Communication method and device

Abstract

The invention relates to a communication method and device, which are used for solving the problem that an ECU is easily eavesdropped when transmitting a message in the prior art. In the application, a first ECU operates a first key and a first fresh value to generate a key stream; performing XOR operation on the key stream and a to-be-transmitted first plaintext message to generate a first ciphertext message; and sending the first ciphertext message to the second ECU. Wherein the first fresh value is a value generated by a counter used for recording the message transmission times of the first ECU in the first ECU when the first ECU transmits the message. The first ECU transmits the first ciphertext message to the second ECU, so that the first message transmitted by the first ECU can be prevented from being eavesdropped, and the confidentiality of transmitting the message by the first ECU can be improved.

Description

[0001] This application is a divisional application. The application number of the original application is 202010025955.8, and the original application date is January 10, 2020. The entire contents of the original application are incorporated into this application by reference. Technical Field

[0002] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0003] With the development of science and technology, various businesses in the automotive industry are becoming more and more mature. In the system of the car, there are many electronic control units (ECUs), which are microcomputer controllers for automobiles. The network connecting these ECUs is called the controller area network (CAN). The CAN bus protocol is a serial communication bus based on the message broadcast mode. It was originally used to achieve reliable communication between ECUs in the car. Later, due to its simple, practical and reliable characteristics, it was widely used in other fields such as industrial automation, shipbuilding, and medical treatment.

[0004] At present, during the communication process based on the CAN bus protocol, malicious attackers can eavesdrop, modify or replay the CAN message (frame) transmitted during the communication process. In order to resist the attacker's modification or replay attack on the CAN message, there are currently some mechanisms for authenticating the CAN message. For example, the secure onboard communication (SecOC) mechanism of the AUTomotive opensystem architecture (AUTOSAR) provides a method for secure communication based on the CAN bus protocol to resist the attacker's modification or replay attack on the CAN message. However, the SecOC mechanism of AUTOSAR cannot prevent attackers from eavesdropping on CAN messages. Summary of the invention

[0005] The present application provides a communication method and device for improving the confidentiality of ECU transmission messages.

[0006] In the first aspect, the present application provides a communication method and device, which can be executed by an ECU in a vehicle. The method includes a first ECU operating a first key and a first fresh value to generate a key stream; performing an XOR operation on the key stream and a first plaintext message to be transmitted to generate a first ciphertext message; the first ECU sends the first ciphertext message to a second ECU; the first fresh value is a value generated by a counter in the first ECU when the first ECU transmits a message, and the counter is used to record the number of times the first ECU transmits a message.

[0007] Based on this solution, the first ECU encrypts the first plaintext message to obtain the first ciphertext message, and transmits the first ciphertext message to the second ECU, thereby preventing the message transmitted by the first ECU from being eavesdropped, which helps to improve the confidentiality of the message transmitted by the first ECU. Even if the ciphertext message is stolen by an attacker, the plaintext message corresponding to the ciphertext message cannot be obtained.

[0008] In a possible implementation, the first ECU may combine encryption protection and integrity protection. Three possible implementations are given as examples below.

[0009] In implementation method 1, the first ECU performs encryption protection first and then integrity protection.

[0010] The first ECU operates on the first key and the first fresh value to generate a key stream, performs an XOR operation on the key stream and the first plaintext message to be transmitted, and generates a first ciphertext message. Furthermore, the first ECU can also operate on the second key, the first ciphertext message, and the first fresh value to generate a message authentication code (MAC), which is used by the second ECU to perform integrity verification on the first plaintext message. In a possible implementation, the first ECU arranges the first ciphertext message, the message authentication code, and the first fresh value in order to obtain a second ciphertext message; the first ECU sends the second ciphertext message to the second ECU.

[0011] In the second implementation method, the first ECU performs integrity protection and encryption protection at the same time.

[0012] The first ECU operates on the first key and the first fresh value to generate a key stream, and performs an XOR operation on the key stream and the first plaintext message to generate a first ciphertext message. At the same time, the first ECU operates on the second key, the first plaintext message and the first fresh value to generate a message authentication code, which is used by the second ECU to perform integrity verification on the first plaintext message; and the first ciphertext message, the message authentication code and the first fresh value are arranged in order to obtain a second ciphertext message. In a possible implementation, the first ECU sends the second ciphertext message to the second ECU.

[0013] In implementation method three, the first ECU performs integrity protection first and then encryption protection.

[0014] The first ECU operates the second key and the first plaintext message to generate a message authentication code, and the message authentication code is used by the second ECU to perform integrity verification on the first plaintext message. Further, the first ECU arranges the first plaintext message and the message authentication code in order to obtain the second plaintext message. Then the first ECU performs an XOR operation on the key stream and the second plaintext message to generate a first ciphertext message. In a possible implementation, the first ECU sends the first ciphertext message and the first freshness value to the second ECU.

[0015] In the present application, the first key may be generated by the first ECU using a key deduction algorithm to calculate the shared key and the first preset parameter, and the shared key is a key shared by the first ECU and the second ECU; the first key may also be preset by the first ECU. The second key may be generated by the first ECU using a key deduction algorithm to calculate the shared key and the second preset parameter; it may also be preset by the first ECU.

[0016] In the present application, the first ECU may also send indication information to the second ECU, where the indication information is used to indicate that the first ECU has performed integrity protection on the first plaintext message; or, to indicate that the first ECU has performed integrity protection and encryption protection on the first plaintext message.

[0017] In the second aspect, the present application provides a communication method that can be executed by an ECU in a vehicle. The method includes the second ECU obtaining a first ciphertext message and a first fresh value; operating the first key and the first fresh value to generate a key stream; performing an XOR operation on the key stream and the first ciphertext message to obtain a first plaintext message; wherein the first ciphertext message is from the first ECU, the first fresh value is the value generated by a counter in the first ECU when the first ECU sends a message, the counter is used to record the number of times the first ECU sends a message, and the shared key is a key shared by the first ECU and the second ECU.

[0018] Based on this solution, the second ECU receives the first ciphertext message transmitted by the first ECU, thereby preventing the message received by the second ECU from being eavesdropped, which helps to improve the confidentiality of the message received by the second ECU. Even if the ciphertext message is stolen by an attacker, the plaintext message corresponding to the ciphertext message cannot be obtained.

[0019] The second ECU can be divided into the following two situations based on the order of integrity verification and decryption.

[0020] In case 1, the second ECU first performs integrity check and then decryption; or integrity check and decryption are performed simultaneously.

[0021] The second ECU receives the second ciphertext message from the first ECU. The second ciphertext message is obtained by arranging the first ciphertext message, the message authentication code and the first fresh value in order; the first ciphertext message, the message authentication code and the first fresh value are obtained from the second ciphertext message; when it is determined that the first fresh value is greater than the second fresh value, the second key, the first ciphertext message and the first fresh value are operated to generate a new message authentication code; if it is determined that the new message authentication code is consistent with the obtained message authentication code, the integrity check passes, and the second fresh value is the fresh value stored locally when the second ECU receives the second ciphertext message. Next, the second ECU operates the first key and the first fresh value to generate a key stream; and performs an XOR operation on the key stream and the first ciphertext message to obtain the first plaintext message.

[0022] In case 2, the second ECU first decrypts and then performs integrity check.

[0023] Based on this situation 2, it can be divided into the following two situations.

[0024] In case 2.1, the second ECU receives the first ciphertext message and the first freshness value from the first ECU; the second ECU performs an XOR operation on the key stream and the first ciphertext message to obtain a second plaintext message, where the second plaintext message is the first plaintext message and the message authentication code arranged in sequence.

[0025] Further, optionally, the second ECU operates on the second key, the first plaintext message and the first fresh value to generate a new message authentication code; if it is determined that the new message authentication code is consistent with the acquired message authentication code, it is determined that the first plaintext message is complete.

[0026] In case 2.2, the second ECU receives the second ciphertext message from the first ECU. The second ciphertext message is obtained by arranging the first ciphertext message, the message authentication code and the first fresh value in order; the first ciphertext message, the message authentication code and the first fresh value are obtained from the second ciphertext message. If it is determined that the first fresh value is greater than the second fresh value, the second ECU operates the second key, the first plaintext message and the first fresh value to generate a new message authentication code; if it is determined that the new message authentication code is consistent with the obtained message authentication code, the integrity check passes. Among them, the second fresh value can be the fresh value stored locally when the second ECU receives the second ciphertext message.

[0027] In a possible implementation, the first key may be generated by the second ECU using a key deduction algorithm to calculate the shared key and the first preset parameter, and the shared key is a key shared by the first ECU and the second ECU; the first key may also be preset by the second ECU. The second key may be generated by the second ECU using a key deduction algorithm to calculate the shared key and the second preset parameter; or it may be preset by the second ECU.

[0028] In a possible implementation, the second ECU may also receive indication information from the first ECU, where the indication information is used to indicate that the first ECU has performed integrity protection on the first plaintext message, or to indicate that the first ECU has performed integrity protection and encryption protection on the first plaintext message. When the second ECU receives the indication information from the first ECU indicating that the first ECU has performed integrity protection on the first plaintext message, the second ECU will perform integrity verification on the first plaintext message after decryption.

[0029] In a third aspect, the present application provides a communication device having the function of implementing the first ECU in the first aspect or the second ECU in the second aspect. The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above functions.

[0030] In one possible implementation, the communication device may be an ECU, or a module that can be used in an ECU, such as a chip or a chip system or a circuit. The beneficial effects can be found in the description of the first aspect or the second aspect above, which will not be repeated here. The communication device may include: a transceiver and a processor. The processor may be configured to support the communication device to perform the corresponding functions of the ECU shown above, and the transceiver is used to support communication between the communication device and other ECUs, etc. Among them, the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit. Optionally, the communication device may also include a memory, which may be coupled to the processor, and which stores the necessary program instructions and data for the communication device.

[0031] In a fourth aspect, the present application provides a communication device for implementing the first aspect or any one of the methods in the first aspect, or for implementing the second aspect or any one of the methods in the second aspect, including corresponding functional modules, respectively used to implement the steps in the above methods. The functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0032] In a possible implementation, the communication device may be an ECU, which may include a processing module and a transceiver module, which may execute the corresponding functions of the ECU in the above method example. For details, please refer to the detailed description in the method example, which will not be repeated here.

[0033] In a fifth aspect, the present application provides a communication system, which includes a first ECU and a second ECU, wherein the first ECU can be used to execute the first aspect or any one of the methods in the first aspect, and the second ECU can be used to execute the second aspect or any one of the methods in the second aspect.

[0034] In a sixth aspect, the present application provides a computer-readable storage medium, in which a computer program or instruction is stored. When the computer program or instruction is executed by a communication device, the communication device executes the method in the above-mentioned first aspect or any possible implementation of the first aspect, or the communication device executes the method in the second aspect or any possible implementation of the second aspect.

[0035] In a seventh aspect, the present application provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed by a communication device, it implements the method of the first aspect or any possible implementation of the first aspect, or implements the method of the second aspect or any possible implementation of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of a communication system architecture provided for this application;

[0037] Figure 2 A schematic diagram of a method flow of a communication method based on an in-vehicle network provided in this application;

[0038] Figure 3 A schematic diagram of the generation process of a ciphertext message provided for this application;

[0039] Figure 4 A schematic diagram of a method flow for first performing encryption protection and then performing integrity protection provided in this application;

[0040] Figure 5 A flowchart of a method for simultaneously performing integrity protection and encryption protection provided by this application;

[0041] Figure 6 A flowchart of a method for first performing integrity protection and then performing encryption protection provided in this application;

[0042] Figure 7 A schematic diagram of a cascade structure of a truncated freshness value, a truncated message authentication code and a ciphertext message provided in this application;

[0043] Figure 8 A schematic diagram of the structure of an ECU provided for this application;

[0044] Fig. 9 A schematic diagram of the structure of an ECU provided for this application. DETAILED DESCRIPTION

[0045] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0046] Figure 1 This is a schematic diagram of the architecture of a communication system applicable to the present application. The communication system takes an electronic and electrical (E / E) system as an example. The communication system may include a gateway, a domain controller, an electronic control unit (ECU) and at least one CAN bus. The communication system may be divided into multiple domains according to function, each domain may include at least one domain controller, and each domain controller is used to manage multiple ECUs connected to one or more CAN buses within the domain. Figure 1 As shown, domain controller 1 is used to manage multiple ECUs connected to the vehicle control system CAN bus in the domain, domain controller 2 is used to manage multiple ECUs connected to the entertainment system CAN bus in the domain, domain controller 3 is used to manage multiple ECUs connected to the diagnostic system CAN bus in the domain, and domain controller 4 is used to manage multiple ECUs connected to the intelligent driving system CAN bus in the domain. The domain controller can also be an ECU. Each domain controller in the communication system belongs to the gateway. Figure 1 As shown, domain controller 1, domain controller 2, domain controller 3 and domain controller 4 belong to a gateway. For example, the gateway is used to isolate ECUs outside the communication system from the communication system, and can realize protocol conversion between ECUs in the communication system. The gateway can also be an ECU. Figure 1 This is only a schematic diagram. The communication system may also include other devices, such as relay devices. Figure 1 This application does not limit the number of gateways, domain controllers, and ECUs connected to various CAN buses included in the communication system.

[0047] The above communication system may include vehicles with communication functions, vehicle-mounted equipment, wireless terminals in unmanned driving, in-vehicle network chips, etc. This application does not limit the application scenarios of the communication system.

[0048] It should be noted that the system architecture and application scenarios described in this application are intended to more clearly illustrate the technical solutions of this application, and do not constitute a limitation on the technical solutions provided by this application. Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new scenarios, the technical solutions provided by this application are also applicable to similar technical problems.

[0049] Below, some terms in this application are explained to facilitate understanding by those skilled in the art.

[0050] 1. Replay Attack

[0051] Replay attacks, also known as replay attacks or playback attacks, refer to an attacker sending a packet that has already been received by the destination host to deceive the system. It is mainly used in the identity authentication process to undermine the correctness of the authentication.

[0052] The basic principle of a replay attack is to resend previously eavesdropped data intact to the recipient. For example, the system will simply encrypt the authentication information before transmitting it. At this time, although the attacker cannot eavesdrop on the password, he can first intercept the encrypted password and then replay it, thereby using this method to carry out an effective attack.

[0053] 2. Key Stream

[0054] A long key stream is generated from a short random key (also called the actual key or seed key), and this long key stream is used to encrypt plaintext or decrypt ciphertext, so that a short key can be used to encrypt longer plaintext or decrypt longer ciphertext.

[0055] 3. Protocol Data Unit (PDU)

[0056] In a layered network structure, such as the Open Systems Interconnection (OSI) model, a PDU is created at each layer of the transmission system. The PDU contains information from the upper layer and additional information from the entity at the current layer, and this PDU is transmitted to the next lower layer.

[0057] 4. Exclusive OR (xor)

[0058] The mathematical symbol for XOR is “⊕”. If the values ​​of a and b are different, the XOR result is 1; if the values ​​of a and b are the same, the XOR result is 0.

[0059] 5. Least significant bit (LSB)

[0060] LSB refers to the 0th bit (i.e. the least significant bit) in a binary number and has a weight of 2^0. In big-endian order, LSB refers to the rightmost bit.

[0061] 6. Most significant bit (MSB)

[0062] MSB refers to the n-1 bit in an n-bit binary number, which has the highest weight 2^(n-1). MSB and LSB are corresponding concepts. In big-endian order, MSB refers to the leftmost bit.

[0063] As follows, combined with the attached Figure 2 To Attachment Figure 7, the communication method based on the in-vehicle network proposed in this application is elaborated in detail. In this application, "at least one" means one or more, and "multiple" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can be represented by: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple. "And / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can be represented by: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In the text description of this application, the character " / " generally indicates that the previous and next associated objects are in an "or" relationship; in the formula of this application, the character " / " indicates that the previous and next associated objects are in a "division" relationship.

[0064] It is to be understood that the various digital numbers involved in the embodiments of the present application are only for the convenience of description and are not used to limit the scope of the embodiments of the present application. The size of the sequence number of the above-mentioned processes does not mean the order of execution, and the order of execution of each process should be determined by its function and inherent logic. The terms "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, including a series of steps or modules. Methods, systems, products or equipment are not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or equipment.

[0065] The present application provides a communication method based on the in-vehicle network, which can be applied to the above Figure 1 In the communication system shown in FIG. 1 , the first ECU and the second ECU may be the above-mentioned Figure 1 Any two ECUs, Figure 1 The ECUs shown in the figure each store a shared key (secret key K). That is, the first ECU and the second ECU may be two ECUs located in the same vehicle, and the first ECU and the second ECU each store a shared key. Further, optionally, the method may be applied to a secure on-board communication (SecOC) mechanism of an automotive open system architecture (AUTOSAR) to provide confidentiality protection for messages transmitted by SecOC, and may be compatible with existing SecOC mechanisms.

[0066] refer to Figure 2 , is a flow chart of a method for communication based on an in-vehicle network provided by the present application. The method comprises the following steps:

[0067] Step 201: The first ECU uses a key derivation algorithm to calculate a shared key and a first preset parameter to generate a first key, wherein the shared key is a key shared by the first ECU and the second ECU.

[0068] This step 201 is an optional step. For example, the first key may also be preset by the first ECU.

[0069] It can also be understood that the input of the key derivation algorithm includes a shared key and a first preset parameter, and the output is a first key. The key derivation algorithm can be a key derivation function (KDF). The first key is a key used to encrypt the first plaintext message of the first ECU, and the first preset parameter is used to indicate that the first key to be generated.

[0070] Further, optionally, the input of the key deduction algorithm may also include one or more of an identifier of the first plaintext message, a first freshness value (counter, CNT), a CAN identifier, and an ECU identifier. Among them, the identifier of the first plaintext message can uniquely identify a first plaintext message; the first freshness value is the value generated by the counter in the first ECU when the first ECU transmits a message. In one possible scenario, the first ECU is locally maintained with a counter, which is used to record the number of times the first ECU transmits a message. For example, the first ECU sends a first plaintext message, and the first freshness value generated by the counter is increased by 1. The CAN identifier is the identifier of the CAN bus to which the first ECU is connected. Combined with the above Figure 1 If the first ECU is an ECU connected to the CAN bus of the vehicle control system, the CAN identifier is the identifier of the CAN bus of the vehicle control system; if the first ECU is an ECU connected to the CAN bus of the diagnostic system, the CAN identifier is the identifier of the CAN bus of the diagnostic system. The ECU identifier can uniquely identify one ECU, namely, the identifier of the first ECU.

[0071] Step 202: The first ECU operates on the first key and the first fresh value to generate a key stream.

[0072] Here, the operation of generating the key stream can be based on an encryption algorithm or a KDF. It can also be understood that the first ECU can operate on the first key and the first fresh value input to the KDF and output the key stream; or the first ECU can operate on the first key and the first fresh value input to the encryption algorithm and output the key stream, see Figure 3 .

[0073] Furthermore, the input for generating the key stream may also include the length of the key stream and / or the identifier of the CAN message and / or the identifier of the first plaintext message to be transmitted. It should be understood that the length of the key stream may also be the default length of the first ECU.

[0074] Step 203: The first ECU performs an XOR operation on the key stream and the first plaintext message to generate a first ciphertext message.

[0075] That is, the key stream ⊕ the first plaintext message can obtain the first ciphertext message (see Figure 3 ), wherein the first plaintext message transmitted by the first ECU may be PDU data.

[0076] Step 204: The first ECU sends a first ciphertext message to the second ECU.

[0077] Step 205: The second ECU obtains the first ciphertext message and the first freshness value.

[0078] In a possible implementation, the second ECU may receive the first encrypted message and the first fresh value from the first ECU, that is, the first ECU may send the first encrypted message and the first fresh value to the second ECU.

[0079] In another possible implementation, the second ECU may obtain the first ciphertext message from the first ECU, and obtain the first ciphertext message from other devices (such as Figure 1 The first fresh value is obtained from a domain controller or a gateway in the communication system shown.

[0080] In another possible implementation, the second ECU may decrypt the first ciphertext message of the first ECU to obtain the first freshness value.

[0081] Step 206: The second ECU uses a key derivation algorithm to operate on the shared key and the first preset parameter to generate a first key.

[0082] Here, the shared key is shared by the second ECU and the first ECU, and the first preset parameter and the key derivation algorithm may be pre-agreed by the first ECU and the second ECU. In addition, the step 206 may refer to the introduction of the above step 201, which will not be described here one by one.

[0083] This step 206 is optional, and the first key may be preset by the second ECU.

[0084] Step 207 : The second ECU operates on the first key and the first fresh value to generate a key stream.

[0085] The step 207 may refer to the introduction of the above step 202, that is, the first ECU in the above step 202 is replaced by the second ECU, which will not be described in detail here.

[0086] Step 208: The second ECU performs an XOR operation on the key stream and the first ciphertext message to obtain a first plaintext message.

[0087] That is, the key stream is XORed with the first plaintext message to obtain the first ciphertext message; conversely, the key stream is XORed with the first ciphertext message to obtain the first plaintext message.

[0088] From the above steps 201 to 208, it can be seen that the first ECU encrypts the first plaintext message to obtain the first ciphertext message, and transmits the first ciphertext message to the second ECU, thereby preventing the message transmitted by the first ECU from being eavesdropped, which helps to improve the confidentiality of the message transmitted by the first ECU. Even if the first ciphertext message is stolen by an attacker, the first plaintext message corresponding to the first ciphertext message cannot be obtained.

[0089] In the present application, the first ECU can also perform integrity protection on the first plaintext message to prevent the attacker from tampering with and replaying the first plaintext message. In other words, the first ECU can perform integrity protection and encryption protection on the first plaintext message to be transmitted, so that the first plaintext message can be prevented from being eavesdropped, and the first plaintext message can be prevented from being replayed and tampered with. The following examples show three possible implementation methods of combining integrity protection and encryption protection. In the following introduction, the operation of generating a key stream is based on an encryption algorithm, and the second ECU obtains the first fresh value from the first ECU as an example.

[0090] In implementation method 1, the first ECU performs encryption protection first and then integrity protection.

[0091] like Figure 4 As shown, it is a flow chart of a method for performing encryption protection first and integrity protection later provided by the present application. The first ECU can use a key deduction algorithm to operate on a shared key and a first preset parameter to generate a first key; operate on the first key and a first fresh value to generate a key stream; perform an XOR operation on the key stream and the first plaintext message to obtain a first ciphertext message.

[0092] Further, the first ECU uses a key deduction algorithm to operate on the shared key and the second preset parameter to generate a second key; and operates on the second key, the first ciphertext message and the first fresh value to generate a message authentication code.

[0093] In one possible implementation, the first ECU may arrange the first ciphertext message, the message authentication code, and the first freshness value in order, for example, placing the message authentication code after the first freshness value, and the first freshness value after the first ciphertext message; for another example, placing the first freshness value after the message authentication code, and the first ciphertext message after the first freshness value; the first ECU obtains the second ciphertext message, and sends the second ciphertext message to the second ECU.

[0094] Based on the above implementation mode 1, the second ECU may perform integrity check first and then decrypt; or integrity check and decryption may be performed simultaneously.

[0095] In a possible implementation, after the second ECU receives the second ciphertext message from the first ECU, it can obtain the first ciphertext message, the message authentication code and the first fresh value respectively. If the second ECU determines that the first fresh value is greater than the second fresh value, it means that the first plaintext message has not been replayed, wherein the second fresh value is the fresh value stored locally when the second ECU receives the second ciphertext message. Further, the second ECU uses the key deduction algorithm to operate the shared key and the second preset parameter to generate a second key; and operates the second key, the first ciphertext message and the first fresh value to generate a new message authentication code. If the second ECU determines that the new message authentication code is consistent with the message authentication code obtained from, the integrity check passes, that is, the first plaintext message has not been tampered with or replayed; if it is determined that the new message authentication code is inconsistent with the message authentication code obtained from the second ciphertext message, the integrity check fails. The integrity check passes, indicating that the first plaintext message and the first fresh value received by the second ECU are both complete and have not been tampered with.

[0096] If the integrity check is determined to be passed, the second ECU decrypts the first ciphertext message. The specific process may be: the second ECU uses the key derivation algorithm to operate on the shared key and the first preset parameter to generate the first key; the first key and the first fresh value are operated to generate a key stream; and the key stream and the first ciphertext message are XORed to obtain the first plaintext message. The first plaintext message is the valid message transmitted from the first ECU to the second ECU.

[0097] If the second ECU determines that the integrity check fails, the second ECU does not need to perform the decryption process on the first ciphertext message. In this way, if the second ECU first performs the integrity check, it does not need to perform the decryption process when the integrity check fails.

[0098] In the second implementation method, the first ECU performs encryption protection and integrity protection at the same time.

[0099] like Figure 5The figure shows a flow chart of a method for performing integrity protection and encryption protection simultaneously provided by the present application. The first ECU uses a key derivation algorithm to operate on a shared key and a second preset parameter to generate a second key; and operates on the second key, the first plaintext message and the first fresh value to generate a message authentication code.

[0100] At the same time, the first ECU can use a key deduction algorithm to operate on the shared key and the first preset parameter to generate a first key, operate the first key and the first fresh value to generate a key stream; perform an XOR operation on the key stream and the first plaintext message to obtain a first ciphertext message; arrange the first ciphertext message, the message authentication code and the first fresh value in order, for example, the message authentication code is placed after the first fresh value, and the first fresh value is placed after the first ciphertext message; for another example, the first fresh value is placed after the message authentication code, and the first ciphertext message is placed after the first fresh value; the first ECU can obtain a second ciphertext message, and send the second ciphertext message to the second ECU.

[0101] Based on the above implementation method 2, since the message authentication code is generated based on the first plaintext message, the second ECU needs to decrypt it first, obtain the first plaintext message, and then perform integrity verification.

[0102] In a possible implementation, the second ECU receives a second ciphertext message from the first ECU, the second ciphertext message being obtained by arranging the first ciphertext message, the message authentication code and the first fresh value in order; the second ECU can obtain the first ciphertext message, the message authentication code and the first fresh value from the second ciphertext message respectively. The second ECU uses a key deduction algorithm to operate on the shared key and the first preset parameter to generate a first key; and operates on the first key and the first fresh value to generate a key stream; and performs an XOR operation on the key stream and the first ciphertext message to obtain a first plaintext message. If the second ECU determines that the first fresh value is greater than the second fresh value, the shared key and the second preset parameter are operated using a key deduction algorithm to generate a second key, and the second fresh value is a fresh value locally stored when the second ECU receives the second ciphertext message; and operates on the second key, the first plaintext message and the first fresh value to generate a new message authentication code. If the second ECU determines that the new message authentication code is consistent with the acquired message authentication code, the integrity check passes; if it determines that the new message authentication code is inconsistent with the acquired message authentication code, the integrity check fails.

[0103] In implementation method three, the first ECU performs integrity protection first and then encryption protection.

[0104] like Figure 6As shown, a flow chart of a method provided by the present application for first performing integrity protection and then performing encryption protection is provided. The first ECU uses a key deduction algorithm to operate on a shared key and a second preset parameter to generate a second key; and operates on the second key, the first plaintext message, and the first fresh value to generate a message authentication code; arranges the first plaintext message and the message authentication code in order, for example, places the message authentication code after the first plaintext message; for another example, places the first plaintext message after the message authentication code; and the first ECU obtains the second plaintext message. Further, the first ECU operates on the first key and the first fresh value to generate a key stream; performs an XOR operation on the key stream and the second plaintext message to generate a first ciphertext message; and sends the first ciphertext message and the first fresh value to the second ECU.

[0105] Based on the above implementation method three, since the message authentication code generated by the first ECU is based on the first plaintext message, the second ECU needs to decrypt it first, obtain the first plaintext message, and then perform integrity verification.

[0106] In a possible implementation, the second ECU receives the first ciphertext message and the first fresh value from the first ECU; uses the key deduction algorithm to operate the shared key and the first preset parameter to generate the first key; and operates the first key and the first fresh value to generate a key stream; performs an XOR operation on the key stream and the first ciphertext message to obtain a second plaintext message, and the second plaintext message is obtained by arranging the first plaintext message, the first fresh value and the message authentication code in sequence. That is, the second ECU obtains the first plaintext message, the first fresh value and the message authentication code from the second plaintext message.

[0107] In order to ensure that the first plaintext message obtained by decryption has not been replayed and tampered with, the second ECU uses the key deduction algorithm to calculate the shared key and the second preset parameter to generate a second key; and calculates the second key, the first plaintext message and the first fresh value to generate a new message authentication code. If the second ECU determines that the new message authentication code is consistent with the obtained message authentication code, the integrity check passes. If the second ECU determines that the new message authentication code is inconsistent with the obtained message authentication code, the integrity check fails and the first plaintext message can be directly discarded.

[0108] Based on the above three implementations, in a possible implementation, after determining that the verification is passed, the second ECU may update the acquired first fresh value to a second fresh value stored locally.

[0109] It should be noted that in the above three implementations, in order to further improve the security of the message transmitted by the first ECU, the first key used for encryption and the second key used for integrity protection are different. Exemplarily, this can be achieved by inputting different preset parameters (such as algorithm type parameters (algorithm type distinguisher)). For example, the preset parameter for generating the first key is the first preset parameter, and the preset parameter for generating the second key is the second preset parameter, and the first preset parameter and the second preset parameter are different. For example, the first preset parameter may be "0x01", and the second preset parameter may be "0x02"; for another example, the first preset parameter is "encryption" and the second preset parameter is "integrity". In addition, the first preset parameter and the key deduction algorithm may be agreed upon by the first ECU and the second ECU.

[0110] In the present application, the input for generating the first ciphertext message may also include one or more of the identifier of the first plaintext message, the identifier of the CAN message, and the length of the key stream. In addition, the input for generating the message authentication code may also include the identifier of the first plaintext message. If the input for generating the message authentication code by the first ECU includes the identifier of the first plaintext message, the input for generating the new message authentication code by the second ECU may also include the identifier of the first plaintext message, wherein the second ECU may obtain the identifier of the first plaintext message from the message header of the second ciphertext message. In one possible implementation, the message authentication code may be a 128-bit string.

[0111] In this application, in order to reduce the load sent by the first ECU, in a possible implementation, the length of the fresh value sent by the first ECU to the second ECU can be shortened, for example, the fresh value can be truncated. In other words, the first fresh value can be a truncated fresh value.

[0112] In a possible implementation, the truncated fresh value can be configured from the LSB of the complete fresh value, or from the MSB of the complete fresh value. In order to further reduce the load sent by the first ECU, the message authentication code can also be truncated. In a possible implementation, the truncated message authentication code can be configured from the MSB, or from the LSB. Figure 7, taking the configuration of the truncated message authentication code starting from MSB and the configuration of the truncated fresh value starting from LSB as an example, the truncated fresh value and the truncated message authentication code are arranged in order with the first ciphertext message to obtain the second ciphertext, and the second ciphertext message is sent to the second ECU. After the second ECU receives the second ciphertext message, it obtains the first ciphertext message, the truncated fresh value and the truncated message authentication code from the second ciphertext message. If the second ECU determines that the received truncated fresh value is higher than the part of the fresh value locally stored in the second ECU corresponding to the truncated fresh value, it means that the received first plaintext message has not been replayed. Further, optionally, the second ECU connects the part of the locally stored fresh value except the part corresponding to the truncated fresh value with the received truncated fresh value to obtain a complete fresh value. If the second ECU determines that the received truncated fresh value is lower than the portion of the locally stored fresh value corresponding to the truncated fresh value, the portion of the locally stored fresh value other than the portion corresponding to the truncated fresh value is added by 1 and then connected with the received truncated fresh value to obtain a complete fresh value. For example, the truncated fresh value is 5 bits configured starting from the LSB, the fresh value locally stored by the second ECU is 15 bits, the portion corresponding to the truncated fresh value is 5 bits starting from the LSB of the 15-bit locally stored fresh value, and the portion other than the portion corresponding to the fresh value is 10 bits starting from the MSB of the 15-bit locally stored fresh value.

[0113] It should be noted that the first fresh value in the input of the second ECU to generate a new message authentication code and key stream is the complete fresh value.

[0114] In the present application, when the first ECU sends the first ciphertext message and the first freshness value to the second ECU, it may also include indication information. The indication information can be used to indicate that the first ECU has performed integrity protection on the first plaintext message; or, the indication information can be used to indicate that the first ECU has performed integrity protection and encryption protection on the first plaintext message. After receiving the indication information, the second ECU can check whether the ciphertext message has integrity protection according to the indication information. Further, the indication information can also be used to indicate that the first ECU has performed encryption protection on the first plaintext message; or, the indication information can also be used to indicate that the first ECU has not performed any protection on the first plaintext message; or, the indication information can also be used to indicate that the first ECU has performed encryption protection on the first plaintext message and has not performed integrity protection; or, the indication information can also be used to indicate that the first ECU has performed integrity protection on the first plaintext message and has not performed encryption protection, and so on.

[0115] In a possible implementation, the indication information may be information independent of the first ciphertext message, or may be carried in the message header of the first ciphertext message or the second ciphertext message. Exemplarily, the indication information may be identified by 1 byte, for example, 0 may be used to indicate that the first plaintext message is not encrypted, and 1 may be used to indicate that the first plaintext message is encrypted; or 0 may be used to indicate that the first plaintext message is not integrity protected, and 1 may be used to indicate that the first plaintext message is integrity protected. Exemplarily, the indication information may also be represented by 2 bytes, for example, 00 indicates that the first plaintext message is not integrity protected and is not encrypted; 01 indicates that the first plaintext message is not integrity protected and is encrypted; 10 indicates that the first plaintext message is integrity protected and is not encrypted; 11 indicates that the first plaintext message is integrity protected and is encrypted. It should be understood that the message header is not encrypted, and after the second ECU receives the second ciphertext message or the first ciphertext message, the indication information can be directly determined from the message header.

[0116] It is understandable that in order to implement the functions in the above embodiments, the communication device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the modules and method steps of each example described in the embodiments disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application scenario and design constraints of the technical solution.

[0117] Figure 8 and Fig. 9 The following is a schematic diagram of the structure of a possible communication device provided in the present application. These communication devices can be used to implement the functions of the first ECU or the second ECU in the above method embodiment, and thus can also achieve the beneficial effects of the above method embodiment. In the present application, the communication device can be as follows: Figure 1 The ECU shown may also be a module (such as a chip) applied to the ECU.

[0118] like Figure 8 As shown, the communication device 800 includes a processing module 801 and a transceiver module 802. The communication device 800 is used to implement the above Figure 2 , Figure 3 , Figure 4 , Figure 5 or Figure 6 The functions of the first ECU or the second ECU in the method embodiment shown in FIG.

[0119] When the communication device 800 is used to implement Figure 2The functions of the first ECU in the method embodiment shown are: the processing module 801 is used to operate on the first key and the first fresh value to generate a key stream; perform an XOR operation on the key stream and the first plaintext message to be transmitted to generate a first ciphertext message; the first fresh value is the value generated by the counter in the communication device when the communication device transmits the message, and the counter is used to record the number of times the communication device transmits the message; the transceiver module 802 is used to send the first ciphertext message to the second ECU.

[0120] When the communication device 800 is used to implement Figure 2 The function of the second ECU in the method embodiment shown is: the processing module 801 is used to obtain a first ciphertext message and a first fresh value, the first ciphertext message comes from the first ECU, the first fresh value is the value generated by a counter in the first ECU when the first ECU sends a message, and the counter is used to record the number of times the first ECU sends the message; the first key and the first fresh value are operated to generate a key stream; the key stream and the first ciphertext message are XORed to obtain a first plaintext message.

[0121] For more detailed description of the processing module 801 and the transceiver module 802, please refer to Figure 2 The relevant descriptions in the method embodiment shown are directly obtained and will not be repeated here.

[0122] It should be understood that the processing module 801 in the embodiment of the present application can be implemented by a processor or a processor-related circuit component, and the transceiver module 802 can be implemented by a transceiver or a transceiver-related circuit component.

[0123] Based on the above content and the same concept, Fig. 9 As shown, the present application also provides a communication device 900. The communication device 900 may include a processor 901 and a transceiver 902. The processor 901 and the transceiver 902 are coupled to each other. It is understood that the transceiver 902 may be an interface circuit or an input-output interface. Optionally, the communication device 900 may also include a memory 903 for storing instructions executed by the processor 901 or storing input data required by the processor 901 to execute instructions or storing data generated after the processor 901 executes instructions.

[0124] When the communication device 900 is used to implement Figure 2 In the method shown, the processor 901 is used to execute the functions of the above-mentioned processing module 801, and the transceiver 902 is used to execute the functions of the above-mentioned transceiver module 802.

[0125] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0126] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in a network device or a terminal device. Of course, the processor and the storage medium can also be present in a network device or a terminal device as discrete components.

[0127] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When a computer program or instruction is loaded and executed on a computer, the process or function of the embodiment of the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device or other programmable device. The computer program or instruction can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program or instruction can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that integrates one or more available media. The available medium can be a magnetic medium, such as a floppy disk, a hard disk, or a tape; it can also be an optical medium, such as a digital video disc (DVD); it can also be a semiconductor medium, such as a solid state drive (SSD).

[0128] In the various embodiments of the present application, unless otherwise specified or provided in a logical conflict, the terms and / or descriptions between the different embodiments are consistent and may be referenced to each other, and the technical features in the different embodiments may be combined to form new embodiments according to their inherent logical relationships.

[0129] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of protection of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A communication method, characterized in that: include: The first node operates the first key and the first fresh value to generate a key stream; wherein the first fresh value is the number of times the first node transmits a message; The first node performs an XOR operation on the key stream and a first plaintext message to be transmitted to generate a first ciphertext message; The first node sends the first ciphertext message and a truncated first freshness value to the second node, where the truncated first freshness value is a fragment of the first freshness value.

2. The method according to claim 1, characterized in that The truncated first fresh value is configured starting from the least significant bit (LSB) of the first fresh value.

3. The method according to claim 1, characterized in that The method further comprises: The first node operates the second key, the first ciphertext message and the first fresh value to generate a message authentication code, where the message authentication code is used by the second node to perform integrity verification on the first plaintext message; The first node arranges the first ciphertext message, the message authentication code, and the truncated first freshness value in order to obtain a second ciphertext message; The first node sends the first ciphertext message and the truncated first freshness value to the second node, including: The first node sends the second ciphertext message to the second node.

4. The method according to claim 3, characterized in that The first node arranges the first ciphertext message, the message authentication code, and the truncated first freshness value in order to obtain a second ciphertext message, including: In the second ciphertext message, the truncated first freshness value precedes the first ciphertext message, and the message authentication code follows the first ciphertext message.

5. The method according to claim 1, characterized in that The method further comprises: The first node operates the second key, the first plaintext message and the first fresh value to generate a message authentication code, where the message authentication code is used by the second node to perform integrity verification on the first plaintext message; The first node arranges the first ciphertext message, the message authentication code, and the truncated first freshness value in order to obtain a second ciphertext message; The first node sends the first ciphertext message and the truncated first freshness value to the second node, including: The first node sends the second ciphertext message to the second node.

6. The method according to claim 1, characterized in that The first node performs an XOR operation on the key stream and the first plaintext message to generate a first ciphertext message, including: The first node operates the second key and the first plaintext message to generate a message authentication code, where the message authentication code is used by the second node to perform integrity verification on the first plaintext message; The first node arranges the first plaintext message and the message authentication code in order to obtain a second plaintext message; The first node performs an XOR operation on the key stream and the second plaintext message to generate the first ciphertext message.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: The first node uses a key deduction algorithm to operate on a shared key and a first preset parameter to generate the first key, where the shared key is a key shared by the first node and the second node.

8. The method according to claim 7, characterized in that The first preset parameter is an algorithm type parameter.

9. The method according to any one of claims 3 to 6, characterized in that: The method further comprises: The first node uses a key deduction algorithm to operate the shared key and a second preset parameter to generate a second key, where the shared key is a key shared by the first node and the second node.

10. The method according to claim 9, characterized in that The second preset parameter is an algorithm type parameter.

11. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: The first node sends indication information to the second node, where the indication information is used to indicate any one of the following: The first node performs integrity protection on the first plaintext message; or, The first node performs integrity protection and encryption protection on the first plaintext message.

12. A communication method, characterized in that: include: The second node obtains the first ciphertext message and the truncated first freshness value; The first ciphertext message comes from a first node, the first freshness value is the number of times the first node transmits the message, and the truncated first freshness value is a fragment of the first freshness value; The second node operates the first key and the truncated first fresh value to generate a key stream; The second node performs an XOR operation on the key stream and the first ciphertext message to obtain a first plaintext message.

13. The method according to claim 12, characterized in that The truncated first fresh value is configured starting from the least significant bit (LSB) of the first fresh value.

14. The method according to claim 12, characterized in that The second node operates the first key and the truncated first fresh value to generate a key stream, including: The second node obtains a complete fresh value according to the truncated first fresh value; The second node operates the first key and the complete fresh value to generate the key stream.

15. The method according to claim 14, characterized in that The second node obtains a complete fresh value according to the truncated first fresh value, including: The second node determines that the truncated first fresh value is higher than a portion of the fresh value locally stored by the second node corresponding to the truncated fresh value; The second node connects the portion of the locally stored fresh value except the portion corresponding to the truncated fresh value with the truncated first fresh value to obtain a complete fresh value.

16. The method according to claim 14, characterized in that The second node obtains a complete fresh value according to the truncated first fresh value, including: The second node determines that the truncated first fresh value is lower than a portion of the fresh value locally stored by the second node corresponding to the truncated first fresh value; The second node adds 1 to the part of the locally stored fresh value except the part corresponding to the truncated fresh value, and then connects it with the truncated first fresh value to obtain a complete fresh value.

17. The method according to claim 12, characterized in that The second node obtains the first ciphertext message and the truncated first freshness value, including: The second node receives a second ciphertext message from the first node, where the second ciphertext message is obtained by arranging the first ciphertext message, the message authentication code, and the truncated first freshness value in sequence; The second node obtains the first ciphertext message and the truncated first freshness value from the second ciphertext message; The second node operates the first key and the truncated first fresh value to generate a key stream, and also includes: The second node obtains the message authentication code from the second ciphertext message; When the second node determines that the first freshness value is greater than a second freshness value, the second node operates on a second key, the first ciphertext message, and the first freshness value to generate a new message authentication code, where the second freshness value is a freshness value locally stored when the second node receives the second ciphertext message; The second node determines that the new message authentication code is consistent with the acquired message authentication code.

18. The method according to claim 17, characterized in that The second ciphertext message is obtained by arranging the first ciphertext message, the message authentication code, and the truncated first freshness value in order, and includes: In the second ciphertext message, the truncated first freshness value precedes the first ciphertext message, and the message authentication code follows the first ciphertext message.

19. The method of claim 12, wherein: The second node obtains the first ciphertext message and the truncated first freshness value, including: The second node receives a second ciphertext message from the first node, where the second ciphertext message is obtained by arranging the first ciphertext message, the message authentication code, and the truncated first freshness value in sequence; The second node obtains the first ciphertext message, the message authentication code and the truncated first freshness value from the second ciphertext message; The second node operates the first key and the truncated first fresh value to generate a key stream, and also includes: When the second node determines that the first freshness value is greater than the second freshness value, the second node operates on the second key, the first plaintext message, and the first freshness value to generate a new message authentication code, where the second freshness value is a freshness value stored locally when the second node receives the second ciphertext message; The second node determines that the new message authentication code is consistent with the acquired message authentication code.

20. The method of claim 12, wherein: The second node obtains the first ciphertext message and the truncated first freshness value, including: The second node receives the first ciphertext message and the truncated first freshness value from the first node; The second node performs an XOR operation on the key stream and the first ciphertext message to obtain the first plaintext message, including: The second node performs an XOR operation on the key stream and the first ciphertext message to obtain a second plaintext message, where the second plaintext message is obtained by arranging the first plaintext message and the message authentication code in sequence; The second node obtains the first plaintext message and the message authentication code from the second plaintext message; The method further comprises: The second node operates the second key, the first plaintext message and the first fresh value to generate a new message authentication code; The second node determines that the first plaintext message is complete based on the consistency between the new message authentication code and the acquired message authentication code.

21. The method according to any one of claims 17 to 20, characterized in that The method further comprises: The second node updates the second fresh value stored locally in the second node according to the truncated first fresh value.

22. The method according to any one of claims 17 to 20, characterized in that The method further comprises: The second node uses a key deduction algorithm to operate on a shared key and a first preset parameter to generate the first key, where the shared key is a key shared by the first node and the second node.

23. The method of claim 22, wherein: The first preset parameter is an algorithm type parameter.

24. The method according to any one of claims 17 to 20, characterized in that The method further comprises: The second node uses a key deduction algorithm to operate the shared key and a second preset parameter to generate the second key, where the shared key is a key shared by the first node and the second node.

25. The method of claim 24, wherein: The second preset parameter is an algorithm type parameter.

26. The method according to any one of claims 12 to 20, characterized in that The method further comprises: The second node receives indication information from the first node, where the indication information is used to indicate that the first node has performed integrity protection on the first plaintext message, or to indicate that the first node has performed integrity protection and encryption protection on the first plaintext message.

27. A communication device, characterized in that: Including processing module and transceiver module: The processing module is used to operate the first key and the first fresh value to generate a key stream; perform an XOR operation on the key stream and the first plaintext message to be transmitted to generate a first ciphertext message; wherein the first fresh value is the number of times the communication device transmits the message; The transceiver module is used to send the first ciphertext message and a truncated first freshness value to the second node, where the truncated first freshness value is a fragment of the first freshness value.

28. The communication device according to claim 27, characterized in that The truncated first fresh value is configured starting from the least significant bit (LSB) of the first fresh value.

29. The communication device according to claim 27, characterized in that The processing module is further used for: Performing an operation on a second key, the first ciphertext message, and the first fresh value to generate a message authentication code, where the message authentication code is used by the second node to perform integrity verification on the first plaintext message; Arrange the first ciphertext message, the message authentication code and the truncated first freshness value in order to obtain a second ciphertext message; When the transceiver module sends the first ciphertext message and the truncated first freshness value to the second node, it is specifically used to: send the second ciphertext message to the second node.

30. The communication device according to claim 29, characterized in that The processing module is further configured to place the truncated first freshness value before the first ciphertext message, and place the message authentication code after the first ciphertext message in the second ciphertext message.

31. The communication device according to claim 27, characterized in that The processing module is further used for: Performing an operation on a second key, the first plaintext message, and the first fresh value to generate a message authentication code, where the message authentication code is used by the second node to perform integrity verification on the plaintext message; Arrange the first ciphertext message, the message authentication code and the truncated first freshness value in order to obtain a second ciphertext message; When the transceiver module sends the first ciphertext message and the truncated first freshness value to the second node, it is specifically used to: send the second ciphertext message to the second node.

32. The communication device according to claim 27, characterized in that The processing module performs an XOR operation on the key stream and the first plaintext message to be transmitted to generate a first ciphertext message, specifically for: Performing an operation on a second key and the first plaintext message to generate a message authentication code, where the message authentication code is used by the second node to perform integrity verification on the first plaintext message; Arrange the first plaintext message and the message authentication code in order to obtain a second plaintext message; An XOR operation is performed on the key stream and the second plaintext message to generate the first ciphertext message.

33. The communication device according to any one of claims 27 to 32, characterized in that: The processing module is further used to use a key deduction algorithm to operate the shared key and the first preset parameter to generate the first key, where the shared key is a key shared by the communication device and the second node.

34. The communication device according to claim 33, characterized in that The first preset parameter is an algorithm type parameter.

35. The communication device according to any one of claims 29 to 32, characterized in that: The processing module is further used to use a key deduction algorithm to operate the shared key and the second preset parameter to generate a second key, where the shared key is a key shared by the communication device and the second node.

36. The communication device according to claim 35, characterized in that The second preset parameter is an algorithm type parameter.

37. The communication device according to any one of claims 27 to 32, characterized in that: The transceiver module is further used to send indication information to the second node, where the indication information is used to indicate any one of the following: The communication device performs integrity protection on the first plaintext message; or, The communication device performs integrity protection and encryption protection on the first plaintext message.

38. A communication device, characterized in that: Including transceiver module and processing module: The transceiver module is used to obtain a first ciphertext message and a truncated first freshness value, wherein the first ciphertext message comes from a first node, the first freshness value is the number of times the first node transmits the message, and the truncated first freshness value is a fragment of the first freshness value; The processing module is used to perform an operation on the first key and the truncated first fresh value to generate a key stream; and perform an XOR operation on the key stream and the first ciphertext message to obtain a first plaintext message.

39. The communication device according to claim 38, characterized in that The truncated first fresh value is configured starting from the least significant bit (LSB) of the first fresh value.

40. The communication device according to claim 38, characterized in that The processing module is used for: Acquire a complete fresh value according to the truncated first fresh value; The first key and the complete fresh value are operated to generate the key stream.

41. The communication device according to claim 40, characterized in that The processing module is used for: Determining that the truncated first fresh value is higher than a portion of the fresh value locally stored at the second node corresponding to the truncated fresh value; The portion of the locally stored fresh value, except the portion corresponding to the truncated fresh value, is connected with the truncated first fresh value to obtain a complete fresh value.

42. The communication device according to claim 40, characterized in that The processing module is used for: Determining that the truncated first fresh value is lower than a portion of the fresh value locally stored by the second node corresponding to the truncated first fresh value; The part of the locally stored fresh value except the part corresponding to the truncated fresh value is added by 1, and then connected with the truncated first fresh value to obtain a complete fresh value.

43. The communication device according to claim 38, characterized in that When the transceiver module obtains the first ciphertext message and the truncated first freshness value, it is specifically used to: receive a second ciphertext message from the first node, where the second ciphertext message is obtained by arranging the first ciphertext message, the message authentication code and the truncated first freshness value in order; Obtaining the first ciphertext message and the truncated first freshness value from the second ciphertext message; The processing module is further configured to obtain the message authentication code from the second ciphertext message before generating the key stream; when it is determined that the first freshness value is greater than the second freshness value, perform operation on the second key, the first ciphertext message and the first freshness value to generate a new message authentication code; It is determined that the new message authentication code is consistent with the acquired message authentication code, and the second fresh value is a fresh value stored locally when the communication device receives the second ciphertext message.

44. The communication device according to claim 43, characterized in that In the second ciphertext message, the truncated first freshness value precedes the first ciphertext message, and the message authentication code follows the first ciphertext message.

45. The communication device according to claim 38, characterized in that When the transceiver module obtains the first ciphertext message and the truncated first freshness value, it is specifically used to: receive a second ciphertext message from the first node, where the second ciphertext message is obtained by arranging the first ciphertext message, the message authentication code and the truncated first freshness value in order; Obtaining the first ciphertext message, the message authentication code, and the truncated first freshness value from the second ciphertext message; The processing module is further configured to, before generating the key stream, when it is determined that the first freshness value is greater than the second freshness value, perform operation on the second key, the first plaintext message and the first freshness value to generate a new message authentication code; It is determined that the new message authentication code is consistent with the acquired message authentication code, and the second fresh value is a fresh value stored locally when the communication device receives the second ciphertext message.

46. ​​The communication device according to claim 38, characterized in that When the transceiver module obtains the first ciphertext message and the truncated first fresh value, it is specifically used to: receive the first ciphertext message and the truncated first fresh value from the first node; When the processing module performs an XOR operation on the key stream and the first ciphertext message to obtain the first plaintext message, the processing module is specifically used to: perform an XOR operation on the key stream and the first ciphertext message to obtain a second plaintext message, where the second plaintext message is obtained by arranging the first plaintext message and the message authentication code in sequence; Obtaining the first plaintext message and the message authentication code from the second plaintext message; The processing module is further configured to, after obtaining the first plaintext message, perform a calculation on the second key, the first plaintext message and the first fresh value to generate a new message authentication code; According to the consistency between the new message authentication code and the acquired message authentication code, it is determined that the first plaintext message is complete.

47. The communication device according to any one of claims 43 to 46, characterized in that: The processing module is also used for: The second fresh value stored locally at the second node is updated according to the truncated first fresh value.

48. The communication device according to any one of claims 43 to 46, characterized in that: The processing module is also used for: A key deduction algorithm is used to operate the shared key and the first preset parameter to generate the first key, where the shared key is a key shared by the first node and the second node.

49. The communication device according to claim 48, characterized in that The first preset parameter is an algorithm type parameter.

50. The communication device according to any one of claims 43 to 46, characterized in that: The processing module is also used for: A key deduction algorithm is used to operate the shared key and the second preset parameter to generate the second key, where the shared key is a key shared by the first node and the second node.

51. The communication device according to claim 50, characterized in that The second preset parameter is an algorithm type parameter.

52. The communication device according to any one of claims 38 to 46, characterized in that: The transceiver module is also used for: Receive indication information from the first node, where the indication information is used to indicate that the first node has performed integrity protection on the first plaintext message, or to indicate that the first node has performed integrity protection and encryption protection on the first plaintext message.

53. A communication device, characterized in that: It includes a processor and a transceiver, wherein the transceiver is used to receive signals from other communication devices outside the communication device and transmit them to the processor or send signals from the processor to other communication devices outside the communication device, and the processor is used to implement the method according to any one of claims 1 to 11 or any one of claims 12 to 26 through a logic circuit or executing code instructions.

54. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program or instruction. When the computer program or instruction is executed by the communication device, the method according to any one of claims 1 to 11 or any one of claims 12 to 26 is implemented.

55. A communication system, characterized in that: The invention comprises the communication device according to any one of claims 27 to 37 and the communication device according to any one of claims 38 to 52.

Images