Bus message security protection method and system and electronic equipment

Abstract

The invention belongs to the technical field of network security and function security of intelligent networked automobiles, and particularly discloses a bus message security protection method and system and electronic equipment.The bus message security protection method comprises the steps that in the design stage, the network security requirement of an in-vehicle bus is determined through security analysis, a jitter attribute is added to a security key message, and the security key message is obtained; carrying out schedulability analysis on the CAN messages, and calculating response time of each message by evaluating the worst execution time, the message period, the message deadline, the queuing jitter time and the priority of each message; in the operation stage, in each message response time, through transverse security detection and longitudinal security detection, performing abnormality judgment on security key messages, and discarding the messages greater than an acceptable threshold value of the number of times of limitation; and adding the messages of which the times are less than or equal to the limited times into a message queue, and waiting for bus arbitration and transmission. According to the invention, while the network security of the in-vehicle bus is improved, the safety of the vehicle driving function is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network security and functional safety of intelligent connected vehicles, and in particular to a bus message security protection method, system and electronic equipment. Background Art

[0002] With the integration and development of automobile and information and communication technology, more and more automotive electronic functions are installed in cars. As the number of on-board computers in cars continues to increase, the design of in-vehicle buses has been severely challenged in terms of bandwidth optimization and functional safety assurance. On the one hand, the CAN bus, or controller area network bus, is the most widely used network technology in cars. It is also used in many industrial fields such as robots, factory automation, aircraft and medical equipment. However, the CAN bus protocol does not use verification or encryption to protect the network security. At present, most of the security protection measures for the CAN bus, such as message encryption, adding MAC code to the message payload and network intrusion detection, do not take into account the insufficient constraints of on-board computers in terms of resource limitations and latency requirements. Therefore, it is extremely vulnerable to network attacks. In particular, with the development of networking, the attack surface of cars being maliciously attacked is constantly expanding. Now attackers attack messages from the on-board physical interface and the on-board wireless interface to the in-vehicle network, which brings great safety risks to the driving of vehicles. On the other hand, automotive electronic functions have strict real-time requirements. If the message instructions are not responded to in time, it may cause catastrophic consequences and even threaten the lives of passengers.

[0003] Therefore, it is currently impossible to improve the security capabilities of the in-vehicle bus network while ensuring that the messages in the in-vehicle bus can meet the real-time requirements and ensure the safety of the car's driving functions. Summary of the invention

[0004] The present invention aims to provide a bus message security protection method, system and electronic device to solve or improve the problem of being unable to ensure the safety of automobile driving functions while considering improving the security capabilities of the in-vehicle bus network.

[0005] In view of this, a first aspect of the present invention is to provide a bus message security protection method, comprising:

[0006] In any of the above technical solutions, S1. During the design phase, the network security requirements of the in-vehicle bus are determined through security analysis, and jitter attributes are added to the security-critical messages in the vehicle environment to obtain security-critical messages, wherein the security-critical messages are messages that may cause security risks if tampered with or lost, including; worst execution time, message cycle, message deadline, queue jitter time and priority;

[0007] Perform schedulability analysis on CAN messages, and calculate the response time of each message by evaluating the worst execution time, message cycle, message deadline, queue jitter time, and priority of each message. CAN is the abbreviation of Controller Area Network, which is a serial communication protocol bus used for real-time applications.

[0008] S2. During the operation phase, based on the attribute parameters of the safety-critical message, within the response time of each message, the safety-critical message is judged to be abnormal through lateral safety detection based on vehicle dynamics analysis and longitudinal safety detection based on data change degree analysis, and messages with a number of times greater than the limit threshold are discarded;

[0009] S3. Add messages less than or equal to the limit number threshold to the message queue, waiting for bus arbitration and transmission.

[0010] In any of the above technical solutions, the size of the queuing jitter time is equal to the delay between the lateral safety analysis based on vehicle dynamics and the longitudinal safety analysis based on the degree of data change.

[0011] In any of the above technical solutions, the lateral safety detection includes: obtaining the physical meaning of the signal actually contained in the message, substituting the sensor value in the message into the vehicle dynamics model, and determining whether the incoming sensor value is abnormal. If so, discard the message; if not, perform longitudinal safety detection on the message.

[0012] In any of the above technical solutions, the longitudinal safety detection includes: comparing the numerical value of the physical quantity contained in the message with the normal value of the physical quantity, and if the difference exceeds the difference threshold, it is counted as an abnormality.

[0013] In any of the above technical solutions, the vertical security detection also includes: setting an acceptable abnormal number threshold, defining messages exceeding the abnormal number threshold as abnormal messages and discarding them.

[0014] In any of the above technical solutions, each message response time is calculated using each message response time formula.

[0015] In any of the above technical solutions, the formula for each message response time is as follows:

[0016] R i =J i +w i +C i

[0017] Among them, R i represents the response time of each message, J i Indicates the queue jitter time, w i represents the queuing delay, C iIndicates the worst execution time of the message.

[0018] In any of the above technical solutions, the lateral safety detection is based on the analysis of vehicle dynamics, taking into account the correlation between multiple data, and the longitudinal safety detection is based on the analysis of the degree of data change, detecting the actual physical quantity changes reflected by the incoming message.

[0019] The second aspect of the present invention is to provide a bus message security protection system, comprising:

[0020] A design module (201) is used to determine the network security requirements of the in-vehicle bus through security analysis during the design phase, and to add jitter attributes to the safety-critical messages in the vehicle environment to obtain safety-critical messages, wherein the safety-critical messages are messages that may cause safety hazards if tampered with or lost, and include: worst execution time, message cycle, message deadline, queue jitter time and priority;

[0021] Perform schedulability analysis on CAN messages, and calculate the response time of each message by evaluating the worst execution time, message cycle, message deadline, queue jitter time, and priority of each message. CAN is the abbreviation of Controller Area Network, which is a serial communication protocol bus used for real-time applications.

[0022] An operation module (202) is used to, during the operation phase, based on the attribute parameters of the safety-critical message, perform abnormality judgment on the safety-critical message through lateral safety detection based on vehicle dynamics analysis and longitudinal safety detection based on data change degree analysis within the response time of each message, and discard messages with a number of times greater than a limit threshold;

[0023] The transmission module (203) is used to add messages less than or equal to the limit number threshold to the message queue, waiting for bus arbitration and transmission.

[0024] A third aspect of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned bus message security protection method when executing the computer program.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. The present invention uses scheduling analysis to ensure the real-time transmission of messages, takes into account the delay overhead caused by network security protection during design, and adopts a method that combines lateral analysis based on vehicle dynamics with longitudinal analysis and detection based on the degree of data change during operation, thereby improving the network security capability of the in-vehicle bus and effectively curbing malicious tampering attacks on CAN bus messages;

[0027] 2. The present invention increases jitter properties by clarifying the delay overhead caused by network security protection, ensuring that the messages in the in-vehicle bus meet the real-time requirements;

[0028] 3. The present invention adopts a collaborative approach of design-time analysis and runtime detection to improve the network security capability of the in-vehicle bus while ensuring the safety of the vehicle driving function. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0030] Figure 1 A flowchart of a bus message security protection method of the present invention;

[0031] Figure 2 A block diagram of a bus message security protection system of the present invention;

[0032] Figure 3 The figure is a schematic diagram of an electronic device of the present invention. DETAILED DESCRIPTION

[0033] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0034] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0035] See also Figure 1-Figure 3 , the following describes a bus message security protection method, system and electronic device of the present invention.

[0036] Figure 1 The present invention is a flowchart of a bus message security protection method.

[0037] In some embodiments of the present invention, Figure 1 As shown, the bus message security protection method includes:

[0038] S1. During the design phase, determine the network security requirements of the in-vehicle bus through security analysis, and add jitter properties to the safety-critical messages in the vehicle environment to obtain safety-critical messages, where safety-critical messages are messages that may cause safety hazards if tampered or lost, including; worst execution time, message cycle, message deadline, queue jitter time and priority;

[0039] In one embodiment, the present invention relates to the process of vehicle network communication to ensure the transmission security of safety-critical messages. The solution of the present invention is applied to the vehicle controller local area network. The messages transmitted during the communication process include safety-critical messages and non-safety-critical messages, among which safety-critical messages are very likely to cause safety hazards, while non-safety-critical messages are very unlikely to cause safety hazards; at the same time, due to real-time requirements, not all messages are detected, only safety-critical messages are detected to reduce overhead, and non-safety-critical messages are directly entered into the ready queue after the message is ready. The above parameters contained in the safety-critical message are crucial to ensure the reliability of the vehicle system when it is subject to potential attacks or failures. Specifically, the worst execution time refers to the longest time for message processing under the most unfavorable conditions, the message cycle is the frequency of message sending, the message deadline is the last time point when the message needs to be processed, and the queue jitter time is the message processing delay caused by changes in system load.

[0040] Among them, security analysis refers to the evaluation of the security of the system under potential threats and attacks during the system design process; network security requirements refer to a series of technical requirements set to ensure the security of the system; bus is usually a broader term, referring to the data transmission network within the vehicle, including various vehicle communication networks such as CAN. The bus is a bridge for communication between on-board computers. In a complex vehicle electronic architecture, multiple on-board computers communicate with each other through the bus to achieve coordinated control of various functional modules of the vehicle. The on-board computer is an electronic controller that controls various subsystems of the car. Modern cars usually contain multiple on-board computers, responsible for different functional modules. Among them, the parameter representing the jitter attribute is the queue jitter time.

[0041] Among them, CAN (Controller Area Network), translated into Chinese as Controller Area Network Bus, is a specific bus protocol used for real-time data transmission.

[0042] Perform schedulability analysis on CAN messages, and calculate the response time of each message by evaluating the worst execution time, message cycle, message deadline, queue jitter time, and priority of each message. CAN is the abbreviation of Controller Area Network, which is a serial communication protocol bus used for real-time applications.

[0043] In one embodiment, each onboard computer sends and receives control instructions or sensor data via the in-vehicle bus. For example, the onboard computer of the braking system may obtain vehicle speed information via the CAN bus and issue a braking command based on the vehicle speed information. The present invention performs schedulability analysis on CAN messages to ensure that each message can be processed on time, thereby preventing safety hazards caused by message loss or delay.

[0044] Each message response time is calculated by the each message response time formula.

[0045] In one embodiment, during the design phase, the response time of each message is calculated to determine whether the messages can be processed within the specified time, ie, before the message deadline, to ensure real-time requirements.

[0046] In one embodiment, the specified time, which usually refers to the maximum allowed time required by the system or application, is a target or standard, the response time is the actual performance, and the delay, i.e., the queuing delay, is a factor affecting the response time. Ensuring that the delay is controlled within a reasonable range helps to meet the specified time requirements. Although the response time is closely related to the worst execution time, delay, and queuing jitter time, considering the message cycle, deadline, and priority is also a necessary measure to ensure the overall performance and security of the system.

[0047] Each message m i They are composed of the following properties:

[0048] (C i ,T i ,D i ,J i ,P i )

[0049] Among them, C i represents the worst execution time of the message, i represents a positive integer, T i Indicates the message cycle, D i Indicates the message deadline, J i Indicates the message jitter time, P i Indicates priority, P i The smaller the value, the higher the message priority; the queue jitter time corresponds to the maximum time from the initial event to the message arriving at the ready queue. The size of the jitter time is equal to the delay between the lateral safety analysis based on the analysis of vehicle dynamics and the longitudinal safety analysis based on the analysis of the degree of data change.

[0050] Among them, the worst execution time of the message, message cycle, message deadline, queue jitter time and priority are all known, but the message response time is unknown. The message response time is calculated through message schedulability analysis.

[0051] The formula for each message response time is as follows:

[0052] R i =J i +w i +C i

[0053] Among them, R i Indicates the response time of each message, w i Represents the queuing delay, which is the maximum time a message can stay in the ready queue before being transmitted on the bus.

[0054] The above formula will help designers better understand the calculation process, enabling them to adjust the message scheduling strategy according to actual needs and optimize system performance.

[0055] The lateral safety detection is based on the analysis of vehicle dynamics, taking into account the correlation between multiple data, and the longitudinal safety detection is based on the analysis of the degree of data change, detecting the actual physical quantity changes reflected by the incoming message.

[0056] The present invention analyzes the real-time performance of messages through a CAN message scheduling algorithm. If the response time of all messages is less than the deadline of the message, the message set is deemed to be schedulable, that is, it can be added to the message queue and wait for bus arbitration and transmission.

[0057] The above method combines the two dimensions of vehicle dynamics and data analysis to provide a comprehensive safety detection solution, enabling the system to monitor and respond to potential safety threats in real time, thereby ensuring the safe operation of the vehicle.

[0058] S2. During the operation phase, based on the attribute parameters of the safety-critical message, within the response time of each message, the safety-critical message is judged to be abnormal through lateral safety detection based on vehicle dynamics analysis and longitudinal safety detection based on data change degree analysis, and messages with a number of times greater than the limit threshold are discarded;

[0059] In one embodiment, during the operation phase, the system uses the safety-critical messages obtained during the design phase to implement lateral safety detection and longitudinal safety detection. The main goal of this phase is to monitor the messages transmitted by the in-vehicle bus in real time to identify potential abnormal behaviors. In the lateral safety detection, the system will parse the actual signals contained in the message and combine these signals with the vehicle dynamics model to analyze whether there are unreasonable changes in the sensor values. If the incoming sensor data is found to deviate from the expected, the system will mark it as a suspicious message. At the same time, in the longitudinal safety detection, the system will compare the numerical value of the physical quantity in the message with the preset normal range. If the difference is found to exceed the set threshold, the message will be recorded as an abnormality. Finally, the system will determine whether the message has an abnormality based on the set acceptable number of abnormalities. If it occurs, it will be discarded. All messages exceeding the threshold will be immediately discarded to ensure that the overall safety and reliability of the system are not affected. This process ensures that all critical messages are under monitoring during operation, and potential security threats are identified and handled in a timely manner.

[0060] S3. Add messages less than or equal to the limit number threshold to the message queue, waiting for bus arbitration and transmission.

[0061] In one embodiment, after completing the abnormal judgment, the system will include all messages that are less than or equal to the acceptable limit number threshold into the message queue. This step is crucial because it ensures that messages that have passed the safety test can continue to participate in the subsequent bus arbitration and transmission process. The construction of the message queue not only depends on the results of the safety analysis, but also involves the reasonable management of message priorities. The system will adjust the position of each message in the queue according to its priority and real-time requirements to ensure that the most critical messages are processed first. This dynamic management mechanism helps the system maintain efficient operation under high load conditions and effectively prevents safety hazards caused by delays in important messages. In this way, the system can ensure the smooth transmission of safety-critical messages, thereby ensuring the safety and stability of the vehicle under various operating conditions.

[0062] In one embodiment, since CAN messages usually include: identifier ID, data length, data content, etc. When multiple on-board computer nodes on the bus send messages at the same time, in order to effectively manage and prioritize transmission, arbitration is performed by comparing the identifier IDs of the messages. The smaller the identifier ID, the greater the priority. The message that wins the arbitration can be transmitted to all nodes on the bus, and each node decides whether to process the received message based on the message ID.

[0063] The size of the queue jitter time is equal to the delay between the lateral analysis based on vehicle dynamics and the longitudinal safety analysis based on the degree of data change.

[0064] In one embodiment, the queue jitter time is not only related to the priority of the message, but also closely related to the dynamic behavior of the vehicle. By analyzing the dynamic response of the vehicle under different operating conditions, the actual delay in message processing can be accurately calculated, providing a reliable basis for subsequent safety detection.

[0065] The lateral safety detection includes: obtaining the physical meaning of the signal actually contained in the message, substituting the sensor value in the message into the vehicle dynamics model, and determining whether the incoming sensor value is abnormal. If so, discard the message; if not, perform longitudinal safety detection on the message.

[0066] In one embodiment, during the lateral safety detection process, the sensor data carried in the message must first be parsed to understand its physical meaning, and then the data must be substituted into the vehicle dynamics model for verification to determine whether the actual situation is consistent with the model prediction. This comparison can reveal potential sensor failures or attack behaviors, so that corresponding safety measures can be taken.

[0067] The longitudinal safety detection includes: comparing the value of the physical quantity contained in the message with the normal value of the physical quantity, and if the difference exceeds a difference threshold, it is counted as an abnormality.

[0068] In one embodiment, during longitudinal safety detection, the system will compare the values ​​reported by the sensor with the preset normal range. Any abnormal data exceeding the threshold will be marked as a potential threat, triggering further safety processing procedures. This ensures that the system responds to abnormal behavior in a timely manner, helping to protect the overall safety of the vehicle.

[0069] The vertical security detection also includes: setting an acceptable abnormal number threshold, defining messages exceeding the abnormal number threshold as abnormal messages and discarding them.

[0070] In one embodiment, by setting an abnormal number threshold, occasional abnormal fluctuations can be tolerated within a certain range. Once the abnormal number threshold is exceeded, the system will immediately discard the message to prevent it from affecting the stability of the system. This measure helps maintain the long-term reliability of the system and avoid unnecessary security alerts caused by a single abnormal data.

[0071] The present invention effectively responds to malicious tampering attacks and promptly prevents malicious messages from entering the CAN bus network by clarifying the delay overhead caused by network security protection; by ensuring the real-time transmission of messages through scheduling analysis, a method combining lateral analysis based on vehicle dynamics with longitudinal analysis and detection based on the degree of data change is adopted during operation to improve the network security capability of the in-vehicle bus; by adopting a collaborative approach of design-time analysis and runtime detection, the network security of the in-vehicle bus is improved while ensuring the safety of the vehicle's driving functions.

[0072] Figure 2 The present invention is a block diagram of a bus message security protection system.

[0073] The embodiment of the second aspect of the present invention further provides a bus message security protection system, including:

[0074] The design module 201 is used to determine the network security requirements of the in-vehicle bus through security analysis during the design phase, and to add jitter attributes to the safety-critical messages in the vehicle environment to obtain safety-critical messages, wherein the safety-critical messages are messages that may cause safety hazards if tampered or lost, including; worst execution time, message cycle, message deadline, queue jitter time and priority;

[0075] Perform schedulability analysis on CAN messages, and calculate the response time of each message by evaluating the worst execution time, message cycle, message deadline, queue jitter time, and priority of each message. CAN is the abbreviation of Controller Area Network, which is a serial communication protocol bus used for real-time applications.

[0076] The operation module 202 is used to perform abnormality judgment on the critical safety message based on the attribute parameters of the critical safety message and within the response time of each message through lateral safety detection based on vehicle dynamics analysis and longitudinal safety detection based on data change degree analysis during the operation phase, and discard messages with a number of times greater than a limit threshold;

[0077] The transmission module 203 is used to add messages less than or equal to the limit number threshold to the message queue, waiting for bus arbitration and transmission.

[0078] Figure 3 The figure is a schematic diagram of an electronic device of the present invention.

[0079] Embodiments of the third aspect of the present invention provide electronic devices. In some embodiments of the present invention, such as Figure 3 As shown, an electronic device is provided, which includes: electronic devices such as desktop computers, notebooks, handheld computers, and cloud servers. The electronic device 3 may include but is not limited to a processor 301 and a memory 302. Those skilled in the art will understand that Figure 3 The electronic device 3 is merely an example and does not limit the electronic device 3 , and may include more or less components than those shown in the figure, or different components.

[0080] The processor 301 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0081] The memory 302 may be an internal storage unit of the electronic device 3, for example, a hard disk or memory of the electronic device 3. The memory 302 may also be an external storage device of the electronic device 3, for example, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 3. The memory 302 may also include both an internal storage unit of the electronic device 3 and an external storage device. The memory 302 is used to store computer programs and other programs and data required by the electronic device.

[0082] The embodiments of the present invention provide a computer-readable storage medium. In some embodiments of the present invention, a computer-readable storage medium is provided, and when the computer-readable storage medium is executed by the processor 301, the steps of the above method are implemented. Therefore, the computer-readable storage medium provided by the present invention has all the technical effects of the above steps, which will not be repeated here.

[0083] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0084] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0085] In the embodiments provided in the present disclosure, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of devices or units, which may be electrical, mechanical or other forms.

[0086] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present disclosure implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, and the computer program code may be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electric carrier signals and telecommunication signals.

[0087] The above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should all be included in the protection scope of the present disclosure.

Claims

1. A bus message security protection method, characterized in that: include: S1. During the design phase, determine the network security requirements of the in-vehicle bus through security analysis, and add jitter properties to the safety-critical messages in the vehicle environment to obtain safety-critical messages, where safety-critical messages are messages that may cause safety hazards if tampered or lost, including; worst execution time, message cycle, message deadline, queue jitter time and priority; Perform schedulability analysis on CAN messages, and calculate the response time of each message by evaluating the worst execution time, message cycle, message deadline, queue jitter time, and priority of each message. CAN is the abbreviation of Controller Area Network, which is a serial communication protocol bus used for real-time applications. S2. During the operation phase, based on the attribute parameters of the safety-critical message, within the response time of each message, the safety-critical message is judged to be abnormal through lateral safety detection based on vehicle dynamics analysis and longitudinal safety detection based on data change degree analysis, and messages with a number of times greater than the limit threshold are discarded; S3. Add messages less than or equal to the limit number threshold to the message queue, waiting for bus arbitration and transmission.

2. The bus message security protection method according to claim 1, characterized in that: The size of the queue jitter time is equal to the delay between the lateral analysis based on vehicle dynamics and the longitudinal safety analysis based on the degree of data change.

3. The bus message security protection method according to claim 1, characterized in that: The lateral safety detection includes: obtaining the physical meaning of the signal actually contained in the message, substituting the sensor value in the message into the vehicle dynamics model, and determining whether the incoming sensor value is abnormal. If so, discard the message; if not, perform longitudinal safety detection on the message.

4. The bus message security protection method according to claim 1, characterized in that: The longitudinal safety detection includes: comparing the value of the physical quantity contained in the message with the normal value of the physical quantity, and if the difference exceeds a difference threshold, it is counted as an abnormality.

5. The bus message security protection method according to claim 4, characterized in that: The vertical security detection further includes: setting an acceptable abnormal number threshold, defining messages exceeding the abnormal number threshold as abnormal messages and discarding them.

6. The bus message security protection method according to claim 1, characterized in that: Each message response time is calculated by the each message response time formula.

7. The bus message security protection method according to claim 6, characterized in that: The formula for each message response time is as follows: R i =J i +w i +C i Among them, R i represents the response time of each message, J i Indicates the queue jitter time, w i represents the queuing delay, C i Indicates the worst execution time of the message.

8. The bus message security protection method according to claim 1, characterized in that: The lateral safety detection is based on the analysis of vehicle dynamics, taking into account the correlation between multiple data, and the longitudinal safety detection is based on the analysis of the degree of data change, detecting the actual physical quantity changes reflected by the incoming message.

9. A system for implementing the bus message security protection method according to any one of claims 1 to 8, characterized in that: include: A design module (201) is used to determine the network security requirements of the in-vehicle bus through security analysis during the design phase, and to add jitter attributes to the safety-critical messages in the vehicle environment to obtain safety-critical messages, wherein the safety-critical messages are messages that may cause safety hazards if tampered with or lost, and include: worst execution time, message cycle, message deadline, queue jitter time and priority; Perform schedulability analysis on CAN messages, and calculate the response time of each message by evaluating the worst execution time, message cycle, message deadline, queue jitter time, and priority of each message. CAN is the abbreviation of Controller Area Network, which is a serial communication protocol bus used for real-time applications. An operation module (202) is used to, during the operation phase, based on the attribute parameters of the safety-critical message, perform abnormality judgment on the safety-critical message through lateral safety detection based on vehicle dynamics analysis and longitudinal safety detection based on data change degree analysis within the response time of each message, and discard messages with a number of times greater than a limit threshold; The transmission module (203) is used to add messages less than or equal to the limit number threshold to the message queue, waiting for bus arbitration and transmission.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that: When the processor executes the computer program, the steps of the bus message security protection method according to any one of claims 1 to 8 are implemented.

Images