CAN bus data encryption method and system
By splitting the data packet and key into half-block and sub-key, and adopting multiple rounds of encryption operations, the problem that traditional encryption algorithms cannot be applied to the CAN bus is solved, and the secure transmission of data packets on the CAN bus is realized.
Patent Information
- Application Number
- CN202411867618.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-18
- Publication Date
- 2025-02-28
AI Technical Summary
Traditional data encryption algorithms cannot be directly applied to the CAN bus, resulting in the threat of the CAN bus data transmission security.
By splitting the data packet to be encrypted into two half blocks of equal size and splitting the key into four subkeys, multiple rounds of encryption operations, including translation, addition, XOR, etc., to generate dynamic encryption constants to ensure sufficient confusion and diffusion of the data.
It realizes an encryption method to ensure data security in the CAN bus short packet transmission environment, meeting the CAN bus requirements for data packet size and performance.
Smart Images
Figure CN119544190A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of data encryption, and in particular to a CAN bus data encryption method and system. Background Art
[0002] CAN (Controller Area Network) bus is a communication protocol widely used in automobiles, industrial automation and other fields. CAN bus is known for its high reliability, real-time performance and high anti-interference ability. However, with the development and popularization of Internet of Things (IoT) technology, CAN bus faces more and more security challenges, especially in the process of data transmission, data packets may be maliciously eavesdropped, tampered or forged. Therefore, the research and implementation of data encryption methods for CAN bus has important practical significance.
[0003] Traditional data encryption algorithms, such as AES (Advanced Encryption Standard) and DES (Data Encryption Standard), have excellent security performance, but due to their high computational complexity and the need for large data blocks, they are difficult to directly apply to the CAN bus, where each data packet has only 8 bytes of short packet transmission. Therefore, developing a data encryption method suitable for the CAN bus can not only ensure data security, but also meet the CAN bus's requirements for data packet size and performance, which has important technical significance and application prospects. Summary of the invention
[0004] The embodiments of the present application provide a CAN bus data encryption method and system to solve the problem in the prior art that the traditional data encryption algorithm cannot be directly applied to the CAN bus, resulting in a threat to the security of CAN bus data transmission.
[0005] On the one hand, an embodiment of the present application provides a CAN bus data encryption method, comprising:
[0006] Split the data packet to be encrypted into two half blocks of equal size, namely the first half block and the second half block;
[0007] Split the key into 4 subkeys, namely the first subkey, the second subkey, the third subkey and the fourth subkey, and the size of each subkey is the same as the size of one half block;
[0008] Generate dynamic encryption constants;
[0009] Perform multiple rounds of encryption operations on each half block to obtain two encrypted half blocks;
[0010] Combine the two encrypted half blocks into encrypted data;
[0011] Multiple rounds of encryption operations are performed on each half block, including:
[0012] Performing a first translation process on the first half block to obtain a first translated half block;
[0013] Add the first shifted half block and the third subkey to obtain the first and half blocks;
[0014] Add the first half block and the dynamic encryption constant to obtain the second half block;
[0015] Performing a second translation process on the first half block to obtain a second translated half block;
[0016] Add the second shifted half block and the fourth subkey to obtain the third half block;
[0017] XOR processing is performed on the first and half blocks and the second and half blocks to obtain a first XOR half block;
[0018] XOR-process the first XOR half block and the third XOR half block to obtain a second XOR half block;
[0019] Add the second XOR half block to the second half block to obtain an encrypted second half block corresponding to the second half block;
[0020] Performing a first translation process on the second half block to obtain a third translated half block;
[0021] Add the third shifted half block and the first subkey to obtain a fourth half block;
[0022] Add the second half block and the dynamic encryption constant to obtain the fifth half block;
[0023] Perform a second translation process on the second half block to obtain a fourth translated half block;
[0024] Add the fourth shifted half block to the second subkey to obtain a sixth half block;
[0025] XOR the fourth and half blocks with the fifth and half blocks to obtain a third XOR half block;
[0026] XOR-process the third XOR half block and the sixth XOR half block to obtain a fourth XOR half block;
[0027] Add the fourth XOR half block to the first half block to obtain an encrypted second half block corresponding to the first half block.
[0028] On the other hand, the embodiment of the present application also provides a CAN bus data encryption system, including:
[0029] A data splitting module is used to split the data packet to be encrypted into two half blocks of equal size;
[0030] A key splitting module, used for splitting a key into four subkeys, each subkey having a size equal to that of one half block;
[0031] Constant generation module, used to generate dynamic encryption constants;
[0032] An encryption module is used to perform multiple rounds of encryption operations on each half block to obtain two encrypted half blocks;
[0033] The combining module is used to combine two encrypted half blocks into encrypted data.
[0034] A CAN bus data encryption method and system in this application has the following advantages:
[0035] 1. Block strategy for data packets and keys: Dividing an 8-byte data packet into two 32-bit half blocks and dividing a 128-bit key into four 32-bit sub-keys is the key to adapting this application to CAN bus short packet transmission.
[0036] 2. Calculation of dynamic encryption constants: By multiplying the golden section constant by 2 to the power of 32, a dynamic encryption constant is generated, which avoids the security risks brought by fixed constants and enhances the security of the method.
[0037] 3. Multiple rounds of encryption and decryption operations: Through multiple rounds of complex addition, XOR and shift operations, the data is fully obfuscated and diffused, thus enhancing the strength of encryption. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0039] Figure 1 A flowchart of a CAN bus data encryption method provided in an embodiment of the present application;
[0040] Figure 2 A flowchart of an encryption operation on a second half block provided in an embodiment of the present application;
[0041] Figure 3 A flowchart of the encryption operation on the first half block provided in an embodiment of the present application. DETAILED DESCRIPTION
[0042] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0043] Figure 1-3 A flowchart of a CAN bus data encryption method provided in an embodiment of the present application. The present application embodiment provides a CAN bus data encryption method, the method comprising the following steps:
[0044] S100, splitting the data packet to be encrypted into two half blocks of equal size, namely a first half block and a second half block.
[0045] For example, limited by the transmission size requirement of the CAN bus, the size of the data packet to be encrypted in the embodiment of the present application is 8 bytes, and each byte is 8 bits, so the data packet has a total of 64 bits. After the data packet is split into 2 half blocks, the first half block and the second half block are both 32 bits in size.
[0046] In an embodiment of the present application, a 64-bit data packet is a binary number, in which each bit is arranged in sequence, and when the data packet is split, the high-order 32 bits can be used as the first half block, and the low-order 32 bits can be used as the second half block.
[0047] S110, split the key into four subkeys, namely a first subkey, a second subkey, a third subkey and a fourth subkey, and the size of each subkey is the same as the size of one half block.
[0048] Exemplarily, the key size used in the embodiment of the present application is 128 bits, and the key is also a binary number in which each bit is arranged in order. When splitting the key, the highest 32 bits can be used as the first subkey, the 33rd to 64th bits from the highest bit can be used as the second subkey, the 65th to 96th bits from the highest bit can be used as the third subkey, and the lowest 32 bits can be used as the fourth subkey.
[0049] It can be seen that the size of each sub-key after splitting is 32 bits, which is the same as the size of the first half block and the second half block, so the sub-key can be directly used for mathematical operations with the half block.
[0050] S120, generating a dynamic encryption constant.
[0051] Exemplarily, S120 specifically includes: first obtaining a golden section constant, then multiplying a first certain digit of the golden section constant by 2 to the power of 32 to obtain a dynamic encryption constant, and finally converting the dynamic encryption constant into a 32-bit binary number.
[0052] The mathematical expression of the golden section constant is This constant is an irrational number, that is, an infinite non-repeating decimal. The golden section constant is a decimal number, and the first certain digits of the decimal number, for example, the first 32 digits multiplied by 2 32After that, the result is still a decimal number. In order to make the dynamic encryption constant able to perform mathematical operations with other binary numbers, the golden section constant needs to be multiplied by 2. 32 The obtained decimal number is converted into a 32-bit binary number, that is, the dynamic encryption constant finally obtained is a 32-bit binary number, and the size and data form are the same as the half block and the subkey, so the dynamic encryption constant can directly perform mathematical operations with the half block and the subkey. It should be understood that in order to reflect the dynamic characteristics of the dynamic encryption constant, the position of the golden section constant is different in each encryption process. For example, the 32 bits starting from the first decimal point of the golden section constant are taken for the first encryption, and the 32 bits starting from the second decimal point of the golden section constant are taken for the second encryption, and so on. Based on the infinite non-cyclic characteristics of the golden section constant, the dynamic encryption constant calculated in each encryption process will also be different.
[0053] S130, performing multiple rounds of encryption operations on each half block to obtain two encrypted half blocks.
[0054] Exemplarily, S130 includes encryption operations on the first half block and the second half block, wherein the encryption operation on the second half block includes the following sub-steps:
[0055] S1300, performing a first translation process on the first half block to obtain a first translated half block;
[0056] S1301, adding the first shifted half block and the third subkey to obtain the first sum half block;
[0057] S1302, adding the first half block and the dynamic encryption constant to obtain the second half block;
[0058] S1303, performing a second translation process on the first half block to obtain a second translated half block;
[0059] S1304, adding the second shifted half block and the fourth subkey to obtain a third half block;
[0060] S1305, performing XOR processing on the first and half blocks and the second and half blocks to obtain a first XOR half block;
[0061] S1306, performing XOR processing on the first XOR half block and the third XOR half block to obtain a second XOR half block;
[0062] S1307, adding the second XOR half block to the second half block to obtain an encrypted second half block corresponding to the second half block.
[0063] In the embodiment of the present application, the first translation process is a 4-bit translation to the left, and the second translation process is a 5-bit translation to the right.
[0064] The above encryption operation on the second half block can be expressed by the following mathematical formula:
[0065] V1'=V1+(((V0<<4)+K2)∧(V0+δ)∧((V0>>5)+K3))
[0066] Among them, V1' represents the encrypted second half block corresponding to the second half block, V1 represents the second half block before the encryption operation, V0 represents the first half block before the encryption operation, << represents a left shift, <<4 represents a left shift of 4 bits, K2 represents the third subkey, ∧ represents an XOR operation, δ represents a dynamic encryption constant, >> represents a right shift, >>5 represents a right shift of 5 bits, and K3 represents the fourth subkey.
[0067] The encryption operation for the first half of the block consists of the following sub-steps:
[0068] S1308, performing a first translation process on the second half block to obtain a third translated half block;
[0069] S1309, adding the third shifted half block and the first subkey to obtain a fourth half block;
[0070] S1310, adding the second half block and the dynamic encryption constant to obtain a fifth half block;
[0071] S1311, performing a second translation process on the second half block to obtain a fourth translated half block;
[0072] S1312, adding the fourth shifted half block to the second subkey to obtain a sixth half block;
[0073] S1313, performing XOR processing on the fourth half block and the fifth half block to obtain a third XOR half block;
[0074] S1314, performing XOR processing on the third XOR half block and the sixth XOR half block to obtain a fourth XOR half block;
[0075] S1315, adding the fourth XOR half block to the first half block to obtain an encrypted second half block corresponding to the first half block.
[0076] The above encryption operation on the first half block can be expressed by the following mathematical formula:
[0077] V0'=V0+(((V1<<4)+K0)∧(V1+δ)∧((V1>>5)+K1))
[0078] Among them, V0' represents the encrypted second half block corresponding to the second half block, V0 represents the second half block before the encryption operation, V1 represents the first half block before the encryption operation, K0 represents the first subkey, and K1 represents the second subkey.
[0079] In an embodiment of the present application, after obtaining two encrypted second half blocks corresponding to the first half block and the second half block respectively, the positions of the two encrypted second half blocks are exchanged, and then the encryption operation is repeated until multiple rounds of encryption operations are completed.
[0080] Specifically, after exchanging the positions of the two encrypted second half blocks, the encrypted second half block corresponding to the second half block will be located at the original position of the first half block, and accordingly, the encrypted second half block corresponding to the first half block will be located at the original position of the second half block. After exchanging the positions, the encrypted second half block corresponding to the first half block will perform the same processing as sub-steps S1300-S1307, and the encrypted second half block corresponding to the second half block will perform the same processing as sub-steps S1308-S1315. After completing an encryption operation on the first half block, an encryption operation on the second half block, and position exchange, a round of encryption operation will end. After completing 64 rounds of encryption operations in the embodiment of the present application, the entire encryption operation process ends.
[0081] S140, combining the two encrypted half blocks into encrypted data.
[0082] For example, after 64 rounds of encryption operations are completed, the final two encrypted half blocks are combined in order to obtain 64-bit encrypted data. The encrypted data can be transmitted to the target device. After the target device receives the encrypted data, it needs to decrypt it. The decryption steps are opposite to the encryption steps, and specifically include:
[0083] Split the encrypted data into two blocks of 32 bits each, namely the first block and the second block;
[0084] Split the key into 4 subkeys, namely the first subkey, the second subkey, the third subkey and the fourth subkey, and the size of each subkey is the same as the size of one block;
[0085] Generate dynamic encryption constants;
[0086] Perform multiple rounds of decryption operations on each block to obtain 2 decrypted blocks;
[0087] Combine the two decrypted blocks into the decrypted data.
[0088] The embodiment of the present application also provides a CAN bus data encryption system, the system comprising:
[0089] A data splitting module is used to split the data packet to be encrypted into two half blocks of equal size, namely a first half block and a second half block;
[0090] A key splitting module, used for splitting a key into four subkeys, namely a first subkey, a second subkey, a third subkey and a fourth subkey, wherein the size of each subkey is the same as the size of one half block;
[0091] Constant generation module, used to generate dynamic encryption constants;
[0092] An encryption module is used to perform multiple rounds of encryption operations on each half block to obtain two encrypted half blocks;
[0093] The combining module is used to combine two encrypted half blocks into encrypted data.
[0094] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.
[0095] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A CAN bus data encryption method, characterized in that: include: Split the data packet to be encrypted into two half blocks of equal size, namely the first half block and the second half block; Splitting the key into four subkeys, namely a first subkey, a second subkey, a third subkey and a fourth subkey, wherein the size of each subkey is the same as the size of one half block; Generate dynamic encryption constants; Perform multiple rounds of encryption operations on each of the half blocks to obtain two encrypted half blocks; Combining the two encrypted second half blocks into encrypted data; Wherein, performing multiple rounds of encryption operations on each of the half blocks includes: Performing a first translation process on the first half block to obtain a first translated half block; Adding the first shifted half block and the third subkey to obtain a first sum half block; Adding the first half block and the dynamic encryption constant to obtain a second half block; Performing a second translation process on the first half block to obtain a second translated half block; adding the second shifted half block and the fourth subkey to obtain a third half block; XORing the first half block and the second half block to obtain a first XOR half block; XOR-processing the first XOR half block and the third XOR half block to obtain a second XOR half block; Adding the second XOR half block to the second half block to obtain the encrypted second half block corresponding to the second half block; Performing the first translation process on the second half block to obtain a third translated half block; adding the third shifted half block and the first subkey to obtain a fourth half block; adding the second half block and the dynamic encryption constant to obtain a fifth half block; performing the second translation process on the second half block to obtain a fourth translated half block; adding the fourth shifted half block and the second subkey to obtain a sixth half block; XOR processing the fourth and half blocks with the fifth and half blocks to obtain a third XOR half block; XORing the third XOR half block and the sixth XOR half block to obtain a fourth XOR half block; The fourth XOR half block is added to the first half block to obtain the encrypted second half block corresponding to the first half block.
2. A CAN bus data encryption method according to claim 1, characterized in that: The size of the data packet is 8 bytes, the sizes of the first half block and the second half block are both 32 bits, the size of the key is 128 bits, and the sizes of the first subkey, the second subkey, the third subkey and the fourth subkey are also all 32 bits.
3. A CAN bus data encryption method according to claim 1, characterized in that: When generating the dynamic encryption constant, the golden section constant is first obtained, and then the first digit of the golden section constant is multiplied by 2 to the power of 32 to obtain the dynamic encryption constant, and finally the dynamic encryption constant is converted into a 32-bit binary number.
4. A CAN bus data encryption method according to claim 1, characterized in that: After obtaining the two encrypted second half blocks corresponding to the first half block and the second half block respectively, the positions of the two encrypted second half blocks are exchanged, and then the encryption operation is repeated until multiple rounds of encryption operations are completed.
5. A CAN bus data encryption method according to claim 1, characterized in that: The first translation process is a 4-bit leftward translation, and the second translation process is a 5-bit rightward translation.
6. A system using a CAN bus data encryption method according to any one of claims 1 to 5, characterized in that: include: A data splitting module is used to split the data packet to be encrypted into two half blocks of equal size; A key splitting module, used for splitting a key into four subkeys, each of which has a size the same as that of one half block; Constant generation module, used to generate dynamic encryption constants; An encryption module, used for performing multiple rounds of encryption operations on each of the half blocks to obtain two encrypted half blocks; The combining module is used to combine the two encrypted second half blocks into encrypted data.