In-vehicle data communication method and system

Abstract

The invention discloses an in-vehicle data communication method and system, and the method comprises the steps that a central gateway controller and different domain controllers mutually authenticate and negotiate corresponding first session keys, and the first session keys between the different domain controllers and the central gateway controller are different; each domain controller and the electronic controller in the domain mutually authenticate and negotiate a uniform second session key in the domain, and the second session keys between different domain controllers and the electronic controller in the domain are different; and performing in-vehicle data communication based on the first session key and the second session key. According to the in-vehicle data communication system, authentication and key negotiation are carried out in a layered mode, the in-vehicle information security level is improved, session keys in different domains are different, and communication level domain-divided security isolation is effectively achieved.

Description

Technical Field

[0001] The present application relates to the field of in-vehicle communication technology, and more specifically, to an in-vehicle data communication method and system. Background Art

[0002] With the development of Internet of Things technology and industrial automation, automobiles have begun to transform into digital and intelligent ones. Intelligent connected cars contain multiple network communication lines such as CAN, CAN-FD, LIN, FlexRay and Ethernet, and the car is divided into different functional domains according to the functions of the ECU.

[0003] However, currently only key communication signals and key component communications in the vehicle are subject to security authentication. All ECUs in the vehicle that participate in security authentication basically use the same key. Mutually authenticated components need to pre-embed a unified key in advance. A fixed key is used for each authentication and communication. Therefore, once an attacker breaks into an ECU and the key is leaked, he can launch a cross-cutting attack on the entire vehicle system, and the information security level in the vehicle is low. Summary of the invention

[0004] The present application provides an in-vehicle data communication method and system. The in-vehicle data communication system performs authentication and key negotiation in layers, thereby improving the information security level in the vehicle. In addition, the session keys in different domains are different, effectively realizing domain-by-domain security isolation at the communication level.

[0005] The present application provides an in-vehicle data communication method, comprising:

[0006] The central gateway controller and different domain controllers mutually authenticate and negotiate corresponding first session keys, and the first session keys between different domain controllers and the central gateway controller are different;

[0007] Each domain controller mutually authenticates with the electronic controller in the domain and negotiates a unified second session key in the domain, and the second session keys between different domain controllers and the electronic controllers in their domains are different;

[0008] In-vehicle data communication is performed based on the first session key and the second session key.

[0009] Preferably, the communication between different electronic controllers in the same domain specifically includes:

[0010] The first electronic controller encrypts the first original data using the second session key of the domain to which it belongs, to obtain first encrypted data;

[0011] The first electronic controller sends the first encrypted data to the second electronic controller in the same domain;

[0012] The second electronic controller decrypts the first encrypted data according to the second session key to obtain the first original data.

[0013] The present application also provides an in-vehicle data communication method, applicable to a domain controller, which includes:

[0014] Send a first token to the central gateway controller, and increment the first value of the first sending counter of the domain controller stored in the domain controller by 1, wherein the first token is obtained by encrypting the first encrypted data of the first layer authentication protocol, the first value of the first sending counter, the first unique identifier of the central gateway controller stored in the domain controller, the random value generated by the domain controller, and the second unique identifier of the domain controller itself;

[0015] Receive a second token sent by the central gateway controller, where the second token is obtained by encrypting the second encrypted data of the first layer authentication protocol, the first value of the second sending counter of the central gateway controller, the third unique identifier of the domain controller stored by the central gateway controller, the random value generated by the central gateway controller, the third session key corresponding to the domain controller, and the second value of the first sending counter obtained by decrypting the first token;

[0016] decrypting the second token using a first authentication key preset by the domain controller;

[0017] Verifying whether the third unique identifier of the domain controller obtained by decryption is the same as the second unique identifier of the domain controller;

[0018] If so, checking whether the third value of the first sending counter obtained by decryption is the same as the first value of the first sending counter in the first token;

[0019] If so, checking whether the second value of the second sending counter obtained by decryption is greater than the value of the first receiving counter stored in the domain controller;

[0020] If so, the value of the first receiving counter is updated with the second value of the second sending counter, and a first session key for communication between the domain controller and the central gateway controller is generated.

[0021] Preferably, the in-vehicle data communication method further includes:

[0022] Sending a third token to an electronic controller in the domain of the domain controller, and increasing the first value of a local third sending counter by 1, wherein the third token is obtained by encrypting according to the first value of the third sending counter, a fourth unique identifier of the electronic controller stored in the domain controller, a third session key corresponding to the domain controller, and the first encryption data of the second layer authentication protocol;

[0023] Receiving a fourth token sent by the electronic controller, where the fourth token is obtained by encrypting the first value of the fourth sending counter stored in the electronic controller, the second encrypted data of the second layer authentication protocol, the second value of the third sending counter obtained by decryption, the fifth unique identifier of the domain controller stored in the electronic controller, the sixth unique identifier of the electronic controller itself, and the first digest value of the third session key corresponding to the domain controller obtained by using a hash algorithm;

[0024] decrypting a fourth token using a first preset key of the electronic controller stored by the domain controller;

[0025] verifying whether the fifth unique identifier of the domain controller obtained by decryption is the same as the second unique identifier of the domain controller;

[0026] If so, checking whether the third value of the third sending counter obtained by decryption is the same as the first value of the third sending counter in the third token;

[0027] If yes, checking whether the second value of the fourth sending counter obtained by decryption is greater than the value of the second receiving counter stored in the domain controller;

[0028] If yes, then use the second value of the fourth sending counter to update the value of the second receiving counter, and use the hash algorithm to calculate the second digest value of the third session key corresponding to the domain controller, and compare the second digest value with the first digest value obtained by decryption for verification;

[0029] If the second digest value is the same as the first digest value, the third session key is used as the second session key within the domain of the domain controller.

[0030] The present application also provides an in-vehicle data communication method, applicable to a central gateway controller, comprising:

[0031] Receive a first token sent by the domain controller, where the first token is obtained by encrypting the first encrypted data of the first layer authentication protocol, the first value of the first sending counter stored by the domain controller, the first unique identifier of the central gateway controller stored by the domain controller, the random value generated by the domain controller, and the second unique identifier of the domain controller;

[0032] decrypting the first token using a second preset key of the domain controller stored by the central gateway controller;

[0033] Verify whether the first unique identifier of the central gateway controller obtained by decryption is the same as the seventh unique identifier of the central gateway controller itself;

[0034] If so, verify whether the second value of the first sending counter obtained by decryption is greater than the value of the third receiving counter stored in the central gateway controller;

[0035] If so, the value of the third receiver is updated with the second value of the first sending counter, and a second token is sent to the domain controller, and the first value of the second sending counter of the central gateway controller is incremented by 1; wherein the second token is obtained by encrypting the second encrypted data of the first layer authentication protocol, the first value of the second sending counter of the central gateway controller, the third unique identifier of the domain controller stored by the central gateway controller, the random value generated by the central gateway controller, the third session key corresponding to the domain controller, and the second value of the first sending counter;

[0036] If a message is received indicating that the domain controller has passed the verification of the second token, a first session key for communication between the domain controller and the central gateway controller is generated.

[0037] The present application also provides an in-vehicle data communication method, applicable to an electronic controller, comprising:

[0038] Receiving a third token of a domain controller to which the electronic controller belongs, the third token being obtained by encrypting according to a first value of a third sending counter, a fourth unique identifier of the electronic controller stored in the domain controller, a third session key corresponding to the domain controller, and first encrypted data of a second layer authentication protocol;

[0039] decrypting the third token using a second authentication key preset by the electronic controller;

[0040] Verifying whether the fourth unique identifier of the electronic controller obtained by decryption is the same as the sixth unique identifier of the electronic controller itself;

[0041] If yes, checking whether the second value of the third sending counter obtained by decryption is greater than the value of the fourth receiving counter stored by the electronic controller;

[0042] If so, the value of the fourth receiving counter is updated with the second value of the third sending counter, and a fourth token is sent to the domain controller, and the first value of the fourth sending counter of the electronic controller is incremented by 1; wherein the fourth token is obtained by encrypting the first value of the fourth sending counter stored in the electronic controller, the second encrypted data of the second layer authentication protocol, the second value of the third sending counter obtained by decryption, the fifth unique identifier of the domain controller stored in the electronic controller, the sixth unique identifier of the electronic controller itself, and the first digest value of the third session key corresponding to the domain controller obtained by using the hash algorithm;

[0043] If a message is received from the domain controller that the fourth token has passed verification, the third session key is used as the second session key within the domain of the domain controller.

[0044] Preferably, the electronic controller further performs key derivation or dispersion on the second session key according to a key matrix stored in the electronic controller.

[0045] The present application also provides an in-vehicle data communication system, comprising a central gateway controller, at least one domain controller, and at least one electronic controller within each domain controller domain;

[0046] Different domain controllers communicate with the central gateway controller using different first session keys;

[0047] Each domain controller communicates with the electronic controllers in its domain using a unified second session key.

[0048] Preferably, the domain controller includes a first token sending module, a first token receiving module, a first verification module, a first update module and a key generation module;

[0049] The first token sending module is used to send a first token to the central gateway controller, and to increase the first value of the first sending counter of the domain controller stored in the domain controller by 1, wherein the first token is obtained by encrypting the first encrypted data of the first layer authentication protocol, the first value of the first sending counter, the first unique identifier of the central gateway controller stored in the domain controller, the random value generated by the domain controller, and the second unique identifier of the domain controller itself;

[0050] The first token receiving module is used to receive a second token sent by the central gateway controller, where the second token is obtained by encrypting the second encrypted data of the first layer authentication protocol, the first value of the second sending counter of the central gateway controller, the third unique identifier of the domain controller stored by the central gateway controller, the random value generated by the central gateway controller, the third session key corresponding to the domain controller, and the second value of the first sending counter obtained by decrypting the first token;

[0051] The first verification module is used to decrypt the second token using the first authentication key preset by the domain controller; verify whether the third unique identifier of the domain controller obtained by decryption is the same as the second unique identifier of the domain controller; check whether the second value of the first sending counter obtained by decryption is the same as the first value of the first sending counter in the first token; check whether the second value of the second sending counter obtained by decryption is greater than the value of the first receiving counter stored in the domain controller;

[0052] The first updating module is used for updating the value of the first receiving counter with the second value of the second sending counter;

[0053] The key generation module is used to generate a first session key for communication between the domain controller and the central gateway controller.

[0054] Preferably, the domain controller further comprises a second token sending module, a second token receiving module, a second verification module, a second update module and a key determination module;

[0055] The second token sending module is used to send a third token to an electronic controller in the domain of the domain controller, and to increase the first value of the local third sending counter by 1, wherein the third token is obtained by encrypting according to the first value of the third sending counter, the fourth unique identifier of the electronic controller stored in the domain controller, the third session key corresponding to the domain controller, and the first encrypted data of the second layer authentication protocol;

[0056] The second token receiving module is used to receive a fourth token sent by the electronic controller, where the fourth token is obtained by encrypting the first value of the fourth sending counter stored in the electronic controller, the second encrypted data of the second layer authentication protocol, the second value of the third sending counter obtained by decryption, the fifth unique identifier of the domain controller stored in the electronic controller, the sixth unique identifier of the electronic controller itself, and the first digest value of the third session key corresponding to the domain controller obtained by using a hash algorithm;

[0057] The second verification module is used to decrypt the fourth token using the first preset key of the electronic controller stored in the domain controller; verify whether the fifth unique identifier of the domain controller obtained by decryption is the same as the second unique identifier of the domain controller; check whether the second value of the third sending counter obtained by decryption is the same as the first value of the third sending counter in the third token; check whether the second value of the fourth sending counter obtained by decryption is greater than the value of the second receiving counter stored in the domain controller; calculate the second digest value of the third session key corresponding to the domain controller by using a hash algorithm, and compare the second digest value with the first digest value obtained by decryption for verification;

[0058] The second updating module is used to update the value of the second receiving counter with the second value of the fourth sending counter;

[0059] The key determination module is used to use the third session key as the second session key within the domain of the domain controller.

[0060] Other features and advantages of the present application will become apparent from the following detailed description of exemplary embodiments of the present application with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the application and, together with the description, serve to explain the principles of the application.

[0062] Figure 1 A structural diagram of the in-vehicle data communication system provided for this application;

[0063] Figure 2 This is a flow chart of the in-vehicle data communication method provided by the present application. DETAILED DESCRIPTION

[0064] Various exemplary embodiments of the present application will now be described in detail with reference to the accompanying drawings. It should be noted that unless otherwise specifically stated, the relative arrangement of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present application.

[0065] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present application, its application, or uses.

[0066] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered part of the specification.

[0067] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0068] The present application provides an in-vehicle data communication method and system. The in-vehicle data communication system performs authentication and key negotiation in layers, thereby improving the information security level in the vehicle. In addition, the session keys in different domains are different, effectively realizing domain-by-domain security isolation at the communication level.

[0069] The in-vehicle data communication system provided by the present application includes a central gateway controller, at least one domain controller, and at least one electronic control unit (ECU) in each domain controller domain. The system implements a centralized one-to-many identity authentication and session key negotiation protocol, which is divided into two layers: the first layer is the identity authentication and key negotiation between the central gateway controller and each domain controller, and the second layer is the identity authentication and key negotiation between each domain controller and the ECU in its domain.

[0070] Different domain controllers communicate with the central gateway controller using different first session keys, and each domain controller communicates with the electronic controllers in its domain using a unified second session key, and different domain controllers correspond to different second session keys.

[0071] exist Figure 1 In the illustrated embodiment, the in-vehicle data communication system includes a central gateway controller A, a first domain controller B and a second domain controller X. The first domain controller B has ECU C and ECU D in its domain, and the second domain controller X has ECU E and ECU F in its domain.

[0072] Based on the above, if Figure 2 As shown, the in-vehicle data communication method provided by the present application includes:

[0073] S210: The central gateway controller and different domain controllers mutually authenticate and negotiate corresponding first session keys, and the first session keys between different domain controllers and the central gateway controller are different.

[0074] As an embodiment, before the vehicle leaves the manufacturer, a key needs to be preset. This key is used for identity authentication and needs to be stored for a long time. It cannot be cleared after the vehicle is powered off.

[0075] Specifically, the central gateway controller A needs to preset its own seventh unique identifier ID A , a sending counter for sending tokens to each domain controller and a receiving counter for receiving tokens from each domain controller (for example, a second sending counter TN for sending tokens to the first domain controller B) AB and a third reception counter N for receiving the token of the first domain controller B AB ), and stores the unique identifiers of all domain controllers (eg, the third unique identifier ID′ of the first domain controller B ) and the preset key corresponding to each domain controller (for example, the second preset key K corresponding to the first domain controller B B ).

[0076] Each domain controller needs to preset its own unique identifier, the authentication key between it and the central gateway controller, the sending counter of the token sent to the central gateway controller and the receiving counter of the token received from the central gateway controller, the sending counter of the token sent to each ECU in the domain and the receiving counter of the token received from each ECU in the domain, and store the first unique identifier ID′ of the central gateway controller A , stores the unique identifiers and corresponding preset keys of all ECUs in its domain.

[0077] Taking the first domain controller B as an example, the first domain controller B presets its own second unique identifier ID B , the first authentication key K′ B , the first sending counter TN of the token sent to the central gateway controller A BA and the first reception counter N of the token received from the central gateway controller A BA , a third sending counter TN for sending tokens to ECU C in the domain BC and the second reception counter N of the token of ECU C in the receiving domain BC , and store the first unique identifier ID′ of the central gateway controller A A , storing the fourth unique identifier ID′ of ECU C within its domain C and the corresponding first preset key K C .

[0078] Each ECU needs to preset its own unique identifier, the authentication key between it and the domain controller to which it belongs, the sending counter for sending tokens to the domain controller to which it belongs and the receiving counter for receiving tokens from the domain controller to which it belongs, and store the unique identifier of the domain controller of its domain.

[0079] Taking ECU C as an example, ECU C needs to preset its own sixth unique identifier ID C , the second authentication key K′ between it and the first domain controller B to which it belongs C , a fourth sending counter TN for sending a token to the first domain controller B to which it belongs CB and a fourth reception counter N of the token of the first domain controller B to which the token is received CB , and stores the fifth unique identifier ID″ of the first domain controller B in its domain B .

[0080] On the basis of the above, taking the first domain controller B as an example, the central gateway controller A and the first domain controller B mutually authenticate and negotiate the corresponding first session key, specifically including:

[0081] S2101: The first domain controller B sends an authentication request to the central gateway controller A.

[0082] Specifically, the first domain controller B sends a first token Token to the central gateway controller A BA , initiate this protocol, and send the first sending counter TN of the first domain controller B stored in the first domain controller B BA The first value of is incremented by 1.

[0083] Among them, the first token Token BA It is the first encrypted data according to the first layer authentication protocol The first transmission counter TN BA The first value of the first domain controller B stores the first unique identifier ID′ of the central gateway controller A. A , the random value F generated by the first domain controller B B and the second unique identifier ID of the first domain controller B itself B Encrypted to obtain:

[0084]

[0085] Among them, the encryption function e KB It is the SM4 block cipher algorithm or the AES symmetric encryption algorithm.

[0086] S2102: The central gateway controller A verifies the first domain controller B. If the verification is successful, an authentication request is sent to the first domain controller B.

[0087] Specifically, the central gateway controller A retrieves the second preset key K of the first domain controller B stored internally therein according to the received first token. B Decrypt the first token.

[0088] During verification, first verify the first unique identifier ID′ of the central gateway controller A obtained by decryption. A Is it the seventh unique identifier ID of the central gateway controller A itself? A If yes, then verify the first sending counter TN obtained by decryption BA The second value TN′ BA Is it greater than the third receiving counter N stored in the central gateway controller A? AB If yes, the verification is successful, and the central gateway controller A uses the first sending counter TN BA The second value TN′ BA Update the third receiver N AB The value of the token is sent to the first domain controller B. AB , to the second sending counter TN of the central gateway controller A AB The first value of is incremented by 1.

[0089] Among them, the second token Token AB It is the second encrypted data based on the first layer authentication protocol The second sending counter TN of the central gateway controller A AB The first value of the first domain controller B stored in the central gateway controller A, the third unique identifier ID′ B , the random value F generated by the central gateway controller A A , the third session key K′ corresponding to the first domain controller B GB and the first transmission counter TN BA The second value TN′ BA Encrypted to obtain:

[0090]

[0091] S2103: The first domain controller B receives the second token Token sent by the central gateway controller A AB And decrypt, the first domain controller B verifies the central gateway controller, and if the verification is successful, it sends a second token verification success message to the central gateway controller A.

[0092] Specifically, the first domain controller B uses the first authentication key K′ preset by the first domain controller B B Decrypt the second token AB .

[0093] During verification, first verify the third unique identifier ID′ of the first domain controller B obtained by decryption B Is it the second unique identifier ID of the first domain controller B? B If yes, check the first sending counter TN obtained by decryption BA The third value TN″ BA Is it the same as the first token? BA The first transmission counter TN BA If yes, check the second sending counter TN obtained by decryption AB The second value TN′ AB Is it greater than the first receiving counter N stored in the first domain controller B? BA If yes, the verification is successful.

[0094] After the verification is passed, the first domain controller B sends the second counter TN AB The second value TN′ AB Update the first receiving counter N BA value and sends a verification pass message to the central gateway controller A.

[0095] S2104: The central gateway controller A and the first domain controller B both generate a first session key K for communication between the first domain controller B and the central gateway controller A AB :

[0096]

[0097] Where f(·) is the key derivation function.

[0098] S220: Each domain controller mutually authenticates with the electronic controllers in the domain and negotiates a unified second session key in the domain. The second session keys between different domain controllers and the electronic controllers in their domains are different.

[0099] Taking the mutual authentication between the first domain controller B and the ECU C in its domain and negotiation of a unified second session key in the domain as an example, the specific steps include:

[0100] S2201: The first domain controller B sends a third session key to an electronic controller within the domain of the first domain controller.

[0101] Specifically, the first domain controller B sends a third token Token to ECU C BC , and send the counter TN to the local third BC The first value of is incremented by 1.

[0102] Among them, the third token Token BC is based on the third sending counter TN BCThe first value of , the fourth unique identifier ID′ of ECU C stored in the first domain controller B C , the third session key K′ corresponding to the first domain controller B GB And the first encrypted data of the second layer authentication protocol Encrypted to obtain:

[0103]

[0104] Among them, the encryption function e KC It is the SM4 block cipher algorithm or the AES symmetric encryption algorithm.

[0105] S2202: ECU C decrypts and verifies the third token. If the verification is successful, it sends the fourth token to the first domain controller B as a reply.

[0106] Specifically, ECU C uses its own preset second authentication key K′ C Decrypt the third token BC .

[0107] During verification, first verify the fourth unique identifier ID' of ECU C obtained by decryption C Is it the sixth unique identifier ID of ECU C itself? C If yes, check the third sending counter TN obtained by decryption BC The second value TN′ BC Is it greater than the fourth receiving counter N stored in ECU C? CB If yes, the verification is successful, and ECU C uses the third sending counter TN BC The second value TN′ BC Update the fourth receiving counter N CB The value of the token is sent to the first domain controller B. CB , to the fourth transmission counter TN of ECUC CB The first value of is incremented by 1.

[0108] Among them, the fourth token Token CB The fourth transmission counter TN stored in ECU C CB The first value of the second layer authentication protocol and the second encrypted data The third transmission counter TN obtained by decryption BC The second value TN′ BC , the fifth unique identifier ID″ of the first domain controller B stored in ECU C B 、The sixth unique identifier ID of ECU C itself C And the third session key K′ corresponding to the first domain controller B obtained by using the hash algorithmGB The first digest value is encrypted to obtain:

[0109]

[0110] S2203: The first domain controller B receives the fourth token Token CB Decryption and verification are performed. If the verification is successful, a verification success message is sent to ECUC.

[0111] Specifically, the first domain controller B receives the fourth token Token sent by ECU C CB Then, the first preset key K of ECU C stored in the first domain controller B is used C Decrypt the fourth token CB .

[0112] During verification, first verify the fifth unique identifier ID" of the first domain controller B obtained by decryption B Is it the second unique identifier ID of the first domain controller B? B If yes, check the third sending counter TN obtained by decryption BC The third value TN″ BC Is it consistent with the third sending counter TN in the third token BC If yes, check the fourth sending counter TN obtained by decryption CB The second value TN′ CB Is it greater than the second receiving counter N stored in the first domain controller B? BC If yes, the verification is successful, and the first domain controller B sends the fourth counter TN CB The second value TN′ CB Update the second receiving counter N BC The value of and the third session key K′ corresponding to the first domain controller B are calculated using a hash algorithm GB The second digest value is compared with the first digest value obtained by decryption. If the second digest value is the same as the first digest value, ECU C correctly receives the third session key K′ sent by the first domain controller B. GB , the first domain controller B sends a message to ECU C indicating that the fourth token verification has passed.

[0113] S2204: The third session key K′ GB As the second session key K in the first domain controller B domain GB , the first domain controller B broadcasts the second session key to other ECUs in its domain.

[0114] The second session key can be directly used for communication between all ECUs in the domain of the domain controller and between the domain controller and any ECU in the domain of the domain controller.

[0115] Preferably, the ECU in the domain can also derive keys of different message types within the ECU or perform key dispersion based on the second session key stored in the ECU.

[0116] S230: Carry out in-vehicle data communication based on the first session key and the second session key. Figure 1 , the communication between different electronic controllers in the same domain includes:

[0117] P1: The first electronic controller (such as ECU C) uses the second session key of its domain (such as K GB ) Encrypt the first original data to obtain first encrypted data.

[0118] P2: The first electronic controller sends the first encrypted data to a second electronic controller (eg, ECUD) in the same domain.

[0119] P3: The second electronic controller decrypts the first encrypted data according to the second session key to obtain the first original data.

[0120] When ECUs in the same domain communicate, the central gateway controller and the domain controller have authenticated and negotiated the first session key. The domain controller and each ECU in its domain have also confirmed the second session key. Data transmitted between different ECUs in the domain can be encrypted using the second session key to ensure confidentiality between data. Authentication between the controller and ECUs in the domain is also achieved, ensuring the authenticity of the data.

[0121] Specifically, the communication between electronic controllers in different domains includes:

[0122] Q1: The third electronic controller (such as ECU C) uses the second session key corresponding to its domain (such as K GB ) encrypts the second original data to obtain second encrypted data, and sends the second encrypted data to the first domain controller to which it belongs (for example, the first domain controller B).

[0123] Q2: The first domain controller uses its corresponding second session key to decrypt the second encrypted data to obtain the first decrypted data, and uses the first session key (e.g., K AB ) encrypts the first decrypted data to obtain third encrypted data, and sends the third encrypted data to the central gateway controller.

[0124] Q3: The central gateway controller uses the first session key between it and the first domain controller to decrypt the third encrypted data, obtain the second decrypted data, and uses the third session key (e.g., K AX ) encrypts the second decrypted data to obtain fourth encrypted data, and sends the fourth encrypted data to the second domain controller.

[0125] Q4: The second domain controller uses the third session key between it and the central gateway controller to decrypt the fourth encrypted data, obtain the third decrypted data, and use the fourth session key (e.g., K GX ) Encrypt the third decrypted data to obtain fifth encrypted data, and send it to a fourth electronic controller, which is an electronic controller within the domain of the second domain controller.

[0126] Q5: The fourth electronic controller decrypts the fifth encrypted data according to the fourth session key to obtain the second original data.

[0127] ECU communication between domains needs to be forwarded by their respective domain controllers and central gateway controllers. During data transmission, the session keys between nodes can be used for encryption and decryption operations to achieve data confidentiality.

[0128] Based on the above, the domain controller of the present application includes a first token sending module 310 , a first token receiving module 320 , a first verification module 330 , a first update module 340 and a key generation module 350 .

[0129] The first token sending module 310 is used to send a first token to the central gateway controller, and to increment the first value of the first sending counter of the domain controller stored in the domain controller by 1. The first token is obtained by encrypting the first encrypted data of the first layer authentication protocol, the first value of the first sending counter, the first unique identifier of the central gateway controller stored in the domain controller, the random value generated by the domain controller, and the second unique identifier of the domain controller itself.

[0130] The first token receiving module 320 is used to receive a second token sent by the central gateway controller. The second token is encrypted based on the second encrypted data of the first layer authentication protocol, the first value of the second sending counter of the central gateway controller, the third unique identifier of the domain controller stored by the central gateway controller, the random value generated by the central gateway controller, the third session key corresponding to the domain controller, and the second value of the first sending counter obtained by decrypting the first token.

[0131] The first verification module 330 is used to decrypt the second token using the first authentication key preset by the domain controller; verify whether the third unique identifier of the domain controller obtained by decryption is the same as the second unique identifier of the domain controller; check whether the second value of the first sending counter obtained by decryption is the same as the first value of the first sending counter in the first token; check whether the second value of the second sending counter obtained by decryption is greater than the value of the first receiving counter stored in the domain controller.

[0132] The first updating module 340 is configured to update the value of the first receiving counter with the second value of the second sending counter.

[0133] The key generation module 350 is used to generate a first session key for communication between the domain controller and the central gateway controller.

[0134] The domain controller also includes a second token sending module 360 ​​, a second token receiving module 370 , a second verification module 380 , a second update module 390 and a key determination module 3100 .

[0135] The second token sending module 360 ​​is used to send a third token to an electronic controller within the domain of the domain controller, and to increment the first value of the local third sending counter by 1. The third token is obtained by encrypting the first value of the third sending counter, the fourth unique identifier of the electronic controller stored in the domain controller, the third session key corresponding to the domain controller, and the first encrypted data of the second layer authentication protocol.

[0136] The second token receiving module 370 is used to receive the fourth token sent by the electronic controller. The fourth token is obtained by encrypting the first value of the fourth sending counter stored in the electronic controller, the second encrypted data of the second layer authentication protocol, the second value of the third sending counter obtained by decryption, the fifth unique identifier of the domain controller stored in the electronic controller, the sixth unique identifier of the electronic controller itself, and the first summary value of the third session key corresponding to the domain controller obtained by using the hash algorithm.

[0137] The second verification module 380 is used to decrypt the fourth token using the first preset key of the electronic controller stored in the domain controller; verify whether the fifth unique identifier of the domain controller obtained by decryption is the same as the second unique identifier of the domain controller; check whether the second value of the third sending counter obtained by decryption is the same as the first value of the third sending counter in the third token; check whether the second value of the fourth sending counter obtained by decryption is greater than the value of the second receiving counter stored in the domain controller; use a hash algorithm to calculate the second digest value of the third session key corresponding to the domain controller, and compare the second digest value with the first digest value obtained by decryption for verification.

[0138] The second updating module 390 is configured to update the value of the second receiving counter with the second value of the fourth sending counter.

[0139] The key determination module 3100 is configured to use the third session key as a second session key within the domain of the domain controller.

[0140] This application implements hierarchical authentication and key negotiation of the central gateway controller, domain controller, and ECU, and different functional domains generate different session keys. The leakage of a single ECU key will not affect the authentication and communication between the gateway, domain controller, and ECUs in other domains, and realizes domain-by-domain security isolation at the key level, and realizes the authenticity, confidentiality, and anti-replay of in-vehicle communications. In addition, the protocol of this application only relies on the random number generation capability of the gateway, and does not make strong assumptions about the capabilities of the domain controller and the ECUs in the domain, which is more suitable for the actual in-vehicle environment.

[0141] Although some specific embodiments of the present application have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are only for illustration, not for limiting the scope of the present application. It should be understood by those skilled in the art that the above embodiments may be modified without departing from the scope and spirit of the present application. The scope of the present application is defined by the appended claims.

Claims

1. A method for in-vehicle data communication, characterized in that: include: The central gateway controller and different domain controllers mutually authenticate and negotiate corresponding first session keys, and the first session keys between different domain controllers and the central gateway controller are different; Each domain controller mutually authenticates with the electronic controller in the domain and negotiates a unified second session key in the domain, and the second session keys between different domain controllers and the electronic controllers in their domains are different; In-vehicle data communication is performed based on the first session key and the second session key.

2. The in-vehicle data communication method according to claim 1, characterized in that: Communication between different electronic controllers in the same domain, including: The first electronic controller encrypts the first original data using the second session key of the domain to which it belongs, to obtain first encrypted data; The first electronic controller sends the first encrypted data to a second electronic controller in the same domain; The second electronic controller decrypts the first encrypted data according to the second session key to obtain the first original data.

3. A method for in-vehicle data communication, applicable to a domain controller, characterized in that: include: Send a first token to the central gateway controller, and increment the first value of the first sending counter of the domain controller stored in the domain controller by 1, wherein the first token is obtained by encrypting the first encrypted data of the first layer authentication protocol, the first value of the first sending counter, the first unique identifier of the central gateway controller stored in the domain controller, the random value generated by the domain controller, and the second unique identifier of the domain controller itself; Receive a second token sent by the central gateway controller, where the second token is encrypted according to the second encrypted data of the first layer authentication protocol, the first value of the second sending counter of the central gateway controller, the third unique identifier of the domain controller stored by the central gateway controller, the random value generated by the central gateway controller, the third session key corresponding to the domain controller, and the second value of the first sending counter obtained by decrypting the first token; decrypting the second token using a first authentication key preset by the domain controller; Verifying whether the third unique identifier of the domain controller obtained by decryption is the same as the second unique identifier of the domain controller; If yes, checking whether the third value of the first sending counter obtained by decryption is the same as the first value of the first sending counter in the first token; If so, checking whether the second value of the second sending counter obtained by decryption is greater than the value of the first receiving counter stored in the domain controller; If so, the value of the first receiving counter is updated with the second value of the second sending counter, and a first session key for communication between the domain controller and the central gateway controller is generated.

4. The in-vehicle data communication method according to claim 3, characterized in that: Also includes: Sending a third token to an electronic controller in the domain of the domain controller, and increasing the first value of a local third sending counter by 1, wherein the third token is obtained by encrypting according to the first value of the third sending counter, a fourth unique identifier of the electronic controller stored in the domain controller, a third session key corresponding to the domain controller, and the first encryption data of the second layer authentication protocol; receiving a fourth token sent by the electronic controller, wherein the fourth token is obtained by encrypting the first value of the fourth sending counter stored in the electronic controller, the second encrypted data of the second layer authentication protocol, the second value of the third sending counter obtained by decryption, the fifth unique identifier of the domain controller stored in the electronic controller, the sixth unique identifier of the electronic controller itself, and the first digest value of the third session key corresponding to the domain controller obtained by using a hash algorithm; decrypting the fourth token using a first preset key of the electronic controller stored by the domain controller; Verifying whether the fifth unique identifier of the domain controller obtained by decryption is the same as the second unique identifier of the domain controller; If yes, checking whether the third value of the third sending counter obtained by decryption is the same as the first value of the third sending counter in the third token; If so, checking whether the second value of the fourth sending counter obtained by decryption is greater than the value of the second receiving counter stored in the domain controller; If so, update the value of the second receiving counter with the second value of the fourth sending counter, calculate the second digest value of the third session key corresponding to the domain controller by using a hash algorithm, and compare and verify the second digest value with the first digest value obtained by decryption; If the second digest value is the same as the first digest value, the third session key is used as the second session key within the domain of the domain controller.

5. A method for in-vehicle data communication, applicable to a central gateway controller, characterized in that: include: Receive a first token sent by a domain controller, where the first token is obtained by encrypting the first encrypted data of the first layer authentication protocol, the first value of the first sending counter stored by the domain controller, the first unique identifier of the central gateway controller stored by the domain controller, the random value generated by the domain controller, and the second unique identifier of the domain controller; decrypting the first token using a second preset key of the domain controller stored by the central gateway controller; Verify whether the first unique identifier of the central gateway controller obtained by decryption is the same as the seventh unique identifier of the central gateway controller itself; If so, verify whether the second value of the first sending counter obtained by decryption is greater than the value of the third receiving counter stored in the central gateway controller; If so, the value of the third receiver is updated with the second value of the first sending counter, and a second token is sent to the domain controller, and the first value of the second sending counter of the central gateway controller is incremented by 1; wherein the second token is obtained by encrypting the second encrypted data of the first layer authentication protocol, the first value of the second sending counter of the central gateway controller, the third unique identifier of the domain controller stored by the central gateway controller, the random value generated by the central gateway controller, the third session key corresponding to the domain controller, and the second value of the first sending counter; If a message indicating that the domain controller has passed the verification of the second token is received, a first session key for communication between the domain controller and the central gateway controller is generated.

6. A method for in-vehicle data communication, applicable to an electronic controller, characterized in that: include: Receiving a third token of a domain controller to which the electronic controller belongs, the third token being obtained by encrypting according to a first value of a third sending counter, a fourth unique identifier of the electronic controller stored in the domain controller, a third session key corresponding to the domain controller, and first encryption data of a second layer authentication protocol; Decrypting the third token using a second authentication key preset by the electronic controller; Verifying whether the fourth unique identifier of the electronic controller obtained by decryption is the same as the sixth unique identifier of the electronic controller itself; If so, checking whether the second value of the third sending counter obtained by decryption is greater than the value of the fourth receiving counter stored by the electronic controller; If so, the value of the fourth receiving counter is updated with the second value of the third sending counter, and a fourth token is sent to the domain controller, and the first value of the fourth sending counter of the electronic controller is incremented by 1; wherein the fourth token is obtained by encrypting the first value of the fourth sending counter stored in the electronic controller, the second encrypted data of the second layer authentication protocol, the second value of the third sending counter obtained by decryption, the fifth unique identifier of the domain controller stored in the electronic controller, the sixth unique identifier of the electronic controller itself, and the first digest value of the third session key corresponding to the domain controller obtained by using the hash algorithm; If a message is received indicating that the domain controller has passed verification of the fourth token, the third session key is used as the second session key within the domain of the domain controller.

7. The in-vehicle data communication method according to claim 6, characterized in that: The electronic controller also performs key derivation or dispersion on the second session key according to a key matrix stored in the electronic controller.

8. An in-vehicle data communication system, characterized in that: including a central gateway controller, at least one domain controller, and at least one electronic controller within each domain controller domain; Different domain controllers communicate with the central gateway controller using different first session keys; Each domain controller communicates with the electronic controllers in its domain using a unified second session key.

9. The in-vehicle data communication system according to claim 8, characterized in that: The domain controller includes a first token sending module, a first token receiving module, a first verification module, a first update module and a key generation module; The first token sending module is used to send a first token to the central gateway controller, and to increase the first value of the first sending counter of the domain controller stored in the domain controller by 1, wherein the first token is obtained by encrypting the first encrypted data of the first layer authentication protocol, the first value of the first sending counter, the first unique identifier of the central gateway controller stored in the domain controller, the random value generated by the domain controller, and the second unique identifier of the domain controller itself; The first token receiving module is used to receive a second token sent by the central gateway controller, where the second token is encrypted according to the second encrypted data of the first layer authentication protocol, the first value of the second sending counter of the central gateway controller, the third unique identifier of the domain controller stored by the central gateway controller, the random value generated by the central gateway controller, the third session key corresponding to the domain controller, and the second value of the first sending counter obtained by decrypting the first token; The first verification module is used to decrypt the second token using a first authentication key preset by the domain controller; Verifying whether the third unique identifier of the domain controller obtained by decryption is the same as the second unique identifier of the domain controller; Check whether the second value of the first sending counter obtained by decryption is the same as the first value of the first sending counter in the first token; Check whether the second value of the second sending counter obtained by decryption is greater than the value of the first receiving counter stored in the domain controller; The first updating module is used to update the value of the first receiving counter with the second value of the second sending counter; The key generation module is used to generate a first session key for communication between the domain controller and the central gateway controller.

10. The in-vehicle data communication system according to claim 9, characterized in that: The domain controller also includes a second token sending module, a second token receiving module, a second verification module, a second update module and a key determination module; The second token sending module is used to send a third token to an electronic controller in the domain of the domain controller, and to increase the first value of the local third sending counter by 1, wherein the third token is obtained by encrypting according to the first value of the third sending counter, a fourth unique identifier of the electronic controller stored in the domain controller, a third session key corresponding to the domain controller, and the first encryption data of the second layer authentication protocol; The second token receiving module is used to receive a fourth token sent by the electronic controller, wherein the fourth token is obtained by encrypting the first value of the fourth sending counter stored in the electronic controller, the second encrypted data of the second layer authentication protocol, the second value of the third sending counter obtained by decryption, the fifth unique identifier of the domain controller stored in the electronic controller, the sixth unique identifier of the electronic controller itself, and the first digest value of the third session key corresponding to the domain controller obtained by using a hash algorithm; The second verification module is used to decrypt the fourth token using the first preset key of the electronic controller stored in the domain controller; verify whether the fifth unique identifier of the domain controller obtained by decryption is the same as the second unique identifier of the domain controller; check whether the second value of the third sending counter obtained by decryption is the same as the first value of the third sending counter in the third token; check whether the second value of the fourth sending counter obtained by decryption is greater than the value of the second receiving counter stored in the domain controller; calculate the second digest value of the third session key corresponding to the domain controller by using a hash algorithm, and compare the second digest value with the first digest value obtained by decryption for verification; The second updating module is used to update the value of the second receiving counter with the second value of the fourth sending counter; The key determination module is used to use the third session key as the second session key within the domain of the domain controller.

Images