Information security encryption and decryption module, system and method

Abstract

The application belongs to the technical field of information security, data encryption and CAN communication in vehicle, and provides an information security encryption and decryption module, system and method. The information security encryption and decryption module comprises a processor, an encryption and decryption module and a register which are connected with each other, the processor is further connected with a first CAN transceiver and a second CAN transceiver, the first CAN transceiver is connected with a first connector, the second CAN transceiver is connected with the encryption and decryption module and a second connector respectively, the processor is configured to pre-process data transmitted by the first CAN transceiver and / or the second CAN transceiver, and the encryption and decryption module is configured to encrypt and / or decrypt the pre-processed data. The information security encryption and decryption module can realize encapsulation of encryption algorithms of vehicle manufacturers, the vehicle manufacturers can quickly and conveniently modify and define the encryption algorithms, and the difficulty of cracking the encryption algorithms is improved.

Description

Technical Field

[0001] This invention belongs to the fields of information security, data encryption and in-vehicle CAN communication technology, and specifically relates to an information security encryption and decryption module, system and method. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Currently, all CAN bus data in vehicles is transmitted in plaintext without any security encryption measures. Adding a data acquisition and analysis tool to the CAN bus allows for easy collection and monitoring of messages, and reverse engineering to extract the signal data. This is highly detrimental to automotive data security and the intellectual property of vehicle manufacturers. Regarding the application of information security encryption algorithms, vehicle manufacturers need to release the encryption algorithm to controller software development suppliers, which inherently risks its leakage. Software development suppliers, on the other hand, need to create corresponding software interfaces or encryption algorithms to meet the data encryption requirements of vehicle manufacturers, adding extra software development workload. Furthermore, different controllers installed in vehicles will encounter additional communication compatibility testing problems due to differences in understanding of encryption algorithms and interface calls. Summary of the Invention

[0004] To address the aforementioned problems, this invention proposes an information security encryption / decryption module, system, and method. The information security encryption / decryption module described in this invention can encrypt and decrypt CAN bus data. Through connectors, it can be plugged and played with various controllers, meeting the static current requirements of the entire vehicle, avoiding the risk of leakage, and ensuring the security of vehicle data.

[0005] According to some embodiments, the present invention adopts the following technical solution:

[0006] Firstly, the present invention provides an information security encryption / decryption module.

[0007] An information security encryption / decryption module includes: a processor, an encryption / decryption module, and a register connected to each other. The processor is also connected to a first CAN transceiver and a second CAN transceiver. The first CAN transceiver is connected to a first connector, and the second CAN transceiver is connected to the encryption / decryption module and the second connector, respectively.

[0008] The processor is configured to preprocess data transmitted from the first CAN transceiver and / or the second CAN transceiver.

[0009] The encryption / decryption module is configured to encrypt and / or decrypt the preprocessed data.

[0010] Furthermore, both the first connector and / or the second connector are used to connect to the controller inside the vehicle.

[0011] Furthermore, both the first CAN transceiver and the second CAN transceiver include several CAN channels.

[0012] Secondly, this invention provides an information security encryption and decryption system.

[0013] An information security encryption and decryption system includes an information security encryption and decryption module as described in the first aspect of mutual communication and data interaction, and a controller in a vehicle. The first connector of the information security encryption and decryption module is connected to the controller in sequence through a first controller connector and a controller CAN transceiver; the second connector of the information security encryption and decryption module is connected to the vehicle bus through a second controller connector.

[0014] Furthermore, the information security encryption / decryption module is powered by the power supply of the controller.

[0015] Furthermore, the information security encryption / decryption module is grounded through the grounding terminal of the controller.

[0016] Thirdly, this invention provides an information security encryption method.

[0017] An information security encryption method, employing the information security encryption system described in the second aspect, includes:

[0018] The controller sends data sequentially through the first controller connector and the first connector to the first CAN transceiver via the first controller CAN transceiver.

[0019] The first CAN transceiver sends data to the processor, and the processor calls the encryption / decryption module to encrypt the data;

[0020] The encryption / decryption module sends the encrypted data to the second CAN transceiver;

[0021] The second CAN transceiver sends the encrypted data to the vehicle bus sequentially through the second connector and the second controller connector.

[0022] Furthermore, when the controller detects that the bus is in sleep mode or the controller sleep condition is met, the power output between the controller and the information security encryption / decryption module is disconnected.

[0023] Fourthly, this invention provides an information security encryption method.

[0024] An information security decryption method, employing the information security encryption system described in the second aspect, includes:

[0025] The vehicle bus transmits CAN messages to the encryption / decryption module via the second controller connector and the second connector through the second CAN transceiver.

[0026] The encryption / decryption module decrypts the CAN messages;

[0027] The encryption / decryption module sends the decrypted CAN message to the processor;

[0028] The processor sends the decrypted CAN message to the controller via the first CAN transceiver, through the first connector and the first controller connector.

[0029] Furthermore, when the controller detects that the bus is in sleep mode or the controller sleep condition is met, the power output between the controller and the information security encryption / decryption module is disconnected.

[0030] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0031] The information security encryption and decryption module described in this invention can encapsulate the encryption algorithms of vehicle OEMs, allowing them to quickly and easily modify and define encryption algorithms, thus increasing the difficulty of cracking encryption algorithms.

[0032] The information security encryption and decryption module described in this invention enables vehicle OEMs to avoid releasing encryption algorithms to controller software suppliers, thus mitigating the risk of encryption algorithm leakage.

[0033] The information security encryption and decryption module described in this invention does not require software development for the controller, achieving plug-and-play functionality, reducing software development workload, and shortening the development cycle.

[0034] The information security encryption and decryption module software described in this invention is uniformly packaged by the vehicle OEM, which greatly reduces the testing workload caused by inconsistent software algorithm development among various controllers.

[0035] The information security encryption / decryption module described in this invention can obtain power from the controller through a connector to operate, or it can be controlled by the controller to power on and off to realize the module's sleep and wake-up, thus meeting the static current requirements of the whole vehicle. Attached Figure Description

[0036] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0037] Figure 1 This is a schematic diagram illustrating the application of the information security encryption / decryption module shown in this invention;

[0038] Figure 2This is a schematic diagram illustrating the application of the first and second connectors shown in this invention.

[0039] In the figure, 1(1) First connector, 1(2) First controller connector, 2(1) First connector, 2(2) Second controller connector, 3(1) First CAN transceiver, 3(2) Second CAN transceiver, 4, Processor (MCU), 5, Encryption / decryption module, 6, Register (EEPROM). Detailed Implementation

[0040] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0041] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0042] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0043] In this invention, terms such as "connected" and "linked" should be interpreted broadly, indicating a fixed connection, an integral connection, or a detachable connection; a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can determine the specific meaning of these terms in this invention based on the specific circumstances, and they should not be construed as limitations on the invention.

[0044] Terminology Explanation:

[0045] Connectors, also known as connectors or sockets, generally refer to electrical connectors. They are devices that connect two active devices to transmit current or signals. The male and female terminals, when in contact, can transmit information or current; this is called a connector.

[0046] A CAN transceiver is a single-chip integrated circuit that combines a CAN data transmitter and a data receiver. Automotive network CAN transceivers are divided into two main categories: stand-alone and combined. Stand-alone network CAN transceivers are more flexible in application and can be connected to various CAN controllers.

[0047] De-identification is a data processing principle that automotive data processors adhere to when carrying out automotive data processing activities.

[0048] Rijndael is a basic cryptographic algorithm used in the Advanced Encryption Standard (AES).

[0049] Example 1

[0050] This embodiment provides an information security encryption / decryption module, such as... Figure 1 The module within the dashed box is the information security encryption / decryption module described in this embodiment, including a processor (MCU) 4, a register (EEPROM) 6, an encryption / decryption module 5, a first CAN transceiver 3 (1), a second CAN transceiver 3 (2), a first connector 1 (1), and a second connector 2 (1); wherein, the processor 4 is connected to the encryption / decryption module 5, the register 6, the first CAN transceiver 3 (1), and the second CAN transceiver 3 (2), the register 6 is connected to the processor 4 and the encryption / decryption module 5, and the encryption / decryption module 5 is connected to the second CAN transceiver 3 (2).

[0051] Specifically, the encryption / decryption module 5 in this embodiment can perform independent encryption / decryption operations.

[0052] The processor 4 in this embodiment can preprocess the data transmitted from the first CAN transceiver and / or the second CAN transceiver, including data standardization and noise reduction.

[0053] The first CAN transceiver 3(1) and the second CAN transceiver 3(2) described in this embodiment are transceivers that support variable rate CANFD and are compatible with CAN transceivers for communication. The first connector 1(1) and the second connector 2(1) described in this embodiment are both standard parts and can be defined by the vehicle OEM for physical connection between the vehicle controller and the information security encryption / decryption module.

[0054] The information security encryption / decryption module described in this embodiment is a standardized module that can independently perform desensitization and differential privacy processing of CAN bus data. The processor selection is not fixed and is determined by the vehicle OEM based on its own algorithms and software development platform. Differential privacy processing can be achieved by modifying the CAN differential signal using algorithms, such as employing a differential method to process the CAN differential signal, or by using other existing methods; this embodiment does not impose specific limitations on this.

[0055] Furthermore, the encryption and decryption algorithms and processes of the information security encryption and decryption module are not required; they are designed by the vehicle OEM based on its own encryption needs and real-time and security requirements. The information security encryption and decryption module described in this embodiment can encrypt and decrypt CAN bus data, and can be plugged and played with each controller through the first connector 1 (1) and the second connector 2 (1).

[0056] The information security encryption / decryption module described in this embodiment can obtain power from the controller through the first connector 1 (1), the second connector 2 (1), the first controller connector 1 (2), and the second controller connector 2 (2) to work. It can also be controlled by the controller to power on and off, thereby realizing the sleep and wake-up of the information security encryption / decryption module to meet the requirements of the vehicle's static current.

[0057] Example 2

[0058] This embodiment provides an information security encryption and decryption system.

[0059] This embodiment uses a car as an example for illustration.

[0060] like Figure 1 As shown, the module within the dashed box is the information security encryption / decryption module described in this embodiment. Below the dashed box is the vehicle's ECU controller. The information security encryption / decryption system described in this embodiment includes the information security encryption / decryption module and the vehicle's ECU controller. Specifically, the first connector 1 (1) of the information security encryption / decryption module is connected to the vehicle's ECU controller via the first controller connector 1 (2), and the second connector 2 (1) of the information security encryption / decryption module is connected to the vehicle's ECU controller via the second controller connector 2 (2).

[0061] In this embodiment, the first connector 1 (1) and the second connector 2 (1) are male connectors of standardized connectors from vehicle OEMs, which can be plug-and-play with the first controller connector 1 (2) and the second controller connector 2 (2), such as... Figure 2 As shown; and the information security encryption / decryption module described in this embodiment can achieve inter-board power supply through the controller's VDD and GND.

[0062] like Figure 1 As shown, the CAN transceiver of the controller ECU is connected to the first CAN transceiver 3 (1) of the information security encryption and decryption module through the first connector 1 (1), which enables communication data interaction between the information security encryption and decryption module and the controller ECU. After the information security encryption and decryption module encrypts the data from the controller ECU through its own encryption algorithm or encryption module, it sends it to the second connector 2 (1) through the second CAN transceiver 3 (2). The second connector 2 (1) realizes data transmission through the connection with the second controller connector 2 (2) and outputs it to the vehicle bus through the second controller connector 2 (2).

[0063] Similarly, if a CAN message is received from the vehicle bus, it first enters the information security encryption and decryption module described in this embodiment through the second connector 2 (1) for decryption processing, and then sends it to the controller ECU through the first connector 1 (1) to realize the reception of vehicle bus data.

[0064] The information security encryption / decryption module described in this embodiment is powered by the controller ECU. When the controller ECU detects that the bus is in sleep mode or the controller sleep mode conditions are met, it can disconnect the VDD power output, thereby reducing the power consumption of the information security encryption / decryption module and achieving the vehicle's static current target. Furthermore, the information security encryption / decryption module described in this embodiment does not affect the vehicle's static current target value.

[0065] The information security encryption / decryption module described in this embodiment does not specify the number of CAN channels that can be encrypted. In other words, even if the number of CAN channels increases or decreases, as long as the information security encryption scheme described in this embodiment is still used, it is still within the scope of protection of this patent.

[0066] The information security encryption / decryption module described in this embodiment achieves seamless encryption of the controller ECU through standardized connections and encryption processing. This ensures that the entire encryption algorithm is independent of individual controller software vendors and is completely controlled by the vehicle OEM. The vehicle OEM can set and modify the encryption algorithm to adapt it to different project platforms, achieving information isolation between vehicle models.

[0067] Example 3

[0068] This embodiment provides an information security encryption method.

[0069] An information security encryption method, employing the information security encryption system described in Embodiment 2, includes:

[0070] The controller sends data sequentially through the first controller connector and the first connector to the first CAN transceiver via the first controller CAN transceiver.

[0071] The first CAN transceiver sends data to the processor, and the processor calls the encryption / decryption module to encrypt the data;

[0072] The encryption / decryption module sends the encrypted data to the second CAN transceiver;

[0073] The second CAN transceiver sends the encrypted data to the vehicle bus sequentially through the second connector and the second controller connector.

[0074] Meanwhile, when the controller detects that the bus is in sleep mode or the controller sleep condition is met, it disconnects the power output from the information security encryption / decryption module.

[0075] Specifically, the information security encryption and decryption module encrypts the data from the controller ECU using its own encryption algorithm or encryption module, and then sends it to the second connector through the second CAN transceiver. The second connector realizes data transmission through its connection with the second controller connector, and outputs it to the vehicle bus through the second controller connector.

[0076] The encryption algorithm used in the encryption / decryption module in this embodiment is an existing solution, which can be designed by the vehicle OEM according to its own encryption needs and real-time and security requirements.

[0077] For example, encryption algorithms can use hash algorithms such as SM3; signature algorithms such as RSA (Rivest-Shamir-Adleman) and ECDSA (Elliptic Curve Digital Signature Algorithm); key exchange algorithms; and symmetric encryption algorithms, such as using AES encryption and decryption algorithms and GCM encryption mode to encrypt CAN messages. The AES encryption and decryption algorithm is an iterative symmetric block cipher algorithm based on the Rijndael structure, with a fixed block length of 128 bits, and can support keys of 128 bits, 192 bits, and 256 bits. The number of rounds of conversion is determined by both the key length and the block length.

[0078] Example 4

[0079] This embodiment provides an information security decryption method.

[0080] An information security decryption method, employing the information security encryption system described in Embodiment 2, includes:

[0081] The vehicle bus transmits CAN messages to the encryption / decryption module via the second controller connector and the second connector through the second CAN transceiver.

[0082] The encryption / decryption module decrypts the CAN messages;

[0083] The encryption / decryption module sends the decrypted CAN message to the processor;

[0084] The processor sends the decrypted CAN message to the controller via the first CAN transceiver, through the first connector and the first controller connector.

[0085] Meanwhile, when the controller detects that the bus is in sleep mode or the controller sleep condition is met, it disconnects the power output from the information security encryption / decryption module.

[0086] Specifically, if a CAN message is received from the vehicle bus, it first enters the information security encryption / decryption module described in this embodiment through the second connector for decryption processing, and then sends it to the controller ECU through the first connector to realize the reception of vehicle bus data.

[0087] The encryption / decryption module in this embodiment uses an existing decryption algorithm, which can be designed by the vehicle manufacturer according to its own decryption needs and real-time and security requirements.

[0088] For example, decryption algorithms can use hash algorithms such as SM3; signature algorithms such as RSA (Rivest-Shamir-Adleman) and ECDSA (Elliptic Curve Digital Signature Algorithm); key exchange algorithms; and symmetric encryption algorithms, such as using AES encryption and decryption algorithms and GCM encryption mode to decrypt CAN messages. The AES encryption and decryption algorithm is an iterative symmetric block cipher algorithm based on the Rijndael structure, with a fixed block length of 128 bits, and can support keys of 128 bits, 192 bits, and 256 bits. The number of rounds of conversion is determined by both the key length and the block length.

[0089] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An information security encryption and decryption system, characterized by, The information security encryption system comprises: an information security encryption module and a controller in a vehicle; the information security encryption module and the controller in the vehicle communicate with each other to exchange data; the information security encryption module comprises a processor, an encryption and decryption module and a register connected with each other; the processor is further connected with a first CAN transceiver and a second CAN transceiver, the first CAN transceiver is connected with a first connector, and the second CAN transceiver is connected with the encryption and decryption module and a second connector respectively; the processor is configured to pre-process data transmitted by the first CAN transceiver and / or the second CAN transceiver; the encryption and decryption module is configured to encrypt and / or decrypt the pre-processed data; and the encryption and decryption module realizes independent encryption and decryption operation; the first connector of the information security encryption module is connected with the controller through a first controller connector and a controller CAN transceiver in sequence; and the second connector of the information security encryption module is connected with a vehicle bus through a second controller connector.

2. The information security encryption and decryption system of claim 1, wherein, The first connector and / or the second connector are used to connect the controller in the vehicle.

3. The information security encryption and decryption system of claim 1, wherein, The first CAN transceiver and the second CAN transceiver each comprise a plurality of CAN channels.

4. The information security encryption system of claim 1, wherein, The information security encryption module is powered by a power supply of the controller.

5. The information security encryption system of claim 1, wherein, The information security encryption module is grounded through a grounding terminal of the controller.

6. An information security encryption method characterized by, The information security encryption system of any one of claims 1-5 comprises: the controller sends data to the first CAN transceiver through a first controller CAN transceiver, a first controller connector and the first connector in sequence; the first CAN transceiver sends the data to the processor, and the processor mobilizes the encryption and decryption module to encrypt the data; the encryption and decryption module sends the encrypted data to the second CAN transceiver; the second CAN transceiver sends the encrypted data to the vehicle bus through a second connector and a second controller connector in sequence.

7. The information security encryption method of claim 6, wherein, When the controller detects that the bus is in sleep or the controller sleep condition is met, the power output between the information security encryption module and the controller is disconnected.

8. An information security decryption method characterized by comprising: The information security encryption system of any one of claims 1-5 comprises: the vehicle bus sends a CAN message to the encryption and decryption module through a second controller connector and a second connector, and then through a second CAN transceiver; the encryption and decryption module decrypts the CAN message; the encryption and decryption module sends the decrypted CAN message to the processor; the processor sends the decrypted CAN message to the controller through a first CAN transceiver, a first connector and a first controller connector in sequence.

9. The information security decryption method of claim 8, wherein, When the controller detects that the bus is in sleep or the controller sleep condition is met, the power output between the information security encryption module and the controller is disconnected.

Images