A pure electric vehicle information security anti-replay control method and system

Abstract

The application provides a pure electric vehicle information security anti-replay control method and system, relates to the technical field of new energy vehicle information security, and solves the technical problems that the prior art cannot add a check field to a standardized message and is difficult to cope with variable period attacks. The method comprises the following steps: obtaining repeated messages caused by a replay attack on a CAN bus; when the repeated messages are gear messages, a life signal check and period arbitration method is used to arbitrate the repeated messages; when the repeated messages are brake messages, a deep fuzzy arbitration and time domain period delay check method is used to arbitrate the repeated messages; and hierarchical alarm is performed according to the duration of the replay attack and the arbitration result. The application is used in the process of transmitting key control messages such as gear messages and brake messages on a CAN bus of a pure electric vehicle, realizes accurate defense against replay attacks, and guarantees the information security and driving stability of the vehicle CAN network.

Description

Technical Field

[0001] This invention belongs to the field of information security technology for new energy vehicles, specifically a method and system for preventing replay attacks in pure electric vehicles. Background Technology

[0002] With the widespread adoption of intelligent connected vehicles, in-vehicle CAN networks face increasingly severe information security threats, among which replay attacks are a common hacker tactic. Attackers intercept and repeatedly send critical vehicle control messages, causing the vehicle control unit to misinterpret commands and potentially leading to loss of vehicle control. Existing anti-replay technologies have significant limitations: restricted by standard protocols such as J1939, dynamic verification fields cannot be added to braking messages, making traditional timestamp or sequence number verification methods ineffective; hackers can also bypass traditional periodic arbitration mechanisms by deliberately altering the replay message cycle, allowing illegal messages to arrive simultaneously with normal messages; furthermore, mainstream solutions, such as the SecOC (Secure Onboard Communication) algorithm, rely on security chips and consume additional communication resources, resulting in high hardware costs and difficulty in adapting to low-cost vehicle models. Summary of the Invention

[0003] This application provides a method and system for preventing replay attacks on pure electric vehicles, which solves the technical problems of existing technologies being unable to add verification fields to standardized messages and being unable to cope with variable period attacks.

[0004] To achieve the above objectives, this application adopts the following technical solution:

[0005] Firstly, a method for preventing replay attacks in the information security of pure electric vehicles is provided, including:

[0006] Retrieve duplicate messages on the CAN bus caused by a replay attack;

[0007] When the repeated message is a gear shift message, the repeated message is arbitrated using a life signal verification and periodic arbitration method; the life signal verification and periodic arbitration method refers to a method of arbitrating messages by combining periodic verification and dynamic password verification;

[0008] When the duplicate message is a braking message, a deep fuzzy arbitration and time-domain periodic delay verification method is used to arbitrate the duplicate message; the deep fuzzy arbitration and time-domain periodic delay verification method means that the message is arbitrated by periodic prediction and multi-frame joint determination;

[0009] Alarms are tiered based on the duration of the replay attack and the arbitration result.

[0010] Based on the above technical solutions, the replay protection method for pure electric vehicle information security provided in this application achieves precise defense against replay attacks by adopting differentiated arbitration strategies for different types of key messages. For gear shift messages, a life signal verification and periodic arbitration method combining periodic verification and dynamic password verification ensures both the timeliness of the message and enhances verification security through dynamic passwords. For braking messages, a deep fuzzy arbitration method combining periodic prediction and multi-frame joint judgment with time-domain periodic delay verification accurately identifies variable-period attacks with temporal randomness, overcoming the limitations of traditional fixed-period verification methods and achieving effective protection without modifying the standardized message structure. Simultaneously, a graded alarm mechanism combining the duration of the replay attack and the arbitration result allows for appropriate countermeasures based on the severity of the attack. This ensures vehicle information security while avoiding unnecessary emergency responses that could interfere with normal vehicle operation, significantly improving the defense capability and operational stability of pure electric vehicles against replay attacks.

[0011] Furthermore, the acquisition of duplicate messages on the CAN bus caused by replay attacks includes:

[0012] Monitor the frequency of occurrence and data consistency of messages with the same ID on the CAN bus;

[0013] When a replay attack is detected, if packets with the same ID appear repeatedly within a short period of time and the data content is inconsistent, it is determined that a replay attack has occurred.

[0014] Record the arrival timestamps and message content of duplicate messages to provide input data for subsequent arbitration.

[0015] Furthermore, the method of arbitrating duplicate messages using life signal verification and periodic arbitration includes:

[0016] Calculate the time interval t between the arrival of the current gear message and the previous valid message;

[0017] Determine whether the time interval t is within the standard period range [T±Δt]: if yes, perform life signal verification; if no, directly intercept the gear shift message; where Δt represents the time tolerance and T represents the standard period.

[0018] If the life signal verification passes, the gear shift message is considered valid, and the valid message record is updated; otherwise, the gear shift message is intercepted and marked as an illegal message.

[0019] Furthermore, the life signal verification means extracting the life signal field from the duplicate message and verifying whether the life signal field conforms to the nonlinear rolling code iteration rule; the life signal field is a rolling code value used to verify the legality of the message and is stored in the message bytes.

[0020] Furthermore, the expression for the iterative law of the nonlinear rolling code is: Among them, Life k This represents the life signal value of the k-th frame message, ⊕ indicates a bitwise XOR operation, and 0×5A represents the hexadecimal constant 5AH.

[0021] Furthermore, the method of arbitrating duplicate messages using deep fuzzy arbitration and time-domain periodic delay verification includes:

[0022] Calculate the time interval T between the arrival of the current braking message and the arrival of the previous valid message. t ;

[0023] Determine T t If the time tolerance range [T±Δt] is within the range, then the gear shift message is determined to be valid; otherwise, the braking message is intercepted, marked as an illegal message, and the arrival time of the illegal message is recorded, and the dynamic periodic benchmark model is updated; wherein, the dynamic periodic benchmark model is used to predict the time interval for the arrival of the next illegal message;

[0024] The arrival time of subsequent braking messages is predicted and verified using a dynamic periodic benchmark model.

[0025] Furthermore, the working mechanism of the dynamic periodic benchmark model is as follows:

[0026] Through formula T i+1 =α×T i +(1-α)×Δt i Calculate the predicted time interval T for the arrival of the next illegal message. i+1 Among them, T i Let T represent the predicted time interval for the arrival of the i-th illegal message, and T i The initial value is the standard period T, i represents the prediction index, α represents the smoothing coefficient, and Δt i This represents the actual time interval between the arrival of the i-th illegal message;

[0027] Each time an illegal message is intercepted, the parameters of the model are updated according to the time interval between interceptions.

[0028] Furthermore, the prediction and verification of the arrival time of subsequent braking messages using the dynamic periodic benchmark model includes:

[0029] When two consecutive braking messages are received within the time tolerance range, the following deep fuzzy arbitration procedure is executed:

[0030] Record the arrival time t1 of the first message and the arrival time t2 of the second message;

[0031] Get the arrival time t of the most recent illegal message i and the predicted value T of the corresponding dynamic periodic benchmark model i ;

[0032] Determine t1-t i or t2-t i Does it fall within the prediction time window [T]? i If the value is within ±Δt], then mark the corresponding message as an illegal message, intercept the illegal message and update the dynamic periodic benchmark model;

[0033] When t1-t i t2-t i If both frames are outside the predicted time window, arbitration of the first and second frames is suspended, and the system waits for the next frame.

[0034] Mark the next frame message as the third frame message, record the arrival time t3 of the third frame message, and calculate the time deviation value ΔT between t3 and the average of t1 and t2; the formula for calculating the time deviation value is: ΔT=t3-(t1+t2) / 2;

[0035] If the time deviation value falls within the predicted time window, the third frame message is marked as a valid message, and the first and second frames message are discarded; otherwise, arbitration is deemed to have failed, and a collision timer is started; the collision timer is used to accumulate the collision time when valid and invalid messages continuously fail to arbitrate, and to trigger an alarm signal based on the accumulated collision time.

[0036] Furthermore, the tiered alarm system based on the duration of the replay attack and the arbitration result includes:

[0037] When the number of illegal packets blocked is less than or equal to the first threshold, and the arbitration result is that the illegal packets were successfully blocked, a level 2 alarm signal is triggered.

[0038] When the accumulated collision time reaches a preset threshold and arbitration fails, a level three alarm signal is triggered.

[0039] Furthermore, the secondary alarm includes: the instrument panel displays a yellow warning message "Vehicle is under replay attack, please drive with caution", and the gateway records a security event log and uploads it to the VSOC platform;

[0040] The three-level alarm includes: the instrument panel displays a red warning message "The vehicle has been subjected to a serious replay attack. Please stop and inspect immediately," the gateway reports a serious fault and requests remote diagnosis, and at the same time executes the vehicle control policy: if the vehicle is not started, it is prohibited from entering the preparation state; if it is in motion, the power output is limited.

[0041] Furthermore, the CAN bus network of the pure electric vehicle includes A-path, B-path and C-path, wherein the C-path CAN bus connects the front domain controller, the EBS controller and the vehicle controller, and the anti-replay control method is mainly applied to the C-path CAN bus to protect against replay attacks of gear request messages from the front domain controller and brake pedal opening signal messages from the EBS controller.

[0042] Secondly, a replay protection control device for information security of pure electric vehicles is provided, comprising: a communication unit and a processing unit; the communication unit is used to establish a communication connection with the CAN bus of the pure electric vehicle, acquire various messages transmitted on the CAN bus in real time, and transmit the acquired messages to the processing unit; simultaneously, it receives the graded alarm signal output by the processing unit and sends it to the corresponding alarm execution component of the vehicle; the processing unit is used to analyze the messages transmitted by the communication unit and identify duplicate messages caused by replay attacks; when the duplicate message is determined to be a gear shift message, it calls the life signal verification and periodic arbitration algorithm, and arbitrates the duplicate message through a combination of periodic verification and dynamic password verification; when the duplicate message is determined to be a braking message, it calls the deep fuzzy arbitration and time-domain periodic delay verification algorithm, and arbitrates the duplicate message through a combination of periodic prediction and multi-frame joint determination; in addition, it is also used to count the duration of the replay attack, and, in combination with the above arbitration results, generate a corresponding graded alarm command and transmit it to the communication unit.

[0043] Thirdly, this application provides a pure electric vehicle information security anti-replay control device, comprising: a processor and a storage medium; the storage medium includes instructions, and the processor is used to execute the instructions to implement the method described in the first aspect and any possible implementation thereof. This pure electric vehicle information security anti-replay control device can be an electronic device or a chip within an electronic device.

[0044] Fourthly, this application provides a pure electric vehicle information security anti-replay control system, including: a message acquisition module, a message classification module, and a hierarchical arbitration module; wherein,

[0045] The message acquisition module is used to access the CAN bus network of the pure electric vehicle in real time, acquire all control messages transmitted on the bus, and after timestamping and parsing the acquired messages, transmit them to the message classification module.

[0046] The message classification module is used to receive the parsed messages output by the message acquisition module, identify duplicate messages through a preset message feature comparison algorithm, and classify them into gear messages, braking messages and other types of messages according to the ID identifier or data field characteristics of the duplicate messages, and synchronize the classification results to the hierarchical arbitration module.

[0047] The hierarchical arbitration module is used to receive the classification results output by the message classification module, call the corresponding arbitration algorithm for different types of duplicate messages, and simultaneously count the duration of replay attacks. Based on the arbitration results, it generates hierarchical alarm signals according to preset alarm level rules and sends the alarm signals to the vehicle's alarm execution unit. The corresponding arbitration algorithm means performing life signal verification and periodic arbitration on gear position messages, and performing deep fuzzy arbitration and time-domain periodic delay verification on braking messages.

[0048] Fifthly, this application provides a computer-readable storage medium storing instructions that, when executed on a pure electric vehicle information security anti-replay control device, cause the pure electric vehicle information security anti-replay control device to perform the method described in the first aspect and any possible implementation thereof.

[0049] Sixthly, this application provides a computer program product containing instructions that, when run on a pure electric vehicle information security anti-replay control device, causes the pure electric vehicle information security anti-replay control device to perform the methods described in the first aspect and any possible implementation thereof.

[0050] This application provides a method for preventing replay attacks on pure electric vehicles. By employing a hybrid replay prevention strategy, it provides differentiated and precise protection for gear shift messages and braking messages, effectively identifying and intercepting replay attack messages, ensuring the authenticity of CAN network data and vehicle driving safety. By introducing dynamic periodic benchmark technology and a deep fuzzy arbitration algorithm, it can effectively cope with attacks where hackers change the replay period, solving the problem of determining when messages arrive simultaneously, and greatly improving the system's robustness under extreme attacks. By establishing a hierarchical security alarm and fault reporting mechanism, it can promptly alert the driver to the vehicle's attack status and upload security event logs to the vehicle network operation and maintenance center through the gateway, achieving predictability and traceability of security risks. The entire solution is developed based on the existing electronic and electrical architecture of the vehicle, without adding additional hardware costs. It can achieve highly reliable information security protection through software strategies alone, significantly improving the product's cost advantage and regulatory compliance, and has broad platform applicability and significant commercial promotion value.

[0051] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 A system architecture diagram of a pure electric vehicle information security anti-replay control system provided in this application embodiment;

[0054] Figure 2 A system schematic diagram of the electronic and electrical network architecture of a pure electric vehicle provided in the embodiments of this application;

[0055] Figure 3 A flowchart illustrating a method for preventing replay attacks in the information security of a pure electric vehicle, provided as an embodiment of this application;

[0056] Figure 4 A flowchart illustrating another method for preventing replay attacks on pure electric vehicles for information security, provided in an embodiment of this application.

[0057] Figure 5 A schematic diagram of the structure of a pure electric vehicle information security anti-replay control device provided in this application embodiment;

[0058] Figure 6 This is a schematic diagram of the hardware structure of a pure electric vehicle information security anti-replay control device provided in an embodiment of this application. Detailed Implementation

[0059] In the description of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. The "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" means one or more, and "multiple" means two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.

[0060] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0061] The information security anti-replay control method for pure electric vehicles provided in this application embodiment can be applied to, for example... Figure 1 In a pure electric vehicle information security anti-replay control system shown, such as Figure 1 As shown, the communication system includes: a message acquisition module, a message classification module, and a hierarchical arbitration module; wherein,

[0062] The message acquisition module is used to access the CAN bus network of pure electric vehicles in real time, acquire all control messages transmitted on the bus, and after timestamping and parsing the acquired messages, transmit them to the message classification module.

[0063] The message classification module receives the parsed messages output by the message acquisition module, identifies duplicate messages through a preset message feature comparison algorithm, and classifies them into gear messages, braking messages and other types of messages based on the ID identifier or data field characteristics of the duplicate messages, and synchronizes the classification results to the hierarchical arbitration module.

[0064] The hierarchical arbitration module receives the classification results output by the message classification module and calls the corresponding arbitration algorithm for different types of duplicate messages. At the same time, it counts the duration of replay attacks, combines the arbitration results, generates hierarchical alarm signals according to preset alarm level rules, and sends the alarm signals to the vehicle's alarm execution unit. The corresponding arbitration algorithm means performing life signal verification and periodic arbitration on gear position messages, and performing deep fuzzy arbitration and time-domain periodic delay verification on braking messages.

[0065] It should be noted that, as Figure 2As shown, a pure electric vehicle information security anti-replay control system also includes modules such as: instrument panel, vehicle controller, front domain controller, central gateway, gear position panel, EBS controller, motor controller, brake pedal, and VSOC platform. The instrument panel, gear position panel, and front domain controller are connected via CAN bus A; the front domain controller, EBS controller, and vehicle controller are connected via CAN bus C; the vehicle controller and motor controller are connected via CAN bus B; CAN buses A, B, and C are all connected to the central gateway; the central gateway wirelessly transmits data to the VSOC platform; and the EBS and brake pedal are connected via hardwired connections. Evaluation shows that CAN bus C, as the core channel carrying critical messages such as gear position control and braking control, has a high risk of being replayed, and the impact of a successful replay is significant. Therefore, this application embodiment designs an anti-replay system for CAN bus C based on the vehicle's electronic and electrical architecture. That is, the method of this application is applied to vehicles such as... Figure 2 The electronic and electrical network architecture of the pure electric vehicle is shown.

[0066] To address the technical problems in existing technologies, such as the inability to add verification fields to standardized messages and the difficulty in responding to variable-period attacks, this application provides a method for preventing replay attacks in pure electric vehicles, which includes:

[0067] Retrieve duplicate messages on the CAN bus caused by a replay attack;

[0068] When a duplicate message is a gear-positioning message, a life signal verification and periodic arbitration method is used to arbitrate the duplicate message; where the life signal verification and periodic arbitration method means that the message is arbitrated by combining periodic verification and dynamic password verification.

[0069] When the duplicate message is a braking message, the deep fuzzy arbitration and time-domain periodic delay verification method is used to arbitrate the duplicate message; where the deep fuzzy arbitration and time-domain periodic delay verification method means that the message is arbitrated by period prediction and multi-frame joint determination;

[0070] Alarms are tiered based on the duration of the replay attack and the arbitration result.

[0071] Based on this, the method achieves efficient defense against replay attacks by using differentiated protection strategies for different types of critical messages, combined with bus monitoring, message verification and alarm control, while adapting to the standardized protocols and low-cost requirements of vehicle networks.

[0072] like Figure 3 As shown in the embodiment of this application, a method for preventing replay attacks in the information security of a pure electric vehicle includes:

[0073] S1. Obtain duplicate messages on the CAN bus caused by replay attacks.

[0074] CAN, or Controller Area Network, is a commonly used bus in vehicle networks for transmitting control commands. The core of acquiring duplicate messages is identifying abnormal messages on the bus caused by replay attacks, which requires relying on the vehicle network's message monitoring capabilities to capture message data with repetitive characteristics.

[0075] In some implementations, the vehicle controller, such as the vehicle controller or central gateway, can monitor the CAN bus message transmission in real time and record key parameters such as the identification information, data content, and transmission time of each message frame. Alternatively, a dedicated bus monitoring module can be used to continuously collect the message stream on the bus and filter abnormal messages through preset data analysis logic.

[0076] It should be noted that the repetitive characteristics of duplicate messages do not only refer to completely identical data, but also include situations such as messages with the same ID appearing frequently in a short period of time, and data content conflicting with normal messages. It is necessary to make a comprehensive judgment based on the transmission pattern of messages and normal business logic.

[0077] For example, when the vehicle monitoring unit detects that a certain message ID is transmitted more than 5 times within 1 second, and the data content of some of the messages is inconsistent with the regular instruction data of that ID, it can be preliminarily determined that there are duplicate messages, and further verification is needed to determine whether it is caused by a replay attack.

[0078] S2. Differentiate arbitration for duplicate messages based on message type.

[0079] Differential arbitration refers to the use of appropriate arbitration methods for messages with different functions, taking into account their transmission protocols, functional importance, and verification limitations in the vehicle network, to ensure that legitimate messages and illegal replay messages are accurately distinguished without violating standardized protocols.

[0080] In some implementations, a periodic verification method can be used for gear shift messages. This involves monitoring the message transmission period to determine if the time interval between the current message and the previous valid message frame is within a reasonable tolerance range. This is combined with a dynamic password verification method, employing existing technologies such as rolling codes and encryption sequences to embed dynamically changing verification fields into the message data. A preset verification algorithm is then used to verify the validity of these fields. For braking messages, a periodic prediction method can be used. This method utilizes a time-series analysis model to predict the arrival time of the next valid message frame based on historical message transmission cycle data. Then, a multi-frame joint judgment is combined, comparing the time intervals and data correlations of consecutive frames to determine which frame conforms to normal business logic.

[0081] It should be noted that differentiated arbitration needs to be adapted to the protocol restrictions of the message. For example, if the braking message follows standardized protocols such as J1939 and cannot add custom verification fields, then arbitration should be achieved by focusing on period prediction and multi-frame joint determination to avoid modifying the standardized message structure.

[0082] For example, when a duplicate message is detected as a gear shift message, the time interval between it and the previous valid gear shift message is first calculated. If the interval is within the range of "standard period ± tolerance", the life signal field in the message data is extracted. The verification logic of "previous frame life signal value → preset algorithm → current life signal value" is used to confirm whether the field conforms to the dynamic change law. If both are satisfied, it is determined to be a valid message. If it is a braking message, when two frames of messages arrive at the same time, the transmission period of the past 10 frames of braking messages is analyzed by the sliding window model to predict the arrival time of the next valid message. If the arrival time of one of the frames of messages deviates from the prediction result by more than 20ms, it is determined to be an illegal replay message.

[0083] S3. Based on the duration of the replay attack and the arbitration result, a tiered alarm will be triggered.

[0084] The core of tiered alarms is to combine the severity of the attack with the effectiveness of the defense, and to adopt different levels of alarm measures to ensure that drivers and maintenance personnel are aware of the risks in a timely manner, while avoiding excessive alarms that may affect the normal operation of vehicles.

[0085] In some implementations, the duration of a replay attack can be tracked using a timer, starting from the first detection of a duplicate packet and recording the duration of the attack state. Arbitration results include "successfully intercepted illegal packets," "unable to distinguish between legal and illegal packets," and "only some illegal packets were intercepted." Alarm measures can be implemented using the vehicle's human-machine interface module, vehicle-to-everything (V2X) communication module, and vehicle control module, with different levels corresponding to different response strengths.

[0086] It should be noted that the tiered alarm system needs to be linked with the vehicle's safety control logic. In the event of a serious attack, the alarm should not only alert the vehicle to the risk, but also take necessary vehicle control measures to reduce the risk of loss of control.

[0087] For example, if the arbitration result is "continuously and successfully intercepting illegal messages" and the attack duration does not exceed 30 seconds, a level one alarm is triggered: the instrument panel displays a yellow warning message, such as "Potential replay attack detected, system has intercepted," and an alarm log is uploaded to the operation and maintenance platform through the vehicle networking module; if the arbitration result is "Arbitration failed, messages cannot be distinguished," and the attack duration exceeds 10 seconds, a level two alarm is triggered: the instrument panel displays a red warning message, such as "Serious replay attack, please pay attention to driving safety," and the vehicle's power output is restricted, and an emergency help signal is sent to the operation and maintenance platform to request remote diagnosis.

[0088] Based on the above technical solutions, this application provides a method for preventing replay attacks on pure electric vehicles. By utilizing existing hardware resources in the vehicle network, such as controllers and bus monitoring modules, and relying on technologies like message identification, periodic monitoring, password verification, and tiered alarms, it achieves comprehensive defense against replay attacks. Its advantages lie in its differentiated arbitration strategy for gear shift messages and braking messages, adapting to the limitations of standardized vehicle protocols and eliminating the need for additional hardware for verification. Arbitration methods such as periodic prediction and multi-frame joint judgment effectively address attacks where hackers alter the replay cycle. Tiered alarms balance risk warnings with the needs of normal vehicle operation, ensuring driving safety while avoiding excessive intervention. Furthermore, this method can flexibly adapt to the CAN bus architecture of different vehicle models without requiring large-scale hardware modifications, possessing strong practicality and promotional value.

[0089] In one possible implementation of this application embodiment, the above-mentioned S1 can be specifically implemented by the following S101, S102 and S103, which are described in detail below:

[0090] S101: Monitor the message transmission status of the CAN bus of pure electric vehicles in real time and collect core message information.

[0091] Monitoring the CAN bus message transmission status refers to continuously capturing all control messages transmitted on the bus through the vehicle hardware module, including message identifier ID, data content, arrival timestamp, and the corresponding sending source of the message.

[0092] It should be noted that, as Figure 2 As shown, when the driver depresses the brake pedal and shifts gears via the gear selector, the gear position message is forwarded from channel A to channel C by the front domain controller and received by the Vehicle Control Unit (VCU). Simultaneously, the Electronic Brake System (EBS) sends a brake pedal percentage signal message to channel C, which is also received by the VCU. The VCU determines that conditions such as effective braking and a valid gear request are met and outputs a valid gear, thus enabling driving. During driving, when the driver depresses the brake pedal, the VCU checks the brake pedal opening message sent by the EBS controller on channel C and stops the drive torque request, putting the vehicle into braking mode. If the gear position or braking message on channel C is replayed by a hacker, it will seriously affect driving safety. Therefore, monitoring should prioritize channel C CAN bus, while also performing basic monitoring of channels A and B CAN buses, forming a "key protection + comprehensive coverage" monitoring strategy.

[0093] In some implementations, if the vehicle controller is used for monitoring, its communication interface with the CAN bus can be reused directly without the need for additional hardware. If a dedicated monitoring module is selected, more refined message filtering can be achieved, reducing the computing power consumption of the vehicle controller.

[0094] S102. Based on the preset judgment rules, identify and filter out duplicate packets caused by replay attacks.

[0095] Under normal operating conditions, messages with the same ID on the CAN bus are sent at fixed intervals, and their data content is consistent with the actual vehicle operation. However, a replay attack disrupts this pattern, causing messages with the same ID to appear densely in a short period of time, and the data to conflict with the actual operation. This can lead to abrupt changes in the data input of the vehicle control unit, resulting in vehicle instability or even loss of control. Therefore, when messages with the same ID are detected to appear repeatedly in a short period of time, and the data content of the repeated messages is inconsistent, it can be determined that the repeated messages are caused by a replay attack.

[0096] In some implementations, the "short time" threshold can be dynamically set according to the message type: for critical messages such as gear shifting and braking with a period of 100ms, the time threshold can be set to 50ms; for non-critical messages, such as vehicle status messages, the time threshold can be relaxed to 100ms. The determination of "inconsistent data content" can be achieved by comparing the core fields of the message data field. For example, for braking messages, the "pedal opening percentage" field is compared, and for gear shifting messages, the "gear command" field is compared. This eliminates the need to verify all data bytes, reducing computational power consumption.

[0097] S103. Extract and record key information of duplicate messages to form the initial data archive for replay attacks.

[0098] The key information of duplicate messages includes the ID of the duplicate message, the data content of each frame of duplicate messages, the arrival timestamp, the sender identifier, and the time difference between the first and last occurrences.

[0099] In some implementations, the recorded information can be stored in the local cache of the vehicle controller or in the non-volatile memory of the central gateway. Storing it in the local cache enables fast data retrieval, adapting to real-time arbitration requirements; storing it in non-volatile memory retains attack records even after the vehicle is powered off, facilitating subsequent fault diagnosis and tracing. Simultaneously, the recorded information can be compressed to reduce storage resource consumption.

[0100] Based on the above technical solution, through real-time monitoring, duplicate message detection, and structured recording, it not only reuses the existing electronic and electrical architecture of the vehicle without requiring additional hardware such as security chips, but also detects whether the vehicle is being attacked by replay messages through targeted monitoring strategies and judgment rules, providing a data foundation for subsequent judgment and filtering of illegal messages, and ensuring the information security and driving stability of the vehicle.

[0101] In one possible implementation of the embodiments of this application, combined with Figure 3 and Figure 4 The above S2 can be implemented through the following S201, S202 and S203, which are explained in detail below:

[0102] S201. Identify and classify duplicate messages to determine whether they are gear shift messages or braking messages.

[0103] The core basis for message type identification and classification is the identification information, data field characteristics, and sending source of duplicate messages. Gear shift messages are typically sent by the front domain controller, and their data field includes gear shift instructions and life signal fields, corresponding to a preset gear shift control message ID. Brake messages are sent by the EBS controller, and their data field includes brake pedal opening percentage information, following the J1939 standard protocol, corresponding to a brake control message ID. By matching these characteristics, the two types of key messages can be clearly distinguished.

[0104] It should be noted that, after evaluation, the C-channel CAN bus contains gear position request messages from the front domain controller and brake pedal opening signal messages from the EBS. The vehicle controller determines the gear position and performs gear switching based on the gear position request message; it issues a braking signal based on the brake pedal opening message to determine whether to initiate actuation. Replaying these two types of messages can cause the vehicle controller to make misjudgments, posing a significant safety risk to the vehicle's dynamic driving process. Therefore, the main design focuses on preventing replay of messages containing these two types of information.

[0105] In some implementations, classification can be accomplished through a preset message type-ID mapping table: the gear message exclusive ID and brake message exclusive ID stored in the vehicle controller are organized into a mapping table. When a duplicate message is received, its ID is extracted and compared with the mapping table to directly determine the message type.

[0106] For example, if a duplicate message with ID 0x123 is obtained in S1, its data field is extracted and found to contain "D gear command" and a 1-byte life signal value. The source of the message is identified as the front domain controller, which is a perfect match with the preset gear message characteristics. Therefore, the duplicate message is determined to be a gear message. If a duplicate message with ID 0x456 is obtained, its data field only contains the information "brake pedal opening 25%", the source of the message is the EBS controller, and it conforms to the J1939 protocol data format. Therefore, it is determined to be a brake message.

[0107] S202. If the repeated message is a gear shift message, arbitration shall be carried out by combining life signal verification and periodic arbitration.

[0108] Among them, life signal verification and periodic arbitration are a two-layer protection strategy for gear shift messages. Periodic arbitration judges the legitimacy by verifying the time regularity of message transmission, while life signal verification further strengthens the verification through dynamically changing password fields. The combination of the two can simultaneously resist "fixed period replay" attacks and "replay attacks disguised as legitimate periods".

[0109] In some implementations, the process for life signal verification and periodic arbitration is as follows:

[0110] Calculate the time interval t between the arrival of the current gear message and the previous valid message;

[0111] Determine if the time interval t is within the standard period range [T±Δt]: if yes, perform a life signal verification; if no, directly intercept the gear shift message; where Δt represents the time tolerance and T represents the standard period.

[0112] If the life signal verification passes, the gear shift message is considered valid and the valid message record is updated; otherwise, the gear shift message is intercepted and marked as an illegal message.

[0113] The standard period T for periodic arbitration is set to 100ms, and the time tolerance Δt is 10ms, meaning the arrival time interval between the current message and the previous valid gear shift message must be within the range of [90ms, 110ms]. Life signal verification is based on a nonlinear rolling code iteration law. The rolling code is stored in a 1-byte field within the gear shift message, and the iteration formula is... Among them, Life k This represents the life signal value of the k-th frame message, ⊕ indicates a bitwise XOR operation, and 0×5A represents the hexadecimal constant 5AH.

[0114] In some implementations, periodic arbitration can be optimized into dynamic tolerance adjustment: the value of Δt is adjusted according to vehicle operating conditions. At high speeds, the vehicle has higher requirements for timely gear shift response, so Δt can be reduced to 5ms to reduce the risk of misjudgment; at low speeds, it can be relaxed to 15ms to adapt to message transmission delays under complex operating conditions. Life signal verification can add an outlier filtering mechanism—if the extracted life signal value exceeds the byte value range of 0x00-0xFF, or the difference from the previous frame value exceeds 50, it can be directly determined as an illegal message without performing a complete iterative calculation.

[0115] It should be noted that the iteration pattern of the life signal field needs to be pre-synchronized in the vehicle controller and the front domain controller to ensure that the calculation logic of the sending and receiving ends is consistent. Furthermore, periodic arbitration should be based on a valid message from the previous frame, not a duplicate message from the previous frame. Additionally, if periodic arbitration fails, the message can be directly intercepted without performing life signal verification.

[0116] For example, the arrival time of the previous valid gear shift message was 16:20:30.100, and the Life signal value was... k =0x3A; The current gear repeat message arrival time is 16:20:30.205, the time interval is 105ms, and the life signal value is 0x7C. Calculated according to the iterative formula: Life k =((0x3A⊕0x5A)+37)mod256=((0x60)+25)mod256=0x7D. Here, the current life signal value 0x7C is found to be inconsistent with the calculated result 0x7D. Therefore, the life signal verification fails, and the duplicate message is determined to be an illegal message and blocked.

[0117] S203. If the repeated message is a braking message, arbitration shall be performed by combining deep fuzzy arbitration and time-domain periodic delay verification.

[0118] Among them, deep fuzzy arbitration and time-domain periodic delay verification are arbitration strategies for braking messages: first, obvious illegal messages are filtered out through basic periodic verification, then the arrival time of illegal messages is predicted through the dynamic periodic reference model (DPR), and the problem of normal messages and illegal messages arriving at the same time is solved by combining multi-frame joint judgment.

[0119] It should be noted that, since braking messages strictly adhere to the J1939 standard protocol, it is impossible to customize life signals for life signal verification. Therefore, pure periodic arbitration is adopted to achieve anti-replay protection against variable message periods. Since replay messages are data recorded on the vehicle, their period should ideally match that of normal messages. This is the case with the highest success rate for anti-replay, because the replay message and the correct message have a phase shift, and their arrival times are completely staggered and no longer overlap. If a hacker sets the replay message period to be shorter or longer to increase the replay probability, then after a replay occurs, over time, the normal message and the replay message will always arrive simultaneously within a very small time window, increasing the difficulty of defending against replay. This application fully considers this situation; when two frames of messages arrive simultaneously within a very short time, periodic arbitration employs deep fuzzy arbitration and time-domain periodic delay verification.

[0120] In some implementations, the workflow of the deep fuzzy arbitration and time-domain periodic delay verification method includes:

[0121] Calculate the time interval T between the arrival of the current braking message and the arrival of the previous valid message. t ;

[0122] Determine T t Is it within the time tolerance range [T±Δt]? If yes, then the gear shift message is determined to be valid; otherwise, the braking message is intercepted and marked as an illegal message. Then, the arrival time of the illegal message is recorded, and the dynamic cycle reference model is updated.

[0123] When two consecutive braking messages are received within the time tolerance range [T±Δt], the following deep fuzzy arbitration procedure is executed:

[0124] Record the arrival time t1 of the first message and the arrival time t2 of the second message;

[0125] Get the arrival time t of the most recent illegal message i and the predicted value T of the corresponding dynamic periodic benchmark model i ;

[0126] Determine t1-t i or t2-t i Does it fall within the prediction time window [T]? i If the value is within ±Δt], then mark the corresponding message as an illegal message, intercept the illegal message and update the dynamic periodic baseline model;

[0127] When t1-t i t2-t i If both frames are outside the predicted time window, arbitration of the first and second frames will be suspended, and the system will wait for the next frame.

[0128] Mark the next frame message as the third frame message, record the arrival time t3 of the third frame message, and calculate the time deviation ΔT between t3 and the average of t1 and t2: ΔT=t3-(t1+t2) / 2;

[0129] If the time deviation value ΔT falls within the predicted time window, the third frame message is marked as a valid message, and the first and second frames are discarded. Afterward, valid and invalid messages will arrive at different times due to different cycles, and the above steps will be repeated. Otherwise, the arbitration is deemed to have failed, and a collision timer is started. Subsequently, an alarm will be triggered based on the cumulative attack time of the collision timer.

[0130] In this application, the iterative formula for the DPR model is T. i+1 =α×T i +(1-α)×Δt i Where α is the smoothing coefficient, preferably 0.7, and T iLet Δt be the predicted time interval for the arrival of the i-th illegal packet, initially set to a standard period T = 100 ms, used to update the time window for illegal packets in real time. i This represents the actual time interval between the arrival of the i-th illegal message.

[0131] In some implementations, the smoothing coefficient α of the DPR model can be dynamically adjusted according to the attack intensity: when the number of consecutively intercepted illegal packets exceeds 5 frames, the attack intensity is considered high, and α is adjusted to 0.6 to enhance the model's sensitivity to tracking changes in the periodicity of illegal packets; when no illegal packets are intercepted within 10 seconds, α reverts to 0.7 to reduce the model's computational power consumption. Simultaneously, multi-frame joint judgment can be extended to four-frame verification—if the time deviations of the first three frames exceed the range, the fourth frame can be waited for, and the average arrival time of the first four frames can be calculated to further improve the accuracy of the judgment.

[0132] It should be noted that the core challenge of braking message arbitration is the simultaneous arrival of two frames (time difference < 5ms). In this case, the illegal message time window predicted by the DPR model must be used as the primary screening method: if the arrival time of one frame falls within the window, it is directly determined to be illegal; if neither frame is within the window, the next frame must be waited for, and the legitimacy is determined by the time deviation between the third frame and the average of the first two frames. Furthermore, the DPR model parameters must be updated immediately after each illegal braking message is intercepted to ensure real-time tracking of variable-period attacks.

[0133] For example, the arrival time of the previous valid braking message was 16:20:30.000. Currently, two duplicate braking messages, A and B, are received, arriving at 16:20:30.102 and 16:20:30.105 respectively. At this point, the DPR model is invoked, and the predicted time interval T of the previous invalid message arrival is known. i =105ms, calculate the current predicted value T i+1 =0.7×10⁵+0.3×10=73.5+3=76.5ms, the corresponding illegal time window is [66.5ms, 86.5ms]. Comparing the intervals between the two frames and the previous illegal frame: the interval for message A is 172ms and the interval for message B is 175ms, both are outside the window, so arbitration is paused and the third frame message C is awaited. The arrival time of message C is 16:20:30.208, and the deviation from the average arrival time of messages A and B is calculated as: 208-(10²+10⁵) / 2=104.5ms, which falls within the range of [90ms, 110ms]. Therefore, message C is deemed valid, messages A and B are discarded, and arbitration is completed.

[0134] Based on the above technical solutions, S2 achieves precise defense against replay attacks on gear position and braking messages through message classification and differentiated arbitration. Regarding the differentiated arbitration method, the dual verification method of period + life signal for gear position messages utilizes time regularity to quickly filter messages and uses dynamic rolling codes to resist spoofing attacks, adapting to its ability to add custom fields. For braking messages, the DPR model + multi-frame judgment strategy circumvents the limitation of the J1939 protocol in adding verification fields. By predicting the period of illegal messages and combining multi-frame features, it effectively solves the problem of simultaneous arrival of variable period attacks and messages. From a functional perspective, the entire arbitration process reuses the vehicle's existing electronic and electrical architecture, requiring no additional security chips and meeting low-cost requirements. Simultaneously, the arbitration response time is controlled within 20ms, ensuring matching with the 100ms message transmission cycle and not affecting the real-time performance of vehicle control. This guarantees high-reliability defense against replay attacks on gear position and braking messages on the CAN bus while also ensuring normal vehicle operation.

[0135] In one possible implementation of this application embodiment, the above-mentioned S3 can be specifically implemented by the following S301, S302 and S303, which are described in detail below:

[0136] S301, Statistical analysis of the duration and arbitration results of replay attacks.

[0137] The duration of a replay attack includes two statistical dimensions: first, the duration of continuous illegal packet interception, which refers to the continuous time interval from the first detection of a duplicate packet and its determination as illegal to the current moment; second, the duration of collision between legal and illegal packets, which refers to the duration of packet conflict accumulated by the collision timer when arbitration fails. The arbitration result includes three states: (1) Arbitration successful, that is, illegal packets are successfully intercepted and legal packets are filtered out; (2) Arbitration failed, that is, legal and illegal packets cannot be distinguished and the collision timer needs to be started; (3) Partial interception, that is, only some illegal packets are intercepted and a small number of suspicious packets are still to be verified.

[0138] In some implementations, a dual-timer parallel statistical mechanism can be used: one timer specifically records the duration of continuous illegal packet interception, resetting the timer for each intercepted illegal packet; the other timer records collisions, starting only when arbitration fails and pausing when arbitration succeeds. Simultaneously, statistical data can be backed up in the central gateway to prevent data loss due to vehicle controller failure.

[0139] S302. Determine the severity level of the replay attack based on preset thresholds and statistical data.

[0140] The preset thresholds are set based on the degree of impact of the attack on vehicle driving safety. This application includes two types of preset thresholds: one is a continuous interception threshold of 10 frames, meaning that if more than 10 illegal packets are continuously intercepted and the arbitration result is successful, it is determined to be a moderate attack; the other is a collision duration threshold of 10 seconds, meaning that if the collision timer accumulates to 10 seconds and the arbitration result is a continuous arbitration failure, it is determined to be a severe attack. In addition, a mild attack threshold can be set, such as continuously intercepting 3-9 illegal packets, corresponding to a lower level of alarm. The severity level is divided into three levels: Level 1 Mild Attack, Level 2 Moderate Attack, and Level 3 Severe Attack, used to determine the strength of subsequent alarm measures.

[0141] S303. Based on the severity level of the attack, implement corresponding graded alarm measures and vehicle control strategies.

[0142] The tiered alarm system is divided into three categories: "warning alerts," "event logging," and "remote reporting." Different severity levels correspond to different combinations of measures: Level 1 (mild attack) only executes "event logging"; Level 2 (medium attack) executes "warning alerts + event logging + remote reporting"; Level 3 (severe attack) adds "vehicle control strategies" to Level 2 to forcibly reduce security risks. All measures are executed collaboratively through the vehicle controller, instrument cluster, central gateway, and VSOC platform to form a closed-loop protection system.

[0143] In some implementations, the mechanism for tiered alarms may include:

[0144] 1. Level 1 Alarm (Minor Attack): Triggered when the number of continuously intercepted illegal packets is 3-9 frames, or when the number of intercepted packets does not reach the threshold but some packet arbitrations fail. At this time, the central gateway automatically records attack-related information, including the attack timestamp, the total CAN bus segments involved, the packet type, and the arbitration result, forming a security event log stored in non-volatile memory for easy subsequent troubleshooting. No explicit warning is issued to the driver to avoid interfering with normal driving.

[0145] 2. Level 2 Alarm (Moderate Attack): Triggered when the number of continuously intercepted illegal packets exceeds 10 frames, and all interceptions are successfully arbitrated. Upon triggering, the vehicle controller sends a command to the instrument panel, which displays a warning message in yellow text: "Vehicle under replay attack, please drive with caution!" Simultaneously, the central gateway wirelessly uploads the stored security event logs to the Vehicle Network Security Operation and Maintenance Center (VSOC platform) for real-time monitoring by backend maintenance personnel. The vehicle maintains normal driving functions, only prompting the driver to pay attention to the vehicle status through warnings, without requiring mandatory driving intervention.

[0146] 3. Level 3 Alarm (Severe Attack): Triggered when a legitimate message collides with an illegal message for 10 seconds or more, or when critical messages such as braking messages fail to arbitrate continuously even if the collision lasts less than 10 seconds. In addition to executing the red text warning on the instrument panel "Vehicle under severe replay attack, please stop immediately for inspection!", logging the gateway, uploading event information to the VSOC platform, and requesting remote diagnostics, the vehicle control strategy must also be executed: If the vehicle is in an unready state, the vehicle controller prohibits sending start commands to the motor controller and EBS controller, preventing the vehicle from entering a drivable state; if the vehicle is in motion, the vehicle controller sends a power limiting command to the motor controller, limiting the vehicle's maximum speed to below 30 km / h, while retaining normal braking and steering functions to ensure the driver can safely pull over to the side of the road, and resume normal driving after the fault is resolved.

[0147] Based on the above technical solution, step S3 adopts a hierarchical security alarm and fault reporting security strategy to promptly inform the driver of the vehicle's replay attack status and upload it to the vehicle network operation and maintenance center for real-time monitoring, ensuring the predictability of vehicle security risks and thus reducing the risk of safety accidents.

[0148] The above primarily describes the solutions of the embodiments of this application from the perspective of device implementation. It is understood that each device, for example, a pure electric vehicle information security anti-replay control device, includes at least one of the hardware structures and software modules corresponding to each function in order to achieve the above-mentioned functions. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0149] This application embodiment can divide a pure electric vehicle information security anti-replay control device into functional units based on the above method example. For example, each function can be divided into separate functional units, or two or more functions can be integrated into one processing unit. The integrated unit can be implemented in hardware or as a software functional unit. It should be noted that the unit division in this application embodiment is illustrative and only represents a logical functional division; other division methods may be used in actual implementation.

[0150] When using integrated units, Figure 5A possible structural schematic diagram of a pure electric vehicle information security anti-replay control device (referred to as pure electric vehicle information security anti-replay control device 50) involved in the above embodiments is shown. The pure electric vehicle information security anti-replay control device 50 includes a processing unit 501 and a communication unit 502, and may also include a storage unit 503. Figure 5 The structural diagram shown can be used to illustrate the structure of the pure electric vehicle information security anti-replay control device involved in the above embodiments.

[0151] when Figure 5 The schematic diagram shown illustrates the structure of the pure electric vehicle information security anti-replay control device involved in the above embodiments. The processing unit 501 is used to control and manage the operation of the pure electric vehicle information security anti-replay control device, the communication unit 502 is used for the pure electric vehicle information security anti-replay control device to communicate with other devices, and the storage unit 503 is used to store the program code and data of the pure electric vehicle information security anti-replay control device.

[0152] For example, the communication unit 502 is used to establish a communication connection with the CAN bus of the pure electric vehicle, collect various messages transmitted on the bus in real time, and transmit the collected messages to the processing unit 501; at the same time, it receives the hierarchical alarm commands output by the processing unit 501 and sends them to the instrument panel, central gateway and VSOC platform respectively. It can also communicate with vehicle control modules such as EBS controller and motor controller to transmit vehicle control commands issued by the processing unit 501.

[0153] The processing unit 501 analyzes the messages transmitted by the communication unit 502. By identifying the frequency of occurrence, data consistency, and transmission time patterns of messages with the same ID, it filters out duplicate messages caused by replay attacks. Based on the ID identifier, data field characteristics, and transmission source of the duplicate messages, it distinguishes between gear shift messages and braking messages. For gear shift messages, it uses a combination of life signal verification and periodic arbitration for arbitration. For braking messages, it uses a combination of deep fuzzy arbitration and time-domain periodic delay verification for arbitration. It calculates the duration of the replay attack and the arbitration result, determines the severity level of the attack based on a preset threshold, and generates corresponding graded alarm commands and vehicle control strategies.

[0154] In one possible implementation, the processing unit 501 is also used to pre-store the mapping relationship between message type and ID, arbitration rules for various types of messages, the judgment threshold for attack severity level and the execution strategy corresponding to the graded alarm, and temporarily cache the key data in the arbitration process to provide a basis for subsequent event tracing and strategy optimization.

[0155] In one possible implementation, the communication unit 502 is also used to dynamically adjust the communication sampling frequency with the CAN bus when the vehicle is in a complex operating condition, so as to ensure accurate acquisition of key messages without occupying too much bus resources; the processing unit 501 is also used to adaptively adjust parameters such as time tolerance and judgment threshold in the arbitration process according to the real-time operating condition of the vehicle, and at the same time, after the alarm command is issued, it receives the execution status information fed back by the instrument, VSOC platform, etc. through the communication unit 502 to verify whether the alarm measures are effective. If they are not effective, the control strategy is readjusted.

[0156] The processing unit 501 can be a processor or a controller, and the communication unit 502 can be a communication interface, transceiver, transceiver circuit, transceiver device, etc. The term "communication interface" is a general term and may include one or more interfaces. The storage unit 503 can be a memory. When the information security anti-replay control device 50 for a pure electric vehicle is a chip, the processing unit 501 can be a processor or a controller, and the communication unit 502 can be an input interface and / or an output interface, pins, or circuits, etc. The storage unit 503 can be a storage unit within the chip (e.g., a register, cache, etc.) or a storage unit located outside the chip (e.g., read-only memory (ROM), random access memory (RAM, etc.).

[0157] The communication unit can also be called a transceiver unit. The antenna and control circuit with transceiver functions in the pure electric vehicle information security anti-replay control device 50 can be considered as the communication unit 502 of the pure electric vehicle information security anti-replay control device 50, and the processor with processing functions can be considered as the processing unit 501 of the pure electric vehicle information security anti-replay control device 50. Optionally, the device in the communication unit 502 used to implement the receiving function can be considered as a communication unit. The communication unit is used to execute the receiving steps in the embodiments of this application, and the communication unit can be a receiver, a receiver circuit, etc. The device in the communication unit 502 used to implement the transmitting function can be considered as a transmitting unit. The transmitting unit is used to execute the transmitting steps in the embodiments of this application, and the transmitting unit can be a transmitter, a transmitter, a transmitting circuit, etc.

[0158] Figure 5If the integrated units in the process are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. Storage media for storing computer software products include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.

[0159] Figure 5 The units in the process can also be called modules; for example, a processing unit can be called a processing module.

[0160] This application embodiment also provides a hardware structure diagram of a pure electric vehicle information security anti-replay control device (denoted as pure electric vehicle information security anti-replay control device 60), see [link to diagram]. Figure 6 The pure electric vehicle information security anti-replay control device 60 includes a processor 601, and optionally, a memory 602 connected to the processor 601.

[0161] In the first possible implementation, see Figure 6 The pure electric vehicle information security anti-replay control device 60 also includes a transceiver 603. The processor 601, memory 602, and transceiver 603 are connected via a bus. The transceiver 603 is used to communicate with other devices or communication networks. Optionally, the transceiver 603 may include a transmitter and a receiver. The device in the transceiver 603 that implements the receiving function can be considered as a receiver, which is used to perform the receiving steps in the embodiments of this application. The device in the transceiver 603 that implements the transmitting function can be considered as a transmitter, which is used to perform the transmitting steps in the embodiments of this application.

[0162] Based on the first possible implementation method Figure 6 The structural diagram shown can be used to illustrate the structure of the pure electric vehicle information security anti-replay control device involved in the above embodiments.

[0163] in, Figure 6 This can also be illustrated by the system chip in the information security anti-replay control device for pure electric vehicles. In this case, the actions performed by the aforementioned information security anti-replay control device for pure electric vehicles can be implemented by this system chip. The specific actions performed can be found above and will not be repeated here.

[0164] In implementation, each step of the method provided in this embodiment can be completed by integrated logic circuits in the processor or by instructions in software form. The steps of the method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or being executed by a combination of hardware and software modules in the processor.

[0165] The processor in this application may include, but is not limited to, at least one of the following: a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a microcontroller unit (MCU), or an artificial intelligence processor, etc., which are various computing devices that run software. Each computing device may include one or more cores for executing software instructions to perform calculations or processing. The processor may be a separate semiconductor chip or integrated with other circuits into a single semiconductor chip. For example, it may be integrated with other circuits (such as encoding / decoding circuits, hardware acceleration circuits, or various bus and interface circuits) to form a SoC (System-on-a-Chip), or it may be integrated as a built-in processor within an ASIC. The ASIC with the integrated processor may be packaged separately or together with other circuits. In addition to the cores for executing software instructions to perform calculations or processing, the processor may further include necessary hardware accelerators, such as field-programmable gate arrays (FPGAs), PLDs (programmable logic devices), or logic circuits that implement dedicated logic operations.

[0166] The memory in the embodiments of this application may include at least one of the following types: read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions; random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions; or electrically erasable programmable-only memory (EEPROM). In some scenarios, the memory may also be a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto.

[0167] This application also provides a computer-readable storage medium including instructions that, when run on a computer, cause the computer to perform any of the methods described above.

[0168] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to perform any of the methods described above.

[0169] This application also provides a chip including a processor and an interface circuit. The interface circuit is coupled to the processor. The processor is used to run computer programs or instructions to implement the above-described method. The interface circuit is used to communicate with other modules outside the chip.

[0170] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks (SSDs)).

[0171] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple instances. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0172] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and modifications.

Claims

1. A method for preventing replay attacks in pure electric vehicles, characterized in that, include: Retrieve duplicate messages on the CAN bus caused by a replay attack; When the repeated message is a gear shift message, the life signal verification and periodic arbitration method is used to arbitrate the repeated message; The life signal verification and periodic arbitration method refers to a method for arbitrating messages by combining periodic verification with dynamic cryptographic verification, including: Calculate the time interval t between the arrival of the current gear message and the previous valid message; Determine whether the time interval t is within the standard period range [T±Δt]: if yes, perform life signal verification; if no, directly intercept the gear shift message; where Δt represents the time tolerance and T represents the standard period. If the life signal verification passes, the gear shift message is considered valid, and the valid message record is updated; otherwise, the gear shift message is intercepted and marked as an illegal message. When the duplicate message is a braking message, a deep fuzzy arbitration and time-domain periodic delay verification method is used to arbitrate the duplicate message; the deep fuzzy arbitration and time-domain periodic delay verification method refers to a method of arbitrating messages through periodic prediction and multi-frame joint determination, including: Calculate the time interval T between the arrival of the current braking message and the arrival of the previous valid message. t ; Determine T t If the time tolerance range [T±Δt] is within the range, then the braking message is deemed valid; otherwise, the braking message is intercepted, marked as an illegal message, and the arrival time of the illegal message is recorded, and the dynamic periodic benchmark model is updated. The dynamic periodic benchmark model is used to predict the time interval for the arrival of the next illegal message. The arrival time of subsequent braking messages is predicted and verified using a dynamic periodic benchmark model. Alarms are tiered based on the duration of the replay attack and the arbitration result.

2. The information security anti-replay control method for pure electric vehicles according to claim 1, characterized in that, The life signal verification means extracting the life signal field from the duplicate message and verifying whether the life signal field conforms to the nonlinear rolling code iteration rule; the life signal field is a rolling code value used to verify the legality of the message and is stored in the message bytes.

3. The information security anti-replay control method for pure electric vehicles according to claim 2, characterized in that, The expression for the nonlinear rolling code iteration law is as follows: :; Among them, Life k This represents the life signal value of the k-th frame message, ⊕ indicates a bitwise XOR operation, and 0×5A represents the hexadecimal constant 5AH.

4. The information security anti-replay control method for pure electric vehicles according to claim 1, characterized in that, The working mechanism of the dynamic periodic benchmark model is as follows: Through formula T i+1 =α×T i +(1-α)×Δt i Calculate the predicted time interval T for the arrival of the next illegal message. i+1 Among them, T i Let T represent the predicted time interval for the arrival of the i-th illegal message, and T i The initial value is the standard period T, i represents the prediction index, α represents the smoothing coefficient, and Δt i This represents the actual time interval between the arrival of the i-th illegal message; Each time an illegal message is intercepted, the parameters of the model are updated according to the time interval between interceptions.

5. The information security anti-replay control method for pure electric vehicles according to claim 1, characterized in that, The prediction and verification of the arrival time of subsequent braking messages using a dynamic periodic benchmark model includes: When two consecutive braking messages are received within the time tolerance range, the following deep fuzzy arbitration procedure is executed: Record the arrival time t1 of the first message and the arrival time t2 of the second message; Get the arrival time t of the most recent illegal message i and the predicted value T of the corresponding dynamic periodic benchmark model i ; Determine t1-t i or t2-t i Does it fall within the prediction time window [T]? i If the value is within ±Δt], then mark the corresponding message as an illegal message, intercept the illegal message and update the dynamic periodic benchmark model; When t1-t i t2-t i If both frames are outside the predicted time window, arbitration of the first and second frames is suspended, and the system waits for the next frame. Mark the next frame message as the third frame message, record the arrival time t3 of the third frame message, and calculate the time deviation value ΔT between t3 and the average of t1 and t2; the formula for calculating the time deviation value is: ΔT=t3-(t1+t2) / 2; If the time deviation value falls within the predicted time window, the third frame message is marked as a valid message, and the first and second frames message are discarded; otherwise, arbitration is deemed to have failed, and a collision timer is started; the collision timer is used to accumulate the collision time when valid and invalid messages continuously fail to arbitrate, and to trigger an alarm signal based on the accumulated collision time.

6. The information security anti-replay control method for pure electric vehicles according to claim 5, characterized in that, The tiered alert system, based on the duration of the replay attack and the arbitration result, includes: When the number of illegal packets blocked is less than or equal to the first threshold, and the arbitration result is that the illegal packets were successfully blocked, a level 2 alarm signal is triggered. When the accumulated collision time reaches a preset threshold and arbitration fails, a level three alarm signal is triggered.

7. The information security anti-replay control method for pure electric vehicles according to claim 1, characterized in that, The electronic and electrical network architecture of the pure electric vehicle includes: an instrument panel, a vehicle controller, a front domain controller, a central gateway, a gear shift panel, an EBS controller, a motor controller, a brake pedal, and a VSOC platform. The instrument panel, gear shift panel, and front domain controller are connected via an A-channel CAN bus. The front domain controller, EBS controller, and vehicle controller are connected via a C-channel CAN bus. The vehicle controller and motor controller are connected via a B-channel CAN bus. The A-channel, B-channel, and C-channel CAN buses are all connected to the central gateway. The central gateway and VSOC platform transmit data wirelessly. The EBS and brake pedal are connected via a hardwired connection. The information security anti-replay control method is applied to the C-channel CAN bus.

8. The information security anti-replay control method for pure electric vehicles according to claim 1, characterized in that, The method is applied in a pure electric vehicle information security anti-replay control system, the system comprising: a message acquisition module, a message classification module, and a hierarchical arbitration module; wherein... The message acquisition module is used to access the CAN bus network of the pure electric vehicle in real time, acquire all control messages transmitted on the bus, and after timestamping and parsing the acquired messages, transmit them to the message classification module. The message classification module is used to acquire duplicate messages on the CAN bus caused by replay attacks, and classify them into gear messages, braking messages and other types of messages according to the ID identifier or data field characteristics of the duplicate messages, and synchronize the classification results to the hierarchical arbitration module. The hierarchical arbitration module is used to receive the classification results output by the message classification module, call the corresponding arbitration algorithm for different types of duplicate messages, and simultaneously count the duration of replay attacks. Based on the arbitration results, it generates hierarchical alarm signals according to preset alarm level rules and sends the alarm signals to the vehicle's alarm execution unit. The corresponding arbitration algorithm means performing life signal verification and periodic arbitration on gear position messages, and performing deep fuzzy arbitration and time-domain periodic delay verification on braking messages.

Images