Automobile local area network safety communication system and safety communication method

Abstract

The present invention discloses a vehicle local area network security communication system and security communication method, the system includes a bus, a device node connected to the bus, and a domain controller, the device node communicates with the domain controller through the bus, and also includes a security node arranged between the device node and the bus, the security node is used to perform encrypted communication with the domain controller to ensure the security of communication data between the device node and the domain controller. The present invention sets a security node between the device node and the bus, performs encrypted communication with the domain controller through the security node to ensure the security of communication data between the device node and the domain controller, prevents unauthorized third parties from intercepting or tampering with data, and ensures the communication security of the vehicle local area network.

Description

Technical Field

[0001] The present invention relates to the field of automobile local area network communication, and in particular to an automobile local area network safety communication system and a safety communication method. Background Art

[0002] With the continuous development of automobile technology, automotive LAN communication has become an indispensable part of modern automobiles. Among them, CAN / CAN-fd bus, as the main communication protocol, realizes efficient and real-time data exchange between various device nodes inside the car. However, this communication method has an important security risk, that is, the data on the bus is not encrypted, which means that any device that can access the OBD interface can directly read the communication data between nodes. From the perspective of automobile safety, this communication method has great risks and may cause the vehicle to be maliciously attacked, data leaked or tampered, which in turn affects driving safety. How to improve the security of automotive LAN communication while ensuring the real-time and reliability of communication has become an urgent problem to be solved.

[0003] At present, there are some technologies that try to solve this problem. One method is to add authentication and encryption functions to the original device node. However, due to the limited space inside the car, the device node often needs to be small and compact, which limits its hardware configuration and leads to very limited resources on the device node. Adding authentication and encryption functions to the original device node will occupy the limited resources on the device node, resulting in reduced communication performance or increased costs. Another method is to use the CAN gateway to authenticate and encrypt data for the in-vehicle network ECU. Another method requires modifying the original device node and adding an authentication process before communication, and encrypting the data during communication. Although this method can improve the security of communication, modifying the original device node may increase costs and introduce new potential risks. Summary of the invention

[0004] In view of the above-mentioned deficiencies in the prior art, the technical problem to be solved by the present invention is to provide a vehicle local area network security communication system and a security communication method that improve communication security by adding security nodes without affecting the real-time and reliability of communication.

[0005] In order to solve the above technical problems, a technical solution adopted by the present invention is: to provide a vehicle local area network security communication system, including a bus, a device node connected to the bus and a domain controller, the device node communicates with the domain controller through the bus, and also includes a security node arranged between the device node and the bus, the security node is used to perform encrypted communication with the domain controller to ensure the security of communication data between the device node and the domain controller.

[0006] Furthermore, the security node is an embedded device arranged between the device node and the bus, having two interfaces, one interface connected to the device node to receive communication data sent by the device node and to send communication data sent by the domain controller decrypted by the security node to the device node, and the other interface connected to the bus to transmit communication data sent by the device node encrypted by the security node to the bus and to receive communication data sent by the domain controller to the bus.

[0007] Furthermore, the security node is also used to collect signal characteristic data generated by the device node in the process of sending communication data and send it to the domain controller. The domain controller is used to authenticate the device node based on the signal characteristic data to prevent replacement attacks on the device node.

[0008] Furthermore, the domain controller includes:

[0009] A data receiving module, used to receive the signal characteristic data, wherein the signal characteristics include signal transmission time, retry time, parasitic capacitance and circuit delay;

[0010] A preprocessing module, used for preprocessing the signal characteristic data received by the data receiving module to obtain sample data, wherein the sample data can be divided into training data and verification data;

[0011] Model building module, used to build the certification model;

[0012] A model training module, used for training the authentication model using the sample data;

[0013] The authentication module is used to use the trained authentication model to authenticate the device node according to the new signal feature data. If the authentication is successful, the device node is legal. If the authentication fails, an alarm is triggered.

[0014] Furthermore, the authentication model includes an input layer, two convolutional layers, two pooling layers, a Dropout layer, a Flatten layer and two fully connected layers, wherein the input layer is used to input the signal feature data, and the last fully connected layer is used as the output layer to output the authentication result, including two situations: authentication success and authentication failure.

[0015] Furthermore, the model training module includes the following submodules:

[0016] The forward propagation module is used to input training data, perform forward propagation through the network hierarchy, and obtain the output result;

[0017] The loss calculation module is used to calculate the error between the output result and the actual label using the loss function;

[0018] The back propagation module is used to calculate the gradient of each layer parameter using the back propagation algorithm;

[0019] The parameter update module is used to update the network parameters according to the calculated gradient using the gradient descent algorithm. When the number of training rounds is greater than 20 but less than or equal to 70, the learning rate is reduced to eight-tenths of the original value after every 10 training rounds. When the number of training rounds is greater than 70, the learning rate is reduced to one-tenth of the original value.

[0020] The validation and adjustment module is used to evaluate the model performance using validation data and adjust the parameters based on the evaluation results.

[0021] In order to solve the above technical problems, another technical solution adopted by the present invention is to provide a vehicle local area network security communication method, comprising the following steps:

[0022] After configuring the security node, the security node and the domain controller generate the same communication key;

[0023] The security node sends an authentication request to the domain controller, and the domain controller authenticates the security node;

[0024] After successful authentication, the security node receives the communication data sent by the device node and encrypts it with the communication key and sends it to the domain controller;

[0025] After receiving the encrypted communication data, the domain controller decrypts it with the same communication key to obtain the communication data sent by the device node.

[0026] Furthermore, after the step of decrypting the encrypted communication data with the same communication key after the domain controller receives the encrypted communication data, the following steps are also included:

[0027] The domain controller generates a control instruction according to the communication data sent by the device node, encrypts the control instruction with a communication key, and sends it to the security node;

[0028] After receiving the encrypted control instruction, the security node decrypts it with the same communication key and sends it to the device node.

[0029] Furthermore, the step of generating the same communication key by the security node and the domain controller includes the following sub-steps:

[0030] Safety node power-on self-test;

[0031] The domain controller sends a key initialization instruction to the security node;

[0032] After receiving the key initialization instruction, the security node generates a communication key using its ID, wherein the security node has an independent MCU, and the MCU has a unique ID, and when configuring the security node, the ID is written into the domain controller;

[0033] The domain controller generates the same communication key according to the ID.

[0034] Furthermore, when receiving the communication data sent by the device node, the security node also collects signal characteristic data generated by the device node in the process of sending the communication data, and encrypts the signal characteristic data together with the communication data sent by the device node and sends the encrypted data to the domain controller;

[0035] The domain controller authenticates the device node according to the signal characteristic data, and continues communication if the authentication is successful, and alarms if the authentication fails.

[0036] The automotive local area network security communication system and security communication method of the present invention have at least the following beneficial effects: a security node is set between the device node and the bus, and encrypted communication is performed with the domain controller through the security node to ensure the security of communication data between the device node and the domain controller, thereby preventing unauthorized third parties from intercepting or tampering with the data; the security node has a unique ID, and the security, reliability and stability of the automotive local area network security communication system are ensured through authentication of the unique ID, a whitelist mechanism and generation of communication keys; the security node is also used to collect signal feature data generated by the device node in the process of sending communication data and send it to the domain controller. The domain controller can verify the authenticity of the device node through these signal feature data, thereby effectively preventing replacement attacks on the device node and providing solid protection for the secure communication of the automotive local area network. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0038] Figure 1 This is a system architecture diagram of an implementation method of a vehicle local area network security communication system of the present invention.

[0039] Figure 2 for Figure 1 A block diagram of the domain controller in .

[0040] Figure 3 This is the network structure diagram of the LeNet-5 model.

[0041] Figure 4 The present invention is a flowchart of an implementation method of a secure communication method for a vehicle local area network.

[0042] Figure 5 for Figure 4 Flow chart of step S1 in FIG. DETAILED DESCRIPTION

[0043] The present invention will be further described below in conjunction with the accompanying drawings.

[0044] See also Figure 1 The automobile local area network security communication system of the present invention includes a bus, a device node connected to the bus, and a domain controller. The device node communicates with the domain controller through the bus to transmit and interact with data. It also includes a security node arranged between the device node and the bus. The security node is used to perform encrypted communication with the domain controller to ensure the security of the communication data between the device node and the domain controller. Whether it is data sent by the device node to the domain controller or data returned by the domain controller to the device node, it will be encrypted and decrypted by the security node to ensure the integrity and confidentiality of the data. In this embodiment, the bus is a CAN bus, or it can be a CAN-fd bus, and the domain controller can also be an on-board computing center.

[0045] The safety node is an embedded device set between the device node and the bus. The embedded device is small and powerful, with two interfaces, one interface is connected to the device node to receive the communication data sent by the device node and send the communication data sent by the domain controller decrypted by the safety node to the device node, and the other interface is connected to the bus to transmit the communication data sent by the device node encrypted by the safety node to the bus and receive the communication data sent by the domain controller to the bus. In order to ensure the reliability and traceability of the safety node, the MCU of the safety node has a unique ID. When configuring the safety node, the ID is written to the domain controller. The domain controller can use this unique ID to generate the same communication key to ensure that the communication with the corresponding safety node is encrypted and secure. In addition, the ID is filed in the manufacturer's database before leaving the factory or at an authorized maintenance point. The domain controller will regularly check whether the ID of the safety node is on the whitelist through the manufacturer's database. This mechanism ensures that only legal and authorized safety nodes can participate in the communication, further enhancing the security of the system.

[0046] In order to monitor the device nodes, the security node is also used to collect signal characteristic data generated by the device nodes in the process of sending communication data and send it to the domain controller. The domain controller is used to authenticate the device nodes based on the signal characteristic data to prevent replacement attacks on the device nodes.

[0047] See also Figure 2 , is a structural block diagram of a domain controller in an embodiment of a vehicle local area network security communication system of the present invention, wherein the domain controller includes a data receiving module 100, a preprocessing module 200, a model building module 300, a model training module 400 and an authentication module 500, wherein:

[0048] The data receiving module 100 is used to receive the signal characteristic data, and the signal characteristics include signal transmission time, retry time, parasitic capacitance and circuit delay. These signal characteristics generated by each device node during the communication process are usually unique or have a specific pattern. For example, the signal transmission time varies depending on the clock accuracy or synchronization mechanism inside the device. The retry time reflects the retry strategy of the device after the communication fails. Parasitic capacitance and circuit delay are closely related to the hardware design and manufacturing process of the device. These characteristics combined can represent the behavior pattern of the device node and are used to distinguish different device nodes. Therefore, these signal characteristics are used to authenticate the device node and prevent the replacement attack of the device node.

[0049] The preprocessing module 200 is used to preprocess the signal feature data received by the data receiving module to obtain sample data. The preprocessing includes operations such as cleaning, standardization, and normalization to eliminate noise and outliers and improve data availability. The sample data can be divided into training data and verification data in a certain proportion for subsequent model training.

[0050] The model building module 300 is used to build an authentication model. The authentication model designed in this embodiment is a LeNet-5 model. Figure 3 The LeNet-5 model includes an input layer, two convolutional layers, two pooling layers, a Dropout layer, a Flatten layer and two fully connected layers, wherein the input layer is used to input the signal feature data. In the two convolutional layers, the number of convolution kernels in the first convolutional layer is 32, the number of convolution kernels in the second convolutional layer is 64, the length of the one-dimensional convolution window is 5, the step size of the convolution is 2, only effective convolution is performed, that is, the boundary data is not processed, and the activation function re lu is specified; there is a pooling layer after each convolutional layer, and the pooling area size is 2. After the convolution and pooling operation, the Dropout layer used to suppress overfitting and the Flatten layer used to flatten multidimensional data are connected, and finally two fully connected layers are connected. The last fully connected layer uses softmax as the classifier to output the classification result, that is, the authentication result, including two cases of successful authentication and failed authentication.

[0051] This certification model uses two convolutional layers to automatically extract deep features from signal feature data. The first convolutional layer uses 32 convolutional kernels and the second convolutional layer uses 64 convolutional kernels, which helps the model learn more feature representations and improve the recognition ability of device node signals. During the convolution process, the window corresponding to each convolutional kernel slides on the input matrix (image) at a certain step size and performs convolution operations. The feature map generated by each convolutional kernel shares the same weight, which reduces the computational complexity of the model and improves the training efficiency of the model. The introduction of the Dropout layer can effectively suppress overfitting. During the training process, the Dropout layer randomly turns off the output of some neurons, which prevents the model from over-relying on certain specific features, thereby improving the generalization ability of the model. LeNet-5 uses pooling operations to achieve spatiotemporal downsampling, extract important parts, and enhance the robustness of the model to translated and distorted images. The network structure of LeNet-5 is relatively simple, with fewer parameters and faster training speed.

[0052] The model training module 400 is used to train the authentication model using the sample data.

[0053] The model training module 400 includes a forward propagation module 410, a loss calculation module 420, a back propagation module 430, a parameter updating module 440, and a verification and adjustment module 450, wherein:

[0054] The forward propagation module 410 is used to input training data, perform forward propagation through the network hierarchy, and obtain output results. The compute_class_weight() function is used to balance the weights between different categories of input samples, and the class_weight parameter is set to balanced so that when processing unbalanced training data, the loss function pays more attention to data with insufficient sample numbers.

[0055] The loss calculation module 420 is used to calculate the error between the output result and the actual label using a loss function.

[0056] The back propagation module 430 is used to calculate the gradient of each layer parameter by using the back propagation algorithm.

[0057] The parameter updating module 440 is used to update the network parameters according to the calculated gradient using the gradient descent algorithm. When the number of training rounds is greater than 20 but less than or equal to 70, the learning rate is reduced to eight tenths of the original value for every 10 training rounds, and when the number of training rounds is greater than 70, the learning rate is reduced to one tenth of the original value; the modell it() function is used to train the training data in the model for a certain number of times, and a Hi story object is returned, which records the changes in the values ​​of loss and other indicators with the number of training rounds. In this embodiment, the number of training rounds is specified to be 150, the number of samples used for training the network once is 256, and the verification data is specified, and the parameter call backs is used as a callback function, which is called at an appropriate time during the training process to adjust the learning rate.

[0058] The verification and adjustment module 450 is used to evaluate the model performance using the verification data and adjust the parameters according to the evaluation results. The trained model is evaluated using the model 1.evaluate() function, which returns the loss value of the model on the verification data set and the selected indicator values, such as accuracy, precision and recall, etc. These indicators help understand the overall performance of the model and its performance in different categories.

[0059] The authentication module 500 is used to authenticate the device node using the trained authentication model according to the new signal feature data. If the authentication is successful, the device node is legal. If the authentication fails, an alarm is triggered. In this embodiment, 1 indicates successful authentication and 0 indicates failed authentication.

[0060] See also Figure 4 , is a flow chart of an embodiment of a method for secure communication in a vehicle local area network of the present invention. The method for secure communication in a vehicle local area network of the present invention specifically comprises the following steps:

[0061] S1. After configuring the security node, the security node and the domain controller generate the same communication key.

[0062] See also Figure 5 , this step S1 includes the following sub-steps:

[0063] S11, safety node power-on self-test.

[0064] When a safety node is powered on for the first time, it will first perform a self-test. This process includes checking whether the node's hardware components (such as processors, memory, communication interfaces, etc.) are working properly and whether the software is complete and correct, to ensure that the safety node is in good condition before being put into operation, thereby avoiding potential failures or safety hazards.

[0065] S12. The domain controller sends a key initialization instruction to the security node.

[0066] When the domain controller needs to establish a communication connection with a security node, the domain controller will first send a key initialization instruction to the security node. This instruction contains the necessary information for generating keys, such as the key generation algorithm, key length, and possible initial vectors. After receiving this instruction, the security node will perform the corresponding key generation operation according to the information in the instruction. In addition, the key initialization instruction can also be used to verify the identity and authorization status of the security node. The domain controller can include specific verification information in the instruction, requiring the security node to provide a correct response or prove its identity.

[0067] S13. After receiving the key initialization instruction, the security node uses its ID to generate a communication key, wherein the security node has an independent MCU, and the MCU has a unique ID. When configuring the security node, the ID is written into the domain controller.

[0068] During the key generation process, the security node will use its own unique ID combined with the algorithm and parameters provided by the domain controller to generate a unique communication key. This key will be used for subsequent encrypted communications with the security node. In this way, each security node will have a unique communication key corresponding to it, thereby achieving personalized and secure communication.

[0069] S14. The domain controller generates the same communication key according to the ID.

[0070] While the security node uses its ID to generate a communication key, the domain controller also generates the same communication key based on the same ID. This key generation method ensures that both communicating parties can use the same key for encryption and decryption operations, thereby achieving data confidentiality and integrity protection.

[0071] S2. The security node sends an authentication request to the domain controller, and the domain controller authenticates the security node.

[0072] After the security node generates the communication key, it will send an authentication request to the domain controller. This request usually contains the security node's ID and the generated communication key information for verification by the domain controller. The domain controller will verify the validity of the security node's ID and communication key information. If the verification is successful, the domain controller will send a confirmation message to the security node, indicating that the key initialization is successful.

[0073] S3. After successful authentication, the security node receives the communication data sent by the device node, encrypts it with the communication key, and sends it to the domain controller.

[0074] Once the key initialization process is completed, all subsequent communications between the security node and the domain controller will use this newly generated communication key for encrypted communication. After receiving the communication data sent by the device node, the security node will use the communication key to symmetrically encrypt the data and then send it to the domain controller to ensure the security of the communication data and prevent unauthorized access and data leakage.

[0075] S4. After receiving the encrypted communication data, the domain controller decrypts it with the same communication key to obtain the communication data sent by the device node.

[0076] When receiving the communication data sent by the device node, the security node also collects the signal characteristic data generated by the device node in the process of sending the communication data, and encrypts the signal characteristic data together with the communication data sent by the device node and sends it to the domain controller; the domain controller authenticates the device node based on the signal characteristic data, continues communication if the authentication is successful, and alarms if the authentication fails.

[0077] S5. The domain controller generates a control instruction according to the communication data sent by the device node, encrypts the control instruction with a communication key, and sends it to the security node.

[0078] The domain controller will analyze and process this data and generate corresponding control instructions, which include operation instructions for device nodes, parameter adjustments and / or other control actions; in order to ensure the security of control instructions during transmission, the domain controller will use the same communication key as the security node to encrypt the control instructions; after encryption is completed, the domain controller will send the encrypted control instructions to the security node.

[0079] S6. After receiving the encrypted control instruction, the security node decrypts it with the same communication key and sends it to the device node.

[0080] After receiving the encrypted control instructions sent by the domain controller, the security node will first verify its integrity and authenticity; after the verification, the security node will use the same communication key as the domain controller to decrypt the encrypted control instructions; after decryption is completed, the security node will send the decrypted control instructions to the device node, thereby ensuring that the device node can receive accurate instructions from the domain controller and perform corresponding operations.

[0081] The present invention sets a security node between the device node and the bus, and performs encrypted communication with the domain controller through the security node to ensure the security of the communication data between the device node and the domain controller, and prevent unauthorized third parties from intercepting or tampering with the data; the security node has a unique ID, and through the authentication of the unique ID, the whitelist mechanism and the generation of communication keys, the security, reliability and stability of the automobile local area network security communication system are ensured; the security node is also used to collect signal feature data generated by the device node in the process of sending communication data and send it to the domain controller. The domain controller can verify the authenticity of the device node through these signal feature data, thereby effectively preventing the replacement attack of the device node and providing a solid guarantee for the secure communication of the automobile local area network.

[0082] The above embodiments only express the preferred embodiments of the present invention, and the description is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A vehicle local area network security communication system, comprising a bus, a device node connected to the bus, and a domain controller, wherein the device node communicates with the domain controller via the bus, and is characterized in that: It also includes a security node disposed between the device node and the bus, the security node is used to perform encrypted communication with the domain controller to ensure the security of communication data between the device node and the domain controller, and the bus is limited to a CAN bus or a CAN-fd bus; The security node is further used to collect signal characteristic data generated by the device node in the process of sending communication data and send it to the domain controller, and the domain controller is used to authenticate the device node according to the signal characteristic data to prevent replacement attacks on the device node; The domain controller comprises: A data receiving module, used to receive the signal characteristic data, wherein the signal characteristics include signal transmission time, retry time, parasitic capacitance and circuit delay; A preprocessing module, used for preprocessing the signal feature data received by the data receiving module to obtain sample data, wherein the sample data can be divided into training data and verification data; Model building module, used to build the certification model; A model training module, used for training the authentication model using the sample data; The authentication module is used to use the trained authentication model to authenticate the device node according to the new signal feature data. If the authentication is successful, the device node is legal. If the authentication fails, an alarm is triggered.

2. The automotive local area network security communication system as claimed in claim 1, characterized in that: The security node is an embedded device arranged between the device node and the bus, and has two interfaces, one interface is connected to the device node to receive communication data sent by the device node and send communication data sent by the domain controller decrypted by the security node to the device node, and the other interface is connected to the bus to transmit communication data sent by the device node encrypted by the security node to the bus and receive communication data sent by the domain controller to the bus.

3. The automotive local area network safety communication system as claimed in claim 1, characterized in that: The authentication model includes an input layer, two convolutional layers, two pooling layers, a Dropout layer, a Flatten layer and two fully connected layers, wherein the input layer is used to input the signal feature data, and the last fully connected layer is used as the output layer to output the authentication results, including two situations: authentication success and authentication failure.

4. The automotive local area network security communication system as claimed in claim 1, characterized in that: The model training module includes the following submodules: The forward propagation module is used to input training data, perform forward propagation through the network hierarchy, and obtain the output result; The loss calculation module is used to calculate the error between the output result and the actual label using the loss function; The back propagation module is used to calculate the gradient of each layer parameter using the back propagation algorithm; The parameter update module is used to update the network parameters according to the calculated gradient using the gradient descent algorithm. When the number of training rounds is greater than 20 but less than or equal to 70, the learning rate is reduced to eight-tenths of the original value after every 10 training rounds. When the number of training rounds is greater than 70, the learning rate is reduced to one-tenth of the original value. The validation and adjustment module is used to evaluate the model performance using validation data and adjust the parameters based on the evaluation results.

5. A method for secure communication in a vehicle local area network, characterized in that: The following steps are involved: After configuring the security node, the security node and the domain controller generate the same communication key; The security node sends an authentication request to the domain controller, and the domain controller authenticates the security node; After successful authentication, the security node receives the communication data sent by the device node and encrypts it with the communication key and sends it to the domain controller, wherein when receiving the communication data sent by the device node, the security node also collects the signal characteristic data generated by the device node in the process of sending the communication data, and encrypts the signal characteristic data together with the communication data sent by the device node and sends it to the domain controller, wherein the signal characteristics include signal sending time, retry time, parasitic capacitance and circuit delay; After receiving the encrypted communication data, the domain controller decrypts it with the same communication key to obtain the communication data sent by the device node. The domain controller authenticates the device node according to the signal characteristic data, continues communication if the authentication is successful, and issues an alarm if the authentication fails.

6. The automotive local area network secure communication method as claimed in claim 5, characterized in that: After the domain controller receives the encrypted communication data and decrypts it with the same communication key, the following steps are also included: The domain controller generates a control instruction according to the communication data sent by the device node, encrypts the control instruction with a communication key, and sends it to the security node; After receiving the encrypted control instruction, the security node decrypts it with the same communication key and sends it to the device node.

7. The automotive local area network secure communication method as claimed in claim 5, characterized in that: The step of generating the same communication key by the security node and the domain controller includes the following sub-steps: Safety node power-on self-test; The domain controller sends a key initialization instruction to the security node; After receiving the key initialization instruction, the security node uses its ID to generate a communication key, wherein the security node has an independent MCU, and the MCU has a unique ID, and when configuring the security node, the ID is written into the domain controller; The domain controller generates the same communication key according to the ID.

Images