Encrypted communication method, apparatus, vehicle, and storage medium

Abstract

The application relates to the technical field of information security, and discloses an encrypted communication method and device, a vehicle and a storage medium. The method comprises the following steps: obtaining to-be-encrypted data; determining first target time information from a plurality of time information to obtain position information of the first target time information in the plurality of time information, wherein the plurality of time information is generated by a target in-vehicle controller and is synchronized to other in-vehicle controllers; encrypting the to-be-encrypted data based on the first target time information to obtain encrypted data; and generating a data packet based on the encrypted data and the position information and sending the data packet to a session receiver. The application can solve the problem that the in-vehicle controller negotiates to generate a session key to perform encrypted communication, and the communication security is low.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to encrypted communication methods, devices, vehicles, and storage media. Background Technology

[0002] As vehicles become increasingly intelligent and connected, they also face more external threats, making the encryption of private and sensitive data and vehicle control commands transmitted between in-vehicle controllers more commonplace. Currently, encrypted communication between in-vehicle controllers typically uses symmetric key encryption. That is, before communicating, the two communicating parties negotiate and generate a session key, and then encrypt the communication based on the session key.

[0003] However, the method by which the in-vehicle controller negotiates and generates a session key for encrypted communication means that once the session key for encrypted communication is negotiated, it usually does not change. If the negotiated session key is cracked, all subsequent communication between the two parties will be deciphered, resulting in low communication security between the in-vehicle controllers. Summary of the Invention

[0004] In view of this, the present invention provides an encrypted communication method, apparatus, vehicle, and storage medium to solve the problem of low communication security caused by the in-vehicle controller negotiating and generating session keys for encrypted communication.

[0005] In a first aspect, the present invention provides an encrypted communication method, the method comprising:

[0006] Obtain the data to be encrypted;

[0007] A first target time information is determined from multiple time information to obtain the position information of the first target time information in the multiple time information, wherein the multiple time information is generated by the target in-vehicle controller and synchronized to other in-vehicle controllers;

[0008] The data to be encrypted is encrypted based on the first target time information to obtain encrypted data;

[0009] A data packet is generated based on the encrypted data and the location information and sent to the session recipient.

[0010] In the manner, the target in-vehicle controller synchronizes the multiple time information to other in-vehicle controllers, each in-vehicle controller selects a first target time information from the multiple time information to encrypt the data to be encrypted, and sends the encrypted data and the position information of the first target time information to the session receiver, so that the session receiver can determine the time information used for decrypting the encrypted data according to the position information. Therefore, the two parties of the session do not need to perform an additional key agreement process before communication, so as to reduce the time consumption of key agreement. At the same time, since the multiple time information is controlled by the target in-vehicle controller, which is different from the actual time, different in-vehicle controllers can select appropriate first target time information from the multiple time information for data encryption, and can also select new first target time information to encrypt data along with the update of the time information synchronized by the target in-vehicle controller, so as to improve the communication security of the in-vehicle controller.

[0011] In an optional implementation, the determining the first target time information from the multiple time information comprises:

[0012] The first target time information is time information other than the latest time information;

[0013] The value of the smallest time unit in the first target time information is obtained as the position information of the first target time information in the multiple time information.

[0014] In the manner, by selecting time information other than the latest time information as the first target time information, the situation that the session receiver cannot successfully decrypt the encrypted data due to the inconsistency of the latest time information of the two parties caused by the time delay can be avoided. Moreover, since the multiple time information of different in-vehicle controllers is not necessarily synchronized due to different transmission delays, the storage positions of the same time information in the multiple time information of each in-vehicle controller can be different. Based on this, by taking the value of the smallest time unit in the first target time information as the position information of the first target time information in the multiple time information, the session receiver can also accurately find the time information used for decryption.

[0015] In an optional implementation, the encrypting the data to be encrypted based on the first target time information comprises:

[0016] A preset time period and a key factor corresponding to the preset time period are obtained;

[0017] determine a target time period in which the first target time information is located, and a target key factor corresponding to the target time period;

[0018] generate a session key based on the target key factor;

[0019] encrypt the data to be encrypted based on the session key to obtain the encrypted data.

[0020] In this way, the target key factor corresponding to the target time period in which the first target time information is located is obtained, and a session key is generated based on the target key factor to encrypt the data to be encrypted. Therefore, the influence of the precision value of time itself on the generation of the session key can be reduced, so as to ensure the accuracy of the session keys generated by the two parties in the session.

[0021] In an optional implementation, the generating the data message based on the encrypted data and the location information comprises:

[0022] calculating a message authentication code of the data to be encrypted according to the session key;

[0023] obtaining replay verification information based on the location information;

[0024] generating the data message based on the encrypted data, the location information, the message authentication code and the replay verification information.

[0025] In this way, the message authentication code and the replay verification information are added to the data message, so that the correctness and authenticity of the received data message can be verified by the receiving party in the session, and the replay attack of the attacker can also be effectively prevented.

[0026] In an optional implementation, the obtaining replay verification information based on the location information comprises:

[0027] determining second target time information from the plurality of time information, the second target time information being time information after the first target time information;

[0028] obtaining a value of the smallest time unit of the second target time information as a replay verification time;

[0029] judging whether the value of the replay verification time is carried over based on the location information to obtain carry-over information;

[0030] taking the replay verification time and the carry-over information as the replay verification information.

[0031] In this way, by taking the replay check time and its corresponding carry information as the replay check information, the session receiver can perform replay check based on the replay check time, while avoiding the situation that the replay check is wrong due to the carry of the value of the minimum time unit of the second target time information.

[0032] In a second aspect, the present application provides an encrypted communication method, comprising:

[0033] receiving a data packet sent by a session initiator;

[0034] extracting encrypted data and position information in the data packet;

[0035] determining target time information from a plurality of time information according to the position information, wherein the plurality of time information is generated by a target in-vehicle controller and synchronized to other in-vehicle controllers;

[0036] decrypting the encrypted data according to the target time information to obtain decrypted data.

[0037] In this way, by synchronizing the plurality of time information to other in-vehicle controllers by the target in-vehicle controller, when receiving the data packet sent by the session initiator, the target time information can be determined from the plurality of time information according to the position information in the data packet, so as to decrypt the encrypted data. Therefore, the session parties do not need to perform additional key agreement process before communication, so as to reduce the time consumption of key agreement. Meanwhile, since the plurality of time information is controlled by the target in-vehicle controller and is different from the actual time, the session parties can select the target time information from the plurality of time information for data encryption and decryption, and with the update of the time information synchronized by the target in-vehicle controller, the session parties can also select new target time information for data encryption and decryption, so as to improve the communication security of the in-vehicle controller.

[0038] In an optional implementation, the decrypting the encrypted data according to the target time information to obtain decrypted data comprises:

[0039] obtaining a preset time period and a key factor corresponding to the preset time period;

[0040] determining a target time period in which the target time information is located and a target key factor corresponding to the target time period based on the preset time period;

[0041] generating a session key based on the target key factor;

[0042] decrypting the encrypted data based on the session key to obtain the decrypted data.

[0043] In the manner, based on the target time period in which the first target time information is located, a target key factor corresponding to the target time period is obtained, and a session key is generated based on the target key factor to decrypt the encrypted data. Therefore, the influence of the precision value of the time itself on the generation of the session key can be reduced to obtain an accurate session key, and the encrypted data can be decrypted smoothly.

[0044] In an optional implementation, the decrypting the encrypted data according to the target time information to obtain decrypted data further includes:

[0045] extracting a message authentication code and replay verification information in the data packet;

[0046] calculating a message authentication code of the decrypted data according to the session key;

[0047] judging whether the message authentication code of the decrypted data is consistent with the message authentication code in the data packet;

[0048] when the message authentication code of the decrypted data is not consistent with the message authentication code in the data packet, determining that the decrypted data fails to pass the verification;

[0049] when the message authentication code of the decrypted data is consistent with the message authentication code in the data packet, performing replay verification on the decrypted data based on the replay verification information.

[0050] In the manner, after the decrypted data is obtained, a message authentication code of the decrypted data is further calculated according to the session key, so that the correctness of the decrypted data and the authenticity of the source can be verified according to the message authentication code of the decrypted data and the message authentication code in the data packet. Meanwhile, after the message authentication code passes the verification, the replay verification is performed on the decrypted data based on the replay verification information in the data packet, which can effectively prevent the replay attack of the attacker.

[0051] In an optional implementation, the replay verification information includes a replay verification time and carry information; and the performing replay verification on the decrypted data based on the replay verification information includes:

[0052] obtaining a replay verification reference;

[0053] when the replay verification time is greater than the replay verification reference, determining that the decrypted data passes the verification;

[0054] when the replay verification time is less than or equal to the replay verification reference, judging whether the value of the replay verification time is carried according to the carry information;

[0055] if the value of the replay verification time is not carried, determining that the decrypted data fails to pass the verification;

[0056] If the value of the replay check time is incremented, it is determined that the decrypted data check is passed;

[0057] After determining that the decrypted data check is passed, the replay check reference is updated to the replay check time.

[0058] In this way, when the replay check time is less than or equal to the replay check reference, it is further determined according to the increment information whether the value of the replay check time is incremented, so that the false judgment of the replay attack caused by the increment of the value of the replay check time can be avoided, and the accuracy of the replay check is ensured.

[0059] In a third aspect, the present application provides an encrypted communication device, the device comprising:

[0060] a data acquisition module configured to acquire to-be-encrypted data;

[0061] a time confirmation module configured to determine first target time information from a plurality of time information to obtain position information of the first target time information in the plurality of time information, the plurality of time information being generated by a target in-vehicle controller and synchronized to other in-vehicle controllers;

[0062] a data encryption module configured to encrypt the to-be-encrypted data based on the first target time information to obtain encrypted data;

[0063] a message sending module configured to generate a data message based on the encrypted data and the position information and send the data message to a session receiver.

[0064] In a fourth aspect, the present application provides an encrypted communication device, the device comprising:

[0065] a message receiving module configured to receive a data message sent by a session initiator;

[0066] a message analysis module configured to extract encrypted data and position information in the data message;

[0067] a time acquisition module configured to determine target time information from a plurality of time information according to the position information, the plurality of time information being generated by a target in-vehicle controller and synchronized to other in-vehicle controllers;

[0068] a data decryption module configured to decrypt the encrypted data based on the target time information to obtain decrypted data.

[0069] In a fifth aspect, the present application provides a vehicle comprising a memory and a processor, which are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the encrypted communication method described above.

[0070] In a sixth aspect, the present application provides a computer readable storage medium, which stores computer instructions for making a computer execute the encryption communication method.

[0071] The present application has the following beneficial effects:

[0072] (1) The present application controls the time information synchronized to other in-vehicle controllers by the target in-vehicle controller, and the in-vehicle controller selects the first target time information from the synchronized multiple time information for data encryption, so that the time information used for data encryption by each in-vehicle controller is different, and with the update of the time information, the in-vehicle controller can also select new first target time information for data encryption, thereby improving the communication security of the in-vehicle controller.

[0073] (2) The present application selects the first target time information from the synchronized multiple time information by the in-vehicle controller for data encryption, and sends the position information of the first target time information to the session receiver, so that the session receiver can determine the time information used for decrypting the encrypted data according to the position information, so that the two parties of the session do not need to perform additional key agreement process before communication, thereby reducing the time consumption of the key agreement.

[0074] (3) The present application obtains the target key factor based on the target time period where the first target time information is located, and generates the session key used for encrypting the data according to the target key factor, so as to reduce the influence of the precision value of the time itself on the generation of the session key, thereby ensuring the accuracy of the session key generated by the two parties of the session.

[0075] (4) The present application uses the replay check time and its corresponding carry information as the replay check information, so as to enable the session receiver to perform replay check based on the replay check time, while avoiding the occurrence of errors in the replay check due to the carry of the value of the replay check time. BRIEF DESCRIPTION OF DRAWINGS

[0076] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0077] Figure 1 is a flowchart of a first encryption communication method according to an embodiment of the present application;

[0078] Figure 2is a schematic diagram of an implementation environment of an encrypted communication method according to an embodiment of the present application;

[0079] Figure 3 is a schematic diagram of a flow of a second encrypted communication method according to an embodiment of the present application;

[0080] Figure 4 is a schematic diagram of time segmentation processing according to an embodiment of the present application;

[0081] Figure 5 is a schematic diagram of a flow of a third encrypted communication method according to an embodiment of the present application;

[0082] Figure 6 is a schematic diagram of a flow of a fourth encrypted communication method according to an embodiment of the present application;

[0083] Figure 7 is a schematic diagram of a flow of a fifth encrypted communication method according to an embodiment of the present application;

[0084] Figure 8 is a schematic diagram of secure communication processing between two parties of a session according to an embodiment of the present application;

[0085] Figure 9 is a structural block diagram of a first encrypted communication device according to an embodiment of the present application;

[0086] Figure 10 is a structural block diagram of a second encrypted communication device according to an embodiment of the present application;

[0087] Figure 11 is a structural schematic diagram of a vehicle control system according to an embodiment of the present application. DETAILED DESCRIPTION

[0088] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0089] With the increasing intelligence and networking of vehicles, the external threats faced by vehicles also increase. Private data, sensitive data and important vehicle control instructions transmitted between vehicle controllers are the key protection objects of vehicle manufacturers. It has become increasingly common to encrypt the transmission of these information. Currently, the encrypted communication between vehicle controllers usually adopts a symmetric key encryption method, that is, the communication parties negotiate a session key before communication, and then perform encrypted communication according to the session key. The ways of negotiating a session key include:

[0090] 1. When a vehicle is offline, a gateway (CGW) is activated by a diagnostic device to generate a new session key, and the communication key is filled in the vehicle controller participating in the secure communication. The diagnostic device activates the CGW to generate a random number R, and the CGW generates a session key CK using R; the diagnostic device makes the vehicle controller (ECU) enter an extended session; the CGW generates a message authentication code MAC using the generated R and a root key MK, and sends R and MAC to the ECU; the ECU receives R and MAC, and checks the MAC using MK. After the check is passed, the session key CK is generated in the same way; the ECU generates a new random number R', generates a new message authentication code MAC' using CK, and sends R' and MAC' to the CGW; the CGW checks the MAC' of R' using CK, and proves the learning success after the check is passed. The subsequent communication is processed using the CK.

[0091] 2. The session initiator and the session receiver negotiate to generate a session key for communication encryption before communication. The session initiator first generates a set of random numbers as session key components X, calculates a message authentication code MAC value using a root key, and sends the encrypted session key components X to the session receiver; the session receiver checks the received session key components X, generates a set of random numbers as session key components Y, synthesizes the session key using the received session key components X, calculates a message authentication code MAC value using the root key, and sends the encrypted session key components Y to the session initiator; the session initiator receives and checks the received session key components Y, synthesizes the session key using the session key components Y, and then sends a challenge data frame encrypted using the session key to the session receiver; the session receiver decrypts the challenge data frame successfully, and then sends a challenge data frame encrypted using the session key to the session initiator. After the session initiator decrypts the challenge data frame successfully, the key negotiation process is completed, and the subsequent communication uses the session key to calculate a data frame check value and to encrypt data.

[0092] However, the vehicle controller negotiates to generate a session key for encrypted communication, which has the following disadvantages: 1) each vehicle controller needs to negotiate a key before communication, so that each vehicle controller may need to maintain multiple session keys. After the session key for encrypted communication is negotiated, the session key usually does not change. If the negotiated session key is cracked, all subsequent communication contents between the communication parties will be cracked, and the communication security between the vehicle controllers is low. 2) The root key of the vehicle controller is generally pre-installed by the controller manufacturer, and the vehicle production line or after-sales fills in each vehicle controller, which increases the production and maintenance procedures. 3) The root key is usually a set of root keys for one vehicle model. The transmission and use process from generation to supplier, production line or after-sales needs a set of key management system for maintenance, which increases the use and maintenance cost, and has a certain risk of key leakage in the transmission and use process of the root key. Once the root key is leaked, the secure communication of the vehicle controller is lost.

[0093] In the related art, in order to solve the problem of low communication security of the in-vehicle controller negotiation to generate a session key for encrypted communication, the following two encryption methods are also proposed: 1, first synchronize the clock of the receiving and transmitting parties, then respectively request the time based on the encryption and decryption key to obtain the corresponding key number by querying the key number time interval mapping table, and expand the key number as the midpoint to obtain m continuous key numbers, so as to obtain the corresponding m keys as the encryption and decryption key at the current time. When the encryption and decryption key request time is asynchronous error is less than or equal to (m-1) times the key update period T, the receiver can correctly decrypt or authenticate the ciphertext data. Although this method does not require multiple communications between the receiving and transmitting parties, it greatly reduces the communication overhead of the system, but still requires the communication key to be pre-stored in the key storage module. 2, first select the encryption object, classify multiple electronic control units into Master and Slave; second, system initialization, Slave access Master, Master checks whether to generate key parameters; if yes, generate key parameters and store in the security storage area of Master and Slave at the same time; if not, use the original generated key parameters; then, generate the key in real time, Master and Slave generate a random number after each power-on of the vehicle, generate the key according to the key parameters and the random number; finally, data encryption, Master encrypts the communication data to be sent to Slave, and Slave encrypts the communication data to be sent to Master. Although this method has low encryption cost and does not need to establish a special server to store the key, it needs to interact and negotiate the communication key in the communication process, which increases the communication time consumption.

[0094] Therefore, in the embodiments of the present application, an encryption communication method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0095] In the present embodiment, an encryption communication method is provided, which can be used as a session initiator for an in-vehicle controller, Figure 1 is a flowchart of the encryption communication method according to the embodiments of the present application, as Figure 1 shown, the flow includes the following steps:

[0096] Step S101, obtaining data to be encrypted.

[0097] Step S102, determining a first target time information from a plurality of time information, to obtain position information of the first target time information in the plurality of time information, wherein the plurality of time information is generated by a target in-vehicle controller and synchronized to other in-vehicle controllers.

[0098] It should be noted that the implementation environment of the embodiment includes in-vehicle controllers with time synchronization and receiving functions connected through an Ethernet or a CAN network. The target in-vehicle controller (i.e., TSN Sever) synchronizes time information to other in-vehicle controllers (i.e., TSN Client), and the TSN Client synchronizes the time information to a local time and continuously maintains the local time information. Specifically, referring to FIG. 1, in-vehicle controllers ECU are connected through an Ethernet or a CAN network to form a communication network, one of the ECU controllers acts as a TSN Sever and continuously sends time information to in-vehicle controller ECUs where TSN Clients are located, the in-vehicle controller ECUs where TSN Clients are located synchronize the time information to a local time after receiving the time information, and then maintain the time information by using a local clock, so that the time between the in-vehicle controllers is consistent. Figure 2

[0099] Specifically, each in-vehicle controller periodically acquires time information from a local clock, and saves at least three consecutive time information in a time pool in chronological order, and determines a first target time information from the time pool.

[0100] For example, each in-vehicle controller cyclically acquires time information synchronized to a local time by a target in-vehicle controller in a fixed time interval, for example, acquires time from the local once every 10 ms. The representation of the time information includes but is not limited to year (2 bytes) + month (1 byte) + day (1 byte) + hour (1 byte) + minutes (1 byte) + seconds (1 byte) + milliseconds (2 bytes), and at least three consecutive time information acquired is saved to the time pool.

[0101] Step S103, encrypting the to-be-encrypted data based on the first target time information, to obtain encrypted data.

[0102] Step S104, generating a data packet based on the encrypted data and the position information, and sending to a session receiver.

[0103] ​The encryption communication method provided by the embodiment synchronizes multiple time information to other in-vehicle controllers by a target in-vehicle controller, each in-vehicle controller selects first target time information from the multiple time information to encrypt the data to be encrypted, and sends the encrypted data and the position information of the first target time information to the session receiver, so that the session receiver can determine the time information used to decrypt the encrypted data according to the position information. Therefore, the two parties of the session do not need to perform an additional key negotiation process before communication, so as to reduce the time consumption of key negotiation. Meanwhile, since the multiple time information is controlled by the target in-vehicle controller, which is different from the actual time, different in-vehicle controllers can select appropriate first target time information from the multiple time information for data encryption, and can also select new first target time information to encrypt data along with the update of the time information synchronized by the target in-vehicle controller, so as to improve the communication security of the in-vehicle controller.

[0104] It can be understood that, compared with the related art of encryption communication of the in-vehicle controller, the embodiment of the application has the following advantages: first, the synchronized time information is controlled by the target in-vehicle controller, i.e., the TSN Sever, which is different from the actual time, so that the initial time information of each in-vehicle controller is different, the generated session key is different, and a new session key is generated for encryption in each session communication period, the key change frequency is faster, and the communication security is higher. Second, the generation and synchronization of the session key are controlled by the in-vehicle controller itself, and an additional key negotiation process is not needed before communication, so as to reduce the negotiation time consumption before communication. Third, no root key is needed, and the root key management and key preloading process is omitted in the production and installation process of the supplier or production line and after-sales, so as to improve the production efficiency and save the production cost.

[0105] Figure 3 The second encryption communication method according to the embodiment of the application is shown in a flowchart as Figure 3 shown in the following steps:

[0106] In step S201, the data to be encrypted is obtained. For details, please refer to step S101 of the above embodiment, which will not be repeated here.

[0107] In step S202, the first target time information is determined from the multiple time information, and the position information of the first target time information in the multiple time information is obtained, wherein the multiple time information is generated by a target in-vehicle controller and synchronized to other in-vehicle controllers. For details, please refer to step S102 of the above embodiment, which will not be repeated here.

[0108] In step S203, the data to be encrypted is encrypted based on the first target time information, and encrypted data is obtained. For details, please refer to step S103 of the above embodiment, which will not be repeated here.

[0109] Step S204, generating a data message based on the encrypted data and the position information, and sending to the session receiver. For details, please refer to step S104 of the above embodiment, which will not be repeated here.

[0110] As one of the specific embodiments, the above step S202 includes:

[0111] Step S2021, determining a first target time information from the plurality of time information, the first target time information being a time information other than the latest time information.

[0112] It is worth noting that when the controller as the session initiator needs to perform encrypted communication, assuming that the fixed time interval is T, the time difference between the latest time information in the time pool of the session initiator and the session receiver is T, so when the time information in the time pool of the session initiator is the latest time information Tn, the second latest time information Tp and the third latest time information Tr, the session receiver must obtain the time information between Tn and Tr when the data message reaches the session receiver. Therefore, using the time information other than the latest time information as the first target time information can ensure that both parties can generate the same session key. For example, using the second latest time information Tp as the first target time information. Of course, in the case where the amount of data stored in the time pool is sufficient, the third latest time information or the fourth latest time information can also be selected as the first target time information, and the selection of the first target time information is not limited here.

[0113] Step S2022, obtaining the value of the smallest time unit in the first target time information as the position information of the first target time information in the plurality of time information.

[0114] For example, the representation of the time information is: year(2 byte)+mouth(1 byte)+day(1 byte)+hour(1 byte)+minutes(1 byte)+seconds(1 byte)+milliseconds(2 byte), and the smallest time unit is millisecond, and the number of milliseconds is taken as the position information of the first target time information in the plurality of time information.

[0115] The encryption communication method provided by the embodiment can avoid the situation that the session receiver cannot successfully decrypt the encrypted data due to the inconsistency of the latest time information of the communication parties caused by the time delay. Moreover, since the multiple time information of different vehicle controllers is not necessarily synchronized due to the different transmission delays, the storage positions of the same time information in the multiple time information of each vehicle controller can be different. Based on this, by taking the value of the smallest time unit in the first target time information as the position information of the first target time information in the multiple time information, the session receiver can accurately find the time information for decryption.

[0116] Specifically, the above step S203 includes:

[0117] In step S2031, a preset time period and a key factor corresponding to the preset time period are obtained.

[0118] In step S2032, a target time period in which the first target time information is located is determined based on the preset time period, and a target key factor corresponding to the target time period is determined.

[0119] It should be noted that since the time itself has a certain precision value, i.e., there is a certain time error, in order to ensure the accuracy of the finally generated session key and ensure that the session keys generated by the session parties based on the same time information are the same, the first target time information needs to be further processed into a preset target key factor according to the target time period in which the first target time information is located. Specifically, referring to Figure 4 The time intervals corresponding to each preset time period are the same, as shown in Figure 4 If the first target time information is greater than or equal to t0 and less than t1, the first target time information is processed into T0; if the first target time information is greater than or equal to t1 and less than t2, the first target time information is processed into T1; if the first target time information is greater than or equal to t2 and less than t3, the first target time information is processed into T2, and the interval of each preset time period is T, so T2-T1=T and T1-T0=T. Therefore, when the vehicle controller ECU as the session initiator uses the second-to-last time information Tp to process T1 as the target key factor for generating the session key, the session parties can generate the same session key.

[0120] In step S2033, a session key is generated based on the target key factor.

[0121] Specifically, the above step S2033 includes:

[0122] The target key factor is subjected to a hash operation to obtain the session key.

[0123] It should be noted that, in addition to being able to perform a hash operation on the target key factor to obtain a session key, the target key factor can also be processed by other key generation algorithms to obtain a session key, and the generation manner of the session key is not limited herein.

[0124] In step S2034, the to-be-encrypted data is encrypted based on the session key to obtain the encrypted data.

[0125] The encryption communication method provided in this embodiment obtains a target key factor corresponding to the target time period in which the first target time information is located, and generates a session key based on the target key factor to encrypt the to-be-encrypted data. Therefore, the influence of the precision value of time itself on the generation of the session key can be reduced, so as to ensure the accuracy of the session keys generated by both parties of the session.

[0126] In some optional embodiments, the above step S204 includes:

[0127] In step S2041, a message authentication code of the to-be-encrypted data is calculated according to the session key.

[0128] It should be noted that the message authentication code herein is a MAC value, and the specific calculation manner can refer to other related technologies, which will not be described in detail herein.

[0129] In step S2042, replay verification information is obtained based on the location information.

[0130] In step S2043, the data packet is generated based on the encrypted data, the location information, the message authentication code, and the replay verification information.

[0131] Specifically, the format of the data packet is: Sync code (3 bytes) + Payload (N bytes) + MAC (N bytes). The location information and the replay verification information are used as a synchronization header Sync code using a 3-byte data segment, the synchronization header is followed by an N-byte payload (i.e., encrypted data), and the payload is followed by an N-byte length message authentication code MAC. It should be noted that in actual operation, the byte lengths of the synchronization header, the payload, and the message authentication code can be adjusted according to actual conditions.

[0132] The encryption communication method provided in this embodiment adds the message authentication code and the replay verification information in the data packet, so that the correctness and authenticity of the received data packet can be verified by the session receiving party, and the replay attack of the attacker can also be effectively prevented.

[0133] As one of the optional embodiments, the step S2042 comprises:

[0134] determining second target time information from the plurality of time information, the second target time information being time information after the first target time information;

[0135] obtaining a value of a minimum time unit of the second target time information as a replay check time;

[0136] judging whether the value of the replay check time occurs a carry based on the position information to obtain carry information;

[0137] sending the replay check time and the carry information as replay check information.

[0138] It can be understood that if the minimum time unit of the second target time information is millisecond, the replay check time is the millisecond number of the second target time information. Since in the process of an actual session, a period of time can be interval between sending a last frame of data packet and sending a current frame of data packet. Therefore, the millisecond number can occur a carry, for example, 3 seconds 500 milliseconds changes to 4 seconds 10 milliseconds, at this time, if only the replay check time 10 milliseconds is sent to the session receiver, then the session receiver can only judge that the current frame of data packet is replay according to the replay check time 500 milliseconds of the last frame and the replay check time 10 milliseconds of the current frame. Therefore, in the embodiment, the carry information corresponding to the replay check time needs to be further sent to the session receiver to avoid replay check error.

[0139] Optionally, the second target time information is the latest time information or time information adjacent to the first target time information.

[0140] As an example, if the minimum time unit of the first target time information and the second target time information is millisecond, the session initiator composes a data packet according to a protocol, first calculates a message authentication code of encrypted data using a session key, adds the message authentication code to the encrypted data, then adds the millisecond number in the first target time information, the millisecond number in the second target time information and the carry information as a synchronization header to the encrypted data. The carry information is obtained by calculating whether the second target time information occurs a carry, when the millisecond number carries to seconds, the millisecond number is reset to zero, the carry information is set to 1, and when the millisecond number is normally increased, the carry information is set to 0.

[0141] The encryption communication method provided by the embodiment can make the session receiver perform replay check based on the replay check time, and avoid the replay check error caused by the value of the minimum time unit of the second target time information occurs a carry.

[0142] As another alternative implementation, the step S2042 comprises:

[0143] taking the value of the position information as a replay check time;

[0144] taking the value of a target time unit in the first target time information as a carry information, the target time unit being a time unit of a level larger than the minimum time unit;

[0145] taking the replay check time and the carry information as replay check information.

[0146] For example, assuming that the minimum time unit in the first target time information is millisecond, the target time unit is second. As known from the above, the position information is the value of the minimum time unit of the first target time information, i.e. the millisecond number of the first target time information. Therefore, when receiving the current frame data packet, the session receiver can compare the replay check time of the current frame (e.g. 100 ms) with the replay check time of the previous frame (e.g. 120 ms), and since 100 ms < 120 ms, it is necessary to further determine whether the value of the replay check time of the current frame has carried over by means of the carry information (i.e. the second number), so as to determine whether the data packet of the current frame is a replayed data packet. For example, the carry information of the current frame is 5 s, and the carry information of the previous frame is 3 s, which indicates that the replay check time of the current frame is less than the replay check time of the previous frame due to the millisecond number having carried over and reset, and the replay check is passed. Therefore, the carry information and the replay check time of the current frame, i.e. the second number and the millisecond number, can be taken as the replay check reference of the data packet of the next frame.

[0147] In the embodiment, another encryption communication method is also provided, which can be used as the in-vehicle controller of the session receiver, Figure 5 is a flowchart of a third encryption communication method according to an embodiment of the present application, as shown in Figure 5 which comprises the following steps:

[0148] Step S301, receiving the data packet sent by the session initiator.

[0149] Step S302, extracting the encrypted data and the position information in the data packet.

[0150] Step S303, determining the target time information from a plurality of time information according to the position information, the plurality of time information being generated by the target in-vehicle controller and synchronized to other in-vehicle controllers.

[0151] Specifically, the target in-vehicle controller synchronizes time information to other in-vehicle controllers, each in-vehicle controller synchronizes the time information to local time and continuously maintains the local time information. Each in-vehicle controller periodically acquires the time information synchronized by the target in-vehicle controller, and stores the acquired multiple time information in a corresponding time pool in chronological order. The in-vehicle controller as a session receiver can query the target time information used for this communication from the time pool through the position information in the data message after receiving the data message sent by the session initiator, so as to decrypt the encrypted data.

[0152] Step S304, decrypting the encrypted data according to the target time information to obtain decrypted data.

[0153] The encryption communication method provided by the embodiment can determine the target time information from the multiple time information according to the position information in the data message when receiving the data message sent by the session initiator, so as to decrypt the encrypted data. Therefore, the session parties do not need to perform an additional key negotiation process before communication, so as to reduce the time consumption of key negotiation. Meanwhile, since the multiple time information is controlled by the target in-vehicle controller and is different from the actual time, the session parties can select the target time information from the multiple time information for data encryption and decryption, and can also select new target time information for data encryption and decryption along with the update of the time information synchronized by the target in-vehicle controller, so as to improve the communication security of the in-vehicle controller.

[0154] Figure 6 is a flowchart of a fourth encryption communication method according to an embodiment of the present application, as shown in the figure, the flow includes the following steps: Figure 6

[0155] Step S401, receiving a data message sent by a session initiator. For details, see step S301 of the above embodiment, which will not be repeated here.

[0156] Step S402, extracting encrypted data and position information in the data message. For details, see step S302 of the above embodiment, which will not be repeated here.

[0157] Step S403, determining target time information from multiple time information according to the position information, the multiple time information is generated by a target in-vehicle controller and synchronized to other in-vehicle controllers. For details, see step S303 of the above embodiment, which will not be repeated here.

[0158] ​Step S404, decrypting the encrypted data according to the target time information to obtain decrypted data. For details, please refer to step S304 of the above embodiment, which will not be described here.

[0159] Specifically, the above step S404 includes:

[0160] Step S4041, obtaining a preset time period and a key factor corresponding to the preset time period.

[0161] Step S4042, determining a target time period in which the target time information is located based on the preset time period, and a target key factor corresponding to the target time period.

[0162] Specifically, after the session receiver receives the data packet, the session receiver first extracts the position information in the synchronization header according to the protocol, determines the target time information between the two time information in the time pool according to the millisecond in the synchronization header, and then obtains the target key factor used by the session initiator for encryption according to the target time period in which the target time information is located, so as to obtain the session key according to the target key factor, and decrypt the encrypted data.

[0163] Step S4043, generating a session key based on the target key factor.

[0164] Specifically, the above step S4043 includes:

[0165] Hashing the target key factor to obtain a session key.

[0166] Step S4044, decrypting the encrypted data based on the session key to obtain the decrypted data.

[0167] The encryption communication method provided in the embodiment obtains the target key factor corresponding to the target time period in which the first target time information is located, generates a session key based on the target key factor, and decrypts the encrypted data. Therefore, the influence of the precision value of time itself on the generation of the session key can be reduced, so as to obtain an accurate session key and ensure the smooth decryption of the encrypted data.

[0168] Further, the above step S404 further includes:

[0169] Step S4045, extracting the message authentication code and the replay verification information in the data packet;

[0170] Step S4046, calculating the message authentication code of the decrypted data according to the session key;

[0171] Step S4047, determining whether the message authentication code of the data packet and the decrypted data is consistent;

[0172] Step S4048, when the data message is inconsistent with the message authentication code of the decrypted data, determining that the decrypted data fails the check.

[0173] Step S4049, when the data message is consistent with the message authentication code of the decrypted data, performing a replay check on the decrypted data based on the replay check information.

[0174] The encryption communication method provided in this embodiment, after obtaining the decrypted data, further calculates the message authentication code of the decrypted data according to the session key, so that the correctness of the decrypted data and the authenticity of the source can be checked according to the message authentication code of the decrypted data and the message authentication code in the data message. Meanwhile, after the message authentication code check passes, the replay check on the decrypted data is performed based on the replay check information in the data message, which can effectively prevent the replay attack of the attacker.

[0175] Further, the replay check information includes a replay check time and carry information; the replay check on the decrypted data based on the replay check information in the step S4049 includes:

[0176] Step S4049a, obtaining a replay check reference.

[0177] Step S4049b, when the replay check time is greater than the replay check reference, determining that the decrypted data passes the check.

[0178] Step S4049c, when the replay check time is less than or equal to the replay check reference, determining whether the value of the replay check time is carried according to the carry information.

[0179] Step S4049d, if the value of the replay check time is not carried, determining that the decrypted data fails the check.

[0180] Step S4049e, if the value of the replay check time is carried, determining that the decrypted data passes the check.

[0181] Step S4049f, after determining that the decrypted data passes the check, updating the replay check reference as the replay check time.

[0182] It can be understood that, the value of the replay check time does not carry over when the carry information is 0, and the value of the replay check time carries over when the carry information is 1, and the replay check reference is the replay check time of the previous frame of data message, when the replay check time of the current frame received is less than or equal to the replay check time of the previous frame, it is indicated that the data message of the current frame can be replayed or can be caused by the value of the replay check time being reset due to carry over, therefore, when the replay check time of the current frame is less than or equal to the replay check time of the previous frame, it is necessary to further judge, according to the carry information, whether the replay check time has carried over compared with the previous frame, if the carry information is 0, it is judged as replayed, and if the carry information is 1, it is judged as the replay check time has carried over and overflowed, and the replay check is passed.

[0183] The encryption communication method provided in the embodiment can further judge, according to the carry information, whether the value of the replay check time has carried over when the replay check time is less than or equal to the replay check reference, so that the replay attack misjudgment caused by the value of the replay check time carrying over can be avoided, and the accuracy of the replay check can be ensured.

[0184] Exemplarily, refer to Figure 7 and Figure 8 , the encryption communication method of the application is described in a specific implementation manner as follows:

[0185] In step S501, the target vehicle controller synchronizes time information to other vehicle controllers, and the other vehicle controllers synchronize the time information to local time and continuously maintain the local time information.

[0186] In step S502, each vehicle controller periodically acquires local time information, and saves time information of at least three times continuously in a time pool.

[0187] In step S503, when an encryption communication session is initiated, a session initiator takes out the second last time information in the time pool to process to obtain a key factor, and performs a hash operation on the key factor to calculate a session key used in the current communication.

[0188] In step S504, the session initiator uses the session key to calculate a message authentication code (MAC) of encrypted data and encrypts the encrypted data, adds the message authentication code to the encrypted data, adds the millisecond number of the second last time information, the millisecond number of the latest time information and carry information as a synchronization header to the encrypted data to generate a data message, wherein the carry information is obtained by calculating whether the millisecond number of the latest time information carries over, and the carry information is set to 1 when the millisecond number carries over to seconds and the millisecond number is reset to zero, and the carry information is set to 0 when the millisecond number normally increases.

[0189] In step S505, the session receiver obtains the target time information from the time pool according to the millisecond of the second last time information in the received data packet, obtains the key factor based on the target time information, and performs the hash operation using the key factor to obtain the session key for decryption.

[0190] In step S506, the session receiver decrypts the encrypted data using the session key, calculates the message authentication code of the decrypted data using the session key, and verifies the integrity and authenticity of the decrypted data according to the message authentication code in the data packet and the message authentication code of the decrypted data, and performs the anti-replay judgment according to the millisecond of the latest time information in the data packet and the carry information.

[0191] In the embodiment, an encryption communication device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and the details of which have been described above. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware is also possible and contemplated.

[0192] The embodiment provides an encryption communication device, as shown in the accompanying drawings, comprising: Figure 9

[0193] The data acquisition module 601 is configured to acquire the data to be encrypted.

[0194] The time confirmation module 602 is configured to determine the first target time information from the plurality of time information, and obtain the position information of the first target time information in the plurality of time information, wherein the plurality of time information is generated by a target in-vehicle controller and synchronized to other in-vehicle controllers.

[0195] The data encryption module 603 is configured to encrypt the data to be encrypted based on the first target time information to obtain encrypted data.

[0196] The packet sending module 604 is configured to generate a data packet based on the encrypted data and the position information, and send the data packet to a session receiver.

[0197] In some optional embodiments, the time confirmation module 602 comprises:

[0198] The time selection unit is configured to determine the first target time information from the plurality of time information, wherein the first target time information is time information other than the latest time information.

[0199] The position confirmation unit is configured to obtain the value of the smallest time unit in the first target time information as the position information of the first target time information in the plurality of time information. ​

[0200] In some optional embodiments, the data encryption module 603 comprises:

[0201] a key factor obtaining unit, configured to obtain a preset time period and a key factor corresponding to the preset time period;

[0202] a key factor confirming unit, configured to determine a target time period in which the first target time information is located based on the preset time period, and a target key factor corresponding to the target time period;

[0203] a session key generating unit, configured to generate a session key based on the target key factor;

[0204] a session data encryption unit, configured to encrypt the data to be encrypted based on the session key to obtain the encrypted data.

[0205] In some optional embodiments, the message sending module 604 comprises:

[0206] an authentication code generating unit, configured to calculate a message authentication code of the data to be encrypted according to the session key;

[0207] a replay information generating unit, configured to obtain replay check information based on the position information;

[0208] a data message generating unit, configured to generate the data message based on the encrypted data, the position information, the message authentication code and the replay check information.

[0209] Further, the replay information generating unit comprises:

[0210] a check time selecting subunit, configured to determine second target time information from the plurality of time information, the second target time information being time information after the first target time information;

[0211] a check time confirming subunit, configured to obtain a value of a smallest time unit of the second target time information as a replay check time;

[0212] a carry information generating subunit, configured to determine whether the value of the replay check time is carried based on the position information to obtain carry information;

[0213] a replay information generating subunit, configured to take the replay check time and the carry information as replay check information.

[0214] Further function descriptions of the above-mentioned various modules and units are the same as those of the above-mentioned corresponding embodiments, which will not be described here.

[0215] The encryption communication apparatus in the embodiment is presented in the form of functional units, where the units refer to ASIC (Application Specific Integrated Circuit) circuits, processors and memories executing one or more software or fixed programs, and / or other devices that can provide the above functions.

[0216] Another encryption communication apparatus is also provided in the embodiment, which is used to implement the above embodiments and preferred embodiments, and will not be described again. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, implementation of hardware, or a combination of software and hardware, is also possible and contemplated.

[0217] The embodiment provides an encryption communication apparatus, as shown in the accompanying drawings, comprising: Figure 10

[0218] A message receiving module 701 is configured to receive a data message sent by a session initiator;

[0219] A message analysis module 702 is configured to extract encrypted data and location information from the data message;

[0220] A time obtaining module 703 is configured to determine target time information from a plurality of time information according to the location information, where the plurality of time information is generated by a target in-vehicle controller and synchronized to other in-vehicle controllers;

[0221] A data decryption module 704 is configured to decrypt the encrypted data according to the target time information to obtain decrypted data.

[0222] In some optional embodiments, the data decryption module 704 comprises:

[0223] A key factor obtaining unit is configured to obtain a preset time period and a key factor corresponding to the preset time period;

[0224] A key factor confirming unit is configured to determine a target time period in which the target time information is located and a target key factor corresponding to the target time period based on the preset time period;

[0225] A session key generating unit is configured to generate a session key based on the target key factor;

[0226] A session data decryption unit is configured to decrypt the encrypted data based on the session key to obtain the decrypted data.

[0227] In some optional embodiments, the data decryption module 704 further comprises:​

[0228] a check information extraction unit configured to extract message authentication code and replay check information in the data packet;

[0229] an authentication code generation unit configured to calculate message authentication code of the decrypted data according to the session key;

[0230] an authentication code check unit configured to determine whether the message authentication code of the decrypted data is consistent with the data packet;

[0231] a check alarm unit configured to determine that the decrypted data fails to pass the check when the message authentication code of the decrypted data is inconsistent with the data packet;

[0232] a replay check unit configured to perform replay check on the decrypted data based on the replay check information when the message authentication code of the decrypted data is consistent with the data packet.

[0233] In some optional embodiments, the replay check unit comprises:

[0234] a reference obtaining sub-unit configured to obtain a replay check reference;

[0235] a check pass sub-unit configured to determine that the decrypted data passes the check when the replay check time is greater than the replay check reference;

[0236] a carry judgment sub-unit configured to determine whether the value of the replay check time is carried when the replay check time is less than or equal to the replay check reference according to the carry information;

[0237] a check error sub-unit configured to determine that the decrypted data fails to pass the check if the value of the replay check time is not carried;

[0238] a check pass sub-unit configured to determine that the decrypted data passes the check if the value of the replay check time is carried;

[0239] a reference updating sub-unit configured to update the replay check reference to the replay check time after determining that the decrypted data passes the check.

[0240] Further function descriptions of the above-mentioned modules and units are the same as those of the corresponding embodiments, which will not be repeated here.

[0241] In this embodiment, the encrypted communication device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0242] This invention also provides a vehicle having the above-described features. Figure 9 or Figure 10 The encrypted communication device shown.

[0243] Please see Figure 11 , Figure 11 This is a schematic diagram of the structure of a vehicle control system provided in an optional embodiment of the present invention, such as... Figure 11 As shown, the vehicle includes one or more processors 10, memory 20, and interfaces for connecting the various components, including high-speed interfaces and low-speed interfaces. The various components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the vehicle, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple vehicles can be connected, with each device providing some of the necessary operations (e.g., as a server array, a set of blade servers, or a multiprocessor system). Figure 11 Take a processor 10 as an example.

[0244] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0245] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0246] The memory 20 can include a program storage area that can store an operating system and application programs required for at least one function, and a data storage area that can store data created according to use of the vehicle, etc. In addition, the memory 20 can include a high-speed random access memory, and can also include a non-transitory memory such as at least one of a magnetic disk storage device, a flash memory device, or other non-transitory solid state memory device. In some alternative embodiments, the memory 20 can optionally include memory that is remotely located with respect to the processor 10, and these remotely located memories can be connected to the vehicle through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communications network, and combinations thereof.

[0247] The memory 20 can include a volatile memory such as a random access memory, and can also include a non-volatile memory such as a flash memory, a hard disk, or a solid state disk. The memory 20 can also include a combination of the above-mentioned types of memory.

[0248] The vehicle also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30, and the output device 40 can be connected by a bus or other means, Figure 11 The connection by the bus is used as an example.

[0249] The input device 30 can receive inputted numerical or character information, and can also generate key signal inputs related to user settings and function controls of the vehicle, such as a touch screen, a keypad, a mouse, a trackpad, a touchpad, a pointing stick, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 can include a display device, an auxiliary lighting device (e.g., an LED), a haptic feedback device (e.g., a vibration motor), etc. The display device includes, but is not limited to, a liquid crystal display, a light emitting diode, a display, and a plasma display. In some alternative embodiments, the display device can be a touch screen.

[0250] The embodiments of the present application further provide a computer readable storage medium, and the method according to the embodiments of the present application can be implemented in hardware, firmware, or recorded in a storage medium, or be implemented as computer codes stored in a remote storage medium or a non-transitory machine readable storage medium and downloaded through a network and stored in a local storage medium, so that the method described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor, or programmable or special hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid state disk, etc. Further, the storage medium can also include a combination of the above-mentioned types of memories. It can be understood that the computer, the processor, the microprocessor controller, or the programmable hardware includes a storage component that can store or receive software or computer codes, when the software or computer codes are accessed and executed by the computer, the processor, or the hardware, the method shown in the above embodiments is implemented.

[0251] Although the embodiments of the present application are described in conjunction with the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. A method of encrypting communications, characterized by, The method comprises: obtaining to-be-encrypted data; determining first target time information from a plurality of time information to obtain position information of the first target time information in the plurality of time information, the plurality of time information being generated by a target in-vehicle controller and synchronized to other in-vehicle controllers; obtaining a preset time period and a key factor corresponding to the preset time period; determining a target time period in which the first target time information is located and a target key factor corresponding to the target time period based on the preset time period; generating a session key based on the target key factor; encrypting the to-be-encrypted data based on the session key to obtain encrypted data; calculating a message authentication code of the to-be-encrypted data according to the session key; obtaining replay verification information based on the position information; generating a data packet based on the encrypted data, the position information, the message authentication code and the replay verification information.

2. The method of claim 1, wherein, The method comprises: determining the first target time information from the plurality of time information, the first target time information being time information other than the latest time information; obtaining a value of a minimum time unit in the first target time information as the position information of the first target time information in the plurality of time information.

3. The method of claim 2, wherein, The method comprises: determining second target time information from the plurality of time information, the second target time information being time information after the first target time information; obtaining a value of a minimum time unit of the second target time information as a replay verification time; judging whether the value of the replay verification time is incremented based on the position information to obtain increment information; taking the replay verification time and the increment information as the replay verification information.

4. A method of encrypting communications, characterized by, The method comprises: receiving a data packet sent by a session initiator; extracting encrypted data and position information in the data packet; determining target time information from a plurality of time information according to the position information, the plurality of time information being generated by a target in-vehicle controller and synchronized to other in-vehicle controllers; obtaining a preset time period and a key factor corresponding to the preset time period; determining a target time period in which the target time information is located and a target key factor corresponding to the target time period based on the preset time period; generating a session key based on the target key factor; decrypting the encrypted data based on the session key to obtain decrypted data; extracting a message authentication code and replay verification information in the data packet; calculating a message authentication code of the decrypted data according to the session key; judging whether the data packet and the message authentication code of the decrypted data are consistent; when the data packet and the message authentication code of the decrypted data are inconsistent, determining that the decrypted data fails to pass verification; when the data packet and the message authentication code of the decrypted data are consistent, performing replay verification on the decrypted data based on the replay verification information.

5. The method of claim 4, wherein, The replay check information comprises a replay check time and carry information; The replay check on the decrypted data based on the replay check information comprises: obtaining a replay check reference; when the replay check time is greater than the replay check reference, determining that the decrypted data passes the check; when the replay check time is less than or equal to the replay check reference, determining whether the value of the replay check time is carried based on the carry information; if the value of the replay check time is not carried, determining that the decrypted data fails the check; if the value of the replay check time is carried, determining that the decrypted data passes the check; after determining that the decrypted data passes the check, updating the replay check reference to the replay check time.

6. An encryption communication apparatus characterized by comprising: The device comprises: a data acquisition module for acquiring data to be encrypted; a time confirmation module for determining first target time information from a plurality of time information to obtain position information of the first target time information in the plurality of time information, the plurality of time information being generated by a target in-vehicle controller and synchronized to other in-vehicle controllers; a data encryption module for encrypting the data to be encrypted based on the first target time information to obtain encrypted data; a message sending module for generating a data message based on the encrypted data and the position information and sending to a session receiver; the data encryption module comprises: a key factor acquisition unit for acquiring a preset time period and a key factor corresponding to the preset time period; a key factor confirmation unit for determining a target time period in which the first target time information is located based on the preset time period and a target key factor corresponding to the target time period; a session key generation unit for generating a session key based on the target key factor; a session data encryption unit for encrypting the data to be encrypted based on the session key to obtain the encrypted data; the message sending module comprises: an authentication code generation unit for calculating a message authentication code of the data to be encrypted according to the session key; a replay information generation unit for obtaining replay check information based on the position information; a data message generation unit for generating the data message based on the encrypted data, the position information, the message authentication code, and the replay check information.

7. An encryption communication apparatus characterized by comprising: The device comprises: a message receiving module for receiving a data message sent by a session initiator; a message analysis module for extracting encrypted data and position information in the data message; a time acquisition module for determining target time information from a plurality of time information according to the position information, the plurality of time information being generated by a target in-vehicle controller and synchronized to other in-vehicle controllers; a data decryption module for decrypting the encrypted data according to the target time information to obtain decrypted data; the data decryption module comprises: a key factor acquisition unit for acquiring a preset time period and a key factor corresponding to the preset time period; A key factor confirmation unit is configured to determine a target time period in which the target time information is located based on the preset time period, and a target key factor corresponding to the target time period; A session key generation unit is configured to generate a session key based on the target key factor; A session data decryption unit is configured to decrypt the encrypted data based on the session key to obtain the decrypted data; The data decryption module further includes: A check information extraction unit is configured to extract a message authentication code and replay check information in the data packet; An authentication code generation unit is configured to calculate a message authentication code of the decrypted data according to the session key; An authentication code check unit is configured to determine whether the message authentication code of the data packet is consistent with the message authentication code of the decrypted data; A check alarm unit is configured to determine that the decrypted data fails to pass the check when the message authentication code of the data packet is inconsistent with the message authentication code of the decrypted data; A replay check unit is configured to perform replay check on the decrypted data based on the replay check information when the message authentication code of the data packet is consistent with the message authentication code of the decrypted data.

8. A vehicle characterized by comprising: The encryption communication method includes: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the encryption communication method in any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are used to make the computer execute the encryption communication method in any one of claims 1 to 5.

Images