A secure communication method and system for a vehicle body network

Abstract

The application relates to a security communication method and system for a vehicle body network, and relates to the field of the vehicle body network, which comprises the following steps: 100, collecting vehicle body information; 101, generating a control key in response to the vehicle body information; 102, generating an authentication request based on the control key; 103, controlling preset control devices to send the authentication request to preset vehicle-mounted nodes, and receiving an authentication response based on the authentication request; 104, determining a vehicle-mounted authentication code and a vehicle-mounted key based on the authentication response; 105, calculating a control authentication code in combination with the vehicle-mounted key, the control key and a preset shared key; and 106, when the control authentication code is consistent with the vehicle-mounted authentication code, controlling preset control devices and vehicle-mounted nodes to establish communication. The application has the effects of improving the security of the vehicle body network and enabling fast communication under the condition that the vehicle body control module and vehicle body network resources are limited.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of vehicle body networks, in particular to a secure communication method and system for a vehicle body network. BACKGROUND

[0002] A vehicle body network is a distributed communication system formed by connecting all electronic devices (such as controllers, sensors, actuators) inside a vehicle through a standardized communication bus.

[0003] In the prior art, traditional vehicle-mounted bus protocols such as Controller Area Network (CAN) and Local Interconnect Network (LIN) do not fully consider information security requirements at the design stage. These protocols are essentially broadcast-based communication based on trust, lacking built-in source authentication, message integrity verification and data encryption mechanisms. This inherent defect makes the vehicle network extremely vulnerable to various network attacks, such as message forgery, data tampering and replay attacks.

[0004] In the vehicle body control domain, an attacker may inject malicious instructions to illegally control vehicle doors, windows, lights and other functions, posing a direct threat to vehicle functional safety and the personal and property safety of drivers and passengers. Existing solutions generally directly transplant encryption algorithms (such as AES) from the IT field to protect against network attacks.

[0005] Vehicle body control modules (vehicle body control modules) have limited computing resources, and directly using encryption algorithms from the IT field may result in communication delays, thereby preventing the protection effect of network attacks from meeting real-time requirements. SUMMARY

[0006] In order to improve the security of the vehicle body network and enable fast communication in a vehicle body control module and vehicle body network resource-limited environment, the present application provides a secure communication method and system for a vehicle body network.

[0007] In a first aspect, the present application provides a secure communication method for a vehicle body network, which adopts the following technical solution:

[0008] A secure communication method for a vehicle body network, comprising:

[0009] Step 100: Collecting vehicle body information;

[0010] Step 101: Generating a control key in response to the vehicle body information;

[0011] Step 102: Generating an authentication request based on the control key;

[0012] Step 103: Controlling a preset control device to send the authentication request to a preset vehicle-mounted node, and receiving an authentication response based on the authentication request;

[0013] Step 104: determining an on-board authentication code and an on-board key based on the authentication response;

[0014] Step 105: calculating a control authentication code in combination with the on-board key, a control key and a preset shared key;

[0015] Step 106: establishing communication between the preset control device and the on-board node when the control authentication code is consistent with the on-board authentication code.

[0016] By adopting the technical scheme, the whole authentication and key establishment process can be completed through only one request-response interaction, which maximally reduces network overhead and start-up delay, so as to realize fast communication in the environment where the body control module and body network resource are limited, and further improve the security of the body network.

[0017] Optionally, the method for generating the authentication response comprises:

[0018] Step 107: generating the on-board key by the preset on-board node in response to the authentication request;

[0019] Step 108: generating a session key in combination with the control key, the on-board key and the preset shared key;

[0020] Step 109: calculating the on-board authentication code according to the control key, the on-board key and the session key;

[0021] Step 110: generating the authentication response in response to the on-board authentication code and the on-board key;

[0022] Step 111: sending the authentication response to the preset control device by the preset on-board node.

[0023] By adopting the technical scheme, the protocol dynamically generates the on-board key and the control key at the on-board node and the body control module respectively, and dynamically generates the session key in combination with the on-board key and the control key, so as to realize "one session one key", and greatly improve the security of communication. Even if a session key is cracked, the security of the master key or other communication sessions will not be affected.

[0024] Optionally, the method further comprises a data exchange method, and the data exchange method comprises:

[0025] Step 200: determining an information type according to the body information;

[0026] Step 201: generating a freshness value in response to the body information when the information type is consistent with preset security information;

[0027] Step 202: calculating a sending authentication code in combination with the body information, the freshness value and the session key;

[0028] Step 203: generating and sending a security message based on the vehicle body information, the freshness value and the sending authentication code.

[0029] By using the above technical solution, the safety information related to driving safety in the information is selected by using the message classification method, and the authentication code of the safety information is calculated for authentication and encryption, so as to reduce the complexity of calculation and the bus load, and improve the security of the vehicle body network.

[0030] Optionally, the data exchange method further comprises:

[0031] Step 204: receiving the security message;

[0032] Step 205: extracting the vehicle body information, the freshness value and the sending authentication code from the security message;

[0033] Step 206: when the freshness value is greater than the preset history value, calculating a receiving authentication code in combination with the vehicle body information, the freshness value and the session key;

[0034] Step 207: if the sending authentication code and the receiving authentication code are inconsistent, discarding the security message;

[0035] Step 208: if the sending authentication code and the receiving authentication code are consistent, updating the history value based on the freshness value.

[0036] By using the above technical solution, the communication sender uses a monotonically increasing counter as a freshness value to replace a complex random number or a time stamp for information synchronization, and the receiver can verify the continuity of the counter to determine whether there is information replay, so as to reduce the information replay under the premise of occupying small network overhead.

[0037] Optionally, it further comprises a leakage identification method, and the leakage identification method comprises:

[0038] Step 300: if the sending authentication code and the receiving authentication code are consistent, determining a control action based on the security message;

[0039] Step 301: determining an action interval according to the control action, and determining a control node based on the security message;

[0040] Step 302: responding to the control node to call a work record;

[0041] Step 303: determining a work state from the work record;

[0042] Step 304: when the work state does not fall into the action interval, discarding the security message, and generating and displaying control confirmation information in response to the control node and the control action.

[0043] By adopting the technical scheme, when the vehicle body information is received, the control action in the vehicle body information is extracted, and the working state of the vehicle-mounted node is checked, so as to determine whether the vehicle-mounted node can execute the control action, and further determine that the vehicle body information is invalid when the vehicle-mounted node cannot execute the control action, and discard the safety message to reduce the situation of session key leakage.

[0044] Optionally, the leakage identification method further comprises:

[0045] Step 305: When the working state falls into the action interval, determining the control frequency from the working record based on the control action;

[0046] Step 306: Determining the continuous threshold in response to the control frequency, and determining the actual interval from the working record based on the control action;

[0047] Step 307: If the actual interval is lower than the continuous threshold, determining the abnormal count in response to the safety message;

[0048] Step 308: When the abnormal count is greater than a preset abnormal threshold, determining the abnormal message based on the abnormal count;

[0049] Step 309: Generating and displaying a key leakage prompt in response to the abnormal message.

[0050] By adopting the technical scheme, when the vehicle body information is received, the working record for controlling the vehicle-mounted node is called, so as to calculate the control frequency of the control action in the working record, and determine that there is a risk of session key leakage when the control frequency is too high, and further timely notify the staff to improve the security of the vehicle body network.

[0051] Optionally, the leakage identification method further comprises:

[0052] Step 310: When the abnormal count is not greater than a preset abnormal threshold, calling a historical key;

[0053] Step 311: Determining the coincidence frequency in combination with the historical key and the session key;

[0054] Step 312: If the coincidence frequency is greater than a preset high-frequency threshold, controlling the preset control device and the vehicle-mounted node to disconnect communication, and calling a discarded key based on the session key;

[0055] Step 313: Updating the vehicle-mounted key and the control key based on the discarded key.

[0056] By adopting the technical scheme, when the vehicle body information is received, the session key used by the vehicle body information is compared with the historical key, so that when the frequency of repetition of the session key in the historical key is too high, it is judged that the session key has a risk of leakage, and then the vehicle-mounted node and the vehicle body control module are controlled to disconnect the communication to reset the session key, and different vehicle-mounted keys and control keys are selected to reduce the repetition of the session key.

[0057] Optionally, the anti-leakage method further comprises:

[0058] Step 400: If the sending authentication code and the receiving authentication code are consistent, the action duration is determined according to the control action, and the power supply curve is called from the control node;

[0059] Step 401: The power consumption is determined from the power supply curve based on the action duration, and the action energy consumption is determined according to the control action;

[0060] Step 402: The energy consumption ratio is determined in combination with the power consumption and the action energy consumption;

[0061] Step 403: When the energy consumption ratio is greater than the preset fluctuation threshold, the preset control device and the control node are controlled to disconnect the communication, and the node tampering prompt is generated and displayed in response to the control node.

[0062] By adopting the technical scheme, the power consumption of the same control action of the vehicle-mounted node is similar, the power consumption of the vehicle-mounted node is calculated after the vehicle body information is received, so that when the power consumption is abnormal, it is judged that the vehicle-mounted node has a tampering risk, and the vehicle body control module and the vehicle-mounted node are controlled to disconnect the communication to reduce the case that the tampered vehicle-mounted node continues to tamper with the vehicle body network.

[0063] Optionally, the anti-leakage method further comprises:

[0064] Step 404: When the energy consumption ratio is not greater than the preset fluctuation threshold, the pulse feature is determined according to the control action;

[0065] Step 405: The pulse feature is identified from the power supply curve based on the action duration;

[0066] Step 406: When the pulse feature exists in the power supply curve, the pulse timing is determined based on the pulse feature, and the control timing is determined in combination with the pulse feature and the control action;

[0067] Step 407: If the pulse timing is inconsistent with the control timing, the preset control device and the control node are controlled to disconnect the communication, and the node tampering prompt is generated and displayed in response to the control node.

[0068] By adopting the technical scheme, the vehicle-mounted nodes are prone to send the same sequence of pulse features for the same control action, and whether the correct sequence of pulse features exists in the power supply curve of the vehicle-mounted node is identified after receiving the vehicle body information, and the vehicle-mounted node is determined to have tampering risk when the pulse features are missing or the sequence is incorrect.

[0069] In a second aspect, the application provides a secure communication system for a vehicle body network, which adopts the following technical scheme:

[0070] A secure communication system for a vehicle body network comprises:

[0071] A collection module is configured to collect vehicle body information.

[0072] A memory is configured to store a program of any of the secure communication methods for a vehicle body network.

[0073] A processor, and the program in the memory can be loaded and executed by the processor.

[0074] By adopting the technical scheme, the entire authentication and key establishment process can be completed through only one request-response interaction, thereby minimizing network overhead and start-up delay, so that fast communication can be achieved in a vehicle body control module and vehicle body network resource limited environment, and the security of the vehicle body network is improved.

[0075] In summary, the application includes at least one of the following beneficial technical effects:

[0076] The entire authentication and key establishment process can be completed through only one request-response interaction, thereby minimizing network overhead and start-up delay, so that fast communication can be achieved in a vehicle body control module and vehicle body network resource limited environment, and the security of the vehicle body network is improved.

[0077] The protocol dynamically generates a vehicle-mounted key and a control key at the vehicle-mounted node and the vehicle body control module respectively, and dynamically generates a session key in combination with the vehicle-mounted key and the control key, thereby achieving "one session one key", greatly improving the security of communication, and even if a session key is cracked, the security of the master key or other communication sessions will not be affected.

[0078] The message hierarchical method is adopted to select the safety information related to driving safety in the information, and the safety information is authenticated and encrypted by authentication code calculation, thereby reducing the complexity of calculation and bus load, and improving the security of the vehicle body network. BRIEF DESCRIPTION OF DRAWINGS

[0079] Figure 1 is a flowchart of a secure communication method for a vehicle body network;

[0080] Figure 2 is a flowchart of a data exchange method;

[0081] Figure 3 is a flow chart of a leakage identification method. DETAILED DESCRIPTION

[0082] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0083] Referring to Figure 1 A secure communication method for a vehicle body network, comprising:

[0084] Step 100: collecting vehicle body information.

[0085] The vehicle body information (plaintext) refers to information sent by all electronic devices (such as controllers, sensors, actuators) inside the vehicle in the vehicle body network, i.e. messages transmitted between the vehicle body control module (BCM) and the vehicle nodes (ECU, i.e. other electronic devices inside the vehicle) in the vehicle body network. When the vehicle body information is collected, it means that the vehicle nodes and the vehicle body control module need to establish communication. The collection method of the vehicle body information is selected by the staff according to the actual situation, which is not described here.

[0086] Step 101: generating a control key in response to the vehicle body information.

[0087] The control key (R_BCM) refers to an unpredictable high-quality random number generated by the vehicle body control module. The generation method of the control key is well known in the art, which is not described here.

[0088] Step 102: generating an authentication request based on the control key.

[0089] The authentication request refers to information sent by the vehicle body control module to the vehicle node for requesting to establish communication. The generation method of the authentication request is well known in the art, which is not described here.

[0090] Step 103: sending the authentication request to a predetermined vehicle node by controlling a predetermined control device, and receiving an authentication response based on the authentication request.

[0091] The authentication response refers to information sent by the vehicle node to the vehicle body control module for requesting to establish communication. The authentication response contains the vehicle authentication code and the vehicle key. The generation method of the authentication response is described below in steps 107 to 111.

[0092] Step 104: determining the vehicle authentication code and the vehicle key based on the authentication response.

[0093] The vehicle-mounted key (R_Node) is a unpredictable high-quality random number generated by the vehicle-mounted node. The generation method of the control key is well known to those skilled in the art, and will not be described here.

[0094] The vehicle-mounted authentication code (MAC_Node) is a MAC value calculated by the vehicle-mounted node based on the vehicle-mounted key and the control key. The calculation method of the vehicle-mounted authentication code is described below in steps 107 to 109, and will not be described here.

[0095] Step 105: Calculate the control authentication code in combination with the vehicle-mounted key, the control key and the preset shared key.

[0096] The shared key (K_Master) is a long-term shared master key pre-stored in the vehicle-mounted node and the body control module. Generally, a 128-bit symmetric key is used as the shared key. The shared key is pre-stored in a hardware security module (HSM) or a secure memory, and is pre-input by a worker, and will not be described here.

[0097] The control authentication code (MAC_BCM) is a MAC value calculated by the body control module based on the vehicle-mounted key and the control key. The calculation method of the vehicle-mounted authentication code is described below in steps 107 to 109, and will not be described here.

[0098] Step 106: When the control authentication code and the vehicle-mounted authentication code are consistent, the control device and the vehicle-mounted node establish communication.

[0099] The control device is a device for controlling the vehicle, which in this embodiment is the body control module (BCM) described above. The control device is selected by a worker according to the actual situation, and will not be described here.

[0100] The consistency of the control authentication code and the vehicle-mounted authentication code means that the body control module confirms that the vehicle-mounted node is legal, and that both parties have successfully and independently negotiated a common session key. Thereafter, both parties can enter the secure data exchange phase.

[0101] If the two are not matched, it means that the authentication fails, the body control module considers that the node is not trusted or the communication process is wrong, and immediately terminates this session, and will not use the derived session key.

[0102] The entire authentication and key establishment process can be completed with only one request-response interaction, which maximally reduces network overhead and start-up delay, so as to enable fast communication in the environment of limited body control module and body network resources, and further improve the security of the body network.

[0103] The generation method of the authentication response comprises:

[0104] Step 107: controlling the preset vehicle-mounted node to generate a vehicle-mounted key in response to the authentication request.

[0105] The vehicle-mounted key (R_Node) refers to an unpredictable high-quality random number generated by the vehicle-mounted node. The generation method of the control key is well known to those skilled in the art, and will not be described here.

[0106] Step 108: generating a session key in combination with the control key, the vehicle-mounted key, and a preset shared key.

[0107] The session key (K_Session) refers to a temporary key calculated by the vehicle-mounted node using a key derivation function. The calculation formula can be expressed as: K_Session = KDF (K_Master, R_BCM, R_Node). The KDF can be constructed based on standard algorithms such as HMAC, ensuring that the same key is always derived from the same input, and that K_Master cannot be inferred from K_Session.

[0108] Step 109: calculating a vehicle-mounted authentication code according to the control key, the vehicle-mounted key, and the session key.

[0109] The vehicle-mounted authentication code (MAC_Node) refers to the vehicle-mounted node concatenating the control key and the vehicle-mounted key (e.g., R_BCM || R_Node), and then using the session key as the key to calculate the MAC value of the concatenated data. The calculation formula is: MAC_Node = MAC (K_Session, R_BCM || R_Node). This vehicle-mounted authentication code proves that the node has K_Master (because it cannot correctly generate K_Session without it), and also proves that it correctly received R_BCM. The calculation method of the vehicle-mounted authentication code is well known to those skilled in the art, and will not be described here.

[0110] Step 110: generating an authentication response in response to the vehicle-mounted authentication code and the vehicle-mounted key.

[0111] The authentication response refers to the information sent by the vehicle-mounted node to the body control module to request the establishment of communication. The generation method of the authentication response is well known to those skilled in the art, and will not be described here.

[0112] Step 111: controlling the preset vehicle-mounted node to send the authentication response to the preset control device.

[0113] The protocol dynamically generates a vehicle-mounted key and a control key at the vehicle-mounted node and the body control module, respectively, and dynamically generates a session key in combination with the vehicle-mounted key and the control key, achieving "one conversation and one encryption", greatly improving the security of communication. Even if a session key is cracked, it will not affect the security of the master key or other communication sessions.

[0114] Referring to Figure 2 , the data exchange method comprises:

[0115] Step 200: determining an information type according to the vehicle body information.

[0116] The information type refers to a category for classifying the vehicle body information, such as safety information, general information, and non-safety information, wherein the safety information refers to information related to vehicle safety, such as brake instructions, the general information refers to information for controlling the vehicle, such as in-vehicle light control, and the non-safety information refers to information for in-vehicle communication, such as status broadcast. The information type corresponding to the vehicle body information can be queried from a type correspondence table, and the type correspondence table refers to a data table recording different vehicle body information and the information types corresponding thereto.

[0117] Step 201: generating a freshness value in response to the vehicle body information when the information type is consistent with a preset safety information.

[0118] The consistency of the information type with the safety information represents that the vehicle body information needs to be authenticated and encrypted to reduce the case of information tampering, and the freshness value (FV) refers to a value generated by an information sender (BCM / ECU) to avoid information replay. The freshness value can be generated by a unidirectionally increasing counter, and the generation method of the freshness value is well known to those skilled in the art, which is not described here.

[0119] Step 202: calculating a message authentication code based on the vehicle body information, the freshness value, and a session key.

[0120] The message authentication code (MAC_Data) refers to a MAC value calculated by the information sender according to the vehicle body information, the freshness value, and the session key, i.e., a value calculated by using the formula MAC_Data=MAC(K_Session, Plaintext||FV). The calculation method of the message authentication code is well known to those skilled in the art, which is not described here.

[0121] Step 203: generating and sending a safety message based on the vehicle body information, the freshness value, and the message authentication code.

[0122] The safety message refers to a complete message composed of the original vehicle body information, the freshness value, and the message authentication code by the information sender. The safety message can be sent to an information receiver (ECU / BCM) through a vehicle-mounted network (such as a CAN bus), and the generation method of the safety message is well known to those skilled in the art, which is not described here.

[0123] The message classification method is used to select the safety information related to driving safety in the information, and the authentication code calculation is performed on the safety information to perform authentication and encryption, thereby reducing the complexity of calculation and bus load and improving the security of the vehicle body network.

[0124] The data exchange method further comprises:

[0125] Step 204: receiving the security message.

[0126] The information receiver receives the security message from the vehicle network (such as CAN bus) and parses the security message.

[0127] Step 205: extracting the vehicle body information, freshness value and sending authentication code from the security message.

[0128] The security message contains the vehicle body information, freshness value and sending authentication code, and the extraction method of the vehicle body information, freshness value and sending authentication code is well known to those skilled in the art, which will not be described here.

[0129] Step 206: When the freshness value is greater than the preset historical value, the receiving authentication code is calculated in combination with the vehicle body information, freshness value and session key.

[0130] The historical value refers to the old value of the stored freshness value, which is preset by the staff and will not be described here.

[0131] The receiving authentication code (MAC_Receiver) refers to the MAC value calculated by the information receiver according to the vehicle body information, freshness value and session key, that is, the value calculated by the formula MAC_Receiver=MAC(K_Session, Plaintext||FV), and the calculation method of the receiving authentication code is well known to those skilled in the art, which will not be described here.

[0132] Step 207: If the sending authentication code and the receiving authentication code are inconsistent, the security message is discarded.

[0133] The inconsistency of the sending authentication code and the receiving authentication code represents that the security message is either counterfeit, or damaged or maliciously modified in transmission, at which time the information receiver must consider the message as invalid and discard it.

[0134] Step 208: If the sending authentication code and the receiving authentication code are consistent, update the historical value based on the freshness value.

[0135] The consistency of the sending authentication code and the receiving authentication code represents that the security message indeed comes from the legitimate sender sharing K_Session (authenticity), and is not tampered in any form during transmission (integrity). At this time, the message is considered to be safe and reliable, and the vehicle body information contained therein can be safely submitted to the upper layer application for processing, and the information receiver will update the historical value stored in its internal storage to the freshness value to avoid information replay.

[0136] The communication sender uses a monotonically increasing counter as a freshness value instead of a complex random number or timestamp to send information synchronously, and the receiver can determine whether information replay exists by verifying the continuity of the counter, thereby reducing information replay under the premise of occupying small network overhead.

[0137] Referring to Figure 3 , the leakage identification method comprises:

[0138] Step 300: If the sending authentication code and the receiving authentication code are consistent, determine the control action based on the security message.

[0139] The control action refers to the control behavior of the vehicle body information contained in the security message on the vehicle node, such as opening the door lock, starting the engine, etc. The identification method of the control action is well known to those skilled in the art, and will not be repeated here.

[0140] Step 301: Determine the action interval according to the control action, and determine the control node based on the security message.

[0141] The action interval refers to the working state range in which the vehicle node can correctly respond to the vehicle body information and make a control action. For example, when the control action is to open the door lock, the door lock state of the vehicle node needs to be closed. The action interval corresponding to the control action can be queried from the action corresponding table. The action corresponding table refers to a data table recording different control actions and their corresponding action intervals.

[0142] The control node is the vehicle node that needs to be specifically controlled by the vehicle body information such as the vehicle door and the engine. The determination method of the control node is well known to those skilled in the art, and will not be repeated here.

[0143] Step 302: Respond to the control node to call the working record.

[0144] The working record refers to the historical record of the working state of the control node such as the opening and closing condition. The working record corresponding to the control node can be queried from the record corresponding table. The record corresponding table refers to a data table recording different control nodes and their corresponding working records.

[0145] Step 303: Determine the working state from the working record.

[0146] The working state is the current state of the control node. The determination method of the working state is well known to those skilled in the art, and will not be repeated here.

[0147] Step 304: When the working state does not fall into the action interval, discard the security message, and generate and display control confirmation information in response to the control node and the control action.

[0148] The working state not falling into the action interval represents that the control node is difficult to correctly respond to the control action, at this time, the vehicle body information is ignored, and it is inquired whether the control action is forced to be executed, the control confirmation information is information for confirming the control node and the control action to the worker, and a generation method of the control confirmation information is common knowledge of workers in the field, and will not be described here.

[0149] When the vehicle body information is received, the control action in the vehicle body information is extracted, and the working state of the vehicle-mounted node is checked, so as to judge whether the vehicle-mounted node can execute the control action, and further judge that the vehicle body information is invalid when the vehicle-mounted node cannot execute the control action, and discard the safety message to reduce the situation of session key leakage.

[0150] The leakage identification method further comprises:

[0151] Step 305: When the working state falls into the action interval, the control frequency is determined from the working record based on the control action.

[0152] The working state falling into the action interval represents that the vehicle-mounted node can correctly respond to the control action, and the control frequency refers to the occurrence frequency of the control action in the working record, that is, the control quantity of the control action in the working record is counted, and the quotient of the control quantity and the total number of actions in the working record is calculated as the control frequency.

[0153] Step 306: In response to the control frequency, the continuous threshold is determined, and the actual interval is determined from the working record based on the control action.

[0154] The continuous threshold refers to the minimum time interval of continuous occurrence of the control action, and the greater the control frequency, the smaller the continuous threshold. The continuous threshold corresponding to the control frequency can be queried from the continuous correspondence table, and the continuous correspondence table refers to a data table recording different control frequencies and the continuous thresholds corresponding thereto.

[0155] Step 307: If the actual interval is lower than the continuous threshold, the abnormal count is determined in response to the safety message.

[0156] The actual interval being lower than the continuous threshold represents that the frequency of the control action is too high, at this time, it is judged that there is a risk of session key leakage, and the abnormal count is the count of the situation that the actual interval is lower than the continuous threshold. The determination method of the abnormal count is common knowledge of workers in the field, and will not be described here.

[0157] Step 308: When the abnormal count is greater than a preset abnormal threshold, the abnormal message is determined based on the abnormal count.

[0158] The abnormal threshold refers to an abnormal count value for judging whether the session key is leaked, and 5 is generally used as the abnormal count. The abnormal threshold is preset by the staff and will not be described here. The abnormal count greater than the abnormal threshold represents that the session key is leaked. The abnormal message is all security messages with actual intervals lower than the continuous threshold. The method for calling the abnormal message is well known to those skilled in the art and will not be described here.

[0159] Step 309: generating and displaying a key leakage prompt in response to the abnormal message.

[0160] The key leakage prompt refers to information for showing the staff the leakage of the session key. The method for generating the key leakage prompt is well known to those skilled in the art and will not be described here.

[0161] When the vehicle body information is received, the working record for controlling the vehicle-mounted node is called to calculate the control frequency of the control action in the working record, and when the control frequency is too high, it is judged that the session key has a risk of leakage, and the staff is notified in time to improve the security of the vehicle body network.

[0162] The leakage identification method further comprises:

[0163] Step 310: calling a historical key when the abnormal count is not greater than the preset abnormal threshold.

[0164] The abnormal count not greater than the abnormal threshold represents that it is not possible to judge whether the session key is leaked. The historical key refers to a session key that has been used. The method for calling the historical key is well known to those skilled in the art and will not be described here.

[0165] Step 311: determining a coincidence frequency in combination with the historical key and the session key.

[0166] The coincidence frequency refers to a frequency value of the session key appearing in the historical key. The number of coincidences of the session key in the historical key can be counted, and the quotient of the number of coincidences and the historical total number of the historical key is calculated as the coincidence frequency.

[0167] Step 312: if the coincidence frequency is greater than a preset high-frequency threshold, controlling the preset control device and the vehicle-mounted node to disconnect communication, and calling a discarded key based on the session key.

[0168] The high-frequency threshold refers to the minimum coincidence frequency of the repeated appearance of the session key. The high-frequency threshold is preset by the staff and will not be described here. The coincidence frequency greater than the high-frequency threshold represents that the session key appears frequently. At this time, it is judged that the session key is leaked, and the communication between the vehicle-mounted node and the vehicle body control module is disconnected to reset the session key. The discarded key refers to a control key and a vehicle-mounted key corresponding to the session key. The method for calling the discarded key is well known to those skilled in the art and will not be described here.

[0169] Step 313: updating the vehicle-mounted key and control key based on the obsolete key.

[0170] When the vehicle body information is received, the session key used in the vehicle body information is compared with the historical key, so that when the frequency of repetition of the session key in the historical key is too high, it is judged that the session key has a risk of leakage, and then the communication between the vehicle-mounted node and the vehicle body control module is controlled to be disconnected to reset the session key, and different vehicle-mounted keys and control keys are selected to reduce the repetition of the session key.

[0171] Optionally, the anti-leakage method further comprises:

[0172] Step 400: if the sending authentication code and the receiving authentication code are consistent, determining the action duration according to the control action, and calling the power supply curve from the control node.

[0173] The action duration refers to the duration required for the control node to perform the control action, and the action duration corresponding to the control action can be queried from the duration correspondence table. The duration correspondence table refers to a data table recording different control actions and their corresponding action durations.

[0174] The power supply curve refers to the curve of the change of the power supply voltage of the power supply to the control node with time, and the determination method of the power supply curve is known to those skilled in the art, which is not described here.

[0175] Step 401: determining the power supply energy consumption from the power supply curve based on the action duration, and determining the action energy consumption according to the control action.

[0176] The power supply energy consumption refers to the total power consumption of the control node within the action duration, and the calculation method of the power supply energy consumption is known to those skilled in the art, which is not described here. The action energy consumption refers to the minimum energy consumption required for the control node to make the control action, and the action energy consumption corresponding to the control action can be queried from the energy consumption correspondence table. The energy consumption correspondence table refers to a data table recording different control actions and their corresponding action energy consumptions.

[0177] Step 402: determining the energy consumption ratio in combination with the power supply energy consumption and the action energy consumption.

[0178] The energy consumption ratio refers to a numerical value for showing the difference between the power supply energy consumption and the action energy consumption. The difference between the power supply energy consumption and the action energy consumption can be calculated as the energy consumption difference, and the quotient of the energy consumption difference and the action energy consumption can be calculated as the energy consumption ratio.

[0179] Step 403: when the energy consumption ratio is greater than a preset fluctuation threshold, controlling the preset control device and the control node to disconnect the communication, and generating and displaying a node tampering prompt in response to the control node.

[0180] The fluctuation threshold refers to the maximum proportion of energy consumption fluctuation that the control node is prone to generate when performing the control action. The fluctuation threshold is pre-set by the staff and will not be described here. The energy consumption proportion greater than the fluctuation threshold represents that the energy consumption of the control node is abnormal, that is, there is a risk of tampering of the control node. The node tampering prompt is information showing the vehicle-mounted node with abnormal energy consumption to the staff. The generation method of the node tampering prompt is common knowledge in the field and will not be described here.

[0181] The power consumption of the same control action of the vehicle-mounted node is similar. When the vehicle body information is received, the power consumption of the vehicle-mounted node is calculated, so that when the power consumption is abnormal, it is judged that the vehicle-mounted node has a tampering risk, and the vehicle body control module and the vehicle-mounted node are disconnected to reduce the case that the tampered vehicle-mounted node continues to tamper with the vehicle body network.

[0182] The anti-leakage method further comprises:

[0183] Step 404: When the energy consumption proportion is not greater than the pre-set fluctuation threshold, determine the pulse feature according to the control action.

[0184] The energy consumption proportion not greater than the fluctuation threshold represents that the energy consumption of the control node is normal. The pulse feature refers to the pulse current feature generated on the power supply curve when the control node performs the control action. For example, the control action of "sending CAN data frame" corresponds to three pulse features from ID sending, data sending, and CRC verification stage. The pulse feature corresponding to the control action can be queried from the pulse corresponding table. The pulse corresponding table refers to a data table recording different control actions and their corresponding pulse features.

[0185] Step 405: Identify the pulse feature from the power supply curve based on the action duration.

[0186] Identify whether there is a pulse feature on the power supply curve within the action duration. The identification method of the pulse feature is common knowledge in the field and will not be described here.

[0187] Step 406: When the pulse feature exists in the power supply curve, determine the pulse timing based on the pulse feature, and determine the control timing in combination with the pulse feature and the control action.

[0188] The existence of the pulse feature in the power supply curve represents that the power supply curve has all the pulse features. The pulse timing refers to the order in which the pulse features appear on the power supply curve. The determination method of the pulse timing is common knowledge in the field and will not be described here.

[0189] The control timing refers to the order of occurrence of the pulse characteristics when the control node performs the control action. The control timing corresponding to the pulse characteristics and the control action can be obtained from the timing corresponding table. The timing corresponding table refers to a data table recording different pulse characteristics, control actions, and their corresponding control timing.

[0190] Step 407: If the pulse timing is inconsistent with the control timing, the control node is disconnected from the preset control device, and a node tampering prompt is generated and displayed in response to the control node.

[0191] The inconsistency between the pulse timing and the control timing indicates that the pulse characteristics of the control node are inaccurate, i.e., the control node has a risk of tampering.

[0192] The vehicle-mounted nodes are likely to emit the same order of pulse characteristics for the same control action. When the vehicle body information is received, it is identified whether there is a correct order of pulse characteristics in the power supply curve of the vehicle-mounted node. If the pulse characteristics are missing or the order is incorrect, it is determined that the vehicle-mounted node has a risk of tampering.

[0193] Based on the same inventive concept, the embodiments of the present application provide a secure communication system for a vehicle body network, comprising:

[0194] The acquisition module is configured to acquire vehicle body information.

[0195] The memory is configured to store the program of any one of the secure communication methods for the vehicle body network.

[0196] The processor is configured to load and execute the program in the memory.

[0197] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above functional modules is exemplified, and in actual application, the above functions can be completed by different functional modules according to needs, i.e., the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0198] The above description is only the preferred embodiments of the present application, and the protection scope of the present application is not limited to the above embodiments. Any technical solution falling within the concept of the present application shall be considered within the protection scope of the present application. It should be noted that, for ordinary skilled persons in the art, some improvements and refinements without departing from the principles of the present application shall also be considered within the protection scope of the present application.

Claims

1. A method for secure communication of a vehicle body network, characterized in that, The method comprises: Step 100: collecting vehicle body information; Step 101: generating a control key in response to the vehicle body information; Step 102: generating an authentication request based on the control key; Step 103: controlling a preset control device to send the authentication request to a preset vehicle-mounted node, and receiving an authentication response based on the authentication request; Step 104: determining a vehicle-mounted authentication code and a vehicle-mounted key based on the authentication response; Step 105: calculating a control authentication code in combination with the vehicle-mounted key, the control key and a preset shared key; Step 106: when the control authentication code is consistent with the vehicle-mounted authentication code, controlling the preset control device and the vehicle-mounted node to establish communication; The method for generating the authentication response comprises: Step 107: controlling the preset vehicle-mounted node to generate a vehicle-mounted key in response to the authentication request; Step 108: generating a session key in combination with the control key, the vehicle-mounted key and the preset shared key; Step 109: calculating a vehicle-mounted authentication code according to the control key, the vehicle-mounted key and the session key; Step 110: generating an authentication response in response to the vehicle-mounted authentication code and the vehicle-mounted key; Step 111: controlling the preset vehicle-mounted node to send the authentication response to the preset control device; The method further comprises a data exchange method, which comprises: Step 200: determining an information type according to the vehicle body information; Step 201: generating a freshness value in response to the vehicle body information when the information type is consistent with preset security information; Step 202: calculating a sending authentication code in combination with the vehicle body information, the freshness value and a session key; Step 203: generating and sending a security message based on the vehicle body information, the freshness value and the sending authentication code.

2. The method for secure communication of a vehicle body network according to claim 1, wherein, The data exchange method further comprises: Step 204: receiving the security message; Step 205: extracting the vehicle body information, the freshness value and the sending authentication code from the security message; Step 206: calculating a receiving authentication code in combination with the vehicle body information, the freshness value and the session key when the freshness value is greater than a preset historical value; Step 207: discarding the security message if the sending authentication code and the receiving authentication code are inconsistent; Step 208: updating the historical value based on the freshness value if the sending authentication code and the receiving authentication code are consistent.

3. The method for secure communication of a vehicle body network according to claim 2, wherein, The method further comprises a leakage identification method, which comprises: Step 300: determining a control action based on the security message if the sending authentication code and the receiving authentication code are consistent; Step 301: determining an action interval according to the control action, and determining a control node based on the security message; Step 302: calling a work record in response to the control node; Step 303: determining a work state from the work record; Step 304: discarding the security message and generating and displaying a control confirmation information in response to the control node and the control action when the work state does not fall within the action interval.

4. The method for secure communication of a vehicle body network according to claim 3, wherein, The leakage identification method further comprises: Step 305: determining a control frequency from the work record based on the control action when the work state falls within the action interval; Step 306: determining a continuous threshold in response to the control frequency, and determining an actual interval from the working record based on the control action; Step 307: determining an abnormal count in response to the security message if the actual interval is lower than the continuous threshold; Step 308: determining an abnormal message based on the abnormal count when the abnormal count is greater than a preset abnormal threshold; Step 309: generating and displaying a key leakage prompt in response to the abnormal message.

5. The method for secure communication of a vehicle body network according to claim 4, characterized in that, The leakage identification method further comprises: Step 310: calling a historical key when the abnormal count is not greater than the preset abnormal threshold; Step 311: determining a coincidence frequency in combination with the historical key and the session key; Step 312: controlling the preset control device and the vehicle-mounted node to disconnect communication if the coincidence frequency is greater than a preset high-frequency threshold, and calling a discarded key based on the session key; Step 313: updating the vehicle-mounted key and the control key based on the discarded key.

6. The method for secure communication of a vehicle body network according to claim 3, wherein, The anti-leakage method further comprises: Step 400: determining an action duration according to the control action if the sending authentication code and the receiving authentication code are consistent, and calling a power supply curve from the control node; Step 401: determining a power supply energy consumption from the power supply curve based on the action duration, and determining an action energy consumption according to the control action; Step 402: determining an energy consumption ratio in combination with the power supply energy consumption and the action energy consumption; Step 403: controlling the preset control device and the control node to disconnect communication when the energy consumption ratio is greater than a preset fluctuation threshold, and generating and displaying a node tampering prompt in response to the control node.

7. The method for secure communication of a vehicle body network according to claim 6, characterized in that, The anti-leakage method further comprises: Step 404: determining a pulse feature according to the control action when the energy consumption ratio is not greater than the preset fluctuation threshold; Step 405: identifying the pulse feature from the power supply curve based on the action duration; Step 406: determining a pulse timing based on the pulse feature when the pulse feature exists in the power supply curve, and determining a control timing in combination with the pulse feature and the control action; Step 407: controlling the preset control device and the control node to disconnect communication if the pulse timing is inconsistent with the control timing, and generating and displaying a node tampering prompt in response to the control node.

8. A secure communication system for a vehicle body network, characterized by It comprises: The acquisition module is configured to acquire vehicle body information; The memory is configured to store a program of a security communication method for a vehicle body network according to any one of claims 1 to 7; The processor is configured to load and execute the program in the memory.

Images