Engine CAN communication method

Abstract

The invention discloses an engine CAN communication method, belongs to the technical field of CAN communication, and solves the technical problem that engine CAN communication has vulnerabilities. The method is used for communication between two ECUs, and comprises the following steps: step 1, a first ECU performs AES-128 algorithm encryption by using an engine S / N number; step 2, the first ECU sends the encrypted S / N number to a second ECU; 3, after the second ECU receives the encrypted S / N number, AES-128 algorithm decryption is carried out, and an S / N number decryption value is obtained; 4, the second ECU compares the decryption value of the S / N number with the S / N number of the engine; if yes, handshake authentication succeeds; otherwise, indicating handshake authentication; step 5, after the handshake authentication is successful, the first ECU starts Seed-key authentication; and step 6, after the handshake authentication fails, waiting for a first set time, repeatedly executing the step 2, and when a set number of times is reached, sending handshake authentication failure information by the first ECU. According to the invention, the handshake authentication is carried out before the Seed-key authentication is started, so that the safety of CAN communication between the two ECUs can be effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of CAN communication, and more specifically, to an engine CAN communication method. Background Art

[0002] With the development of automobile engine technology, the functions of engines are becoming more and more powerful, such as redundant technology and multi-sensor technology. The performance of a single ECU can no longer meet the needs of the engine. At this time, two or even more ECUs are required to work together, and each ECU communicates through the CAN bus.

[0003] According to ISO4229 security specification, automotive ECU software uses seed-key for message authentication and secure access. However, seed-key has disadvantages such as repeated use and pseudo-random generation, which makes it easy to be cracked and has poor security. Summary of the invention

[0004] The technical problem to be solved by the present invention is to address the above-mentioned deficiencies in the prior art. The purpose of the present invention is to provide an engine CAN communication method, which can improve the security of CAN communication between ECUs in the engine.

[0005] The technical solution of the present invention is: an engine CAN communication method, which is used for communication between two ECUs, comprising the following steps:

[0006] Step 1. The first ECU uses the engine S / N number to perform AES-128 algorithm encryption;

[0007] Step 2. The first ECU sends the encrypted S / N number to the second ECU;

[0008] Step 3. After receiving the encrypted S / N number, the second ECU performs AES-128 algorithm decryption to obtain the decrypted S / N number value;

[0009] Step 4. The second ECU compares the decrypted value of the S / N number with the S / N number of the engine; if the decrypted value of the S / N number is consistent with the S / N number of the engine, it means that the handshake authentication between the first ECU and the second ECU is successful, and the second ECU returns a handshake authentication success message to the first ECU; otherwise, it means that the handshake authentication between the first ECU and the second ECU fails, and the second ECU returns a handshake authentication failure message to the first ECU;

[0010] Step 5. If the first ECU receives the handshake authentication success message, the first ECU starts the Seed-key authentication;

[0011] Step 6. If the first ECU receives a handshake authentication failure message, it waits for a first set time and then repeats step 2; when the number of repetitions of step 2 reaches a set number, the first ECU sends a handshake authentication failure message.

[0012] As a further improvement, the engine S / N number is stored in the first ECU and the second ECU respectively.

[0013] Furthermore, the first set time is 5ms to 10ms.

[0014] Furthermore, the set number of times is 5 times.

[0015] Further, in step 5, when the Seed-key authentication is passed, the first ECU and the second ECU communicate with each other through Seed-key encryption; when the Seed-key authentication is not passed, the first ECU sends a Seed-key authentication failure message.

[0016] Furthermore, if the first ECU sends the encrypted S / N number to the second ECU and still does not receive any return information from the second ECU after waiting for a second set time, the first ECU repeatedly sends the encrypted S / N number to the second ECU. When the number of repetitions reaches the set number, the first ECU issues a communication disconnection message.

[0017] Furthermore, the second set time is 5ms to 10ms.

[0018] Furthermore, the first ECU uses the engine S / N number + the date of the day to perform AES-128 algorithm encryption and then performs handshake authentication.

[0019] Furthermore, the data encryption process in communication is as follows:

[0020] Get the data that needs to be encrypted;

[0021] Determine whether the data is null;

[0022] If the data is null, an error is reported;

[0023] If the data is not null, the encryptStringByAES-128 function is called to encrypt the data with AES-128.

[0024] Generate encrypted data.

[0025] Furthermore, the data decryption process in communication is as follows:

[0026] Get the data that needs to be decrypted;

[0027] Determine whether the data is null;

[0028] If the data is null, an error is reported;

[0029] If the data is not null, call the function decryptStringByAES-128 to perform AES-128 decryption on the data;

[0030] Generate decrypted data.

[0031] Beneficial Effects

[0032] Compared with the prior art, the present invention has the following advantages:

[0033] The present invention performs handshake authentication before starting Seed-key authentication, which can effectively improve the security of CAN communication between two ECUs and effectively utilize existing technical confidentiality and software stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is a flow chart of the present invention;

[0035] Figure 2 Diagram of the data encryption process;

[0036] Figure 3 Diagram of the data decryption process. DETAILED DESCRIPTION

[0037] The present invention will be further described below with reference to the specific embodiments in the accompanying drawings.

[0038] See also Figure 1 to Figure 3 , an engine CAN communication method, the method is used for communication between two ECUs, comprising the following steps:

[0039] Step 1. The first ECUA uses the engine S / N number to perform AES-128 algorithm encryption;

[0040] Step 2. The first ECUA sends the encrypted S / N number to the second ECUB;

[0041] Step 3. After receiving the encrypted S / N number, the second ECUB performs AES-128 algorithm decryption to obtain the decrypted S / N number value;

[0042] Step 4. The second ECUB compares the decrypted S / N number value with the engine S / N number; if the decrypted S / N number value is consistent with the engine S / N number, it means that the handshake authentication between the first ECUA and the second ECUB is successful, and the second ECUB returns a handshake authentication success message to the first ECUA; otherwise, it means that the handshake authentication between the first ECUA and the second ECUB fails, and the second ECUB returns a handshake authentication failure message to the first ECUA;

[0043] The engine S / N number is pre-stored in the first ECUA and the second ECUB respectively, and each engine S / N number is unique;

[0044] Step 5. If the first ECUUA receives the handshake authentication success message, the first ECUUA starts the Seed-key authentication;

[0045] Step 6. If the first ECUUA receives a handshake authentication failure message, it waits for the first set time and repeats step 2; when the number of repetitions of step 2 reaches the set number, the first ECUUA sends a handshake authentication failure message to prevent receiving an error message after being disturbed and affecting the handshake authentication. Preferably, the first set time is 5ms to 10ms, and the set number is 5 times.

[0046] In step 5, when the Seed-key authentication is passed, the first ECUA and the second ECUB communicate with each other through Seed-key encryption, that is, the first ECUA and the second ECUB can normally perform encrypted CAN communication; when the Seed-key authentication fails, the first ECUA sends a Seed-key authentication failure message.

[0047] Furthermore, if the first ECUA sends the encrypted S / N number to the second ECUB and still does not receive a return message from the second ECUB after waiting for the second set time, the first ECUA repeatedly sends the encrypted S / N number to the second ECUB to improve the fault tolerance function. When the number of repetitions reaches the set number, the first ECUA sends a communication disconnection message. Preferably, the second set time is 5ms to 10ms.

[0048] Furthermore, the first ECUA uses the engine S / N number + the date of the day to perform AES-128 algorithm encryption and then performs handshake authentication.

[0049] That is, the first ECUA sends the encrypted S / N number + today's date to the second ECUB; after receiving the encrypted S / N number + today's date, the second ECUB performs AES-128 algorithm decryption to obtain the decrypted value of the S / N number + today's date; the second ECUB compares the decrypted value of the S / N number + today's date with the engine S / N number + today's date; if the decrypted value of the S / N number + today's date is consistent with the engine S / N number + today's date, it means that the handshake authentication between the first ECUA and the second ECUB is successful, and the second ECUB returns the handshake authentication success information to the first ECUA; otherwise, it means that the handshake authentication between the first ECUA and the second ECUB fails, and the second ECUB returns the handshake authentication failure information to the first ECUA. Today's date is variable, and using the S / N number + today's date for handshake authentication can further improve security.

[0050] In this embodiment, the data encryption process in communication is as follows:

[0051] Get the data that needs to be encrypted;

[0052] Determine whether the data is null;

[0053] If the data is null, an error is reported;

[0054] If the data is not null, the encryptStringByAES-128 function is called to encrypt the data with AES-128.

[0055] Generate encrypted data. Figure 2 shown.

[0056] The data decryption process during communication is as follows:

[0057] Get the data that needs to be decrypted;

[0058] Determine whether the data is null;

[0059] If the data is null, an error is reported;

[0060] If the data is not null, call the function decryptStringByAES-128 to perform AES-128 decryption on the data;

[0061] Generate decrypted data. Figure 3 shown.

[0062] The above are only preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the structure of the present invention, which will not affect the effect of the implementation of the present invention and the practicality of the patent.

Claims

1. An engine CAN communication method, the method is used for communication between two ECUs, characterized in that: The following steps are involved: Step 1. The first ECU (A) uses the engine S / N number to perform AES-128 algorithm encryption; Step 2. The first ECU (A) sends the encrypted S / N number to the second ECU (B); Step 3. After receiving the encrypted S / N number, the second ECU (B) performs AES-128 algorithm decryption to obtain the decrypted S / N number value; Step 4. The second ECU (B) compares the decrypted value of the S / N number with the S / N number of the engine; if the decrypted value of the S / N number is consistent with the S / N number of the engine, it means that the handshake authentication between the first ECU (A) and the second ECU (B) is successful, and the second ECU (B) returns a handshake authentication success message to the first ECU (A); otherwise, it means that the handshake authentication between the first ECU (A) and the second ECU (B) fails, and the second ECU (B) returns a handshake authentication failure message to the first ECU (A); Step 5. If the first ECU (A) receives the handshake authentication success message, the first ECU (A) starts the Seed-key authentication; Step 6. If the first ECU (A) receives a handshake authentication failure message, it waits for a first set time and then repeats step 2; when the number of repetitions of step 2 reaches the set number, the first ECU (A) sends a handshake authentication failure message.

2. The engine CAN communication method according to claim 1, characterized in that: The engine S / N number is stored in the first ECU (A) and the second ECU (B), respectively.

3. The engine CAN communication method according to claim 1, characterized in that: The first set time is 5ms to 10ms.

4. The engine CAN communication method according to claim 1, characterized in that: The setting number of times is 5 times.

5. The engine CAN communication method according to claim 1, characterized in that: In step 5, when the Seed-key authentication is passed, the first ECU (A) and the second ECU (B) communicate with each other through Seed-key encryption; when the Seed-key authentication is not passed, the first ECU (A) sends a Seed-key authentication failure message.

6. An engine CAN communication method according to any one of claims 1 to 5, characterized in that: If the first ECU (A) sends the encrypted S / N number to the second ECU (B) and still does not receive any return information from the second ECU (B) after waiting for a second set time, the first ECU (A) repeatedly sends the encrypted S / N number to the second ECU (B). When the number of repetitions reaches the set number, the first ECU (A) sends a communication disconnection message.

7. An engine CAN communication method according to claim 6, characterized in that: The second set time is 5 ms to 10 ms.

8. The engine CAN communication method according to claim 6, characterized in that: The first ECU (A) uses the engine S / N number + the current date to perform AES-128 algorithm encryption and then performs handshake authentication.

9. The engine CAN communication method according to claim 5, characterized in that: The data encryption process during communication is as follows: Get the data that needs to be encrypted; Determine whether the data is null; If the data is null, an error is reported; If the data is not null, the encryptStringByAES-128 function is called to encrypt the data with AES-128. Generate encrypted data.

10. The engine CAN communication method according to claim 7, characterized in that: The data decryption process during communication is as follows: Get the data that needs to be decrypted; Determine whether the data is null; If the data is null, an error is reported; If the data is not null, call the function decryptStringByAES-128 to perform AES-128 decryption on the data; Generate decrypted data.

Images