Vehicle communication data encryption method, decryption method, device and system

Abstract

The embodiments of the present application provide a vehicle communication data encryption method, decryption method, device, and system, relating to the field of vehicle data security technology. The method includes obtaining a first mask corresponding to a message to be sent; obtaining a first hash value based on the message identifier of the message to be sent and the first mask; obtaining a second hash value based on the source payload of the message to be sent and the first mask; obtaining combined hash data based on the first hash value and the second hash value; encrypting and reconstructing the source payload based on the combined hash data to obtain a reconstructed payload; and updating the message to be sent based on the reconstructed payload and sending it. The method uses double hash encryption and reconstructs the data, converting plaintext data into irregular data, improving data security, and solving the problem of vehicle Ethernet communication data being easily cracked and leading to data leakage.

Description

Technical Field

[0001] The present application relates to the field of vehicle data security technology, and more specifically, to a vehicle communication data encryption method, decryption method, device, and system. Background Art

[0002] With the application of Ethernet technology SOMEIP communication middleware in the automotive field, the requirements for network information security and communication data security have become more stringent. Ethernet communication data in vehicles is usually transmitted in plain text, which is easy to be cracked and lead to data leakage. Summary of the Invention

[0003] The purpose of the embodiments of the present application is to provide a vehicle communication data encryption method, decryption method, device and system, which adopt double hash encryption and reconstruct the data to convert plaintext data into irregular data, improve data security, and solve the problem that vehicle Ethernet communication data can be easily cracked and cause data leakage.

[0004] In the first aspect, the present application provides a vehicle communication data encryption method, which is applied to a sending end, and the method includes: obtaining a first mask corresponding to a message to be sent; obtaining a first hash value based on the message identifier of the message to be sent and the first mask; obtaining a second hash value based on the source payload of the message to be sent and the first mask; obtaining combined hash data based on the first hash value and the second hash value; encrypting and reconstructing the source payload based on the combined hash data to obtain a reconstructed payload; updating the message to be sent based on the reconstructed payload and sending it.

[0005] In the technical solution of the embodiment of the present application, double hash encryption is adopted, and the message identifier and the source payload are hashed with the first mask respectively, and the hash values obtained by the two hash calculations are screened respectively, and then the screening results are combined, and the source payload data is encrypted and reconstructed using the combined results, breaking the original rules of the source payload data, so that the plaintext data is converted into irregular data through complex reconstruction rules, thereby improving security.

[0006] In some embodiments, obtaining combined hash data based on a first hash value and a second hash value includes: reordering the first hash value and the second hash value to obtain a reordered first hash value and a reordered second hash value; filtering the reordered first hash value and the reordered second hash value to obtain first verification data and second verification data; and recombining the first verification data and the second verification data to generate the combined hash data. The combined hash data obtained by sorting and filtering the first and second hash values, and then recombining the filtering results, is irregular data. An attacker cannot determine the original first and second hash values through the combined hash data, thereby ensuring that a reconstructed payload reconstructed from the combined hash data is also irregular data.

[0007] In some embodiments, reordering the first and second hash values to obtain a reordered first hash value and a reordered second hash value includes: randomly generating a coprime number corresponding to the number of digits of the first or second hash value; using the coprime number to establish a mapping relationship table from the current order of each digit of the hash value to the target order; reordering the first and second hash values based on the mapping relationship table to obtain a reordered first hash value and a reordered second hash value; and repeating the above steps to reorder the second hash value to obtain a reordered second hash value. Reordering the first and second hash values using the mapping relationship table disrupts the original order, thereby enhancing the irregularity and randomness of the reordered first and second hash values.

[0008] In some embodiments, using the coprime numbers to establish a mapping relationship table from the current order of each bit value of the hash value to the target order includes: generating a mapping relationship table based on a derivation formula, wherein the derivation formula is expressed as: ,and ;in, Indicates the position subscript corresponding to the target sorting, Indicates the position subscript corresponding to the current sort, The value range is 0 to , The number of bits representing the first hash value, for The derivation is used to generate a mapping table, and the original hash value positions are mapped to new positions according to the mapping table, thereby obtaining a new order and enhancing randomness.

[0009] In some embodiments, the reordered first hash value and the reordered second hash value are separately screened to obtain first verification data and second verification data, including: obtaining a portion of the hash values from the reordered first hash value based on a preset first screening rule as the first verification data; and obtaining a portion of the hash values from the reordered second hash value using a preset second screening rule as the second verification data. After screening, only the portion of the hash values is used as verification data to participate in the reconstruction of the source payload, which can reduce the possibility of the reconstructed source payload being cracked, thereby improving security. In addition, the first and second verification data obtained after reordering and screening are more random and irregular.

[0010] In some embodiments, based on a preset first screening rule, extracting a portion of the hash value from the rearranged first hash value as the first verification data includes: extracting even-numbered bits from the rearranged first hash value and using them as the first verification data. Removing the even-numbered bits increases the randomness of the first verification data, thereby preventing an attacker from discovering the encryption pattern.

[0011] In some embodiments, using a preset second filtering rule to extract a portion of the hash value from the rearranged second hash value as the second verification data includes extracting the odd bits from the rearranged second hash value and using them as the second verification data. Extracting the odd bits and distinguishing them from the first filtering rule increases the diversity of the filtering rules and further enhances the randomness of the encryption method.

[0012] In some embodiments, the source payload is encrypted and reconstructed based on the combined hash data to obtain a reconstructed payload: coprime numbers and the combined hash data are inserted into the source payload according to a preset reconstruction rule to obtain the reconstructed payload. Reconstructing the source payload produces irregular data, making it difficult to detect encryption patterns even in plaintext messages, thereby enhancing data security.

[0013] In some embodiments, the combined hash data is inserted into the source payload according to a preset reconstruction rule to obtain a reconstructed payload, including: inserting a coprime number and every two bytes of the combined hash data after each byte of the source payload until all coprime numbers and combined hash data are inserted into the source payload; if the length of the source payload is less than half the total length of the coprime numbers and the combined hash data, then splicing the remaining combined hash data at the end of the source payload. Specific reconstruction rules are provided, and using these reconstruction rules, an irregular reconstructed payload can be obtained, which converts plaintext data into irregular data, making it impossible for attackers to obtain valid data, greatly improving data security and reducing the risk of being cracked.

[0014] In some embodiments, obtaining a first mask corresponding to a message to be sent includes: obtaining message attributes of the message to be sent, the message attributes including a source IP address, a source MAC address, a destination IP address, a destination MAC address, a VLAN ID, a transport protocol, a source port number, and a destination port number; and searching a local mapping table for a corresponding first mask based on the message attributes, the local mapping table including a local mask and a mask of a communicating counterpart. Each communicating component only knows its own mask and the mask of the communicating counterpart, thereby improving security and preventing mask leakage.

[0015] In a second aspect, the present application provides a vehicle communication data decryption method, which is applied to the receiving end corresponding to the transmitting end in the first aspect, and the method includes: obtaining a second mask corresponding to the received encrypted message; obtaining a third hash value based on the message identifier of the encrypted message and the second mask; parsing the encrypted message according to a preset reconstruction rule to obtain two mutually prime numbers, first verification data, second verification data, and a source payload; obtaining a fourth hash value based on the source payload and the second mask; and verifying the encrypted message based on the mutually prime numbers, the first verification data, the second verification data, the third hash value, and the fourth hash value. Verification using the first verification data, the second verification data, the third hash value, and the fourth hash value ensures the reliability of the received message data and can effectively prevent tampering by attackers.

[0016] In some embodiments, the encrypted message is verified based on the coprime number, the first verification data, the second verification data, the third hash value, and the fourth hash value, including: obtaining a rearranged third hash value corresponding to the third hash value and a rearranged fourth hash value corresponding to the fourth hash value based on the coprime number; performing identity verification based on the rearranged third hash value and the first verification data to obtain an identity verification result; if the identity verification result is yes, performing data verification based on the rearranged fourth hash value and the second verification data. Utilizing the dual verification method of identity verification and data verification, only data that passes both verification methods is retained, fully ensuring the security of the received data.

[0017] In some embodiments, performing identity verification based on the rearranged third hash value and the first verification data includes: obtaining the third verification data using a preset first screening rule; and verifying that the identity verification is successful if the first verification data is equal to the third verification data. Identity verification ensures that the identities of both communicating parties are correct.

[0018] In some embodiments, performing data verification based on the rearranged fourth hash value and the second verification data includes: obtaining the fourth verification data using a preset second screening rule; and verifying that the data verification succeeds if the second verification data is equal to the fourth verification data. Data verification ensures that the received data is valid and has not been tampered with.

[0019] On the third aspect, the present application provides a vehicle communication data encryption device, which is applied to the sending end, and the device includes: a first mask acquisition module, which is used to obtain a first mask corresponding to the message to be sent; a first hash acquisition module, which is used to obtain a first hash value based on the message identifier of the message to be sent and the first mask; a second hash acquisition module, which is used to obtain a second hash value based on the source payload of the message to be sent and the first mask; a combination module, which is used to obtain combined hash data based on the first hash value and the second hash value; a reconstruction module, which is used to encrypt and reconstruct the source payload according to the combined hash data to obtain a reconstructed payload; and an update module, which is used to update the message to be sent based on the reconstructed payload and send it. By using hash double encryption and data reconstruction, the plaintext data is converted into irregular data, so that attackers cannot obtain valid data, thereby improving the security of data transmission and the risk of being cracked.

[0020] In a fourth aspect, the present application provides a vehicle communication data verification device, which is applied to the receiving end, and the device includes: a second mask acquisition module, which is used to obtain the second mask corresponding to the received encrypted message; a third hash acquisition module, which is used to obtain a third hash value based on the message identifier of the encrypted message and the second mask; a message parsing module, which is used to parse the encrypted message using a preset reconstruction rule to obtain two coprime numbers, first verification data, second verification data and a source payload; a fourth hash acquisition module, which is used to obtain a fourth hash value based on the coprime numbers, the source payload and the second mask; and a verification module, which is used to verify the encrypted message based on the first verification data, the second verification data, the third hash value and the fourth hash value. The dual verification method of identity verification and data verification ensures the security and accuracy of both communicating parties and the received data.

[0021] In a fifth aspect, the present application provides a vehicle communication data encryption system, comprising the transmitting end described in the first aspect and the receiving end described in the second aspect. The transmitting end encrypts data using double hashing and data reconstruction, and the receiving end performs identity verification and data validation on the received data. Only data that passes the double validation is retained. This system enables encrypted transmission of vehicle data, making it difficult to tamper with, crack, or be attacked by replay attacks. The irregular data transmission and high-intensity verification process make it difficult for attackers to gain access, resulting in a high level of security.

[0022] In a sixth aspect, the present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the above-mentioned vehicle communication data encryption method.

[0023] In a seventh aspect, the present application provides a readable storage medium, in which computer program instructions are stored. When the computer program instructions are read and executed by a processor, the above-mentioned vehicle communication data encryption method is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 A flowchart of a vehicle communication data encryption method provided in an embodiment of the present application;

[0026] Figure 2 A flowchart for obtaining a first mask provided in an embodiment of the present application;

[0027] Figure 3 A flow chart for generating combined hash data provided in an embodiment of the present application;

[0028] Figure 4 A flowchart of sorting hash values provided in an embodiment of the present application; Figure 5 Screening flow chart provided for the embodiments of this application;

[0029] Figure 6 A flowchart of a specific implementation of the vehicle communication data encryption method provided in an embodiment of the present application;

[0030] Figure 7 A flowchart of a vehicle communication data decryption method provided in an embodiment of the present application;

[0031] Figure 8 A verification flow chart provided for an embodiment of the present application;

[0032] Figure 9 A flowchart of a specific implementation of the vehicle communication data decryption method provided in an embodiment of the present application;

[0033] Figure 10 A structural block diagram of a vehicle communication data encryption device provided in an embodiment of the present application;

[0034] Figure 11 A structural block diagram of a vehicle communication data decryption device provided in an embodiment of the present application;

[0035] Figure 12 This is a flowchart of the specific implementation of the vehicle communication data encryption system provided in an embodiment of the present application.

[0036] icon:

[0037] 110 - first mask acquisition module; 120 - first hash acquisition module; 130 - second hash acquisition module; 140 - combination module; 150 - reconstruction module; 160 - update module; 210 - second mask acquisition module; 220 - third hash acquisition module; 230 - message parsing module; 240 - fourth hash acquisition module; 250 - verification module. DETAILED DESCRIPTION

[0038] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0039] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0040] With the application of SOMEIP (Scalable service-oriented middleware over IP) communication middleware, vehicle Ethernet data transmission is usually transmitted in plain text. Even if E2E encryption (End-to-End Encryption) is used, attackers can crack it based on the changing patterns of communication data, resulting in data leakage.

[0041] In response to the above technical problems, an embodiment of the present application provides a vehicle communication data encryption method, which adopts a double hash encryption method, uses a mask to hash the message identifier and source payload data of the message respectively, and then sorts, filters, and reorganizes the encryption results. After a series of operations, the reorganized hash data is used to reconstruct the source payload data. Through the above process, the plaintext data is converted into irregular data, making it impossible for attackers to crack it according to the change pattern of the data, thereby ensuring data security.

[0042] Please see Figure 1 , Figure 1 A flowchart of a vehicle communication data encryption method provided in an embodiment of the present application, the method comprising the following steps:

[0043] S110: Obtain a first mask corresponding to the message to be sent;

[0044] S120: Obtain a first hash value according to the message identifier of the message to be sent and the first mask;

[0045] S130: Obtain a second hash value according to the source payload of the message to be sent and the first mask;

[0046] S140: Obtain combined hash data according to the first hash value and the second hash value;

[0047] S150: Encrypt and reconstruct the source payload according to the combined hash data to obtain a reconstructed payload;

[0048] S160: Update the message to be sent based on the reconstructed payload and send it to the receiving end.

[0049] For example, the message to be sent may be a SOMEIP message. The message structure of a SOMEIP message includes a message identifier and a source payload. The message identifier and source payload are hashed separately to achieve double hashing of the SOMEIP message, making verification more difficult for attackers. The hash algorithm used here, for example, is the SHA-256 hash algorithm, which has not been cracked. This enhances data tamper resistance and cracking resistance, significantly improving data security and reducing the risk of hacking. The first mask is hashed with the message identifier, which can be used to verify the identities of both communicating parties. The first mask is hashed with the source payload, which can be used to verify data validity.

[0050] The double-hash encryption results are filtered and combined, and the combined results are reorganized according to the reconstruction rules to reconstruct the source payload data. The resulting new source payload is a randomized version of the original source payload data. Double-hash encryption and data reconstruction increase the randomness of the valid data. Even if the data is intercepted or leaked, attackers cannot infer the valid data from the randomized data, making it more difficult to decipher the data, thereby ensuring secure transmission of vehicle SOMEIP Ethernet data.

[0051] Message identifiers include Service ID, Method ID, and Session ID. The Session ID is used to distinguish different sessions. Therefore, during the communication process, the Session ID is constantly changing. Including the Session ID in the hash operation avoids the possibility of data replay attacks.

[0052] Please see Figure 2 , Figure 2 FIG. 4 is a flowchart of obtaining a first mask. In some embodiments, obtaining a first mask corresponding to a message to be sent includes:

[0053] S111: Acquire message attributes of the message to be sent, including source IP, source MAC (physical address of the network card at the sender), destination IP, destination MAC (physical address of the network card at the receiver), VLAN (Virtual Local Area Network) ID, transport protocol (UDP / TCP), source port, and destination port.

[0054] S112: Searching for a corresponding first mask in a local mapping table based on the message attribute, where the local mapping table includes a local mask and a communication partner mask.

[0055] The OEM configures and manages masks based on the message attributes in Ethernet communications. They can generate random, uniformly lengthed masks for each communication component. Longer masks improve encryption. Masks can also be regularly updated to prevent leaks and tampering.

[0056] When sending masks, the OEM strictly encrypts them before sending them to Ethernet communication components, ensuring that only the communicating components know their own masks and the masks of their counterparts. For example, when A and B are communicating, A needs to know the mask it sends to B and the mask B replies to A. Similarly, B needs to know the mask it sends to A and the mask A replies to B. Therefore, the first mask refers to the sender's own mask. When messages are sent to different receivers, the first masks obtained through the mapping table are also different.

[0057] As for the mapping table, it is managed locally at the sending or receiving end to establish a mapping relationship between message attributes and masks. When sending and receiving SOMEIP messages, it is necessary to find the mask corresponding to the message in the mapping table before subsequent data construction and verification can be carried out, which preliminarily ensures the security of the data.

[0058] Please see Figure 3 , Figure 3 In some embodiments, obtaining the combined hash data according to the first hash value and the second hash value includes:

[0059] S141: reorder the first Hash value and the second Hash value respectively to obtain a reordered first Hash value and a reordered second Hash value;

[0060] S142: Screen the rearranged first Hash value and the rearranged second Hash value respectively to obtain first verification data and second verification data;

[0061] S143: Recombining the first verification data and the second verification data to generate combined hash data.

[0062] The first hash value and the second hash value are sorted and screened respectively, and only a part of the values are selected as the first verification data and the second verification data respectively. After sorting and screening, it is impossible for an attacker to obtain the original first hash value and the second hash value based on the first verification data and the second verification data, which has high security. In addition, only a part of the values are selected as the first verification data and the second verification data respectively, which are subsequently used to encrypt and reconstruct the meta-payload, so that the length of the reconstructed payload can be controlled to avoid the reconstructed payload being too long.

[0063] Sorting refers to rearranging the positions of hash values (including the first hash value and the second hash value) so that the position of each hash value changes and each hash value (except the first one) cannot return to its original position. In this way, the rearranged first hash value and the rearranged second hash value obtained after reordering are irregular, and the first verification data and second verification data obtained after screening are more random, further enhancing security.

[0064] There is no limitation on the method of recombining the first verification data and the second verification data. For example, the first verification data and the second verification data may be spliced, interspersed, or reordered, and the method can be customized as needed. The more complex the rules, the less regular the data obtained, the lower the possibility of cracking the reconstructed data, and the higher the security.

[0065] Please see Figure 4 , Figure 4 A flowchart for sorting hash values. In some embodiments, re-sorting the first hash value and the second hash value to obtain the re-sorted first hash value and the re-sorted second hash value includes:

[0066] S144: Randomly generate a coprime number corresponding to the number of bits of the first hash value;

[0067] S145: Using coprime numbers to establish a mapping relationship table from the current order of each digit of the hash value to the target order;

[0068] S146: reordering the first Hash values based on the mapping relationship table to obtain reordered first Hash values;

[0069] S147: Repeat the above steps to reorder the second Hash values to obtain reordered second Hash values.

[0070] Coprime numbers, that is, the number of bits of the generated random number and the first hash value or the second hash value are prime to each other (the only common factor is 1), and there are at least two coprime numbers, here there are two pairs, the first pair is the number of bits of the generated random number and the first hash value, the second pair is the number of bits of the other generated random number and the second hash value. The mapping relationship table is that the current position gets a new position based on the mapping relationship. The mapping relationship table established by coprime numbers allows each value of the hash value to get a new position ( i 0 is 0), thereby reordering the hash values of the first hash value and the second hash value to obtain the reordered first hash value and the reordered second hash value respectively.

[0071] The mapping relationship table can be used to reorder the first hash values (the process of reordering the second hash values is the same as the process of reordering the first hash values, which will not be repeated here), completely disrupting the original order of the first hash values and the second hash values, thereby enhancing the randomness of the reordered first hash values and the reordered second hash values.

[0072] In some embodiments, using coprime numbers to establish a mapping relationship table from the current order of each bit value of the hash value to the target order includes: generating the mapping relationship table based on a derivation formula, which can be expressed as:

[0073] ,and ;

[0074] in, Indicates the position subscript corresponding to the target sorting, Indicates the position subscript corresponding to the current sort, The value range is 0 to , The number of bits representing the first hash value, for % represents the remainder operation.

[0075] For example, if the first hash value has 32 bits in total, then n =32, k are randomly generated coprime numbers, such as k =31, i When the value of 0 is 1, i The value of 1 is 31, which means that the hash value with the position subscript 1 (located at the second position) corresponding to the current sort is sorted to the position subscript 31 (located at the 32nd position), thus replacing the position and sorting of the first hash value. Similarly, the corresponding coprime number mapping table is generated based on the total number of bits of the second hash value for sorting, which will not be repeated here.

[0076] Please see Figure 5 , Figure 5For the screening flow chart, in some embodiments, screening the rearranged first Hash value and the rearranged second Hash value to obtain the first verification data and the second verification data includes:

[0077] S148: Based on a preset first screening rule, obtain a partial hash value from the rearranged first hash value as first verification data;

[0078] S149: Using a preset second screening rule, obtain a partial hash value from the rearranged second hash value as second verification data.

[0079] Different filtering rules can be used for filtering the rearranged first hash value and the rearranged second hash value, that is, using the first filtering rule and the second filtering rule respectively. Compared with using the same filtering rule, the complexity of the rule can be increased, and it is more difficult for attackers to crack.

[0080] In some embodiments, based on a preset first screening rule, obtaining a partial hash value from the rearranged first hash value as the first verification data includes: obtaining even bits in the rearranged first hash value and using them as the first verification data.

[0081] The first verification data is a partial value taken from the rearranged first hash value (from the message identifier hash operation) to participate in the reconstruction of the source payload data, and is used at the receiving end to authenticate the identities of both communicating parties using the first verification data.

[0082] Even-numbered bits are used for screening, and only a portion of the rearranged first hash value is used as the first verification data, thereby increasing the randomness and security of the data in the encrypted message and preventing it from being cracked by attackers.

[0083] In some embodiments, using a preset second screening rule to obtain a partial hash value from the rearranged second hash value as the second verification data includes: obtaining odd bits in the rearranged second hash value and using them as the second verification data.

[0084] The second verification data is a partial value taken from the rearranged second hash value (from the source payload hash operation) to participate in the reconstruction of the source payload data, and is used at the receiving end to verify the validity of the data using the second verification data.

[0085] Odd-numbered bits are used for screening, and only a portion of the rearranged second hash value is used as the first verification data, thereby increasing the randomness and security of the data in the encrypted message and preventing it from being cracked by attackers.

[0086] As for the specific first filtering rule and the second filtering rule, this embodiment extracts even digits and odd digits respectively. Other filtering rules can also be used, such as limiting the number and position of filtering, such as only selecting a part of the rearranged first hash value and the rearranged second hash value, such as the front, middle, and back values. This can also be customized as needed, and no limitation is made here.

[0087] The first hash value and the second hash value are reordered and screened respectively, and the obtained first verification data and the second verification data are far different from the first hash value and the second hash value. An attacker cannot obtain the first hash value and the second hash value of a pair based on the first verification data and the second verification data, and the pair has strong randomness and irregularity.

[0088] In some embodiments, encrypting and reconstructing the source payload according to the combined hash data to obtain the reconstructed payload includes: inserting the combined hash data into the source payload according to a preset reconstruction rule to obtain the reconstructed payload.

[0089] This involves two reconstructions: the first is to recombine the first and second verification data to obtain the combined hash data, and the second is to use the combined hash data to reconstruct the source payload data to obtain the reconstructed payload. Using the reconstruction rules and the combined hash data to reconstruct the source payload, these two reconstructions transform the reconstructed payload into irregular data. This makes it difficult for attackers to determine the reconstruction rules, making it more difficult to crack the reconstructed payload and thus improving data security.

[0090] Reconstruction rules can be customized according to actual needs. The more complex the rules, the lower the possibility of data being cracked and the higher the security.

[0091] In some embodiments, the coprime numbers and the combined hash data are inserted into the source payload according to a preset reconstruction rule to obtain a reconstructed payload, including: inserting every 2 bytes of the coprime numbers and the combined hash data after each byte of the source payload until all the coprime numbers and the combined hash data are inserted into the source payload; if the length of the source payload is less than half of the total length of the coprime numbers and the combined hash data, the remaining combined hash data is spliced at the end of the source payload.

[0092] Intersperse the coprime numbers and the combined hash data into the source payload. If the source payload is short, concatenate the remaining hash values at the end; if the source payload is long, no values are inserted into the remaining source payload. Other interspersing methods can also be used, such as setting the interspersing position and the number of source payload intervals, which are not limited here. The coprime numbers interspersed into the source payload here include two pairs, namely the two coprime numbers used to obtain the rearranged first hash value and the two coprime numbers used to obtain the rearranged second hash value.

[0093] After the above-mentioned hash encryption and data reconstruction process, the valid data has been disrupted into irregular data. Even if the data is intercepted or leaked, the attacker will not be able to infer the valid data based on the existing data, which improves the data's anti-cracking ability and greatly improves the security of vehicle data transmission.

[0094] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be described clearly and completely below. Figure 6 , Figure 6 This is a flowchart of a specific implementation of a vehicle communication data encryption method, which includes:

[0095] S201: Search the local mapping table based on the source IP, source MAC, destination IP, destination MAC, VLAN ID, transport protocol (UDP / TCP), source PORT, and destination PORT of the message to be sent to determine whether the corresponding first mask mask1 is found; if not, abandon the sending and record the problem;

[0096] S202: If the first mask mask1 is found, the Service ID, Method ID, and Session ID of the to-be-sent SOMEIP message are hashed with the first mask mask1 to obtain a first hash value HASH1. The first hash value HASH1 is reordered using coprime numbers k1 and n1, and all even-numbered bits of the reordered first hash value are extracted to obtain the first verification data hash1.

[0097] S203: Perform a hash operation on the first mask mask1 and the source payload data1 to obtain a second hash value HASH2. Reorder the second hash value HASH2 using coprime numbers k2 and n2, and extract all odd-numbered bits of the reordered second hash value to obtain second verification data hash2.

[0098] S204: Recombine to obtain combined verification data hash1+hash2; insert the mutually prime numbers k1, n1, k2, n2, hash1+hash2 into the source payload data1 according to the reconstruction rule to obtain the reconstructed payload data11;

[0099] S205: reload the reconstructed payload data11 into the SOMEIP message, update the SOMEIP message and then send it to the receiving end.

[0100] At the receiving end, the received encrypted message is verified for identity and data. This double verification ensures that the encrypted message has not been tampered with, while avoiding the attacker's identity disguise, greatly improving the security and confidentiality of vehicle data. Therefore, the embodiment of the present application also provides a vehicle communication data decryption method, which is applied to the above-mentioned receiving end. Please refer to Figure 7 , Figure 7 A flowchart of a method for decrypting vehicle communication data, the method comprising:

[0101] S310: Obtain a second mask corresponding to the received encrypted message;

[0102] S320: Obtain a third hash value according to the message identifier of the encrypted message and the second mask;

[0103] S330: Parse the encrypted message according to a preset reconstruction rule to obtain a coprime number, first verification data, second verification data, and source payload;

[0104] S340: Obtain a fourth hash value according to the source payload and the second mask;

[0105] S350: Verify the encrypted message according to the coprime number, the first verification data, the second verification data, the third Hash value, and the fourth Hash value.

[0106] At the receiving end, the corresponding second mask is found according to the message attributes of the received encrypted message, and the encrypted message is parsed according to the reconstruction method of the sending end. The parsed message identifier and source payload are also hashed and encrypted respectively. The encryption result and the two encryption results of the sending end carried in the encrypted message are used to verify to ensure the security and validity of the data received by the receiving end.

[0107] Please see Figure 8 , Figure 8 To verify the flow chart, in some embodiments, verifying the encrypted message based on the coprime number, the first verification data, the second verification data, the third hash value, and the fourth hash value includes:

[0108] S351: Obtaining a rearranged third hash value corresponding to the third hash value and a rearranged fourth hash value corresponding to the fourth hash value based on coprime numbers;

[0109] S352: Perform identity verification based on the rearranged third Hash value and the first verification data to obtain an identity verification result;

[0110] S353: If the identity verification result is yes, perform data verification based on the rearranged fourth Hash value and the second verification data.

[0111] The specific verification methods include identity authentication and data validity verification. Whether the mask can be found, whether the identity authentication is passed, and whether the data verification is passed determines whether the data is accepted or discarded.

[0112] For the second mask, the receiving end searches the local mapping table based on the source IP, source MAC, destination IP, destination MAC, VLAN ID, transport protocol (UDP / TCP), source PORT, and destination PORT of the encrypted message to obtain the sender mask. If the encrypted message has not been tampered with, the second mask should be the same as the first mask.

[0113] According to the sender's reconstruction rules, the encrypted message is parsed to obtain the coprime number, the first verification data, the second verification data, and the source payload. If the encrypted message has not been tampered with, the first verification data, the second verification data, and the source payload should be the same as those on the receiving end. Therefore, the hash value corresponding to the two hash encryptions can be used to verify the identity of the communicating parties and the validity of the data. After two verifications, the validity of the received encrypted message is guaranteed.

[0114] In some embodiments, performing identity verification based on the rearranged third hash value and the first verification data includes: obtaining the third verification data using a preset first screening rule; and if the first verification data is equal to the third verification data, the identity verification is successful. The rearranged third hash value is screened using the preset first screening rule to obtain the third verification data. The third verification data and the first verification data are both obtained by performing a hash operation using a message identifier. The message identifier can be used to represent the identities of both communicating parties. Therefore, identity verification can be performed using the third verification data and the first verification data.

[0115] The adoption of identity authentication mechanism for both communicating parties improves data security strength and greatly enhances data security and reliability.

[0116] If the first filtering rule is to obtain even digits, then the even digits of the rearranged third hash value are obtained and used as the third verification data. The even digits of the rearranged third hash value are extracted as the third verification data. The third verification data obtained after rearrangement and filtering has a strong randomness, making it impossible for an attacker to obtain the third verification data, making the identity verification result more convincing.

[0117] In some embodiments, performing data verification based on the rearranged fourth hash value and the second verification data includes: obtaining the fourth verification data using a preset second screening rule; and verifying that the data verification is successful if the second verification data is equal to the fourth verification data. The rearranged fourth hash value is screened using the preset second screening rule to obtain the fourth verification data. The fourth verification data and the second verification data are both obtained by performing a hash operation on payload data in the message. Therefore, the rearranged fourth hash value (which requires screening to obtain the fourth verification data) and the second verification data can be used for data verification.

[0118] On the basis of successful identity verification, data verification is further performed. If the data verification is successful, the security and validity of the encrypted message are proved.

[0119] If the second filtering rule is to obtain odd digits, then the odd digits of the rearranged fourth hash value are obtained and used as the fourth verification data. The odd digits of the rearranged fourth hash value are extracted as the fourth verification data. After rearrangement and filtering, the fourth verification data is obtained, making it impossible for an attacker to obtain the fourth verification data, making the verification result more convincing during the data verification process.

[0120] A high-intensity verification process of identity authentication and data validity verification is adopted to ensure the security and validity of the received data.

[0121] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be described clearly and completely below. Figure 9 , Figure 9 The following is a flowchart of a specific implementation of a vehicle communication data verification method, which includes:

[0122] S401: After receiving the SOMEIP data, first search the local mapping table through the received Ethernet data's message attributes - source IP, source MAC, destination IP, destination MAC, VLAN ID, transport protocol (UDP / TCP), source PORT, and destination PORT to determine whether the second mask mask2 is found. If not, discard the data and record the problem.

[0123] S402: If the second mask mask2 is found, the reconstruction rule is used to parse the coprime numbers k1, n1, k2, n2, the first verification data hash1, the second verification data hash2, and the source payload data2 (if it has not been tampered with, data2 is the same as the source payload data1); the Service ID, Method ID, and Session ID are extracted and hashed with the second mask mask2 to obtain a third hash value HASH3; according to the reconstruction method, HASH3 is reordered using the coprime numbers k1 and n1 to obtain a reordered third hash value, and all even bits of the reordered third hash value are extracted to obtain the third verification data hash3;

[0124] S403: Identity authentication: compare hash1 and hash3 to see if they are equal; if hash1 and hash3 are not equal, the identity authentication fails, the data is directly discarded, and the process ends;

[0125] S404: If hash1=hash3, the identity verification of both parties is successful, and then data verification is performed;

[0126] S405: Hash the second mask mask2 and the parsed data2 to obtain a fourth hash value HASH4. According to the reconstruction method, HASH4 is reordered using the coprime numbers k2 and n2 to obtain a rearranged fourth hash value, and all odd bits of the rearranged fourth hash value are extracted to obtain fourth verification data hash4.

[0127] S406: Payload verification: Compare hash2 and hash4 to see if they are equal. If they are equal, the data is valid, the verification is successful, and the received data can be further processed. If they are not equal, the verification fails, the data may have been tampered with during transmission, the data is discarded, and the problem is recorded.

[0128] Please see Figure 10 , Figure 10 This is a structural block diagram of a vehicle communication data encryption device provided by this application. It should be understood that the device is Figure 1 The method embodiment executed in the embodiment corresponds to the method, and can execute the steps involved in the aforementioned method. The specific functions of the device can be found in the description above. To avoid repetition, detailed description is appropriately omitted here. The device includes but is not limited to:

[0129] A first mask acquisition module 110 is configured to acquire a first mask corresponding to a message to be sent;

[0130] A first hash acquisition module 120 is configured to obtain a first hash value based on a message identifier of a message to be sent and a first mask; a second hash acquisition module 130 is configured to obtain a second hash value based on a source payload of the message to be sent and the first mask;

[0131] A combining module 140, configured to obtain combined hash data according to the first hash value and the second hash value;

[0132] A reconstruction module 150 is configured to encrypt and reconstruct the source payload according to the combined hash data to obtain a reconstructed payload;

[0133] The updating module 160 is configured to update the message to be sent based on the reconstructed payload and send the message.

[0134] In the technical solution of the embodiment of the present application, double hash encryption is adopted, and the hash encryption results are further rearranged, screened and reorganized, and the reorganization results are used to reconstruct the data, converting the plaintext data into irregular data, thereby improving the data's resistance to cracking, making it impossible for attackers to obtain valid data, and improving data security.

[0135] According to some embodiments of the present application, the first mask acquisition module 110 is specifically used to obtain message attributes of the message to be sent, the message attributes including source IP, source MAC, destination IP, destination MAC, VLAN ID, transport protocol, source PORT, and destination PORT; based on the message attributes, the corresponding first mask is searched from the local mapping table, and the local mapping table includes its own mask and the communication counterpart mask.

[0136] According to some embodiments of the present application, the combination module 140 is specifically configured to:

[0137] The first hash value and the second hash value are respectively reordered to obtain a reordered first hash value and a reordered second hash value; the reordered first hash value and the reordered second hash value are respectively screened to obtain first verification data and second verification data; the first verification data and the second verification data are recombined to generate combined hash data.

[0138] According to some embodiments of the present application, the specific reordering process is as follows:

[0139] Randomly generate a coprime number corresponding to the number of digits of the first hash value; use the coprime number to establish a mapping relationship table from the current order of each digit of the hash value to the target order; reorder the first hash value based on the mapping relationship table to obtain a reordered first hash value; repeat the above steps to reorder the second hash value to obtain a reordered second hash value.

[0140] According to some embodiments of the present application, a mapping relationship table from the current order of each bit value of a hash value to the target order is established using coprime numbers, including: generating a mapping relationship table based on a derivation formula, where the derivation formula is expressed as: ,and ;in, Indicates the position subscript corresponding to the target sorting, Indicates the position subscript corresponding to the current sort, The value range is 0 to , The number of bits representing the first hash value, for % represents the remainder operation.

[0141] According to some embodiments of the present application, the specific screening process is:

[0142] Based on a preset first screening rule, a partial hash value is obtained from the rearranged first hash value as the first verification data; and using a preset second screening rule, a partial hash value is obtained from the rearranged second hash value as the second verification data.

[0143] According to some embodiments of the present application, a specific first screening rule may be: obtaining even-numbered bits in the rearranged first Hash value and using them as first verification data.

[0144] According to some embodiments of the present application, a specific second screening rule may be: obtaining odd bits in the rearranged second Hash value and using them as second verification data.

[0145] According to some embodiments of the present application, the reconstruction module 150 is specifically used to: insert the coprime number and the combined hash data into the source payload according to a preset reconstruction rule to obtain a reconstructed payload.

[0146] According to some embodiments of the present application, the specific reconstruction rule is: insert every 2 bytes of the coprime number and the combined hash data after each byte of the source payload until all the combined hash data are inserted into the source payload; if the length of the source payload is less than half of the total length of the coprime number and the combined hash data, the remaining combined hash data is spliced at the end of the source payload.

[0147] The updating module 160 is specifically configured to use the reconstructed payload as the source payload of the message to be sent, update the message to be sent, and send the updated message to be sent to the receiving end.

[0148] Please see Figure 11 , Figure 11 This is a structural block diagram of a vehicle communication data verification device, which is applied to the receiving end corresponding to the transmitting end of the above embodiment. The device includes:

[0149] A second mask acquisition module 210 is configured to acquire a second mask corresponding to the received encrypted message;

[0150] A third hash acquisition module 220, configured to obtain a third hash value according to the message identifier of the encrypted message and the second mask;

[0151] The message parsing module 230 is used to parse the encrypted message using a preset reconstruction rule to obtain a coprime number, a first verification data, a second verification data, and a source payload;

[0152] A fourth hash acquisition module 240 is configured to obtain a fourth hash value according to the source payload and the second mask;

[0153] The verification module 250 is used to verify the encrypted message according to the coprime number, the first verification data, the second verification data, the third Hash value, and the fourth Hash value.

[0154] According to some embodiments of the present application, the verification module 250 is specifically used to: obtain a rearranged third hash value corresponding to the third hash value based on coprime numbers, and a rearranged fourth hash value corresponding to the fourth hash value; perform identity verification based on the rearranged third hash value and the first verification data to obtain an identity verification result; if the identity verification result is yes, perform data verification based on the rearranged fourth hash value and the second verification data.

[0155] In the technical solution of the embodiment of the present application, the encrypted message is used to find the corresponding mask, the encrypted message is parsed using the reconstruction rules during encryption, and the parsing results are used for identity verification and data verification. Whether to receive or discard the data is determined by whether the mask can be found, whether the identity authentication is passed, and whether the data verification is passed. Through a high-intensity verification process, the possibility of data tampering is avoided.

[0156] According to some embodiments of the present application, identity verification specifically includes: obtaining third verification data using a preset first screening rule; if the first verification data is equal to the third verification data, the identity verification is successful.

[0157] According to some embodiments of the present application, data verification specifically includes obtaining fourth verification data using a preset second screening rule; if the second verification data is equal to the fourth verification data, the data verification is successful.

[0158] Please see Figure 12 , Figure 12 This is a flowchart for the specific implementation of a vehicle communication data encryption system. This application also provides a vehicle communication data encryption system, which includes the aforementioned transmitter and receiver. Payload encryption is performed at the transmitter, while identity verification and payload verification are performed at the receiver. Through irregular data transmission and a high-intensity verification process, encrypted transmission of vehicle data is achieved, making the data resistant to tampering and cracking, and highly secure.

[0159] The specific implementation process of the vehicle communication data encryption system is as follows:

[0160] S501: Define the mask value length and generate independent masks based on the vehicle's message attributes: source IP, source MAC, destination IP, destination MAC, VLAN ID, transport protocol (UDP / TCP), source port, and destination port. Establish mask management rules, securely distribute, and regularly update the mask.

[0161] S502: Each communication component locally manages message attributes: source IP, source MAC, destination IP, destination MAC, VLAN ID, transport protocol (UDP / TCP), source PORT, destination PORT, and mask mapping relationship table;

[0162] S503: Define a data reconstruction method to prevent plaintext transmission. Insert the coprime number and the encrypted hash value into the source payload data at a rate of 2 bytes per byte, thereby disrupting the source payload data.

[0163] S504: Define the data encryption method, use the SHA second-generation hash algorithm, and use the service ID, method ID, session ID, first mask, and source payload as the data to be encrypted;

[0164] S505: Payload encryption process: The sender finds the first mask according to the attributes of the message to be sent: source IP, source MAC, target IP, target MAC, VLAN ID, transport protocol (UDP / TCP), source PORT, and target PORT, hashes the service ID, method ID, session ID, and the first mask to obtain HASH1, uses the coprime numbers k1 and n1 to reorder the first hash value HASH1 and extract all even bits of the rearranged first hash value to obtain hash1; then hashes the first mask and the payload data to obtain HASH2, uses the coprime numbers k2 and n2 to reorder the second hash value HASH2 and extract all odd bits of the rearranged second hash value to obtain hash2; recombines and inserts the coprime numbers k1, n1, k2, n2, hash1+hash2 into the corresponding positions of the payload data according to the data reconstruction rule to obtain new payload data; regenerates the SOMEIP message and sends it to the receiver via the bus;

[0165] S506: Identity verification process: The receiving end extracts the message attributes from the bus received data: source IP, source MAC, destination IP, destination MAC, VLAN ID, transport protocol (UDP / TCP), source PORT, destination PORT, and searches for the second mask in the local mapping table; if not found, it is directly discarded; if the second mask is found, the reconstruction rule is used to parse the coprime numbers k1, n1, k2, n2, the first verification data hash1, the second verification data hash2, and the source payload data2 (if it has not been tampered with, data2 is the same as the source payload data1); the second mask and the extracted service ID, Method ID, and Session ID are hashed to obtain HASH3, and HASH3 is reordered using the coprime numbers k1 and n1 to obtain a rearranged third hash value and all even bits of the rearranged third hash value are extracted to obtain hash3; hash3 is compared with hash1 for consistency. If they are different, the message is discarded; if they are equal, the payload verification continues;

[0166] S507: Payload verification process: After the identity authentication is successful, the extracted payload data and the second mask are hashed to obtain HASH4; HASH4 is reordered using the coprime numbers k2 and n2 to obtain a rearranged fourth hash value and all odd bits of the rearranged fourth hash value are extracted to obtain hash4, and hash4 is compared with hash2 for consistency. If they are different, they are discarded; if they are the same, the message is accepted.

[0167] The present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the method in any of the aforementioned optional implementations.

[0168] The present application provides a readable storage medium, which stores computer program instructions. When the computer program instructions are read and executed by a processor, the method in any of the aforementioned optional implementations is executed.

[0169] The storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0170] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0171] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0172] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0173] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0174] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0175] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A vehicle communication data encryption method, characterized in that: Applied to a sending end, the method includes: Obtain the first mask corresponding to the message to be sent; Obtaining a first hash value according to the message identifier of the message to be sent and the first mask; Obtaining a second hash value according to the source payload of the message to be sent and the first mask; Obtaining combined hash data based on the first hash value and the second hash value specifically includes: reordering the first hash value and the second hash value respectively to obtain a reordered first hash value and a reordered second hash value; screening the reordered first hash value and the reordered second hash value respectively to obtain first verification data and second verification data; recombining the first verification data and the second verification data to generate the combined hash data, wherein the reordering specifically includes: randomly generating a coprime number corresponding to the number of bits of the first hash value; using the coprime number to establish a mapping relationship table from the current order of each bit value of the hash value to the target order; reordering the first hash value based on the mapping relationship table to obtain the reordered first hash value; and reordering the second hash value with reference to the first hash value reordering step to obtain the reordered second hash value. Encrypting and reconstructing the source payload according to the combined hash data to obtain a reconstructed payload; The message to be sent is updated based on the reconstructed payload and sent.

2. The vehicle communication data encryption method according to claim 1, characterized in that: The mapping relationship table of the current sorting to the target sorting of each digit of the hash value established by using the coprime numbers includes: The mapping relationship table is generated based on a derivation formula, which is expressed as: ,and ; in, Indicates the position subscript corresponding to the target sorting, Indicates the position subscript corresponding to the current sort, The value range is 0 to , The number of bits representing the first hash value, for % represents the remainder operation.

3. The vehicle communication data encryption method according to claim 1, characterized in that: The step of screening the rearranged first Hash value and the rearranged second Hash value respectively to obtain first verification data and second verification data includes: Based on a preset first screening rule, obtaining a partial hash value from the rearranged first hash value as the first verification data; A preset second screening rule is used to obtain a partial hash value from the rearranged second hash value as the second verification data.

4. The vehicle communication data encryption method according to claim 3, characterized in that: The obtaining, based on a preset first screening rule, a partial hash value from the rearranged first hash value as the first verification data includes: Obtain even-numbered bits in the rearranged first hash value and use them as the first verification data.

5. The vehicle communication data encryption method according to claim 3, characterized in that: The obtaining a partial hash value from the rearranged second hash value as the second verification data by using a preset second screening rule includes: Obtain odd bits in the rearranged second Hash value and use them as the second verification data.

6. The vehicle communication data encryption method according to claim 1, characterized in that: The encrypting and reconstructing the source payload according to the combined hash data to obtain the reconstructed payload includes: The coprime number and the combined hash data are inserted into the source payload according to a preset reconstruction rule to obtain the reconstructed payload.

7. The vehicle communication data encryption method according to claim 6, characterized in that: The step of inserting the coprime number and the combined hash data into the source payload according to a preset reconstruction rule to obtain the reconstructed payload includes: Insert every two bytes of the coprime numbers and the combined hash data after each byte of the source payload until all the coprime numbers and the combined hash data are inserted into the source payload; if the length of the source payload is less than half of the total length of the coprime numbers and the combined hash data, concatenate the remaining combined hash data at the end of the source payload.

8. The vehicle communication data encryption method according to claim 1, characterized in that: The obtaining of the first mask corresponding to the message to be sent includes: Obtain the message attributes of the message to be sent, wherein the message attributes include source IP, source MAC, destination IP, destination MAC, VLAN ID, transport protocol, source PORT, and destination PORT; Based on the message attribute, a corresponding first mask is searched from a local mapping table, where the local mapping table includes a local mask and a communication peer mask.

9. A vehicle communication data decryption method, characterized in that: A receiving end corresponding to a transmitting end in the vehicle communication data encryption method according to any one of claims 1 to 8, the method comprising: Obtaining the second mask corresponding to the received encrypted message; Obtaining a third hash value according to the message identifier of the encrypted message and the second mask; Parsing the encrypted message according to a preset reconstruction rule to obtain a coprime number, first verification data, second verification data, and a source payload; Obtaining a fourth Hash value according to the source payload and the second mask; The encrypted message is verified according to the coprime number, the first verification data, the second verification data, the third hash value, and the fourth hash value. Specifically: based on the coprime number, a rearranged third hash value corresponding to the third hash value and a rearranged fourth hash value corresponding to the fourth hash value are obtained; identity verification is performed based on the rearranged third hash value and the first verification data to obtain an identity verification result; if the identity verification result is yes, data verification is performed based on the rearranged fourth hash value and the second verification data.

10. The vehicle communication data decryption method according to claim 9, characterized in that: The performing identity verification based on the rearranged third Hash value and the first verification data includes: Obtaining third verification data using a preset first screening rule; If the first verification data is equal to the third verification data, the identity verification is successful.

11. The vehicle communication data decryption method according to claim 9, characterized in that: The performing data verification based on the rearranged fourth Hash value and the second verification data includes: Obtaining fourth verification data using a preset second screening rule; If the second verification data is equal to the fourth verification data, the data verification is successful.

12. A vehicle communication data encryption device, characterized in that: Applied to a transmitting end, the device includes: A first mask acquisition module, used to obtain a first mask corresponding to the message to be sent; A first hash acquisition module, configured to obtain a first hash value according to the message identifier of the message to be sent and the first mask; A second hash acquisition module, configured to obtain a second hash value according to the source payload of the message to be sent and the first mask; A combination module, configured to obtain combined hash data based on the first hash value and the second hash value, specifically comprising: reordering the first hash value and the second hash value respectively to obtain a reordered first hash value and a reordered second hash value; screening the reordered first hash value and the reordered second hash value respectively to obtain first verification data and second verification data; and recombining the first verification data and the second verification data to generate the combined hash data, wherein the reordering process specifically comprises: randomly generating a coprime number corresponding to the number of bits of the first hash value; using the coprime number to establish a mapping relationship table from the current order of each bit value of the hash value to the target order; reordering the first hash value based on the mapping relationship table to obtain the reordered first hash value; and reordering the second hash value with reference to the first hash value reordering step to obtain the reordered second hash value; A reconstruction module, configured to encrypt and reconstruct the source payload according to the combined hash data to obtain a reconstructed payload; An updating module is used to update the message to be sent based on the reconstructed payload and send it.

13. A vehicle communication data decryption device, characterized in that: Applied to a receiving end, the device includes: A second mask acquisition module, configured to acquire a second mask corresponding to a received encrypted message; A third hash acquisition module, configured to obtain a third hash value according to the message identifier of the encrypted message and the second mask; A message parsing module, configured to parse the encrypted message using a preset reconstruction rule to obtain two mutually prime numbers, a first verification data, a second verification data, and a source payload; a fourth hash acquisition module, configured to obtain a fourth hash value according to the coprime number, the source payload, and the second mask; The verification module is used to verify the encrypted message according to the coprime number, the first verification data, the second verification data, the third hash value, and the fourth hash value, specifically: based on the coprime number, obtain a rearranged third hash value corresponding to the third hash value, and a rearranged fourth hash value corresponding to the fourth hash value; perform identity verification based on the rearranged third hash value and the first verification data to obtain an identity verification result; if the identity verification result is yes, perform data verification based on the rearranged fourth hash value and the second verification data; the rearrangement includes: randomly generating a coprime number corresponding to the number of bits of the third hash value; using the coprime number to establish a mapping relationship table from the current order of each bit value of the hash value to the target order, and reordering the third hash value based on the mapping relationship table to obtain the reordered third hash value; and reordering the fourth hash value with reference to the third hash value reordering step to obtain the reordered fourth hash value.

14. A vehicle communication data encryption system, characterized in that: The system includes the sending end in the vehicle communication data encryption method according to any one of claims 1 to 8, and the receiving end in the vehicle communication data decryption method according to any one of claims 9 to 11.

15. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the vehicle communication data encryption method according to any one of claims 1 to 8.

16. A readable storage medium, characterized in that The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the vehicle communication data encryption method according to any one of claims 1 to 8 is executed.

Images