Method and apparatus for determining truncation policy for freshness value for secure in-vehicle communications

Abstract

The present application proposes a method and apparatus for determining a truncation policy for a freshness value used by an electronic control unit (ECU) in secure in-vehicle communications. The method comprises the following steps: determining two ECUs participating in safe vehicle-mounted communication; determining a truncation length of the freshness value using a deep learning network model based on parameters related to attributes of the two ECUs; generating a truncated freshness value by truncating the freshness value using the truncation length; a secure protocol data unit (PDU) is generated by filling at least the truncated freshness value after a protected PDU transmitted in the secure in-vehicle communication. According to the method, compromise and balance can be carried out between safety and communication efficiency, the truncation length of the optimal freshness value is obtained, and the optimal truncation strategy is applied based on the truncation length.

Description

Background Art

[0002] With the widespread use of Internet of Vehicles, the demand for data communication security in vehicles has increased significantly. The Security Onboard Communication (SecOC) module is an independent module in AUTOSAR. It introduces communication authentication on the traditional vehicle CAN bus as an onboard network security bus solution, which can provide a resource-efficient and practical security authentication mechanism at the Protocol Data Unit (PDU) level for vehicle data transmission and interaction.

[0003] Replay attacks are a typical type of attack against vehicle communications. The current secure communication mode implemented by the Electronic Control Unit (ECU) based on the SecOC security mechanism can prevent this attack by filling the PDU with a freshness value. However, due to limitations such as communication bandwidth, the freshness value is usually truncated. The truncation length and truncation scheme of the freshness value are generally negotiated and determined by the Original Equipment Manufacturer (OEM) and the supplier based on the vehicle solution and are fixed for secure communications between all ECUs. The fixed freshness value truncation length cannot coordinate communication efficiency and security in all situations.

[0004] Therefore, there is a need to improve the truncation length and truncation strategy of freshness values ​​used in in-vehicle safety communications. Summary of the invention

[0005] In response to the above-mentioned problems, the present application proposes a method, a device and a computer storage medium for determining a truncation strategy of a freshness value used by an ECU in secure in-vehicle communications.

[0006] According to one aspect of the present application, a method for determining a truncation strategy for a freshness value used by an electronic control unit (ECU) in secure in-vehicle communication is proposed, comprising: determining two ECUs participating in the secure in-vehicle communication, the two ECUs including a sending ECU and a receiving ECU; determining a truncation length of the freshness value using a deep learning network model based on parameters related to attributes of the two ECUs, wherein the deep learning network model is trained based on historical data of the parameters and the truncation length; generating a truncated freshness value by truncating the freshness value using the truncation length; generating a secure protocol data unit (PDU) transmitted in the secure in-vehicle communication by filling at least the truncated freshness value after the protected PDU.

[0007] According to another aspect of the present application, a device for determining a truncation strategy for a freshness value used by an electronic control unit (ECU) in secure in-vehicle communication is proposed, comprising a processor and an executable instruction memory for storing the processor, wherein the processor is configured to execute executable instructions to implement the method described above.

[0008] According to another aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. The computer program includes executable instructions. When the executable instructions are executed by a processor, the method described above is implemented.

[0009] According to yet another aspect of the present application, a vehicle is provided for performing in-vehicle safety communication using the method described above.

[0010] By adopting the truncation strategy for determining the freshness value used by the ECU in safe vehicle communication proposed in this application, the resources of the two ECUs implementing the communication can be fully utilized, and the truncation length of the corresponding freshness value can be determined for different ECU pairs consisting of a sender ECU and a receiver ECU using a deep learning network model. This truncation length determination method can improve the communication efficiency between ECUs without reducing the anti-attack performance of vehicle safety communication, especially the anti-replay attack performance, and make a compromise and balance between security and communication efficiency to obtain the optimal truncation length of the freshness value and apply the optimal truncation strategy based on the truncation length. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other features and advantages of the present application will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings.

[0012] Figure 1 The present invention is a schematic flowchart of a method for determining a truncation strategy of a freshness value used by an ECU in secure in-vehicle communication according to an embodiment of the present application.

[0013] Figure 2 The diagram is a schematic diagram of the distribution of ECU communication clusters implementing the SecOC security mechanism in a vehicle according to an embodiment of the present application.

[0014] Figure 3 The data composition structure of the freshness value according to the embodiment of the present application.

[0015] Figure 4 It is a schematic diagram of a message frame structure of a security protocol data unit according to an embodiment of the present application.

[0016] Figure 5 Detailed description of the invention is given in detail below: FIG. 1 is an exemplary structure of a deep learning network model according to an embodiment of the present application.

[0017] Figure 6The present invention is a schematic structural block diagram of an electronic device for determining a truncation strategy of a freshness value used by an ECU in secure in-vehicle communication according to an embodiment of the present application. DETAILED DESCRIPTION

[0018] The exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, the exemplary embodiments can be implemented in a variety of forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided to make the contents of this application comprehensive and complete and to fully convey the concepts of the exemplary embodiments to those skilled in the art. In the drawings, the size of some elements may be exaggerated or deformed for clarity. The same reference numerals in the drawings represent the same or similar structures, and thus their detailed descriptions will be omitted.

[0019] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, elements, etc. can be adopted. In other cases, known structures, methods or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0020] As mentioned above, the purpose of the SecOC module is to provide communication authentication for vehicle network security and to provide a resource-efficient and practical security authentication mechanism for data transmission and interaction at the protocol data unit (PDU) level. The SecOC module can provide identity authentication for data transmitted in the SecOC security mechanism, and can effectively detect attacks such as data playback, deception, and tampering. In a hierarchical network structure, each layer of the network transmission system will establish a PDU, which includes information from the upper layer and information attached to the entity of the current layer. After the additional information, the PDU is transmitted to the next layer to extract relevant information and data. For example, the SecOC security mechanism can use MAC (Message Authentication Code) as a verifier to implement identity authentication and prevent bus data from being tampered with.

[0021] Replay attacks, also known as replay attacks or replay attacks, refer to an attacker sending a data packet that has already been received by the recipient to achieve the purpose of deception. Replay attacks can destroy the correctness of authentication during the identity authentication process, eavesdrop on data during data transmission, or use forged data instead of correct data. Replay attacks can be carried out by the initiator of the data packet or by an attacker who intercepts and resends the data packet. For example, during the authentication process, the attacker steals the authentication credentials by network monitoring or other means, and then resends it to the authentication server. The transmitted data is usually encrypted, but if the eavesdropper knows the definition of the data packet, he can confuse the receiver by sending the data again without knowing the specific data content. For example, the data transmission system will simply encrypt the authentication information or the transmitted data before transmitting it. Although the attacker cannot eavesdrop on the password, he can first intercept the encrypted password and then replay it, so that the receiver responds to the forged data packet and sends data to the attacker.

[0022] The defense scheme for replay attacks includes adding specific additional data for authentication and encryption in the transmitted data packet (e.g., PDU) according to the rules agreed upon in advance by the receiver and the sender. The specific additional data includes, for example: 1) a random number (a stored random number agreed upon in advance by the receiver and the sender); 2) a timestamp (requiring the receiver and the sender to perform accurate time synchronization); 3) a counter (e.g., a gradually increasing integer). According to an embodiment of the present application, the specific additional data used for anti-replay attacks generally adopts data related to 2) and 3).

[0023] In order to prevent data transmission in secure vehicle communications on the CAN bus from being replayed, the concept of freshness value (FV) is introduced in the SecOC security mechanism. The encryption and decryption of complex encryption algorithms require high computing resources and data bandwidth, while the freshness value setting can make a trade-off between performance and security, effectively improving bus security to a certain extent, so it is mainly used in anti-replay attacks.

[0024] There are three main ways to use freshness values: 1) Signal Counter; 2) Timestamp; and 3) Multiple Freshness Counters. The multiple freshness counter in 3) is usually used to generate freshness values. The multiple freshness value represents the real-time nature of the information and is generated by two modes: timestamp check and frame counter check. Among them, the timestamp check requires accurate time synchronization between the two ECUs involved in the vehicle safety communication.

[0025] Figure 3An exemplary data composition structure of the freshness value is shown. From the most significant bit MSB to the least significant bit LSB, the freshness value FV 300 is composed of the values ​​of the trip counter 301, the reset counter 302, the message counter 303 and the reset flag 304. The length of these data values ​​is 8 bytes (64 bits / bit) in total, wherein the value of the reset bit 304 is usually 1 bit. Among them, the trip counter 301 is an incremental counter with an initial value of 0, which is incremented during power-on, wake-up and other operations. When the trip counter 301 increments, the reset counter 302 is cleared. The reset counter 302 increases monotonically, indicating that according to the cycle set in the application scenario, when the reset counter 302 increments, the message counter 303 is cleared. The message counter 303 increases monotonically, and the message counter 303 of the sender ECU or the main ECU increases by 1 every time the sender ECU or the main ECU sends a data packet. The reset bit 304 is used to synchronize the value of the reset counter 302 from the sender ECU or the master ECU in real time.

[0026] It should be noted that the secure data transmission in the SecOC security mechanism is completed between two or more ECUs that serve as senders and receivers respectively. In the master-slave mode, these two or more ECUs are also called slave ECUs. In the master-slave mode, the master ECU updates the setting information about the data such as the freshness value by sending a synchronization message to the two or more slave ECUs that perform data transmission. At this time, the master ECU serves as the security mechanism formulation party for the secure data communication of the SecOC security mechanism. In the non-master-slave mode, the sender ECU sends a synchronization message to the receiver ECU to send the setting information about the data such as the freshness value. At this time, the sender ECU serves as the security mechanism formulation party for the secure data communication of the SecOC security mechanism. Although the participants in the data transmission in the secure vehicle communication may include two or more ECUs, for each data transmission, the ECUs participating in the data transmission are generally completed by two ECUs (also called ECU pairs) consisting of a sender ECU and a receiver ECU (the slave ECU is also divided into a sender ECU and a receiver ECU in a single data transmission). Therefore, the freshness value corresponds to the two ECUs or ECU pairs participating in the data transmission.

[0027] During the synchronization process, the sending ECU or the master ECU puts the new values ​​of the synchronization counter and the reset counter in the synchronization message and sends it to the receiving ECU or the slave ECU. After receiving the synchronization message, the receiving ECU or the slave ECU stores and updates the values ​​of the two counters and counts based on the reset counter during the transmission process of secure communication.

[0028] The SecOC security mechanism uses the secure PDU (Secured PDU) message frame structure when transmitting data. The secure PDU includes an optional secure PDU header, a protected PDU (authentic PDU), an optional freshness value, and an authenticator from the most significant bit MSB to the least significant bit LSB. The protected PDU is the PDU data that needs to be protected against replay attacks in secure vehicle communications. Filling the freshness value in the secure PDU can prevent the PDU data from being stolen and forged, thereby improving security.

[0029] Those skilled in the art realize that if the data length of the security PDU message frame is too long, it will lead to a waste of communication resources and a decrease in communication efficiency. Therefore, it is necessary to shorten the length of the security PDU message frame as much as possible while ensuring sufficient security performance. Usually, the data length of the entire security PDU message frame is shortened by truncating the data of the freshness value and / or the authenticator value.

[0030] When truncating the freshness value, the low-order part of the message counter can be truncated or the data of the set data length can be truncated starting from the least significant bit LSB as part of the truncated freshness value, and the value of the reset bit is added as the other part of the truncated freshness value to form the truncated freshness value and fill it into the protected PDU. The truncated freshness value is generally filled after the protected PDU. Other content and information in the freshness value are not visible to the receiving ECU or slave ECU in the received protected PDU. The data of the synchronization counter and reset counter transmitted in the message frame data structure of the SecOC security mechanism on-board communication are transmitted through synchronization messages, so the synchronization message can ensure the consistency of the freshness value FV information at both the sending ECU and the receiving ECU.

[0031] In the vehicle communication of the SecOC security mechanism, the message authentication code (MAC) authentication method is used. The MAC calculated using the CMAC algorithm of AES-128 can be used as the authenticator value. When the authenticator value is truncated, such as Figure 4 As shown in , the data of the calculated or preset truncation length of the validator value 420 is truncated from the most significant bit MSB and filled into the protected PDU as the truncated validator value 421. The truncated validator value 421 is generally filled after the truncated freshness value. The low-order part 422 left after the truncation in the validator is discarded. The truncation length and truncation strategy of the validator are not discussed in detail in this article.

[0032] Therefore, one of the key points of the compromise and balance between security and communication efficiency is to obtain the optimal truncation length of the freshness value and apply the optimal truncation strategy based on the truncation length. If the truncation length of the freshness value is too long, it will lead to a waste of communication resources and reduced communication efficiency, while if the truncation length of the freshness value is too short, it will affect the security performance against replay attacks. The existing truncation length and truncation strategy of the freshness value are generally determined by the OEM and supplier based on the vehicle solution and the CPU resources of each ECU, and the truncation length and strategy are fixed for all ECUs. The present application aims to provide a more optimal truncation length and strategy for the freshness value, especially to provide a variable truncation length and strategy for the freshness value for the specific situation of two ECUs involved in data transmission for secure vehicle communications, so as to achieve optimal system performance.

[0033] The following will be combined with the attached Figure 1 The system flow of a solution for determining a truncation length and a truncation strategy of a freshness value used by an ECU in secure in-vehicle communication according to an embodiment of the present application is introduced.

[0034] The process mainly includes step S110 of determining the sending ECU and the receiving ECU participating in the secure in-vehicle communication, step S120 of determining the truncation length of the freshness value based on the attribute-related parameters of the two ECUs using a deep learning network model, step S130 of generating a truncated freshness value based on the determined truncation length, and step S140 of generating a secure PDU by filling at least the truncated freshness value after the transmitted protected PDU.

[0035] First, step S110 determines an ECU pair consisting of two ECUs participating in the secure vehicle communication. Figure 2 As shown, there may be multiple ECUs implementing different functions on the vehicle architecture that implements the SecOC security mechanism. These ECUs are divided into different groups in the form of ECU communication clusters according to the functions implemented and the relevance and scope of data communication. The number of ECUs included in each ECU communication cluster may be the same or different. For example, Figure 2ECU 210 and ECU 220 in the ECU communication cluster 200-1 of the SecOC security mechanism, ECU 230 and ECU 250 form an ECU communication cluster 200-2, and ECU 230, ECU240 and ECU260 form an ECU communication cluster 200-3. According to the embodiment of the present application, the truncation strategy of the freshness value is determined only for the safe vehicle communication between the ECU pairs consisting of two ECUs belonging to the same communication cluster, and there is no need for safe data communication between ECUs belonging to different ECU communication clusters, so there is no need to consider the truncation strategy of the freshness value between these ECUs. Different truncation lengths and truncation strategies of freshness values ​​can be determined for each ECU pair with different ECUs that have the need for vehicle-mounted safety communication, and a unified truncation length and truncation strategy can also be determined for all ECUs in each ECU communication cluster. For example, when safe vehicle data communication is carried out between any two ECUs, one ECU is a sending ECU and the other ECU is a receiving ECU, and the two implement data transmission such as unicast, then a specific truncation strategy of freshness value can be determined for the unicast data transmission. When the safe in-vehicle data communication is carried out between one ECU and multiple other ECUs, the single ECU is the sender ECU, and the other multiple ECUs are all receiving ECUs. These ECUs implement data transmission such as multicast. Then, a unified truncation strategy of the freshness value can be determined for the multicast data transmission, or a specific truncation strategy of the freshness value can be determined between the sender ECU and each receiving ECU. The truncation strategy of the freshness value can be distinguished by the ID of the ECU participating in the safe in-vehicle communication. It can be understood that in the safe in-vehicle communication between two ECUs, no matter which ECU is the sender ECU and the other ECU is the receiving ECU, the truncation length and strategy of the freshness value determined for the two ECUs are the same. In the following, ECUs 210 and 220 in the ECU communication cluster 200-1 are taken as examples to introduce the technical details of calculating the optimal truncation length and truncation strategy of the freshness value.

[0036] Step S120 is used to determine the truncation length of the freshness value used by the two ECUs participating in the secure communication based on their attributes. The parameters associated with the attributes include the load parameter and the effective load parameter of the sender ECU 210, the load parameter and the effective load parameter of the receiver ECU 220, and other communication efficiency parameters associated with the secure in-vehicle communication between the two.

[0037] Parameters related to the properties of the sender ECU and the receiver ECU include the processing performance of the ECU, memory capacity, communication bandwidth, and data frame size. Other communication efficiency parameters associated with secure in-vehicle communication between two ECUs include, for example, the design and performance requirements of the vehicle solution. These parameters determine the range of data lengths of truncated freshness values ​​that can be supported by secure data communication between two ECUs, the optimal truncation length, and the truncation strategy.

[0038] The present application also uses a deep learning network model to determine the truncation length of the freshness value used by the ECU based on these parameters. The input of the deep learning network model includes a multidimensional input X n .exist Figure 5 In the example shown, the multidimensional input X n It at least includes the load parameter X1 of the sender ECU 210, the load parameter X2 of the receiver ECU 220, the payload parameter X3 of the sender ECU 210, the payload parameter X4 of the receiver ECU 220, and the communication efficiency parameter X5 related to safe vehicle communication. The output of the deep learning network model is Y(x), which takes the form of the truncated length and probability of the freshness value that can be used by the ECU pair consisting of ECU 210 and 220. The truncated length or the weighted value (integer) of the truncated length with the highest probability value or weighted probability value can be used as the final output Y determined and predicted by the deep learning network model, that is, the optimal truncated length of the freshness value. The predicted final output can be marked with the ID combination of the ECU pair. For example, if the labels of ECU 210 and 220 are a and b respectively, the optimal truncated length determined and predicted for the two can use Y ab According to an embodiment of the present application, the data of each dimension of the input and output of the deep learning network model can be a scalar.

[0039] The size of the input, hidden, and output layers of the deep learning network model and the scale of each layer (e.g., size, number of layers) are related to the number of ECUs involved in safe in-vehicle communication and the complexity of the features extracted from these multi-dimensional inputs. Figure 5 In the example in , the network model has two hidden layers.

[0040] The loss function or constraint of the deep learning network model is set based on the requirements of the anti-replay attack performance and / or communication efficiency of the secure vehicle communication. For example, the loss function or constraint can be that the anti-replay attack performance is optimal or not less than the safety performance threshold, and / or the communication efficiency between ECUs is optimal or not less than the communication efficiency threshold, and / or the truncation length of the freshness value is greater than or equal to the minimum length threshold (e.g., 8 bits). Specifically, the loss function can be further set to that the mean square error of the communication efficiency between ECUs is lower than the mean square error threshold when the truncation length of the freshness value is not less than the minimum length threshold.

[0041] Before use, the deep learning network model needs to be trained based on a training data set consisting of historical data of truncated lengths of ECU attribute-related parameters and / or freshness values ​​for safe vehicle communication to determine the optimal model parameters. The training process is conducted in an offline manner. Offline here not only means that the model training has been completed offline based on historical data instead of online real-time prediction before the deep learning network model is used to determine and predict the truncation lengths for safe communication for the two currently determined ECUs, but also means that the training process is performed on a server / data processor that is not deployed on the vehicle or is located far away from the vehicle or on a server / data processor located at the equipment manufacturer or supplier, and the trained network model is deployed on the vehicle. It can also mean that the deep learning network model is not deployed on the vehicle but on a server or data processor that is located far away from the vehicle, then the training of the network model and the prediction and determination of the truncation strategy for each ECU pair or each ECU communication cluster are completed outside the vehicle and the vehicle only stores the various freshness value truncation strategies that have been determined. According to an embodiment of the present application, a deep learning network model can also be set on the vehicle as a part of the security module or processor of the vehicle-mounted device, and the truncated length and strategy of the optimal freshness value for each ECU pair or ECU communication cluster are calculated and predicted in advance based on historical data according to the ECU of each communication cluster on the vehicle, and used when the ECU pair performs secure vehicle communication. The parameters of the deep learning network model can be trained or updated again offline at a set period or according to demand.

[0042] In the learning process of the deep learning network model, a verified training data set can be used, or an unverified training data set can be used. When unverified historical data is used as a training data set, for example, a deep learning network model that supports unsupervised learning can be used, without verifying the training data set, and the network model input (such as the ECU's parameters related to the ECU's attributes and / or the truncated length of the freshness value mentioned above) can be directly used for model building and training and to optimize the parameters of the network model. The deep learning network model can also further use a reinforcement learning network.

[0043] The trained deep learning network model continuously optimizes the network model to achieve the best communication efficiency without affecting the anti-replay attack performance (for example, the truncation length of the freshness value is selected to be no less than 8 bits), and finally outputs the optimal truncation length of the freshness value.

[0044] In step S130, the freshness value is truncated based on the optimal truncation length predicted by the network model to generate a truncated freshness value. Figure 3 , which shows that the truncated freshness value used to fill the protected PDU is truncated in the freshness value 300 using the determined optimal truncation length. The optimal truncation length of the freshness value predicted by the network model is recorded as L. According to the truncation setting of the freshness value, it is necessary to truncate data of length L starting from the least significant bit LSB of the freshness value 300 as the truncated freshness value 306. Specifically, the freshness value 300 is, starting from the least significant bit LSB, the reset bit 304, the message counter 303, the reset counter 302 and the synchronization counter 301. The data length of the reset bit 304 is, for example, 1 bit. Since the requirement that the truncation length of the freshness value is not less than 8 bits does not affect the anti-replay attack performance, the truncated freshness value 306 includes not only the reset bit 304, but also a part of the data truncated from the least significant bit LSB of the value of the message counter 303 as another part of the truncated freshness value 306, that is, the high-order data part shown in 305. The data length of the high-order data portion 305 of the truncated freshness value 306 is referred to as the message counter truncation length L′, where L′=L−the data length (in bits) of the reset bit 304 .

[0045] Next, in step S140 , after the truncated freshness value is filled into the protected PDU, a secure PDU is generated. Figure 4 The specific method of generating a secure PDU is shown in FIG. The secure PDU 400 includes a protected PDU 430, followed by a truncated freshness value 411 and a truncated validator value 421. Figure 3 Similar to the truncation strategy of the freshness value shown in FIG. 4 , the freshness value 410 truncates data of a data length of L starting from the least significant bit LSB and is used as the truncated freshness value portion in the security PDU, and the remaining truncated high-order data portion 412 in the freshness value 410 is discarded. After the truncated freshness value 411, the security PDU 400 also includes a truncated validator value 421 from the validator value 420. The validator value 420 truncates data of a preset validator truncation length starting from the most significant bit MSB and is used as the truncated validator value portion in the security PDU, and the remaining truncated low-order data portion 422 in the validator value 420 is discarded.

[0046] The secure PDU generated through the above process is applied to the secure vehicle communication between ECU 210 and ECU 220 and the corresponding parameters are configured to achieve a compromise and optimal match between the anti-replay attack performance and communication efficiency between ECUs with secure communication requirements. For all ECUs on the vehicle, the following can be used: Figure 1 The method flow described determines an optimal freshness value cutoff length and strategy to use in communication.

[0047] The embodiments of the present application also provide a vehicle capable of using the truncation length and truncation strategy of the freshness value determined by the method described above to generate a secure PDU for use in data transmission in secure in-vehicle communication.

[0048] By adopting the truncation strategy for determining the freshness value used by the ECU in safe vehicle communication proposed in this application, the resources of the two ECUs implementing the communication can be fully utilized, and the truncation length of the corresponding freshness value can be determined for different ECU pairs consisting of a sender ECU and a receiver ECU using a deep learning network model. This truncation length determination method can improve the communication efficiency between ECUs without reducing the anti-attack performance of vehicle safety communication, especially the anti-replay attack performance, and make a compromise and balance between security and communication efficiency to obtain the optimal truncation length of the freshness value and apply the optimal truncation strategy based on the truncation length.

[0049] In an exemplary embodiment of the present application, a computer-readable storage medium is also provided, on which a computer program is stored, the program including executable instructions, which can implement the steps of the method for determining the truncation strategy of the freshness value used by the ECU in the safe vehicle communication described in any of the above embodiments when the executable instructions are executed by, for example, a processor. In some possible implementations, various aspects of the present application can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to cause the terminal device to execute the steps described in the method for determining the truncation strategy of the freshness value used by the ECU in the safe vehicle communication according to various exemplary embodiments of the present application.

[0050] The program product for implementing the above method according to the embodiment of the present application can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present application is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0051] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0052] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by an instruction execution system, an apparatus, or a device or used in combination with it. The program code contained on the readable storage medium may be transmitted with any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0053] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0054] In an exemplary embodiment of the present application, an electronic device is also provided, which may include a processor and a memory for storing executable instructions of the processor. The processor is configured to execute the steps of the method for determining a truncation strategy for a freshness value used by an ECU in secure vehicle communication in any of the above embodiments by executing the executable instructions.

[0055] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0056] Refer to the following Figure 6 The electronic device 600 according to this embodiment of the present application is described. Figure 6 The electronic device 600 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0057] like Figure 6 As shown, the electronic device 600 is in the form of a general computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610), a display unit 640, etc.

[0058] The storage unit stores a program code, which can be executed by the processing unit 610, so that the processing unit 610 performs the steps of various exemplary embodiments of the present application described in the method for determining the truncation strategy of the freshness value used by the ECU in the secure vehicle communication. For example, the processing unit 610 can perform the following steps: Figure 1 Follow the steps shown in .

[0059] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache memory unit 6202 , and may further include a read-only memory unit (ROM) 6203 .

[0060] The storage unit 620 may also include a program / utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0061] Bus 630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0062] The electronic device 600 may also communicate with one or more external devices 700 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 600, and / or communicate with any device that enables the electronic device 600 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 650. Furthermore, the electronic device 600 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 660. The network adapter 660 may communicate with other modules of the electronic device 600 via a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0063] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the method for determining the truncation strategy of the freshness value used by the ECU in safe vehicle communication according to the implementation of the present application.

[0064] Those skilled in the art will readily appreciate other embodiments of the present application after considering the description and practicing the contents disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The description and embodiments are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the appended claims.

Claims

1. A method for determining a truncation strategy for a freshness value used by an electronic control unit (ECU) in secure in-vehicle communications, comprising: Determining two ECUs participating in the secure vehicle communication, the two ECUs comprising a sending ECU and a receiving ECU; determining a cutoff length of the freshness value using a deep learning network model based on parameters related to properties of the two ECUs, wherein the deep learning network model is trained based on historical data of the parameters and the cutoff length; generating a truncated freshness value by truncating the freshness value using the truncation length; A secure protocol data unit (PDU) transmitted in the secure in-vehicle communication is generated by padding a protected PDU with at least the truncated freshness value.

2. The method according to claim 1, characterized in that The parameters include a load parameter and a payload parameter of the sender ECU, a load parameter and a payload parameter of the receiver ECU, and a communication efficiency parameter related to the secure vehicle communication.

3. The method according to claim 2, characterized in that The load parameter and the payload parameter of the sender ECU and the load parameter and the payload parameter of the receiver ECU are respectively related to at least one of the processing performance, memory capacity, communication bandwidth and data frame size of the sender ECU and the receiver ECU, and the communication efficiency parameter is related to the design and performance requirements of the vehicle.

4. The method according to claim 3, characterized in that The input of the deep learning network model is the parameters, and the output of the deep learning network model is the truncation length that enables the secure in-vehicle communication to meet requirements related to anti-replay attack performance and / or communication efficiency.

5. The method according to claim 4, characterized in that The deep learning network model is an unsupervised reinforcement learning network.

6. The method according to claim 1, characterized in that The freshness value includes at least a message counter value and a reset bit value, and generating a truncated freshness value by truncating the freshness value using the truncation length includes: Truncating data of a message counter truncation length from the least significant bit of the message counter value as first truncation data, wherein the message counter truncation length is the data length of the truncation length minus the reset bit value; The truncated freshness value is generated by combining the first truncated data and the reset bit value.

7. The method according to claim 1, characterized in that Generating a secure protocol data unit (PDU) transmitted in the secure in-vehicle communication by padding at least the truncated freshness value after a protected PDU includes: The secure protocol data unit (PDU) is generated by padding the protected PDU with the truncated freshness value and the truncated authenticator value.

8. The method according to claim 1, characterized in that The two ECUs belong to the same ECU communication cluster, which is located in a vehicle implementing the secure in-vehicle communication and includes at least the two ECUs.

9. The method according to claim 8, characterized in that The freshness value is updated through a synchronization message sent by the sender ECU to the receiver ECU, or through a synchronization message sent by a master ECU in the ECU communication cluster for managing the sender ECU and the receiver ECU.

10. The method according to claim 8, characterized in that An ECU pair consisting of any two ECUs in the ECU communication cluster has different truncation lengths.

11. The method according to claim 10, characterized in that The different truncation lengths are determined based on the same trained deep learning network model.

12. The method according to claim 10, characterized in that Different truncation lengths are determined using different deep learning network models, and the different deep learning network models are trained based on the parameters of the ECUs in the corresponding ECU pair and historical data of the truncation lengths.

13. An apparatus for determining a truncation strategy for a freshness value used by an electronic control unit (ECU) in secure in-vehicle communications, comprising: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the executable instructions to implement the method according to any one of claims 1 to 12.

14. A computer-readable storage medium having a computer program stored thereon, the computer program comprising executable instructions, and when the executable instructions are executed by a processor, the method according to any one of claims 1 to 12 is implemented.

15. A vehicle using the method according to claims 1 to 12 for in-vehicle safety communication.

Images