Data diagnosis processing method, device and equipment based on vehicle Ethernet, medium and program product

Abstract

The invention relates to a data diagnosis processing method, device and equipment based on a vehicle Ethernet, a medium and a program product, and relates to the technical field of vehicles, the data diagnosis processing method based on the vehicle Ethernet comprises the following steps: responding to a data diagnosis request and an equipment certificate sent by vehicle diagnosis equipment, and if a to-be-detected item indicated by the data diagnosis request is determined, determining the to-be-detected item according to the to-be-detected item; if the equipment certificate does not exist in the first permission routing table, verifying the equipment certificate; wherein the data diagnosis request comprises vehicle data of items to be detected; the data diagnosis request accords with an Ethernet transmission protocol; the equipment certificate is the certificate of the vehicle diagnosis equipment; the first permission routing table comprises a plurality of to-be-detected items, and the data security requirement of the to-be-detected items of the first permission routing table is lower than a first preset data security requirement; if it is determined that the verification of the device certificate is passed, sending the data diagnosis request to the target terminal; wherein the vehicle data in the data diagnosis request is used for obtaining a data diagnosis result.

Description

Technical Field

[0001] The present invention relates to the field of vehicle technology, and in particular to a data diagnosis and processing method, device, equipment, medium and program product based on vehicle Ethernet. Background Art

[0002] Most cars use Controller Area Network (CAN) for in-car communication. However, as vehicles have more and more intelligent functions, such as autonomous driving and Over-the-Air Technology (OTA) upgrades, these functions require the transmission of large amounts of data and higher data transmission speeds. Therefore, automotive Ethernet is introduced to transmit large data packets and high-efficiency data.

[0003] However, in the related field, when vehicle diagnosis is performed via Ethernet communication, the identity of the device requesting diagnosis is usually not verified, resulting in the problem of low security of vehicle diagnosis solutions using Ethernet communication. Summary of the invention

[0004] One of the purposes of the present invention is to provide a data diagnostic processing method, device, equipment, medium and program product based on vehicle Ethernet, so as to solve the problem in the prior art that the security of vehicle diagnostic solutions based on Ethernet communication is low due to the failure to verify the identity of the requesting diagnostic device, thereby effectively improving the security of vehicle diagnostic solutions based on Ethernet communication.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0006] A data diagnosis processing method based on vehicle Ethernet, comprising: responding to a data diagnosis request and a device certificate sent by a vehicle diagnostic device, if it is determined that the item to be detected indicated by the data diagnosis request does not exist in a first authority routing table, then verifying the device certificate; wherein the data diagnosis request includes vehicle data of the item to be detected; the data diagnosis request complies with the Ethernet transmission protocol; the device certificate is a certificate of the vehicle diagnostic device; the first authority routing table includes multiple items to be detected, and the data security requirements of the items to be detected in the first authority routing table are lower than the first preset data security requirements; if it is determined that the verification of the device certificate is passed, then sending the data diagnosis request to a target terminal; wherein the vehicle data in the data diagnosis request is used to obtain a data diagnosis result.

[0007] According to the above technical means, the vehicle diagnostic device will send a data diagnostic request containing the vehicle data of the items to be tested, and attach the device certificate. The system will verify the device certificate. If the verification is successful, the data diagnostic request will be sent to the target terminal to obtain the data diagnostic result.

[0008] Further, if it is determined that the device certificate does not exist in the first authority routing table, the device certificate is verified to obtain a first verification result; wherein, the first authority routing table includes device certificates of devices that meet device security requirements; and the first verification result indicates that the verification of the device certificate has passed.

[0009] Further, a root certificate corresponding to the vehicle diagnostic device is retrieved; if it is determined that the obtained root certificate is consistent with the device certificate, it is determined that the first verification result is obtained.

[0010] Furthermore, the sending frequency of the diagnostic request is monitored; if it is determined that the sending frequency meets at least one of the following preset conditions, the diagnostic request is determined to be an abnormal request, and an identity authentication instruction is sent to the vehicle diagnostic device; wherein, the preset condition is that the sending frequency of the diagnostic request is greater than a first preset value; or, the preset condition is that the diagnostic request repeatedly requests access to the same item to be detected within a preset time period, and the sending frequency is greater than a second preset value; wherein, the first preset value is greater than or equal to the second preset value.

[0011] Furthermore, the initial vehicle data corresponding to the vehicle data is determined to be a plurality of data segments; and according to the security factor of the vehicle data, different encryption algorithms are used to encrypt different data segments to obtain the vehicle data.

[0012] Furthermore, if the data security requirement of the vehicle data in the data diagnostic request is lower than the second preset data security requirement, the vehicle data in the data diagnostic request is unencrypted data; if the data security requirement of the vehicle data in the data diagnostic request is higher than the second preset data security requirement, the vehicle data in the data diagnostic request has a security factor, and the vehicle data in the data diagnostic request is encrypted based on the encryption method corresponding to the security factor corresponding to the vehicle data; wherein, if the security factor of the vehicle data in the data diagnostic request is a first security factor, the vehicle data in the data diagnostic request is encrypted based on the symmetric encryption method corresponding to the first security factor; if the security factor of the vehicle data in the data diagnostic request is a second security factor, the vehicle data in the data diagnostic request is encrypted based on the asymmetric encryption method corresponding to the second security factor.

[0013] Furthermore, a symmetric encryption sequence is randomly generated; the initial data corresponding to the vehicle data is encrypted using the symmetric encryption sequence to obtain first encrypted data; and the first public key corresponding to the initial vehicle data is initially encrypted using the symmetric encryption sequence to obtain an encrypted public key; the first encrypted data is encrypted again using the encrypted public key to obtain the vehicle data.

[0014] Furthermore, if it is determined that the session maintenance request sent by the vehicle diagnostic device is continuously received, the communication with the vehicle diagnostic device is maintained; if it is determined that the session maintenance request sent by the vehicle diagnostic device is not received within a preset time period, it is determined that an abnormality has occurred in the communication with the vehicle diagnostic device, and a network abnormality prompt message is sent to the vehicle diagnostic device; wherein, the network abnormality prompt message indicates that an abnormality has occurred in the communication with the vehicle diagnostic device.

[0015] Furthermore, the vehicle diagnostic device and the target terminal are deployed in different local area networks.

[0016] Furthermore, the data diagnosis result sent by the target terminal is received, and the data diagnosis result is fed back to the vehicle diagnosis device.

[0017] A data diagnosis processing device based on vehicle Ethernet includes: a verification unit, which is used to respond to a data diagnosis request and a device certificate sent by a vehicle diagnostic device. If it is determined that the item to be detected indicated by the data diagnosis request does not exist in a first authority routing table, the device certificate is verified; wherein the data diagnosis request includes vehicle data of the item to be detected; the data diagnosis request complies with the Ethernet transmission protocol; the device certificate is a certificate of the vehicle diagnostic device; the first authority routing table includes multiple items to be detected, and the data security requirements of the items to be detected in the first authority routing table are lower than the first preset data security requirements; a sending unit, which is used to send the data diagnosis request to a target terminal if it is determined that the verification of the device certificate is passed; wherein the vehicle data in the data diagnosis request is used to obtain a data diagnosis result.

[0018] Furthermore, the verification unit is used to determine whether the verification of the device certificate has passed, specifically: if it is determined that the device certificate does not exist in the first authority routing table, the device certificate is verified to obtain a first verification result; wherein the first authority routing table includes device certificates of devices that meet device security requirements; the first verification result indicates that the verification of the device certificate has passed.

[0019] Furthermore, the verification unit is further used to retrieve a root certificate corresponding to the vehicle diagnostic device; if it is determined that the obtained root certificate is consistent with the device certificate, it is determined that the first verification result is obtained.

[0020] Furthermore, the verification unit is also used to, before sending the data diagnostic request to the target terminal if it is determined that the verification of the device certificate is passed, specifically to: if it is determined that the item to be detected indicated by the data diagnostic request does not exist in the second authority routing table, execute the step of sending the data diagnostic request to the target terminal if it is determined that the verification of the device certificate is passed; wherein the second authority routing table includes multiple items to be detected, and the data security requirements of the items to be detected in the second authority routing table are lower than the first preset data security requirements.

[0021] Furthermore, the device also includes a monitoring unit for monitoring the sending frequency of the diagnostic request; if it is determined that the sending frequency meets at least one of the following preset conditions, the diagnostic request is determined to be an abnormal request, and an identity authentication instruction is sent to the vehicle diagnostic device; wherein, the preset condition is that the sending frequency of the diagnostic request is greater than a first preset value; or, the preset condition is that the diagnostic request repeatedly requests access to the same item to be detected within a preset time period, and the sending frequency is greater than a second preset value; wherein, the first preset value is greater than or equal to the second preset value.

[0022] Furthermore, the device also includes an encryption unit, which is used to determine the initial vehicle data corresponding to the vehicle data into multiple data segments; according to the security factor of the vehicle data, different encryption algorithms are used to encrypt different data segments to obtain the vehicle data.

[0023] Furthermore, the device also includes a security unit, which is specifically used to: if the data security requirement of the vehicle data in the data diagnostic request is lower than the second preset data security requirement, then the vehicle data in the data diagnostic request is unencrypted data; if the data security requirement of the vehicle data in the data diagnostic request is higher than the second preset data security requirement, then the vehicle data in the data diagnostic request has a security factor, and the vehicle data in the data diagnostic request is encrypted based on the encryption method corresponding to the security factor corresponding to the vehicle data.

[0024] Furthermore, the security unit is also used to: if the security factor of the vehicle data in the data diagnostic request is a first security factor, the vehicle data in the data diagnostic request is encrypted based on a symmetric encryption method corresponding to the first security factor; if the security factor of the vehicle data in the data diagnostic request is a second security factor, the vehicle data in the data diagnostic request is encrypted based on an asymmetric encryption method corresponding to the second security factor.

[0025] Furthermore, the security unit is also used to randomly generate a symmetric encryption sequence; use the symmetric encryption sequence to encrypt the initial data corresponding to the vehicle data to obtain first encrypted data; and use the symmetric encryption sequence to initially encrypt the first public key corresponding to the initial vehicle data to obtain an encrypted public key; use the encrypted public key to encrypt the first encrypted data again to obtain the vehicle data.

[0026] Furthermore, the device also includes a session unit, which is specifically used to: if it is determined that the session maintenance request sent by the vehicle diagnostic device is continuously received, then maintain the communication with the vehicle diagnostic device; if it is determined that the session maintenance request sent by the vehicle diagnostic device is not received within a preset time, then determine that the communication with the vehicle diagnostic device is abnormal, and send a network abnormality prompt message to the vehicle diagnostic device; wherein the network abnormality prompt message indicates that the communication with the vehicle diagnostic device is abnormal. Furthermore, the vehicle diagnostic device and the target terminal are deployed in different local area networks.

[0027] Furthermore, the apparatus also includes a feedback unit, which is specifically used to receive the data diagnosis result sent by the target terminal and feed back the data diagnosis result to the vehicle diagnosis device.

[0028] An electronic device comprises: a processor, and a memory communicatively connected to the processor;

[0029] The memory stores computer-executable instructions;

[0030] The processor executes the computer-executable instructions stored in the memory to implement the method for sending vehicle diagnostic results as described in the first aspect of the present invention.

[0031] A data diagnosis and processing system based on vehicle Ethernet includes: vehicle diagnosis equipment, a target terminal, and electronic equipment.

[0032] A computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed, the method for sending vehicle diagnostic results as described in the first aspect of the present invention is implemented.

[0033] A computer program product comprises a computer program, wherein when the computer program is executed, the method for sending vehicle diagnostic results as described in the first aspect of the present invention is implemented.

[0034] Beneficial effects of the present invention: The data diagnosis processing method, device, equipment, medium and program product based on vehicle Ethernet provided by the present invention verify the equipment certificate by responding to the data diagnosis request and equipment certificate sent by the vehicle diagnostic equipment; wherein the data diagnosis request includes the vehicle data of the item to be detected; the data diagnosis request complies with the Ethernet transmission protocol; the equipment certificate is the certificate of the vehicle diagnostic equipment; if it is determined that the verification of the equipment certificate is passed, the data diagnosis request is sent to the target terminal; wherein the vehicle data in the data diagnosis request is used to obtain the data diagnosis result. That is, by verifying the equipment certificate of the diagnostic requesting device, data diagnosis requests sent by illegal devices are prevented, thereby improving the security of the system. Ensure the integrity and accuracy of the data: only devices that have passed the verification can send data diagnosis requests, so that the received data can be ensured to be complete and accurate, thereby improving the accuracy of the data diagnosis results. The transmission of the above data is realized through Ethernet, which ensures the efficiency of data transmission while providing a safe diagnosis solution based on Ethernet communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A flow chart of a data diagnosis and processing method based on vehicle Ethernet provided by an embodiment of the present invention;

[0036] Figure 2 A flow chart of a data diagnosis and processing method based on vehicle Ethernet provided by another embodiment of the present invention;

[0037] Figure 3 This is a system architecture diagram of a data diagnosis and processing method based on vehicle Ethernet according to an embodiment of the present invention;

[0038] Figure 4 This is a schematic diagram of the structure of a data diagnosis and processing device based on vehicle Ethernet according to an embodiment of the present invention;

[0039] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The following will describe the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention, not for limiting the scope of protection of the present invention.

[0041] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0042] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and corresponding operation entrances shall be provided for users to choose to authorize or refuse.

[0043] In one example, car diagnosis needs to be transmitted through a communication network. As the number of intelligent functions of vehicles increases, such as autonomous driving and OTA upgrade functions, these functions require the transmission of large amounts of data and the data transmission speed requirements also become higher, so in-vehicle Ethernet is introduced to transmit large data packets and high-efficiency data. When there is a problem with Ethernet communication, based on the developed on-board automatic diagnostic system (English: On-Board Diagnostics, referred to as: OBD) interface, the network interface is used to perform functional debugging or fault diagnosis on the vehicle Ethernet node, which involves how the diagnostic equipment can be securely connected to the diagnostic interface. In the field of vehicle diagnosis based on Ethernet, identity authentication of the requesting device for diagnosis is usually not considered, resulting in low security of vehicle diagnostic solutions based on Ethernet communication, or diagnosis requires frequent user inquiries, resulting in low diagnostic efficiency.

[0044] Based on the above problems, the present invention provides a data diagnosis processing method based on vehicle Ethernet, which prevents data diagnosis requests from being sent by illegal devices by verifying the device certificate of the diagnostic request device, thereby improving the security of the system. Ensure the integrity and accuracy of the data: Only devices that have passed the verification can send data diagnosis requests, which can ensure that the received data is complete and accurate, thereby improving the accuracy of the data diagnosis results. The above data is transmitted through Ethernet, which ensures the efficiency of data transmission and provides a safe diagnosis solution based on Ethernet communication.

[0045] The technical solution of the present invention is described in detail below through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0046] Figure 1The flowchart of the data diagnosis and processing method based on vehicle Ethernet provided by one embodiment of the present invention. The data diagnosis and processing method based on vehicle Ethernet can be executed by software and / or hardware devices. For example, the hardware device can be a data diagnosis and processing device based on vehicle Ethernet, and the data diagnosis and processing device based on vehicle Ethernet can be an electronic device or a processing chip in an electronic device. Figure 1 As shown, the method of the embodiment of the present invention includes:

[0047] S101. In response to a data diagnostic request and a device certificate sent by a vehicle diagnostic device, if it is determined that the item to be detected indicated by the data diagnostic request does not exist in a first authority routing table, the device certificate is verified; wherein the data diagnostic request includes vehicle data of the item to be detected; the data diagnostic request complies with an Ethernet transmission protocol; the device certificate is a certificate of the vehicle diagnostic device; the first authority routing table includes multiple items to be detected, and the data security requirements of the items to be detected in the first authority routing table are lower than the first preset data security requirements.

[0048] Exemplarily, the data diagnosis request includes vehicle data of items to be detected, which generally involve key parameters such as vehicle status and fault information, so as to perform a comprehensive diagnosis, such as engine data, catalytic converter data, particulate filter data, oxygen sensor data, emission control system data, fuel system data, etc.

[0049] The data diagnostic request complies with the Ethernet transmission protocol. Since the request is transmitted on Ethernet, it needs to follow the corresponding network layer protocol, such as ISO 13400-2. The device certificate is used to verify the legitimacy of the vehicle diagnostic device. By verifying the certificate, it can be ensured that the diagnostic instrument is an authorized and legitimate device, not a malicious device.

[0050] S102: If it is determined that the verification of the device certificate is successful, the data diagnosis request is sent to a target terminal; wherein the vehicle data in the data diagnosis request is used to obtain a data diagnosis result.

[0051] Illustratively, the verification process checks whether the device certificate is issued by a trusted certificate authority and exists in a trusted certificate chain.

[0052] Optionally, it is also possible to verify whether the certificate has been revoked, preventing the use of a revoked or invalid device certificate for diagnosis.

[0053] When the certificate is verified, it indicates that the vehicle diagnostic device requesting the diagnosis is a legitimate device that can be trusted.

[0054] This embodiment verifies the device certificate in response to the data diagnostic request and device certificate sent by the vehicle diagnostic device, thereby ensuring the security of the vehicle data of the items to be detected in the data diagnostic request. When the certificate is verified, the data diagnostic request is sent to the target terminal to obtain the diagnostic result. In other words, the above-mentioned Ethernet diagnostic device authentication method allows the supervisory diagnostic device to read the vehicle information normally, and the normal diagnostic device can send diagnostic instructions only after passing the security authentication. For important diagnostic instructions, the relevant operations can only be performed after passing the security level authentication of the corresponding diagnostic request of the target terminal. It solves the problem in the prior art that the vehicle diagnostic solution based on Ethernet communication has low security due to the failure to verify the identity of the requesting diagnostic device.

[0055] Figure 2 A flowchart of a data diagnosis processing method based on vehicle Ethernet provided by another embodiment of the present invention. The data diagnosis processing method based on vehicle Ethernet can be executed by software and / or hardware devices. For example, the hardware device can be a data diagnosis processing device based on vehicle Ethernet, and the data diagnosis processing device based on vehicle Ethernet can be an electronic device or a processing chip in an electronic device. Figure 2 As shown, the method of the embodiment of the present invention includes:

[0056] S201. In response to a data diagnostic request and a device certificate sent by a vehicle diagnostic device, verify the device certificate; wherein the data diagnostic request includes vehicle data of items to be detected; the data diagnostic request complies with an Ethernet transmission protocol; and the device certificate is a certificate of the vehicle diagnostic device.

[0057] Exemplarily, the vehicle diagnostic device is used to send Ethernet diagnostic requests such as function debugging, fault diagnosis, data reading, etc. Optionally, the vehicle diagnostic device is divided into a supervisory diagnostic device and a normal diagnostic device, wherein the supervisory diagnostic device can directly read some specific diagnostic services. The normal diagnostic device is used for function debugging and fault diagnosis of vehicle manufacturers or aftermarket vehicles.

[0058] When the vehicle diagnostic device receives the device authentication request and diagnostic service authority security authentication request sent by the diagnostic access terminal and the target terminal, it needs to execute the relevant authentication process. After the normal diagnostic device and the diagnostic access terminal are authenticated, it needs to send a connection request in real time. After executing the relevant diagnostic service, it needs to send a request to stop the connection to the diagnostic access terminal.

[0059] The target terminal receives the diagnostic request forwarded by the diagnostic access terminal, responds according to the security level of the diagnostic request, directly feeds back diagnostic data for the diagnostic request sent by the supervisory diagnostic device, and can only perform diagnostic operations after the diagnostic request of the normal diagnostic device is authenticated at the corresponding level according to the security level of the diagnostic request.

[0060] S202. If it is determined that the item to be detected indicated by the data diagnostic request does not exist in the second authority routing table, execute the step of sending the data diagnostic request to the target terminal if it is determined that the verification of the device certificate is passed; wherein the second authority routing table includes multiple items to be detected, and the data security requirements of the items to be detected in the second authority routing table are lower than the first preset data security requirements.

[0061] Exemplarily, some low-risk preset detection items are pre-stored in the second authority routing table, that is, lower than the first preset data security requirement, and diagnostic services can be directly accessed without device authentication. In the case where the item to be detected indicated by the data diagnostic request does not exist in the second authority routing table, it means that the item to be detected indicated by the data diagnostic request is not low-risk, and the device certificate needs to be verified. Only when the device certificate verification is passed, the data diagnostic request will be sent to the target terminal, thereby improving the security of vehicle diagnosis.

[0062] Exemplarily, the sending frequency of the diagnostic request is monitored; if it is determined that the sending frequency meets at least one of the following preset conditions, the diagnostic request is determined to be an abnormal request, and an identity authentication instruction is sent to the vehicle diagnostic device; wherein the preset condition is that the sending frequency of the diagnostic request is greater than a first preset value; or, the preset condition is that the diagnostic request repeatedly requests access to the same item to be detected within a preset time period, and the sending frequency is greater than a second preset value; wherein the first preset value is greater than or equal to the second preset value.

[0063] It should be noted that since the data security requirement is lower than the first preset data security requirement, the access to the diagnostic service that can be performed directly without device authentication may result in malicious repeated access, occupying the communication channel, and thus causing other normal access to fail. Therefore, if the device sends diagnostic requests too frequently, it is considered that there is an abnormality in the diagnostic device and re-authentication is required; if the same item to be detected is repeatedly accessed at a high frequency in a short period of time, it is considered that there is an abnormality and re-authentication is required.

[0064] S203. If it is determined that the device certificate does not exist in the second authority routing table, verify the device certificate to obtain a first verification result; wherein the second authority routing table includes device certificates of devices that meet device security requirements; and the first verification result indicates that the verification of the device certificate is passed.

[0065] In one example, verifying the device certificate to obtain a first verification result includes: retrieving a root certificate corresponding to the vehicle diagnostic device; and if it is determined that the obtained root certificate is consistent with the device certificate, determining that the first verification result is obtained.

[0066] Exemplarily, the first authority routing table may pre-store a certificate blacklist. If the device certificate does not exist in the first authority routing table, it means that the device certificate is not a blacklist certificate. At this time, the device certificate needs to be verified, and the root certificate corresponding to the vehicle diagnostic device is retrieved. If it is determined that the obtained root certificate is consistent with the device certificate, the first verification result is determined to be obtained.

[0067] It should be noted that in order to verify the device, the system will retrieve the root certificate corresponding to the vehicle diagnostic device. The root certificate is the apex of the public key certificate chain and is used to verify whether the downstream certificate is valid. By verifying the device certificate, unauthorized devices can be prevented from disguising themselves as legitimate diagnostic devices to conduct man-in-the-middle attacks, thereby protecting the vehicle's data security.

[0068] Optionally, if it is not in the blacklist, it can also be determined whether the device certificate has expired. If it has not expired, the stored root certificate is used to verify the diagnosis request device certificate.

[0069] It should be noted that if the identity authentication fails, a negative response is fed back, and the diagnostic access terminal can only access the items to be detected pre-stored in the second authority routing table.

[0070] S204, sending the data diagnosis request to a target terminal; wherein the vehicle data in the data diagnosis request is used to obtain a data diagnosis result.

[0071] For example, if the target terminal is an electronic control unit (ECU), after receiving the data diagnosis request, the ECU will parse it and extract the specific operation requested and the required data type. This process is the basis of the diagnostic work and ensures the smooth progress of subsequent operations. According to the received request, the ECU will execute the corresponding diagnostic procedures, such as detecting sensor data, actuator status, etc., and generate diagnostic results. These results are crucial to determine the status of the vehicle and identify potential problems.

[0072] S205: Receive the data diagnosis result sent by the target terminal, and feed back the data diagnosis result to the vehicle diagnosis device.

[0073] For example, after the diagnosis is completed, the ECU will send the diagnosis results back to the diagnostic instrument (equivalent to the vehicle diagnostic equipment). This process may include error codes, real-time data, fault descriptions and other information, providing maintenance personnel with direct and detailed diagnosis basis.

[0074] Furthermore, in the solution provided in this embodiment, the initial vehicle data corresponding to the vehicle data is determined as multiple data segments; according to the security factor of the vehicle data, different encryption algorithms are used to encrypt different data segments to obtain the vehicle data.

[0075] Optionally, the transmission method of the vehicle data is determined according to the security level of the vehicle data. That is, the vehicle data is divided into different data segments according to a preset splitting method, and different data segments are encrypted according to different encryption methods. The number of data segments can be determined according to the security level of the vehicle data.

[0076] Optionally, the vehicle data is evenly divided into three data segments, and different data segments are encrypted using different encryption sequences.

[0077] Optionally, the vehicle data is randomly divided into three data segments, and different data segments are encrypted using different encryption sequences.

[0078] Optionally, the vehicle data is divided into different types, such as operating parameter data, timestamp data, error data, etc., and data of different data types are encrypted using different encryption methods.

[0079] Furthermore, in the solution provided by this embodiment, if the data security requirement of the vehicle data in the data diagnostic request is lower than the second preset data security requirement, the vehicle data in the data diagnostic request is unencrypted data; if the data security requirement of the vehicle data in the data diagnostic request is higher than the second preset data security requirement, the vehicle data in the data diagnostic request has a security factor, and the vehicle data in the data diagnostic request is encrypted based on the encryption method corresponding to the security factor corresponding to the vehicle data.

[0080] It should be noted that when the data security requirement of the vehicle data in the data diagnostic request is higher than the second preset data security requirement, this means that these data have higher security requirements, and corresponding encryption measures need to be taken to protect the confidentiality and integrity of the data. In this case, the vehicle data will have a corresponding security factor. This security factor is determined based on factors such as the importance and sensitivity of the data and potential security threats. Depending on the security factor, different encryption methods can be selected to encrypt vehicle data. Encryption methods include symmetric encryption and asymmetric encryption. Symmetric encryption uses the same key for encryption and decryption operations, while asymmetric encryption uses two different keys, public and private. By selecting an appropriate encryption method, the security of vehicle data during transmission and storage can be ensured to prevent unauthorized access and theft.

[0081] In one example, if the security factor of the vehicle data in the data diagnostic request is a first security factor, the vehicle data in the data diagnostic request is encrypted based on a symmetric encryption method corresponding to the first security factor; if the security factor of the vehicle data in the data diagnostic request is a second security factor, the vehicle data in the data diagnostic request is encrypted based on an asymmetric encryption method corresponding to the second security factor.

[0082] Exemplarily, for the security of vehicle data, the vehicle data may be encrypted. When the data security requirement of the vehicle data in the data diagnosis request is lower than the second preset data security requirement, it means that the data security requirement of the vehicle data is low, and the vehicle data in the data diagnosis request is unencrypted data and can be directly diagnosed. If the data security requirement of the vehicle data in the data diagnosis request is higher than the second preset data security requirement, it means that the data security requirement of the vehicle data is high and has a safety factor. Encryption is performed using the encryption method corresponding to the safety factor.

[0083] Optionally, the target terminal divides the security level of its own diagnostic service according to the content of the entire vehicle diagnostic service. For example, if the diagnostic service security level is 0, the diagnostic request security level for reading the controller version information is 1, and the diagnostic request security level for writing information is 2, etc. This security level can be divided according to the information of the target controller itself. When the target terminal receives the diagnostic request sent by the diagnostic access terminal, it determines the security level of the diagnostic request. If the security level is 0, it directly feeds back the information of the diagnostic request; if the security level of the received diagnostic request is 1, the diagnostic request device is required to perform level 1 security authentication, and encrypt using symmetric encryption. If the authentication is passed, the corresponding diagnostic service is executed; if the security level of the received diagnostic request is 2, the diagnostic request device is required to perform level 2 security authentication, and encrypt using asymmetric encryption. If the authentication is passed, the corresponding diagnostic service is executed.

[0084] It should be noted that symmetric encryption uses the same key to encrypt and decrypt data. This method is also called single-key encryption; asymmetric encryption uses a pair of keys - public key and private key. The public key is used to encrypt data, while the private key is used to decrypt data. It is said that the encryption operation speed is faster and is suitable for encryption processing of large amounts of data. Due to the complexity of the algorithm, the encryption and decryption speed of asymmetric encryption is slower and is suitable for scenarios such as encryption of small amounts of data or digital signatures.

[0085] Through the above steps, reasonable data security classification and encryption measures, the system can provide necessary security protection without sacrificing user experience, for example, ensuring the security and response speed of vehicle remote control and diagnostic services.

[0086] Furthermore, the solution provided in this embodiment may also include the following steps: if it is determined that the session maintenance request sent by the vehicle diagnostic device is continuously received, then the communication with the vehicle diagnostic device is maintained; if it is determined that the session maintenance request sent by the vehicle diagnostic device is not received within a preset time period, then it is determined that an abnormality has occurred in the communication with the vehicle diagnostic device, and a network abnormality prompt message is sent to the vehicle diagnostic device; wherein the network abnormality prompt message indicates that an abnormality has occurred in the communication with the vehicle diagnostic device.

[0087] Exemplarily, the diagnostic access terminal continuously monitors session maintenance requests from the vehicle diagnostic device. On the one hand, such requests are sent periodically to confirm that both parties are still in an active communication state. If the system continuously receives session maintenance requests, it will continue to maintain a communication connection with the vehicle diagnostic device. This ensures that data can be transmitted in real time and continuously, making the diagnostic results more accurate and timely. Through periodic message exchanges, the system can monitor the quality of the communication line, promptly discover and resolve possible connection problems, thereby ensuring the stability and reliability of data transmission. On the other hand, if the diagnostic access terminal does not receive a session maintenance request sent by the vehicle diagnostic device within a preset time period, the session will be disconnected to prevent other illegal diagnostic request devices from accessing the vehicle and illegally sending diagnostic services to attack the vehicle.

[0088] Further, in the solution provided by this embodiment, when the vehicle data in the data diagnosis request is encrypted based on the asymmetric encryption method corresponding to the second safety factor, it includes randomly generating a symmetric encryption sequence;

[0089] The initial data corresponding to the vehicle data is encrypted using the symmetric encryption sequence to obtain first encrypted data; the first public key corresponding to the initial vehicle data is initially encrypted using the symmetric encryption sequence to obtain an encrypted public key; the first encrypted data is encrypted again using the encrypted public key to obtain the vehicle data.

[0090] That is to say, when the vehicle data has a high degree of impact on the safety of the vehicle, a more complex encryption method is needed to ensure the security of the vehicle data. The symmetric encryption sequence is a set of keys or parameters used to encrypt and decrypt data. It is automatically generated by the system to ensure its randomness and uniqueness. The legal diagnostic device can automatically synchronize the symmetric encryption sequence and the first private key corresponding to the first public key. Among them, the first private key and the first public key are paired, the first private key is used for decryption, and the first public key is used for encryption. Even if the illegal diagnostic device obtains the symmetric encryption sequence or one of the first private keys, it cannot obtain the complete vehicle data. Therefore, the security of vehicle data is effectively improved.

[0091] In the above manner, even if an illegal diagnostic device obtains a decryption sequence, it cannot obtain the complete vehicle data, thus ensuring the security of the vehicle data.

[0092] Furthermore, in the solution provided in this embodiment, the vehicle diagnostic device and the target terminal are deployed in different local area networks.

[0093] For example, placing the vehicle diagnostic equipment and the target terminal in different LANs can significantly improve the security of the entire system. By distributing sensitive data and key assets, even if one LAN is attacked, the devices and data in another LAN can still be protected. This isolation method helps reduce the potential network attack surface and improve overall network security protection.

[0094] In the method provided by the embodiment of the present invention, when a data diagnosis request is received that includes vehicle data of items to be detected, the items to be detected that have data security requirements lower than the first preset data security requirements pre-stored in the second authority routing table are quickly screened out and forwarded to the target terminal for diagnosis without certificate verification, and then the device certificate of the vehicle diagnostic device is verified using the root certificate pre-stored in the first authority routing table, thereby effectively improving the security of the vehicle diagnostic solution of Ethernet communication while ensuring the diagnostic efficiency.

[0095] The execution subject of the above solution may be a diagnostic access terminal, such as Figure 3 As shown, Figure 3 It is a system architecture diagram of a data diagnosis and processing method based on vehicle Ethernet according to an embodiment of the present invention, including: a diagnosis request device, a diagnosis access terminal, and a target terminal.

[0096] The diagnostic access terminal is used to receive a data diagnostic request and a device certificate sent by a vehicle diagnostic device, and forward the diagnostic request to a target terminal.

[0097] The target terminal is used to perform diagnosis based on the vehicle data carried in the data diagnosis request.

[0098] The diagnosis request device corresponds to a vehicle diagnosis device, for example, a vehicle diagnosis instrument that has been certified and sold.

[0099] The following are embodiments of the apparatus of the present invention, which can be used to implement the embodiments of the method of the present invention. For details not disclosed in the embodiments of the apparatus of the present invention, please refer to the embodiments of the method of the present invention.

[0100] Figure 4 FIG. 1 is a schematic diagram of the structure of a data diagnosis and processing device based on vehicle Ethernet according to an embodiment of the present invention. Figure 4 As shown, the data diagnosis and processing device based on vehicle Ethernet in the embodiment of the present invention includes: a verification unit 401 and a sending unit 402. Among them:

[0101] The verification unit 401 is used to verify the device certificate in response to the data diagnosis request and the device certificate sent by the vehicle diagnostic device; wherein the data diagnosis request includes the vehicle data of the item to be detected; the data diagnosis request complies with the Ethernet transmission protocol; and the device certificate is the certificate of the vehicle diagnostic device;

[0102] The sending unit 402 is used to send the data diagnosis request to the target terminal if it is determined that the verification of the device certificate is passed; wherein the vehicle data in the data diagnosis request is used to obtain the data diagnosis result.

[0103] Furthermore, the verification unit 401 is used to determine whether the verification of the device certificate has passed, specifically: if it is determined that the device certificate does not exist in the first authority routing table, the device certificate is verified to obtain a first verification result; wherein the first authority routing table includes device certificates of devices that meet device security requirements; the first verification result indicates that the verification of the device certificate has passed.

[0104] Furthermore, the verification unit 401 is further used to retrieve a root certificate corresponding to the vehicle diagnostic device; if it is determined that the obtained root certificate is consistent with the device certificate, it is determined that the first verification result is obtained.

[0105] Furthermore, the verification unit 401 is also used to, before sending the data diagnostic request to the target terminal if it is determined that the verification of the device certificate is passed, specifically to: if it is determined that the item to be detected indicated by the data diagnostic request does not exist in the second authority routing table, execute the step of sending the data diagnostic request to the target terminal if it is determined that the verification of the device certificate is passed; wherein the second authority routing table includes multiple items to be detected, and the data security requirements of the items to be detected in the second authority routing table are lower than the first preset data security requirements.

[0106] Furthermore, the device also includes a monitoring unit (not shown in the figure), which is specifically used to: monitor the sending frequency of the diagnostic request, and if the diagnostic request meets any of the following conditions, determine that the diagnostic request is an abnormal request, and send an identity authentication instruction to the vehicle diagnostic device: the sending frequency of the diagnostic request is greater than a first preset value; the diagnostic request repeatedly requests access to the same item to be detected within a preset time period, and the sending frequency is greater than a second preset value; wherein the first preset value is greater than or equal to the second preset value.

[0107] Furthermore, the device also includes an encryption unit (not shown in the figure), which is used to determine the initial vehicle data corresponding to the vehicle data into multiple data segments; according to the security factor of the vehicle data, different encryption algorithms are used to encrypt different data segments to obtain the vehicle data.

[0108] Furthermore, the device also includes a security unit (not shown in the figure), which is specifically used to: if the data security requirement of the vehicle data in the data diagnostic request is lower than the second preset data security requirement, then the vehicle data in the data diagnostic request is unencrypted data; if the data security requirement of the vehicle data in the data diagnostic request is higher than the second preset data security requirement, then the vehicle data in the data diagnostic request has a security factor, and the vehicle data in the data diagnostic request is encrypted based on the encryption method corresponding to the security factor corresponding to the vehicle data.

[0109] Furthermore, the security unit (not shown in the figure) is also used for: if the security factor of the vehicle data in the data diagnostic request is a first security factor, the vehicle data in the data diagnostic request is encrypted based on the symmetric encryption method corresponding to the first security factor; if the security factor of the vehicle data in the data diagnostic request is a second security factor, the vehicle data in the data diagnostic request is encrypted based on the asymmetric encryption method corresponding to the second security factor.

[0110] Furthermore, the security unit (not shown in the figure) is also used to randomly generate a symmetric encryption sequence; use the symmetric encryption sequence to encrypt the initial data corresponding to the vehicle data to obtain the first encrypted data; and use the symmetric encryption sequence to initially encrypt the first public key corresponding to the initial vehicle data to obtain the encrypted public key; use the encrypted public key to encrypt the first encrypted data again to obtain the vehicle data. Further, the device also includes a session unit (not shown in the figure), which is specifically used to: if it is determined that the session maintenance request sent by the vehicle diagnostic device is continuously received, then maintain the communication with the vehicle diagnostic device; if it is determined that the session maintenance request sent by the vehicle diagnostic device is not received within a preset time period, then determine that the communication with the vehicle diagnostic device is abnormal, and send a network abnormality prompt message to the vehicle diagnostic device; wherein the network abnormality prompt message indicates that the communication with the vehicle diagnostic device is abnormal.

[0111] Furthermore, the vehicle diagnostic device and the target terminal are deployed in different local area networks.

[0112] Furthermore, the apparatus also includes a feedback unit (not shown in the figure), which is specifically used to receive the data diagnosis result sent by the target terminal and feed back the data diagnosis result to the vehicle diagnosis device.

[0113] Figure 5 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 5 As shown, the electronic device 500 may include: at least one processor 501 and a memory 502 .

[0114] The memory 502 is used to store programs. Specifically, the programs may include program codes, and the program codes include computer-executable instructions.

[0115] The memory 502 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0116] The processor 501 is used to execute the computer-executable instructions stored in the memory 502 to implement the data diagnosis and processing method based on vehicle Ethernet described in the aforementioned method embodiment. Among them, the processor 501 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiment of the present invention. Specifically, when implementing the data diagnosis and processing method based on vehicle Ethernet described in the aforementioned method embodiment, the electronic device may be, for example, an electronic control unit on the vehicle and other electronic devices with processing functions.

[0117] Optionally, the electronic device 500 may further include a communication interface 503. In a specific implementation, if the communication interface 503, the memory 502 and the processor 501 are implemented independently, the communication interface 503, the memory 502 and the processor 501 may be interconnected through a bus and communicate with each other. The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc., but it does not mean that there is only one bus or one type of bus.

[0118] Optionally, in a specific implementation, if the communication interface 503, the memory 502 and the processor 501 are integrated on a chip, the communication interface 503, the memory 502 and the processor 501 can communicate through an internal interface.

[0119] The present invention also provides a data diagnosis and processing system based on vehicle Ethernet, comprising: a vehicle diagnosis device, a target terminal, and an electronic device.

[0120] The present invention also provides a computer-readable storage medium, in which computer program instructions are stored. When a processor executes the computer program instructions, the above-mentioned data diagnosis processing method based on vehicle Ethernet is implemented.

[0121] The present invention also provides a computer program product, including a computer program, which implements the above-mentioned data diagnosis processing method based on vehicle Ethernet when executed by a processor.

[0122] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0123] An exemplary readable storage medium is coupled to the processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in a dedicated integrated circuit. Of course, the processor and the readable storage medium can also exist as discrete components in a data diagnostic processing device based on vehicle Ethernet.

[0124] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0125] Finally, it should be noted that the above embodiments are only preferred embodiments for fully illustrating the present invention, and the protection scope of the present invention is not limited thereto. Any equivalent substitution or change made by a person skilled in the art based on the present invention is within the protection scope of the present invention.

Claims

1. A data diagnosis and processing method based on vehicle Ethernet, characterized in that: include: In response to a data diagnostic request and a device certificate sent by a vehicle diagnostic device, if it is determined that the item to be detected indicated by the data diagnostic request does not exist in the first authority routing table, the device certificate is verified; wherein the data diagnostic request includes vehicle data of the item to be detected; the data diagnostic request complies with the Ethernet transmission protocol; the device certificate is a certificate of the vehicle diagnostic device; the first authority routing table includes multiple items to be detected, and the data security requirements of the items to be detected in the first authority routing table are lower than the first preset data security requirements; If it is determined that the verification of the device certificate is passed, the data diagnosis request is sent to the target terminal; wherein the vehicle data in the data diagnosis request is used to obtain a data diagnosis result.

2. The method according to claim 1, characterized in that: Determining that the verification of the device certificate is successful includes: If it is determined that the device certificate does not exist in the second authority routing table, the device certificate is verified to obtain a first verification result; wherein the second authority routing table includes device certificates of devices that meet device security requirements; and the first verification result indicates that the verification of the device certificate has passed.

3. The method according to claim 2, characterized in that Verifying the device certificate to obtain a first verification result includes: Retrieving a root certificate corresponding to the vehicle diagnostic device; If it is determined that the obtained root certificate is consistent with the device certificate, it is determined that the first verification result is obtained.

4. The method according to claim 1, characterized in that: After sending the data diagnosis request to the target terminal, the method further includes: monitoring the sending frequency of the diagnosis request; If it is determined that the sending frequency meets at least one of the following preset conditions, determining that the diagnostic request is an abnormal request, and sending an identity authentication instruction to the vehicle diagnostic device; The preset condition is that the sending frequency of the diagnostic request is greater than a first preset value; or the preset condition is that the diagnostic request repeatedly requests access to the same item to be detected within a preset time period, and the sending frequency is greater than a second preset value; Wherein, the first preset value is greater than or equal to the second preset value.

5. The method according to claim 1, characterized in that: The method further comprises: determining the initial vehicle data corresponding to the vehicle data into a plurality of data segments; According to the security factor of the vehicle data, different encryption algorithms are used for different data segments to encrypt different data segments to obtain the vehicle data.

6. The method according to claim 1, characterized in that If the data security requirement of the vehicle data in the data diagnosis request is lower than the second preset data security requirement, the vehicle data in the data diagnosis request is unencrypted data; If the data security requirement of the vehicle data in the data diagnostic request is higher than the second preset data security requirement, the vehicle data in the data diagnostic request has a security factor, and the vehicle data in the data diagnostic request is encrypted based on the encryption method corresponding to the security factor corresponding to the vehicle data; wherein, if the security factor of the vehicle data in the data diagnostic request is a first security factor, the vehicle data in the data diagnostic request is encrypted based on the symmetric encryption method corresponding to the first security factor; if the security factor of the vehicle data in the data diagnostic request is a second security factor, the vehicle data in the data diagnostic request is encrypted based on the asymmetric encryption method corresponding to the second security factor.

7. The method according to claim 6, characterized in that When the vehicle data in the data diagnosis request is encrypted based on an asymmetric encryption method corresponding to the second safety factor, the method further includes: Randomly generate symmetric encryption sequences; The initial data corresponding to the vehicle data is encrypted using the symmetric encryption sequence to obtain first encrypted data; the first public key corresponding to the initial vehicle data is initially encrypted using the symmetric encryption sequence to obtain an encrypted public key; the first encrypted data is encrypted again using the encrypted public key to obtain the vehicle data.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: If it is determined that the session maintaining request sent by the vehicle diagnostic device is continuously received, maintaining the communication with the vehicle diagnostic device; If it is determined that the session maintenance request sent by the vehicle diagnostic device is not received within the preset time period, it is determined that an abnormality has occurred in the communication with the vehicle diagnostic device, and a network abnormality prompt message is sent to the vehicle diagnostic device; wherein the network abnormality prompt message indicates that an abnormality has occurred in the communication with the vehicle diagnostic device.

9. The method according to any one of claims 1 to 7, characterized in that: The vehicle diagnostic device and the target terminal are deployed in different local area networks.

10. The method according to any one of claims 1 to 7, characterized in that The method further comprises: The data diagnosis result sent by the target terminal is received, and the data diagnosis result is fed back to the vehicle diagnosis device.

11. A data diagnosis and processing device based on vehicle Ethernet, characterized in that: include: A verification unit, configured to verify the device certificate in response to a data diagnosis request and a device certificate sent by a vehicle diagnostic device; wherein the data diagnosis request includes vehicle data of items to be detected; the data diagnosis request complies with an Ethernet transmission protocol; and the device certificate is a certificate of the vehicle diagnostic device; The sending unit is used to send the data diagnosis request to the target terminal if it is determined that the verification of the device certificate is passed; wherein the vehicle data in the data diagnosis request is used to obtain the data diagnosis result.

12. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method for sending vehicle diagnosis results according to any one of claims 1 to 10.

13. A data diagnosis and processing system based on vehicle Ethernet, characterized in that: include: A vehicle diagnostic device, a target terminal, and the electronic device as claimed in claim 12.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed, the method for sending the vehicle diagnostic result according to any one of claims 1 to 10 is implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed, the method for transmitting the vehicle diagnosis result according to any one of claims 1 to 10 is implemented.

Images