Data encryption processing methods, systems, electronic devices and computer program products

Abstract

This application relates to the field of network security and provides a data encryption processing method, system, electronic device, and computer program product. The method includes: obtaining a first key from a first node, a count value of transmitted data frames, data to be transmitted, and a controller area network (CLAN) identifier for the data to be transmitted; generating a target mask based on the first key, the count value, and the CLAN identifier, combined with a chaotic mapping; and encrypting the data to be transmitted based on the target mask and a byte position permutation table generated from the target mask to obtain the ciphertext of the data to be transmitted. This scheme can balance data transmission security and real-time performance, achieving efficient and secure data transmission.

Description

Technical Field

[0001] This application belongs to the field of network security, and in particular relates to a data encryption processing method, system, electronic device and computer program product. Background Technology

[0002] In automotive electronics, industrial control, and other fields, the Controller Area Network (CAN) protocol has become a core communication protocol due to its high reliability and low cost. However, the CAN protocol lacks a native encryption mechanism, making the transmitted data vulnerable to interception. Existing data transmission schemes improve the security of data under the CAN protocol by introducing encryption algorithms, such as the Rivest-Shamir-Adleman (RSA) encryption algorithm proposed by Ron Rivest, Adi Shamir, and Leonard Adleman, the Advanced Encryption Standard (AES) encryption algorithm, and the Elliptic Curve Cryptography (ECC) algorithm. Encryption algorithms like RSA require pre-storing a large number of keys and have poor real-time performance. Encryption algorithms like AES use a static key system with a globally pre-set shared key; if the key is leaked, data security cannot be guaranteed. The ECC encryption algorithm has vulnerabilities, is prone to information leakage, and is computationally complex, with poor real-time performance and security. In other words, existing encryption algorithms struggle to balance data security and real-time performance when processing data transmitted under the CAN protocol. Summary of the Invention

[0003] This application provides a data encryption processing method, system, electronic device, and computer program product to solve the problem that encryption algorithms under the CAN protocol in the prior art cannot simultaneously ensure data transmission security and real-time performance.

[0004] The first aspect of this application provides a data encryption processing method, including:

[0005] Obtain the first key of the first node, the count value of the transmitted data frames, the data to be transmitted, and the controller LAN identifier of the data to be transmitted;

[0006] Based on the first key, the count value, and the controller LAN identifier, and combined with chaotic mapping, a target mask is generated;

[0007] The data to be transmitted is encrypted based on the target mask and the byte position permutation table generated by the target mask to obtain the ciphertext of the data to be transmitted.

[0008] A second aspect of this application provides a data encryption processing system, including:

[0009] The acquisition module is used to acquire the first key of the first node, the count value of the transmitted data frames, the data to be transmitted, and the controller local area network identifier of the data to be transmitted;

[0010] The generation module is used to generate a target mask based on the first key, the count value, and the controller local area network identifier, combined with chaotic mapping.

[0011] An encryption module is used to encrypt the data to be transmitted based on the target mask and a byte position substitution table generated by the target mask, so as to obtain the ciphertext of the data to be transmitted.

[0012] A third aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in the first aspect.

[0013] A fourth aspect of this application provides a computer program product comprising a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0014] A fifth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0015] As can be seen from the above, this application, based on the first key of the first node, the real-time updated count of transmitted data frames, and the controller area network identifier of the data to be transmitted, generates a unique target mask according to the current data transmission requirements, combined with chaotic mapping. This avoids the overhead of pre-storing massive keys, eliminates key lookup and loading delays, and quickly completes the mask derivation and data encryption required for encryption, reducing encryption latency and ensuring real-time data transmission. Simultaneously, the target mask is generated based on the changing count value and controller area network identifier, ensuring that the target mask is not reusable, preventing attackers from cracking the encryption logic using historical masks. Furthermore, the data encryption process utilizes a byte position substitution table generated from the target mask to achieve double encryption, effectively improving data transmission security. This application improves encryption efficiency and security through a dynamic generation mechanism, achieving efficient and secure data transmission. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart of a data encryption processing method provided in an embodiment of this application. Figure 1 ;

[0018] Figure 2 This is a flowchart of a data encryption processing method provided in an embodiment of this application. Figure 2 ;

[0019] Figure 3 This is a structural diagram of a data encryption processing system provided in an embodiment of this application;

[0020] Figure 4 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0021] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0022] It should be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0023] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0024] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0025] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [the described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [the described condition or event] is detected," or "in response to detection of [the described condition or event]."

[0026] In specific implementations, the terminals described in the embodiments of this application include, but are not limited to, other portable devices such as mobile phones, laptop computers, or tablet computers with touch-sensitive surfaces (e.g., touchscreen displays and / or touchpads). It should also be understood that in some embodiments, the device is not a portable communication device, but a desktop computer with touch-sensitive surfaces (e.g., touchscreen displays and / or touchpads).

[0027] The following discussion describes terminals that include displays and touch-sensitive surfaces. However, it should be understood that terminals may include one or more other physical user interface devices such as physical keyboards, mice, and / or joysticks.

[0028] The terminal supports a variety of applications, such as one or more of the following: drawing applications, presentation applications, word processing applications, website creation applications, disc burning applications, spreadsheet applications, game applications, telephone applications, video conferencing applications, email applications, instant messaging applications, exercise support applications, photo management applications, digital camera applications, digital camcorder applications, web browsing applications, digital music player applications, and / or digital video player applications.

[0029] Various applications that can run on a terminal can use at least one common physical user interface device, such as a touch-sensitive surface. One or more functions of the touch-sensitive surface and the corresponding information displayed on the terminal can be adjusted and / or changed between and / or within applications. In this way, the terminal's common physical architecture (e.g., the touch-sensitive surface) can support various applications with user interfaces that are intuitive and transparent to the user.

[0030] It should be understood that the sequence number of each step in this embodiment does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of this application embodiment.

[0031] There are various encryption schemes under the existing CAN protocol, each with its own advantages and disadvantages.

[0032] The RSA encryption algorithm implements data encryption under the CAN protocol in hardware. However, its large number exponentiation modulo operation results in high latency, making it difficult to meet high real-time requirements. XTS stands for XEX-based Tweaked Codebook mode with Stealth. The AES / XTS encryption algorithm combines AES and XTS, using stream encryption to improve encryption speed. However, key management is static, and the extended frame padding method relies on dedicated hardware modules, resulting in poor security and insufficient flexibility. Furthermore, these hardware encryption schemes rely on dedicated chips, increasing cost and design complexity, and consuming significant resources.

[0033] Software encryption schemes require significant amounts of memory resources, such as read-only memory (ROM) or random access memory (RAM), which can impact real-time performance.

[0034] Existing encryption schemes also include those using static keys or simple counters to implement a single mechanism. These schemes suffer from poor dynamic adaptability and are vulnerable to replay attacks. Pre-set key slots can improve the problem of poor dynamic adaptability to some extent, but they require storing dynamic keys in secure storage and matching key slots by message ID, necessitating additional storage space. Furthermore, the low key update frequency makes them susceptible to being cracked by attackers. More importantly, existing encryption schemes struggle to balance data transmission security and real-time performance.

[0035] To address the aforementioned issues, this application provides a data encryption processing method, system, electronic device, and computer program product.

[0036] The data encryption processing method provided in this application fully utilizes the characteristics of the CAN protocol, has strong dynamic adaptability and compatibility, can reduce hardware investment costs, improves data transmission security and real-time performance through multi-level encryption mechanisms, achieves an effective balance between security and real-time performance, prevents attackers from intercepting and tampering with data, and prevents the leakage of critical control commands (such as brake signals and steering signals), and ensures that automobiles and other CAN protocol-based devices and systems can operate normally.

[0037] To illustrate the technical solution described in this application, specific embodiments are provided below.

[0038] See Figure 1 , Figure 1 This is a flowchart of a data encryption processing method provided in an embodiment of this application. Figure 1 .like Figure 1 As shown, a data encryption processing method includes the following steps:

[0039] Step 101: Obtain the first key of the first node, the count value of the transmitted data frames, the data to be transmitted, and the controller LAN identifier of the data to be transmitted.

[0040] The first node is a communication node with data transmission and reception capabilities, such as the Electronic Control Unit (ECU) in an in-vehicle network. ECUs in an in-vehicle network achieve multi-node collaborative control via the CAN bus, ensuring the safety and real-time performance of vehicle functions. These ECUs, such as the engine control module and brake controller, are all communication nodes with data transmission and reception capabilities.

[0041] The first node pre-stores at least one key, such as a root key, a master key, and a device key. The root key is the unique starting point of the key derivation tree and can work with encryption algorithms to derive subkeys such as the master key. The master key is an intermediate-layer key, derived from the root key, and can further generate device keys, etc. The device key is a unique identifier for the node and is used for two-way authentication or encrypted communication.

[0042] The first key is the key pre-stored by the first node for encrypting and decrypting its data. The first key can be the root key, the master key, or other keys that can be shared by multiple communication nodes.

[0043] In some embodiments, the first key may be a 128-bit key, such as a 128-bit root key, to improve encryption effectiveness.

[0044] The first node is equipped with a counter to record the number of data frames transmitted. Each time the first node successfully transmits a data frame, the count value recorded by the counter is incremented by one. For example, the initial value of the counter used by ECU A to record the number of data frames transmitted is 0x00000001. After successfully transmitting a data frame, the count value increases from 0x00000001 to 0x00000002.

[0045] In some embodiments, the counter is a 32-bit incrementing counter.

[0046] The data to be transmitted is the raw information content that needs to be transmitted via the CAN bus, which may include control commands, sensor readings and / or status information, etc.

[0047] The Controller Area Network (CAN) identifier is used to identify the data to be transmitted. Different data to be transmitted correspond to different CAN identifiers.

[0048] In some embodiments, standard frames and extended frames are two CAN data frame formats. The CAN ID of a standard frame is 11 bits, and the CAN ID of an extended frame is 29 bits.

[0049] To ensure data transmission security, the data to be transmitted needs to be encrypted. The first key, the counter value, and the controller LAN identifier are important parameters used to implement data encryption to ensure communication security.

[0050] Step 102: Based on the first key, the count value, and the controller LAN identifier, and combined with chaotic mapping, generate a target mask.

[0051] The target mask is a sequence of bytes generated based on the first key, a counter value, and the controller LAN identifier, using an encryption algorithm and incorporating chaotic mapping. The target mask is used to encrypt the data to be transmitted.

[0052] CAN IDs possess inherent randomness, and their count values ​​dynamically change with the number of data frames transmitted. Correspondingly, the target mask generated based on this is bound to the lifecycle of the data to be transmitted in the current frame, achieving one-frame-one-key encryption. That is, each target mask is only used to encrypt the data to be transmitted in the current frame. The target mask used to encrypt the data to be transmitted in the next frame is regenerated based on the Controller Area Network (CAN) identifier and count value of the next frame's data, resulting in strong dynamic adaptability. On the one hand, there is no need to retain the target mask required for encryption, saving resource space and reducing communication latency. On the other hand, attackers cannot reverse engineer the target mask through the storage medium. Even if the target mask of a certain frame is cracked, the obtained target mask cannot be used to decrypt data in other frames. The dynamic change of the target mask can prevent replay attacks and achieve high-quality forward security protection.

[0053] In some embodiments, generating a target mask based on the first key, the count value, and the controller local area network identifier, combined with chaotic mapping, includes: encrypting a concatenated sequence formed by concatenating the controller local area network identifier and the count value using the first key to obtain a second key; encrypting the concatenated sequence using the second key to obtain an initial mask; extracting target parameter values ​​from the second key; performing chaotic mapping iteration and data transformation based on the target parameter values ​​to obtain a chaotic flow; and performing an XOR operation on the initial mask and the chaotic flow to obtain the target mask.

[0054] The second key is a subkey derived from the first key. It is used to generate the initial mask and also serves as a source of parameters for the chaotic system iteration, providing the target parameter values ​​required for the iteration and aiding in the generation of the target mask. The initial mask is a preliminary mask generated by re-encrypting the same concatenated sequence using the second key, and is used to generate the target mask. The target parameter values ​​are the chaotic system initialization parameters extracted from the second key, such as state variables and control parameters, used to drive the chaotic system to perform chaotic mapping iterations.

[0055] There are various types of chaotic mappings, among which the Logistic chaotic mapping is a lightweight chaotic mapping with low computational complexity, small memory footprint, and high randomness. Its simplification characteristics are prominent, namely simplification of dimensions, computation, and implementation, which can improve the iteration speed while ensuring high randomness.

[0056] The controller LAN identifier and the count value are concatenated to obtain a concatenated sequence. Key derivation is performed based on the first key, and chaotic mapping is introduced to achieve multi-level encryption. The introduction of chaotic flow breaks the linearity of the encryption process, resists statistical analysis attacks, increases the key derivation level, isolates the direct association between the first key and the final target mask, and establishes multi-level isolation between the first key and the target mask, increasing the difficulty of cracking. Attackers find it difficult to deduce the first key from the target mask, reducing the risk of first key exposure. Furthermore, the count value and controller LAN identifier are different for each frame, ensuring that the target mask is unique and cannot be reused. The XOR operation superimposes the initial mask with the randomness of the chaotic flow, significantly increasing the mask complexity. XOR operation is efficient and easy to implement in hardware, efficiently generating the target mask required for encryption, improving encryption speed, and ensuring real-time data transmission.

[0057] In some embodiments, the step of performing chaotic mapping iteration and data transformation based on the target parameter value to obtain a chaotic flow includes: inputting the target parameter value into a first chaotic system; performing chaotic mapping iteration on the first chaotic system exhibiting transient effects until the transient effects are eliminated to obtain a second chaotic system; performing a set number of chaotic mapping iterations on the second chaotic system to obtain a set number of chaotic sequences output by the second chaotic system; and performing fixed-point arithmetic and binarization processing on the set number of chaotic sequences to obtain the chaotic flow.

[0058] A chaotic system is a nonlinear dynamic system. The first chaotic system and the second chaotic system are the same chaotic system in different state stages. The state stage corresponding to the first chaotic system is the stage where transient effects exist, while the state stage corresponding to the second chaotic system is the steady-state stage where transient effects have disappeared. A chaotic sequence is a sequence of state values ​​generated by iterative chaotic mapping, such as a numerical sequence. A chaotic stream is a byte sequence, i.e., a byte stream, after the chaotic sequence has been transformed, such as 0xA5, 0x3F, etc.

[0059] A highly complex chaotic flow is generated through iterative chaotic mapping to confuse the initial mask and then generate the target mask.

[0060] In some embodiments, the chaotic map is a Logistic chaotic map, and correspondingly, the chaotic system is a Logistic chaotic system. The first chaotic system is a Logistic chaotic system in the transient effect stage, and the second chaotic system is a Logistic chaotic system in the steady-state stage after the transient effect has been eliminated.

[0061] The transition state sequence output by the first chaotic system in the transient effect stage may exhibit a periodic or skewed distribution, making it easily predictable. The target parameter value is used as the initialization parameter for the chaotic system and input into the first chaotic system. Then, chaotic mapping iterations are performed until the transient effect in the first chaotic system is eliminated, resulting in a second chaotic system without transient effects. The second chaotic system can output a chaotic sequence, improving the randomness and anti-predictability of the output content.

[0062] In some embodiments, the data field of the CAN data frame is 8 bytes, and the corresponding number is set to 8. Based on the second chaotic system, a set number of chaotic mapping iterations are performed, and the second chaotic system outputs 8 chaotic sequences accordingly, so as to form an 8-byte chaotic stream, which is then XORed to generate an 8-byte target mask, thereby achieving encryption.

[0063] The chaotic sequence output by the second chaotic system is a floating-point sequence. This is converted to an integer sequence through fixed-point arithmetic to improve computational efficiency. The integer sequence is then binarized to facilitate XOR operations. A predetermined number of binarized integer sequences are combined into a single sequence to obtain the chaotic flow.

[0064] In some embodiments, fixed-point arithmetic involves multiplying each floating-point value in the floating-point value sequence by 256 and rounding down to the nearest integer, generating an 8-bit unsigned integer sequence. This integer sequence is the result of the fixed-point arithmetic operation.

[0065] In some embodiments, the following is a partial code example of generating the target mask based on the first key, the count value, and the controller area network identifier:

[0066] temp_key = derive_temp_key(RootKey, CAN_ID||Counter); / / Generate the second key;

[0067] Mask = derive_Mask(temp_key, CAN_ID||Counter); / / Generate the initial mask;

[0068] uint32_t x=( temp_key [0]<<8)| temp_key [1]); / / Initialize x;

[0069] uint32_t μ=3.0+(( temp_key [2]*0.003852140077821) / 255); / / Dynamically adjust μ, μ∈[3.0,3.99];

[0070] uint8_t GenerateChaosByte(){

[0071] x = μ*x*(1-x); / / Logistic chaotic mapping iteration;

[0072] return(uint8_t)(x>>8)&0xFF; / / Fixed-point arithmetic and binarization;

[0073] }; / / Generate chaotic sequences;

[0074] DynamicMask = Mask ⊕ ChaosStream; / / Generate the target mask.

[0075] Here, RootKey refers to the first key, temp_key refers to the second key, CAN_ID refers to the controller LAN identifier, Counter refers to the counter value, Mask refers to the initial mask, GenerateChaosByte() is the function that generates the chaotic sequence, x refers to the state variable, μ refers to the control parameter, ChaosStream refers to the chaotic stream, and DynamicMask refers to the target mask.

[0076] In some embodiments, the control parameter μ is dynamically adjusted to introduce nonlinearity, thereby improving the chaotic system. This solves the technical problems of traditional chaotic systems, such as small parameter range, uneven sequence distribution, and insufficient randomness when directly applied to CAN encryption. It enhances the randomness of subsequent chaotic sequence generation, increases the complexity and unpredictability of the chaotic sequence, and thus improves encryption security.

[0077] In some embodiments, the control parameter μ can be adjusted based on a first key, a second key, or other factors.

[0078] In some embodiments, the value of the iterative function corresponding to the control parameter μ is pre-calculated and stored in a table. During actual operation, table lookup is used instead of real-time function calculation, reducing computation time.

[0079] In some embodiments, encryption steps, such as encrypting the concatenated sequence using a first key and encrypting the concatenated sequence using a second key, are implemented using a lightweight encryption algorithm. A lightweight encryption algorithm, such as the Extended Tiny Encryption Algorithm (XTEA), has a computation speed that meets the microsecond-level response requirements, a small code size, and occupies less RAM space. It is also compatible with 8-bit and 16-bit microcontroller units (MCUs), has strong hardware compatibility, does not require a dedicated encryption chip, and reduces deployment costs.

[0080] Step 103: Encrypt the data to be transmitted based on the target mask and the byte position permutation table generated by the target mask to obtain the ciphertext of the data to be transmitted.

[0081] After obtaining the target mask, a byte position permutation table is generated using the target mask. The target mask and the byte position permutation table are then used to encrypt the data to be transmitted, thereby obtaining the corresponding ciphertext, achieving data encryption and ensuring data security.

[0082] In some embodiments, encrypting the data to be transmitted based on the target mask and a byte position permutation table generated from the target mask to obtain the ciphertext of the data to be transmitted includes: converting the data to be transmitted into a structured data frame; performing an XOR operation on the structured data frame and the target mask to obtain mask data; generating the byte position permutation table based on the target mask; and permuting the positions of each byte value in the mask data using the byte position permutation table to obtain the ciphertext of the data to be transmitted.

[0083] The data to be transmitted is converted into structured data frames, a conversion adapted to the data field requirements of the CAN transmission protocol. An XOR obfuscation operation based on the target mask is performed on the structured data frames, effectively eliminating the statistical characteristics and patterns of the original data. Byte-level spatial obfuscation is achieved by rearranging the byte positions of the masked data through a substitution table. The XOR operation and position substitution form a multi-layered protection for the data to be transmitted.

[0084] The data to be transmitted is combined with the low byte of the count value, and a checksum is calculated. The data to be transmitted, the low byte of the count value, and the checksum form an 8-byte structured data frame, which is convenient for XORing with an 8-byte target mask to achieve data encryption.

[0085] In some embodiments, a code example of a structured data frame is: PlainText=[Counter_Low,Data1,Data2,Data3,Data4,Data5,Data6,Checksum], where Checksum=(Data1^Data2^...^Data6)+Counter_Low. The PlainText array represents the structured data frame, Counter_Low is the low byte of the count value, Checksum is the checksum, and Data1, Data2, Data3, Data4, Data5, and Data6 are the data to be transmitted. Embedding the checksum into the data field avoids adding new fields by reusing data space, eliminating extra length overhead and optimizing transmission efficiency.

[0086] The structured data frame and the target mask are XORed byte by byte to obtain the mask data corresponding to the structured data frame, thus achieving one-time data encryption.

[0087] The target mask can be XORed with the structured data frame, and can also be used to generate a byte position permutation table to perturb the mask data, that is, to permutate the position of each byte value in the mask data, thereby achieving secondary data encryption and obtaining the final ciphertext.

[0088] In some embodiments, an example of performing an XOR operation on the structured data frame and the target mask to obtain the mask data is: MaskedData = PlainText ⊕ DynamicMask. Here, MaskedData is the mask data.

[0089] In some embodiments, the code example for generating the byte position permutation table based on the target mask is: perm_table = generate_perm_table(DynamicMask).

[0090] In some embodiments, generating the byte position permutation table based on the target mask includes: permuting the original position of each byte value in the target mask to obtain the updated position corresponding to each original position; and establishing a mapping relationship between each original position and its corresponding updated position to obtain the byte position permutation table.

[0091] The target mask is dynamically generated as the data to be transmitted is transmitted. Each frame of data to be transmitted has a unique target mask. The byte position substitution table generated based on this is a dynamic substitution table, rather than a static substitution table that is used for a long time. This solves the problem that substitution tables are easy to crack. At the same time, the byte position substitution table changes with the target mask, so there is no need to occupy memory to store the substitution table for a long time, saving resource space.

[0092] In some embodiments, a byte position substitution table is generated based on the size of the byte values ​​in the target mask. The original position of each byte value in the target mask is recorded. The byte values ​​in the target mask are sorted in ascending or descending order, and the position of each byte value after the ascending or descending order is determined, i.e., the updated position after the ascending or descending order. Based on the byte values, a mapping relationship between the original position and the updated position is established to obtain the byte position substitution table.

[0093] For example, consider the byte values ​​0x30, 0x40, 0x20, and 0x10. The original positions of these four byte values ​​are 1, 2, 3, and 4, respectively. Arranging these four byte values ​​in ascending order yields 0x10, 0x20, 0x30, and 0x40. The positions corresponding to these ascending byte values ​​are 1, 2, 3, and 4. Specifically, the position of 0x10 changes from 4 to 1, the position of 0x20 changes from 3 to 2, the position of 0x30 changes from 1 to 3, and the position of 0x40 changes from 2 to 4. Correspondingly, original position 1 corresponds to updated position 3, original position 2 corresponds to updated position 4, original position 3 corresponds to updated position 2, and original position 4 corresponds to updated position 1. This establishes a mapping relationship between the original and updated positions, generating a byte position substitution table.

[0094] In some embodiments, the original positions of each byte value in the target mask are recorded. The Fisher-Yates Shuffle Algorithm is used to perturb the positions of each byte value in the target mask, and the updated position of each byte value after the Fisher-Yates Shuffle Algorithm perturbation is determined. Based on the byte values, a mapping relationship between the original positions and the updated positions is established to obtain a byte position permutation table.

[0095] In some embodiments, the step of permuting the positions of each byte value in the mask data using the byte position permutation table to obtain the ciphertext of the data to be transmitted includes: determining the target update position of each byte value in the mask data using the byte position permutation table; and permuting the positions of each byte value in the mask data to the target update position according to the target update position to obtain the ciphertext.

[0096] Each byte value in the mask data has its original position. By using a byte position permutation table, the positions of the byte values ​​in the mask data are interchanged. Through position perturbation, data obfuscation is achieved, which is equivalent to re-encryption.

[0097] For example, in the byte position permutation table, original position 1 corresponds to updated position 3, original position 2 corresponds to updated position 4, original position 3 corresponds to updated position 2, and original position 4 corresponds to updated position 1. If the mask data is ABCD, where A, B, C, and D are byte values, based on the byte position permutation table, the mask data ABCD is permuted to obtain the ciphertext DCAB. This section is for illustrative purposes only.

[0098] The byte position permutation table defines the mapping relationship between the original position and the updated position. In the byte position permutation table, the original position i corresponds to the updated position j, where i and j are positive integers, i, j ∈ [1, 8]. The byte value in the mask data at the original position i is moved to the target updated position j, which corresponds to the original position i. After all the byte values ​​in the mask data have been moved to the target updated position, the ciphertext is obtained.

[0099] The data encryption method proposed in this application is a novel encryption algorithm that integrates the characteristics of the CAN protocol and can balance real-time performance and security. It achieves a balance between security and real-time performance through technologies such as CAN ID binding encryption, real-time update of the count value, lightweight encryption algorithm, lightweight chaotic system, dynamic position perturbation based on target mask, and multi-level encryption mechanism.

[0100] In some embodiments, the first node can selectively encrypt data based on the controller LAN identifier whitelist, encrypting only critical data, thereby achieving reasonable resource allocation, improving the real-time performance of data transmission, and effectively balancing security and real-time performance.

[0101] In this embodiment, based on the first key of the first node, the real-time updated count of transmitted data frames, and the controller area network identifier of the data to be transmitted, a unique target mask is generated according to the current data transmission requirements, combined with chaotic mapping. This avoids the overhead of pre-stored massive keys, eliminates key lookup and loading delays, and quickly completes the mask derivation and data encryption required for encryption, reducing encryption latency and ensuring real-time data transmission. Simultaneously, the target mask is generated based on the changing count value and controller area network identifier, ensuring that the target mask is not reusable, preventing attackers from cracking the encryption logic using historical masks. During data encryption, a byte position substitution table generated from the target mask is also used to achieve double encryption, effectively improving data transmission security. This application improves encryption efficiency and security through a dynamic generation mechanism, achieving efficient and secure data transmission.

[0102] See Figure 2 , Figure 2 This is a flowchart of a data encryption processing method provided in an embodiment of this application. Figure 2 .like Figure 2 As shown, a data encryption processing method includes the following steps:

[0103] Step 201: Obtain the first key of the first node, the count value of the transmitted data frames, the data to be transmitted, and the controller LAN identifier of the data to be transmitted.

[0104] The implementation process of this step is the same as that of step 101 in the aforementioned embodiments, and will not be repeated here.

[0105] Step 202: Based on the first key, the count value, and the controller LAN identifier, and combined with chaotic mapping, generate a target mask.

[0106] The implementation process of this step is the same as that of step 102 in the aforementioned embodiments, and will not be repeated here.

[0107] Step 203: Encrypt the data to be transmitted based on the target mask and the byte position permutation table generated by the target mask to obtain the ciphertext of the data to be transmitted.

[0108] The implementation process of this step is the same as that of step 103 in the aforementioned embodiments, and will not be repeated here.

[0109] Step 204: Encapsulate the ciphertext, the count value, and the controller local area network identifier into a controller local area network data frame.

[0110] After obtaining the ciphertext through data encryption, the ciphertext, the count value, and the controller area network identifier are encapsulated into a CAN data frame to facilitate data transmission via the CAN bus.

[0111] Step 205: The controller local area network (CLAN) data frame is transmitted to the second node via the CLAN bus. The second node decrypts the data based on the pre-stored decryption key, the count value contained in the CLAN data frame, and the CLAN identifier.

[0112] The first node transmits the CAN data frame to the target node, i.e., the second node, via the CAN bus according to the transmission requirements, thus fulfilling the transmission requirements.

[0113] Similar to the first node, the second node is also a communication node with data transmission and reception capabilities. It pre-stores at least one key, such as a root key, master key, or device key. Among these, the at least one key pre-stored by the second node includes the key used by the node for encryption and decryption.

[0114] The second node can decrypt the ciphertext in the CAN data frame based on its pre-stored decryption key, as well as the count value and controller area network identifier contained in the CAN data frame.

[0115] The decryption process of the second node can be referred to steps 101-103 above. The decryption process of the second node can be briefly summarized as follows: The concatenated sequence of the Controller Area Network (CAN) identifier and count value in the CAN data frame is encrypted using the decryption key to obtain the third key; the concatenated sequence of the CAN data frame is encrypted using the third key to obtain the initial decryption mask; the decryption target parameter value is extracted from the third key and used as the initial input parameter for decrypting the first chaotic system. Chaotic mapping iteration is performed until the transient effect is eliminated to obtain the second chaotic system. The second chaotic system is then used to perform a set number of chaotic mapping iterations to obtain the decrypted chaotic sequence. Through fixed-point arithmetic, binarization, and data combination, the decrypted chaotic stream is obtained; the initial decryption mask and the decrypted chaotic stream are XORed to obtain the decryption target mask; a decryption byte position permutation table is generated based on the decryption target mask; the byte order of the ciphertext in the CAN data frame is restored using the decryption byte position permutation table, i.e., reverse permutation is performed to achieve the first decryption; the dynamic XOR mask is removed using the decryption target mask to achieve the second decryption, obtaining the decrypted data.

[0116] After obtaining the decrypted data, a decryption checksum is calculated based on the data and the low byte of the count value in the decrypted data, and compared with the checksum of the check bits in the decrypted data. If the decryption checksum matches the checksum of the check bits in the decrypted data, the data decryption is successful, and the second node has successfully obtained the decrypted data. If the decryption checksum does not match the checksum of the check bits in the decrypted data, the data decryption fails, and the second node discards the frame of data.

[0117] In some embodiments, if the decryption key of the second node is the first key, the decryption checksum calculated based on the data and the low byte of the count value in the decryption data is usually consistent with the checksum of the check bits in the decryption data.

[0118] The data encryption processing method of this application enables data encryption, ensuring the security and real-time performance of data transmission. At the same time, the data encryption processing method of this application can also be used to decrypt data, reducing decryption delay and achieving efficient decryption.

[0119] In some embodiments, when the first node transmits a CAN data frame to the second node via the CAN bus, if the first node has a data transmission requirement, it can generate a target mask for a new frame of data to be transmitted in parallel, thereby encrypting and transmitting the new frame of data to be transmitted.

[0120] In some embodiments, after the first node successfully transmits a CAN data frame to the second node via the CAN bus, the counter value of the first node is incremented by one. The counter value is updated in real time, improving the security of the target mask.

[0121] In this embodiment of the application, after encrypting the ciphertext of the data to be transmitted, a controller local area network (CLAN) data frame containing the ciphertext is encapsulated based on the ciphertext, the count value, and the controller local area network identifier. The CLAN data frame with higher security is then transmitted to the second node to achieve the data transmission purpose and realize secure data transmission.

[0122] See Figure 3 , Figure 3 This is a structural diagram of a data encryption processing system provided in an embodiment of this application. For ease of explanation, only the parts related to the embodiment of this application are shown.

[0123] The data encryption processing system 300 includes: an acquisition module 301, a generation module 302, and an encryption module 303.

[0124] The acquisition module 301 is used to acquire the first key of the first node, the count value of the transmitted data frames, the data to be transmitted, and the controller local area network identifier of the data to be transmitted.

[0125] The generation module 302 is used to generate a target mask based on the first key, the count value, and the controller local area network identifier, combined with chaotic mapping.

[0126] The encryption module 303 is used to encrypt the data to be transmitted based on the target mask and the byte position substitution table generated by the target mask to obtain the ciphertext of the data to be transmitted.

[0127] In some embodiments, the generation module is specifically used for:

[0128] The first key is used to encrypt the concatenated sequence formed by the controller local area network identifier and the count value to obtain the second key;

[0129] The concatenated sequence is encrypted using the second key to obtain an initial mask;

[0130] Extract the target parameter value from the second key;

[0131] Based on the target parameter values, perform chaotic mapping iteration and data transformation to obtain a chaotic flow;

[0132] The target mask is obtained by performing an XOR operation on the initial mask and the chaotic flow.

[0133] In some embodiments, the generation module is further configured to:

[0134] The target parameter value is input into the first chaotic system, and the first chaotic system with transient effects is subjected to chaotic mapping iteration until the transient effects are eliminated, thus obtaining the second chaotic system.

[0135] Perform a set number of chaotic mapping iterations on the second chaotic system to obtain a set number of chaotic sequences output by the second chaotic system;

[0136] The chaotic flow is obtained by performing fixed-point arithmetic and binarization on the predetermined number of chaotic sequences.

[0137] In some embodiments, the encryption module is specifically used for:

[0138] Convert the data to be transmitted into structured data frames;

[0139] Perform an XOR operation on the structured data frame and the target mask to obtain mask data;

[0140] Based on the target mask, generate the byte position substitution table;

[0141] The ciphertext of the data to be transmitted is obtained by permuting the values ​​of each byte in the mask data using the byte position permutation table.

[0142] In some embodiments, the encryption module is further configured to:

[0143] The original position of each byte value in the target mask is permuted to obtain the updated position corresponding to each original position;

[0144] Establish a mapping relationship between each original position and its corresponding updated position to obtain the byte position substitution table.

[0145] In some embodiments, the encryption module is further configured to:

[0146] The target update position of each byte value in the mask data is determined by the byte position substitution table.

[0147] According to the target update position, the positions of each byte value in the mask data are replaced to the target update position to obtain the ciphertext.

[0148] In some embodiments, the system further includes a data transmission module for:

[0149] The ciphertext, the count value, and the controller local area network identifier are encapsulated into a controller local area network data frame;

[0150] The controller local area network (CLAN) data frame is transmitted to the second node via the CLAN bus. The second node decrypts the data based on a pre-stored decryption key, the count value contained in the CLAN data frame, and the CLAN identifier.

[0151] The data encryption processing system provided in this application embodiment can implement all processes of the above-described data encryption processing method embodiments and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0152] Figure 4 This is a structural diagram of an electronic device provided in an embodiment of this application. As shown in the figure, the electronic device 4 of this embodiment includes: at least one processor 40 ( Figure 4 (Only one is shown in the diagram), memory 41, and computer program 42 stored in said memory 41 and executable on said at least one processor 40, which, when executed, implements the steps in any of the above method embodiments.

[0153] The electronic device 4 can be a desktop computer, laptop, handheld computer, or cloud server, etc. The electronic device 4 may include, but is not limited to, a processor 40 and a memory 41. Those skilled in the art will understand that... Figure 4 This is merely an example of electronic device 4 and does not constitute a limitation on electronic device 4. It may include more or fewer components than shown, or combine certain components, or different components. For example, the electronic device may also include input / output devices, network access devices, buses, etc.

[0154] The processor 40 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0155] The memory 41 can be an internal storage unit of the electronic device 4, such as a hard disk or memory. The memory 41 can also be an external storage device of the electronic device 4, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. Furthermore, the memory 41 can include both internal and external storage units of the electronic device 4. The memory 41 is used to store the computer program and other programs and data required by the electronic device. The memory 41 can also be used to temporarily store data that has been output or will be output.

[0156] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0157] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0158] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0159] In the embodiments provided in this application, it should be understood that the disclosed systems / electronic devices and methods can be implemented in other ways. For example, the system / electronic device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of systems or units may be electrical, mechanical, or other forms.

[0160] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0161] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0162] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0163] The processes in the above-described embodiments can be implemented by a computer program product. When the computer program product is run on an electronic device, the electronic device executes the steps in the above-described method embodiments.

[0164] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A data encryption processing method, characterized in that, include: Obtain the first key of the first node, the count value of the transmitted data frames, the data to be transmitted, and the controller LAN identifier of the data to be transmitted; Based on the first key, the count value, and the controller local area network identifier, and combined with chaotic mapping, a target mask is generated. Specifically, this includes: encrypting a concatenated sequence formed by the controller local area network identifier and the count value using the first key to obtain a second key; encrypting the concatenated sequence using the second key to obtain an initial mask; extracting target parameter values ​​from the second key; performing chaotic mapping iteration and data transformation based on the target parameter values ​​to obtain a chaotic flow; and performing an XOR operation on the initial mask and the chaotic flow to obtain the target mask. The step of performing chaotic mapping iteration and data transformation based on the target parameter values ​​to obtain a chaotic flow includes: inputting the target parameter values ​​into a first chaotic system; performing chaotic mapping iteration on the first chaotic system exhibiting transient effects until the transient effects are eliminated to obtain a second chaotic system; performing a set number of chaotic mapping iterations on the second chaotic system to obtain a set number of chaotic sequences output by the second chaotic system; and performing fixed-point arithmetic and binarization processing on the set number of chaotic sequences to obtain the chaotic flow. The data to be transmitted is encrypted based on the target mask and the byte position permutation table generated by the target mask to obtain the ciphertext of the data to be transmitted.

2. The method according to claim 1, characterized in that, The data to be transmitted is encrypted based on the target mask and the byte position permutation table generated by the target mask to obtain the ciphertext of the data to be transmitted, including: Convert the data to be transmitted into structured data frames; Perform an XOR operation on the structured data frame and the target mask to obtain mask data; Based on the target mask, generate the byte position substitution table; The ciphertext of the data to be transmitted is obtained by permuting the values ​​of each byte in the mask data using the byte position permutation table.

3. The method according to claim 2, characterized in that, The step of generating the byte position permutation table based on the target mask includes: The original position of each byte value in the target mask is permuted to obtain the updated position corresponding to each original position; Establish a mapping relationship between each original position and its corresponding updated position to obtain the byte position substitution table.

4. The method according to claim 2, characterized in that, The step of permuting the positions of each byte value in the mask data using the byte position permutation table to obtain the ciphertext of the data to be transmitted includes: The target update position of each byte value in the mask data is determined by the byte position substitution table. According to the target update position, the positions of each byte value in the mask data are replaced to the target update position to obtain the ciphertext.

5. The method according to claim 1, characterized in that, After encrypting the data to be transmitted based on the target mask and the byte position substitution table generated by the target mask to obtain the ciphertext of the data to be transmitted, the method further includes: The ciphertext, the count value, and the controller local area network identifier are encapsulated into a controller local area network data frame; The controller local area network (CLAN) data frame is transmitted to the second node via the CLAN bus. The second node decrypts the data based on a pre-stored decryption key, the count value contained in the CLAN data frame, and the CLAN identifier.

6. A data encryption processing system, characterized in that, include: The acquisition module is used to acquire the first key of the first node, the count value of the transmitted data frames, the data to be transmitted, and the controller local area network identifier of the data to be transmitted; A generation module is used to generate a target mask based on the first key, the count value, and the controller local area network identifier, combined with chaotic mapping. Specifically, this includes: encrypting a concatenated sequence formed by the controller local area network identifier and the count value using the first key to obtain a second key; encrypting the concatenated sequence using the second key to obtain an initial mask; extracting target parameter values ​​from the second key; performing chaotic mapping iteration and data transformation based on the target parameter values ​​to obtain a chaotic flow; and performing an XOR operation on the initial mask and the chaotic flow to obtain the target mask. The step of performing chaotic mapping iteration and data transformation based on the target parameter values ​​to obtain a chaotic flow includes: inputting the target parameter values ​​into a first chaotic system; performing chaotic mapping iteration on the first chaotic system exhibiting transient effects until the transient effects are eliminated to obtain a second chaotic system; performing a set number of chaotic mapping iterations on the second chaotic system to obtain a set number of chaotic sequences output by the second chaotic system; and performing fixed-point arithmetic and binarization processing on the set number of chaotic sequences to obtain the chaotic flow. An encryption module is used to encrypt the data to be transmitted based on the target mask and a byte position substitution table generated by the target mask, so as to obtain the ciphertext of the data to be transmitted.

7. An electronic device, characterized in that, The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device performs the method as described in any one of claims 1 to 5.

8. A computer program product, characterized in that, Includes a computer program, which, when run, causes the method as described in any one of claims 1 to 5 to be performed.

Images