A zero-trust intelligent connected vehicle group information continuous verification strategy method

Abstract

The present invention discloses a zero-trust intelligent networked vehicle group information continuous verification strategy method, which specifically relates to the field of vehicle information security technology, including information that a vehicle or device intends to send to other vehicles or devices, namely initial information; verification information generated by a verification strategy toolbox, namely additional verification information; the initial information and additional verification information are encrypted and packed by the sender's verification strategy toolbox and then sent, and the information sent is encrypted, and the initial information and verification information cannot be directly seen. Mixed information, that is, sending messages; when other vehicles or devices receive messages sent by other vehicles or devices, that is, receiving messages that may contain attack information, the receiving party's verification strategy toolbox unpacks the information, specifically including separating the initial information and verification information from the mixed information. The present invention generates additional verification information through a function observer, and realizes information correctness verification by constructing an internal logical relationship hidden in the sent information.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a zero-trust intelligent networked vehicle group information continuous verification strategy method. Background Art

[0002] Intelligent connected vehicles enhance the ability of automobiles in situational awareness and enable them to work in teams. Efficient vehicle group collaboration and planning can significantly improve transportation conditions, and improve traffic safety, energy consumption, and road utilization. Therefore, research on intelligent connected vehicles has attracted worldwide attention. At present, intelligent connected vehicles are gradually moving from experimental scenarios to practical applications, and are moving towards a more life-oriented direction. However, like all unmanned systems, intelligent connected vehicles also have obvious potential dangers, such as user information leakage. Since intelligent connected vehicle systems integrate the cyber world and the physical world, they have the ability to transmit cyber attack risks to the real physical world. After a vehicle is attacked by a malicious network, the malicious attacker may even be able to control the huge kinetic energy of the vehicle itself, bringing great security risks to the physical world. Moreover, there is no upper limit to this risk, and it may even threaten national security. Therefore, the security of intelligent connected vehicles is of vital importance.

[0003] Intelligent connected vehicles cover both networks and vehicles. From this perspective, in order to further improve the safety of intelligent connected vehicles, we can start from the network communication level and the physical vehicle control level. In actual application, a vehicle group may be composed of vehicles of different brands and types with the cooperation of roadside units and other equipment. When the group is running, these vehicles / equipment need to be included in the same network management. These devices will also switch during the movement of the fleet. This has caused the network boundaries of intelligent connected vehicles to be very blurred. In the past, identity authentication or information verification that relied on network boundaries can no longer meet actual needs, and there is an urgent need to update the network security architecture.

[0004] The zero-trust network architecture is a new security framework that adheres to the concept of "never trust, continuously verify" and is committed to building a higher level of communication security environment. In the zero-trust network framework, any information transmission has an additional verification link.

[0005] At present, there are still some problems that need to be overcome when applying zero-trust network architecture to intelligent connected vehicles:

[0006] 1) In the past, vehicle communication mainly relied on identity authentication, which in turn mainly relied on the evaluation of the vehicle's historical behavior. However, the vehicle's historical behavior is not necessarily related to the current possible attack. The trust scoring mechanism that relied on the vehicle's historical behavior in the past could not effectively deal with the hypocrisy of cyber attackers and is no longer effective.

[0007] The zero-trust network architecture assumes that any vehicle in a group of vehicles is at risk of being attacked, so it is necessary to build an information-based verification strategy to shift the focus of verification from identity assessment to information assessment.

[0008] 2) The continuous verification behavior required by the zero-trust network architecture itself will inevitably increase the system's latency, and the accumulation of trust evaluation based on historical behavior often means a longer time consumption, which is a huge time burden for realizing the "never trust, repeatedly authenticate" zero-trust network architecture.

[0009] 3) In fact, the basic data for identity assessment also comes from interactive information. The unreliability of the information itself also leads to the unreliability of identity assessment. Mining the internal connections of information and establishing new contradictions may become an effective solution to solve the problem. Summary of the invention

[0010] To this end, the present invention provides a zero-trust intelligent connected vehicle group information continuous verification strategy method to solve the problems raised in the background technology.

[0011] In order to achieve the above-mentioned purpose, the present invention provides the following technical solutions: a zero-trust intelligent networked vehicle group information continuous verification strategy method, considering the attacks suffered by the vehicle-mounted networked communication terminal T-BOX vehicle-mounted communication module during information transmission,

[0012] The information that a vehicle or device intends to send to another vehicle or device is the initial information; the verification information generated by the verification strategy toolbox is the additional verification information; the initial information and the additional verification information are encrypted and packed by the sender's verification strategy toolbox before being sent. The information sent is a mixed information of the encrypted information and the initial information and the verification information cannot be directly seen, that is, the sending message;

[0013] When other vehicles or devices receive messages from other vehicles or devices, i.e., messages that may contain attack information, the receiving party verification strategy toolbox performs information unpacking, specifically including separating initial information and verification information from mixed information;

[0014] When the unpacked information meets the verification policy conditions, it is considered that the sent message has not been attacked or tampered with, that is, the verification is passed, and the verification policy toolbox transmits the separated initial information to the vehicle or device;

[0015] If the unpacked information does not meet the verification policy conditions, the verification fails and the vehicle or device refuses to receive the information. The verification policy toolbox transmits the previous verified information to the vehicle or device as needed.

[0016] The strategies of the verification strategy toolbox include static verification strategies and dynamic verification strategies;

[0017] The verification process is based on the transmitted information, and the additional information is generated according to a certain algorithm. The difference in the identity of the vehicle or device may only be an aid in strategy selection.

[0018] Preferably, first establish a state space model of the vehicle for

[0019]

[0020] x(t)∈R n is the vehicle state, u(t) is the vehicle control input, y(t) is the vehicle output, η(t) includes various sensor interferences and unknown inputs suffered by the vehicle, and matrices A, B, C, D, and G are all known matrices of appropriate dimensions.

[0021] Preferably, the information to be sent is represented by the subscript s, and the initial information x to be sent to the other vehicle or device is s (t)∈R n , the packing process is as follows:

[0022] (1) Generate verification information z s (t)∈R m :

[0023] z s (t) = L σ x s (t) (2)

[0024] Where L σ ∈R m×n To generate a matrix for verification information, its specific value or change rule is determined by the continuous verification strategy toolbox, which is mastered by the verification strategy toolboxes of both communicating parties;

[0025] (2) Generate additional verification information θ s (t)∈R q :

[0026] θ s The generation of (t) does not depend on the system state x s (t), including fixed values, changing functions and uniform pseudo-random number generators, whose generation algorithms are also mastered by the verification strategy toolboxes of both communicating parties.

[0027] Preferably, the information actually sent is from the initial information x s (t) Expanded to That is, the combination of initial information and additional information; in order to conceal The combination relationship of the verification strategy toolbox generates a full-rank matrix X σ ∈R (n +m+q)×(n+m+q), corresponding to static time-invariant and dynamic time-variant, left multiplication Send it later, that is, the final message sent is The dimension of this full-rank matrix is ​​related to the actual information sent The dimensions are related.

[0028] Preferably, the message received by the receiver is represented by the subscript r, and the receiver receives the received message Or M that has been tampered with by the attack s After that, use Separation information x r (t), z r (t) and θ r (t), if z r (t) = L σ x r (t) and the received θ r (t) and the self-verification strategy toolbox generated by θ s (t) is consistent with the corresponding θ(t), which means that the information has not changed during the transmission process; theoretically, the malicious attacker does not know L σ , X σ and the generation mechanism of θ(t), any changes All of them will destroy the verification relationship, resulting in information verification failure; r (t) = L σ x r (t) verifies whether x(t) and z(t) have changed respectively, and θ(t) verifies whether the overall information has changed in equal proportion.

[0029] Preferably, for the above-mentioned dynamic verification strategy, there will inevitably be delays in the information transmission process. When the information transmission happens to occur at the moment of strategy change, misjudgment may occur. Multiple dynamic verification strategies are adopted for coexisting verification. Simply put, the effective time of any verification strategy is not a certain moment, but a certain time period. At any moment, multiple verification strategies may be effective at the same time, and the length of this time period can be adjusted according to actual conditions.

[0030] Preferably, from the vehicle group from the origin to the destination, the static strategy L σ and X σ is fixed; under dynamic strategy, L σ and X σ It changes according to the rules agreed upon by both parties, and the dimension of information changes, including:

[0031] (1) Low-dimensional verification: When m < n, that is, the number of verification information is less than the number of initial information, the verification information is less, and the logical relationship that can be reflected is also less, and the verification of all the information in x(t) may be ignored;

[0032] (2) Full-dimensional verification: When m = n, that is, the number of verification information is equal to the number of initial information, the verification information is comprehensive. σ When it is full rank, it can reflect the logical relationship of all information in x(t);

[0033] (3) High-dimensional verification: When m>n, that is, the number of verification information is greater than the number of initial information, there is more verification information, and more comprehensive logical relationships can be constructed for judgment.

[0034] The present invention has the following advantages:

[0035] The present invention builds an information gap barrier between the vehicle management party and the malicious attacker, establishes a verification strategy based on the information itself, and attempts to find a method to distinguish the authenticity of information by judging whether the information itself is contradictory. The method no longer verifies the identity of the sender, but focuses on the transmitted information itself. The specific innovations can be summarized as follows:

[0036] 1) Based on the idea of ​​function observer, a continuous verification scheme based on information itself is proposed under the zero-trust network architecture. The concept of the continuous verification strategy safe is given, and its working principle is analyzed in detail through the two actions of boxing and unboxing.

[0037] 2) The continuous verification strategy set can be divided into two categories: static and dynamic. The dynamic verification strategy set can be triggered by the set of conditions of interest to change the content and dimension according to the actual configuration or risk assessment of the vehicle group. The triggering condition set can include various factors of concern to the vehicle management party, such as environmental changes, time changes, and subject changes.

[0038] 3) In terms of resource consumption, the proposed method only uses the system information itself and will not significantly increase the overall system overhead. The offline update strategy also avoids the risk of network theft of the verification toolbox. The combination of offline update and online verification adopted by the method improves security. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A schematic diagram of a zero-trust intelligent connected vehicle group provided by the present invention;

[0040] Figure 2 A framework diagram of the continuous verification strategy provided by the present invention;

[0041] Figure 3 A schematic diagram of the process of packing and unpacking information provided by the present invention;

[0042] Figure 4 A schematic diagram of a dynamic strategy provided by the present invention;

[0043] Figure 5A schematic diagram of the multi-strategy parallel verification provided by the present invention. DETAILED DESCRIPTION

[0044] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] Example 1

[0046] This embodiment provides a zero-trust intelligent networked vehicle group information continuous verification strategy method, considering the attacks suffered by the vehicle-mounted networked communication terminal T-BOX vehicle-mounted communication module during information transmission, such as Figure 1 As shown,

[0047] like Figure 3 As shown, the information that a vehicle or device intends to send to another vehicle or device is the initial information; the verification information generated by the verification strategy toolbox is the additional verification information; the initial information and the additional verification information are encrypted and packed by the sender's verification strategy toolbox before being sent. The information sent is encrypted, and the initial information and the verification information are mixed information that cannot be directly seen, that is, the sending message;

[0048] When other vehicles or devices receive messages from other vehicles or devices, i.e., messages that may contain attack information, the receiving party verification strategy toolbox performs information unpacking, specifically including separating initial information and verification information from mixed information;

[0049] When the unpacked information meets the verification policy conditions, it is considered that the sent message has not been attacked or tampered with, that is, the verification is passed, and the verification policy toolbox transmits the separated initial information to the vehicle or device;

[0050] If the unpacked information does not meet the verification policy conditions, the verification fails and the vehicle or device refuses to receive the information. The verification policy toolbox transmits the previous verified information to the vehicle or device as needed.

[0051] The strategies of the verification strategy toolbox include static verification strategies and dynamic verification strategies;

[0052] The verification process is based on the transmitted information, and the additional information is generated according to a certain algorithm. The difference in the identity of the vehicle or device may only be an aid in strategy selection.

[0053] Preferably, first establish a state space model of the vehicle for

[0054]

[0055] x(t)∈R n is the vehicle state, u(t) is the vehicle control input, y(t) is the vehicle output, η(t) includes various sensor interferences and unknown inputs suffered by the vehicle, and matrices A, B, C, D, and G are all known matrices of appropriate dimensions.

[0056] Preferably, the information to be sent is represented by the subscript s, and the initial information x to be sent to the other vehicle or device is s (t)∈R n , the packing process is as follows:

[0057] (1) Generate verification information z s (t)∈R m :

[0058] z s (t) = L σ x s (t) (2)

[0059] Where L σ ∈R m×n To generate a matrix for verification information, its specific value or change rule is determined by the continuous verification strategy toolbox, which is mastered by the verification strategy toolboxes of both communicating parties;

[0060] (2) Generate additional verification information θ s (t)∈R q :

[0061] θ s The generation of (t) does not depend on the system state x s (t), including fixed values, changing functions and uniform pseudo-random number generators, whose generation algorithms are also mastered by the verification strategy toolboxes of both communicating parties.

[0062] Preferably, the information actually sent is from the initial information x s (t) Expanded to That is, the combination of initial information and additional information; in order to conceal The combination relationship of the verification strategy toolbox generates a full-rank matrix X σ ∈R (n +m+q)×(n+m+q) , corresponding to static time-invariant and dynamic time-variant, left multiplication Send it later, that is, the final message sent is The dimension of this full-rank matrix is ​​related to the actual information sent The dimensions are related.

[0063] Preferably, the message received by the receiver is represented by the subscript r, and the receiver receives the received message Or M that has been tampered with by the attack s After that, use Separation information x r (t), z r (t) and θ r (t), if z r (t) = L σ x r (t) and the received θ r (t) and the self-verification strategy toolbox generated by θ s (t) is consistent with the corresponding θ(t), which means that the information has not changed during the transmission process; theoretically, the malicious attacker does not know L σ , X σ and the generation mechanism of θ(t), any changes All of them will destroy the verification relationship, resulting in information verification failure; r (t) = L σ x r (t) verifies whether x(t) and z(t) have changed respectively, and θ(t) verifies whether the overall information has changed in equal proportion.

[0064] Preferably, for the above dynamic verification strategy, there is inevitably a delay in the information transmission process. When the information transmission happens to occur at the time of strategy change, misjudgment may occur. Multiple dynamic verification strategies are used for verification, such as Figure 5 As shown, in simple terms, the validity period of any verification strategy is not a certain moment, but a certain period of time. At any moment, multiple verification strategies may be valid at the same time, and the length of this period of time can be adjusted according to actual conditions.

[0065] Preferably, from the vehicle group from the origin to the destination, the static strategy L σ and X σ is fixed; under dynamic strategy, L σ and X σ It changes according to the rules agreed upon by both parties, and the dimension of information changes, including:

[0066] (1) Low-dimensional verification: When m < n, that is, the number of verification information is less than the number of initial information, the verification information is less, and the logical relationship that can be reflected is also less, and the verification of all the information in x(t) may be ignored;

[0067] (2) Full-dimensional verification: When m = n, that is, the number of verification information is equal to the number of initial information, the verification information is comprehensive. σ When it is full rank, it can reflect the logical relationship of all information in x(t);

[0068] (3) High-dimensional verification: When m>n, that is, the number of verification information is greater than the number of initial information, there is more verification information, and more comprehensive logical relationships can be constructed for judgment.

[0069] like Figure 2-Figure 4 As shown, based on the above scheme, a vehicle model including position, velocity and acceleration states is established. For a certain vehicle (assuming the number is i), its longitudinal dynamics model can be modeled according to relevant knowledge of mechanics:

[0070]

[0071] Among them, s i (t) is the position of the vehicle, v i (t) is the speed of the vehicle, a i (t) is the acceleration of the vehicle, u i (t) is the control input of the vehicle, d i (t) is the interference caused by various reasons, τ i is the vehicle engine time constant. Define the system state vector Then (3) can be written as

[0072]

[0073] in,

[0074]

[0075] Assuming that the vehicle is equipped with a vehicle positioning sensor, a speed sensor and an acceleration sensor, the output equation can be established as

[0076] y i (t) = C i x i (t) (5)

[0077] in, Considering the interference on the actuator and sensor at the same time, the system model can be expressed as:

[0078]

[0079] η i (t) represents these interferences, d i (t) is only a part of it, the matrix D i and G i is the interference coefficient matrix.

[0080] In order to construct z i (t) = L σ x i (t), the function observer proposed for (6) is:

[0081]

[0082] in, Yes i (t), ξ i (t) is the intermediate variable, N i ,J i ,H i ,K i is the matrix to be sought.

[0083] The estimation error is defined as:

[0084]

[0085] when

[0086]

[0087] and

[0088] (L σ -K i C i )B i -H i =0(11)

[0089] Sometimes, there is

[0090]

[0091] It can be seen that the establishment of (10) eliminates η i (t) and The influence of has been eliminated; if (12) is stable, then That is Can be used As an additional vector z i (t). In order to make (10) hold, it is written as, and the two matrices are defined as Θ i and i :

[0092]

[0093] When there is

[0094]

[0095] Formula (13) has the following general solution:

[0096]

[0097] in, Represents the matrix Θ i The generalized inverse of (15) can easily solve the required N i ,K i ,J i , substituting into (11) we can find H i However, in order to ensure that (12) is stable, It needs to be Hurwitz and must meet the following conditions:

[0098]

[0099] Use pole placement, linear matrix inequality and other methods to find the appropriate Z, and then solve other related matrices.

[0100] Matrix L σ It is determined by the verification strategy toolbox, that is, by the administrator. During the setting process, it should be verified that conditions (14) and (16) are met. As long as these two conditions are met, it can be set freely.

[0101] Considering that there may be slight errors in the process of information transmission, we can set the thresholds γ1,γ2>0. r (t)-L σ x r (t)||<γ1 and||θ s (t)-θ r (t)||<γ2, it passes the verification; when ||z r (t)-L σ x r (t)||<γ1or||θ s (t)-θ r When (t)||<γ2 does not hold, verification is rejected.

[0102] Example 2

[0103] Different from the artificial threshold in the first embodiment, the threshold is constructed according to the known information in this embodiment, and the vector x(t)∈R is defined. n The upper and lower bounds of and x (t), then If we know that η in (6) i The upper and lower bounds of (t), namely You can avoid threshold setting and directly construct z i (t) = L σ x i The upper and lower bounds of (t) are given by the proposed function interval observer:

[0104]

[0105] The symbols mean: for matrix X, then X u=max{X,0},X d =max{-X,0}, it is easy to get X u and X d All elements of are greater than or equal to 0, and X=X u -X d .

[0106] The estimated residuals are defined as:

[0107]

[0108] when Then i (t) = L σ x i (t) has upper and lower bounds, satisfying

[0109] When there is

[0110]

[0111] and

[0112] H i -T i B i =0 (19)

[0113] Then there is

[0114]

[0115] When the initial variables are selected, Then for any t>0, we have

[0116] (18) The first equation is the Sylvester equation. For the selected Metzler and Hurwitz matrices N i and matrix J i , T can be directly solved i , substituting into (19) we can solve for H i .

[0117] when

[0118]

[0119] The information sent at this time is Reversible matrix X σ ∈R (n+2m+q)×(n+2m+q) , the final message sent is When the receiver receives the message, Separation information x r (t) zr (t) and θ r (t), if And the received θ r (t) and the self-verification strategy toolbox generated by θ s If the corresponding θ(t) is consistent with that of θ(t), it means that the information has not changed during the transmission process.

[0120] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A zero-trust intelligent networked vehicle group information continuous verification strategy method, considering the attack on the vehicle-mounted networked communication terminal T-BOX vehicle-mounted communication module during information transmission, characterized by: The information that a vehicle or device intends to send to another vehicle or device is the initial information; the verification information generated by the verification strategy toolbox is the additional verification information; the initial information and the additional verification information are encrypted and packed by the sender's verification strategy toolbox before being sent. The information sent is a mixed information of the encrypted information and the initial information and the verification information cannot be directly seen, that is, the sending message; When other vehicles or devices receive messages from other vehicles or devices, i.e., messages that may contain attack information, the receiving party verification strategy toolbox performs information unpacking, specifically including separating initial information and verification information from mixed information; When the unpacked information meets the verification policy conditions, it is considered that the sent message has not been attacked or tampered with, that is, the verification is passed, and the verification policy toolbox transmits the separated initial information to the vehicle or device; If the unpacked information does not meet the verification strategy conditions, the verification fails and the vehicle or device refuses to receive the information. The verification strategy toolbox transmits the previous verified information to the vehicle or device as needed. The strategies of the verification strategy toolbox include static verification strategies and dynamic verification strategies; First, establish the state space model of the vehicle for x(t)∈R n is the vehicle state, u(t) is the vehicle control input, y(t) is the vehicle output, η(t) includes various sensor interferences and unknown inputs suffered by the vehicle, and matrices A, B, C, D, and G are all known matrices of appropriate dimensions; The information to be sent is represented by the subscript s, and the initial information x to be sent to other vehicles or devices s (t)∈R n , the packing process is as follows: (1) Generate verification information z s (t)∈R m : z s (t)=L σ x s (t)(2) Where L σ ∈R m×n To generate a matrix for verification information, its specific value or change rule is determined by the continuous verification strategy toolbox, which is mastered by the verification strategy toolboxes of both communicating parties; (2) Generate additional verification information θ s (t)∈R q : θ s The generation of (t) does not depend on the system state x s (t), including fixed values, variable functions, and uniform pseudo-random number generators, whose generation algorithms are also mastered by the verification strategy toolboxes of both communicating parties; The actual information sent is the initial information x s (t) Expanded to That is, the combination of initial information and additional information; in order to conceal The combination relationship of the verification strategy toolbox generates a full-rank matrix X σ ∈R (n+m+q)×(n+m+q) , corresponding to static time-invariant and dynamic time-variant, left multiplication Send it later, that is, the final message sent is The dimension of this full-rank matrix is ​​related to the actual information sent The dimensions are related.

2. According to claim 1, a zero-trust intelligent connected vehicle group information continuous verification strategy method is characterized by: The message received by the receiver is represented by the subscript r. Or M that has been tampered with by the attack s After that, use Separation information x r (t), z r (t) and θ r (t), if z r (t) = L σ x r (t) and the received θ r (t) and the self-verification strategy toolbox generated by θ s (t) is consistent with the corresponding θ(t), which means that the information has not changed during the transmission process; theoretically, the malicious attacker does not know L σ , X σ and the generation mechanism of θ(t), any changes All of them will destroy the verification relationship, resulting in information verification failure; r (t) = L σ x r (t) verifies whether x(t) and z(t) have changed respectively, and θ(t) verifies whether the overall information has changed in equal proportion.

3. According to claim 1, a zero-trust intelligent connected vehicle group information continuous verification strategy method is characterized by: For the above dynamic verification strategy, there is inevitably a delay in the information transmission process. When the information transmission happens to occur at the moment of strategy change, misjudgment may occur. Multiple dynamic verification strategies are used for coexisting verification.

4. A zero-trust intelligent connected vehicle group information continuous verification strategy method according to claim 2, characterized in that: From the vehicle group from the origin to the destination, the static strategy L σ and X σ is fixed; under dynamic strategy, L σ and X σ It changes according to the rules agreed upon by both parties, and the dimension of information changes, including: (1) Low-dimensional verification: When m < n, that is, the number of verification information is less than the number of initial information, the verification information is less, and the logical relationship that can be reflected is also less, and the verification of all the information in x(t) may be ignored; (2) Full-dimensional verification: When m = n, that is, the number of verification information is equal to the number of initial information, the verification information is comprehensive. σ When it is full rank, it reflects the logical relationship of all information in x(t); (3) High-dimensional verification: When m>n, that is, the number of verification information is greater than the number of initial information, there is more verification information, and more comprehensive logical relationships are constructed for judgment.

Images