153] After obfuscation, the data seen by the attacking account at the data link layer is:

[0154] 0x370 0xFB 0x0A 0xE9 0x1B 0x56 0x61 0x54 0xAF

[0155] Compare the data link layer data before and after unlocking the driver's seat belt

[0156] 0x338 0x56 0x24 0x27 0xAA 0xB1 0x15 0x55 0xF7

[0157] 0x370 0xFB 0x0A 0xE9 0x1B 0x56 0x61 0x54 0xAF

[0158] It can be seen that the attacking account cannot determine which identifier corresponds to the data field that causes the driver's seat belt signal to change, resulting in the failure of the controller LAN reverse engineering and preventing the communication matrix from being cracked.

[0159] The following describes the data obfuscation method using the sending node as the execution subject:

[0160] See also Figure 6 , which shows a process diagram of a data obfuscation method provided in an embodiment of the present application Figure 1 , the method comprising:

[0161] Step S301: Acquire data link layer data in the controller area network; the data link layer data includes data fields and data identification information;

[0162] Step S302: Obfuscating the data field and the data identification information to obtain the obfuscated data field and obfuscated data identification information corresponding to the data link layer data;

[0163] Step S303: Send the obfuscated data field and the obfuscated data identification information to the controller local area network data link layer; so that the controller local area network data link layer sends the obfuscated data field and the obfuscated data identification information to the receiving node; and so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is the reverse processing process of the obfuscation processing.

[0164] In an optional embodiment, the above step S302 includes:

[0165] An XOR operation is performed on the data field and the data identification information to obtain the obfuscated data field and the obfuscated data identification information.

[0166] In an optional embodiment, the above step S303 includes:

[0167] The obfuscated data field and the obfuscated data identification information are sent to a controller area network data link layer; the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node; and the receiving node performs an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information.

[0168] In an optional embodiment, performing an XOR operation on the data field and the data identification information to obtain the obfuscated data field and the obfuscated data identification information includes:

[0169] Performing a hash operation on the data field to obtain data field summary information;

[0170] Performing an XOR operation on the data field summary information and the data identification information to obtain the obfuscated data identification information;

[0171] Performing a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information;

[0172] An XOR operation is performed on the obfuscated data identification summary information and the data field to obtain the obfuscated data field.

[0173] In an optional embodiment, the sending of the obfuscated data field and the obfuscated data identification information to a controller area network data link layer; so that the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node; and so that the receiving node performs an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information, including:

[0174] The obfuscated data field and the obfuscated data identification information are sent to the controller area network data link layer; so that the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to the receiving node; so that the receiving node performs a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information; so that the receiving node performs an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field; so that the receiving node performs a hash operation on the data field to obtain data field summary information; and so that the receiving node performs an XOR operation on the data field summary information and the obfuscated data identification information to obtain the data identification information.

[0175] In an optional embodiment, performing an XOR operation on the data field summary information and the data identification information to obtain the obfuscated data identification information includes:

[0176] In a case where the number of bits of the data field summary information is greater than the number of bits of the data identification information, truncating the data field summary information based on the number of bits of the data identification information to obtain first target data field summary information;

[0177] Performing an XOR operation on the first target data field summary information and the data identification information to obtain the obfuscated data identification information; or,

[0178] When the number of bits of the data field summary information is equal to the number of bits of the data identification information, performing an XOR operation on the data field summary information and the data identification information to obtain the obfuscated data identification information; or

[0179] When the number of bits of the data field summary information is less than the number of bits of the data identification information, concatenating the data field summary information based on the number of bits of the data identification information to obtain second target data field summary information;

[0180] An XOR operation is performed on the second target data field summary information and the data identification information to obtain the obfuscated data identification information.

[0181] In an optional embodiment, performing an XOR operation on the obfuscated data identification summary information and the data field to obtain the obfuscated data field includes:

[0182] When the number of bits of the obfuscated data identification summary information is greater than the number of bits of the data field, truncating the obfuscated data identification summary information based on the number of bits of the data field to obtain first target obfuscated data identification summary information;

[0183] Performing an XOR operation on the first target obfuscated data identification summary information and the data field to obtain the obfuscated data field; or,

[0184] When the number of bits of the obfuscated data identification summary information is equal to the number of bits of the data field, performing an XOR operation on the obfuscated data identification summary information and the data field to obtain the obfuscated data field; or

[0185] When the number of bits of the obfuscated data identification summary information is less than the number of bits of the data field, concatenating the obfuscated data identification summary information based on the number of bits of the data field to obtain second target obfuscated data identification summary information;

[0186] An XOR operation is performed on the second target obfuscated data identification summary information and the data field to obtain the obfuscated data field.

[0187] In an optional embodiment, in any of the above-mentioned data obfuscation methods, the obfuscating the data field and the data identification information to obtain the obfuscated data field and obfuscated data identification information corresponding to the data link layer data includes:

[0188] The data identification information is truncated to obtain first target identification information and second target identification information; the first target identification information is identification information in the data identification information that meets a preset condition, and the second target identification information is identification information in the data identification information other than the first target identification information;

[0189] Obfuscating the data field and the first target identification information to obtain the obfuscated data field and the obfuscated data identification information;

[0190] Accordingly, sending the obfuscated data field and the obfuscated data identification information to the controller area network data link layer includes:

[0191] The second target identification information, the obfuscated data field and the obfuscated data identification information are sent to the controller LAN data link layer; so that the controller LAN data link layer sends the second target identification information, the obfuscated data field and the obfuscated data identification information to the receiving node; so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data field and the first target identification information; and so that the receiving node performs splicing processing on the first target identification information and the second target identification information to obtain the data identification information.

[0192] The following describes the data obfuscation method using the controller area network data link layer as the execution subject:

[0193] See also Figure 7 , which shows a process diagram of a data obfuscation method provided in an embodiment of the present application Figure 2 , the method comprising:

[0194] Step S401: receiving an obfuscated data field and obfuscated data identification information sent by a sending node; the obfuscated data field and the obfuscated data identification information are determined based on the obfuscation processing performed by the sending node on the data field and the data identification information, and the data field and the data identification information are obtained by the sending node;

[0195] Step S402: Send the obfuscated data field and the obfuscated data identification information to a receiving node; so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

[0196] In an optional embodiment, in any of the above-mentioned data obfuscation methods, the receiving the obfuscated data field and obfuscated data identification information sent by the sending node includes:

[0197] receiving the second target identification information, the obfuscated data field and the obfuscated data identification information sent by the sending node; the obfuscated data field and the obfuscated data identification information are determined based on the obfuscation processing performed by the sending node on the data field and the first target identification information, and the first target identification information and the second target identification information are determined based on the truncation processing performed by the sending node on the data identification information; the first target identification information is identification information in the data identification information that meets a preset condition, and the second target identification information is identification information in the data identification information other than the first target identification information;

[0198] sending the second target identification information, the obfuscated data field and the obfuscated data identification information to the receiving node, so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data field and the first target identification information; and so that the receiving node performs splicing processing on the first target identification information and the second target identification information to obtain the data identification information.

[0199] The following describes the data obfuscation method using the receiving node as the execution subject:

[0200] See also Figure 8 , which shows a process diagram of a data obfuscation method provided in an embodiment of the present application Figure 3 , the method comprising:

[0201] Step S501: receiving an obfuscated data field and obfuscated data identification information sent by a controller area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by a sending node to the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the obfuscation processing performed by the sending node on the data field and the data identification information; the data field and the data identification information are obtained by the sending node;

[0202] Step S502: performing reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

[0203] In an optional embodiment, the above step S501 includes:

[0204] The obfuscated data field and the obfuscated data identification information sent by the controller area network data link layer are received; the obfuscated data field and the obfuscated data identification information are sent by the sending node to the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the sending node performing an XOR operation on the data field and the data identification information; the data field and the data identification information are acquired by the sending node.

[0205] In an optional embodiment, the above step S502 includes:

[0206] An XOR operation is performed on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information.

[0207] In an optional embodiment, the receiving the obfuscated data field and the obfuscated data identification information sent by the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by the sending node to the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the sending node performing an XOR operation on the data field and the data identification information; the data field and the data identification information are obtained by the sending node, including:

[0208] Receive the obfuscated data field and the obfuscated data identification information sent by the controller local area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by the sending node to the controller local area network data link layer; the obfuscated data field is determined based on the sending node performing an XOR operation on the obfuscated data identification summary information and the data field; the obfuscated data identification summary information is determined based on the sending node performing a hash operation on the obfuscated data identification information; the obfuscated data identification information is determined based on the sending node performing an XOR operation on the data field summary information and the data identification information; the data field summary information is determined based on the sending node performing a hash operation on the data field; the data field and the data identification information are acquired by the sending node.

[0209] In an optional embodiment, performing an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information includes:

[0210] Performing a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information;

[0211] Performing an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field;

[0212] Performing a hash operation on the data field to obtain data field summary information;

[0213] An XOR operation is performed on the data field summary information and the obfuscated data identification information to obtain the data identification information.

[0214] In an optional embodiment, performing an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field includes:

[0215] In a case where the number of bits of the obfuscated data identification summary information is greater than the number of bits of the obfuscated data field, truncating the obfuscated data identification summary information based on the number of bits of the obfuscated data field to obtain third target obfuscated data identification summary information;

[0216] Performing an XOR operation on the third target obfuscated data identification summary information and the obfuscated data field to obtain the data field; or,

[0217] When the number of bits of the obfuscated data identification summary information is equal to the number of bits of the obfuscated data field, performing an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field; or,

[0218] When the number of bits of the obfuscated data identification summary information is less than the number of bits of the obfuscated data field, concatenating the obfuscated data identification summary information based on the number of bits of the obfuscated data field to obtain fourth target obfuscated data identification summary information;

[0219] An XOR operation is performed on the fourth target obfuscated data identification summary information and the obfuscated data field to obtain the data field.

[0220] In an optional embodiment, performing an XOR operation on the data field summary information and the obfuscated data identification information to obtain the data identification information includes:

[0221] In a case where the number of bits of the data field summary information is greater than the number of bits of the obfuscated data identification information, truncating the data field summary information based on the number of bits of the obfuscated data identification information to obtain third target data field summary information;

[0222] Performing an XOR operation on the third target data field summary information and the obfuscated data identification information to obtain the data identification information; or,

[0223] When the number of bits of the data field summary information is equal to the number of bits of the obfuscated data identification information, performing an XOR operation on the data field summary information and the obfuscated data identification information to obtain the data identification information; or,

[0224] When the number of bits of the data field summary information is less than the number of bits of the obfuscated identifier, concatenating the data field summary information based on the number of bits of the obfuscated data identification information to obtain fourth target data field summary information;

[0225] An XOR operation is performed on the fourth target data field summary information and the obfuscated data identification information to obtain the data identification information.

[0226] In an optional embodiment, in any of the above-mentioned data obfuscation methods, the receiving of the obfuscated data field and obfuscated data identification information sent by the controller area network data link layer includes:

[0227] receiving the second target identification information, the obfuscated data field and the obfuscated data identification information sent by the controller area network data link layer; the second target identification information, the obfuscated data field and the obfuscated data identification information are sent by the sending node to the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the obfuscation processing performed by the sending node on the data field and the first target identification information; the first target identification information and the second target identification information are determined based on the truncation processing performed by the sending node on the data identification information; the first target identification information is identification information in the data identification information that meets a preset condition, and the second target identification information is identification information in the data identification information other than the first target identification information;

[0228] Accordingly, the performing reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data includes:

[0229] Performing reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data field and the first target identification information;

[0230] The first target identification information and the second target identification information are concatenated to obtain the data identification information.

[0231] It can be seen from the above technical solutions of the embodiments of the present application that, in the embodiments of the present application, the data field and the data identification information are obfuscated by the sending node to obtain the obfuscated data field and the obfuscated data identification information, and then the obfuscated data field and the obfuscated data identification information are sent to the controller local area network data link layer, and then the obfuscated data field and the obfuscated data identification information are sent to the receiving node through the controller local area network data link layer, and the obfuscated data field and the obfuscated data identification information are reversely obfuscated by the receiving node to obtain the data field and the data identification information, and the reverse obfuscation processing is the reverse processing process of the obfuscation processing. The technical solution of the present application can effectively enhance the security of controller area network data link layer data, prevent the communication matrix of the controller area network from being cracked through reverse engineering of the controller area network, and achieve effective protection of controller area network data link layer data without involving key exchange or certificate authentication. It is not dependent on a specific controller area network data format, occupies less computing resources, can be adaptively deployed according to the specific implementation, has high compatibility, and is compatible with all current controller area network data formats, including traditional controller area networks (ClassicalCAN), controller area networks with flexible data bit rates (CAN FD), and controller area networks with extra-long data fields (CAN XL).

[0232] Corresponding to the data obfuscation method provided in the above embodiment, the embodiment of the present application also provides a data obfuscation device. Since the data obfuscation device provided in the embodiment of the present application corresponds to the data obfuscation method provided in the above embodiment, the implementation method of the aforementioned data obfuscation method is also applicable to the data obfuscation device provided in this embodiment, and will not be described in detail in this embodiment.

[0233] See also Fig. 9 , which shows a structural frame of a data obfuscation device provided in an embodiment of the present application Figure 1 , the device comprises:

[0234] A data acquisition module, used to acquire data link layer data in the controller area network; the data link layer data includes data fields and data identification information;

[0235] An obfuscation processing module, used to perform obfuscation processing on the data field and the data identification information to obtain an obfuscated data field and obfuscated data identification information corresponding to the data link layer data;

[0236] The first data sending module is used to send the obfuscated data field and the obfuscated data identification information to the controller local area network data link layer; so that the controller local area network data link layer sends the obfuscated data field and the obfuscated data identification information to the receiving node; and so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is the reverse processing process of the obfuscation processing.

[0237] In an optional embodiment, the obfuscation processing module includes:

[0238] The first obfuscation module is used to perform an XOR operation on the data field and the data identification information to obtain the obfuscated data field and the obfuscated data identification information.

[0239] In an optional embodiment, the first data sending module includes:

[0240] The first sending module is used to send the obfuscated data field and the obfuscated data identification information to the controller area network data link layer; so that the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to the receiving node; and so that the receiving node performs an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information.

[0241] In an optional embodiment, the first obfuscation module includes:

[0242] A first hash operation module, used for performing a hash operation on the data field to obtain data field summary information;

[0243] A first XOR operation module, configured to perform an XOR operation on the data field summary information and the data identification information to obtain the obfuscated data identification information;

[0244] A second hash operation module, used to perform a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information;

[0245] The second XOR operation module is used to perform an XOR operation on the obfuscated data identification summary information and the data field to obtain the obfuscated data field.

[0246] In an optional embodiment, the first sending module includes:

[0247] The second sending module is used to send the obfuscated data field and the obfuscated data identification information to the controller local area network data link layer; so that the controller local area network data link layer sends the obfuscated data field and the obfuscated data identification information to the receiving node; so that the receiving node performs a hash operation on the obfuscated data identification information to obtain the obfuscated data identification summary information; so that the receiving node performs an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field; so that the receiving node performs a hash operation on the data field to obtain the data field summary information; and so that the receiving node performs an XOR operation on the data field summary information and the obfuscated data identification information to obtain the data identification information.

[0248] In an optional embodiment, the first XOR operation module includes:

[0249] a first truncation processing module, configured to, when the number of bits of the data field summary information is greater than the number of bits of the data identification information, truncate the data field summary information based on the number of bits of the data identification information to obtain first target data field summary information; and to perform an XOR operation on the first target data field summary information and the data identification information to obtain the obfuscated data identification information; or,

[0250] A first processing module is configured to perform an XOR operation on the data field summary information and the data identification information to obtain the obfuscated data identification information when the number of bits of the data field summary information is equal to the number of bits of the data identification information; or

[0251] The first splicing processing module is used to, when the number of bits of the data field summary information is less than the number of bits of the data identification information, perform splicing processing on the data field summary information based on the number of bits of the data identification information to obtain second target data field summary information; and to perform an XOR operation on the second target data field summary information and the data identification information to obtain the obfuscated data identification information.

[0252] In an optional embodiment, the second XOR operation module includes:

[0253] a second truncation processing module, configured to, when the number of bits of the obfuscated data identification summary information is greater than the number of bits of the data field, truncate the obfuscated data identification summary information based on the number of bits of the data field to obtain first target obfuscated data identification summary information; and to perform an XOR operation on the first target obfuscated data identification summary information and the data field to obtain the obfuscated data field; or,

[0254] A second processing module is configured to perform an XOR operation on the obfuscated data identification summary information and the data field to obtain the obfuscated data field when the number of bits of the obfuscated data identification summary information is equal to the number of bits of the data field; or

[0255] a second splicing processing module, configured to, when the number of bits of the obfuscated data identification summary information is less than the number of bits of the data field, perform splicing processing on the obfuscated data identification summary information based on the number of bits of the data field to obtain second target obfuscated data identification summary information; and to perform an XOR operation on the second target obfuscated data identification summary information and the data field to obtain the obfuscated data field.

[0256] In an optional embodiment, the obfuscation processing module may further include:

[0257] a second obfuscation module, configured to perform truncation processing on the data identification information to obtain first target identification information and second target identification information; the first target identification information is identification information in the data identification information that meets a preset condition, and the second target identification information is identification information in the data identification information other than the first target identification information; and to perform obfuscation processing on the data field and the first target identification information to obtain the obfuscated data field and the obfuscated data identification information;

[0258] Accordingly, the first data sending module may further include:

[0259] The third sending module is used to send the second target identification information, the obfuscated data field and the obfuscated data identification information to the controller local area network data link layer; so that the controller local area network data link layer sends the second target identification information, the obfuscated data field and the obfuscated data identification information to the receiving node; so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data field and the first target identification information; and so that the receiving node performs splicing processing on the first target identification information and the second target identification information to obtain the data identification information.

[0260] See also Fig.10 , which shows a structural frame of a data obfuscation device provided in an embodiment of the present application Figure 2 , the device comprises:

[0261] A first data receiving module is used to receive an obfuscated data field and obfuscated data identification information sent by a sending node; the obfuscated data field and the obfuscated data identification information are determined based on the obfuscation processing performed by the sending node on the data field and the data identification information, and the data field and the data identification information are obtained by the sending node;

[0262] The second data sending module is used to send the obfuscated data field and the obfuscated data identification information to a receiving node, so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

[0263] In an optional embodiment, the first data receiving module includes:

[0264] The first receiving module is used to receive the second target identification information, the obfuscated data field and the obfuscated data identification information sent by the sending node; the obfuscated data field and the obfuscated data identification information are determined based on the obfuscation processing performed by the sending node on the data field and the first target identification information, and the first target identification information and the second target identification information are determined based on the truncation processing performed by the sending node on the data identification information; the first target identification information is the identification information in the data identification information that meets a preset condition, and the second target identification information is the identification information in the data identification information other than the first target identification information.

[0265] In an optional embodiment, the second data sending module includes:

[0266] a fourth sending module, configured to send the second target identification information, the obfuscated data field, and the obfuscated data identification information to the receiving node, so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data field and the first target identification information; and so that the receiving node performs splicing processing on the first target identification information and the second target identification information to obtain the data identification information.

[0267] See also Fig.11 , which shows a structural frame of a data obfuscation device provided in an embodiment of the present application Figure 3 , the device comprises:

[0268] A second data receiving module is used to receive an obfuscated data field and obfuscated data identification information sent by a controller area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by a sending node to the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the obfuscation processing performed by the sending node on the data field and the data identification information; the data field and the data identification information are obtained by the sending node;

[0269] A reverse obfuscation processing module is used to perform reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

[0270] In an optional embodiment, the second data receiving module includes:

[0271] The second receiving module is used to receive the obfuscated data field and the obfuscated data identification information sent by the controller local area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by the sending node to the controller local area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the sending node performing an exclusive OR operation on the data field and the data identification information; the data field and the data identification information are acquired by the sending node.

[0272] In an optional embodiment, the reverse obfuscation processing module includes:

[0273] The first reverse obfuscation module is used to perform an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information.

[0274] In an optional embodiment, the second receiving module includes:

[0275] The third receiving module is used to receive the obfuscated data field and the obfuscated data identification information sent by the controller local area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by the sending node to the controller local area network data link layer; the obfuscated data field is determined based on the sending node performing an XOR operation on the obfuscated data identification summary information and the data field; the obfuscated data identification summary information is determined based on the sending node performing a hash operation on the obfuscated data identification information; the obfuscated data identification information is determined based on the sending node performing an XOR operation on the data field summary information and the data identification information; the data field summary information is determined based on the sending node performing a hash operation on the data field; the data field and the data identification information are acquired by the sending node.

[0276] In an optional embodiment, the first reverse obfuscation module includes:

[0277] A third hash operation module, used to perform a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information;

[0278] A third XOR operation module is used to perform an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field;

[0279] A fourth hash operation module, used to perform a hash operation on the data field to obtain data field summary information;

[0280] The fourth XOR operation module is used to perform an XOR operation on the data field summary information and the obfuscated data identification information to obtain the data identification information.

[0281] In an optional embodiment, the third XOR operation module includes:

[0282] A third truncation processing module is used to truncate the obfuscated data identification summary information based on the bit number of the obfuscated data field to obtain third target obfuscated data identification summary information when the bit number of the obfuscated data identification summary information is greater than the bit number of the obfuscated data field; and to perform an XOR operation on the third target obfuscated data identification summary information and the obfuscated data field to obtain the data field; or,

[0283] A third processing module is configured to, when the number of bits of the obfuscated data identification summary information is equal to the number of bits of the obfuscated data field, perform an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field; or

[0284] a third splicing processing module, configured to, when the number of bits of the obfuscated data identification summary information is less than the number of bits of the obfuscated data field, perform splicing processing on the obfuscated data identification summary information based on the number of bits of the obfuscated data field to obtain fourth target obfuscated data identification summary information; and to perform an XOR operation on the fourth target obfuscated data identification summary information and the obfuscated data field to obtain the data field.

[0285] In an optional embodiment, the fourth XOR operation module includes:

[0286] a fourth truncation processing module, configured to, when the number of bits of the data field summary information is greater than the number of bits of the obfuscated data identification information, truncate the data field summary information based on the number of bits of the obfuscated data identification information to obtain third target data field summary information; and to perform an XOR operation on the third target data field summary information and the obfuscated data identification information to obtain the data identification information; or,

[0287] A fourth processing module is configured to, when the number of bits of the data field summary information is equal to the number of bits of the obfuscated data identification information, perform an XOR operation on the data field summary information and the obfuscated data identification information to obtain the data identification information; or

[0288] a fourth splicing processing module, configured to perform splicing processing on the data field summary information based on the number of bits of the obfuscated data identification information to obtain fourth target data field summary information when the number of bits of the data field summary information is less than the number of bits of the obfuscated identifier; and to perform an XOR operation on the fourth target data field summary information and the obfuscated data identification information to obtain the data identification information.

[0289] In an optional embodiment, the second data receiving module may further include:

[0290] A third receiving module is used to receive the second target identification information, the obfuscated data field and the obfuscated data identification information sent by the controller area network data link layer; the second target identification information, the obfuscated data field and the obfuscated data identification information are sent by the sending node to the controller area network data link layer; the obfuscated data field and the obfuscated data identification information are determined based on the obfuscation processing performed by the sending node on the data field and the first target identification information; the first target identification information and the second target identification information are determined based on the truncation processing performed by the sending node on the data identification information; the first target identification information is the identification information in the data identification information that meets the preset condition, and the second target identification information is the identification information in the data identification information except the first target identification information;

[0291] Accordingly, the above reverse obfuscation processing module may also include:

[0292] Performing reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data field and the first target identification information;

[0293] The first target identification information and the second target identification information are concatenated to obtain the data identification information.

[0294] It should be noted that the device provided in the above embodiment, when implementing its functions, is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0295] The data obfuscation device of the embodiment of the present application can effectively enhance the security of the controller area network data link layer data, prevent the communication matrix of the controller area network from being cracked through reverse engineering of the controller area network, and achieve effective protection of the controller area network data link layer data without involving key exchange or certificate authentication. It is not dependent on a specific controller area network data format, occupies less computing resources, can be adaptively deployed according to the specific implementation, has high compatibility, and is compatible with all current controller area network data formats, including the traditional controller area network (Classical CAN), the controller area network with flexible data bit rate (CAN FD), and the controller area network with extra long data field (CAN XL).

[0296] The embodiment of the present application also provides a data obfuscation system, the data obfuscation system comprising: a sending node, a controller area network data link layer, and a receiving node;

[0297] The sending node is used to obtain data link layer data in the controller area network; the data link layer data includes a data field and data identification information; and is used to perform obfuscation processing on the data field and the data identification information to obtain an obfuscated data field and obfuscated data identification information corresponding to the data link layer data; and is used to send the obfuscated data field and the obfuscated data identification information to the controller area network data link layer;

[0298] The controller area network data link layer is used to send the obfuscated data field and the obfuscated data identification information to a receiving node;

[0299] The receiving node is used to perform reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

[0300] An embodiment of the present application also provides an electronic device, including a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the processor to implement the data obfuscation method provided in the above method embodiment.

[0301] The memory can be used to store software programs and modules. The processor executes various functional applications and realizes high-level autonomous driving by running the software programs and modules stored in the memory. The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, application programs required for functions, etc.; the data storage area may store data created according to the use of the device, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. Accordingly, the memory may also include a memory controller to provide the processor with access to the memory.

[0302] The method embodiments provided in the embodiments of the present application may be executed in a computer terminal, a server or a similar computing device, that is, the above-mentioned electronic device may include a computer terminal, a server or a similar computing device. Fig.12 is a hardware structure block diagram of an electronic device running a data obfuscation method provided in an embodiment of the present application, such as Fig.12 As shown, the internal structure of the electronic device may include but is not limited to: a processor, a network interface and a memory. The processor, network interface and memory in the electronic device may be connected via a bus or other means. Fig.12 The example of connecting through bus is taken in the following.

[0303] Among them, the processor (or CPU (Central Processing Unit)) is the computing core and control core of the electronic device. The network interface may optionally include a standard wired interface, a wireless interface (such as WI-FI, a mobile communication interface, etc.). Memory is a memory device in an electronic device for storing programs and data. It is understandable that the memory here can be a high-speed RAM storage device, or a non-volatile memory device (non-volatile memory), such as at least one disk storage device; optionally, it can also be at least one storage device located away from the aforementioned processor. The memory provides a storage space, which stores the operating system of the electronic device, which may include but is not limited to: Windows system (an operating system), Linux (an operating system), Android (Android, a mobile operating system) system, IOS (a mobile operating system) system, etc., and this application does not limit this; and, in the storage space, one or more instructions suitable for being loaded and executed by the processor are also stored, and these instructions can be one or more computer programs (including program codes). In the embodiment of this specification, the processor loads and executes one or more instructions stored in the memory to implement the data obfuscation method provided in the above method embodiment.

[0304] An embodiment of the present application also provides a computer-readable storage medium, in which at least one instruction or at least one program is stored, and the at least one instruction or at least one program is loaded and executed by a processor to implement the data obfuscation method provided in the method embodiment.

[0305] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store program codes.

[0306] It should be noted that the above-mentioned sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. And the above describes a specific embodiment of this specification. Other embodiments are within the scope of the attached claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-small sample image classification and parallel processing are also possible or may be advantageous.

[0307] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0308] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above embodiments can be completed by hardware, or can be completed by a program to instruct related hardware. The program can be stored in a computer-readable storage medium, and the above-mentioned storage medium can be a read-only memory, a disk or an optical disk, etc.

[0309] The above are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A data obfuscation method, characterized in that: include: Acquire data link layer data in the controller area network; the data link layer data includes data fields and data identification information; Performing a hash operation on the data field to obtain data field summary information; Performing an XOR operation on the data field summary information and the data identification information to obtain obfuscated data identification information; Performing a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information; Performing an XOR operation on the obfuscated data identification summary information and the data field to obtain an obfuscated data field; The obfuscated data field and the obfuscated data identification information are sent to the controller area network data link layer; so that the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node; and so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

2. The data obfuscation method according to claim 1, characterized in that: The obfuscated data field and the obfuscated data identification information are sent to a controller area network data link layer; so that the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node; And enabling the receiving node to perform reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data, including: The obfuscated data field and the obfuscated data identification information are sent to a controller area network data link layer; the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node; and the receiving node performs an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information.

3. The data obfuscation method according to claim 2, characterized in that: The obfuscated data field and the obfuscated data identification information are sent to a controller area network data link layer; so that the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to a receiving node; And enabling the receiving node to perform an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information, including: The obfuscated data field and the obfuscated data identification information are sent to the controller area network data link layer; so that the controller area network data link layer sends the obfuscated data field and the obfuscated data identification information to the receiving node; so that the receiving node performs a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information; so that the receiving node performs an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field; so that the receiving node performs a hash operation on the data field to obtain data field summary information; and so that the receiving node performs an XOR operation on the data field summary information and the obfuscated data identification information to obtain the data identification information.

4. A data obfuscation method, characterized in that: include: Receiving obfuscated data fields and obfuscated data identification information sent by a controller area network data link layer; the obfuscated data fields and the obfuscated data identification information are sent by a sending node to the controller area network data link layer; the obfuscated data field is determined based on the sending node performing an XOR operation on the obfuscated data identification summary information and the data field; the obfuscated data identification summary information is determined based on the sending node performing a hash operation on the obfuscated data identification information; the obfuscated data identification information is determined based on the sending node performing an XOR operation on the data field summary information and the data identification information; the data field summary information is determined based on the sending node performing a hash operation on the data field; The data field and the data identification information are acquired by the sending node; Reverse obfuscation processing is performed on the obfuscated data field and the obfuscated data identification information to obtain data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

5. The data obfuscation method according to claim 4, characterized in that: The performing reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data includes: An XOR operation is performed on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information.

6. The data obfuscation method according to claim 4, characterized in that: The performing an XOR operation on the obfuscated data field and the obfuscated data identification information to obtain the data field and the data identification information includes: Performing a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information; Performing an XOR operation on the obfuscated data identification summary information and the obfuscated data field to obtain the data field; Performing a hash operation on the data field to obtain data field summary information; An XOR operation is performed on the data field summary information and the obfuscated data identification information to obtain the data identification information.

7. A data obfuscation device, characterized in that: The device comprises: A data acquisition module, used to acquire data link layer data in the controller area network; the data link layer data includes data fields and data identification information; A first operation module, used for performing a hash operation on the data field to obtain data field summary information; A second operation module is used to perform an XOR operation on the data field summary information and the data identification information to obtain obfuscated data identification information; A third operation module is used to perform a hash operation on the obfuscated data identification information to obtain obfuscated data identification summary information; a fourth operation module, configured to perform an XOR operation on the obfuscated data identification summary information and the data field to obtain an obfuscated data field; The first data sending module is used to send the obfuscated data field and the obfuscated data identification information to the controller local area network data link layer; so that the controller local area network data link layer sends the obfuscated data field and the obfuscated data identification information to the receiving node; and so that the receiving node performs reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain the data link layer data; the reverse obfuscation processing is the reverse processing process of the obfuscation processing.

8. A data obfuscation device, characterized in that: The device comprises: A second data receiving module is used to receive an obfuscated data field and obfuscated data identification information sent by a controller area network data link layer; the obfuscated data field and the obfuscated data identification information are sent by a sending node to the controller area network data link layer; the obfuscated data field is determined based on the sending node performing an XOR operation on the obfuscated data identification summary information and the data field; the obfuscated data identification summary information is determined based on the sending node performing a hash operation on the obfuscated data identification information; the obfuscated data identification information is determined based on the sending node performing an XOR operation on the data field summary information and the data identification information; the data field summary information is determined based on the sending node performing a hash operation on the data field; the data field and the data identification information are acquired by the sending node; A reverse obfuscation processing module is used to perform reverse obfuscation processing on the obfuscated data field and the obfuscated data identification information to obtain data link layer data; the reverse obfuscation processing is a reverse processing process of the obfuscation processing.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed based on the processor to implement the data obfuscation method according to any one of claims 1 to 6.

10. A computer-readable storage medium, wherein at least one instruction or at least one program is stored in the storage medium, wherein the at least one instruction or the at least one program is loaded and executed based on a processor to implement the data obfuscation method according to any one of claims 1 to 6.

Images