Bus information security protection method and device, equipment and storage medium

Abstract

The invention discloses a bus information security protection method, device and equipment and a storage medium, and the method comprises the following steps: when received input data is application data, segmenting the application data into data segments with a preset byte number, and inputting the data segments into a security communication component; according to the data segment with the preset byte number in the secure communication component, calculating an attribute value corresponding to the data segment with the preset byte number; and obtaining encrypted data according to the data segment with the preset byte number in the secure communication component and the calculation result of the attribute value, and sending the encrypted data through a bus. According to the method, encryption processing and attribute value verification are adopted, confidentiality and integrity protection of data in the transmission process is ensured, a lightweight information security protection method is designed, a security key distribution mechanism concept is referred to, CAN messages are designed, and data integrity and freshness are achieved.

Description

Technical Field

[0001] The present application relates to the field of secure communications, and in particular to a bus information security protection method, apparatus, device and storage medium. Background Art

[0002] The Controller Area Network (CAN) bus was designed as a high-performance, real-time communication protocol, particularly suitable for automotive network communications in real-time environments. Any node on the CAN bus has equal permissions to transmit and receive data. For example, an engine control unit can continuously send RPM data to the bus, and any node in the network can receive this data, regardless of whether it has been requested. Attackers can craft CAN data frames containing useless data or directly copy data frames from the bus to launch replay attacks on other nodes. An attacker simply needs a CAN bus sniffing tool to connect to a CAN network, obtain data transmitted on the bus, or perform other actions, compromising the authenticity and integrity of the information transmitted on the bus.

[0003] Furthermore, while the secure key distribution mechanism ensures data integrity and freshness, it does not encrypt the data and therefore cannot guarantee data confidentiality. This means that even with the secure key distribution mechanism, attackers may still be able to obtain data transmitted on the bus through other means. Summary of the Invention

[0004] The main purpose of this application is to provide a bus information security protection method, which aims to address the technical problem that CAN bus communication cannot authenticate the identity information of transmitted messages, is vulnerable to attacks, and has information leakage. A lightweight information security protection method has been designed, and the concept of a secure key distribution mechanism has been referred to. The CAN message has been redesigned to achieve data integrity, freshness, and anti-replay attack functions. The security of the CAN message is improved to prevent data from being eavesdropped, tampered with, and forged. At the same time, the resource consumption of the secure key distribution mechanism solution is reduced, making it more suitable for use in a resource-constrained vehicle environment, maintaining the real-time and reliability of the CAN bus, and not affecting the normal operation of the vehicle.

[0005] To achieve the above objectives, the present application provides a bus information security protection method, which includes the following steps:

[0006] When the received input data is application data, dividing the application data into data segments of a preset number of bytes and inputting the data segments into the secure communication component;

[0007] Calculating, based on the data segment of the preset number of bytes in the secure communication component, an attribute value corresponding to the data segment of the preset number of bytes;

[0008] Encrypted data is obtained according to the calculation result of the data segment with the preset number of bytes and the attribute value in the secure communication component, and the encrypted data is sent through the bus.

[0009] In one embodiment, the step of calculating the attribute value corresponding to the data segment of the preset number of bytes in the secure communication component further includes:

[0010] storing the data segments of the preset number of bytes according to the secure communication component;

[0011] Calculating, based on the stored data of the data segment of the preset number of bytes, a freshness value corresponding to the stored data of the data segment of the preset number of bytes;

[0012] According to the storage data of the data segment of the preset number of bytes and the freshness value, the HASH value corresponding to the storage data of the data segment of the preset number of bytes and the freshness value is calculated and updated.

[0013] In one embodiment, the step of calculating and updating the HASH value corresponding to the stored data of the data segment of the preset number of bytes and the freshness value based on the stored data of the data segment of the preset number of bytes and the freshness value further includes:

[0014] Select the corresponding HASH algorithm according to the security level of the input application data;

[0015] Calculating the HASH value corresponding to the stored data of the data segment of the preset number of bytes and the freshness value according to the selected HASH algorithm;

[0016] According to the storage data of the data segment of the current preset number of bytes and the internal state of the freshness value, the corresponding HASH value is updated.

[0017] In one embodiment, the step of obtaining encrypted data based on the data segment having the preset number of bytes and the calculation result of the attribute value in the secure communication component and sending the encrypted data via the bus further includes:

[0018] The data segment of the number of bytes, the freshness value and the HASH value are stored to obtain encrypted data;

[0019] Verifying the encrypted data according to the freshness value and the HASH value;

[0020] According to the verification result, the encrypted data that has been successfully verified is sent through the bus.

[0021] In one embodiment, when the received input data is application data, before the step of dividing the application data into data segments of a preset number of bytes and inputting the data segments into the secure communication component, the step further includes:

[0022] Determine the type of data received via the bus;

[0023] When the data type received through the bus is encrypted data, calling the secure communication component to decrypt the encrypted data;

[0024] According to the result of data decryption, the attribute value corresponding to the data segment of the preset number of bytes is verified;

[0025] According to the verification result of the attribute value corresponding to the data segment with the preset number of bytes, the security protection strategy is executed on the data segment with the preset number of bytes.

[0026] In one embodiment, the step of executing the security protection policy on the data segment of the preset number of bytes based on the verification result of the attribute value corresponding to the data segment of the preset number of bytes further includes:

[0027] Verify the freshness value and the HASH value according to the parsed freshness value and the HASH value;

[0028] When it is determined that the verification result of the HASH value passes, executing a data retention policy on the data segment of the preset number of bytes;

[0029] When it is determined that the verification result of the HASH value fails, a data discarding strategy is executed on the data segment with the preset number of bytes.

[0030] In one embodiment, when it is determined that the verification result of the HASH value fails, the step of executing the policy of discarding data on the data segment of the preset number of bytes further includes:

[0031] When it is determined that the verification result of the HASH value fails, reporting an interrupt signal to the bus and issuing a retransmission request;

[0032] According to the interrupt signal, an error log is recorded in which a verification result of the HASH value fails;

[0033] According to the retransmission request, recalculate and send the data segment of the preset number of bytes specified in the request.

[0034] In addition, to achieve the above-mentioned purpose, the present application also provides a bus information security protection device, which includes: a data segmentation module, an attribute calculation module and an encryption transmission module;

[0035] The data segmentation module is configured to, when the received input data is application data, segment the application data into data segments of a preset number of bytes and input the data segments into the secure communication component;

[0036] The attribute calculation module is used to calculate the attribute value corresponding to the data segment of the preset number of bytes according to the data segment of the preset number of bytes in the secure communication component;

[0037] The encryption transmission module is used to obtain encrypted data based on the data segment with the preset number of bytes and the calculation result of the attribute value in the security communication component, and send the encrypted data through the bus.

[0038] In addition, to achieve the above-mentioned purpose, the present application also provides a bus information security protection device, which includes: a memory, a processor, and a bus information security protection processing program stored on the memory and capable of running on the processor. When the bus information security protection processing program is executed by the processor, the steps of the above-mentioned bus information security protection method are implemented.

[0039] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium. A computer program is stored on the storage medium, and when the computer program is executed by the processor, the steps of the bus information security protection method described above are implemented.

[0040] The above one or more technical solutions provided by this application may have the following advantages or at least achieve the following technical effects:

[0041] The present application discloses a bus information security protection method, apparatus, device, and storage medium, relating to the field of secure communications. The technical method comprises the following steps: dividing input application data into data segments of a preset number of bytes and inputting them into a secure communication component; calculating attribute values corresponding to the data segments of the preset number of bytes in the secure communication component; obtaining encrypted data based on the data segments of the preset number of bytes in the secure communication component and the calculation results of the attribute values, and sending the encrypted data via the bus. The present application redesigns the message data segment and introduces frame validity (FV) value and hash value to achieve secure data transmission and verification. At the same time, the solution should minimize resource consumption to adapt to resource-constrained vehicle environments. The present application aims to design a lightweight information security protection method to address the security issues of CAN bus communications being easily eavesdropped, tampered with, and forged. The method also refers to the concept of a secure key distribution mechanism and redesigns the CAN message to achieve data integrity, freshness, and anti-replay attack functions. The security of CAN messages is improved to prevent data from being eavesdropped, tampered with, and forged. At the same time, it also reduces the resource consumption of the security key distribution mechanism solution, making it more suitable for use in resource-constrained vehicle environments, maintaining the real-time and reliability of the CAN bus without affecting the normal operation of the vehicle. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0043] Figure 1 This is a flow chart of a first embodiment of the bus information security protection method proposed in the present application;

[0044] Figure 2 This is a flow chart of the second embodiment of the bus information security protection method proposed in the embodiment of the present application;

[0045] Figure 3 This is a flow chart of the third embodiment of the bus information security protection method proposed in the embodiment of the present application;

[0046] Figure 4 This is a flowchart of a fourth embodiment of the bus information security protection method proposed in the present application;

[0047] Figure 5 This is a schematic diagram of the module structure of the bus information security protection device according to an embodiment of the present application;

[0048] Figure 6 This is a schematic diagram of the bus information security protection device structure of the hardware operating environment involved in the bus information security protection method in the embodiment of the present application.

[0049] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0050] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0051] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture. If the specific posture changes, the directional indications will also change accordingly.

[0052] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features limited to "first" and "second" may explicitly or implicitly include at least one of such features. In addition, if "and / or" or "and / or" appears in the full text, its meaning includes three parallel schemes. Taking "A and / or B" as an example, it includes scheme A, or scheme B, or a scheme in which A and B are satisfied at the same time. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in this field to implement it. When the combination of technical solutions is mutually contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0053] With the rapid development of automotive electronic technology, the security and reliability of in-vehicle network communications are becoming increasingly important. As the main mode of in-vehicle network communication, the data security of the traditional CAN bus is increasingly receiving attention. The concept aims to improve the security of in-vehicle network communication, but the traditional security key distribution mechanism may have problems such as high resource consumption and complex implementation. Therefore, this solution proposes a lightweight security key distribution mechanism solution, which realizes the secure transmission and verification of data by redesigning the CAN message data segment. In response to these problems, this application proposes a bus information security protection method of the first embodiment, please refer to Figure 1, the method includes steps S10 to S30:

[0054] Step S10: When the received input data is application data, the application data is divided into data segments of a preset number of bytes and input into the secure communication component.

[0055] Step S20: Calculate the attribute value corresponding to the data segment with the preset number of bytes in the secure communication component.

[0056] Step S30: Obtaining encrypted data according to the data segment of the preset number of bytes in the secure communication component and the calculation result of the attribute value, and sending the encrypted data through the bus.

[0057] It should be noted that in this embodiment, the bus information security protection method proposed in this application effectively improves the confidentiality and integrity of CAN bus communications through steps such as data segmentation, attribute value calculation, and data encryption. This method has the advantages of strong flexibility, high security, and ease of implementation, and is applicable to various automotive electronic systems and communication networks. The following is a detailed description of the above steps:

[0058] In step S10, input data refers to information that needs to be transmitted between different devices or systems. The data type of this information can include application data (text, images, audio, video, and other types of data). At the initial stage of data communication, this application data needs to be input into the processing system. This is typically achieved through user operation, device interfaces, or network protocols. During data communication, especially when processing large amounts of data, segmenting the data into smaller data segments (or packets) is a common and effective practice. This practice not only improves data transmission efficiency but also reduces the error rate during data transmission. The preset byte number refers to the number of byte segments into which the data is segmented. This number is typically determined based on factors such as data transmission bandwidth, latency, and error rate. Setting a reasonable byte number ensures efficient and accurate data transmission. If the byte number is too large, data transmission may be slow or erroneous; if the byte number is too small, data transmission complexity and overhead may be increased. The input application data is segmented into multiple data segments based on the preset byte number. This process is typically implemented through an algorithm or program to ensure that the size of each data segment meets the preset requirements. The segmented data segments need to be numbered and stored in a certain order so that they can be correctly identified and reassembled during subsequent processing and transmission.

[0059] It's important to note that a secure communication component refers to the hardware device or software module responsible for data transmission security. It typically includes components such as encryption, decryption, and authentication. Inputting the segmented data segments into the secure communication component ensures data transmission security by utilizing the encryption, decryption, and authentication functions provided by these components. Before inputting data segments, initial configuration of the secure communication component may be required, including setting parameters such as the encryption algorithm, key, and authentication method.

[0060] In step S20, calculating the attribute values of data segments is an important data processing method during data communication. These attribute values can be used for various purposes, such as data verification, error detection, and encryption strength assessment. An attribute value is a quantitative representation of a characteristic or property associated with a data segment. In data communication, common attribute value types include checksums, hash values, and length values. The appropriate attribute value type is selected for calculation based on actual needs and data characteristics. For example, in scenarios where data integrity needs to be ensured, a checksum or hash value can be calculated; in scenarios where encryption strength needs to be assessed, the key length or complexity of the encryption algorithm can be calculated.

[0061] Based on the selected attribute value type, a corresponding algorithm or program is used to calculate the data segment. This process typically involves byte-by-byte processing of the data segment or specific mathematical operations. The calculated attribute value must be uniquely associated with the data segment and stored appropriately for subsequent use. For example, a checksum or hash value can be appended to the end of the data segment as trailer information; alternatively, the attribute value can be stored in a dedicated database or log file. Calculated attribute values have various applications in data communication. Data verification compares the calculated attribute values of the sender and receiver to determine whether errors or tampering have occurred during data transmission. Error detection serves as a basis for error detection, helping the system promptly detect and correct errors in data transmission. By calculating attribute values, the strength and security of encryption algorithms can be assessed, allowing the selection of appropriate encryption methods to ensure data transmission security.

[0062] In the secure communication component, the system encrypts data using an appropriate encryption algorithm based on a data segment with a preset number of bytes and its corresponding attribute values. The selection of an encryption algorithm should take into account factors such as data confidentiality, transmission efficiency, and computational complexity. Common encryption algorithms include the Advanced Encryption Standard (AES) and the Rivest-Shamir-Adleman (RSA) algorithm. The encryption process takes the data segment and attribute values as input and generates encrypted data through the encryption algorithm. Encrypted data typically consists of a ciphertext portion and possible additional information (such as an encryption algorithm identifier and a key identifier). The generated encrypted data is then transmitted to the destination node via the CAN bus. During transmission, the system may employ additional transmission protocols to ensure data reliability and integrity, such as using a cyclic redundancy check (CRC) checksum to detect errors in data transmission.

[0063] In step S30, data encryption during the data communication process is a key means of ensuring data transmission security. Data encryption refers to the process of converting plaintext data into ciphertext using an encryption algorithm and a key. This process is typically performed within a secure communication component. Before encryption, the encryption algorithm and key must be determined. An encryption algorithm is a mathematical function or program used to encrypt and decrypt data; a key is the secret information used to control the operation of the encryption algorithm. A data segment of a preset number of bytes and the calculated result of an attribute value are used as input, and encryption is performed using the selected encryption algorithm and key. The encrypted data is converted into an unreadable ciphertext form, thereby ensuring the security of data transmission.

[0064] A bus is a communication channel that connects multiple devices or components and allows data to be transmitted between them. In data communication systems, buses are typically used to connect components such as processors, memory, and input / output devices. Encrypted data is sent to the target device or system via the bus. This process requires reliable and real-time data transmission to avoid data loss or delays. During the transmission process, specific communication protocols and formats may be required to ensure correct data transmission and parsing. For example, network transmission protocols such as TCP / IP and UDP can be used to ensure reliable data transmission; specific data formats such as JSON and XML can also be used to ensure correct data parsing and processing. This method primarily uses the CAN bus for transmission, which sends messages in a broadcast format. When a node on the CAN bus needs to send a message to another node, it broadcasts the message to all nodes on the bus. Nodes on the bus are not configured by address; instead, they determine whether to accept messages from other nodes based on an identifier (ID) at the beginning of the message. This content-oriented programming approach makes the CAN bus more flexible and scalable. The target device or system needs to receive and decrypt the encrypted data sent via the bus. This process is typically accomplished through a decryption module corresponding to the secure communication component. The receiving device or system must use the same encryption algorithm and key as the sender to decrypt the received data. The decrypted data is restored to its original plaintext form, allowing it to be correctly identified and processed. During the decryption process, the accuracy of the decryption algorithm and the security of the key must be ensured. Errors or leaks in the decryption algorithm or key can lead to decryption failures or data leaks.

[0065] In summary, the three steps described above involve data processing and security encryption technologies in data communications. Their application ensures the security, reliability, and real-time nature of data transmission. Furthermore, these steps provide important reference and guidance for the design and implementation of data communication systems.

[0066] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above embodiment 1 can be referred to the above introduction and will not be described in detail later. Figure 2 In this embodiment, the step of calculating the attribute value corresponding to the data segment of the preset number of bytes in the secure communication component according to the data segment of the preset number of bytes further includes:

[0067] Step S21: According to the secure communication component, the data segment of the preset number of bytes is stored.

[0068] Step S22: Calculate the freshness value corresponding to the stored data of the data segment with the preset number of bytes according to the stored data of the data segment with the preset number of bytes.

[0069] Step S23: Calculate and update the HASH value corresponding to the stored data of the data segment of the preset number of bytes and the freshness value according to the stored data of the data segment of the preset number of bytes and the freshness value.

[0070] Specifically, in this embodiment, each data segment of a preset number of bytes corresponds to one or more attribute values. These attribute values are used to characterize certain characteristics of the data segment, such as data integrity and source credibility. Common attribute values include hash values, checksums, and digital signatures. The calculated attribute values are stored in a specific area of the secure communication component for subsequent data encryption and verification processes. The following is a detailed description of the above steps:

[0071] In step S21, data storage during the data communication process not only ensures data persistence and availability but also provides a foundation for subsequent data processing and analysis. Secure communication components not only encrypt and decrypt data but also typically provide data storage capabilities. These storage capabilities may exist in various forms, such as memory cache, disk storage, and database systems. Data segments, divided according to a preset number of bytes, need to be securely stored for use in subsequent processing and transmission. Storage requirements may include data persistence, accessibility, security, and capacity.

[0072] Select an appropriate storage strategy based on the characteristics of the data and the capabilities of the secure communication components. For example, for data that requires fast access, you can choose memory cache; for data that needs to be persisted, you can choose disk storage or a database system. Implement the storage process of data segments, including operations such as writing, reading, and updating data. When writing data, you need to ensure the integrity and accuracy of the data; when reading data, you need to ensure the accessibility and consistency of the data; when updating data, you need to ensure the synchronization and security of the data. In order to improve storage efficiency and performance, you can optimize storage management. For example, you can use compression algorithms to reduce data storage space; you can use indexes and caches to speed up data access; and you can use technologies such as data deduplication and backup to improve data reliability and security.

[0073] In step S22, data freshness refers to the ability of data to maintain its validity and accuracy within a specific timeframe. Calculating data freshness is crucial for ensuring real-time and reliable data communication. Freshness is a quantitative metric used to measure the validity and accuracy of data within a specific timeframe. It can be calculated based on attributes such as data generation time, update time, and access time. Based on the data storage, an appropriate calculation method is selected to calculate the freshness value. For example, timestamps can be used to calculate the time difference between data generation and update; access frequency can be used to calculate data activity and usage efficiency; and data change rate can be used to assess data stability and reliability.

[0074] Freshness values need to be updated as data is updated to maintain its accuracy and validity. Update strategies may include periodic updates, triggered updates, and automatic updates. Periodic updates update the freshness value at predetermined intervals; triggered updates update the freshness value when specific data changes occur; and automatic updates use algorithms or programs to automatically detect and update the freshness value. Freshness values have various applications in data communication. For example, they can serve as a basis for data selection, filtering, and sorting; as a reference for data caching and prefetching; and as an indicator for evaluating data quality and reliability.

[0075] In step S23, a hash value is a technique used to verify data integrity and consistency. By calculating the hash value of the data, it can be ensured that the data has not been tampered with or damaged during transmission and storage. A hash value is a fixed-length string calculated by inputting the data into a hash function. Hash functions have characteristics such as unidirectionality and collision resistance, resulting in different hash value outputs for different data inputs. Based on the preset number of bytes of stored data and the freshness value of the data segment, an appropriate hash function is selected to calculate the hash value. Common hash functions include MD5, SHA-1, and SHA-256. The calculation process typically involves steps such as data preprocessing, calling the hash function, and generating the hash value. When the stored data or freshness value of a data segment changes, the corresponding hash value needs to be updated to maintain its accuracy. Update strategies may include recalculating the hash value, partially updating the hash value, or updating based on a timestamp. Recalculating the HASH value means recalculating the HASH value of the entire data when any change occurs to the data; partially updating the HASH value means updating the HASH value of only the changed part of the data; and timestamp-based updating means updating the HASH value based on the timestamp of the data.

[0076] HASH values have a variety of applications in the data communication process. For example, it can be used to verify the integrity and consistency of data; it can be used to detect data tampering and corruption; it can be used for data deduplication and indexing, etc. In addition, HASH values can also be used in combination with other security mechanisms (such as digital signatures, encryption, etc.) to improve the security and reliability of data. The calculated HASH value needs to be securely stored and managed for use in subsequent processing and verification processes. Storing and managing HASH values may involve strategies such as data storage location, access rights, backup and recovery. For example, HASH values can be stored in specific fields of a database; appropriate access rights can be set to limit access to HASH values; and HASH values can be backed up and restored regularly to ensure their security and availability.

[0077] In particular, in this embodiment, steps S21, S22, and S23 involve data processing, storage management, and secure encryption technologies used in data communications. By combining these steps, the security, freshness, and integrity of data storage can be ensured. Furthermore, these steps provide important reference and guidance for the design and implementation of data communication systems. In practical applications, appropriate algorithms, protocols, and technologies must be selected to implement these steps based on specific needs and scenarios.

[0078] Furthermore, in this embodiment, the step of calculating and updating the HASH value corresponding to the storage data of the data segment with a preset number of bytes and the freshness value based on the storage data of the data segment with a preset number of bytes and the freshness value may also include: selecting a corresponding HASH algorithm based on the security level of the input application data; calculating the HASH value corresponding to the storage data of the data segment with a preset number of bytes and the freshness value based on the selected HASH algorithm; and updating the corresponding HASH value based on the internal state of the storage data of the data segment with a preset number of bytes and the freshness value.

[0079] Specifically, in this embodiment, ensuring the integrity, consistency, and security of data during data communication and processing is crucial. To achieve this goal, it is common practice to use a HASH algorithm to process data. The HASH algorithm can verify the integrity and consistency of data and detect data tampering and corruption by converting data into a string of fixed length (i.e., a HASH value). The following is a detailed description of the above steps:

[0080] During application data processing, different data may have different security levels. To ensure data security, it's necessary to select an appropriate HASH algorithm based on the data's security level. Security levels are typically defined based on the data's sensitivity, importance, and potential security threats. Common security levels include low, medium, high, and very high. Low-level data may not require high security requirements, while high-level data requires more complex and secure HASH algorithms. Different HASH algorithms can be selected based on the data's security level. For example, the MD5 algorithm can be used for low-level data. Although MD5 has been proven to have collision issues, it still has some value for low-sensitivity data. The SHA-1 algorithm can be used for medium-level data. SHA-1 was once a widely used HASH algorithm. Although it is no longer recommended for security-sensitive applications, it still provides some security for moderately sensitive data. For high-level data, SHA-256 or SHA-3 algorithms can be used. These algorithms offer higher security and collision resistance and are suitable for highly sensitive data. For extremely sensitive data, a more complex and secure HASH algorithm, such as SHA-512, or combined with other encryption technologies may be necessary. When selecting a hash algorithm, in addition to considering the data security level, you also need to consider factors such as the algorithm's computational efficiency, resource consumption, and compatibility with other systems. Ensure that the selected algorithm meets security requirements while also offering good performance and scalability.

[0081] After selecting an appropriate hash algorithm, the next step is to calculate the stored data and freshness values of data segments with a preset number of bytes to generate the corresponding hash value. The stored data in a data segment refers to data segments divided into a preset number of bytes and stored in a specific location. This data may include various types of information, such as text, images, and audio. The freshness value measures the validity and accuracy of the data within a specific timeframe. It can be calculated based on attributes such as the data's generation time, update time, or access time. When calculating the hash value, the freshness value must be considered as part of the data. Using the selected hash algorithm, a hash calculation is performed on the stored data segments and freshness values. The stored data segments and freshness values are preprocessed as necessary, such as format conversion and encoding. The selected hash function is called and the preprocessed data is input into the function. The hash function generates a fixed-length string, the hash value, based on the input data. When calculating the hash value, efficiency and accuracy must be ensured. Using an efficient hash algorithm and optimized calculation strategy can improve computation speed and reduce resource consumption. At the same time, it is necessary to ensure that the generated HASH value is sufficiently unique and collision-resistant to verify the integrity and consistency of the data.

[0082] As data is constantly updated and changes, the corresponding HASH value needs to be regularly updated to maintain its accuracy and validity. The internal state of the stored data and freshness value of a data segment with a preset number of bytes may change, such as due to data updates, deletions, or the addition of new data. These changes may alter the structure and content of the data, affecting the accuracy of the HASH value. To maintain the accuracy and validity of the HASH value, an appropriate update strategy is required. A common update strategy updates the HASH value at regular intervals. This ensures that the HASH value promptly reflects the latest data status when the data changes. When specific data changes occur (such as the addition of new data, deletion of data, or data updates), a HASH value update is triggered. This ensures that the HASH value is immediately updated to reflect the latest data status when the data changes. When implementing HASH value updates, the following points should be noted: Before updating the HASH value, ensure data consistency and integrity. Avoid updating the HASH value when the data is inconsistent. When updating the HASH value, ensure that the HASH algorithm used is consistent with the algorithm used to calculate the previous HASH value. Avoid using different algorithms to cause HASH value inconsistencies. When updating HASH values, performance optimization needs to be considered. Using efficient calculation strategies and algorithms can reduce calculation time and resource consumption, and improve the overall performance of the system.

[0083] In particular, in this embodiment, with the continuous development of technology, the HASH algorithm has a wide range of application value in data communication and processing, but its security also faces some new challenges.

[0084] Collision problem: For some hash algorithms, different input data may generate the same hash value, which is called a collision problem. Collisions can lead to data verification failure and loss of data integrity. Therefore, when selecting a hash algorithm, it is important to choose one with a low collision probability.

[0085] Tamper resistance: If the data is altered, its hash value will also change. This allows for detection of data tampering. However, some attackers may attempt to bypass data verification mechanisms by carefully crafting input data to generate specific hash values. Therefore, more complex and secure hash algorithms are needed to improve tamper resistance.

[0086] Computational efficiency: While efficient hashing algorithms can increase computational speed and reduce resource consumption, overly simple algorithms can be easily cracked by attackers. Therefore, a balance needs to be struck between computational efficiency and security.

[0087] Based on the first embodiment and / or the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the first and second embodiments above can be referred to the above introduction and will not be described in detail later. Figure 3 In this embodiment, step S30, the step of obtaining encrypted data based on the data segment of the preset number of bytes and the calculation result of the attribute value in the secure communication component and sending the encrypted data via the bus, further includes:

[0088] Step S31: storing the data segment of the byte quantity, the freshness value and the HASH value to obtain encrypted data.

[0089] Step S32: verifying the encrypted data according to the freshness value and the HASH value.

[0090] Step S33: According to the verification result, the encrypted data that has been successfully verified is sent through the bus.

[0091] It should be noted that, in this embodiment, in order to ensure the confidentiality, integrity and authenticity of the data, it is usually necessary to encrypt the transmitted data. The following is a detailed description of the above steps:

[0092] In step S31, the data segment, freshness value (which may be a timestamp or serial number used to indicate the timeliness of the data) and HASH value (a fixed-length string generated by an encryption algorithm used to verify the integrity of the data) are stored. Storage methods may include memory storage, disk storage, or cloud storage. Using the selected encryption algorithm and key, the segmented data and attribute values are encrypted to generate encrypted data. In actual applications, it is necessary to select a suitable storage method based on the performance and security requirements of the system. The storage location is usually inside the secure communication component or on a storage device associated with it. This ensures the security and integrity of the encrypted data during transmission.

[0093] In step S32, the purpose of the verification is to ensure that the encrypted data has not been tampered with or damaged during storage and transmission. By comparing the freshness value in the encrypted data with the current time or serial number of the system, it is determined whether the data is expired or tampered with. If the freshness value does not meet the requirements, the data is considered invalid. The HASH value of the stored encrypted data is recalculated using the same encryption algorithm and compared with the stored HASH value. If the two HASH values are the same, the data is considered complete and has not been tampered with; if they are different, the data is considered to have been tampered with. Based on the results of the freshness verification and the HASH value verification, it is determined whether the encrypted data is valid. If both verifications pass, the encrypted data is considered valid; if any one of the verifications fails, the encrypted data is considered invalid.

[0094] In step S33, the encrypted data is sent via the bus only after verification. This ensures that the transmitted data is complete, authentic, and untampered with. Transmission methods may include serial communication, parallel communication, network communication, and so on. In practical applications, the appropriate transmission method needs to be selected based on the system's communication protocol and bus type. During the transmission process, the encrypted data may need to be further encapsulated and formatted to meet the requirements of the communication protocol. Furthermore, data transmission speed and reliability must be ensured to avoid data loss or transmission errors.

[0095] Furthermore, before verifying data transmission, the bus's operating status must be checked. Only when the bus indicates a fault-free state is the encrypted data transmitted over the bus based on the verification results. Status registers in the bus controller or interface chip can be used to obtain bus electrical status information, such as voltage, current, and signal levels, to determine if the electrical status is normal. Abnormal voltage may indicate a bus short circuit, disconnection, or interference, making data transmission inappropriate. Alternatively, a bus protocol-based detection command can be used to detect a bus fault. The timing of receiving the detection command between the receiving and transmitting ends can be used to determine if the bus is faulty. If no heartbeat frame is received within a set time, a bus fault may exist, and data should not be transmitted.

[0096] In practical applications, the appropriate encryption algorithm can be selected based on the sensitivity of the data and the security of the transmission environment. For data requiring high security and integrity, an asymmetric encryption algorithm can be selected; for data requiring efficient transmission, a symmetric encryption algorithm can be selected. Key generation must follow specific algorithms and rules to ensure complexity and randomness. Common key generation algorithms include the AES algorithm for symmetric encryption and the RSA algorithm for asymmetric encryption. Keys should be stored on secure physical storage media or encrypted cloud storage services. Stored keys should also be regularly backed up and updated to prevent accidental loss or disclosure. Key distribution must ensure security and reliability. Secure communication protocols and encryption technologies can be used to transmit keys to prevent theft or tampering during transmission. Keys should be promptly destroyed when no longer needed to prevent leakage and misuse.

[0097] Based on the first embodiment and / or the second embodiment and / or the third embodiment of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the first, second and third embodiments above can be referred to above and will not be described in detail later. Figure 4 In this embodiment, before step S10, the following steps are also included:

[0098] Step S40: Determine the type of data received via the bus.

[0099] Step S50: When the data type received through the bus is encrypted data, the secure communication component is called to decrypt the encrypted data.

[0100] Step S60: According to the result of data decryption, the attribute value corresponding to the data segment of the preset number of bytes is verified.

[0101] Step S70: executing a security protection strategy for the data segment with the preset number of bytes according to the verification result of the attribute value corresponding to the data segment with the preset number of bytes.

[0102] Specifically, in this embodiment, when data is transmitted via the bus, encryption techniques are typically used to ensure confidentiality and integrity. Once the receiving end receives the encrypted data via the bus, it is necessary to invoke the secure communication component to decrypt the data to restore its original form for subsequent processing. The following is a detailed description of the above steps:

[0103] In step S50, the transmitting end of the data communication system encrypts the original data using an encryption algorithm and key to generate encrypted data. This encrypted data is then transmitted to the receiving end via a bus. Upon receiving this encrypted data, the receiving end must first verify the data's integrity and source authenticity to ensure it has not been tampered with or damaged during transmission. To decrypt the received encrypted data, the receiving end invokes a secure communication component. This component typically includes the necessary decryption algorithms and key management functionality. Before invoking the secure communication component, the receiving end must verify its identity and permissions to ensure it is qualified to decrypt the data. The receiving end obtains a decryption key that matches the encryption algorithm used by the transmitting end from a key management system or secure storage. The receiving end inputs the decryption key and the received encrypted data into the decryption algorithm, which performs a series of complex mathematical operations to recover the original data. During or after decryption, the receiving end may also need to verify the data to ensure that the decrypted data is consistent with the original data. Key generation, storage, distribution, and updates require strict security management to prevent key leakage or misuse. To improve decryption efficiency, hardware acceleration and parallel processing can be used to optimize the decryption process.

[0104] In step S60, the data segments with a preset number of bytes refer to data blocks with a fixed length or a specific length range, divided according to the communication protocol or data format requirements. These data blocks are treated as a whole during transmission to ensure data integrity and consistency. Attribute values are defined and verified. These attribute values are recorded and checked during data generation, transmission, and decryption. This ensures that the length of the data segment matches the expected length to prevent data truncation or tampering. The data is checked to ensure that it conforms to expected format requirements, such as data type and encoding method. A checksum is generated by performing a specific mathematical operation (such as a sum) on each byte in the data segment and verified at the receiving end. A mismatch in the checksum indicates that the data may have been tampered with. A hash algorithm is used to hash the data segment to generate a unique hash value. The receiving end can use the same hash algorithm to hash the decrypted data segment and compare the result with the hash value provided by the sending end. A mismatch indicates that the data may have been tampered with. The verification process typically involves extracting attribute values, comparing them, and determining the verification result. First, the attribute values to be verified are extracted from the decrypted data segment. The extracted attribute values are compared with expected values. These expected values may be set when the data is generated or provided by the sender during transmission. The comparison result is used to determine whether the data segment passes the checksum. If the attribute values match, the data segment is accurate and complete; if they do not match, the data may have been tampered with or corrupted.

[0105] In step S70, the data verification process generates a verification result. This result is typically a Boolean value (true or false) indicating whether the data segment has passed verification. If the data segment passes verification, it is accurate and complete; if it fails verification, it may have been tampered with or corrupted. Based on the data verification result, the following security protection strategies can be formulated: data discard, data retransmission, and data repair strategies. If the data segment fails verification and cannot be repaired or retransmitted, it can be discarded. This prevents the erroneous or corrupted data from being further processed or used. If the data segment fails verification but its accuracy can be restored through retransmission, the sender can be requested to resend the data segment. This ensures that the receiving end ultimately receives accurate and complete data. In some cases, the corrupted data segment can be repaired using specific algorithms or techniques. If the repair is successful, the data segment can continue to be processed; if the repair fails, additional measures (such as discarding or retransmitting) are required. When data errors or corruption are detected, the system can trigger an alarm mechanism to notify relevant personnel for action. This helps to promptly identify and resolve potential security issues.

[0106] Security protection policy execution involves selecting an appropriate security protection policy based on data verification results and system security requirements. The selected security protection policy is then applied to the data segment. This may involve actions such as discarding, retransmitting, repairing, or issuing an alert. After implementing the security protection policy, its effectiveness needs to be monitored and evaluated. This ensures policy effectiveness and allows for the timely identification and resolution of potential issues. Security protection policies should be flexible enough to adapt to diverse security requirements and scenarios. When multiple security protection policies are available, priority should be determined based on system security requirements and resource availability.

[0107] Furthermore, in this embodiment, in step S70, the step of executing a security protection policy on the data segment of the preset number of bytes based on the verification result of the attribute value corresponding to the data segment of the preset number of bytes further includes: verifying the freshness value and the HASH value based on the parsed freshness value and the HASH value. If it is determined that the verification result of the HASH value passes, executing a policy of retaining data on the data segment of the preset number of bytes. If it is determined that the verification result of the HASH value fails, executing a policy of discarding data on the data segment of the preset number of bytes.

[0108] Specifically, in this embodiment, step S70 is a key step in the entire data processing process. It executes the corresponding security protection strategy on the data segment based on the verification result of the attribute value corresponding to the data segment with a preset number of bytes. The following is a detailed description of the above steps:

[0109] During data transmission and processing, freshness and hash values are two important verification metrics. Freshness measures the timeliness of data, ensuring it has not become obsolete or tampered with during transmission. Hash values, a data integrity verification method, perform specific mathematical operations on the data to generate a unique, fixed-length string (i.e., a hash value) for data integrity verification at the receiving end. The receiving end first parses the freshness value from the data segment and compares it with the current time or a preset time threshold. If the freshness value is within an acceptable range (i.e., the data is not out of date), the hash value is verified. If the freshness value is outside the acceptable range, additional processing may be required, such as requesting a retransmission or discarding the data. The receiving end parses the hash value from the data segment and applies the same hash algorithm to the data segment's contents to generate a local hash value. The local hash value is then compared with the parsed hash value. If the two match, the data segment has not been tampered with during transmission; if they do not match, the data may have been tampered with or corrupted. The sender and receiver must use the same hash algorithm to ensure hash value comparability. During freshness verification, the sender and receiver must maintain synchronized time to ensure freshness value accuracy. In some cases, hash value verification can be performed first, followed by freshness verification, to save computing resources. However, the specific order should be determined based on actual needs and scenarios.

[0110] When a data segment passes the freshness and hash value verification, it is deemed valid and complete. The receiving end should implement a data retention policy for subsequent processing and use. Data segments that pass verification should be stored in designated storage media (such as memory or disk) for further processing and use. The data segment's status should be marked as "verified" in its metadata or management information for quick identification during subsequent processing. Log information related to data verification and storage should be recorded for auditing and troubleshooting. Appropriate security measures (such as encryption and access control) should be implemented on the storage media to prevent unauthorized access or tampering. Regular backup and recovery testing should be performed for important data to ensure data reliability and availability. Log information should be regularly cleaned and archived to prevent log expansion and excessive storage space usage. When a data segment fails the freshness or hash value verification, it may be outdated, tampered with, or corrupted. In this case, the receiving end should implement a data discard policy to prevent further use or dissemination of erroneous or corrupted data. Delete the data segments that fail verification from the memory (if they have been stored in a persistent storage medium such as a disk, corresponding deletion operations are also required).

[0111] Mark the data segment's status as "verification failed" in the data segment's management information so that it can be quickly identified and reprocessed during subsequent processing. Generate an error report and notify relevant personnel to handle it. The error report should include the data segment's identification information, the reason for the verification failure, and possible solutions. Before deleting data, it is necessary to ensure that no other processes or threads are using the data to prevent data deletion from causing system crashes or data inconsistencies. The error report must accurately reflect the reason for the data verification failure and possible solutions so that relevant personnel can quickly locate the problem and take appropriate measures. For discarded data segments, relevant log information must also be recorded for subsequent auditing and troubleshooting. Furthermore, in this embodiment, the step of executing the data discarding strategy for the preset number of bytes of data segments when it is determined that the verification result of the HASH value fails also includes: reporting an interrupt signal to the bus and issuing a retransmission request when it is determined that the verification result of the HASH value fails; recording an error log indicating that the verification result of the HASH value fails based on the interrupt signal; and recalculating and sending the preset number of bytes of data segments specified in the request based on the retransmission request.

[0112] Specifically, in this embodiment, due to various reasons (such as network failure, device failure, data tampering, etc.), the data segment may be damaged or tampered, resulting in a HASH value verification failure. To ensure the integrity and accuracy of the data, when the HASH value verification result fails, it is necessary to implement a data discarding strategy and take corresponding subsequent processing measures. The following is a detailed description of the above steps:

[0113] At the data receiver, the integrity of the received data segment is determined by calculating a hash value and comparing it with the hash value sent by the transmitter. If the two do not match, the hash value check fails. When the hash value check fails, the data receiver sends an interrupt signal to the system bus. This interrupt signal notifies other system components (such as the data transmitter and error handling module) that the current data segment has failed verification. Interrupt signals can be implemented in various ways, such as using a dedicated interrupt request signal line or through a software query mechanism. Simultaneously with the interrupt signal, the data receiver generates a retransmission request. This request contains identification information (such as the sequence number and data segment size) for the data segment that failed verification, allowing the transmitter to accurately locate and retransmit the data segment. The retransmission request can be sent to the transmitter via a specific communication protocol or interface.

[0114] When the system receives an interrupt signal, the error handling module activates and records the corresponding error log. The error log contains detailed information such as the data segment identifier, the reason for the verification failure (such as a hash value mismatch), and the time the error occurred. Error logs facilitate subsequent problem analysis and troubleshooting. Error logs need to be regularly cleaned and archived to prevent log expansion and excessive storage space usage. Log access rights must also be strictly controlled to prevent unauthorized access and tampering.

[0115] The data segment is recalculated and sent based on the retransmission request. After receiving the retransmission request, the sender re-extracts the corresponding data segment from the original data source based on the data segment identification information specified in the request. The sender then calculates the hash value of the re-extracted data segment to ensure its integrity. After confirming the integrity of the data segment, the sender sends the recalculated data segment to the receiver. During the transmission process, the sender adheres to the corresponding communication protocols and interface specifications to ensure accurate data transmission. After receiving the resent data segment, the receiver performs another hash value check. If the check passes, the data segment is successfully received; if the check still fails, further error handling measures (such as multiple retransmissions and data recovery) may be required.

[0116] The system must ensure that interrupt signals are processed and responded to promptly to avoid data loss or system crashes. Error logs must accurately record the cause of data verification failures and related information for subsequent analysis and processing. Log integrity must also be guaranteed to prevent tampering or deletion. Retransmission requests must include accurate data segment identification information and the reason for verification failure, allowing the sender to accurately locate and retransmit the data segment. Furthermore, the reliability of retransmission requests must be guaranteed to prevent issues such as request loss or incorrect processing. When recalculating and retransmitting data segments, the sender must ensure efficient processing to reduce data transmission delays and improve overall system performance. Data security and privacy must be protected throughout the entire data transmission and processing process. For example, encryption can be used to protect data confidentiality, while authentication and authorization mechanisms can be employed to prevent unauthorized access and manipulation.

[0117] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent processing scope of the present application.

[0118] This application also provides a bus information security protection device, please refer to Figure 5 The bus information security protection device includes: a data segmentation module, an attribute calculation module and an encryption transmission module.

[0119] The data segmentation module 10 is configured to, when the received input data is application data, segment the application data into data segments of a preset number of bytes and input the data segments into the secure communication component.

[0120] The attribute calculation module 20 is used to calculate the attribute value corresponding to the data segment with the preset number of bytes according to the data segment with the preset number of bytes in the security communication component.

[0121] The encryption transmission module 30 is used to obtain encrypted data based on the data segment with the preset number of bytes and the calculation result of the attribute value in the secure communication component, and send the encrypted data through the bus.

[0122] The bus information security protection device provided in this application, which employs the bus information security protection method of the aforementioned embodiment, can resolve the technical problem of CAN bus communication being unable to authenticate the security information of transmitted messages, making it vulnerable to attacks and information leakage. Compared to the prior art, the beneficial effects of the bus information security protection device provided in this application are the same as those of the bus information security protection method provided in the aforementioned embodiment, and the other technical features of the bus information security protection device are the same as those disclosed in the aforementioned embodiment method, and are not further described here.

[0123] The present application provides a bus information security protection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the bus information security protection method in the above-mentioned embodiment one.

[0124] Reference below Figure 6 , which shows a schematic diagram of the structure of a bus information security protection device suitable for implementing the embodiments of the present application. The bus information security protection device in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The bus information security protection device shown is merely an example and should not impose any limitations on the functions and scope of use of the embodiments of the present application.

[0125] like Figure 6 As shown, the bus information security protection device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. RAM 1004 also stores various programs and data required for the operation of the bus information security protection device. Processing device 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, a touch screen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage device 1003 including, for example, a magnetic tape, hard disk, etc.; and communication device 1009. The communication device 1009 can allow the bus information security protection device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a bus information security protection device with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems can be implemented or provided instead.

[0126] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0127] The bus information security protection device provided in this application, employing the bus information security protection method of the aforementioned embodiment, can resolve the technical problem of CAN bus communication being unable to authenticate the security information of transmitted messages, making it vulnerable to attacks and information leakage. Compared to the prior art, the beneficial effects of the bus information security protection device provided in this application are the same as those of the bus information security protection method provided in the aforementioned embodiment, and the other technical features of the bus information security protection device are the same as those disclosed in the method of the aforementioned embodiment, and are not further described here.

[0128] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0129] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0130] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the bus information security protection method in the above-mentioned embodiment.

[0131] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0132] The computer-readable storage medium may be included in the bus information security protection device; or it may exist independently without being assembled into the bus information security protection device.

[0133] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0134] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0135] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0136] The computer-readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned bus information security protection method. This computer-readable storage medium can address the technical issues of CAN bus communication being unable to authenticate the security information of transmitted messages, making it vulnerable to attacks and information leaks. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the bus information security protection method provided in the aforementioned embodiments, and are not further elaborated here.

[0137] The above description is only part of the embodiments of the present application and does not limit the patent scope of the present application. All equivalent structural transformations made by using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A bus information security protection method, characterized in that: The bus information security protection method comprises the following steps: When the received input data is application data, dividing the application data into data segments of a preset number of bytes and inputting the data segments into the secure communication component; Calculating, based on the data segment of the preset number of bytes in the secure communication component, an attribute value corresponding to the data segment of the preset number of bytes; Encrypted data is obtained according to the calculation result of the data segment with the preset number of bytes and the attribute value in the secure communication component, and the encrypted data is sent through the bus.

2. The bus information security protection method according to claim 1, wherein: The step of calculating the attribute value corresponding to the data segment with the preset number of bytes in the secure communication component according to the data segment with the preset number of bytes further includes: storing the data segments of the preset number of bytes according to the secure communication component; Calculating, based on the stored data of the data segment of the preset number of bytes, a freshness value corresponding to the stored data of the data segment of the preset number of bytes; According to the storage data of the data segment of the preset number of bytes and the freshness value, the HASH value corresponding to the storage data of the data segment of the preset number of bytes and the freshness value is calculated and updated.

3. The bus information security protection method according to claim 2, wherein: The step of calculating and updating the HASH value corresponding to the stored data of the data segment of the preset number of bytes and the freshness value according to the stored data of the data segment of the preset number of bytes and the freshness value further includes: Select the corresponding HASH algorithm according to the security level of the input application data; Calculating the HASH value corresponding to the stored data of the data segment of the preset number of bytes and the freshness value according to the selected HASH algorithm; According to the storage data of the data segment of the current preset number of bytes and the internal state of the freshness value, the corresponding HASH value is updated.

4. The bus information security protection method according to claim 3, wherein: The step of obtaining encrypted data based on the data segment with the preset number of bytes and the calculation result of the attribute value in the secure communication component and sending the encrypted data via the bus further includes: The data segment of the number of bytes, the freshness value and the HASH value are stored to obtain encrypted data; Verifying the encrypted data according to the freshness value and the HASH value; According to the verification result, the encrypted data that has been successfully verified is sent through the bus.

5. The bus information security protection method according to claim 1, wherein: Before the step of dividing the received input data into data segments of a preset number of bytes and inputting the data segments into the secure communication component when the received input data is application data, the step further includes: Determine the type of data received via the bus; When the data type received through the bus is encrypted data, calling the secure communication component to decrypt the encrypted data; According to the result of data decryption, the attribute value corresponding to the data segment of the preset number of bytes is verified; According to the verification result of the attribute value corresponding to the data segment with the preset number of bytes, the security protection strategy is executed on the data segment with the preset number of bytes.

6. The bus information security protection method according to claim 5, characterized in that: The step of executing the security protection policy on the data segment of the preset number of bytes according to the verification result of the attribute value corresponding to the data segment of the preset number of bytes further includes: Verify the freshness value and the HASH value according to the parsed freshness value and the HASH value; When it is determined that the verification result of the HASH value passes, executing a data retention policy on the data segment of the preset number of bytes; When it is determined that the verification result of the HASH value fails, a data discarding strategy is executed on the data segment with the preset number of bytes.

7. The bus information security protection method according to claim 6, characterized in that: The step of executing a data discarding strategy on the data segments of the preset number of bytes when it is determined that the verification result of the HASH value fails further includes: When it is determined that the verification result of the HASH value fails, reporting an interrupt signal to the bus and issuing a retransmission request; According to the interrupt signal, an error log is recorded in which a verification result of the HASH value fails; According to the retransmission request, recalculate and send the data segment of the preset number of bytes specified in the request.

8. A bus information security protection device, characterized in that: The device includes: a data segmentation module, an attribute calculation module and an encryption transmission module; The data segmentation module is configured to, when the received input data is application data, segment the application data into data segments of a preset number of bytes and input the data segments into the secure communication component; The attribute calculation module is used to calculate the attribute value corresponding to the data segment of the preset number of bytes according to the data segment of the preset number of bytes in the secure communication component; The encryption transmission module is used to obtain encrypted data based on the data segment with the preset number of bytes and the calculation result of the attribute value in the security communication component, and send the encrypted data through the bus.

9. A bus information security protection device, characterized in that: The bus information security protection device includes: a memory, a processor, and a bus information security protection processing program stored in the memory and runnable on the processor. When the bus information security protection processing program is executed by the processor, the steps of the bus information security protection method as described in any one of claims 1 to 7 are implemented.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the bus information security protection method according to any one of claims 1 to 7 are implemented.

Images