Secure communication method and system for vehicle body network

Abstract

The invention relates to a safety communication method and system for a vehicle body network, and relates to the field of vehicle body networks, and the method comprises the steps: 100, collecting vehicle body information; 101, generating a control key in response to the vehicle body information; step 102, generating an authentication request based on the control key; step 103, controlling a preset control device to send the authentication request to a preset vehicle-mounted node, and receiving an authentication response based on the authentication request; step 104, determining a vehicle-mounted authentication code and a vehicle-mounted key based on the authentication response; step 105, calculating a control authentication code in combination with the vehicle-mounted secret key, the control secret key and a preset shared secret key; and 106, when the control authentication code is consistent with the vehicle-mounted authentication code, controlling a preset control device to establish communication with the vehicle-mounted node. According to the invention, the security of the vehicle body network is improved, and rapid communication can be realized in an environment in which the vehicle body control module and vehicle body network resources are limited.

Description

Technical Field

[0001] This invention relates to the field of vehicle network, and more particularly to a secure communication method and system for vehicle network. Background Technology

[0002] The vehicle network is a distributed communication system formed by connecting all electronic devices (such as controllers, sensors, and actuators) inside a vehicle through a standardized communication bus.

[0003] In existing technologies, traditional vehicle bus protocols, such as Controller Area Network (CAN) and Link-In-Network (LIN), did not fully consider information security requirements in their initial design. These protocols are essentially trust-based broadcast communication, lacking built-in source authentication, message integrity verification, and data encryption mechanisms. This inherent deficiency makes vehicle networks highly vulnerable to various network attacks, such as message forgery, data tampering, and replay attacks.

[0004] In the vehicle control domain, attackers may inject malicious commands to illegally control functions such as doors, windows, and lights, posing a direct threat to vehicle functional safety and the personal and property safety of passengers. Existing solutions generally directly transplant encryption algorithms from the IT field (such as AES) to protect against network attacks.

[0005] The vehicle control module has limited computing resources, and directly using encryption algorithms from the IT field may lead to communication delays, thus making it impossible to meet real-time requirements for protection against network attacks. Summary of the Invention

[0006] To improve the security of the vehicle network and enable rapid communication in environments with limited vehicle control modules and vehicle network resources, this invention provides a secure communication method and system for the vehicle network.

[0007] In a first aspect, the present invention provides a secure communication method for vehicle network, employing the following technical solution: A secure communication method for vehicle network, comprising: Step 100: Collect vehicle body information; Step 101: Generate a control key in response to the vehicle information; Step 102: Generate an authentication request based on the control key; Step 103: Control the preset control device to send the authentication request to the preset vehicle node, and receive the authentication response based on the authentication request; Step 104: Determine the vehicle authentication code and vehicle key based on the authentication response; Step 105: Calculate the control authentication code by combining the vehicle key, control key, and preset shared key; Step 106: When the control authentication code matches the vehicle authentication code, the preset control device and the vehicle node establish communication.

[0008] By adopting the above technical solution, the entire authentication and key establishment process can be completed with only one request-response interaction, minimizing network overhead and startup latency, thereby enabling rapid communication in environments with limited vehicle control module and vehicle network resources, and thus improving the security of the vehicle network.

[0009] Optionally, the method for generating the authentication response includes: Step 107: Control the preset vehicle node to generate a vehicle key in response to the authentication request; Step 108: Generate a session key by combining the control key, vehicle key, and preset shared key; Step 109: Calculate the vehicle authentication code based on the control key, vehicle key, and session key; Step 110: Generate an authentication response in response to the vehicle authentication code and vehicle key; Step 111: Control the preset vehicle node to send the authentication response to the preset control device.

[0010] By adopting the above technical solution, the protocol dynamically generates vehicle keys and control keys at the vehicle node and the body control module respectively, and combines the vehicle keys and control keys to dynamically generate session keys, realizing "one key per voice call", which greatly improves the security of communication. Even if a session key is cracked, it will not affect the security of the master key or other communication sessions.

[0011] Optionally, it also includes a data exchange method, the data exchange method comprising: Step 200: Determine the information type based on the vehicle body information; Step 201: When the information type is consistent with the preset safety information, a freshness value is generated in response to the vehicle information; Step 202: Calculate the sending authentication code by combining the vehicle information, freshness value, and session key; Step 203: Generate and send a security message based on the vehicle information, freshness value, and document authentication code.

[0012] By adopting the above technical solution, a message hierarchy method is used to select safety information related to driving safety from the information, and authentication codes are calculated for the safety information for authentication and encryption, thereby reducing the computational complexity and bus load, and improving the security of the vehicle network.

[0013] Optionally, the data exchange method further includes: Step 204: Receive the security message; Step 205: Extract vehicle information, freshness value, and document authentication code from the security message; Step 206: When the freshness value is greater than the preset historical value, calculate the message authentication code by combining the vehicle information, the freshness value and the session key; Step 207: If the sending authentication code and the receiving authentication code do not match, discard the security message; Step 208: If the posting authentication code and the receiving authentication code are the same, update the historical value based on the freshness value.

[0014] By adopting the above technical solution, the communication sender uses a monotonically increasing counter as the fresh value instead of complex random numbers or timestamps to send information synchronously. The receiver can verify the continuity of the counter to determine whether there is information replay, thereby reducing information replay while consuming less network overhead.

[0015] Optionally, a leakage identification method may also be included, the leakage identification method comprising: Step 300: If the sending authentication code and receiving authentication code are consistent, determine the control action based on the security message; Step 301: Determine the action range based on the control action, and determine the control node based on the security message; Step 302: Retrieve the work record in response to the control node; Step 303: Determine the work status from the work record; Step 304: When the working state does not fall within the action range, discard the security message, and generate and display control confirmation information in response to the control node and control action.

[0016] By adopting the above technical solution, when the vehicle body information is received, the control actions in the vehicle body information are extracted, and the working status of the vehicle node is checked to determine whether the vehicle node can execute the control actions. Then, if the vehicle node cannot execute the control actions, the vehicle body information is determined to be invalid, and the security message is discarded to reduce the possibility of session key leakage.

[0017] Optionally, the leakage identification method further includes: Step 305: When the working state falls into the action range, determine the control frequency from the work record based on the control action; Step 306: Determine a continuous threshold in response to the control frequency, and determine the actual interval from the work record based on the control action; Step 307: If the actual interval is lower than the continuous threshold, determine the anomaly count in response to the security message; Step 308: When the anomaly count is greater than a preset anomaly threshold, an anomaly message is determined based on the anomaly count; Step 309: In response to the generation of the abnormal message, display a key leakage prompt.

[0018] By adopting the above technical solution, after receiving vehicle information, the work records of controlling the vehicle node are retrieved, thereby calculating the control frequency of the control actions in the work records. If the control frequency is too high, it is determined that there is a risk of leakage of the session key, and then the staff are notified in time to improve the security of the vehicle network.

[0019] Optionally, the leakage identification method further includes: Step 310: When the anomaly count is not greater than the preset anomaly threshold, retrieve the historical key; Step 311: Determine the overlap frequency by combining the historical key and the session key; Step 312: If the overlap frequency is greater than a preset high-frequency threshold, control the preset control device and the vehicle node to disconnect from communication, and retrieve the abandoned key based on the session key; Step 313: Update the vehicle key and control key based on the discarded key.

[0020] By adopting the above technical solution, when the vehicle information is received, the session key used for the vehicle information is compared with the historical key. If the session key is repeated too frequently in the historical key, it is determined that there is a risk of session key leakage. Then, the vehicle node and the vehicle control module are disconnected to reset the session key, and different vehicle keys and control keys are selected to reduce the situation of session key duplication.

[0021] Optionally, it also includes a leakage prevention method, the leakage prevention method comprising: Step 400: If the sending authentication code and receiving authentication code are consistent, determine the action duration according to the control action, and retrieve the power supply curve from the control node; Step 401: Determine the power consumption from the power supply curve based on the action duration, and determine the action energy consumption based on the control action; Step 402: Determine the energy consumption ratio by combining the power supply energy consumption and the operation energy consumption; Step 403: When the energy consumption ratio is greater than the preset fluctuation threshold, the preset control device and control node are disconnected from communication, and the control node generates and displays a node tampering prompt in response to the control node.

[0022] By adopting the above technical solution, the power consumption of the same control action of the vehicle node is similar. When the vehicle information is received, the power consumption of the vehicle node is calculated. When the power consumption is abnormal, it is determined that the vehicle node is at risk of being tampered with. The vehicle control module and the vehicle node are then disconnected from each other to reduce the possibility that the tampered vehicle node will continue to tamper with the vehicle network.

[0023] Optionally, the leakage prevention method further includes: Step 404: When the energy consumption ratio is not greater than the preset fluctuation threshold, determine the pulse characteristics according to the control action; Step 405: Identify the pulse characteristics from the power supply curve based on the action duration; Step 406: When the pulse characteristic exists in the power supply curve, determine the pulse timing based on the pulse characteristic, and determine the control timing by combining the pulse characteristic and the control action; Step 407: If the pulse timing is inconsistent with the control timing, the control device and control node of the preset control are disconnected from communication, and the control node generates and displays a node tampering prompt in response to the control node.

[0024] By adopting the above technical solution, the vehicle node is likely to emit pulse characteristics in the same order for the same control action. After receiving the vehicle information, it can identify whether there are pulse characteristics in the correct order in the power supply curve of the vehicle node, and judge that there is a risk of tampering when the pulse characteristics are missing or the order is wrong.

[0025] Secondly, this application provides a secure communication system for vehicle network, employing the following technical solution: A secure communication system for vehicle network, comprising: The data acquisition module is used to collect vehicle body information; A memory for storing programs for any of the aforementioned secure communication methods for vehicle network; The processor is the unit of memory that allows programs to be loaded and executed by the processor.

[0026] By adopting the above technical solution, the entire authentication and key establishment process can be completed with only one request-response interaction, minimizing network overhead and startup latency, thereby enabling rapid communication in environments with limited vehicle control module and vehicle network resources, and thus improving the security of the vehicle network.

[0027] In summary, this application includes at least one of the following beneficial technical effects: The entire authentication and key establishment process can be completed with only one request-response interaction, minimizing network overhead and startup latency, thereby enabling rapid communication in environments with limited vehicle control modules and vehicle network resources, and thus improving the security of the vehicle network; The protocol dynamically generates vehicle keys and control keys at the vehicle node and the body control module respectively, and combines the vehicle keys and control keys to dynamically generate session keys, realizing "one key per voice call", which greatly improves the security of communication. Even if a session key is cracked, it will not affect the security of the master key or other communication sessions. A message hierarchy approach is used to select safety information related to driving safety from the information, and authentication codes are calculated for the safety information for authentication and encryption, thereby reducing computational complexity and bus load, and improving the security of the vehicle network. Attached Figure Description

[0028] Figure 1 This is a flowchart of a secure communication method for vehicle network; Figure 2 This is a flowchart of the data exchange method; Figure 3 This is a flowchart of the leak identification method. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0030] Reference Figure 1 A secure communication method for vehicle network, comprising: Step 100: Collect vehicle body information.

[0031] Plaintext refers to the information sent by all electronic devices (such as controllers, sensors, and actuators) inside a vehicle within the vehicle network. It is the message transmitted between the Body Control Module (BCM) and the on-board nodes (ECUs, i.e., other electronic devices inside the vehicle) in the vehicle network. When plaintext is collected, it means that there is an on-board node and the Body Control Module that need to establish communication. The method of collecting plaintext is selected by the staff according to the actual situation, and will not be elaborated here.

[0032] Step 101: Generate a control key in response to the vehicle body information.

[0033] The control key (R_BCM) is an unpredictable, high-quality random number generated by the vehicle control module. The method for generating the control key is common knowledge to those in the field and will not be elaborated here.

[0034] Step 102: Generate an authentication request based on the control key.

[0035] An authentication request is a message sent by the vehicle control module to the on-board node to request the establishment of communication. The method for generating authentication requests is common knowledge to those skilled in the art and will not be described in detail here.

[0036] Step 103: Control the preset control device to send the authentication request to the preset vehicle node, and receive the authentication response based on the authentication request.

[0037] The authentication response refers to the information sent by the vehicle node to the body control module to request the establishment of communication. The authentication response includes the vehicle authentication code and the vehicle key. The method for generating the authentication response is described in steps 107 to 111 below.

[0038] Step 104: Determine the vehicle authentication code and vehicle key based on the authentication response.

[0039] The vehicle key (R_Node) is an unpredictable, high-quality random number generated by the vehicle node. The method for generating the control key is common knowledge to those in the field and will not be elaborated here.

[0040] The vehicle authentication code (MAC_Node) refers to the MAC value calculated by the vehicle node based on the vehicle key and the control key. The calculation method of the vehicle authentication code is described in steps 107 to 109 below, and will not be repeated here.

[0041] Step 105: Calculate the control authentication code by combining the vehicle key, control key and preset shared key.

[0042] The shared key (K_Master) refers to the long-term shared master key that is pre-stored in the vehicle node and the body control module. Generally, a 128-bit symmetric key is used as the shared key. The shared key is pre-stored in the hardware security module (HSM) or secure memory. The shared key is pre-entered by the staff, which will not be elaborated here.

[0043] The Control Authentication Code (MAC_BCM) is the MAC value calculated by the body control module based on the vehicle key and the control key. The calculation method of the vehicle authentication code is described in steps 107 to 109 below, and will not be repeated here.

[0044] Step 106: When the control authentication code matches the vehicle authentication code, the preset control device and the vehicle node establish communication.

[0045] The control device refers to the device used to control the vehicle. In this embodiment, it is the Body Control Module (BCM) mentioned above. The control device is selected by the staff according to the actual situation, and will not be described in detail here.

[0046] The fact that the control authentication code matches the vehicle authentication code means that the vehicle control module has confirmed that the vehicle node is legitimate and that both parties have successfully and independently negotiated a common session key. After that, both parties can enter the secure data exchange phase.

[0047] If the two do not match, it means that the authentication has failed. The vehicle control module will consider the node to be untrusted or that there is an error in the communication process, and will immediately terminate the session without using the derived session key.

[0048] The entire authentication and key establishment process can be completed with only one request-response interaction, minimizing network overhead and startup latency, thereby enabling rapid communication in environments with limited vehicle control modules and vehicle network resources, and thus improving the security of the vehicle network.

[0049] Methods for generating authentication responses include: Step 107: Control the preset vehicle node to generate a vehicle key in response to the authentication request.

[0050] The vehicle key (R_Node) is an unpredictable, high-quality random number generated by the vehicle node. The method for generating the control key is common knowledge to those in the field and will not be elaborated here.

[0051] Step 108: Generate a session key by combining the control key, vehicle key, and preset shared key.

[0052] The session key (K_Session) refers to the temporary key calculated by the vehicle node using a key derivation function. Its calculation formula can be expressed as: K_Session=KDF(K_Master, R_BCM, R_Node). This KDF can be constructed based on standard algorithms such as HMAC, ensuring that the same key can always be derived from the same input, and that K_Master cannot be derived from K_Session.

[0053] Step 109: Calculate the vehicle authentication code based on the control key, vehicle key, and session key.

[0054] The vehicle authentication code (MAC_Node) is calculated by the vehicle node concatenating the control key and the vehicle key (e.g., R_BCM||R_Node), and then using the session key as the key to calculate the MAC value of the concatenated data. The calculation formula is: MAC_Node = MAC(K_Session, R_BCM||R_Node). This vehicle authentication code proves that the node has K_Master (because without it, K_Session cannot be generated correctly) and also proves that it has correctly received R_BCM. The calculation method of the vehicle authentication code is common knowledge in the field and will not be elaborated here.

[0055] Step 110: Generate an authentication response in response to the vehicle authentication code and vehicle key.

[0056] An authentication response is the information sent by the vehicle node to the body control module to request the establishment of communication. The method for generating the authentication response is common knowledge to those skilled in the art and will not be elaborated here.

[0057] Step 111: Control the preset vehicle node to send the authentication response to the preset control device.

[0058] The protocol dynamically generates vehicle keys and control keys at the vehicle node and body control module respectively, and combines the vehicle keys and control keys to dynamically generate session keys, realizing "one key per voice call", which greatly improves the security of communication. Even if a session key is cracked, it will not affect the security of the master key or other communication sessions.

[0059] Reference Figure 2 Data exchange methods include: Step 200: Determine the information type based on the vehicle body information.

[0060] Information type refers to the categories used to classify vehicle information, such as safety information, general information, and non-safety information. Safety information refers to information related to vehicle safety, such as braking commands; general information refers to information used to control the vehicle, such as interior light control; and non-safety information refers to information used for in-vehicle communication, such as status broadcasts. The information type corresponding to the vehicle information can be found in the type correspondence table, which is a data table that records different vehicle information and their corresponding information types.

[0061] Step 201: When the information type is consistent with the preset safety information, a freshness value is generated in response to the vehicle information.

[0062] The fact that the information type is consistent with the security information means that the vehicle information needs to be authenticated and encrypted to reduce the possibility of information tampering. The freshness value (FV) is a value generated by the information sender (BCM / ECU) to prevent information replay. The freshness value can be generated by a unidirectionally increasing counter. The method of generating the freshness value is common knowledge to those in the field and will not be elaborated here.

[0063] Step 202: Calculate the sending authentication code by combining the vehicle information, freshness value and session key.

[0064] The MAC (Message Authentication Code) is a MAC value calculated by the message sender based on vehicle information, freshness value, and session key. It is calculated using the formula MAC_Data=MAC(K_Session, Plaintext||FV). The calculation method of the MAC is common knowledge in the field and will not be elaborated here.

[0065] Step 203: Generate and send a security message based on the vehicle information, freshness value, and document authentication code.

[0066] A safety message is a complete message that the sender combines the original vehicle information, freshness value, and message authentication code into a single message. The safety message can be sent to the receiver (ECU / BCM) via the vehicle network (such as CAN bus). The method for generating safety messages is common knowledge to those in the field and will not be elaborated here.

[0067] A message hierarchy approach is used to select safety information related to driving safety from the information, and authentication codes are calculated for the safety information for authentication and encryption, thereby reducing computational complexity and bus load, and improving the security of the vehicle network.

[0068] Data exchange methods also include: Step 204: Receive the security message.

[0069] The information receiver receives and parses security messages from the vehicle network (such as the CAN bus).

[0070] Step 205: Extract vehicle information, freshness value and document authentication code from the security message.

[0071] The security message contains vehicle information, freshness value, and document authentication code. The methods for extracting vehicle information, freshness value, and document authentication code are common knowledge to those in the field and will not be elaborated here.

[0072] Step 206: When the freshness value is greater than the preset historical value, calculate the message authentication code by combining the vehicle information, the freshness value and the session key.

[0073] Historical value refers to the old value of the stored freshness value. The historical value is preset by the staff and will not be elaborated here.

[0074] The MAC Receiver is a MAC value calculated by the recipient based on vehicle information, freshness value, and session key. It is calculated using the formula MAC_Receiver=MAC(K_Session, Plaintext||FV). The calculation method of the MAC is common knowledge in the field and will not be elaborated here.

[0075] Step 207: If the sending authentication code and receiving authentication code do not match, discard the security message.

[0076] If the sending authentication code and the receiving authentication code do not match, it means that the security message is either forged, damaged or maliciously modified during transmission. In this case, the information receiver must consider the message invalid and discard it.

[0077] Step 208: If the posting authentication code and the receiving authentication code are the same, update the historical value based on the freshness value.

[0078] The consistency between the sending authentication code and the receiving authentication code indicates that the secure message indeed originated from a legitimate sender of the shared K_Session (authenticity) and has not been tampered with in any way during transmission (integrity). At this point, the message is considered secure and reliable, and the vehicle information it contains can be securely submitted to the upper-layer application for processing. The information receiver will then update its internally stored history value to a freshness value to prevent information replay.

[0079] The sender uses a monotonically increasing counter as a fresh value instead of complex random numbers or timestamps to send information synchronously. The receiver can verify the continuity of the counter to determine whether there is information replay, thereby reducing information replay with less network overhead.

[0080] Reference Figure 3 Leakage identification methods include: Step 300: If the sending authentication code and receiving authentication code are consistent, determine the control action based on the security message.

[0081] Control actions refer to the control behaviors of vehicle nodes based on vehicle information contained in safety messages such as unlocking doors and starting the engine. The methods for identifying control actions are common knowledge to those in the field and will not be elaborated here.

[0082] Step 301: Determine the action range based on the control action, and determine the control node based on the security message.

[0083] An action range refers to the range of working states within which an onboard node can correctly respond to vehicle information and perform control actions. For example, when the control action is to unlock a door, the door lock state of the onboard node needs to be closed. The action range corresponding to the control action can be found in the action correspondence table, which is a data table that records different control actions and their corresponding action ranges.

[0084] The control node is the on-board node that needs to be specifically controlled for vehicle body information such as doors and engine. The method for determining the control node is common knowledge to those in the field and will not be elaborated here.

[0085] Step 302: Retrieve the work record in response to the control node.

[0086] Work records refer to the historical records of the working status of control nodes, such as opening and closing status. The work records corresponding to the control nodes can be retrieved from the record correspondence table, which is a data table that records different control nodes and their corresponding work records.

[0087] Step 303: Determine the work status from the work record.

[0088] The working state is the current state of the control node. The method for determining the working state is common knowledge to those in the field and will not be elaborated here.

[0089] Step 304: When the working state does not fall within the action range, discard the security message, and generate and display control confirmation information in response to the control node and control action.

[0090] If the working state does not fall within the action range, it means that the control node is unable to respond to the control action correctly. At this time, ignore the vehicle information and ask the staff whether to force the control action. The control confirmation information is the information to confirm the control node and the control action with the staff. The method of generating the control confirmation information is common knowledge in the field and will not be described in detail here.

[0091] Upon receiving vehicle body information, the system extracts the control actions from the vehicle body information and checks the working status of the vehicle node to determine whether the vehicle node can execute the control actions. If the vehicle node cannot execute the control actions, the system determines that the vehicle body information is invalid and discards the security message to reduce the possibility of session key leakage.

[0092] Leakage identification methods also include: Step 305: When the working state falls into the action range, determine the control frequency from the work record based on the control action.

[0093] The fact that the working state falls within the action range means that the vehicle node can correctly respond to the control action. The control frequency refers to the frequency of the occurrence of control actions in the work record. That is, the control frequency is calculated by counting the number of control actions in the work record and then calculating the quotient of the number of control actions and the total number of actions in all actions in the work record.

[0094] Step 306: Determine a continuous threshold in response to the control frequency, and determine the actual interval from the work record based on the control action.

[0095] The continuous threshold refers to the minimum time interval between consecutive occurrences of control actions. The higher the control frequency, the smaller the continuous threshold. The continuous threshold corresponding to the control frequency can be found in the continuous correspondence table, which is a data table that records different control frequencies and their corresponding continuous thresholds.

[0096] Step 307: If the actual interval is lower than the continuous threshold, determine the anomaly count in response to the security message.

[0097] An actual interval below the continuous threshold indicates that the frequency of control actions is too high. At this time, it is judged that there is a risk of session key leakage. The abnormal count is the count of the actual interval below the continuous threshold. The method for determining the abnormal count is common knowledge to those in the art and will not be elaborated here.

[0098] Step 308: When the anomaly count is greater than a preset anomaly threshold, an anomaly message is determined based on the anomaly count.

[0099] The anomaly threshold is an anomaly count value used to determine whether a session key has been leaked. A count of 5 is typically used. This threshold is preset by staff and will not be elaborated upon here. An anomaly count greater than the threshold indicates that the session key has been leaked. Abnormal messages are all security messages whose actual intervals are below the consecutive threshold. The method for retrieving abnormal messages is common knowledge in this field and will not be described further.

[0100] Step 309: In response to the generation of the abnormal message, display a key leakage prompt.

[0101] A key leakage alert is a message displayed to staff indicating that the session key has been leaked. The method for generating a key leakage alert is common knowledge in the field and will not be elaborated here.

[0102] Upon receiving vehicle information, the system retrieves the work records of controlling the vehicle nodes to calculate the control frequency of the control actions recorded in the work records. If the control frequency is too high, it is determined that there is a risk of session key leakage, and staff are promptly notified to improve the security of the vehicle network.

[0103] Leakage identification methods also include: Step 310: When the anomaly count is not greater than the preset anomaly threshold, retrieve the historical key.

[0104] An anomaly count not exceeding the anomaly threshold indicates that it is impossible to determine whether the session key has been leaked. Historical keys refer to session keys that have been used in the past. The method for retrieving historical keys is common knowledge to those in the field and will not be elaborated here.

[0105] Step 311: Determine the overlap frequency by combining the historical key and the session key.

[0106] Overlap frequency refers to the frequency with which a session key appears in historical keys. It can be calculated by counting the number of overlaps between a session key and historical keys, and then taking the quotient of the number of overlaps and the total number of historical keys as the overlap frequency.

[0107] Step 312: If the overlap frequency is greater than a preset high-frequency threshold, control the preset control device and the vehicle node to disconnect from communication, and retrieve the abandoned key based on the session key.

[0108] The high-frequency threshold refers to the minimum overlap frequency of repeated occurrences of the session key. The high-frequency threshold is preset by the staff and will not be elaborated here. If the overlap frequency is greater than the high-frequency threshold, it means that the session key is appearing frequently. At this time, it is determined that the session key has been leaked, and the communication between the vehicle node and the body control module is disconnected to reset the session key. The abandoned key refers to the control key and vehicle key corresponding to the session key. The method for retrieving the abandoned key is common knowledge to those in the field and will not be elaborated here.

[0109] Step 313: Update the vehicle key and control key based on the discarded key.

[0110] Upon receiving vehicle information, the system compares the session key used for the vehicle information with the historical key. If the session key is repeated too frequently in the historical key, it is determined that there is a risk of session key leakage. The system then controls the vehicle node and the vehicle control module to disconnect communication to reset the session key and selects different vehicle keys and control keys to reduce the occurrence of session key duplication.

[0111] Optionally, it also includes a leakage prevention method, the leakage prevention method comprising: Step 400: If the sending authentication code and receiving authentication code are consistent, determine the action duration according to the control action, and retrieve the power supply curve from the control node.

[0112] Action duration refers to the time required for a control node to perform an action according to the control action. The action duration corresponding to the control action can be found in the duration correspondence table, which is a data table that records different control actions and their corresponding action durations.

[0113] The power supply curve is a curve showing how the power supply voltage to the control node changes over time. The method for determining the power supply curve is common knowledge to those in the field and will not be elaborated here.

[0114] Step 401: Determine the power consumption from the power supply curve based on the action duration, and determine the action energy consumption based on the control action.

[0115] Power supply energy consumption refers to the total power consumption of the control node during the operation duration. The calculation method for power supply energy consumption is common knowledge among those skilled in the art and will not be elaborated here. Action energy consumption refers to the minimum energy consumption required for the control node to perform a control action. The action energy consumption corresponding to the control action can be found from the energy consumption correspondence table, which is a data table that records different control actions and their corresponding action energy consumption.

[0116] Step 402: Determine the energy consumption ratio by combining the power supply energy consumption and the operation energy consumption.

[0117] The energy consumption ratio is a value used to show the difference between power supply energy consumption and action energy consumption. The difference between power supply energy consumption and action energy consumption can be calculated as the energy consumption difference, and the quotient of the energy consumption difference and action energy consumption can be calculated as the energy consumption ratio.

[0118] Step 403: When the energy consumption ratio is greater than the preset fluctuation threshold, the preset control device and control node are disconnected from communication, and the control node generates and displays a node tampering prompt in response to the control node.

[0119] The fluctuation threshold refers to the maximum proportion of energy consumption fluctuations that a control node is prone to when executing control actions. This threshold is preset by staff and will not be elaborated upon here. An energy consumption ratio exceeding the fluctuation threshold indicates an anomaly in the control node's energy consumption, suggesting a risk of tampering. The node tampering alert displays information about the vehicle-mounted node with abnormal energy consumption to staff. The method for generating this alert is common knowledge in the field and will not be detailed here.

[0120] The power consumption of the same control actions of the vehicle nodes is similar. After receiving the vehicle information, the power consumption of the vehicle node is calculated. When the power consumption is abnormal, it is determined that the vehicle node is at risk of being tampered with. The vehicle control module and the vehicle node are then disconnected from each other to reduce the possibility that the tampered vehicle node will continue to tamper with the vehicle network.

[0121] Leakage prevention methods also include: Step 404: When the energy consumption ratio is not greater than the preset fluctuation threshold, determine the pulse characteristics according to the control action.

[0122] An energy consumption ratio not exceeding the fluctuation threshold indicates that the energy consumption of the control node is normal. Pulse characteristics refer to the pulse current characteristics generated on the power supply curve when the control node executes a control action. For example, the control action of "sending a CAN data frame" corresponds to three pulse characteristics, which come from the ID sending, data sending, and CRC verification stages, respectively. The pulse characteristics corresponding to the control action can be found from the pulse correspondence table, which is a data table that records different control actions and their corresponding pulse characteristics.

[0123] Step 405: Identify the pulse characteristics from the power supply curve based on the action duration.

[0124] The method for identifying pulse features on the power supply curve within the duration of the action is common knowledge to those skilled in the art and will not be elaborated here.

[0125] Step 406: When the pulse characteristic exists in the power supply curve, determine the pulse timing based on the pulse characteristic, and determine the control timing by combining the pulse characteristic and the control action.

[0126] The presence of pulse characteristics in the power supply curve indicates that the power supply curve contains all pulse characteristics. Pulse timing refers to the order in which pulse characteristics appear on the power supply curve. The method for determining pulse timing is common knowledge to those skilled in the art and will not be elaborated here.

[0127] Control timing refers to the order in which pulse characteristics appear when a control node executes a control action. The control timing corresponding to the pulse characteristics and control actions can be found in the timing correspondence table, which is a data table that records different pulse characteristics and control actions and their corresponding control timing.

[0128] Step 407: If the pulse timing is inconsistent with the control timing, the control device and control node of the preset control are disconnected from communication, and the control node generates and displays a node tampering prompt in response to the control node.

[0129] Inconsistency between pulse timing and control timing indicates that the pulse characteristics of the control node are inaccurate, meaning that the control node is at risk of being tampered with.

[0130] Vehicle-mounted nodes tend to emit pulse characteristics in the same sequence for the same control action. When vehicle information is received, the system identifies whether there are pulse characteristics in the correct sequence in the power supply curve of the vehicle-mounted node. If the pulse characteristics are missing or the sequence is incorrect, it is determined that there is a risk of tampering with the vehicle-mounted node.

[0131] Based on the same inventive concept, embodiments of the present invention provide a secure communication system for vehicle network, comprising: The data acquisition module is used to collect vehicle body information; A memory for storing programs for any of the aforementioned secure communication methods for vehicle network; The processor is the unit of memory that allows programs to be loaded and executed by the processor.

[0132] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0133] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A secure communication method for vehicle network, characterized in that, include: Step 100: Collect vehicle body information; Step 101: Generate a control key in response to the vehicle information; Step 102: Generate an authentication request based on the control key; Step 103: Control the preset control device to send the authentication request to the preset vehicle node, and receive the authentication response based on the authentication request; Step 104: Determine the vehicle authentication code and vehicle key based on the authentication response; Step 105: Calculate the control authentication code by combining the vehicle key, control key, and preset shared key; Step 106: When the control authentication code matches the vehicle authentication code, the preset control device and the vehicle node establish communication.

2. The secure communication method for vehicle network according to claim 1, characterized in that, The method for generating the authentication response includes: Step 107: Control the preset vehicle node to generate a vehicle key in response to the authentication request; Step 108: Generate a session key by combining the control key, vehicle key, and preset shared key; Step 109: Calculate the vehicle authentication code based on the control key, vehicle key, and session key; Step 110: Generate an authentication response in response to the vehicle authentication code and vehicle key; Step 111: Control the preset vehicle node to send the authentication response to the preset control device.

3. A secure communication method for vehicle network according to claim 2, characterized in that, It also includes a data exchange method, which includes: Step 200: Determine the information type based on the vehicle body information; Step 201: When the information type is consistent with the preset safety information, a freshness value is generated in response to the vehicle information; Step 202: Calculate the sending authentication code by combining the vehicle information, freshness value, and session key; Step 203: Generate and send a security message based on the vehicle information, freshness value, and document authentication code.

4. A secure communication method for vehicle network according to claim 3, characterized in that, The data exchange method further includes: Step 204: Receive the security message; Step 205: Extract vehicle information, freshness value, and document authentication code from the security message; Step 206: When the freshness value is greater than the preset historical value, calculate the message authentication code by combining the vehicle information, the freshness value and the session key; Step 207: If the sending authentication code and the receiving authentication code do not match, discard the security message; Step 208: If the posting authentication code and the receiving authentication code are the same, update the historical value based on the freshness value.

5. A secure communication method for vehicle network according to claim 4, characterized in that, It also includes a leakage identification method, which includes: Step 300: If the sending authentication code and receiving authentication code are consistent, determine the control action based on the security message; Step 301: Determine the action range based on the control action, and determine the control node based on the security message; Step 302: Retrieve the work record in response to the control node; Step 303: Determine the work status from the work record; Step 304: When the working state does not fall within the action range, discard the security message, and generate and display control confirmation information in response to the control node and control action.

6. A secure communication method for vehicle network according to claim 5, characterized in that, The leakage identification method further includes: Step 305: When the working state falls into the action range, determine the control frequency from the work record based on the control action; Step 306: Determine a continuous threshold in response to the control frequency, and determine the actual interval from the work record based on the control action; Step 307: If the actual interval is lower than the continuous threshold, determine the anomaly count in response to the security message; Step 308: When the anomaly count is greater than a preset anomaly threshold, an anomaly message is determined based on the anomaly count; Step 309: In response to the generation of the abnormal message, display a key leakage prompt.

7. A secure communication method for vehicle network according to claim 6, characterized in that, The leakage identification method further includes: Step 310: When the anomaly count is not greater than the preset anomaly threshold, retrieve the historical key; Step 311: Determine the overlap frequency by combining the historical key and the session key; Step 312: If the overlap frequency is greater than a preset high-frequency threshold, control the preset control device and the vehicle node to disconnect from communication, and retrieve the abandoned key based on the session key; Step 313: Update the vehicle key and control key based on the discarded key.

8. A secure communication method for vehicle network according to claim 5, characterized in that, It also includes leakage prevention methods, which include: Step 400: If the sending authentication code and receiving authentication code are consistent, determine the action duration according to the control action, and retrieve the power supply curve from the control node; Step 401: Determine the power consumption from the power supply curve based on the action duration, and determine the action energy consumption based on the control action; Step 402: Determine the energy consumption ratio by combining the power supply energy consumption and the operation energy consumption; Step 403: When the energy consumption ratio is greater than the preset fluctuation threshold, the preset control device and control node are disconnected from communication, and the control node generates and displays a node tampering prompt in response to the control node.

9. A secure communication method for vehicle network according to claim 8, characterized in that, The leakage prevention method also includes: Step 404: When the energy consumption ratio is not greater than the preset fluctuation threshold, determine the pulse characteristics according to the control action; Step 405: Identify the pulse characteristics from the power supply curve based on the action duration; Step 406: When the pulse characteristic exists in the power supply curve, determine the pulse timing based on the pulse characteristic, and determine the control timing by combining the pulse characteristic and the control action; Step 407: If the pulse timing is inconsistent with the control timing, the control device and control node of the preset control are disconnected from communication, and the control node generates and displays a node tampering prompt in response to the control node.

10. A secure communication system for vehicle network, characterized in that, include: The data acquisition module is used to collect vehicle body information; A memory for storing a program for a secure communication method for a vehicle network as described in any one of claims 1 to 9; The processor is the unit of memory that allows programs to be loaded and executed by the processor.

Images