Vehicle CAN communication network security protection method and system based on OBD gateway

Abstract

The invention provides a vehicle CAN communication network safety protection method and system based on an OBD gateway. The method comprises the steps that an OBD gateway unit receives identity identification information of all parts of a whole vehicle for identity confirmation; if the identity verification is passed, opening communication channels between the gateway and each part and between the parts; the OBD gateway unit is a gateway ECU (Electronic Control Unit) which is additionally arranged on an OBD interface of the whole vehicle; bidirectional identity verification is carried out between the vehicle and the special equipment based on an encryption verification algorithm, and if the identity verification is passed, the whole vehicle is opened to carry out external data interaction through an OBD interface; the special equipment is gateway identity authentication equipment; receiving a software upgrade package sent by the special equipment, and verifying the authenticity and integrity of the upgrade package based on an encryption verification algorithm; and if the upgrade package passes the verification, issuing the software upgrade package to each part for upgrading. The gateway ECU is additionally arranged on the unique OBD interface of the whole vehicle to manage CAN external communication of the whole vehicle in a unified mode, and safe communication of parts of the whole vehicle is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle network security, and in particular to a vehicle CAN communication network security protection method and system based on an OBD gateway. Background Art

[0002] With the development of intelligent and connected technologies, vehicle network security issues are becoming more and more important. Among them, the software upgrade security protection of vehicle parts is becoming increasingly prominent. The software upgrade security protection of vehicle parts is an important part of ensuring vehicle network security. In order to ensure the safety and stability of the vehicle, effective measures must be taken to protect the software upgrade process of vehicle parts.

[0003] The common means of protection for current software upgrades is to protect the integrity and authenticity of the upgrade package by combining digests, digital signatures, and digital certificates for the upgrade package during the software upgrade process. This method requires vehicle manufacturers and component manufacturers to establish a complete key management process and system. The current effective way to protect CAN communication security is to use SecOC. However, due to cost investment and technical level limitations, some component manufacturers cannot fully match the above solutions. In this case, more protection measures need to be implemented at the vehicle level to protect the upgrade process and CAN communication security. In addition, there is a lack of unified control over the external communication interfaces of vehicle components, and the risk of illegal access is high. The OBD interface lacks targeted security protection strategies, resulting in many weak links in the vehicle CAN communication network when facing external threats. A comprehensive and coordinated security protection solution is urgently needed to solve these problems. Summary of the invention

[0004] In order to solve the above problems, the present invention proposes a vehicle CAN communication network security protection method and system based on OBD gateway. By adding a gateway ECU to the only OBD interface of the whole vehicle, only the whole vehicle OBD interface is retained as the communication interface of the whole vehicle, and the whole vehicle CAN external communication channel is uniformly managed to achieve safe communication of vehicle parts.

[0005] In order to achieve the above object, the present invention adopts the following technical solution:

[0006] In a first aspect, the present invention provides a vehicle CAN communication network security protection method based on an OBD gateway, comprising:

[0007] When the vehicle is powered on, the OBD gateway unit receives the identity information of all vehicle components for identity confirmation; if the identity confirmation is successful, the communication channels between the gateway and each component and between each component are opened; the OBD gateway unit is a gateway ECU installed on the OBD interface of the vehicle;

[0008] When the vehicle OBD is connected to a dedicated device, a two-way identity authentication is performed between the OBD gateway unit and the dedicated device based on an encryption verification algorithm. If the identity authentication is passed, the vehicle is opened to external data interaction through the OBD interface; the dedicated device is a gateway identity authentication device;

[0009] When the software package is updated, the OBD gateway unit receives the software upgrade package sent by the dedicated device and verifies the authenticity and integrity of the upgrade package based on the encryption verification algorithm; if the upgrade package passes the verification, the software upgrade package is sent to each component for upgrading.

[0010] Preferably, the OBD gateway unit receives the identity information of all vehicle components for identity confirmation; if the identity confirmation is successful, the communication channels between the gateway and each component and between each component are opened; specifically including:

[0011] The OBD gateway unit receives the identity information sent by each component through the CAN communication network based on the vehicle's custom communication protocol;

[0012] The identity identification information is compared one by one based on the pre-stored legal identity identification tags; if the information matches, the communication channels between the gateway and each component and between each component are opened; otherwise, the information of identity authentication failure is transmitted to the dashboard, and the component is prohibited from communicating with the gateway; the legal identity identification tag includes a unique serial number, a specific code or a digital certificate.

[0013] Preferably, the alarm information of each component is not restricted by identity confirmation. If a component generates an alarm information, it is transmitted to the instrument panel in real time for display.

[0014] Preferably, the OBD gateway unit and the dedicated device perform two-way identity authentication based on an encryption verification algorithm. If the identity authentication is passed, the whole vehicle is opened to external data interaction through the OBD interface; specifically, the following steps are included:

[0015] The OBD gateway unit and the dedicated device respectively pre-store a pair of asymmetric keys, including a gateway private key, a gateway public key, a dedicated device private key, and a dedicated device public key;

[0016] The OBD gateway unit receives the device authentication information sent by the dedicated device, performs hash processing on the device authentication information using the SHA-256 algorithm to generate a first hash value; encrypts the first hash value using the gateway public key and the RSA algorithm to generate a first digital signature, and sends the first digital signature to the dedicated device;

[0017] The dedicated device uses the gateway private key and the RSA algorithm to decrypt the first digital signature to obtain a second hash value; compares the first hash value and the second hash value, if they are the same, the verification is successful, the data has not been tampered with during transmission, and comes from the OBD gateway unit; otherwise, the verification fails;

[0018] The dedicated device receives the gateway authentication information sent by the OBD gateway unit, performs hash processing on the gateway authentication information using the SHA-256 algorithm to generate a third hash value; encrypts the third hash value using the dedicated device public key and the RSA algorithm to generate a second digital signature, and sends the second digital signature to the OBD gateway unit;

[0019] The OBD gateway unit decrypts the second digital signature using a dedicated device private key and an RSA algorithm to obtain a fourth hash value; compares the third hash value and the fourth hash value, and if they are the same, the verification is successful, the data has not been tampered with during transmission, and comes from a dedicated device; otherwise, the verification fails;

[0020] If the two-way verification is successful, the OBD gateway unit opens the vehicle to external data exchange through the OBD interface.

[0021] Preferably, the OBD gateway unit receives the software upgrade package sent by the dedicated device, and verifies the authenticity and integrity of the upgrade package based on an encryption verification algorithm, specifically including:

[0022] The OBD gateway unit and the software upgrade package respectively pre-store a pair of asymmetric keys, including a gateway private key, a gateway public key, a sender private key, and a sender public key;

[0023] The OBD gateway unit receives the upgrade package authentication information sent by the software upgrade package, performs hash processing on the upgrade package authentication information using the SHA-256 algorithm to generate a fifth hash value; encrypts the fifth hash value using the gateway public key and the RSA algorithm to generate a third digital signature, and sends the fifth digital signature to the dedicated device;

[0024] The software upgrade package uses the gateway private key and the RSA algorithm to decrypt the third digital signature to obtain a sixth hash value; compare the fifth hash value and the sixth hash value, if they are the same, the verification is successful, the data has not been tampered with during transmission, and comes from the OBD gateway unit; otherwise, the verification fails;

[0025] The software upgrade package receives the gateway authentication information sent by the OBD gateway unit, performs hash processing on the gateway authentication information using the SHA-256 algorithm to generate a seventh hash value; encrypts the seventh hash value using the sender's public key and the RSA algorithm to generate a fourth digital signature, and sends the seventh digital signature to the OBD gateway unit;

[0026] The OBD gateway unit decrypts the fourth digital signature using the sender's private key and the RSA algorithm to obtain an eighth hash value; compares the seventh hash value with the eighth hash value, and if they are the same, the verification is successful, the data has not been tampered with during transmission, and is from the software upgrade package; otherwise, the verification fails;

[0027] If the two-way authenticity and integrity verification is successful, the OBD gateway unit opens a communication channel with the software upgrade package.

[0028] Preferably, if the upgrade package passes the verification, the software upgrade package is sent to each component for upgrading, specifically: according to the identity identifier of the upgrade package corresponding to the legal identity identifier of the component, a targeted software upgrade is performed.

[0029] Preferably, it also includes retaining only the OBD port of the whole vehicle as the communication interface of the whole vehicle, and using physical blocking to protect the external upgrade and debugging interfaces of all components of the whole vehicle.

[0030] In a second aspect, the present invention provides a vehicle CAN communication network security protection system based on an OBD gateway, comprising:

[0031] The gateway-component verification module is configured so that when the vehicle is powered on, the OBD gateway unit receives the identity information of all the components of the vehicle for identity confirmation; if the identity confirmation is passed, the communication channel between the gateway and each component and between the components is opened; the OBD gateway unit is a gateway ECU installed on the OBD interface of the vehicle;

[0032] The gateway-dedicated device verification module is configured to perform two-way identity authentication between the OBD gateway unit and the dedicated device based on an encryption verification algorithm when the vehicle OBD is connected to the dedicated device. If the identity authentication is passed, the vehicle is opened to external data interaction through the OBD interface; the dedicated device is a gateway identity authentication device;

[0033] When the upgrade package verification and distribution module is configured to update and upgrade the software package, the OBD gateway unit receives the software upgrade package sent by the dedicated device and verifies the authenticity and integrity of the upgrade package based on the encryption verification algorithm; if the upgrade package verification passes, the software upgrade package is distributed to each component for upgrading.

[0034] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a vehicle CAN communication network security protection method based on an OBD gateway as described in the first aspect.

[0035] In a fourth aspect, the present invention provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of a vehicle CAN communication network security protection method based on an OBD gateway as described in the first aspect are implemented.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] (1) The present invention adopts the method of installing a gateway ECU on the OBD port of the whole vehicle and using an encryption algorithm to perform security verification, perform identity authentication management on the components of the whole vehicle, uniformly manage the external communication of the whole vehicle CAN network, use special tools for the communication of the whole vehicle OBD port, block and protect the external interfaces and debugging interfaces of the components except the communication interface of the whole vehicle, perform software upgrade operations on the components of the whole vehicle through the gateway, ensure the safety of the software upgrade environment, and thus improve the network security protection of software upgrade and CAN communication.

[0038] (2) The present invention concentrates the key links of security protection on the gateway ECU node by installing a gateway ECU at the OBD port of the vehicle and using encryption algorithms for security verification and unified management of the vehicle CAN network external communication. Instead of over-relying on vehicle manufacturers and parts manufacturers to build complex key management processes and systems, security is ensured through a unified encryption algorithm verification mechanism at the gateway, which reduces the degree of dependence on the original complex key management system and reduces the security risks caused by the difficulty of some parts manufacturers to establish a complete key management process and system.

[0039] (3) The present invention creates a relatively closed and secure software upgrade environment by using a dedicated device (gateway identity authentication device) for the vehicle's OBD port communication and blocking the external interfaces and debugging interfaces of the components except the vehicle's communication interface. At the same time, the software upgrade operation of each component is performed with the help of the gateway, further ensuring that the software upgrade process can be carried out under more controllable and safer conditions, avoiding external illegal intrusion and interference, and effectively improving the network security protection level during the software upgrade process.

[0040] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their description are used to explain the present invention but do not constitute a limitation of the present invention.

[0042] Figure 1A main flow chart of a vehicle CAN communication network security protection method based on an OBD gateway provided in an embodiment of the present invention;

[0043] Figure 2 A schematic diagram of the overall framework of a vehicle CAN communication network security protection method based on an OBD gateway provided in an embodiment of the present invention;

[0044] Figure 3 A schematic diagram of an identity authentication process between an OBD gateway unit and a dedicated device provided in an embodiment of the present invention;

[0045] Figure 4 A schematic diagram of a software upgrade package upgrade process provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0047] Embodiment 1

[0048] like Figure 1 As shown, this embodiment discloses a vehicle CAN communication network security protection method based on an OBD gateway, comprising the following steps:

[0049] S1: When the vehicle is powered on, the OBD gateway unit receives the identity information of all vehicle components for identity confirmation; if the identity confirmation is successful, the communication channels between the gateway and each component and between each component are opened; the OBD gateway unit is a gateway ECU installed on the OBD interface of the vehicle;

[0050] S2: When the vehicle OBD is connected to a dedicated device, a two-way identity authentication is performed between the OBD gateway unit and the dedicated device based on an encryption verification algorithm. If the identity authentication is successful, the vehicle is opened to external data interaction through the OBD interface; the dedicated device is a gateway identity authentication device;

[0051] S3: When the software package is updated, the OBD gateway unit receives the software upgrade package sent by the dedicated device and verifies the authenticity and integrity of the upgrade package based on the encryption verification algorithm; if the upgrade package passes the verification, the software upgrade package is sent to each component for upgrading.

[0052] Next, combine Figure 2 , a vehicle CAN communication network security protection method based on OBD gateway disclosed in this embodiment is described in detail.

[0053] In S1, when the vehicle is powered on, the OBD gateway unit will receive the identity information from all the components of the vehicle and perform identity confirmation operations on the information. Only when the identity confirmation is successful will the communication channels between the gateway and the components and between the components be opened.

[0054] The gateway fully integrates the identity information of all vehicle components. At the same time, each component also has built-in gateway authentication data. Whenever the vehicle is powered on, all components will communicate with the gateway to confirm each other's identities. The gateway is specifically the OBD gateway unit, which is a gateway ECU installed on the vehicle's OBD interface. The specific process of confirming identity is as follows:

[0055] The OBD gateway unit receives the identity information sent by each component through the CAN communication network based on the vehicle's custom communication protocol;

[0056] The identity identification information is compared one by one based on the pre-stored legal identity identification tags; if the information matches, the communication channels between the gateway and each component and between each component are opened; otherwise, the information of identity authentication failure is transmitted to the dashboard, and the component is prohibited from communicating with the gateway; the legal identity identification tag includes a unique serial number, a specific code or a digital certificate.

[0057] As a specific implementation method, the instrument panel is a type of component, and the alarm information displayed on the instrument panel is not restricted by the identity authentication process between the gateway and the instrument, ensuring that key information can be transmitted in real time.

[0058] Once the components have successfully passed the identity authentication, they can communicate with the outside world with the help of the gateway. On the contrary, if they fail to pass the identity authentication, the components cannot use the OBD interface for external communication. At this time, the gateway will quickly transmit the information of the identity authentication failure to the dashboard, and clearly display it, such as: "XXX component identity authentication failed, and it has been prohibited from communicating with the OBD interface", to ensure the safety and stability of the vehicle communication system.

[0059] In S2, when the vehicle has external data exchange requirements, the OBD gateway unit needs to perform two-way identity authentication with the dedicated device based on the encryption verification algorithm. If and only if the two-way identity authentication is passed, the vehicle can realize external data exchange through the OBD interface.

[0060] In this embodiment, the dedicated device (dedicated tool) is a gateway identity authentication device. Only after passing the identity authentication will the gateway ECU open the external communication of the vehicle's OBD interface. Other OBD communication external devices can communicate data with the vehicle through OBD through the dedicated device.

[0061] The dedicated device is a device specifically developed for gateway ECU identity authentication, including hardware devices connected to OBD and interactive host computer software. The host computer software is installed on the computer and connected to the network to exchange information with the cloud server. The host computer software has an account and password login function.

[0062] In terms of security, this embodiment only performs identity authentication for dedicated devices, which is more targeted and restricts arbitrary access by external devices, thereby enhancing vehicle information and driving safety. From the perspective of system resource utilization, it reduces the authentication burden, saves resources, and optimizes communication management, making communication more orderly and stable.

[0063] like Figure 3 As shown, the OBD gateway unit and the dedicated device perform two-way identity authentication based on an encryption verification algorithm, wherein the encryption verification algorithm is a method for generating a file digest based on RSA2048 asymmetric encryption and SHA256, specifically including:

[0064] S201: The OBD gateway unit and the dedicated device respectively store a pair of asymmetric keys in advance, including a gateway private key, a gateway public key, a dedicated device private key, and a dedicated device public key; wherein the gateway unit stores the dedicated device private key and the gateway public key discretely or in the security module of the ECU, the host computer software of the dedicated device stores the gateway public key, and the gateway private key and the gateway identity coding data are stored in pairs on the company's cloud server. The unique coding information of the gateway device is obtained through the host computer software of the dedicated device, and the host computer software of the dedicated device obtains the gateway private key on the cloud server according to the unique coding information of the gateway device.

[0065] S202: The OBD gateway unit receives device authentication information sent by the dedicated device, performs hash processing on the device authentication information using the SHA-256 algorithm to generate a first hash value; encrypts the first hash value using the gateway public key and the RSA algorithm to generate a first digital signature, and sends the first digital signature to the dedicated device;

[0066] S203: The dedicated device decrypts the first digital signature using the gateway private key and the RSA algorithm to obtain a second hash value; compares the first hash value and the second hash value, if they are the same, the verification is successful, the data has not been tampered with during transmission, and comes from the OBD gateway unit; otherwise, the verification fails;

[0067] S204: The dedicated device receives the gateway authentication information sent by the OBD gateway unit, performs hash processing on the gateway authentication information using the SHA-256 algorithm to generate a third hash value; encrypts the third hash value using the dedicated device public key and the RSA algorithm to generate a second digital signature, and sends the second digital signature to the OBD gateway unit;

[0068] S205: The OBD gateway unit decrypts the second digital signature using the dedicated device private key and the RSA algorithm to obtain a fourth hash value; compares the third hash value and the fourth hash value, if they are the same, the verification is successful, the data has not been tampered with during transmission, and comes from the dedicated device; otherwise, the verification fails;

[0069] S206: If the two-way verification is successful, the OBD gateway unit opens the vehicle to external data exchange through the OBD interface.

[0070] This embodiment adopts two-way verification, which greatly enhances the security of data transmission. By combining hash algorithm with asymmetric encryption, it ensures that the information transmitted between the gateway unit and the dedicated device has not been tampered with and the source is reliable. Secondly, it can effectively prevent illegal equipment from accessing, protect the internal network of the vehicle from external malicious attacks, maintain the stable operation of the vehicle system, avoid security risks caused by data leakage or tampering, improve the overall network security protection level of the vehicle, and provide solid protection for data interaction such as vehicle software upgrades.

[0071] As a specific implementation method, in addition to opening the OBD interface for external communication, physical blocking is used to protect the external upgrade and debugging interfaces of all vehicle components, and only the OBD port of the vehicle is retained as the communication interface of the vehicle.

[0072] In S3, when there is a situation of receiving a software upgrade package, the OBD gateway unit will be responsible for receiving the software upgrade package sent by the dedicated device, and use the encryption verification algorithm to strictly verify the authenticity and integrity of the upgrade package. Once the upgrade package passes the verification, the OBD gateway unit will send the software upgrade package to each component to implement the software upgrade operation of each component.

[0073] like Figure 4 As shown in the figure, when a component needs to be upgraded due to function upgrade or vulnerability repair, first, the identity authentication verification is completed through the OBD and gateway by a dedicated device, and then the software upgrade package is downloaded to the gateway through a dedicated tool. The gateway verifies the authenticity and integrity of the upgrade package based on the asymmetric encryption of RSA2048 and the method of generating file digests with SHA256. After the verification is passed, the software of the corresponding component is upgraded according to the identity of the upgrade package. The functional verification at the vehicle level is completed, and the component upgrade operation is completed.

[0074] Specifically, the authenticity and integrity of the upgrade package are verified based on the encryption verification algorithm, including:

[0075] S301: The OBD gateway unit and the software upgrade package respectively pre-store a pair of asymmetric keys, including a gateway private key, a gateway public key, a sender private key, and a sender public key;

[0076] S302: The OBD gateway unit receives the upgrade package authentication information sent by the software upgrade package, performs hash processing on the upgrade package authentication information using the SHA-256 algorithm to generate a fifth hash value; encrypts the fifth hash value using the gateway public key and the RSA algorithm to generate a third digital signature, and sends the fifth digital signature to the dedicated device;

[0077] S303: The software upgrade package uses the gateway private key and the RSA algorithm to decrypt the third digital signature to obtain a sixth hash value; compare the fifth hash value and the sixth hash value, if they are the same, the verification is successful, the data has not been tampered with during transmission, and comes from the OBD gateway unit; otherwise, the verification fails;

[0078] S304: The software upgrade package receives the gateway authentication information sent by the OBD gateway unit, performs hash processing on the gateway authentication information using the SHA-256 algorithm to generate a seventh hash value; encrypts the seventh hash value using the sender's public key and the RSA algorithm to generate a fourth digital signature, and sends the seventh digital signature to the OBD gateway unit;

[0079] S305: The OBD gateway unit decrypts the fourth digital signature using the sender's private key and the RSA algorithm to obtain an eighth hash value; compares the seventh hash value with the eighth hash value, and if they are the same, the verification is successful, the data has not been tampered with during transmission, and is from the software upgrade package; otherwise, the verification fails;

[0080] S306: If the two-way authenticity and integrity verification is successful, the OBD gateway unit opens a communication channel with the software upgrade package.

[0081] As an implementation method, if the upgrade package passes the verification, the software upgrade package is sent to each component for upgrading; otherwise, the rollback procedure is triggered to roll back the vehicle system to the safe state before the upgrade. The process of sending the software upgrade package to each component for upgrading is: according to the identity of the upgrade package corresponding to the legal identity of the component, a targeted software upgrade is performed.

[0082] This specific embodiment uniformly manages the external communication of the vehicle CAN network by adding a gateway ECU. It can monitor, filter, security check and identity authentication of all data entering and leaving the vehicle CAN network, build a unified and effective security line for CAN communication at the vehicle level, make up for the security loopholes caused by poor implementation by parts manufacturers, and comprehensively improve the network security protection effect of CAN communication.

[0083] Embodiment 2

[0084] This embodiment provides a vehicle CAN communication network security protection system based on an OBD gateway, including:

[0085] The gateway-component verification module is configured so that when the vehicle is powered on, the OBD gateway unit receives the identity information of all the components of the vehicle for identity confirmation; if the identity confirmation is passed, the communication channel between the gateway and each component and between the components is opened; the OBD gateway unit is a gateway ECU installed on the OBD interface of the vehicle;

[0086] The gateway-dedicated device verification module is configured to perform two-way identity authentication between the OBD gateway unit and the dedicated device based on an encryption verification algorithm when the vehicle OBD is connected to the dedicated device. If the identity authentication is passed, the vehicle is opened to external data interaction through the OBD interface; the dedicated device is a gateway identity authentication device;

[0087] When the upgrade package verification and distribution module is configured to update and upgrade the software package, the OBD gateway unit receives the software upgrade package sent by the dedicated device and verifies the authenticity and integrity of the upgrade package based on the encryption verification algorithm; if the upgrade package verification passes, the software upgrade package is distributed to each component for upgrading.

[0088] Embodiment 3

[0089] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the vehicle CAN communication network security protection method based on an OBD gateway as described in the first embodiment are implemented.

[0090] Embodiment 4

[0091] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of a vehicle CAN communication network security protection method based on an OBD gateway as described in the first embodiment are implemented.

[0092] The steps or modules involved in the above embodiments 2 to 4 correspond to those in embodiment 1. For the specific implementation, please refer to the relevant description of embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood to include any medium that can store, encode or carry an instruction set for execution by a processor and enable the processor to execute any method in the present invention.

[0093] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A vehicle CAN communication network security protection method based on OBD gateway, characterized in that: include: When the vehicle is powered on, the OBD gateway unit receives the identification information of all vehicle components for identity confirmation; If the identity confirmation is passed, the communication channels between the gateway and each component and between each component are opened; the OBD gateway unit is a gateway ECU installed on the OBD interface of the whole vehicle; When the vehicle OBD is connected to a dedicated device, a two-way identity authentication is performed between the OBD gateway unit and the dedicated device based on an encryption verification algorithm. If the identity authentication is passed, the vehicle is opened to external data interaction through the OBD interface; the dedicated device is a gateway identity authentication device; When the software package is updated, the OBD gateway unit receives the software upgrade package sent by the dedicated device and verifies the authenticity and integrity of the upgrade package based on the encryption verification algorithm; If the upgrade package verification passes, the software upgrade package will be sent to each component for upgrading.

2. A vehicle CAN communication network security protection method based on OBD gateway as claimed in claim 1, characterized in that: The OBD gateway unit receives the identity information of all vehicle components for identity confirmation; if the identity confirmation is successful, the communication channels between the gateway and each component and between each component are opened; specifically, the following are included: The OBD gateway unit receives the identity information sent by each component through the CAN communication network based on the vehicle's custom communication protocol; The identity identification information is compared one by one based on the pre-stored legal identity identification tags; if the information matches, the communication channels between the gateway and each component and between each component are opened; otherwise, the information of identity authentication failure is transmitted to the dashboard, and the component is prohibited from communicating with the gateway; the legal identity identification tag includes a unique serial number, a specific code or a digital certificate.

3. A vehicle CAN communication network security protection method based on OBD gateway as claimed in claim 2, characterized in that: The alarm information of each component is not restricted by identity confirmation. If a component generates an alarm, it will be transmitted to the dashboard in real time for display.

4. A vehicle CAN communication network security protection method based on OBD gateway as claimed in claim 1, characterized in that: The OBD gateway unit and the dedicated device perform two-way identity authentication based on an encryption verification algorithm. If the identity authentication is passed, the vehicle is opened to external data interaction through the OBD interface; specifically, the following steps are included: The OBD gateway unit and the dedicated device respectively pre-store a pair of asymmetric keys, including a gateway private key, a gateway public key, a dedicated device private key, and a dedicated device public key; The OBD gateway unit receives the device authentication information sent by the dedicated device, performs hash processing on the device authentication information using the SHA-256 algorithm to generate a first hash value; encrypts the first hash value using the gateway public key and the RSA algorithm to generate a first digital signature, and sends the first digital signature to the dedicated device; The dedicated device uses the gateway private key and the RSA algorithm to decrypt the first digital signature to obtain a second hash value; compares the first hash value and the second hash value, if they are the same, the verification is successful, the data has not been tampered with during transmission, and comes from the OBD gateway unit; otherwise, the verification fails; The dedicated device receives the gateway authentication information sent by the OBD gateway unit, performs hash processing on the gateway authentication information using the SHA-256 algorithm to generate a third hash value; encrypts the third hash value using the dedicated device public key and the RSA algorithm to generate a second digital signature, and sends the second digital signature to the OBD gateway unit; The OBD gateway unit decrypts the second digital signature using a dedicated device private key and an RSA algorithm to obtain a fourth hash value; compares the third hash value and the fourth hash value, and if they are the same, the verification is successful, the data has not been tampered with during transmission, and comes from a dedicated device; otherwise, the verification fails; If the two-way verification is successful, the OBD gateway unit opens the vehicle to external data exchange through the OBD interface.

5. A vehicle CAN communication network security protection method based on OBD gateway as claimed in claim 1, characterized in that: The OBD gateway unit receives the software upgrade package sent by the dedicated device and verifies the authenticity and integrity of the upgrade package based on the encryption verification algorithm, specifically including: The OBD gateway unit and the software upgrade package respectively pre-store a pair of asymmetric keys, including a gateway private key, a gateway public key, a sender private key, and a sender public key; The OBD gateway unit receives the upgrade package authentication information sent by the software upgrade package, performs hash processing on the upgrade package authentication information using the SHA-256 algorithm to generate a fifth hash value; encrypts the fifth hash value using the gateway public key and the RSA algorithm to generate a third digital signature, and sends the fifth digital signature to the dedicated device; The software upgrade package uses the gateway private key and the RSA algorithm to decrypt the third digital signature to obtain a sixth hash value; compare the fifth hash value and the sixth hash value, if they are the same, the verification is successful, the data has not been tampered with during transmission, and comes from the OBD gateway unit; otherwise, the verification fails; The software upgrade package receives the gateway authentication information sent by the OBD gateway unit, performs hash processing on the gateway authentication information using the SHA-256 algorithm to generate a seventh hash value; encrypts the seventh hash value using the sender's public key and the RSA algorithm to generate a fourth digital signature, and sends the seventh digital signature to the OBD gateway unit; The OBD gateway unit decrypts the fourth digital signature using the sender's private key and the RSA algorithm to obtain an eighth hash value; compares the seventh hash value with the eighth hash value, and if they are the same, the verification is successful, the data has not been tampered with during transmission, and is from the software upgrade package; otherwise, the verification fails; If the two-way authenticity and integrity verification is successful, the OBD gateway unit opens a communication channel with the software upgrade package.

6. A vehicle CAN communication network security protection method based on OBD gateway as claimed in claim 1, characterized in that: If the upgrade package verification passes, the software upgrade package is sent to each component for upgrading, specifically: according to the identity identifier of the upgrade package corresponding to the legal identity identifier of the component, a targeted software upgrade is performed.

7. A vehicle CAN communication network security protection method based on OBD gateway as claimed in claim 1, characterized in that: It also includes retaining only the vehicle's OBD port as the vehicle's communication interface, and using physical blocking methods to protect the external upgrade and debugging interfaces of all vehicle components.

8. A vehicle CAN communication network security protection system based on OBD gateway, characterized in that: include: The gateway-component verification module is configured so that when the vehicle is powered on, the OBD gateway unit receives the identity information of all vehicle components for identity confirmation; If the identity confirmation is passed, the communication channels between the gateway and each component and between each component are opened; the OBD gateway unit is a gateway ECU installed on the OBD interface of the whole vehicle; The gateway-dedicated device verification module is configured to perform two-way identity authentication between the OBD gateway unit and the dedicated device based on an encryption verification algorithm when the vehicle OBD is connected to the dedicated device. If the identity authentication is passed, the vehicle is opened to external data interaction through the OBD interface; the dedicated device is a gateway identity authentication device; The upgrade package verification and delivery module is configured to update and upgrade the software package. When the OBD gateway unit receives the software upgrade package sent by the dedicated device, the authenticity and integrity of the upgrade package are verified based on the encryption verification algorithm. If the upgrade package verification passes, the software upgrade package will be sent to each component for upgrading.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by the processor, the steps in the vehicle CAN communication network security protection method based on OBD gateway as described in any one of claims 1-7 are implemented.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps in the vehicle CAN communication network security protection method based on OBD gateway as described in any one of claims 1-7 are implemented.

Images