Secure time synchronization method and system based on HSM

Abstract

The present invention discloses a secure time synchronization method and system based on HSM, including GM node and Slave node, GM node and Slave node including HSM hardware security module, OS layer, gPTP protocol stack, MAC layer; HSM hardware security module provides certificate management and message authentication encryption interface of gPTP message, gPTP protocol stack accesses certificate management and message authentication encryption interface service of HSM hardware security module and gPTP service of MAC layer through OS layer, thereby completing secure time synchronization. The present invention completes time synchronization under the premise of ensuring the security of vehicle-mounted network through HSM hardware security module, can effectively identify and prevent intruder's replay attack, Dos, spoofing attack, protocol vulnerability attack, man-in-the-middle attack and other behaviors, and improves the security and stability of vehicle network.

Description

Technical Field

[0001] The present invention relates to time synchronization technology, and in particular to a secure time synchronization method and system based on HSM. Background Art

[0002] The Generalized Precision Time Protocol (gPTP) is defined by the IEEE Std 802.1 AS standard, and its purpose is to ensure that all nodes in the local area network have the same time, that is, time synchronization. Replay attacks, DoS, spoofing attacks, protocol vulnerability attacks, and man-in-the-middle attacks that exist in traditional networks also exist in the vehicle-mounted gPTP network. The communication environment of the vehicle-mounted network has extremely high requirements for security and reliability, and the gPTP service is an indispensable part of the vehicle-mounted network. Therefore, the network security risks faced when using the gPTP protocol need to be urgently addressed. Summary of the invention

[0003] In order to solve the deficiencies in the prior art, the purpose of the present invention is to provide a secure time synchronization method and system based on HSM, which completes time synchronization under the premise of ensuring the security of the vehicle network through the HSM hardware security module, and can effectively identify and prevent intruders' replay attacks, Dos, spoofing attacks, protocol vulnerability attacks, man-in-the-middle attacks and other behaviors, thereby improving the security and stability of the vehicle's network.

[0004] To achieve the purpose of the present invention, the technical solution adopted by the present invention is:

[0005] A secure time synchronization system based on HSM, including a GM node and a Slave node, the GM node sends a time synchronization message, and the Slave node receives the time synchronization message;

[0006] Both the GM node and the Slave node include the HSM hardware security module, OS layer, gPTP protocol stack, and MAC layer; the HSM hardware security module provides certificate management and message authentication and encryption interface for gPTP messages. The gPTP protocol stack accesses the certificate management and message authentication and encryption interface services of the HSM hardware security module and the gPTP service of the MAC layer through the OS layer to complete secure time synchronization.

[0007] Furthermore, when the vehicle is produced, the HSM certificate of the HSM hardware security module is uniformly imported by the production line tool.

[0008] Furthermore, the HSM hardware security modules of the GM node and the Slave node in the vehicle system import the same HSM certificate.

[0009] A secure time synchronization method based on HSM, comprising the steps of:

[0010] (1) When the GM node sends a gPTP message, it authenticates the gPTP message by calling the message authentication and encryption interface service of the HSM hardware security module, and sends the gPTP time synchronization message together with the message authentication result M to the Slave node in the gPTP network in the vehicle;

[0011] (2) After receiving the gPTP message, the Slave node extracts the gPTP message and the corresponding message authentication result respectively, and authenticates the gPTP message by calling the message authentication encryption interface service of the HSM hardware security module to obtain the message authentication result M1; the locally calculated gPTP message authentication result M1 is compared with the message authentication result M extracted from the received gPTP message. If the two message authentication results are consistent, time synchronization is performed.

[0012] Furthermore, step (1) specifically includes:

[0013] (1.1) Start the gPTP time synchronization program, check the HSM status and whether the certificate is valid. If invalid, record the invalid status and stop time synchronization;

[0014] (1.2) If valid, continue with time synchronization; first, encapsulate the gPTP synchronization message;

[0015] (1.3) Then, the message authentication and encryption interface service of the HSM hardware security module is called to authenticate the gPTP message and generate a message authentication result M;

[0016] (1.4) Fill the message authentication result M into the extension field of the gPTP synchronization message;

[0017] (1.5) Finally, a gPTP sync message is sent that fills in the message authentication result.

[0018] Furthermore, step (2) specifically includes:

[0019] (2.1) Start the gPTP time synchronization program, check the HSM status and whether the certificate is valid. If invalid, record the invalid status and stop time synchronization;

[0020] (2.2) If valid, continue time synchronization and receive gPTP synchronization messages;

[0021] (2.3) Call the message authentication and encryption interface service of the HSM hardware security module to authenticate the gPTP message and obtain the message authentication result M1;

[0022] (2.4) Compare the locally calculated gPTP message authentication result M1 with the message authentication result M extracted from the received gPTP message; if the two message authentication results are inconsistent, it indicates that the message is an attack message or an HSM error, and the failure status is recorded and time synchronization is stopped;

[0023] (2.5) If the two message authentication results are consistent, time synchronization is performed.

[0024] Furthermore, in step (2.3), the certificate used by the Slave node for message authentication is the same as the certificate used by the GM node for message authentication.

[0025] The beneficial effect of the present invention is that, compared with the prior art, the message authentication algorithm of the present invention uses a dedicated HSM module to ensure the integrity and authenticity of the gPTP message, preventing the possibility of the message being tampered with or coming from a malicious gPTP node; there is no need to add new applications, and the existing gPTP protocol stack can be quickly adapted.

[0026] Under the premise of ensuring time synchronization, the verification of time synchronization messages is completed through the message authentication mechanism, which can effectively prevent replay attacks, DoS, spoofing attacks, protocol vulnerability attacks, man-in-the-middle attacks, etc., and improve the security and reliability of the vehicle network. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a schematic diagram of a secure time synchronization system based on HSM;

[0028] Figure 2 It is a logical diagram of gPTP message sending;

[0029] Figure 3 This is a logical diagram of gPTP message reception. DETAILED DESCRIPTION

[0030] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of this application.

[0031] like Figure 1 As shown, the HSM-based secure time synchronization system of the present invention includes a GM node and a Slave node, GM is a master node, Slave is a distributed slave node, GM node sends a time synchronization message, and Slave node receives a time synchronization message (gPTP message). The message is sent through the Bridge node, Bridge is a bridge node, and complies with the generalized clock synchronization protocol (gPTP protocol) of the IEEE Std 802.1AS standard.

[0032] Both the GM node and the Slave node include the HSM hardware security module, OS layer, gPTP protocol stack (gPTP stack), and MAC layer. The HSM hardware security module provides certificate management and message authentication and encryption interface for gPTP messages. The gPTP Stack accesses the certificate management and message authentication and encryption interface services of the HSM hardware security module and the gPTP service of the MAC layer through the OS layer to complete secure time synchronization based on HSM.

[0033] During vehicle production, the production line tool uniformly imports the HSM certificate of the HSM hardware security module to ensure the legitimacy of the certificate while reducing the risk of certificate leakage. The HSM hardware security modules of the GM node and the Slave node in the vehicle system all import the same HSM certificate to complete the verification of the time synchronization message.

[0034] like Figure 2 As shown, when the GM node sends a gPTP message, it authenticates the gPTP message by calling the message authentication and encryption interface service of the HSM hardware security module, and sends the gPTP time synchronization message together with the message authentication result M to the Slave node in the gPTP network in the vehicle.

[0035] The specific steps of gPTP message sending are as follows:

[0036] (1) Start the gPTP time synchronization program, check the HSM status and whether the certificate is valid. If invalid, record the invalid status and stop time synchronization;

[0037] (2) If valid, continue with time synchronization; first, encapsulate the gPTP synchronization message;

[0038] (3) Then, the message authentication and encryption interface service of the HSM hardware security module is called to authenticate the gPTP message and generate a message authentication result M;

[0039] (4) Fill the message authentication result M into the extension field of the gPTP synchronization message;

[0040] (5) Finally, a gPTP synchronization message is sent that fills in the message authentication result.

[0041] like Figure 3As shown in the figure, after receiving the gPTP message, the Slave node extracts the gPTP message and the corresponding message authentication result respectively, and authenticates the gPTP message by calling the message authentication encryption interface service of the HSM hardware security module to obtain the message authentication result M1. The locally calculated gPTP message authentication result M1 is compared with the message authentication result M extracted from the received gPTP message. If the two message authentication results are inconsistent, it means that the message has been illegally tampered with or the message comes from an illegal device, and there is an intruder in the vehicle system who has launched an attack on the gPTP network. If the two message authentication results are consistent, time synchronization is performed.

[0042] Receiving gPTP messages specifically includes the following steps:

[0043] (1) Start the gPTP time synchronization program, check the HSM status and whether the certificate is valid. If invalid, record the invalid status and stop time synchronization;

[0044] (2) If valid, continue time synchronization and receive gPTP synchronization messages;

[0045] (3) Call the message authentication and encryption interface service of the HSM hardware security module to authenticate the gPTP message and obtain the message authentication result M1; the certificate used by the slave node for message authentication is the same as the certificate used by the GM node for message authentication;

[0046] (4) Compare the locally calculated gPTP message authentication result M1 with the message authentication result M extracted from the received gPTP message; if the two message authentication results are inconsistent, it indicates that the message is an attack message or the HSM is wrong, then the failure status is recorded and time synchronization is stopped;

[0047] (5) If the two message authentication results are consistent, time synchronization is performed.

[0048] The beneficial effect of the present invention is that, compared with the prior art, the message authentication algorithm of the present invention uses a dedicated HSM module to ensure the integrity and authenticity of the gPTP message, preventing the possibility of the message being tampered with or coming from a malicious gPTP node; there is no need to add new applications, and the existing gPTP protocol stack can be quickly adapted.

[0049] Under the premise of ensuring time synchronization, the verification of time synchronization messages is completed through the message authentication mechanism, which can effectively prevent replay attacks, DoS, spoofing attacks, protocol vulnerability attacks, man-in-the-middle attacks, etc., and improve the security and reliability of the vehicle network.

[0050] The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, but not to limit the scope of protection of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the scope of protection of the present invention.

Claims

1. A secure time synchronization system based on HSM, characterized in that: It includes GM nodes and Slave nodes. GM nodes send time synchronization messages, and Slave nodes receive time synchronization messages. Both the GM node and the Slave node include the HSM hardware security module, OS layer, gPTP protocol stack, and MAC layer; the HSM hardware security module provides certificate management and message authentication and encryption interface for gPTP messages. The gPTP protocol stack accesses the certificate management and message authentication and encryption interface services of the HSM hardware security module and the gPTP service of the MAC layer through the OS layer to complete secure time synchronization; When the GM node sends a gPTP message, it authenticates the gPTP message by calling the message authentication and encryption interface service of the HSM hardware security module, and sends the gPTP time synchronization message together with the message authentication result M to the Slave node in the gPTP network in the vehicle; After receiving the gPTP message, the Slave node extracts the gPTP message and the corresponding message authentication result respectively, and performs message authentication on the gPTP message by calling the message authentication encryption interface service of the HSM hardware security module to obtain the message authentication result M1; The locally calculated gPTP message authentication result M1 is compared with the message authentication result M extracted from the received gPTP message. If the two message authentication results are consistent, time synchronization is performed.

2. The HSM-based secure time synchronization system according to claim 1, characterized in that: During vehicle production, the HSM certificate of the HSM hardware security module is uniformly imported by the production line tools.

3. The HSM-based secure time synchronization system according to claim 1, characterized in that: The HSM hardware security modules of the GM node and the Slave node in the vehicle system import the same HSM certificate.

4. A secure time synchronization method based on HSM, based on the secure time synchronization system based on HSM according to any one of claims 1 to 3, characterized in that: Includes steps: (1) When the GM node sends a gPTP message, it authenticates the gPTP message by calling the message authentication and encryption interface service of the HSM hardware security module, and sends the gPTP time synchronization message together with the message authentication result M to the Slave node in the gPTP network in the vehicle; Specifically include: (1.1) Start the gPTP time synchronization program, check the HSM status and whether the certificate is valid. If invalid, record the invalid status and stop time synchronization; (1.2) If valid, continue with time synchronization; first, encapsulate the gPTP synchronization message; (1.3) Then, the message authentication and encryption interface service of the HSM hardware security module is called to authenticate the gPTP message and generate a message authentication result M; (1.4) Fill the message authentication result M into the extension field of the gPTP synchronization message; (1.5) Finally, a gPTP sync message is sent that contains the authentication result of the populated message. (2) After receiving the gPTP message, the Slave node extracts the gPTP message and the corresponding message authentication result respectively, and authenticates the gPTP message by calling the message authentication encryption interface service of the HSM hardware security module to obtain the message authentication result M1; the locally calculated gPTP message authentication result M1 is compared with the message authentication result M extracted from the received gPTP message. If the two message authentication results are consistent, time synchronization is performed.

5. The HSM-based secure time synchronization method according to claim 4, characterized in that: Step (2) specifically includes: (2.1) Start the gPTP time synchronization program, check the HSM status and whether the certificate is valid. If invalid, record the invalid status and stop time synchronization; (2.2) If valid, continue time synchronization and receive gPTP synchronization messages; (2.3) Call the message authentication and encryption interface service of the HSM hardware security module to authenticate the gPTP message and obtain the message authentication result M1; (2.4) Compare the locally calculated gPTP message authentication result M1 with the message authentication result M extracted from the received gPTP message; if the two message authentication results are inconsistent, it indicates that the message is an attack message or an HSM error, and the failure status is recorded and time synchronization is stopped; (2.5) If the two message authentication results are consistent, time synchronization is performed.

6. The HSM-based secure time synchronization method according to claim 4, characterized in that: In step (2.3), the certificate used by the Slave node for message authentication is the same as the certificate used by the GM node for message authentication.

Images