Control method of network structure, network structure, electronic equipment and vehicle

Abstract

The invention relates to the field of communication, and provides a network structure control method, a network structure, electronic equipment and a vehicle. The method comprises the following steps: a gateway sends a verification message to a target electronic controller on a network segment; the target electronic controller verifies the received verification message to obtain a target verification result, and feeds back the target verification result to the gateway through the network segment; and the gateway performs data information transmission with the target electronic controller by using the corresponding network segment in response to the fact that the target verification result is successful in verification, or disconnects the communication connection between the corresponding network segment and the target electronic controller in response to the fact that the target verification result is determined to be failed in verification. Through the verification process of the verification message, the tampered target electronic controller can be accurately detected, and then the communication of the tampered target electronic controller is disconnected, so that the tampered target electronic controller cannot carry out data transmission, and the communication security of a network structure is ensured.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a control method for a network structure, a network structure, an electronic device and a vehicle. Background Art

[0002] In the communication architecture, each communication device may be maliciously modified by others.

[0003] However, if someone maliciously changes the communication device, the user may encounter the risk of data transmission errors or data leakage when using the maliciously changed communication architecture for data transmission. Summary of the invention

[0004] In view of this, the purpose of the present application is to propose a network structure control method, a network structure, an electronic device and a vehicle to solve the current problem of malicious modification of communication devices in the communication architecture.

[0005] Based on the above purpose, the present application provides a control method for a network structure, wherein the network structure includes a gateway, multiple network segments and multiple electronic controllers, wherein the gateway is communicatively connected with the electronic controllers through the network segments, wherein each network segment includes at least one electronic controller,

[0006] The method comprises:

[0007] The gateway sends a verification message to the target electronic controller on the network segment;

[0008] The target electronic controller verifies the received verification message to obtain a target verification result, and feeds back the target verification result to the gateway through the network segment;

[0009] The gateway transmits data information with the target electronic controller using the corresponding network segment in response to the target verification result being a passed verification, or disconnects the communication connection between the corresponding network segment and the target electronic controller in response to determining that the target verification result is a failed verification.

[0010] Based on the same inventive concept, the present application also provides a network structure, including: a gateway, a plurality of network segments and a plurality of electronic controllers, wherein the gateway is communicatively connected with the electronic controllers through the network segments, wherein each network segment includes at least one electronic controller;

[0011] The gateway is configured to send a verification message to a target electronic controller on the network segment;

[0012] The target electronic controller is configured to verify the received verification message to obtain a target verification result, and feed back the target verification result to the gateway through the network segment;

[0013] The gateway is further configured to, in response to the target verification result being a passed verification, utilize the corresponding network segment to transmit data information with the target electronic controller, or, in response to determining that the target verification result is a verification failure, disconnect the communication connection between the corresponding network segment and the target electronic controller.

[0014] Based on the same inventive concept, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor implements the method as described above when executing the computer program.

[0015] Based on the same inventive concept, the present application also provides a vehicle, including the network structure as described above or the electronic device as described above.

[0016] From the above description, it can be seen that in the control method, network structure, electronic device and vehicle of the network structure provided by the present application, the gateway will be divided into multiple network segments for communication connection with each electronic controller, and the gateway will also send a corresponding verification message to the target electronic controller of each network segment; then after the corresponding target electronic controller receives the verification message, it is necessary to verify the verification message. If the target electronic controller is a normal device, it has the ability to complete the verification of the verification message, and then obtain the target verification result of passing the verification. If the target electronic controller is tampered with, it cannot complete the verification process of the verification message, and will obtain the target verification result of failing the verification; finally, if the gateway receives the target verification message fed back by the target electronic controller, If the verification result is that the verification passes, it proves that the target electronic controller is normal. The data information of the target electronic controller can be transmitted through the network segment where the target electronic controller is located, so that the target electronic controller can smoothly execute its corresponding function. If the target verification result fed back by the target electronic controller fails, it proves that the target electronic controller has been tampered with. In order to ensure the communication security of the network structure and avoid the harm of the tampered target electronic controller, the gateway will disconnect the communication connection of the device in the corresponding network segment, so that the tampered target electronic controller cannot transmit data through the gateway in the corresponding network segment, and then the tampered target electronic controller cannot execute its corresponding function, so that it will not affect the communication security of the network structure. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A flowchart of a method for controlling a network structure according to an embodiment of the present application;

[0019] Figure 2 A detailed structural example diagram of the network structure of an embodiment of the present application;

[0020] Figure 3 A flowchart of a method for controlling a network structure according to another embodiment of the present application;

[0021] Figure 4 A structural block diagram of the network structure of an embodiment of the present application;

[0022] Figure 5 A structural diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0024] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0025] Glossary:

[0026] CAN: Controller Area Network, controller area network bus.

[0027] GW: gateway.

[0028] ECU: electronic Control Unit, electronic controller.

[0029] SC segment: Subscriber Carrier, a technology used to support mobile users’ access to the Internet.

[0030] BD segment: Bridge Domain, which is a Layer 2 broadcast domain for forwarding data packets in a VXLAN network.

[0031] PT segment: Protocol Independent Multicast is a network technology that allows efficient transmission of multimedia data in the network.

[0032] HUT: Head Unit Terminal, host controller.

[0033] TCU: Transmission Control Unit, automatic transmission control unit.

[0034] ESP: Electronic Stability Program, electronic body stability system.

[0035] T-BOX: Telematics-BOX, vehicle networking control unit.

[0036] PDCU: Power Distribution Control Unit, power domain control unit.

[0037] IBC: Integrated Brake Control, integrated brake controller.

[0038] IDC: Intelligent Driving Center, intelligent driving data center.

[0039] For the communication architecture on the vehicle, the commonly used CAN communication architecture is generally adopted, and the gateway (GW) is used as the route point of the entire communication architecture. This is like a master-slave architecture. The corresponding gateway is the master node, and the connected communication devices (ECU) are slave nodes. The master node manages the data interaction and transmission between the slave nodes.

[0040] If the ECU of a slave node in the vehicle's communication architecture is maliciously changed by someone else and replaced with another ECU, or some bad auto repair shops tamper with the parts and install an irregular replacement part, the quality of the tampered replacement part cannot be guaranteed, which will affect the performance of the entire vehicle. The corresponding node in the communication architecture is likely to be unable to adapt to the communication rhythm of the entire vehicle, causing abnormal functions of the entire vehicle.

[0041] In view of the above situation, the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0042] The control method of the network structure proposed in the embodiment of the present application includes a gateway, multiple network segments and multiple electronic controllers. The gateway is communicatively connected with the electronic controller via the network segments, wherein each network segment includes at least one electronic controller.

[0043] In specific implementation, the gateway (GW) communicates with multiple electronic controllers (ECUs) through multiple network segments, so that each electronic controller can communicate and transmit data through the gateway, and then control the execution of corresponding functions.

[0044] The corresponding network segments include but are not limited to SC network segments, BD network segments and PT network segments. Specifically, different network segment interfaces will be set on the gateway, including: SC network segment interface, BD network segment interface and / or PT network segment interface, so that the electronic controller of the corresponding network segment will be connected to the corresponding network segment interface, thereby enabling the electronic controller to perform data transmission in the corresponding network segment.

[0045] For example, in the SC network segment, the host controller (HUT) and the vehicle network control unit (T-BOX) are connected to the SC network segment interface of the gateway (GW), so that the host controller (HUT) and the vehicle network control unit (T-BOX) can perform data transmission on the SC network segment after verification;

[0046] In the BD network segment, the electronic stability system (ESP) and the automatic transmission control unit (TCU) are connected to the BD network segment interface of the gateway (GW), so that the electronic stability system (ESP) and the automatic transmission control unit (TCU) can transmit data on the BD network segment after passing the verification;

[0047] In the PT network segment, the power domain control unit (PDCU) and the integrated brake controller (IBC) are connected to the PT network segment interface of the gateway (GW), so that the power domain control unit (PDCU) and the integrated brake controller (IBC) can transmit data on the PT network segment after verification.

[0048] like Figure 1 As shown, the method includes:

[0049] Step 101: the gateway sends a verification message to a target electronic controller on the network segment.

[0050] In specific implementation, the gateway can generate corresponding verification messages for each network segment at the same time, and send corresponding verification messages to the target electronic controller in each network segment at the same time. Alternatively, the gateway can generate corresponding verification messages in sequence according to the order of each network segment, determine the target electronic controller corresponding to each network segment, and then send corresponding verification messages to the target electronic controller corresponding to each network segment in sequence.

[0051] The target electronic controller is any one of at least one electronic controller in the corresponding network segment; or the electronic controllers of the corresponding network segment are arranged in sequence, and the target electronic controller is the first electronic controller of the corresponding network segment.

[0052] In addition, the verification message carries information corresponding to the standard configuration of the target electronic controller, and the verification message can be used to detect whether the target electronic controller has been illegally tampered with or replaced.

[0053] Step 102: the target electronic controller verifies the received verification message to obtain a target verification result, and feeds back the target verification result to the gateway through the network segment.

[0054] During specific implementation, the target electronic controller will receive the verification message sent by the gateway through the corresponding network segment. The target electronic controller will use the standard configuration data stored in itself to verify the verification message. If the corresponding target verification results match each other, the verification is passed; if they do not match each other, the corresponding target verification result is a verification failure.

[0055] The target electronic controller will use the corresponding network segment to send the target verification results back to the gateway, and then the gateway will make decisions based on the target verification results.

[0056] Step 103, in response to the target verification result being a passed verification, the gateway utilizes the corresponding network segment to transmit data information with the target electronic controller, or, in response to determining that the target verification result is a failed verification, disconnects the communication connection between the corresponding network segment and the target electronic controller.

[0057] In specific implementation, after receiving the target verification result of the target electronic controller, the gateway judges the target verification result. If the verification passes, it proves that the target electronic controller is normal, has not been illegally tampered with or replaced, and can be used normally. At this time, the gateway will receive the control information of the target electronic controller through the corresponding network segment, and route and forward the control information to the corresponding control device for execution, and send the control information sent by other control devices to the target electronic controller through the corresponding network segment so that the target electronic controller can execute the corresponding control function.

[0058] If the verification fails, it proves that the target electronic controller has been illegally tampered with and replaced and cannot be used normally. At this time, the gateway will disconnect the communication between the corresponding network segment and the target electronic controller, making it impossible for the target electronic controller to perform data transmission control normally, so as to prevent the illegally tampered target electronic controller from causing harm to the operation of other components of the vehicle.

[0059] Each network segment and all electronic controllers corresponding to each network segment are all verified according to the process of steps 101 to 103 above. If all the verifications pass, the vehicle can drive normally. If any verification fails, a prompt will be given so that the driver can handle it in time according to the prompt to avoid the normal function of the vehicle being affected by tampering or disconnection of some electronic components.

[0060] Through the above scheme, the gateway will be divided into multiple network segments for communication connection with each electronic controller, and the gateway will also send a corresponding verification message to the target electronic controller of each network segment; then after the corresponding target electronic controller receives the verification message, it needs to verify the verification message. If the target electronic controller is a normal device, it has the ability to complete the verification of the verification message, and then obtain the target verification result of passing the verification. If the target electronic controller is tampered with, it will not be able to complete the verification process of the verification message, and will obtain the target verification result of failing the verification; finally, if the gateway receives the target verification result fed back by the target electronic controller that the verification is passed, it proves that the target electronic If the controller is normal, the data information of the target electronic controller can be transmitted through the network segment where the target electronic controller is located, so that the target electronic controller can successfully execute its corresponding function. If the target verification result received from the target electronic controller fails, it proves that the target electronic controller has been tampered with. In order to ensure the communication security of the network structure and avoid the harm of the tampered target electronic controller, the gateway will disconnect the communication connection of the device in the corresponding network segment, so that the tampered target electronic controller cannot transmit data through the gateway in the corresponding network segment, and the tampered target electronic controller cannot execute its corresponding function, so that it will not affect the communication security of the network structure.

[0061] In addition, after the gateway sends a verification message to the target electronic controller, it will start timing. If the target verification result is not received from the target electronic controller within the predetermined time, the target verification result will be considered as a verification failure, and the communication connection between the corresponding network segment and the target electronic controller will be disconnected.

[0062] In some embodiments, any one of the multiple network segments includes multiple electronic controllers arranged in sequence, and the multiple electronic controllers of any one of the network segments are sequentially used as target electronic controllers to perform a verification process.

[0063] In the specific implementation, in order to ensure the smooth execution of the verification process, all electronic controllers of each network segment are arranged in sequence and assigned corresponding sequence numbers (for example, the sequence numbers are marked with positive integers). In this way, each electronic controller of the network segment can be used as the target electronic controller to execute the verification process of the above steps 101 to 103 in sequence.

[0064] For example, for the SC segment, the sequence number of the host controller (HUT) is 1, and the sequence number of the vehicle networking control unit (T-BOX) is 2;

[0065] For the BD network segment, the sequence number of the electronic stability system (ESP) is 1, and the sequence number of the automatic transmission control unit (TCU) is 2;

[0066] For the PT segment, the sequence number of the power domain control unit (PDCU) is 1 and the sequence number of the integrated brake controller (IBC) is 2.

[0067] Through the above scheme, it can be ensured that each electronic controller can complete the verification in sequence without confusion and omission, thus ensuring the accuracy and effectiveness of the verification process.

[0068] In some embodiments, the verification message includes at least one of the following: an identifier, an identification mark, and a root certificate verification code.

[0069] Among them, the identifier represents the position sequence number of the target electronic controller, the identification identifier represents the model type of the target electronic controller, the root certificate verification code identifies the verification password of the target electronic controller, and the root certificate verification code can be a hash value (HASH) calculated by the gateway based on the root certificate through a hash algorithm.

[0070] Step 102 includes:

[0071] After the target electronic controller receives the verification message through the corresponding network segment, the target electronic controller performs at least one of the following:

[0072] Step 1021, in response to determining that the verification message includes an identifier, obtain the location information of the target electronic controller, determine whether the location information matches the identifier, obtain the identifier verification result, and feed back the identifier verification result to the gateway through the corresponding network segment.

[0073] During specific implementation, if the target electronic controller is normal, the correct location information can be obtained, so that the location information will match the identifier, and then an identifier verification result of passing the identifier verification will be obtained; if the target electronic controller is tampered with, the location information may not be obtained or wrong location information may be obtained, so that it cannot match the identifier, and then an identifier verification result of failing the identifier verification will be obtained.

[0074] Step 1022, in response to determining that the verification message includes an identification identifier, obtain the identity identifier of the target electronic controller, determine whether the identity identifier matches the identification identifier, obtain an identity verification result, and feed back the identity verification result to the gateway through the corresponding network segment.

[0075] During specific implementation, if the target electronic controller is normal, the correct identity identifier can be obtained, so that the identity identifier will match the identification identifier, and then an identity verification result of passing the identification identifier verification will be obtained; if the target electronic controller is tampered with, the identity identifier may not be obtained or an incorrect identity identifier may be obtained, so that it cannot match the identification identifier, and then an identity verification result of failing the identity verification will be obtained.

[0076] Step 1023, in response to determining that the verification message includes a root certificate verification code, obtain the local root certificate in the target electronic controller, determine whether the local root certificate matches the root certificate verification code, obtain the root certificate verification result, and feed back the root certificate verification result to the gateway through the corresponding network segment.

[0077] During specific implementation, if the target electronic controller is normal, the correct local root certificate can be obtained, so that the local root certificate will match the root certificate verification code, and then the root certificate verification result of passing the root certificate verification will be obtained; if the target electronic controller is tampered with, it may not be possible to obtain the local root certificate or obtain an incorrect local root certificate, so that it cannot match the root certificate verification code, and then the root certificate verification result of failing the root certificate verification will be obtained.

[0078] The target verification result includes: at least one of an identifier verification result, an identity verification result and a root certificate verification result.

[0079] In some preferred embodiments, the corresponding verification message includes: an identifier, an identification mark and a root certificate verification code, so that if any of the identifier verification result, the identity verification result and the root certificate verification result fails to verify, the corresponding target verification result is a verification failure. Only when all of the identifier verification result, the identity verification result and the root certificate verification result pass the verification, the corresponding target verification result passes the verification.

[0080] Through the above scheme, the target verification result can be determined based on at least one of the identifier verification result, the identity verification result and the root certificate verification result, thereby more accurately verifying whether the target electronic controller has been tampered with.

[0081] In some embodiments, the identifiers represent the order of the electronic controllers that need to be verified;

[0082] After the gateway receives the target verification result fed back by the target electronic controller through the corresponding network segment in step 103, the method further includes:

[0083] Step 104: The gateway determines that the target verification result includes an identifier verification result, and increases the identifier in the verification message by one sequence to obtain a new identifier.

[0084] Step 105: Generate a new verification message based on the new identifier, and send the new verification message to the next target electronic controller.

[0085] In specific implementation, after the verification of a target electronic controller is completed, regardless of whether the verification of the target electronic controller is successful, it will be determined in sequence whether there are any electronic controllers that have not been verified in the corresponding network segment. If there are any, the corresponding identifier will be increased by one in sequence to obtain a new identifier (for example, after the verification of the target electronic controller with identifier 1 is completed, identifier 1+1 is added to obtain a new identifier 2), the new identifier is added to a new verification message, and it is sent to the next target electronic controller through the corresponding network segment, and the next target electronic controller that has not completed the verification is verified, and the above steps 102 and 103 are repeated to complete the verification process for the next target electronic controller.

[0086] If it is determined in sequence that there is no electronic controller that has not completed verification in the corresponding network segment, the next network segment will be verified in sequence starting from the first electronic controller of the next network segment and the process of steps 101 to 103 will be repeated.

[0087] Through the above scheme, the gateway can automatically increase the identifier in sequence, thereby automatically realizing the verification process of the next target electronic controller, ensuring that each electronic controller completes the verification in sequence.

[0088] In some embodiments, after the step of determining that the target verification result is a verification failure in response, the step further includes:

[0089] Step 106: the gateway generates verification failure prompt information according to the target electronic controller that fails verification, and outputs the verification failure prompt information.

[0090] In specific implementation, the verification failure prompt information includes: the name and model of the target electronic controller and the reason for the verification failure. The specific output prompt method includes: at least one of voice prompt, light prompt, image prompt and vibration prompt.

[0091] Through the above scheme, a prompt can be given in time after the target electronic controller verification fails, so that the user can know the corresponding verification failure result in time, and then deal with the tampered target electronic controller as soon as possible to prevent the tampered target electronic controller from affecting the function of the entire vehicle.

[0092] In some embodiments, the step of outputting the verification failure prompt information in step 106 includes:

[0093] Step 1061, the gateway determines whether the host controller has completed the verification process, wherein the host controller is one of the multiple electronic controllers.

[0094] Step 1062: In response to determining that the host controller has completed the verification process, the gateway determines whether the host controller has passed the verification.

[0095] Step 1063, in response to determining that the verification result of the host controller is a passed verification, the gateway outputs the verification failure prompt information to the display screen through the host controller for prompting, or, in response to determining that the verification result of the host controller is a failed verification, the gateway determines an alarm message according to the verification failure prompt message, and prompts on the gateway according to the alarm message.

[0096] Alternatively, in step 1064, the gateway determines an alarm message according to the verification failure prompt message in response to determining that the host controller has not completed the verification process, and issues a prompt on the gateway according to the alarm message.

[0097] In specific implementation, since the host controller is the core control device for controlling the display screen, in order to determine whether the verification failure prompt information can be prompted through the display screen, it is necessary to judge the completion status of the verification process of the host controller.

[0098] Only when the host controller completes the verification and passes the verification, the host controller will control the display screen to display the "verification failure prompt information" for the target electronic controller. The specific way of displaying the "verification failure prompt information" on the display screen includes: at least one of image prompt, text prompt, voice prompt, and light prompt.

[0099] If the host controller has not completed the verification, or the verification fails after completion, the gateway will directly generate an alarm message for prompting. The prompt on the gateway includes: at least one of: voice prompt, light prompt, image prompt, and vibration prompt.

[0100] Through the above scheme, if the display screen can be used for prompting, try to use the display screen to prompt "verification failure prompt information" so that users can know it in time. If the display screen cannot be used for prompting, the gateway can also be used for prompting to avoid users being unaware of the verification failure.

[0101] In some embodiments, after step 106, the method further includes:

[0102] Step 107 : The gateway receives verification adjustment information for the target electronic controller that failed verification.

[0103] Step 108, the gateway changes the target verification result of the target electronic controller to verification passed according to the verification adjustment information, connects the communication connection between the corresponding network segment and the target electronic controller, and uses the corresponding network segment to transmit data information with the target electronic controller.

[0104] During specific implementation, it is possible that the target electronic controller is being repaired in a regular vehicle repair shop and undergoing normal component replacement. If verification fails at this time, the user can input verification adjustment information and update the data of the target electronic controller based on the verification adjustment information, so that the target electronic controller can pass the verification correctly, connect the corresponding network segment and the target electronic controller for normal data information transmission.

[0105] In addition, after updating the data of the target electronic controller based on the verification adjustment information, the target electronic controller will send a data update completion signal to the gateway, allowing the gateway to re-verify the target electronic controller. After the verification passes, the communication connection between the corresponding network segment and the target electronic controller is connected for normal data information transmission.

[0106] The verification adjustment information includes: correct data of the replaced target electronic controller for verifying the verification message, specifically including: at least one of correct location information, correct identity identification and correct local root certificate.

[0107] The above scheme can avoid the situation where the normally replaced target electronic controller is misjudged as verification failure, and timely correction and adjustment can be made to this situation so that the vehicle can operate normally.

[0108] The following describes the control method of the network structure of the present application with a specific embodiment. The specific network structure is as follows: Figure 2 shown.

[0109] ① Introduce identifiers that represent order. Each ECU in the corresponding network segment has a fixed identifier that represents the order (specifically, the position order). For example, if HUT and TBOX are both on the SC network segment, and the signal is transmitted first to HUT and then to TBOX, the identifier of HUT will be defined as 1 and the identifier of TBOX will be defined as 2.

[0110] ②Introduce the identification mark of ECU to represent its identity. The identification mark of each ECU is its own name (or model). For example, the identification mark of HUT is HUT, and the identification mark of TBOX is TBOX. This ECU identification mark will correspond one-to-one with the logical address of each ECU.

[0111] ③Introducing ECU logical address. In the vehicle CAN communication, each ECU has its own specific logical address in the network structure. The logical address is consistent with the destination of the message. For example, if you want to send a message to HUT, the logical address of HUT is 0x111, but the message is actually sent to 0x111. Because in CAN communication, GW does not know the name of each ECU, and the ECU name cannot be implemented in the software, so the logical address is used to replace the ECU.

[0112] GW only needs to send this message to 0x111. 0x111 corresponds to HUT.

[0113] ④ The method of introducing the root certificate. First, GW acts as the master node, and GW will pre-install a root certificate. This certificate will also be pre-installed in each ECU to form the local root certificate of each ECU. In this way, ECU can use the local root certificate to correctly verify the root certificate verification code generated by the root certificate sent by GW.

[0114] Program implementation process:

[0115] 1. First, when the vehicle is powered on for the first time, GW will use this root certificate to calculate a HASH value (i.e. the root certificate verification code). Then it will start to wake up all the ECUs in the vehicle and the verification process will start. GW will preset the logical addresses of all ECUs and make a one-to-one correspondence between the logical addresses and the ECU identification marks.

[0116] 2. Assume that this architecture has three network segments and six ECUs. Define the corresponding verification message for each ECU: identifier + identification + root certificate HASH (i.e., root certificate verification code).

[0117] Define the verification messages corresponding to the HUT and T-BOX in the SC network segment:

[0118] (1) The identifier of HUT is 1, HUT (identification mark of HUT), and HASH of the root certificate;

[0119] (2) The identifier of T-BOX is 2, T-BOX (the identification mark of T-BOX), and the HASH of the root certificate.

[0120] Define the verification messages corresponding to TCU and PDCU in the BD network segment:

[0121] (1) The identifier of TCU is 1, TCU (TCU identification), and the HASH of the root certificate;

[0122] (2) The identifier of PDCU is 2, PDCU (identification mark of PDCU), and HASH of the root certificate.

[0123] Define the verification messages corresponding to ESP and IBC in the PT segment:

[0124] (1) The ESP identifier is 1, ESP (ESP identification), and the HASH of the root certificate;

[0125] (2) The identifier of IBC is 2, IBC (IBC identification mark), and the HASH of the root certificate.

[0126] 3. GW will send a verification message to the first node ECU of each network segment, such as to HUT. This message will contain (identifier "1" + HUT identification "HUT" + root certificate HASH). Here, a verification message is first sent to the first node of each network segment (for example, HUT of SC network segment). After receiving the verification message, HUT verifies it. After passing the verification, it sends the verification result to GW.

[0127] When GW receives the verification result from HUT, it will generate another verification message, automatically increase the identifier by 1, and automatically change the identification of the ECU to the identification of the next ECU. The HASH of the root certificate remains unchanged and is sent to the ECU of the next node. Moreover, this verification message will not be received by the first node HUT that has passed the verification, and will be directly routed to the ECU of the next node (such as T-BOX).

[0128] Each ECU will continuously check whether the result is passed or not, and will reply the verification result to GW. After receiving it, GW will send the corresponding verification message to the ECU of the next node.

[0129] Specific ECU verification process:

[0130] The identifier is verified according to the position information to obtain the identifier verification result, which proves whether the ECU is correctly located in the vehicle architecture. If the identifier verification result is a verification failure, it is very likely that the ECU has been replaced in the wrong position.

[0131] The identification mark of the ECU is verified using the identity mark to obtain the identity verification result. The identification mark is used to prove the identity of the ECU. For example, if the HUT is replaced with the TCU, the identity verification result is a verification failure, then there must be a big problem with the vehicle architecture.

[0132] The HASH of the root certificate is verified using the local root certificate of the ECU to obtain the root certificate verification result. If the HASH value of the root certificate is verified incorrectly (that is, the root certificate verification result is verification failure), it means that there is a problem with the local root certificate and the identity is even less trustworthy.

[0133] 4. In order to ensure that even if a node verification fails, it will not affect the verification of other nodes, each time the GW receives the verification result, it will automatically add 1 to the identifier and then implement the verification of the next node.

[0134] 5. Each ECU in each network segment performs operations according to the above steps 1 to 4, that is, when the whole vehicle communication is started, each node must be verified layer by layer. Only after all ECUs are verified, can it be ensured that the authentic and trustworthy ECUs that have passed the verification are enabled, and the unauthentic and problematic ECUs that failed the verification cannot be enabled normally, ensuring the normal communication of the whole vehicle.

[0135] Through the above solution, the phenomenon of arbitrary replacement of electronic controllers (ECU) can be effectively avoided, making the modification market cleaner or making the user's vehicle safer.

[0136] For another embodiment of the control method of the network structure, the specific implementation process is as follows:

[0137] The network structure includes: a gateway and a plurality of electronic controllers communicatively connected to the gateway, wherein the plurality of electronic controllers are arranged in a predetermined order with the gateway as the first.

[0138] In specific implementation, the gateway (GW) communicates with each electronic controller (ECU) to form the network structure. In the network structure, the gateway acts as a master node and each electronic controller acts as a slave node, thereby forming a master-slave architecture.

[0139] The electronic controller is an ECU installed in a car, including but not limited to a host controller (HUT), a transmission control unit (TCU), an electronic stability system (ESP), a vehicle networking control unit (T-BOX), a power domain control unit (PDCU), an integrated brake controller (IBC), an intelligent driving data center (IDC), a vehicle control unit (VCU) and a battery management system (BMS), etc. In this application, the number of electronic controllers is one or more.

[0140] Then, from all electronic controllers, those that pose a high risk to vehicle driving safety are selected for sorting. Based on the selected electronic controllers and gateways, the remaining electronic controllers are set in a corresponding order as needed, starting with the gateway, to form a predetermined order. The predetermined order is set according to actual needs. For example, the corresponding devices to be screened are gateway, host controller, intelligent driving data center, and vehicle network control unit, and the corresponding predetermined order is gateway → host controller → intelligent driving data center → vehicle network control unit.

[0141] Among them, the gateway, as the main node, is marked as a trusted node, so that when performing subsequent verification, the previous node can be used to verify the next node, avoiding the situation where the verification cannot be performed or an infinite loop verification occurs.

[0142] like Figure 3 As shown, the method includes steps 201 to 204:

[0143] Step 201, after the vehicle is started, the gateway acts as a verification node and determines the electronic controllers that need to be verified as verified nodes according to the predetermined order.

[0144] In specific implementation, after the vehicle is started, the first gateway in the predetermined sequence will be used as the verification node, and the subsequent electronic controllers will be used as the verified nodes. This will start the process of using the verification node to verify the verified node.

[0145] Step 202: the verifying node retrieves configuration data from the verified node, and verifies the configuration data to obtain a verification result.

[0146] Step 203: In response to the verification result being a verification failure, the vehicle fails to start.

[0147] Alternatively, in step 204, in response to the verification result corresponding to the electronic controller as the verified node being verified as passed, the vehicle is started successfully.

[0148] In specific implementation, the verification node sends a call instruction to the verified node, and the verified node sends the configuration data stored in itself to the verification node, and then the verification node verifies the configuration data to determine whether the configuration data is correct.

[0149] If the configuration data is incorrect after verification, the verification result is verification failure, which proves that the corresponding verified node is an untrusted electronic controller that has been tampered with. In order to avoid the tampered electronic controller affecting the operation of the vehicle, the vehicle will fail to start at this time.

[0150] If the configuration data is correct after verification, the verification result is verification passed, which proves that the corresponding verified node is a trustworthy electronic controller. The configuration data includes at least one of the following: signature data of the electronic controller, fixed data, and verification data for verification. The last electronic controller in the predetermined sequence does not need to store the verification data.

[0151] When all electronic controllers are verified, the electronic controllers in the predetermined order of the vehicle are all credible, and the vehicle will start successfully and then run normally. Among them, it is determined that the electronic controller corresponding to the gateway is communicated. After the electronic controller is verified, it is proved that all electronic controllers are verified, and it is determined that the vehicle is successfully started.

[0152] Through the above scheme, after the vehicle start is triggered, since the predetermined order of the gateway and the electronic controller in the network structure is arranged with the gateway first, the gateway can be used as the verification node first, and the subsequent electronic controller can be used as the verified node; then the verification node is used to verify the configuration data of the verified node. If the verification fails, it proves that the electronic controller corresponding to the verified node has been tampered with. In order to avoid the tampered electronic controller affecting the operation of the vehicle, the vehicle start will fail and the vehicle will stop running; if the verification passes, it can be determined that the electronic controller in the network structure is credible, the vehicle can be started normally, and the network structure can be used for normal data communication. This can effectively avoid the situation where the tampered electronic controller affects the operation of the vehicle and ensure the security of the vehicle's network structure.

[0153] The verification results obtained from steps 101 to 103 are used as the first verification results, and the verification results obtained from steps 201 to 204 are used as the second verification results. The vehicle can operate normally only if both the first verification results and the second verification results of all ECUs pass the verification.

[0154] In some embodiments, after the vehicle startup is triggered in step 201, the gateway acts as a verification node, including:

[0155] After the vehicle start-up is triggered, the gateway performs self-verification on the local data. After the self-verification passes, the gateway acts as a verification node.

[0156] In specific implementation, in order to ensure its own security, the gateway will perform self-verification before acting as a verification node. If the verification passes, the gateway can serve as a verification node; if the verification fails, the vehicle will fail to start.

[0157] Through the above scheme, the gateway's self-verification process can ensure the gateway's credibility and security, thereby making subsequent gateways more accurate as verification nodes.

[0158] In some embodiments, there are multiple electronic controllers, and the multiple electronic controllers are arranged in a predetermined order with the gateway as the first.

[0159] Step 204 includes:

[0160] Step 2041, in response to the fact that the verified node is not the last one in the predetermined sequence, the verified node is used as a new verification node, the next electronic controller is used as a new verified node, and the new verified node is verified using the new verification node.

[0161] Alternatively, in step 2042, in response to the verified node being the last one in the predetermined sequence, the vehicle is started successfully.

[0162] In specific implementation, it will be determined in a predetermined order whether there is a next electronic controller after the verified node. If there is no next electronic controller, it proves that the verified node is the last one in the predetermined order, and it will be directly determined that the network architecture verification has passed and the vehicle has been successfully started. If there is a next electronic controller, the current verified node will be used as the verification node, and the next electronic controller in the predetermined order will be used as the verified node to repeat the verification process of the verification node and the verified node, until the last electronic controller is verified as the verified node, and then it is determined that the vehicle has been successfully started.

[0163] In some embodiments, before step 202 is implemented, the method further includes:

[0164] Step A, the gateway pre-stores hash verification data of the first electronic controller among a plurality of electronic controllers in a predetermined order;

[0165] Step B: pre-store hash verification data of the next electronic controller in a predetermined order in each of the multiple electronic controllers except the last electronic controller.

[0166] In the specific implementation, the gateway and each electronic device need to be pre-configured. Since the gateway is a trusted master node, the verification root certificate A (i.e., the verification node certificate of the gateway) and the hash verification data (HASH) generated according to the fixed data of the first electronic controller will be pre-stored in the gateway, and in order to ensure the security of the data, the hash verification data will be stored in the gateway's secure storage area (for example, efuse, TEE, etc.), and the hash verification data in the gateway must be written once and cannot be changed. Among them, the hash verification data of the gateway is used for hash verification of the first electronic controller.

[0167] For other electronic controllers, a fixed data of the electronic controller (for example, a fixed 16-byte data), a secondary certificate B issued based on the root certificate A (the secondary certificate B is the verification node certificate of the electronic controller), a signature data for the fixed data and the hash verification data of the next electronic controller will be stored. Among them, the last electronic controller may not store the "hash verification data".

[0168] Through the above scheme, the data in the gateway and each electronic controller can be stored in advance, thereby ensuring the smooth execution of the subsequent verification process.

[0169] In some embodiments, step 202 includes the verification node executing step 2021, step 2022 / step 2023, and step 2024 / step 2025.

[0170] Step 2021, retrieve the signature data from the verified node, verify the signature data using the verification node certificate, and obtain a signature verification result.

[0171] For example, the verification node is a gateway, and the verified node is the first electronic controller (such as HUT). The signature data of the first electronic controller is retrieved, and then the signature data of the first electronic controller is verified using the verification root certificate A (i.e., the verification node certificate) in the gateway.

[0172] Step 2022: In response to the signature verification result being a verification failure, determine that the verification result is a verification failure.

[0173] In specific implementation, if the signature verification fails, it proves that the verified node has been tampered with and is untrustworthy, which will cause the vehicle to fail to start.

[0174] Alternatively, in step 2023, in response to the signature verification result being a passed verification, the signature data is hashed to obtain hash data, and the hash data is verified using the hash verification data stored in the verification node to obtain a hash verification result.

[0175] In specific implementation, if the signature verification passes, since the signature data is obtained through signature processing based on the fixed data of the electronic controller, the verification node will extract the fixed data from the signature data, and then perform hash processing on the fixed data to calculate the corresponding hash data. The hash data is then verified using the hash verification data stored in the verification node to determine whether it is correct, and then the hash verification result is obtained.

[0176] Step 2024: In response to the hash verification result being a verification failure, determine that the verification result is a verification failure.

[0177] In specific implementation, if the hash verification fails, it proves that the verified node has been tampered with and is unreliable, which will cause the vehicle to fail to start.

[0178] Alternatively, in step 2025, in response to the hash verification result being a passed verification, it is determined that the verification result is a passed verification.

[0179] In specific implementation, after the hash check passes, if the checked node at this time is the last electronic controller in the predetermined order, the verification process will be ended and the vehicle will be started successfully; if the checked node at this time is not the last electronic controller in the predetermined order, the checked node will be used as the verification node, and the next electronic controller in the predetermined order will be used as the checked node to continue the verification process and repeat the above steps 2021 to 2025.

[0180] Through the above scheme, after the two verification processes of signature verification and hash verification, the accuracy of the verification process can be improved, the security of the network structure can be enhanced, and the tampered electronic controller can be accurately verified to prevent it from affecting the operation of the vehicle.

[0181] In some embodiments, step 202 includes the verification node executing step 2021', step 2022' / step 2023':

[0182] Step 2021', retrieve signature data from the verified node, perform hash processing on the signature data to obtain hash data, verify the hash data using the hash verification data stored in the verification node, and obtain a hash verification result.

[0183] In specific implementation, since the signature data is obtained through signature processing based on the fixed data of the electronic controller, the verification node will extract the fixed data from the retrieved signature data, and then perform hash processing on the fixed data to calculate the corresponding hash data. The hash data is then verified using the hash verification data stored in the verification node to determine whether it is correct, thereby obtaining the hash verification result.

[0184] Step 2022': in response to the hash verification result being a verification failure, determining that the verification result is a verification failure.

[0185] In specific implementation, if the hash verification fails, it proves that the verified node has been tampered with and is unreliable, which will cause the vehicle to fail to start.

[0186] Alternatively, step 2023', in response to the hash verification result being a verification pass, determining that the verification result is a verification pass.

[0187] In specific implementation, after the hash check passes, if the checked node at this time is the last electronic controller in the predetermined order, the verification process will be ended and the vehicle will be started successfully; if the checked node at this time is not the last electronic controller in the predetermined order, the checked node will be used as the verification node, and the next electronic controller in the predetermined order will be used as the checked node to continue the verification process and repeat the above steps 2021' to 2023'.

[0188] Through the above scheme, after the hash verification process, the accuracy of the verification process can be improved, the security of the network structure can be enhanced, and the tampered electronic controller can be accurately verified to prevent it from affecting the operation of the vehicle.

[0189] In some embodiments, after step 203, the method further includes:

[0190] Step 205: the verification node generates verification failure prompt information according to the verified node that fails the verification, and outputs the verification failure prompt information.

[0191] In specific implementation, the verification failure prompt information includes: the name and model of the electronic controller corresponding to the verified node and the reason for the verification failure. The specific output prompt method includes: at least one of voice prompt, light prompt, image prompt and vibration prompt.

[0192] Through the above scheme, after the verification of the electronic controller corresponding to the verified node fails, a prompt can be given in time, so that the user can know the corresponding verification failure result in time, and then deal with the tampered electronic controller as soon as possible to prevent the tampered electronic controller from affecting the function of the entire vehicle.

[0193] In addition, as a preferred embodiment, step 205 includes:

[0194] Step 2051: the verification node determines whether the host controller has completed the verification process and passed the verification.

[0195] Step 2052: In response to determining that the host controller has completed the verification process, the verification node outputs the verification failure prompt information to the display screen through the host controller for prompting.

[0196] Alternatively, in step 2053, the gateway determines an alarm message according to the verification failure prompt message in response to determining that the host controller has not completed the verification process, and prompts on the gateway according to the alarm message.

[0197] In specific implementation, since the host controller is the core control device for controlling the display screen, in order to determine whether the verification failure prompt information can be prompted through the display screen, it is necessary to judge the completion status of the verification process of the host controller.

[0198] Only when the host controller verification is completed (the host controller verification is completed, and the subsequent electronic controller verification is performed, proving that the host controller is verified), the host controller will be used to control the display screen to display the "verification failure prompt information" of the electronic controller of the verified node. The specific way of displaying the "verification failure prompt information" on the display screen is: at least one of image prompt, text prompt, voice prompt, and light prompt.

[0199] If the host controller has not completed the verification, the gateway will directly generate an alarm message for prompting. The prompt on the gateway includes: at least one of a voice prompt, a light prompt, an image prompt, and a vibration prompt.

[0200] Through the above scheme, if the display screen can be used for prompting, try to use the display screen to prompt "verification failure prompt information" so that users can know it in time. If the display screen cannot be used for prompting, the gateway can also be used for prompting to avoid users being unaware of the verification failure.

[0201] In some embodiments, after step 205, the method further includes:

[0202] Step 206: The verification node receives verification adjustment information for the verified node that failed verification.

[0203] Step 207: the verifying node changes the verification result of the verified node to verification passed according to the verification adjustment information, and the verified node serves as the verifying node, and the next electronic controller in the predetermined sequence serves as the verified node to continue to execute the verification process.

[0204] During specific implementation, the electronic controller of the verified node may be repaired in a regular vehicle repair shop and have normal components replaced. If verification fails at this time, the user can input verification adjustment information and update the data of the electronic controller of the verified node based on the verification adjustment information, so that the electronic controller of the verified node can pass the verification correctly.

[0205] In addition, after updating the data of the electronic controller of the verified node based on the verification adjustment information, the electronic controller of the verified node will send a data update completion signal to the verification node, so that the verification node can re-verify the electronic controller of the verified node and obtain a verification result of passing the verification.

[0206] The verification adjustment information includes: correct configuration data of the electronic controller of the replaced verified node, and specifically includes: at least one of correct signature data, correct fixed data and correct verification data.

[0207] Through the above scheme, it is possible to avoid the situation where the electronic controller of the verified node that is normally replaced is mistakenly judged as a verification failure, and this situation can be corrected and adjusted in time to allow the vehicle to operate normally.

[0208] The following describes the control method of the network structure of the present application with a specific embodiment.

[0209] First, the corresponding network structure is a master-slave architecture, the master node is the GW gateway, and the other ECUs are slave nodes.

[0210] Preparation of the master node: GW needs to preset the verification root certificate A (i.e. the verification node certificate of the gateway) inside itself; and a HASH generated by the fixed 16-byte data of GW, and needs to write the HASH corresponding to the data in its own internal secure storage area, such as efuse, TEE, etc., and ensure that it is written once and cannot be changed; and preset the hash verification data (HASH) generated by the fixed data of the first electronic controller.

[0211] Preparation of slave nodes: When all electronic controllers corresponding to all slave nodes leave the factory, except for the master node, all slave nodes will have three things preset in them: a 16-byte fixed data of their own ECU (i.e., fixed data), a secondary certificate B issued by the verification root certificate A (i.e., verification node certificate), a signature data for the 16-byte data (this is the name signed by the verification root certificate A), and the hash of the preset next node.

[0212] A predetermined sequence is set in advance, and the previous node is used as the verification node and the next node is used as the verified node in turn according to the predetermined sequence, and the verified nodes are verified in sequence using the verification nodes.

[0213] For example, the predetermined order is GW→HUT→T-BOX→TCU→...; then GW will preset the HASH of 16-byte data of HUT, HUT will preset the HASH of 16-byte data of TBOX, and so on.

[0214] Program implementation process:

[0215] The GW gateway is the trust node in the whole solution, the root of trust. Because the whole solution is that the previous node verifies the next node, for example, GW first verifies HUT, and after HUT verifies, the next node should be verified TBOX. Then use HUT to verify T-BOX. Because the whole solution is that the previous node verifies the next node. If there is no trusted node, there is no source, and this cycle will continue endlessly, so a trusted node, namely GW, must be defined.

[0216] (1) When the vehicle starts, the GW will perform self-verification, call out the HASH of the fixed 16-byte data stored in its own security area, and then compare it with its own preset HASH. If they are consistent, it means that the data itself has not been tampered with, and jump to the next step. If the verification fails, it means that the GW data itself has been tampered with, the vehicle will not start, and the CAN interaction will fail.

[0217] (2) After GW passes the verification, GW acts as the verification node and HUT acts as the verified node to perform the verification process:

[0218] (21) GW will verify the HUT. First, the GW's root certificate A (i.e., verification node certificate) is used to verify the signature data of the 16-byte data stored in the HUT. After the signature verification is passed, the 16-byte fixed data in the signature data will be extracted and the corresponding HASH (i.e., hash data) will be calculated. If the signature verification fails, the next step will not be entered and the vehicle will fail to start.

[0219] (22) The calculated hash data is compared with the HUT 16-byte HASH preset by the GW itself for hash verification. After the hash verification passes, the HUT is used to verify the T-BOX. If the hash verification fails, the next step will not be entered and the vehicle startup will fail.

[0220] (3) Use HUT as the verification node and T-BOX as the verified node to perform the verification process:

[0221] (31) First, HUT uses the local secondary certificate (i.e., verification node certificate) to verify the 16-byte signature data in TBOX. Because the secondary certificates of all slave nodes are issued by the root certificate preset by GW, the signature signed by the root certificate can be verified by the secondary certificate.

[0222] (32) When the signature verification passes, the 16-byte fixed data in the T-BOX signature data will be extracted, and the hash data HASH will be calculated and compared with the T-BOX 16-byte HASH (i.e. hash verification data) stored in the HUT for hash verification. After the hash verification passes, jump to the verification of the next ECU. If one of the signature verification and hash verification fails, the vehicle will not start normally.

[0223] All subsequent slave nodes, and so on, are similar to the above signature verification and hash verification process. Only after all ECU signature verification and hash verification are passed, the vehicle CAN can communicate normally. Of course, in order to avoid frequent vehicle problems caused by the failure of one of the ECUs due to incomplete development of a certain ECU, you can select a high-risk ECU for safe startup verification. For example, select GW, HUT, IDC, and TBOX for a predetermined order.

[0224] Through the above solution, the phenomenon of arbitrary replacement of electronic controllers (ECU) can be effectively avoided, making the modification market cleaner or making the user's vehicle safer.

[0225] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0226] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0227] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides a network structure 300, such as Figure 4 The system shown includes: a gateway 301, a plurality of network segments 302 and a plurality of electronic controllers 303, wherein the gateway 301 is connected to the electronic controllers 303 through the network segments 302, wherein each network segment 302 includes at least one electronic controller 303;

[0228] The gateway 301 is configured to send a verification message to a target electronic controller on the network segment 302;

[0229] The target electronic controller is configured to verify the received verification message to obtain a target verification result, and feed back the target verification result to the gateway 301 through the network segment 302;

[0230] The gateway 301 is also configured to, in response to the target verification result being a passed verification, utilize the corresponding network segment 302 to transmit data information with the target electronic controller, or, in response to determining that the target verification result is a verification failure, disconnect the communication connection between the corresponding network segment 302 and the target electronic controller.

[0231] In some embodiments, any network segment 302 among the multiple network segments 302 includes multiple electronic controllers 303 arranged in sequence, and the multiple electronic controllers 303 of any network segment 302 are sequentially used as target electronic controllers to perform a verification process.

[0232] In some embodiments, the verification message includes at least one of the following: an identifier, an identification mark, and a root certificate verification code;

[0233] After receiving the verification message through the corresponding network segment 302, the target electronic controller is specifically configured to perform at least one of the following:

[0234] In response to determining that the verification message includes an identifier, obtaining the location information of the target electronic controller, determining whether the location information matches the identifier, obtaining an identifier verification result, and feeding back the identifier verification result to the gateway 301 through the corresponding network segment 302;

[0235] In response to determining that the verification message includes an identification identifier, obtaining the identity identifier of the target electronic controller, determining whether the identity identifier matches the identification identifier, obtaining an identity verification result, and feeding back the identity verification result to the gateway 301 through the corresponding network segment 302;

[0236] In response to determining that the verification message includes a root certificate verification code, obtaining a local root certificate in the target electronic controller, determining whether the local root certificate matches the root certificate verification code, obtaining a root certificate verification result, and feeding back the root certificate verification result to the gateway 301 through the corresponding network segment 302;

[0237] The target verification result includes: at least one of an identifier verification result, an identity verification result and a root certificate verification result.

[0238] In some embodiments, the identifiers represent the order of the electronic controllers 303 that need to be verified;

[0239] The gateway 301 is further configured to determine that the target verification result includes an identifier verification result after receiving the target verification result fed back by the target electronic controller through the corresponding network segment 302, and increase the identifier in the verification message by one sequence to obtain a new identifier;

[0240] A new verification message is generated based on the new identifier, and the new verification message is sent to a next target electronic controller.

[0241] In some embodiments, the gateway 301 is further configured to:

[0242] After the response to determining that the target verification result is a verification failure, verification failure prompt information is generated according to the target electronic controller that failed the verification, and the verification failure prompt information is output as a prompt.

[0243] In some embodiments, the gateway 301 is further specifically configured as:

[0244] Determining whether the host controller has completed the verification process, wherein the host controller is one of the multiple electronic controllers 303;

[0245] In response to determining that the host controller has completed the verification process, determining whether the host controller has passed the verification;

[0246] In response to determining that the verification result of the host controller is a verification pass, outputting the verification failure prompt information to the display screen through the host controller for prompting, or, in response to determining that the verification result of the host controller is a verification failure, determining alarm information according to the verification failure prompt information, and prompting on the gateway 301 according to the alarm information;

[0247] or,

[0248] In response to determining that the host controller has not completed the verification process, an alarm message is determined according to the verification failure prompt information, and a prompt is given on the gateway 301 according to the alarm message.

[0249] In some embodiments, the gateway 301 is further specifically configured as:

[0250] Generating verification failure prompt information according to the target electronic controller that failed verification, and after outputting the verification failure prompt information, receiving verification adjustment information for the target electronic controller that failed verification;

[0251] The target verification result of the target electronic controller is changed to verification passed according to the verification adjustment information, and the communication connection between the corresponding network segment 302 and the target electronic controller is connected, and data information is transmitted between the corresponding network segment 302 and the target electronic controller.

[0252] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0253] The network structure of the above embodiment is used to implement the corresponding method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described in detail here.

[0254] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any of the above embodiments when executing the program.

[0255] Figure 5A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0256] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0257] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0258] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0259] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0260] The bus 1050 comprises a path for transmitting information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0261] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0262] The electronic device of the above embodiment is used to implement the corresponding method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0263] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method described in any of the above embodiments.

[0264] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0265] The computer instructions stored in the storage medium of the above embodiments are used to enable the computer to execute the method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0266] Based on the same concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a computer program product, including computer program instructions. When the computer program instructions are run on a computer, the computer executes the method described in any of the above embodiments, which has the beneficial effects of the corresponding method embodiments and will not be repeated here.

[0267] Based on the same inventive concept, the present application also provides a vehicle, including the network structure or the electronic device described in the above embodiment. The beneficial effects of the embodiments with the corresponding network structure or electronic device are not described in detail here.

[0268] It is understandable that before using the technical solutions of each embodiment of the present application, the type, scope of use, usage scenarios, etc. of the personal information involved will be informed to the user in an appropriate manner, and the user's authorization will be obtained.

[0269] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly remind the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can independently choose whether to provide personal information to the electronic device, application, server, storage medium or other software or hardware that performs the operation of the technical solution of the present application according to the prompt message.

[0270] As an optional but non-limiting implementation, in response to receiving the user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0271] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation method of this application. Other methods that meet relevant laws and regulations may also be applied to the implementation method of this application.

[0272] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0273] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0274] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0275] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A method for controlling a network structure, characterized in that: The network structure includes a gateway, a plurality of network segments and a plurality of electronic controllers, wherein the gateway is communicatively connected with the electronic controllers through the network segments, wherein each network segment includes at least one electronic controller. The method comprises: The gateway sends a verification message to the target electronic controller on the network segment; The target electronic controller verifies the received verification message to obtain a target verification result, and feeds back the target verification result to the gateway through the network segment; The gateway transmits data information with the target electronic controller using the corresponding network segment in response to the target verification result being a passed verification, or disconnects the communication connection between the corresponding network segment and the target electronic controller in response to determining that the target verification result is a failed verification.

2. The method according to claim 1, characterized in that Any network segment among the multiple network segments includes multiple electronic controllers arranged in sequence, and the multiple electronic controllers of any network segment are sequentially used as target electronic controllers to perform a verification process.

3. The method according to claim 1 or 2, characterized in that: The verification message includes at least one of the following: an identifier, an identification mark, and a root certificate verification code; The target electronic controller receives the verification message through the corresponding network segment, verifies the verification message to obtain a target verification result, and feeds back the target verification result to the gateway through the corresponding network segment, including: After the target electronic controller receives the verification message through the corresponding network segment, the target electronic controller performs at least one of the following: In response to determining that the verification message includes an identifier, obtaining location information of the target electronic controller, determining whether the location information matches the identifier, obtaining an identifier verification result, and feeding back the identifier verification result to the gateway through a corresponding network segment; In response to determining that the verification message includes an identification identifier, obtaining the identity identifier of the target electronic controller, determining whether the identity identifier matches the identification identifier, obtaining an identity verification result, and feeding back the identity verification result to the gateway through a corresponding network segment; In response to determining that the verification message includes a root certificate verification code, obtaining a local root certificate in the target electronic controller, determining whether the local root certificate matches the root certificate verification code, obtaining a root certificate verification result, and feeding back the root certificate verification result to the gateway through a corresponding network segment; The target verification result includes: at least one of an identifier verification result, an identity verification result and a root certificate verification result.

4. The method according to claim 3, characterized in that The identifiers represent the order of the electronic controllers that need to be verified; After the gateway receives the target verification result fed back by the target electronic controller through the corresponding network segment, the method further includes: The gateway determines that the target verification result includes an identifier verification result, and increases the identifier in the verification message by one sequence to obtain a new identifier; A new verification message is generated based on the new identifier, and the new verification message is sent to a next target electronic controller.

5. The method according to claim 1, characterized in that: After the response to determining that the target verification result is a verification failure, the method further includes: The gateway generates verification failure prompt information according to the target electronic controller that fails the verification, and outputs the verification failure prompt information as a prompt.

6. The method according to claim 5, characterized in that The step of outputting the verification failure prompt information includes: The gateway determines whether the host controller has completed the verification process, wherein the host controller is one of the plurality of electronic controllers; In response to determining that the host controller has completed the verification process, the gateway determines whether the host controller has passed the verification; In response to determining that the verification result of the host controller is a verification pass, the gateway outputs the verification failure prompt information to the display screen through the host controller for prompting, or, in response to determining that the verification result of the host controller is a verification failure, the gateway determines an alarm message according to the verification failure prompt information, and prompts on the gateway according to the alarm message; or, In response to determining that the host controller has not completed the verification process, the gateway determines alarm information according to the verification failure prompt information, and prompts on the gateway according to the alarm information.

7. The method according to claim 5, characterized in that The gateway generates verification failure prompt information according to the target electronic controller that fails the verification, and after outputting the verification failure prompt information, further comprises: The gateway receives verification adjustment information for a target electronic controller that fails verification; The gateway changes the target verification result of the target electronic controller to verification passed according to the verification adjustment information, connects the communication connection between the corresponding network segment and the target electronic controller, and uses the corresponding network segment to transmit data information with the target electronic controller.

8. A network structure, characterized in that: include: A gateway, a plurality of network segments and a plurality of electronic controllers, wherein the gateway is communicatively connected with the electronic controllers via the network segments, wherein each network segment includes at least one electronic controller; The gateway is configured to send a verification message to a target electronic controller on the network segment; The target electronic controller is configured to verify the received verification message to obtain a target verification result, and feed back the target verification result to the gateway through the network segment; The gateway is further configured to, in response to the target verification result being a passed verification, utilize the corresponding network segment to transmit data information with the target electronic controller, or, in response to determining that the target verification result is a verification failure, disconnect the communication connection between the corresponding network segment and the target electronic controller.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A vehicle, characterized in that: Includes the network structure described in claim 8 or the electronic device described in claim 9.

Images