Internet of vehicles security authentication and data encryption transmission system integrated with IPv6 technology

Abstract

The invention discloses an Internet of Vehicles security certification and data encryption transmission system integrated with an IPv6 (Internet Protocol Version 6) technology. According to the invention, the key strategy can be automatically optimized according to the dynamic environment in the actual operation of the Internet of Vehicles, and the dynamic balance between the security protection and the communication efficiency is realized. The system can intelligently judge the cracking risk faced by a current key by combining real-time data such as a vehicle driving state and network environment characteristics, so as to flexibly adjust the key length and the updating frequency: when the network environment is safe and the vehicle is in a low-risk area, the key service cycle is properly prolonged, and the basic key length is maintained to reduce the communication overhead; when a potential threat is detected or a vehicle enters a complex road section, the secret key security level is automatically improved, and the rotation period is shortened to enhance the protection capability. The system burden cannot be increased due to excessive encryption, potential safety hazards cannot be left due to insufficient protection, and key management better meets the actual requirements of high-speed movement of vehicles and rapid change of scenes in the Internet of Vehicles.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of Internet of Vehicles, and particularly relates to an Internet of Vehicles security authentication and data encryption transmission system integrated with IPv6 technology. BACKGROUND

[0002] The Internet of Vehicles security authentication refers to a technical system for verifying the identity legality and access control of entities such as vehicles, roadside devices, cloud platforms and application services in the Internet of Vehicles through cryptographic technology, identity authentication mechanism and trusted communication protocol. The authentication system aims to prevent security threats such as identity forgery, data tampering and replay attacks, and to protect the confidentiality, integrity and availability of the communication link of the Internet of Vehicles. The core process includes identity registration and two-way authentication based on digital certificates, PKI system or lightweight encryption algorithms, and the implementation of trusted interaction between vehicles and infrastructure, vehicles and vehicles (V2V), vehicles and cloud (V2I / V2N) through dynamic token, timestamp and digital signature technology. In addition, the Internet of Vehicles security authentication also involves intrusion detection, abnormal behavior analysis and key dynamic update mechanism to cope with potential attacks in complex network environments. By constructing a multi-level, end-to-end security authentication architecture, the overall attack resistance of the Internet of Vehicles system can be effectively improved, and reliable security protection can be provided for intelligent driving, vehicle-road cooperation, remote diagnosis and other application scenarios.

[0003] However, the existing technology generally adopts a fixed key strategy in the Internet of Vehicles security authentication and data encryption transmission, which cannot dynamically adjust the key length and update period according to the vehicle driving state and network environment, is prone to excessive encryption to increase communication overhead or insufficient encryption to leave security vulnerabilities, and is difficult to guarantee the communication security of critical scenarios such as autonomous driving. SUMMARY

[0004] The purpose of the present application is to solve the above-mentioned problems, and to provide an Internet of Vehicles security authentication and data encryption transmission system integrated with IPv6 technology.

[0005] The technical solution adopted by the present application is as follows: an Internet of Vehicles security authentication and data encryption transmission system integrated with IPv6 technology, comprising: an IPv6 network adaptation and communication optimization layer, a distributed dynamic identity authentication module, a hybrid encryption transmission module, a self-adaptive key management and abnormal detection module, a data privacy protection module and a security audit and integration module. The self-adaptive key management and abnormal detection module is internally provided with a self-adaptive key management module and an abnormal communication detection module. The device access output end of the IPv6 network adaptation and communication optimization layer is connected to the identity verification input end of the distributed dynamic identity authentication module. The authentication result output end of the distributed dynamic identity authentication module is connected to the encryption enabling input end of the hybrid encryption transmission module, The key requirement input terminal of the hybrid encryption transmission module is connected to the key generation output terminal of the adaptive key management and anomaly detection module; The flow monitoring input end of the adaptive key management and anomaly detection module is connected to the flow data output end of the IPv6 network adaptation and communication optimization layer.

[0006] The encrypted data output end of the hybrid encryption transmission module is connected to the privacy processing input end of the data privacy protection module.

[0007] The identity operation log output end of the distributed dynamic identity authentication module, the encryption process log output end of the hybrid encryption transmission module, the key change and abnormal event log output end of the adaptive key management and anomaly detection module, and the privacy processing record output end of the data privacy protection module are all connected to the full log input end of the security audit and compliance module.

[0008] In a preferred embodiment, the IPv6 network adaptation and communication optimization layer includes an IPv6 address intelligent allocation submodule, an IPv6+ protocol optimization submodule, and a network layer security tunnel submodule. The IPv6 address intelligent allocation submodule integrates vehicle hardware fingerprints, roadside device location information, and edge node coverage data. It uses SLAAC combined with DHCPv6 to assign unique IPv6 addresses to access devices. The address allocation strategy dynamically adjusts based on device type (vehicle / roadside device / edge node) and access scenario (highway / urban area / campus), supporting address conflict detection and rapid reallocation for millions of concurrent devices. The IPv6+ protocol optimization submodule integrates real-time network topology, vehicle movement trajectories, and edge node computing resource status. It integrates SRv6 segment routing and flow detection technology, dynamically adjusts routing paths based on vehicle speed and communication latency requirements, implements ultra-low latency forwarding for autonomous driving control command transmission, and uses path aggregation for non-real-time service data to reduce network overhead. The network layer security tunnel submodule integrates device identity certificates, IPSec policy templates, and encryption algorithm parameters, enforces the deployment of the IPSec protocol at the IPv6 network layer, encrypts data packets using the SM4 algorithm and performs SM3 hash authentication through ESP encapsulation, automatically negotiates encryption suites and key update cycles during tunnel establishment, and supports real-time monitoring of tunnel status and a rapid reconnection mechanism in the event of an abnormal disconnection.

[0009] In a preferred embodiment, the distributed dynamic identity authentication module includes a blockchain identity storage submodule, a dynamic pseudonym management submodule, and a national encryption algorithm application submodule. The blockchain identity storage submodule integrates vehicle hardware fingerprints, IPv6 addresses, and manufacturer certificate data to generate a unique blockchain digital identity for each vehicle. The associated information is written to the consortium chain through a smart contract, supporting on-chain query and verification of identity information. Identity changes require multi-node consensus confirmation to ensure non-tamperability. The dynamic pseudonym management submodule integrates timestamp, vehicle location information, and roadside device trust level data to control the vehicle to generate a new temporary IPv6 address periodically. The address generation rule is based on the original address hash and random seed. The pseudonym legality proof is submitted to the roadside device through group signature technology. The pseudonym validity period is dynamically adjusted according to the current regional security level (shortened to 5 minutes in high-security areas and extended to 15 minutes in normal areas). The national encryption algorithm application submodule integrates the root certificate of the key management center, the device public key list, and the algorithm parameter configuration data. It uses the SM2 asymmetric encryption algorithm to realize identity signing and verification. The key generation process combines the random number generator of the device hardware security module to support key hierarchical management (device-level key / application-level key) and regular rotation. The anti-quantum computing attack capability is certified by the National Cryptographic Administration.

[0010] In a preferred embodiment, the hybrid encryption transmission module includes a real-time data encryption submodule, a non-real-time data encryption submodule, and a data integrity verification submodule. The real-time data encryption submodule integrates CAN bus instruction types, data transmission delay requirements, and security level label data. It uses the SM4 symmetric encryption algorithm for vehicle control instructions (such as brake signals and steering instructions). The encryption mode uses ECB to reduce computational overhead. The key is pre-distributed to the vehicle terminal and roadside device through a dedicated secure channel, and hardware acceleration (integrated national encryption algorithm chip) is supported for the encryption process. The non-real-time data encryption submodule integrates data service types (navigation maps / OTA upgrade packages), transmission priorities, and data size information. It uses a hybrid encryption scheme, first encrypting the temporary SM4 key using the SM2 asymmetric encryption algorithm, and then encrypting the data body using the SM4 algorithm. It establishes an end-to-end secure transmission channel based on the TLS1.3 protocol, supports breakpoint resume, and performs encrypted data fragment verification. The data integrity verification submodule integrates data packet metadata (timestamp, sender identity), transmission path records, and verification algorithm configuration data. It adds an SM3 hash value to all transmitted data. The hash calculation range covers data content and metadata. The receiver verifies the integrity by comparing the locally calculated hash value with the attached hash value. If the verification fails, the data retransmission mechanism is triggered, and abnormal logs are recorded.

[0011] In a preferred embodiment, the adaptive key management module predicts the key cracking risk through an LSTM neural network and dynamically adjusts the SM4 key parameters, learns the timing characteristics in the vehicle networking environment, and outputs the key cracking risk probability in real time to provide a basis for key parameter adjustment; The LSTM model structure is as follows: a 3-layer bidirectional LSTM network, the input layer dimension is 8 (the above 8 features), the hidden layer node number is 64, 32, and 16 respectively, the overfitting is inhibited through Dropout (the rate is 0.2), and the output layer is output through the Sigmoid activation function. The key cracking risk probability RR (R∈[0,1], 0 is no risk, and 1 is extremely high risk) is output. The model is trained through historical attack samples (such as key brute force cracking attempts and abnormal tampering records), minimizes the cross-entropy loss function, and realizes accurate prediction of the risk trend.

[0012] In a preferred embodiment, the adaptive key management module adjusts the SM4 key length (128 / 256 bits) and rotation period (5-30 minutes) according to the risk probability RR output by the LSTM, balances security and computing overhead, and specifically includes: Low-risk scenario (R<0.3): The vehicle is in a safe network environment (such as a closed park), the key length is maintained at 128 bits, the rotation period is set to 30 minutes (the maximum period), the key update frequency is reduced to reduce the communication overhead; Medium-risk scenario (0.3≤R≤0.7): There are potential threats in the network (such as occasional abnormal traffic), the key parameters change dynamically with RR, the length transitions to 256 bits, and the period is gradually shortened; High-risk scenario (R>0.7): Explicit attack intention (such as continuous DDoS attempt) is detected, 256-bit key is forced to be enabled, rotation period is compressed to 5 minutes (minimum period), and high-frequency key update is used to resist cracking.

[0013] The adaptive adjustment formula of the SM4 key length is as follows: L=128+128·σ(R−θ); In the formula: L is the SM4 symmetric key length (unit: bit), and the value range is 128-256; R is the key cracking risk probability output by the LSTM (R∈[0,1]); θ is the risk threshold (the empirical value is 0.5), which is used to trigger the key length switching; σ(x) is the Sigmoid activation function, and the expression is R−θ is mapped to (0, 1) to realize the smooth transition of the key length.

[0014] In a preferred embodiment, the abnormal communication detection module fuses the local feature extraction capability of CNN and the long sequence dependence modeling advantage of Transformer to construct an end-to-end IPv6 traffic anomaly detection framework; Using a CNN+Transformer hybrid model, local feature extraction and long sequence dependence analysis are deeply fused to realize real-time identification of DDoS attacks and replay attacks in IPv6 traffic. Specifically, the model collects traffic data in a 5-second sliding time window, constructs a three-dimensional input matrix from the IPv6 packet size (normalized to the range of 0-1), transmission frequency (converted to thousands of packets per second), and TTL value (normalized to the range of 0-1), and inputs the standardized data into the CNN layer. The CNN layer uses a 3x3 convolution kernel (64 channels) to extract local spatiotemporal anomaly features, such as the "short-term surge in packet size and high consistency" pulse pattern in DDoS attacks, or the "jump in TTL value due to fake routing path" in replay attacks. Then, the 2x2 max pooling is used to compress the dimension, and the feature map containing local anomaly signals is output. Subsequently, the feature map is flattened into a sequence vector and input into the Transformer encoder. The self-attention mechanism of the Transformer captures global dependence by calculating the correlation weight of features at different time points, such as the "high-frequency sending (frequency > 500 packets per second within 5 seconds) and packet size variance < 0.1" cooperative anomaly in DDoS attacks, or the "high repetition of current features and historical window (within the last 30 minutes) features" in replay attacks. After focusing on key associations through 8 attention heads, the Transformer outputs an attack probability vector through a fully connected layer. When the DDoS attack probability > 0.85, it is determined to be malicious traffic such as fake V2X emergency braking messages. When the replay attack probability > 0.9, combined with the historical feature similarity and TTL decay anomaly (normal transmission TTL decay gradient is -1~-3, and replay attack may cause jump above -5), it identifies the repeated sending of historical instruction attacks; where the replay attack feature similarity calculation formula is: ; In the formula: S represents the feature similarity score between the current window and the historical window (value range 0-1, the closer to 1, the higher the replay possibility); Vt represents the Transformer output feature vector of the current time window (dimension 128); Vt−k represents the historical feature vector of the previous kk windows (k\in[1,30]k∈[1,30], unit 5 seconds / window); α represents the feature content similarity weight (value 0.7, highlighting the consistency of packet content); β represents a time decay coefficient (value 0.1, to make the recent history window similarity weight higher); cos(·) represents the cosine similarity function, which calculates the vector space angle cosine value to measure content consistency.

[0015] The formula effectively distinguishes between replay attacks (highly repeated recent history features) and normal periodic messages (such as location broadcasts once per second, with time decay similarity decreasing) by combining feature content similarity and time decay factor. When S>0.92, it is determined to be a replay attack.

[0016] In a preferred embodiment, the data privacy protection module includes a federated learning and homomorphic encryption submodule, a trajectory anonymization processing submodule. The federated learning and homomorphic encryption submodule integrates the local training model parameters of the vehicle enterprise, sensor data features, and privacy computing task requirements, uses a federated learning framework to realize multi-participant collaborative training, and calculates the gradient locally through Paillier homomorphic encryption of the original data. The encrypted gradient is uploaded to the cloud aggregation server, and the gradient privacy is protected during the aggregation process using secure multi-party computing technology, supporting real-time monitoring of model training progress and filtering of abnormal gradients. The trajectory anonymization processing submodule integrates real-time location coordinates of vehicles, road network topology, and adjacent vehicle density data, and performs k-anonymization processing (mixed with the location information of k adjacent vehicles) on the original location data. The anonymization parameter k is dynamically adjusted according to the regional population density (k=20 in urban areas, k=10 in suburban areas), and the processed data is uploaded to the traffic management platform through SM4 symmetric encryption, supporting post-audit and compliance verification of anonymization effect.

[0017] In a preferred embodiment, the data privacy protection module further includes a privacy computing task scheduling submodule, which integrates the computing resource status, data privacy level, and task deadline requirements of each participant, dynamically allocates federated learning tasks and homomorphic encryption computing tasks, prioritizes high-privacy-level data (biological features / driving behavior) to local edge nodes for processing, and allocates low-privacy-level data (road condition statistical information) to cloud batch computing. The task scheduling strategy is optimized through reinforcement learning algorithm to minimize privacy leakage risk and computing delay.

[0018] In a preferred embodiment, the blockchain audit log submodule, dynamic compliance check submodule, and security event response submodule are included. The blockchain audit log submodule integrates identity authentication records, key operation logs, and abnormal event alarm data, writes all system operation records in chronological order into a blockchain, and the log content includes operation subject, operation type, timestamp, and associated data hash. The audit log supports automatic audit rule configuration based on smart contracts (such as triggering an alarm for key rotation beyond the expiration date), is tamper-proof, and supports authorized queries by third-party institutions. The dynamic compliance check submodule integrates GDPR / ISO27001 compliance standard clauses, data outbound security assessment methods, and industry regulatory requirements, and internally includes a compliance rule engine to convert standard clauses into executable check items (such as whether desensitization is completed before data cross-border transmission). The submodule scans data transmission processes and storage states in real time, outputs compliance scores and rectification recommendations, and supports automatic generation and regular submission of compliance reports. The security event response submodule integrates abnormal detection alarms, attack type classification, and emergency plan library data, receives security events (such as DDoS attacks / replay attacks) pushed by the AI anomaly detection module, automatically matches emergency plans according to the severity level of the event (light alarm triggers suspicious traffic isolation, and severe alarm starts regional network switching), records the entire response process to the blockchain audit log, and supports post-tracing analysis and response effect evaluation.

[0019] In summary, due to the adoption of the above technical solutions, the present application has the following advantages: 1. In the present application, the key strategy can be automatically optimized according to the dynamic environment in the actual operation of the Internet of Vehicles, achieving a dynamic balance between security protection and communication efficiency. The system will combine real-time data such as vehicle driving state and network environment characteristics to intelligently judge the cracking risk faced by the current key, and then flexibly adjust the key length and update frequency. In a safe network environment and when the vehicle is in a low-risk area, the key usage period is appropriately extended, and the basic key length is maintained to reduce communication overhead. When potential threats are detected or the vehicle enters a complex section, the key security level is automatically improved, and the rotation period is shortened to enhance protection capabilities. This dynamic adjustment mechanism avoids the drawbacks of traditional fixed key strategies, which do not increase system burden due to excessive encryption, nor leave security risks due to inadequate protection. The key management is more suitable for the actual needs of high-speed movement of vehicles and rapid changes in scenarios in the Internet of Vehicles.

[0020] 2、In the application, by fusing local feature capture and global correlation analysis ability, accurate recognition and real-time response to complex attack behavior are realized. With the help of a deep learning model, the system can sensitively capture subtle signals such as high-frequency abnormal features of DDoS attacks and historical instruction repetition patterns of replay attacks from IPv6 traffic data, and at the same time, combined with the correlation analysis of different time point features, distinguish the periodic data in normal communication from the disguised behavior of malicious attacks. This detection mechanism not only can timely discover known attack types, but also can gradually improve the recognition ability of unknown threats by learning new attack features, effectively reducing the risk of communication interruption or instruction tampering caused by attacks, providing reliable security protection for automatic driving control instruction transmission, V2X emergency message broadcast and other key scenes, and keeping the vehicle networking communication stable and reliable in complex network environment. BRIEF DESCRIPTION OF DRAWINGS

[0021] Fig. 1 is the overall system block diagram of the application; Fig. 2 is the system block diagram of the adaptive key management and anomaly detection module in the application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical scheme and advantages of the application more clear and understandable, the application will be further described in detail below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the application and do not limit the application.

[0023] Embodiment: Referring to Figs. 1-2 A vehicle networking security authentication and data encryption transmission system integrating IPv6 technology, comprising: an IPv6 network adaptation and communication optimization layer, a distributed dynamic identity authentication module, a hybrid encryption transmission module, an adaptive key management and anomaly detection module, a data privacy protection module and a security audit and integration module; The adaptive key management and anomaly detection module is internally provided with: an adaptive key management module and an abnormal communication detection module; The device access output end of the IPv6 network adaptation and communication optimization layer is connected with the identity verification input end of the distributed dynamic identity authentication module; The authentication result output end of the distributed dynamic identity authentication module is connected with the encryption enabling input end of the hybrid encryption transmission module, The key requirement input end of the hybrid encryption transmission module is connected with the key generation output end of the adaptive key management and anomaly detection module; The traffic monitoring input end of the adaptive key management and anomaly detection module is connected with the traffic data output end of the IPv6 network adaptation and communication optimization layer.

[0024] The encrypted data output end of the hybrid encryption transmission module is connected with the privacy processing input end of the data privacy protection module.

[0025] The identity operation log output end of the distributed dynamic identity authentication module, the encryption process log output end of the hybrid encryption transmission module, the key change and abnormal event log output end of the adaptive key management and abnormal detection module, and the privacy processing record output end of the data privacy protection module are all connected with the full-amount log input end of the security audit and integration module.

[0026] The IPv6 network adaptation and communication optimization layer includes an IPv6 address intelligent allocation sub-module, an IPv6+ protocol optimization sub-module, and a network layer security tunnel sub-module. The IPv6 address intelligent allocation sub-module integrates vehicle hardware fingerprints, roadside device location information, and edge node coverage range data, allocates unique IPv6 addresses for access devices using SLAAC combined with DHCPv6 protocol, dynamically adjusts address allocation strategies according to device types (vehicles / roadside devices / edge nodes) and access scenarios (high-speed / urban / park), and supports address conflict detection and rapid reallocation in the case of concurrent access of millions of devices. The IPv6+ protocol optimization sub-module integrates real-time network topology, vehicle movement trajectory, and edge node computing resource status, integrates SRv6 segment routing and in-stream detection technology, dynamically adjusts routing paths according to vehicle driving speed and communication latency requirements, enables ultra-low latency forwarding strategies for automatic driving control instruction transmission, and uses path aggregation transmission for non-real-time business data to reduce network overhead. The network layer security tunnel sub-module integrates device identity certificates, IPSec policy templates, and encryption algorithm parameters, forcibly deploys IPSec protocol at the IPv6 network layer, performs SM4 algorithm encryption and SM3 hash authentication on data packets through ESP encapsulation, automatically negotiates encryption suites and key update periods during tunnel establishment, and supports real-time monitoring of tunnel status and rapid reconnection mechanism in the case of abnormal disconnection.

[0027] The distributed dynamic identity authentication module includes a blockchain identity evidence sub-module, a dynamic pseudonym management sub-module, and a national secret algorithm application sub-module. The blockchain identity evidence sub-module integrates vehicle hardware fingerprints, IPv6 addresses, and manufacturer certificate data to generate a unique blockchain digital identity for each vehicle. The associated information is written into the alliance chain through a smart contract, supporting on-chain query and verification of identity information. Identity changes need to be confirmed by multi-node consensus to ensure non-tamperability. The dynamic pseudonym management sub-module integrates timestamp, vehicle location information, and roadside device trust level data to control the vehicle to generate a new temporary IPv6 address periodically. The address generation rule is based on the original address hash and a random number seed. The pseudonym legality proof is submitted to the roadside device through group signature technology. The pseudonym validity period is dynamically adjusted according to the current regional security level (shortened to 5 minutes in high-security areas and extended to 15 minutes in ordinary areas). The national secret algorithm application sub-module integrates the root certificate of the key management center, the device public key list, and the algorithm parameter configuration data. It uses the SM2 asymmetric encryption algorithm to realize identity signing and verification. The key generation process combines the random number generator of the device hardware security module to support hierarchical key management (device-level key / application-level key) and regular rotation. The anti-quantum computing attack capability is certified by the National Cryptographic Administration.

[0028] The hybrid encryption transmission module includes a real-time data encryption sub-module, a non-real-time data encryption sub-module, and a data integrity verification sub-module. The real-time data encryption sub-module integrates CAN bus instruction types, data transmission time delay requirements, and security level label data. It uses the SM4 symmetric encryption algorithm for vehicle control instructions (such as brake signals and steering instructions). The encryption mode uses ECB to reduce computational overhead. The key is pre-distributed to the vehicle terminal and roadside device through a dedicated secure channel, and hardware acceleration (national secret algorithm chip) is supported for the encryption process. The non-real-time data encryption sub-module integrates data service types (navigation map / OTA upgrade package), transmission priority, and data size information. It uses a hybrid encryption scheme, first encrypting the temporary SM4 key using the SM2 asymmetric encryption algorithm, and then encrypting the data body using the SM4 algorithm. It establishes an end-to-end secure transmission channel based on the TLS1.3 protocol, supports breakpoint resume, and verifies encrypted data fragments. The data integrity verification sub-module integrates data packet metadata (timestamp, sender identity), transmission path records, and verification algorithm configuration data. It adds an SM3 hash value to all transmission data. The hash calculation range covers data content and metadata. The receiver verifies the integrity by comparing the locally calculated hash value with the attached hash value. If the verification fails, the data retransmission mechanism is triggered, and abnormal logs are recorded.

[0029] The adaptive key management module predicts key cracking risks and dynamically adjusts SM4 key parameters through an LSTM neural network. It learns the time series characteristics in the Internet of Vehicles environment to output the key cracking risk probability in real time, providing a basis for key parameter adjustment. The LSTM model structure is as follows: a 3-layer bidirectional LSTM network, the input layer dimension is 8 (the above 8 features), the hidden layer node number is 64, 32 and 16 respectively, the overfitting is inhibited through Dropout (the rate is 0.2), and the output layer is output through the Sigmoid activation function. Key cracking risk probability RR (R∈[0, 1], 0 is no risk, and 1 is extremely high risk). The model is trained through historical attack samples (such as key brute force cracking attempts and abnormal traffic tampering records), and the cross-entropy loss function is minimized to realize accurate prediction of risk trend.

[0030] The adaptive key management module adjusts the SM4 key length (128 / 256 bits) and rotation period (5-30 minutes) according to the risk probability RR output by the LSTM, balances security and computational overhead, and specifically includes: Low-risk scenario (R<0.3R<0.3): The vehicle is in a safe network environment (such as a closed park), the key length is maintained at 128 bits, the rotation period is set to 30 minutes (the maximum period), and the key update frequency is reduced to reduce communication overhead; Medium-risk scenario (0.3\leqR\leq0.70.3≤R≤0.7): There are potential threats in the network (such as occasional abnormal traffic), the key parameters change dynamically with RR, the length transitions to 256 bits, and the period is gradually shortened; High-risk scenario (R>0.7R>0.7): Explicit attack intent is detected (such as continuous DDoS attempts), 256-bit keys are forced to be enabled, and the rotation period is compressed to 5 minutes (the minimum period), and high-frequency key update is used to resist cracking.

[0031] The adaptive adjustment formula of SM4 key length is: L=128+128·σ(R−θ); In the formula: L is the SM4 symmetric key length (unit: bit), and the value range is 128-256; R is the key cracking risk probability output by the LSTM (R∈[0, 1]); θ is the risk threshold (the empirical value is 0.5), which is used to trigger the key length switching; σ(x) is the Sigmoid activation function, and the expression is R−θ is mapped to (0, 1) to realize smooth transition of key length.

[0032] The abnormal communication detection module fuses the local feature extraction capability of CNN and the long sequence dependence modeling advantage of Transformer to build an end-to-end IPv6 traffic anomaly detection framework; The CNN+Transformer hybrid model is used to realize real-time identification of DDoS attacks and replay attacks in IPv6 traffic by deeply fusing local feature extraction and long sequence dependency analysis. Specifically, the model collects traffic data in a 5-second sliding time window, constructs a three-dimensional input matrix from the IPv6 packet size (normalized to the range of 0-1), transmission frequency (converted to thousands of packets per second), and TTL value (normalized to the range of 0-1), and inputs the standardized data into the CNN layer. The CNN layer uses a 3×3 convolution kernel (64 channels) to extract local spatiotemporal anomaly features, such as the "short-time packet size surge and high consistency" pulse pattern in DDoS attacks, or the "TTL value jump (e.g., from 20 to 5)" due to fake routing paths in replay attacks. Then, the feature map is compressed in dimension through 2×2 max pooling, outputting a feature map containing local anomaly signals. Subsequently, the feature map is flattened into a sequence vector and input into the Transformer encoder, which captures global dependencies through self-attention mechanisms that calculate the correlation weights of features at different time points. For example, the "high-frequency sending (frequency > 500 packets per second within 5 seconds) and packet size variance < 0.1" cooperative anomaly in DDoS attacks, or the "high repetition of current features and historical window (within the last 30 minutes)" in replay attacks. After focusing on key associations through 8 attention heads, the Transformer outputs an attack probability vector through a fully connected layer. When the DDoS attack probability > 0.85, it is determined to be malicious traffic such as fake V2X emergency braking messages. When the replay attack probability > 0.9, combined with the historical feature similarity and TTL decay anomaly (normal transmission TTL decay gradient is -1~-3, and replay attacks may cause a jump of -5 or more), it identifies the repeated sending of historical instruction attacks. where the replay attack feature similarity calculation formula is: ; where: S represents the feature similarity score between the current window and the historical window (value range 0-1, the closer to 1, the higher the replay possibility); Vt represents the Transformer output feature vector of the current time window (dimension 128); Vt−k represents the historical feature vector of the previous kk windows (k\in[1,30]k∈[1,30], unit 5 seconds / window); α represents the feature content similarity weight (value 0.7, highlighting the consistency of packet content); β represents the time decay coefficient (value 0.1, giving higher weight to the similarity of recent historical windows); cos(·) represents the cosine similarity function, which calculates the cosine value of the vector space angle to measure the content consistency.

[0033] The formula effectively distinguishes between a replay attack (high repetition of recent historical features) and a normal periodic message (such as a location broadcast once per second, with the similarity decreasing over time) by fusing the feature content similarity and the time decay factor. When S>0.92, it is determined to be a replay attack.

[0034] The data privacy protection module includes a federated learning and homomorphic encryption submodule, and a trajectory anonymization processing submodule. The federated learning and homomorphic encryption submodule integrates the local training model parameters of the vehicle enterprise, the sensor data features, and the privacy computing task requirements, realizes collaborative training of multiple participants by using a federated learning framework, calculates the gradient locally by using Paillier homomorphic encryption on the original data, uploads the encrypted gradient to a cloud aggregation server, protects the gradient privacy by using secure multi-party computing technology in the aggregation process, and supports real-time monitoring of the model training progress and filtering of abnormal gradients. The trajectory anonymization processing submodule integrates real-time position coordinates of vehicles, road network topology, and density data of adjacent vehicles, performs k-anonymization processing (mixed with position information of k adjacent vehicles) on the original position data, dynamically adjusts the anonymization parameter k according to the regional population density (k=20 in urban areas and k=10 in suburban areas), and uploads the processed data to a traffic management platform by using SM4 symmetric encryption, thereby supporting post-audit and compliance verification of the anonymization effect.

[0035] The data privacy protection module also includes a privacy computing task scheduling submodule. The privacy computing task scheduling submodule integrates the computing resource states, data privacy levels, and task deadline requirements of each participant, dynamically allocates federated learning tasks and homomorphic encryption computing tasks, preferentially schedules high-privacy-level data (biological features / driving behavior) to local edge nodes for processing, and allocates low-privacy-level data (road condition statistical information) to cloud batch computing. The task scheduling strategy is optimized by using a reinforcement learning algorithm to minimize the privacy leakage risk and the computing time delay.

[0036] The blockchain audit log submodule integrates identity authentication records, key operation logs, and abnormal event alarm data, writes all system operation records in time sequence into a blockchain, and the log content includes operation subject, operation type, timestamp, and associated data hash, supports automatic audit rule configuration based on a smart contract (such as triggering an alarm for key overage and non-replacement), the audit log is not tamperable and supports authorized query by a third-party institution. The dynamic compliance checking submodule integrates GDPR / ISO27001 compliance standard clauses, data outbound security evaluation methods, and industry regulatory requirements, and internally builds a compliance rule engine to convert standard clauses into executable checking items (such as whether desensitization is completed before data cross-border transmission), and real-time scanning of data transmission processes and storage states, outputs compliance scores and rectification suggestions, and supports automatic generation and regular submission of compliance reports. The security event response submodule integrates abnormal detection alarms, attack type classification, and emergency plan library data, receives security events (such as DDoS attacks / replay attacks) pushed by an AI abnormal detection module, automatically matches emergency plans according to the severity level of the event (light alarm triggers suspicious flow isolation, and severe alarm starts regional network switching), records the response process to the blockchain audit log throughout the process, and supports post-tracing analysis and response effect evaluation.

[0037] From the above, it can be seen that: In the present application, the key strategy can be automatically optimized according to the dynamic environment in the actual operation of the Internet of Vehicles, realizing the dynamic balance of security protection and communication efficiency. The system will combine real-time data such as vehicle driving state and network environment characteristics, intelligently judge the cracking risk faced by the current key, and then flexibly adjust the key length and update frequency - when the network environment is safe and the vehicle is in a low-risk area, appropriately extend the key usage period and maintain the basic key length to reduce communication overhead; and when potential threats are detected or the vehicle enters a complex section, automatically improve the key security level and shorten the rotation period to enhance the protection capability. This dynamic adjustment mechanism avoids the drawbacks of the traditional fixed key strategy "one size fits all", neither increases the system burden due to excessive encryption, nor leaves security risks due to insufficient protection, making the key management more suitable for the actual needs of high-speed movement of vehicles and rapid changes of scenes in the Internet of Vehicles.

[0038] In the present application, by fusing local feature capture and global correlation analysis capability, accurate identification and real-time response to complex attack behavior are realized. With the help of a deep learning model, the system can sensitively capture subtle signals such as high-frequency abnormal features of DDoS attacks and historical instruction repetition patterns of replay attacks from IPv6 traffic data, and at the same time, combined with the correlation analysis of features at different time points, it can distinguish between periodic data in normal communication and disguised behavior of malicious attacks. This detection mechanism not only can timely discover known attack types, but also can gradually improve the recognition ability of unknown threats by learning new attack features, effectively reducing the risk of communication interruption or instruction tampering caused by attacks, providing reliable security protection for key scenarios such as automatic driving control instruction transmission and V2X emergency message broadcast, and keeping the vehicle networking communication stable and reliable in complex network environment.

[0039] It should be noted that, in this paper, relational terms such as first and second are used only to distinguish one entity or operation from another, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the term "comprising" or any other variation thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or inherent to such a process, method, article or device. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0040] The above embodiments are only used to illustrate the technical solutions of the present application, but not limit it; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An integrated IPv6 technology-based vehicle networking security authentication and data encryption transmission system, characterized in that: The application relates to an IPv6 network adaptation and communication optimization layer, a distributed dynamic identity authentication module, a hybrid encryption transmission module, a self-adaptive key management and anomaly detection module, a data privacy protection module and a security audit and integration module. The self-adaptive key management and anomaly detection module is internally provided with a self-adaptive key management module and an anomaly communication detection module. The device access output end of the IPv6 network adaptation and communication optimization layer is connected with the identity authentication input end of the distributed dynamic identity authentication module. The authentication result output end of the distributed dynamic identity authentication module is connected with the encryption enabling input end of the hybrid encryption transmission module. The key generation output end of the self-adaptive key management and anomaly detection module is connected with the key demand input end of the hybrid encryption transmission module. The traffic data output end of the IPv6 network adaptation and communication optimization layer is connected with the traffic monitoring input end of the self-adaptive key management and anomaly detection module. The encryption data output end of the hybrid encryption transmission module is connected with the privacy processing input end of the data privacy protection module. The identity operation log output end of the distributed dynamic identity authentication module, the encryption process log output end of the hybrid encryption transmission module, the key change and anomaly event log output end of the self-adaptive key management and anomaly detection module and the privacy processing record output end of the data privacy protection module are all connected with the full-amount log input end of the security audit and integration module. The IPv6 network adaptation and communication optimization layer comprises an IPv6 address intelligent allocation sub-module, an IPv6+ protocol optimization sub-module and a network layer security tunnel sub-module. 2.The integrated IPv6 technology-based V2X security authentication and data encryption transmission system of claim 1, wherein: The IPv6 address intelligent allocation sub-module integrates vehicle hardware fingerprints, roadside device position information and edge node coverage range data, and allocates unique IPv6 addresses for access devices by combining SLAAC with DHCPv6 protocol. The IPv6+ protocol optimization sub-module integrates real-time network topology, vehicle moving track and edge node computing resource state, integrates SRv6 segment routing and in-stream detection technology, dynamically adjusts routing paths according to vehicle driving speed and communication time delay demand, enables ultra-low time delay forwarding strategy for automatic driving control instruction transmission, and adopts path aggregation transmission for non-real-time business data to reduce network overhead. The network layer security tunnel sub-module integrates device identity certificate, IPSec strategy template and encryption algorithm parameters, forcibly deploys IPSec protocol at the IPv6 network layer, performs SM4 algorithm encryption and SM3 hash authentication on data packets through ESP encapsulation, automatically negotiates encryption suite and key update period during tunnel establishment process, and supports real-time monitoring of tunnel state and quick reconnection mechanism in case of abnormal disconnection. The distributed dynamic identity authentication module comprises a blockchain identity storage sub-module, a dynamic pseudonym management sub-module and a national secret algorithm application sub-module. The blockchain identity storage sub-module integrates vehicle hardware fingerprints, IPv6 addresses and manufacturer certificate data, generates a unique blockchain digital identity for each vehicle, associates information through a smart contract written into a consortium chain, supports on-chain query and verification of identity information, and needs to pass multi-node consensus confirmation to ensure non-tamperability during identity change. 3.The integrated IPv6 technology-based V2X security authentication and data encryption transmission system of claim 1, wherein: ​ The dynamic pseudonym management submodule integrates timestamp, vehicle location information, roadside device trust level data, controls the vehicle to generate a new temporary IPv6 address periodically, the address generation rule is based on the original address hash and random number seed, submits the pseudonym legality proof to the roadside device through the group signature technology, and the validity period of the pseudonym is dynamically adjusted according to the current regional security level; The national secret algorithm application submodule integrates the root certificate of the key management center, the device public key list and the algorithm parameter configuration data, realizes identity signature and signature verification by using an SM2 asymmetric encryption algorithm, supports key hierarchical management and periodic rotation in combination with the random number generator of the device hardware security module, and passes the quantum computing attack resistance ability through the compliance certification of the national cryptography administration. 4.The integrated IPv6 technology-based V2X security authentication and data encryption transmission system of claim 1, wherein: The hybrid encryption transmission module includes a real-time data encryption submodule, a non-real-time data encryption submodule and a data integrity verification submodule; the real-time data encryption submodule integrates CAN bus instruction types, data transmission time delay requirements and security level label data, adopts an SM4 symmetric encryption algorithm for vehicle control instructions, selects an ECB encryption mode to reduce the calculation overhead, pre-distributes the key to the vehicle terminal and the roadside device through a special security channel, and supports hardware acceleration of the encryption process; The non-real-time data encryption submodule integrates data service types, transmission priorities and data size information, adopts a hybrid encryption scheme, first encrypts a temporary SM4 key by using an SM2 asymmetric encryption algorithm, then encrypts the data body by using the SM4 algorithm, establishes an end-to-end secure transmission channel in combination with a TLS1.3 protocol, and supports breakpoint resume and encrypted data slice verification; The data integrity verification submodule integrates data packet metadata, transmission path records and verification algorithm configuration data, adds an SM3 hash value to all transmission data, the hash calculation range covers the data content and the metadata, the receiver verifies the integrity by comparing the locally calculated hash value with the added hash value, and triggers a data retransmission mechanism and records an abnormal log when the verification fails. 5.The integrated IPv6 technology-based V2X security authentication and data encryption transmission system of claim 1, wherein: The adaptive key management module predicts the key cracking risk and dynamically adjusts the SM4 key parameters through an LSTM neural network, learns the time sequence characteristics in the Internet of Vehicles environment, and outputs the key cracking risk probability in real time to provide a basis for key parameter adjustment; The LSTM model structure is as follows: a 3-layer bidirectional LSTM network, the input layer dimension is 8, the hidden layer node numbers are 64, 32 and 16 respectively, the overfitting is suppressed through Dropout, and the output layer outputs the key cracking risk probability RR through a Sigmoid activation function; the model is trained through historical attack samples, the cross-entropy loss function is minimized, and the risk trend is accurately predicted. 6.The integrated IPv6 technology-based V2X security authentication and data encryption transmission system of claim 1, wherein: The adaptive key management module adjusts the SM4 key length and rotation period according to the risk probability RR output by the LSTM, balances the security and calculation overhead, and specifically includes the following: In a low-risk scenario, the vehicle is in a safe network environment, the key length is maintained at 128 bits, the rotation period is set to 30 minutes, the key update frequency is reduced to reduce the communication overhead; In a medium-risk scenario, there are potential threats in the network, the key parameters change dynamically with RR, the length is transitioned to 256 bits, and the period is gradually shortened. High-risk scenario: detect explicit attack intention, force enable 256-bit key, rotation period compression to 5 minutes, resist cracking through high-frequency key update; The SM4 key length adaptive adjustment formula is: L = 128 + 128 * sigma (R - theta); In the formula: L is the SM4 symmetric key length, and the value range is 128-256; R is the key cracking risk probability output by the LSTM; Theta is a risk threshold for triggering key length switching; σ(x) is a sigmoid activation function, expressed as R - θ is mapped to (0, 1) to achieve smooth transition of key length. 7.The integrated IPv6 technology-based V2X security authentication and data encryption transmission system of claim 1, wherein: The abnormal communication detection module fuses the local feature extraction capability of CNN and the long sequence dependence modeling advantage of Transformer to build an end-to-end IPv6 traffic anomaly detection framework; Using the CNN+Transformer hybrid model, local feature extraction and long sequence dependence analysis are deeply fused to realize real-time identification of DDoS attacks and replay attacks in IPv6 traffic; Specifically, the model collects traffic data in a 5-second sliding time window, constructs a three-dimensional input matrix of IPv6 packet size, transmission frequency, and TTL value, and inputs the standardized processed data into the CNN layer; The CNN layer uses a 3*3 convolution kernel to extract local spatio-temporal anomaly features, such as the "pulse mode of sudden increase in packet size and high consistency in a short time" in DDoS attacks, or the "jump in TTL value due to fake routing path" in replay attacks, and then compresses the dimension through 2*2 max pooling to output a feature map containing local anomaly signals; Subsequently, the feature map is flattened into a sequence vector and input into the Transformer encoder, which captures global dependence relationships through its self-attention mechanism by calculating the correlation weights of features at different time points - for example, the "coordinated anomaly of high-frequency sending and packet size variance <0.1" in DDoS attacks, or the "high repetition of current features and historical window features" in replay attacks; After focusing on key correlations through 8 attention heads, the Transformer outputs an attack probability vector through a fully connected layer, and when the DDoS attack probability >0.85, it is determined to be malicious traffic such as fake V2X emergency braking messages; When the replay attack probability >0.9, combined with the historical feature similarity and TTL decay anomaly, the repeated historical instruction attack is identified; The replay attack feature similarity calculation formula is: ； In the formula: S represents the feature similarity score of the current window and the historical window; V t Transformer output feature vector representing the current time window; V t−k represents the history feature vector of the previous k windows; Alpha represents the feature content similarity weight; Beta represents the time decay coefficient; Cos(·) represents the cosine similarity function, which calculates the cosine value of the vector space angle to measure content consistency. 8.The integrated IPv6 technology-based V2X security authentication and data encryption transmission system of claim 1, wherein: The data privacy protection module includes a federated learning and homomorphic encryption submodule, and a trajectory anonymization processing submodule; the federated learning and homomorphic encryption submodule integrates vehicle enterprise local training model parameters, sensor data features, and privacy computing task requirements, adopts a federated learning framework to realize collaborative training of multiple participants, and calculates gradients locally through Paillier homomorphic encryption of original data; the encrypted gradients are uploaded to a cloud aggregation server, and in the aggregation process, a secure multi-party computing technology is adopted to protect gradient privacy, real-time monitoring of model training progress and filtering of abnormal gradients are supported; the trajectory anonymization processing submodule integrates real-time position coordinates of vehicles, road network topological structure, and adjacent vehicle density data, performs k-anonymization processing on original position data, dynamically adjusts an anonymization parameter k according to regional population density, and uploads the processed data to a traffic management platform through SM4 symmetric encryption, thereby supporting post-audit and compliance verification of anonymization effects. 9.The integrated IPv6 technology-based V2X security authentication and data encryption transmission system of claim 1, wherein: The data privacy protection module further includes a privacy computing task scheduling submodule, which integrates computing resource states, data privacy levels, and task deadline requirements of each participant, dynamically allocates federated learning tasks and homomorphic encryption computing tasks, preferentially schedules high-privacy-level data to local edge nodes for processing, and allocates low-privacy-level data to cloud batch computing, and optimizes a task scheduling strategy through a reinforcement learning algorithm to minimize privacy leakage risks and computing time delays. 10.The integrated IPv6 technology-based V2X security authentication and data encryption transmission system of claim 1, wherein: The data privacy protection module further includes a blockchain audit log submodule, a dynamic compliance checking submodule, and a security event response submodule.

Images