Trusted CAN communication method and system based on dual-channel and closed-loop encryption and decryption

Abstract

The invention discloses a trusted CAN communication method and system based on dual channels and closed-loop encryption and decryption, and relates to the technical field of data communication, and the method comprises the steps: dividing negotiation and transmission communication channels on the same physical CAN bus, which are respectively used for message broadcasting and user data transmission; equipment authentication and credible list maintenance are completed through a broadcast message, and decryption information is carried to form a chained encryption and decryption closed loop; a user message is encrypted by adopting a one-time password book, and a receiver verifies and restores data based on decryption information; dynamic priority management and an abnormal triggering mechanism based on ID conflicts are supported, and the communication safety and the system stability are improved. Through dual-channel division, chained closed-loop encryption and decryption, dynamic priority management based on arbitration and a communication anomaly detection mechanism, the data security, transmission reliability and system scheduling flexibility of the CAN network are improved.

Description

Technical Field

[0001] The present invention relates to the field of data communication technology, and in particular to a trusted CAN communication method and system based on dual channels and closed-loop encryption and decryption. Background Art

[0002] With the rapid development of the Internet of Things (IoT) and automation technology, the CAN bus, as an efficient and reliable serial communication protocol, has been widely used in automotive, industrial control, aerospace, and other fields. Traditional CAN communication systems do not specifically consider encryption and authentication mechanisms during data transmission, making them vulnerable to malicious attacks and data tampering. As the automotive and industrial control fields gradually move toward intelligent and networked development, the CAN bus faces increased risks of cyberattacks, including but not limited to replay attacks, counterfeit device attacks, and data tampering. To enhance the security of CAN networks, it is crucial to design a secure communication method that prevents unauthorized access and ensures confidentiality and data integrity during communication.

[0003] In the existing CAN bus, all devices communicate over a shared physical bus. Every CAN message is accessible to all devices, lacking effective encryption and isolation mechanisms. This makes communications between devices vulnerable to unauthorized access or tampering in certain scenarios. Furthermore, because the CAN protocol uses a broadcast method, all devices can see all messages sent on the bus, leading to security and privacy vulnerabilities.

[0004] Therefore, how to improve the security, reliability and flexibility of CAN communication by combining encryption technology, decentralized management, dynamic priority mechanism, message legitimacy detection and other technologies on the basis of traditional CAN bus communication has become a key issue that needs to be solved urgently. Summary of the Invention

[0005] Based on the above-mentioned shortcomings of the prior art, the purpose of the present invention is to provide a trusted CAN communication method and system based on dual channels and closed-loop encryption and decryption to solve the above-mentioned technical problems.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a trusted CAN communication method based on dual channels and closed-loop encryption and decryption, comprising: On the same physical CAN bus, the communication logic is divided into negotiation communication channel and transmission communication channel. The negotiation communication channel transmits broadcast messages based on the group identification ID, and the transmission communication channel transmits user messages based on the valid device ID. Verify the legitimacy of devices based on broadcast messages received through the negotiated communication channel, dynamically manage the trusted device list, and implement access and isolation of communication nodes; Trusted CAN devices send self-decryptable broadcast messages through the negotiated communication channel. The broadcast messages contain decryption information used to decrypt the next user message. Based on the decryption information obtained, a one-time pad is generated, the user data is encrypted, and the user message is constructed and sent through the transmission communication channel. The receiving device decrypts and verifies the user message based on the decryption information. If the verification passes, it is considered a valid message, otherwise it is discarded. In response to device ID conflicts, trusted CAN devices perform dynamic priority management based on preset priorities and valid ID reselection strategies; During message transmission, message reliability transmission detection is performed. When abnormalities in broadcast message and user message transmission are detected or the number of decryption failures exceeds the threshold, the exception is triggered and reported to the application layer system.

[0007] The present invention is further configured such that the negotiation logical communication channel uses a preset group ID as a CAN message ID to transmit negotiation information; the transmission logical communication channel uses a valid device ID as a CAN message ID to transmit application layer data information; Broadcast messages and user messages are logical layer messages. Broadcast messages are transmitted on the negotiation logical communication channel; user messages are transmitted on the transmission logical communication channel.

[0008] The present invention is further configured such that the user message includes message metadata, decrypted value type, decrypted value, sequence number, message length, padding length, data, data padding, and data checksum; The broadcast message includes the decryption information of this message, serial number, device ID, function, message length, padding length, user message decryption related information, value, data padding and data verification; the decryption information of this message includes the decryption value type and decryption value.

[0009] The present invention is further configured such that both broadcast messages and user messages are in encrypted format, and the message structure carries decryption information of the next user message, the decryption information including a decryption value type and a decryption value; the decryption value type includes a random value type and an offset value type: When the random value type is used, the receiver uses the random value as a seed and combines it with the preset symmetric key to input the scrambling code generation algorithm to generate the current one-time pad; When the offset value type is used, the receiver generates the current one-time pad by offsetting the position of the pad used in the previous decrypted user message based on the offset value. The encryption process is as follows: the original data except the data check field is input into the scrambling algorithm, and the original data is XOR-scrambled with the one-time pad to obtain the ciphertext data; The decryption process is as follows: the receiver constructs a one-time pad based on the decryption method indicated by the decryption information in the current message, performs an XOR scrambling operation with the ciphertext data to restore the original data, and then performs data verification on the restored result to verify its legitimacy. If the verification fails, the message is discarded.

[0010] The present invention is further configured such that after startup, the trusted CAN device continuously monitors the negotiation communication channel in a whitelist monitoring mode by default, and only receives the transmission communication channel messages of the authenticated device ID; Device authentication is based on broadcast messages. If a trusted CAN device successfully receives a legitimate broadcast message on the negotiated communication channel and passes decryption and verification, it extracts the valid device ID and adds it to the local monitoring whitelist. The authenticated device enters the lifecycle management process, and the device information record includes: current decryption information, the sequence value of the latest broadcast message, the unique serial identifier of the device, and the latest activity timestamp; If the same device ID and unique serial identifier are received subsequently but the broadcast serial number is non-increasing, it is considered an illegal message or networking anomaly and authentication fails. If the unique serial identifier is different, the device status is updated and it is considered as a device priority adjustment. Before the priority adjustment, a broadcast message confirmation is sent first, and the device priority is adjusted after the confirmation message is received to prevent CAN message replay attacks. The latest activity timestamp is automatically refreshed each time a legitimate message is successfully received from a device. If a device is inactive within the set time, it is considered offline, its information will be removed from the whitelist, and monitoring will be terminated. If the number of illegal messages received from a device exceeds the threshold within the set time, the device's valid device ID will be removed from the whitelist, and a notification will be broadcast to notify it to re-authenticate or adjust its priority. Illegal messages include messages of decryption failure or verification failure.

[0011] The present invention is further configured such that dynamic priority management includes: Each trusted CAN device is set with a preset device ID and an effective device ID. In the absence of conflict, the effective device ID is the same as the preset device ID. When a device ID conflict is detected, or a priority management notification is received in a broadcast message from another device, the priority of the current valid device ID is reduced by one level, that is, the current valid device ID plus one is used as the new valid device ID; After setting a new valid device ID, the relevant devices are informed through broadcast messages, triggering the priority adjustment and re-authentication of the corresponding devices; If a trusted CAN device receives a broadcast message from another device with the same valid ID and the other device has a different unique sequence value, the device that joins the network later will have a higher priority, and the existing device will need to reselect a valid device ID. If the valid ID currently used by any trusted CAN device is not equal to the preset ID, and the device is not in conflict with the preset ID on the same virtual bus, the device will periodically monitor the channel corresponding to its preset ID. If it is confirmed to be idle, it will switch back to the preset ID and broadcast to notify other devices to update the mapping information. If it is a conflict between devices on the same virtual bus, when the corresponding device goes offline, it will switch back to the preset ID and broadcast to notify other devices to update the mapping information.

[0012] The present invention is further configured such that the method includes an anomaly detection mechanism based on the decryption state of the communication channel, specifically comprising: The trusted CAN device implements an interval monitoring strategy on the negotiation communication channel. If the number of consecutive broadcast messages of decryption failure or data verification failure received within a preset time window exceeds the threshold, it is determined to be a network anomaly or an illegal device attack. The abnormal event is triggered and reported to the upper-layer application system, and the trusted CAN device is started to implement the interval monitoring strategy on the negotiation communication channel until the channel returns to normal and adopts the continuous monitoring strategy. Trusted CAN devices continuously monitor the status of the transmission communication channel. If the number of decryption failures of user messages received within a preset time window exceeds a preset threshold, it is determined that there is a data conflict or illegal message injection behavior, triggering the device priority management process; If the number of device priority management operations triggered within a continuous time period exceeds the total number of trusted devices in the current virtual CAN bus, the network is determined to be under continuous attack and a high-priority security alarm signal is sent to the upper-level application system.

[0013] The present invention is further configured such that the method includes a user message reliable transmission detection mechanism for detecting whether the message is completely received and processed in a timely manner on the virtual CAN bus, comprising: Passive detection mechanism: When a trusted CAN device receives a user message from a specific trusted CAN device, if the message sequence number does not increase continuously, it determines that there is a risk of message loss. The device then sends a broadcast message through the negotiated communication channel after a random delay within the specified time to alert the sender. If the device receives the same exception report from another device during the delay period, it automatically cancels the current exception alert broadcast to reduce broadcast conflicts. Active detection mechanism: When the application layer specifies that certain user messages require confirmation, the trusted CAN device adds their message IDs to the reliable transmission list and requires all receivers to return confirmation information via broadcast within a specified time. If the number of confirmation responses is less than the number of current virtual CAN bus members recorded in the device management, the message is considered lost. When any mechanism detects a message transmission anomaly, the detection device will trigger a report to the upper-layer application system, which will choose retransmission, alarm, or fault-tolerance compensation based on the application scenario strategy.

[0014] The present invention is further configured as follows: the method constructs multiple virtual CAN buses through an encryption mechanism and a device management mechanism, including: The physical CAN bus is logically divided into multiple virtual CAN buses, each of which is composed of trusted CAN devices with the same preset group identification ID and symmetric key; The communication channel within the virtual CAN bus is isolated from other virtual CAN buses, allowing only member devices to negotiate communication and data transmission based on the same group ID and key; The device priority relationship within each virtual CAN bus is uniformly sorted by the preset device ID. When there is no conflict, the effective ID of the device is equal to its preset ID, maintaining communication consistency and arbitration priority. The device priority management and device monitoring lists between different virtual CAN buses do not interfere with each other, avoiding cross-logic interference caused by ID conflicts, thereby realizing dynamic separation and independent operation of virtual CAN buses.

[0015] The present invention also provides a trusted CAN communication system based on dual channels and closed-loop encryption and decryption, which is used to implement the above-mentioned trusted CAN communication method based on dual channels and closed-loop encryption and decryption, including: Channel division module: On the same physical CAN bus, the communication logic is divided into negotiation communication channel and transmission communication channel. The negotiation communication channel transmits broadcast messages based on the group ID, and the transmission communication channel transmits user messages based on the valid device ID. Device management module: Verifies the legitimacy of devices based on broadcast messages received through the negotiated communication channel, dynamically manages the list of trusted devices, and implements access and isolation of communication nodes; Transmission module: The trusted CAN device sends a self-decryptable broadcast message through the negotiated communication channel. The broadcast message contains decryption information used to decrypt the next user message. Based on the decryption information obtained, a one-time password is generated, the user data is encrypted, and the user message is constructed and sent through the transmission communication channel. Verification module: The receiving device decrypts and verifies the user message based on the decryption information. If the verification passes, it is considered a valid message; otherwise, it is discarded. Priority management module: In response to device ID conflicts, trusted CAN devices complete dynamic priority management based on preset priorities and valid ID reselection strategies; Anomaly detection module: During message transmission, it performs message reliability transmission detection. When it detects abnormal transmission of broadcast messages and user messages or the number of decryption failures exceeds the threshold, it triggers the exception and reports it to the application layer system.

[0016] The present invention provides a trusted CAN communication method and system based on dual channels and closed-loop encryption and decryption. The method divides the communication logic into a negotiation communication channel and a transmission communication channel on the same physical CAN bus. The negotiation communication channel transmits broadcast messages based on a group identification ID, and the transmission communication channel transmits user messages based on a valid device ID. Device legitimacy is verified based on the broadcast messages received through the negotiation communication channel, and a trusted device list is dynamically managed to achieve access and isolation of communication nodes. The trusted CAN device sends a self-decryptable broadcast message through the negotiation communication channel. The broadcast message contains decryption information for decrypting the next user message. A one-time password is generated based on the obtained decryption information, and a user message is constructed after encrypting the user data and sent through the transmission communication channel. The receiving device decrypts and verifies the user message based on the decryption information. If the verification passes, it is determined to be a valid message, otherwise it is discarded. In response to a device ID conflict, the trusted CAN device completes dynamic priority management based on a preset priority and a valid ID reselection strategy. When a user message transmission anomaly is detected or the number of decryption failures exceeds a threshold, an anomaly report or a retransmission request is triggered through the broadcast channel. The beneficial effects produced include: 1. Realize logical communication channel division on the physical bus: By logically dividing CAN communication into negotiation communication channels and transmission communication channels, the control and user data transmission are separated, making the message types clear and the transmission paths independent, effectively improving the flexibility of communication scheduling and control; 2. Establish a chain-dependent closed-loop encryption and decryption mechanism: By embedding decryption information in user and broadcast messages, combined with a one-time pad and scrambling algorithm, each message ciphertext is unique and non-replayable, significantly improving data confidentiality, anti-counterfeiting, and resistance to replay attacks. 3. Implement dynamic priority management based on arbitration mechanism: Each device has a preset device ID and a valid device ID. When a conflict occurs, the valid ID is automatically selected and a notification is broadcast. This allows for dynamic adjustment of device priority without human intervention, ensuring that messages from high-priority devices are sent first. 4. Communication anomaly detection and alarm capabilities: The system can continuously monitor the message decryption status of negotiation and transmission channels, and trigger alarms or processing mechanisms based on decryption failures and illegal behavior detection, thereby enhancing network security protection capabilities and robustness; 5. Comprehensively guarantee user message reliability: By introducing a user message reliability detection mechanism, this overcomes the limitation of the traditional CAN data link layer, which can only guarantee "reception by at least one node" but cannot confirm "reception by all nodes." By utilizing a dual strategy of passive detection (based on message sequence number continuity analysis) and active detection (based on ACK confirmation feedback), this invention monitors the complete transmission status of messages within the virtual CAN bus in real time, ensuring that all target trusted nodes have successfully received the message. This significantly improves data distribution integrity, avoids application logic errors or control failures caused by message loss, and enhances the communication reliability and robustness of the entire CAN network in mission-critical scenarios.

[0017] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without inventive efforts. In the drawings: Figure 1 This is the expression diagram of CAN / CANFD frame in the data link layer; Figure 2 The expression diagram of CAN frame for application layer; Figure 3 A flowchart of a trusted CAN communication method based on dual channels and closed-loop encryption and decryption is shown as an exemplary embodiment of the present invention; Figure 4 A diagram showing an expression form of a user message according to an exemplary embodiment of the present invention; Figure 5 A diagram showing an expression form of a broadcast message according to an exemplary embodiment of the present invention; Figure 6 This is a flowchart showing information encryption according to an exemplary embodiment of the present invention; Figure 7 This is a flowchart of information decryption shown as an exemplary embodiment of the present invention; Figure 8 A diagram showing a device management mechanism according to an exemplary embodiment of the present invention; Figure 9 A diagram showing a priority management mechanism according to an exemplary embodiment of the present invention; Figure 10The figure is a schematic structural diagram of a trusted CAN communication system based on dual channels and closed-loop encryption and decryption, showing an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following describes the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art will readily appreciate the other advantages and benefits of the present invention from the disclosure herein. The present invention may also be implemented or applied through various other specific embodiments, and the various details in this specification may be modified or altered based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are intended only to illustrate the present invention and are not intended to limit the scope of protection of the present invention.

[0020] It should be noted that the illustrations provided in the following embodiments are merely schematic illustrations of the basic concept of the present invention. Therefore, the illustrations only show components related to the present invention and are not drawn according to the number, shape, and size of components in actual implementation. In actual implementation, the type, quantity, and proportion of each component may be changed arbitrarily, and the component layout may also be more complex.

[0021] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it will be apparent to those skilled in the art that the embodiments of the present invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring the embodiments of the present invention.

[0022] First of all, in order to help understand the principle of the present invention, we first introduce the CAN / CANFD frame format and mapping principle. Figure 1 , the expression of CAN / CANFD frame in the data link layer. CAN has multiple frame types in the data link layer. The application layer only focuses on the data frame and remote control frame in CAN / CANFD. Please refer to Figure 2 The application layer abstracts the CAN frame into the following expressions; extended identifier: whether the CAN frame / CANFD frame is an extended frame. If it is an extended frame, the ID is 29 bits, if not, the ID is 11 bits; remote control frame identifier: identifies whether the frame type is data transmission frame data or request transmission frame; data length: describes the effective transmission data length of the data field; data: CAN frame length 0-8 bytes, and CANFD frame length 0-64 bytes.

[0023] Example 1 A trusted CAN communication method based on dual channels and closed-loop encryption and decryption, such as Figure 3 Shown, including: On the same physical CAN bus, the communication logic is divided into negotiation communication channel and transmission communication channel. The negotiation communication channel transmits broadcast messages based on the group identification ID, and the transmission communication channel transmits user messages based on the valid device ID. Verify the legitimacy of devices based on broadcast messages received through the negotiated communication channel, dynamically manage the trusted device list, and implement access and isolation of communication nodes; Trusted CAN devices send self-decryptable broadcast messages through the negotiated communication channel. The broadcast messages contain decryption information used to decrypt the next user message. Based on the decryption information obtained, a one-time pad is generated, the user data is encrypted, and the user message is constructed and sent through the transmission communication channel. The receiving device decrypts and verifies the user message based on the decryption information. If the verification passes, it is considered a valid message, otherwise it is discarded. In response to device ID conflicts, trusted CAN devices perform dynamic priority management based on preset priorities and valid ID reselection strategies; During message transmission, message reliability transmission detection is performed. When abnormalities in broadcast message and user message transmission are detected or the number of decryption failures exceeds the threshold, the exception is triggered and reported to the application layer system.

[0024] The present invention is further configured such that the negotiation logical communication channel uses a preset group ID as a CAN message ID to transmit negotiation information; the transmission logical communication channel uses a valid device ID as a CAN message ID to transmit application layer data information; Broadcast messages and user messages are logical layer messages. Broadcast messages are transmitted on the negotiation logical communication channel; user messages are transmitted on the transmission logical communication channel.

[0025] like Figure 4As shown, the present invention further configures the user message to include message metadata, decrypted value type, decrypted value, sequence number, message length, padding length, data, data padding, and data checksum. Specifically, data checksum is generated using a data checksum algorithm using all components of the user message, excluding the data checksum, as input data. Data checksum is used to verify the data after decryption. All components of the user message are transmitted encrypted. In the above fields, message metadata: is the CAN message header in the application frame format; decryption value type: represents 2 types, namely random value type and offset value type; decryption value: pure value, the meaning is expressed by the decryption value type; sequence number: is a cyclically increasing value, used for transmission reliability detection mechanism; message length: represents the length of the user message, that is, the logical layer message length in the figure; padding length: the underlying CAN transmission has data alignment requirements, so data alignment is required; data: is the data field in the application layer frame; data padding: includes but is not limited to padding the data here with random values or hashes; data check: used to check the data when decrypting the logical layer message; subpacketization is composed of an identifier and data, where the identifier is composed of a subpacket identifier, the total number of subpackets and the packet sequence number; subpacket identifier: identifies whether the data carried is a complete logical layer message, and further The subpacket identifier is not only used in user messages, but also in broadcast messages. Here is an explanation. If the CAN device uses the CANFD format for transmission, it can generally carry the broadcast message completely. However, if it is in the CAN format, only 8 bytes can be used for transmission, so a broadcast message cannot be placed. The broadcast message must be encrypted first and then subpacketized. The same is true for user messages. At this time, the subpacket identifier must be scrambled and the one-time password corresponding to the message is used for scrambling; Total number of subpackets: If the subpacket identifier indicates that the data is carried by a complete logical layer message, this field indicates that a complete logical layer message is divided into several message packets; Packet sequence number: Similarly, it indicates which message packet it is; Data: carries a complete logical layer message or part; The data link layer uses a valid device ID as the ID of the CAN message, carries the message packet, and the others are configured as the CAN data frame format; like Figure 5 As shown, the broadcast message includes the decryption information of this message, serial number, device ID, function, message length, padding length, user message decryption related information, value, data padding and data verification; the decryption information of this message includes the decryption value type and decryption value. Figure 5In the example, the logical layer message is a broadcast message, consisting of the fields shown in the figure. The decryption information for this message consists of the decryption value type and decryption value, the same as in the user message. This is used to decrypt this message, so the decryption value type is always a random value. Note that this field is encrypted with a fixed key; Serial number: Because the broadcast message is the communication channel for the trusted CAN device, it uses a self-decryption method. The serial number is a cyclically increasing field. It and the device ID in the message can resist message replay attacks; Device ID: The valid device ID of the trusted CAN device that sends this broadcast message; Function: The broadcast message is defined for different functional purposes, and the meaning of the values in the broadcast message is explained; Message length: The length of this broadcast message; Padding length: The underlying CAN transmission has data alignment requirements, so data alignment is required; User message decryption related information: It consists of the decryption value type and decryption value, which are consistent with the user message. This is used to decrypt the next user message to be sent by the trusted CAN device that sent this broadcast message; Value: This field has an indefinite length, and its specific meaning is defined by the function field; Data padding: Including but not limited to padding the data here with a random value or hash; Data check: Used to check the data when decrypting the logical layer message; All components of the broadcast message are encrypted for transmission. However, the decryption information of this message is encrypted with a fixed key scrambling code, while the other components are introduced in the encryption and decryption mechanism; Figure 5 The ID of the CAN message in the data link layer is the group ID, and the rest are the same as in the user message.

[0026] like Figure 6 and Figure 7 As shown, the present invention is further configured such that both broadcast messages and user messages are in encrypted format, and the message structure carries decryption information of the next user message, the decryption information includes a decryption value type and a decryption value; the decryption value type includes a random value type and an offset value type: When the random value type is used, the receiver uses the random value as a seed and combines it with the preset symmetric key to input the scrambling code generation algorithm to generate the current one-time pad; When the offset value type is used, the receiver generates the current one-time pad by offsetting the position of the pad used in the previous decrypted user message based on the offset value. The encryption process is as follows: the original data except the data check field is input into the scrambling algorithm, and the original data is XOR-scrambled with the one-time pad to obtain the ciphertext data; The decryption process is as follows: the receiver constructs a one-time pad based on the decryption method indicated by the decryption information in the current message, performs an XOR scrambling operation with the ciphertext data to restore the original data, and then performs data verification on the restored result to verify its legitimacy. If the verification fails, the message is discarded.

[0027] Specifically, the CAN trusted devices of the present invention all use broadcast messages as the beginning of communication. Broadcast messages are self-decryptable and carry user message decryption information. User messages also carry the decryption information of the next user message, thus forming a decryption closed loop. Figure 6 In the example, arrows pointing to the boxes in the middle column indicate data input to the corresponding operation in the middle column. The boxes pointed out by the arrows in the middle column represent the output data of the corresponding operation. In broadcast messages, the original data is all fields except the decryption information and data checksum of the message. In user messages, the original data is all fields except the data checksum.

[0028] See also Figure 7 Upon receiving a fully encrypted message, the random value in the decrypted message is retrieved and a one-time pseudo-keypad is generated, similar to the encryption process. The encrypted data in the message and the pseudo-keypad are scrambled to produce the original data to be verified. This data is then verified using a data verification algorithm and the data checksum in the message. If the verification passes, the message is considered legitimate; otherwise, it is considered illegitimate and discarded. The decrypted message consists of two fields: type and value. The type specifies whether the value is a random value and an offset. If the value is an offset, the current one-time pseudo-keypad is reused when decrypting the next user message sent by the trusted CAN device, but it is offset by the corresponding value. If the value is a random value, a new pseudo-keypad is generated. This mechanism aims to maintain a dynamic balance between security and efficiency.

[0029] Each trusted CAN device has two logical communication channels: a negotiation logical communication channel that uses the group ID as the CAN message ID, and a transmission logical communication channel that uses the valid device ID as the CAN message ID. Messages transmitted by the trusted CAN device on the negotiation logical communication channel are self-decryptable, and the encrypted data of the message carries the decryption information for the next message on the transmission logical communication channel from the trusted CAN device. The encrypted data of messages on the transmission logical communication channel also carries the decryption information for the next message on the transmission logical communication channel. Each message uses different decryption information to achieve dynamic encryption.

[0030] like Figure 8 As shown, the present invention is further configured such that after startup, the trusted CAN device continuously monitors the negotiation communication channel in a whitelist monitoring mode by default, and only receives the transmission communication channel message of the authenticated device ID; Device authentication is based on broadcast messages. If a trusted CAN device successfully receives a legitimate broadcast message on the negotiated communication channel and passes decryption and verification, it extracts the valid device ID and adds it to the local monitoring whitelist. The authenticated device enters the lifecycle management process, and the device information record includes: current decryption information, the sequence value of the latest broadcast message, the unique serial identifier of the device, and the latest activity timestamp; If the same device ID and unique serial identifier are received subsequently but the broadcast serial number is non-increasing, it is considered an illegal message or networking anomaly and authentication fails. If the unique serial identifier is different, the device status is updated and it is considered as a device priority adjustment. Before the priority adjustment, a broadcast message confirmation is sent first, and the device priority is adjusted after the confirmation message is received to prevent CAN message replay attacks. The latest activity timestamp is automatically refreshed each time a legitimate message is successfully received from a device. If a device is inactive within the set time, it is considered offline, its information will be removed from the whitelist, and monitoring will be terminated. If the number of illegal messages received from a device exceeds the threshold within the set time, the device's valid device ID will be removed from the whitelist, and a notification will be broadcast to notify it to re-authenticate or adjust its priority. Illegal messages include messages of decryption failure or verification failure.

[0031] Specifically, the main functions of device management include device authentication management, device lifecycle management, and device priority management; Device authentication management: This involves authenticating trusted devices and maintaining a listening list. When a CAN device is powered on, the listening mechanism is in whitelist mode, and this mode cannot be changed. A trusted CAN device will always listen to the negotiation communication channel (i.e., using the preset group ID as the CAN message ID). The transmission communication channel, which represents other trusted CAN devices, is a broadcast message received, decoded, and verified for legitimacy by the trusted CAN device on the negotiation communication channel (indicating successful device authentication). The device ID in the message (i.e., the valid device ID representing the trusted CAN device) is added to the whitelist, marking the beginning of device lifecycle management. When device lifecycle management determines that a device is to be deleted, the valid device ID representing the trusted CAN device is removed from the listening whitelist.

[0032] Device Lifecycle Management: Device authentication management (DEM) enables device lifecycle management by adding the device to the monitoring list. The DEM stores decryption information, the sequence in broadcast messages, the unique sequence value representing the trusted CAN device (carried in the broadcast message), and the latest activity timestamp. The sequence in broadcast messages and the unique sequence value representing the trusted CAN device are used to prevent message replay attacks and manage device priority. If the sequence value in a broadcast message sent by a CAN device does not increase regularly and the unique sequence value of the trusted CAN device matches, it is considered an illegal attack or a networking issue, representing a validity check failure. However, if the unique sequence value of the trusted CAN device is different, it is a legitimate message, and the corresponding device information field is updated, which is considered device priority management. The latest activity timestamp is used to delete the device information and perform device authentication management if the device has not sent any messages for a period of time. The latest activity timestamp is refreshed when a message is received from the trusted CAN device. If a threshold of illegal messages (decryption or validity check failures) is received on the transmission communication channel within a period of time, the message is sent to the trusted CAN device via a broadcast message for device priority management. After that, the trusted CAN device information and device authentication management are deleted.

[0033] like Figure 9 As shown, the present invention is further configured such that dynamic priority management includes: Each trusted CAN device is set with a preset device ID and an effective device ID. In the absence of conflict, the effective device ID is the same as the preset device ID. When a device ID conflict is detected, or a priority management notification is received in a broadcast message from another device, the priority of the current valid device ID is reduced by one level, that is, the current valid device ID plus one is used as the new valid device ID; After setting a new valid device ID, the relevant devices are informed through broadcast messages, triggering the priority adjustment and re-authentication of the corresponding devices; If a trusted CAN device receives a broadcast message from another device with the same valid ID, and the other device has a different unique sequence value, the device that joins the network later will have higher priority, and the existing device will need to reselect a valid device ID. Furthermore, before reselecting, it must first confirm the ID through a broadcast message and wait for the confirmation message before reselecting the device ID to prevent CAN message replay attacks. If the valid ID currently used by any trusted CAN device is not equal to the preset ID, and the device is not in conflict with the preset ID on the same virtual bus, the device will periodically monitor the channel corresponding to its preset ID. If it is confirmed to be idle, it will switch back to the preset ID and broadcast to notify other devices to update the mapping information. If it is a conflict between devices on the same virtual bus, when the corresponding device goes offline, it will switch back to the preset ID and broadcast to notify other devices to update the mapping information.

[0034] Specifically, device priority management refers to the priority of messages sent simultaneously within a CAN network. A trusted CAN device with a smaller valid device ID value has a higher priority, utilizing the CAN bus arbitration mechanism. Trusted CAN devices have two device IDs: valid and preset. When there is no conflict, the valid ID value equals the preset value. In the event of a conflict, the valid device ID is selected.

[0035] When receiving a broadcast message notification from other trusted CAN devices for priority management (that is, valid device ID selection will be performed in the scenario described in device lifecycle management). Valid device ID selection: The trusted CAN device will select a free and available valid device ID with a lower priority than the current device based on the locally cached information of other trusted CAN devices. If there is no free device available, it will use a valid device ID with a priority one level lower than it as the valid device ID and send a broadcast message to the corresponding trusted CAN device for device priority management, and so on, and send a broadcast message for device monitoring management. When a trusted CAN device receives a broadcast message from another trusted CAN device with the same valid device ID (determined by the unique serial value representing the trusted CAN device), it will select the valid device ID as described above. By default, the priority of a later trusted CAN device with the same device ID is higher than that of the existing trusted CAN device.

[0036] Priority management follows two principles: If there are no conflicts, the device's effective ID is equal to the preset ID, and the priority of a later device ID is higher than that of an existing trusted CAN device (i.e., the existing trusted CAN device selects the device's effective ID). Principle 2 can resolve conflicts within the same virtual CAN bus. When an external conflict occurs, the trusted CAN device within the same virtual CAN bus, as described in the device management description, notifies the conflicting CAN device to select its effective device ID.

[0037] When the valid ID is different from the preset ID and there is an external conflict (determined by checking the locally stored trusted CAN valid device ID), the trusted CAN device will monitor the preset ID channel at intervals. If no other device is occupying it, the device valid ID selection will be switched back to the preset ID.

[0038] The present invention is further configured such that the method includes an anomaly detection mechanism based on the decryption state of the communication channel, specifically comprising: The trusted CAN device implements an interval monitoring strategy on the negotiation communication channel. If the number of consecutive broadcast messages of decryption failure or data verification failure received within a preset time window exceeds the threshold, it is determined to be a network anomaly or an illegal device attack. The abnormal event is triggered and reported to the upper-layer application system, and the trusted CAN device is started to implement the interval monitoring strategy on the negotiation communication channel until the channel returns to normal and adopts the continuous monitoring strategy. Trusted CAN devices continuously monitor the status of the transmission communication channel. If the number of decryption failures of user messages received within a preset time window exceeds a preset threshold, it is determined that there is a data conflict or illegal message injection behavior, triggering the device priority management process; If the number of device priority management operations triggered within a continuous time period exceeds the total number of trusted devices in the current virtual CAN bus, the network is determined to be under continuous attack and a high-priority security alarm signal is sent to the upper-level application system.

[0039] Specifically, when decryption failures or data verification failures are detected on the negotiation communication channel within a period of time, it indicates that there is a networking anomaly or an illegal device is attacking the network. The network will notify and report this anomaly to the upper application layer to handle the anomaly. The trusted CAN device will monitor the negotiation communication channel at intervals and resume normal monitoring when the channel is normal. When decryption failures are detected on the transmission communication channel for a period of time exceeding the preset threshold, it indicates a data transmission conflict or an illegal device, and the device will be prioritized. When there are multiple device priority managements within a period of time (exceeding the number of devices on the current virtual bus), it means that an illegal device is attacking the network, and the application layer will be reported to handle this anomaly. The present invention is further configured such that the method includes a user message reliable transmission detection mechanism for detecting whether the message is completely received and processed in a timely manner on the virtual CAN bus, comprising: Passive detection mechanism: When a trusted CAN device receives a user message from a specific trusted CAN device, if the message sequence number does not increase continuously, it determines that there is a risk of message loss. The device then sends a broadcast message through the negotiated communication channel after a random delay within the specified time to alert the sender. If the device receives the same exception report from another device during the delay period, it automatically cancels the current exception alert broadcast to reduce broadcast conflicts. Active detection mechanism: When the application layer specifies that certain user messages require confirmation, the trusted CAN device adds their message IDs to the reliable transmission list and requires all receivers to return confirmation information via broadcast within a specified time. If the number of confirmation responses is less than the number of current virtual CAN bus members recorded in the device management, the message is considered lost. When any mechanism detects a message transmission anomaly, the detection device will trigger a report to the upper-layer application system, which will choose retransmission, alarm, or fault-tolerance compensation based on the application scenario strategy.

[0040] Specifically, the reliable transmission of user messages depends on the communication quality of the communication channel. When encountering illegal attacks or message loss, the reliable transmission management of user messages ensures that the trusted CAN device can perceive this situation and take corresponding measures.

[0041] Because CAN's communication mechanism is broadcast communication and CAN devices are decentralized, when a trusted CAN device detects that a message is lost, it should be reported to the application layer for processing, and different strategies should be made according to different actual application scenarios.

[0042] The present invention is further configured as follows: the method constructs multiple virtual CAN buses through an encryption mechanism and a device management mechanism, including: The physical CAN bus is logically divided into multiple virtual CAN buses, each of which is composed of trusted CAN devices with the same preset group identification ID and symmetric key; The communication channel within the virtual CAN bus is isolated from other virtual CAN buses, allowing only member devices to negotiate communication and data transmission based on the same group ID and key; The device priority relationship within each virtual CAN bus is uniformly sorted by the preset device ID. When there is no conflict, the effective ID of the device is equal to its preset ID, maintaining communication consistency and arbitration priority. The device priority management and device monitoring lists between different virtual CAN buses do not interfere with each other, avoiding cross-logic interference caused by ID conflicts, thereby realizing dynamic separation and independent operation of virtual CAN buses.

[0043] Specifically, cross-logical interference refers to logical interference caused by different CAN application layer protocols using the same ID. Using the aforementioned encryption technology and device management, a single physical CAN bus can be partitioned into any number of virtual buses. Device priority management uses pre-set device IDs to maintain the priority order of devices on a single virtual CAN bus. Priority management within device management prevents interference between different virtual buses, achieving a dynamic balance. Only trusted CAN devices with the same pre-set group ID and key are considered part of a single virtual CAN bus.

[0044] Example 2 See also Figure 2 The exemplary trusted CAN communication system based on dual channels and closed-loop encryption and decryption is used to implement the above-mentioned trusted CAN communication method based on dual channels and closed-loop encryption and decryption, including: Channel division module: On the same physical CAN bus, the communication logic is divided into negotiation communication channel and transmission communication channel. The negotiation communication channel transmits broadcast messages based on the group ID, and the transmission communication channel transmits user messages based on the valid device ID. Device management module: Verifies the legitimacy of devices based on broadcast messages received through the negotiated communication channel, dynamically manages the list of trusted devices, and implements access and isolation of communication nodes; Transmission module: The trusted CAN device sends a self-decryptable broadcast message through the negotiated communication channel. The broadcast message contains decryption information used to decrypt the next user message. Based on the decryption information obtained, a one-time password is generated, the user data is encrypted, and the user message is constructed and sent through the transmission communication channel. Verification module: The receiving device decrypts and verifies the user message based on the decryption information. If the verification passes, it is considered a valid message; otherwise, it is discarded. Priority management module: In response to device ID conflicts, trusted CAN devices complete dynamic priority management based on preset priorities and valid ID reselection strategies; Anomaly detection module: During message transmission, it performs message reliability transmission detection. When it detects abnormal transmission of broadcast messages and user messages or the number of decryption failures exceeds the threshold, it triggers the exception and reports it to the application layer system.

[0045] It should be noted that the trusted CAN communication system based on dual-channel and closed-loop encryption and decryption provided in the above embodiment and the trusted CAN communication method based on dual-channel and closed-loop encryption and decryption provided in the above embodiment are of the same concept, wherein the specific manner in which each module and unit performs operations has been described in detail in the method embodiment and will not be repeated here. In actual applications, the trusted CAN communication system based on dual-channel and closed-loop encryption and decryption provided in the above embodiment can, as needed, allocate the above functions to different functional modules, that is, divide the internal structure of the system into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0046] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0047] It should be understood that the term "and / or" as used herein simply describes a relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A alone, A and B together, or B alone. A and B can be singular or plural. Furthermore, the character " / " as used herein generally indicates an "or" relationship between the associated objects, but it may also indicate an "and / or" relationship. For specific understanding, please refer to the context.

[0048] In this application, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural.

[0049] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0050] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0051] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0052] In the several embodiments provided in this application, it should be understood that the disclosed system can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0053] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0054] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0055] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0056] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A trusted CAN communication method based on dual channels and closed-loop encryption and decryption, characterized in that: include: On the same physical CAN bus, the communication logic is divided into negotiation communication channel and transmission communication channel. The negotiation communication channel transmits broadcast messages based on the group identification ID, and the transmission communication channel transmits user messages based on the valid device ID. Verify the legitimacy of devices based on broadcast messages received through the negotiated communication channel, dynamically manage the trusted device list, and implement access and isolation of communication nodes; Trusted CAN devices send self-decryptable broadcast messages through the negotiated communication channel. The broadcast messages contain decryption information used to decrypt the next user message. Based on the decryption information obtained, a one-time pad is generated, the user data is encrypted, and the user message is constructed and sent through the transmission communication channel. The receiving device decrypts and verifies the user message based on the decryption information. If the verification passes, it is considered a valid message, otherwise it is discarded. In response to device ID conflicts, trusted CAN devices perform dynamic priority management based on preset priorities and valid ID reselection strategies; During message transmission, message reliability transmission detection is performed. When abnormalities in broadcast message and user message transmission are detected or the number of decryption failures exceeds the threshold, the exception is triggered and reported to the application layer system.

2. A trusted CAN communication method based on dual-channel and closed-loop encryption and decryption according to claim 1, characterized in that: The negotiation logical communication channel uses the preset group ID as the CAN message ID to transmit negotiation information; the transmission logical communication channel uses the valid device ID as the CAN message ID to transmit application layer data information; Broadcast messages and user messages are logical layer messages. Broadcast messages are transmitted on the negotiation logical communication channel; user messages are transmitted on the transmission logical communication channel.

3. A trusted CAN communication method based on dual-channel and closed-loop encryption and decryption according to claim 2, characterized in that: User messages include message metadata, decrypted value type, decrypted value, sequence number, message length, padding length, data, data padding, and data checksum; The broadcast message includes the decryption information of this message, serial number, device ID, function, message length, padding length, user message decryption related information, value, data padding and data verification; the decryption information of this message includes the decryption value type and decryption value.

4. The trusted CAN communication method based on dual-channel and closed-loop encryption and decryption according to claim 1 is characterized in that: Both broadcast messages and user messages are in encrypted format. The message structure carries the decryption information of the next user message. The decryption information includes the decryption value type and the decryption value. The decryption value type includes the random value type and the offset value type: When the random value type is used, the receiver uses the random value as a seed and combines it with the preset symmetric key to input the scrambling code generation algorithm to generate the current one-time pad; When the offset value type is used, the receiver generates the current one-time pad by offsetting the position of the pad used in the previous decrypted user message based on the offset value. The encryption process is as follows: the original data except the data check field is input into the scrambling algorithm, and the original data is XOR-scrambled with the one-time pad to obtain the ciphertext data; The decryption process is as follows: the receiver constructs a one-time pad based on the decryption method indicated by the decryption information in the current message, performs an XOR scrambling operation with the ciphertext data to restore the original data, and then performs data verification on the restored result to verify its legitimacy. If the verification fails, the message is discarded.

5. The trusted CAN communication method based on dual-channel and closed-loop encryption and decryption according to claim 1 is characterized in that: After startup, the trusted CAN device continuously monitors the negotiation communication channel in whitelist listening mode by default, and only receives the communication channel messages transmitted by the authenticated device ID; Device authentication is based on broadcast messages. If a trusted CAN device successfully receives a legitimate broadcast message on the negotiated communication channel and passes decryption and verification, it extracts the valid device ID and adds it to the local monitoring whitelist. The authenticated device enters the lifecycle management process, and the device information record includes: current decryption information, the sequence value of the latest broadcast message, the unique serial identifier of the device, and the latest activity timestamp; If the same device ID and unique serial identifier are received subsequently but the broadcast serial number is non-increasing, it is considered an illegal message or networking anomaly and authentication fails. If the unique serial identifier is different, the device status is updated and it is considered as a device priority adjustment. Before the priority adjustment, a broadcast message confirmation is sent first, and the device priority is adjusted after the confirmation message is received to prevent CAN message replay attacks. The latest activity timestamp is automatically refreshed each time a legitimate message is successfully received from a device. If a device is inactive within the set time, it is considered offline, its information will be removed from the whitelist, and monitoring will be terminated. If the number of illegal messages received from a device exceeds the threshold within the set time, the device's valid device ID will be removed from the whitelist, and a notification will be broadcast to notify it to re-authenticate or adjust its priority. Illegal messages include messages of decryption failure or verification failure.

6. The trusted CAN communication method based on dual-channel and closed-loop encryption and decryption according to claim 1, characterized in that: Dynamic priority management includes: Each trusted CAN device is set with a preset device ID and an effective device ID. In the absence of conflict, the effective device ID is the same as the preset device ID. When a device ID conflict is detected, or a priority management notification is received in a broadcast message from another device, the priority of the current valid device ID is reduced by one level, that is, the current valid device ID plus one is used as the new valid device ID; After setting a new valid device ID, the relevant devices are informed through broadcast messages, triggering the priority adjustment and re-authentication of the corresponding devices; If a trusted CAN device receives a broadcast message from another device with the same valid ID and the other device has a different unique sequence value, the device that joins the network later will have a higher priority, and the existing device will need to reselect a valid device ID. If the valid ID currently used by any trusted CAN device is not equal to the preset ID, and the device is not in conflict with the preset ID on the same virtual bus, the device will periodically monitor the channel corresponding to its preset ID. If it is confirmed to be idle, it will switch back to the preset ID and broadcast to notify other devices to update the mapping information. If it is a conflict between devices on the same virtual bus, when the corresponding device goes offline, it will switch back to the preset ID and broadcast to notify other devices to update the mapping information.

7. The trusted CAN communication method based on dual-channel and closed-loop encryption and decryption according to claim 1, characterized in that: The method includes an anomaly detection mechanism based on the decryption state of the communication channel, specifically including: The trusted CAN device implements an interval monitoring strategy on the negotiation communication channel. If the number of consecutive broadcast messages of decryption failure or data verification failure received within a preset time window exceeds the threshold, it is determined to be a network anomaly or an illegal device attack. The abnormal event is triggered and reported to the upper-layer application system, and the trusted CAN device is started to implement the interval monitoring strategy on the negotiation communication channel until the channel returns to normal and adopts the continuous monitoring strategy. Trusted CAN devices continuously monitor the status of the transmission communication channel. If the number of decryption failures of user messages received within a preset time window exceeds a preset threshold, it is determined that there is a data conflict or illegal message injection behavior, triggering the device priority management process; If the number of device priority management operations triggered within a continuous time period exceeds the total number of trusted devices in the current virtual CAN bus, the network is determined to be under continuous attack and a high-priority security alarm signal is sent to the upper-level application system.

8. The trusted CAN communication method based on dual-channel and closed-loop encryption and decryption according to claim 1 is characterized in that: The method includes a user message reliable transmission detection mechanism for detecting whether the message is completely received and processed in a timely manner on the virtual CAN bus, including: Passive detection mechanism: When a trusted CAN device receives a user message from a specific trusted CAN device, if the message sequence number does not increase continuously, it determines that there is a risk of message loss. The device then sends a broadcast message through the negotiated communication channel after a random delay within the specified time to alert the sender. If the device receives the same exception report from another device during the delay period, it automatically cancels the current exception alert broadcast to reduce broadcast conflicts. Active detection mechanism: When the application layer specifies that certain user messages require confirmation, the trusted CAN device adds their message IDs to the reliable transmission list and requires all receivers to return confirmation information via broadcast within a specified time. If the number of confirmation responses is less than the number of current virtual CAN bus members recorded in the device management, the message is considered lost. When any mechanism detects a message transmission anomaly, the detection device will trigger a report to the upper-layer application system, which will choose retransmission, alarm, or fault-tolerance compensation based on the application scenario strategy.

9. The trusted CAN communication method based on dual-channel and closed-loop encryption and decryption according to claim 1, characterized in that: The method builds multiple virtual CAN buses through encryption mechanism and device management mechanism, including: The physical CAN bus is logically divided into multiple virtual CAN buses, each of which is composed of trusted CAN devices with the same preset group identification ID and symmetric key; The communication channel within the virtual CAN bus is isolated from other virtual CAN buses, allowing only member devices to negotiate communication and data transmission based on the same group ID and key; The device priority relationship within each virtual CAN bus is uniformly sorted by the preset device ID. When there is no conflict, the effective ID of the device is equal to its preset ID, maintaining communication consistency and arbitration priority. The device priority management and device monitoring lists between different virtual CAN buses do not interfere with each other, avoiding cross-logic interference caused by ID conflicts, thereby realizing dynamic separation and independent operation of virtual CAN buses.

10. A trusted CAN communication system based on dual channels and closed-loop encryption and decryption, used to implement a trusted CAN communication method based on dual channels and closed-loop encryption and decryption according to any one of claims 1 to 9, characterized in that: include: Channel division module: On the same physical CAN bus, the communication logic is divided into negotiation communication channel and transmission communication channel. The negotiation communication channel transmits broadcast messages based on the group ID, and the transmission communication channel transmits user messages based on the valid device ID. Device management module: Verifies the legitimacy of devices based on broadcast messages received through the negotiated communication channel, dynamically manages the list of trusted devices, and implements access and isolation of communication nodes; Transmission module: The trusted CAN device sends a self-decryptable broadcast message through the negotiated communication channel. The broadcast message contains decryption information used to decrypt the next user message. Based on the decryption information obtained, a one-time password is generated, the user data is encrypted, and the user message is constructed and sent through the transmission communication channel. Verification module: The receiving device decrypts and verifies the user message based on the decryption information. If the verification passes, it is considered a valid message; otherwise, it is discarded. Priority management module: In response to device ID conflicts, trusted CAN devices complete dynamic priority management based on preset priorities and valid ID reselection strategies; Anomaly detection module: During message transmission, it performs message reliability transmission detection. When it detects abnormal transmission of broadcast messages and user messages or the number of decryption failures exceeds the threshold, it triggers the exception and reports it to the application layer system.

Images