Penetration test method, system and equipment based on vehicle communication network and medium

Abstract

The invention relates to the technical field of vehicle networking safety, in particular to a penetration test method, system and device based on a vehicle communication network and a medium, and the method comprises the steps: turning on switches of all network connection modes supported by an OBD system, and enabling the OBD system to establish communication connection with a target side; the method comprises the following steps: carrying out network scanning by using each network connection mode supported by the OBD system in sequence through an attack side, and initiating network attacks of specified times on each network connection mode of the OBD system based on a network scanning result; recording an attack result of each network attack; calculating a security evaluation performance value of the OBD system based on the attack result; and generating an automatic penetration test report based on the attack result and the security evaluation performance value. According to the method, all network connection modes of the OBD system are tested through automatic traversal, and the attack result is recorded and analyzed, so that comprehensive, efficient and quantifiable safety assessment of the vehicle communication network is realized.

Description

Technical Field

[0001] This application relates to the field of vehicle network security technology, specifically to a penetration testing method, system, device, and medium based on vehicle communication networks. Background Technology

[0002] With the rapid development of intelligent connected vehicles, the OBD (On-Board Diagnostics) system, as a key interface for vehicle status monitoring, fault diagnosis, and data interaction, is increasingly communicating with external networks. The OBD system integrates multiple communication technologies such as 5G, 4G, Bluetooth, and WiFi, significantly enhancing the vehicle's remote diagnostics, software upgrades, and real-time data service capabilities. However, it also greatly expands the system's network attack surface, placing higher demands on vehicle network security.

[0003] In the field of vehicle communication security, existing technologies typically employ independent testing methods for specific communication protocols, performing security scans and attack simulations on individual channels involved in the OBD system, such as Bluetooth, WiFi, or cellular networks. These methods, by conducting vulnerability analysis, authentication mechanism testing, and data eavesdropping attack simulations on specific communication links, can, to some extent, uncover certain security issues in the OBD system under a particular network access method, thereby improving the protection capabilities of specific communication modules.

[0004] However, existing penetration testing methods mostly focus on security testing under a single network connection mode of the OBD system, lacking the ability to conduct collaborative and systematic testing of the multiple network access modes it supports. During the testing process, it often relies on manual configuration of attack parameters and targets one by one, making it difficult to achieve automation, multi-mode network scanning and attack switching, resulting in low testing efficiency and limited coverage. In addition, existing methods usually do not systematically record key information such as attack type, success or failure, and time consumption during the attack process, making it impossible to quantitatively evaluate the overall security performance of the OBD system. Summary of the Invention

[0005] To address the technical problems of existing penetration testing methods for vehicle OBD systems, such as limited testing modes, reliance on manual labor, low efficiency, and lack of quantitative evaluation capabilities, this application provides a penetration testing method, system, device, and medium based on vehicle communication networks. By automatically traversing and testing all network connection methods of the OBD system and recording and analyzing the attack results, a comprehensive, efficient, and quantifiable security assessment of the vehicle communication network is achieved.

[0006] In a first aspect, this application provides a penetration testing method based on a vehicle communication network, comprising the following steps: S1. Turn on all network connection methods supported by the OBD system to establish a communication connection between the OBD system and the target side; S2. On the attacking side, network scans are performed sequentially using each network connection method supported by the OBD system, and network attacks are launched a specified number of times for each network connection method of the OBD system based on the network scan results; wherein, each network attack is configured with a different network address and name; S3. Record the results of each network attack, including the attack type, whether the attack was successful, and the time required for a successful attack. S4. Calculate the security performance value of the OBD system based on the attack results; S5. Generate automated penetration test reports based on attack results and security assessment performance values.

[0007] It should be further noted that in step S1, the network connection methods supported by the OBD system include 4G, 5G, Bluetooth, and WiFi.

[0008] It should be further explained that in step S2, the method for launching network attacks on each network connection method based on the network scan results is as follows: according to the OBD system network access point and vulnerability information obtained from the scan, configure the parameters and targets of the network attack, and then carry out the network attack.

[0009] It should be further noted that step S2, the steps for launching a network attack, include: S21. Launch a denial-of-service attack against the specified network connection method of the OBD system; S22. If a denial-of-service attack causes the communication connection between the OBD system and the target side to be interrupted, then proceed to step S23; If the denial-of-service attack does not cause the communication connection between the OBD system and the target side to be interrupted, the attack is deemed to have failed and the attack ends. S23. The attacking side conducts network eavesdropping and hijacking attacks on the specified network connection method of the OBD system, with the goal of obtaining vehicle data in the OBD system; If vehicle data is successfully obtained from the OBD system, the attack is considered successful; otherwise, the attack is considered unsuccessful.

[0010] It should be further noted that in step S2, denial-of-service attacks include: DoS attacks and DDoS attacks; Network eavesdropping and hijacking attacks include: fake base station attacks and sniffing attacks.

[0011] It should be further explained that in step S23, network eavesdropping and hijacking attacks obtain vehicle data from the OBD system by establishing an unauthorized connection between the attacking side and the OBD system. The process of establishing an unauthorized connection between the attacking side and the OBD system includes: S231. The attacking side obtains the link key that comes with the OBD system and sends an authentication request to the OBD system. The authentication request includes the network address of the attacking side and a random number generated by a random number generator. S232. The OBD system uses an improved E1 algorithm to process the link key, network address, and random number to generate the first response message and the first authentication offset; The attacking side processes the link key, network address, and random number using the same improved E1 algorithm to generate a second response message and a second authentication offset. S233. The OBD system sends the first response message to the attacking side; S234. The attacking side compares the first response message and the second response message. If they match, the authentication is successful, an unauthorized connection is established, and the OBD system saves the first authentication offset and the attacking side saves the second authentication offset.

[0012] It should be further explained that the execution flow of the improved E1 algorithm in S232 includes: S2321. Using the AES-CMAC algorithm, derive three subkeys K1, K2, and K3 based on the link key; The network address from the attacking side is extended to obtain the extended network address, denoted as ADDR_EXT; The random number from the attacking side is divided into two parts, denoted as RANDA1 and RANDA2 respectively; S2322. Use K1 to encrypt ADDR_EXT to obtain the state; S2323. Apply a nonlinear transformation to the state using the S-box (Substitution-Box) to obtain state1; S2324. Perform an XOR operation on RANDA1 and RANDA2 to obtain compressed_RANDA, and then perform an XOR operation on compressed_RANDA and state1 to obtain the updated state1; S2325. Alternately use K2 and K3 to encrypt the updated state1 for 6 rounds to obtain the encrypted result state2; S2326. Output the specified number of bits in state2 as an acknowledgment message; Perform a SHA3 hash operation on state2 and output the result as the authentication offset.

[0013] It should be further noted that the OBD system supports the use of EAP-AKA and 5G AKA algorithms for authenticating cellular network access, as well as the use of the EAP-TLS algorithm for authenticating non-cellular network access.

[0014] It should be further noted that the formula for calculating the safety assessment performance value in step S4 is as follows:

[0015] In the formula, Indicates the safety assessment performance value; This indicates the total number of network connection methods supported by the OBD system; Indicates that for the first Total number of network attacks launched using the network connection methods supported by the OBD system; Indicates that for the first The total number of successful network attacks initiated using the network connection methods supported by the OBD system; Indicates the preset for the first Attack time thresholds for network connection methods supported by various OBD systems; Indicates that for the first The average time taken for all successful network attacks on all network connection methods supported by the OBD system; , These are the preset weighting coefficients.

[0016] It should be further noted that the content of the automated penetration test report includes: statistics on the number of attacks for each network connection method, distribution of attack types, attack success rate, average time to attack success, and security assessment performance value.

[0017] It should be further noted that the content of the automated penetration test report also includes: the security status of the OBD system communication module and risk points, links to fix the risk points, and the impact of the risk points.

[0018] It should be further noted that the security status of the OBD system communication module is determined by comparing the security assessment performance value with the preset security threshold. Risk points are identified by analyzing the types of successful attacks, the frequency of successful attacks, and the authentication offset. The links to fix vulnerabilities and the extent of their impact are obtained by querying a pre-defined vulnerability database based on the identified vulnerabilities.

[0019] Secondly, this application provides a penetration testing system based on a vehicle communication network for implementing the above-mentioned penetration testing method, including: The OBD communication connection management module is used to enable all network connection methods supported by the OBD system, so that the OBD system can establish a communication connection with the target side. The network scanning and attack execution module is used to perform network scanning on the attacking side by sequentially utilizing each network connection method supported by the OBD system, and to launch a specified number of network attacks on each network connection method of the OBD system based on the network scanning results. The attack result recording and storage module is used to record the attack results of each network attack. The attack results include the attack type, whether the attack was successful, and the time required for a successful attack. The security assessment performance value calculation module is used to calculate the security assessment performance value of the OBD system based on the attack results. The automated test report generation module is used to generate automated penetration test reports based on attack results and security assessment performance values.

[0020] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described penetration testing method.

[0021] Fourthly, this application provides a storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described penetration testing method.

[0022] As can be seen from the above technical solutions, this application has the following advantages: 1. This application enables all network connection methods supported by the OBD system and establishes a communication connection with the target side. Then, it uses each network connection method to perform automated scanning and multiple differentiated attacks in sequence, achieving complete coverage and systematic testing of the OBD system's multi-network access environment. This solves the problems of low efficiency and limited coverage caused by the single testing mode and reliance on manual network switching in the existing technology for OBD systems. As a result, it can efficiently and comprehensively discover potential security vulnerabilities in the OBD system in different communication protocols, significantly improving the security testing efficiency of vehicle communication networks.

[0023] 2. This application solves the problem of fragmented penetration test results and lack of unified evaluation standards in existing OBD systems by recording key data such as the attack type, success status and time required for each network attack, and calculating a quantitative security assessment performance value based on this data. It achieves an objective and quantitative assessment of the overall security protection level of the OBD system, making the security performance of the OBD system measurable and comparable, and providing a reliable decision-making basis for vehicle network security protection.

[0024] 3. Based on attack results and security assessment performance values, this application automatically generates penetration test reports for OBD systems, solving the problem of disconnect between the testing process and result analysis in existing technologies. It achieves full-process automation from test execution to result analysis and report output, significantly improving the efficiency and reliability of OBD system security testing, while ensuring the consistency and operability of test result output. Attached Figure Description

[0025] To more clearly illustrate the technical solution of this application, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart of a penetration testing method based on a vehicle communication network in one embodiment of this application.

[0027] Figure 2 This is a schematic block diagram of a penetration testing system based on a vehicle communication network in one embodiment of this application.

[0028] Figure 3 This is a schematic diagram of the hardware structure of an electronic device in one embodiment of this application. Detailed Implementation

[0029] To make the purpose, features, and advantages of this application more apparent and understandable, specific embodiments and accompanying drawings will be used to clearly and completely describe the technical solution protected by this application. Obviously, the embodiments described below are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0030] The penetration testing methods involved in this application will be described in detail below. Specific details such as particular system architectures and techniques are presented for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application can also be implemented in other embodiments without these specific details.

[0031] In the penetration testing methods involved in this application, the term "comprising" indicates the presence of the described feature, integral, step, operation, element, and / or component, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or collections thereof. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0032] To facilitate a clear description of the technical solutions of this application, the terms "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that the terms "first" and "second" do not necessarily imply that they are different.

[0033] The terms "one embodiment" or "some embodiments" used in this application mean that one or more embodiments of this application include the specific features, structures, or characteristics described in that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this application do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.

[0034] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0035] The penetration testing method provided in this application embodiment is executed by a computer device, and correspondingly, the penetration testing system based on the vehicle communication network runs in the computer device.

[0036] Figure 1 This is a flowchart of a penetration testing method based on a vehicle communication network according to an embodiment of this application. Wherein, Figure 1 The implementing entity can be a penetration testing system. Depending on the specific requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted.

[0037] like Figure 1 As shown, this penetration testing method based on vehicle communication networks includes: Step S1: Turn on the switch for all network connection methods supported by the OBD system to establish a communication connection between the OBD system and the target side.

[0038] By enabling all network connections of the OBD system and establishing communication connections with the target side, it ensures that all potential communication channels are in a testable state, providing a complete initial environment for subsequent systematic penetration testing.

[0039] In some specific embodiments, the OBD system supports network connection methods including 4G, 5G, Bluetooth, and WiFi.

[0040] By specifying network connection methods including 4G, 5G, Bluetooth, and WiFi, the test scope is limited to cover mainstream in-vehicle wired and wireless communication protocols, ensuring that the test scope is comprehensive and representative, and can effectively evaluate the safety performance of the OBD system in various real-world application scenarios.

[0041] Step S2: On the attacking side, network scans are performed sequentially using each network connection method supported by the OBD system, and network attacks are launched a specified number of times for each network connection method of the OBD system based on the network scan results; wherein, each network attack is configured with a different network address and name.

[0042] By enabling the attacker to scan each network connection method sequentially and launch multiple network attacks with different configurations, automated traversal testing of multi-mode network interfaces is achieved. This increases the test coverage while improving the depth and breadth of testing through differentiated attack configurations, thus more effectively discovering potential security vulnerabilities.

[0043] In some specific embodiments, the method for launching network attacks based on network scan results for each network connection method is as follows: based on the network access point and vulnerability information of the OBD system obtained by scanning, configure the parameters and targets of the network attack, and then carry out the network attack.

[0044] By configuring attack parameters and targets based on access point and vulnerability information obtained from network scanning, network attacks become more targeted. This configuration method improves the accuracy of testing and the efficiency of vulnerability discovery, ensuring that the testing process is both comprehensive and focused.

[0045] In some specific embodiments, the steps of launching a cyberattack include: S21. Launch a denial-of-service attack against the specified network connection method of the OBD system; S22. If a denial-of-service attack causes the communication connection between the OBD system and the target side to be interrupted, then proceed to step S23; If the denial-of-service attack does not cause the communication connection between the OBD system and the target side to be interrupted, the attack is deemed to have failed and the attack ends. S23. The attacking side conducts network eavesdropping and hijacking attacks on the specified network connection method of the OBD system, with the goal of obtaining vehicle data in the OBD system; If vehicle data is successfully obtained from the OBD system, the attack is considered successful; otherwise, the attack is considered unsuccessful.

[0046] By adopting a tiered testing process—first testing connection stability with a denial-of-service attack, then implementing eavesdropping and hijacking attacks—multi-layered verification of network connectivity, from availability to confidentiality, is achieved, enabling a systematic evaluation of the OBD system's security protection capabilities at different levels.

[0047] In some specific embodiments, denial-of-service attacks include: DoS attacks and DDoS attacks; Network eavesdropping and hijacking attacks include: fake base station attacks and sniffing attacks.

[0048] By specifically defining denial-of-service attacks as DoS and DDoS attacks, and eavesdropping and hijacking attacks as fake base station and sniffing attacks, the testing methodology ensures that it covers typical high-threat network attack vectors. This targeted selection of attack types improves the practicality and effectiveness of the testing.

[0049] In some specific embodiments, in step S23, network eavesdropping and hijacking attacks obtain vehicle data from the OBD system by establishing an unauthorized connection between the attacking side and the OBD system. The process of establishing an unauthorized connection between the attacking side and the OBD system includes: S231. The attacking side obtains the link key that comes with the OBD system and sends an authentication request to the OBD system. The authentication request includes the network address of the attacking side and a random number generated by a random number generator. S232. The OBD system uses an improved E1 algorithm to process the link key, network address, and random number to generate the first response message and the first authentication offset; The attacking side processes the link key, network address, and random number using the same improved E1 algorithm to generate a second response message and a second authentication offset. S233. The OBD system sends the first response message to the attacking side; S234. The attacking side compares the first response message and the second response message. If they match, the authentication is successful, an unauthorized connection is established, and the OBD system saves the first authentication offset and the attacking side saves the second authentication offset.

[0050] By clarifying the specific authentication process for establishing an unauthorized connection between the attacker and the OBD system, and using an improved E1 algorithm to process the link key, network address, and random number for response comparison, a verifiable security authentication mechanism testing method is provided. This method can effectively evaluate the security strength of the OBD system's authentication mechanism. In some specific embodiments, in S232, the execution flow of the improved E1 algorithm includes: S2321. Using the AES-CMAC algorithm, derive three subkeys K1, K2, and K3 based on the link key; The network address from the attacking side is extended to obtain the extended network address, denoted as ADDR_EXT; The random number from the attacking side is divided into two parts, denoted as RANDA1 and RANDA2 respectively; S2322. Use K1 to encrypt ADDR_EXT to obtain the state; S2323. Apply a nonlinear transformation to the state using the S-box (Substitution-Box) to obtain state1; S2324. Perform an XOR operation on RANDA1 and RANDA2 to obtain compressed_RANDA, and then perform an XOR operation on compressed_RANDA and state1 to obtain the updated state1; S2325. Alternately use K2 and K3 to encrypt the updated state1 for 6 rounds to obtain the encrypted result state2; S2326. Output the specified number of bits in state2 as an acknowledgment message; Perform a SHA3 hash operation on state2 and output the result as the authentication offset.

[0051] By clearly defining and improving the execution flow of the E1 algorithm, including steps such as AES-CMAC derived subkey, address expansion, random number processing, and multi-round encryption, a more computationally complex and attack-resistant security algorithm implementation scheme is provided, which can significantly improve the security and reliability of the testing process.

[0052] In some specific embodiments, the OBD system supports the use of EAP-AKA and 5G AKA algorithms for authenticating cellular network access, and the use of EAP-TLS algorithm for authenticating non-cellular network access.

[0053] By explicitly stating that the OBD system supports the use of EAP-AKA and 5G AKA algorithms for cellular network access authentication, and the EAP-TLS algorithm for non-cellular network access authentication, the test environment is ensured to cover mainstream network security authentication mechanisms. This comprehensive support for authentication protocols can truly reflect the security status of the OBD system in actual applications.

[0054] Step S3: Record the attack results of each network attack. The attack results include the attack type, whether the attack was successful, and the time required for a successful attack.

[0055] By recording the results of each cyberattack, a reliable basis is provided for subsequent quantitative analysis of security performance, ensuring the accuracy and traceability of the assessment results. Step S4: Calculate the security assessment performance value of the OBD system based on the attack results.

[0056] Calculating security assessment performance values ​​based on attack result data transforms discrete attack events into comprehensive evaluation indicators, which can objectively reflect the overall network security protection level of the OBD system and provide a scientific and reliable measurement standard for security assessment.

[0057] In some specific embodiments, the formula for calculating the security assessment performance value is as follows:

[0058] In the formula, Indicates the safety assessment performance value; This indicates the total number of network connection methods supported by the OBD system; Indicates that for the first Total number of network attacks launched using the network connection methods supported by the OBD system; Indicates that for the first The total number of successful network attacks initiated using the network connection methods supported by the OBD system; Indicates the preset for the first Attack time thresholds for network connection methods supported by various OBD systems; Indicates that for the first The average time taken for all successful network attacks on all network connection methods supported by the OBD system; , These are the preset weighting coefficients.

[0059] By providing a formula for calculating security assessment performance values ​​that includes multi-dimensional parameters, a scientific quantitative assessment of test results is achieved. This comprehensive calculation formula provides an objective standard for measuring the system's security level, making the security assessment results more accurate and reliable.

[0060] Step S5: Generate an automated penetration test report based on the attack results and security assessment performance values.

[0061] Test reports are automatically generated based on attack results and security assessment performance values, achieving full automation from test execution to result output, significantly improving assessment efficiency, and ensuring the standardization and operability of test result output.

[0062] In some specific embodiments, the content of the automated penetration test report includes: statistics on the number of attacks under each network connection method, distribution of attack types, attack success rate, average time to attack success, and security assessment performance value.

[0063] By requiring penetration test reports to include attack statistics, type distribution, success rate, average time, and security assessment values ​​for each network connection method, the report ensures that it comprehensively reflects the testing process and core results. This standardized reporting requirement makes the test results clearer and easier to understand.

[0064] In some specific embodiments, the content of the automated penetration test report also includes: the security status of the OBD system communication module and risk points, the repair links for the risk points, and the harm caused by the risk points.

[0065] By adding information on the security status of the communication module, risk points, repair links, and hazard descriptions to the test report, the practical value of the report is enhanced. This comprehensive report content provides clear guidance for subsequent security remediation, enabling the testing work to truly play a role in security protection.

[0066] In some specific embodiments, the security status of the OBD system communication module is determined by comparing the security assessment performance value with a preset security threshold; Risk points are identified by analyzing the types of successful attacks, the frequency of successful attacks, and the authentication offset. The links to fix vulnerabilities and the extent of their impact are obtained by querying a pre-defined vulnerability database based on the identified vulnerabilities.

[0067] By defining the security status based on security value comparison, analyzing the characteristics of successful attacks to obtain risk points, and querying the vulnerability database to match remediation information, the system automates and standardizes security status judgment and risk identification. This intelligent processing method significantly improves the efficiency and accuracy of security assessment.

[0068] In one specific embodiment, the steps of the penetration testing method based on vehicle communication networks include: Step S1: Turn on the switch for all network connection methods supported by the OBD system to establish a communication connection between the OBD system and the target side; The OBD system supports network connection methods including 4G, 5G, Bluetooth, and WiFi.

[0069] Step S2: On the attacking side, network scans are performed sequentially using each network connection method supported by the OBD system, and network attacks are launched a specified number of times for each network connection method of the OBD system based on the network scan results; wherein, each network attack is configured with a different network address and name; The method for launching network attacks based on network scan results for each network connection method is as follows: based on the network access point and vulnerability information of the OBD system obtained by scanning, configure the parameters and targets of the network attack, and then carry out the network attack. The steps to launch a cyberattack include: S21. Launch a denial-of-service attack against the specified network connection method of the OBD system. Denial-of-service attacks include DoS attacks and DDoS attacks. S22. If a denial-of-service attack causes the communication connection between the OBD system and the target side to be interrupted, then proceed to step S23; If the denial-of-service attack does not cause the communication connection between the OBD system and the target side to be interrupted, the attack is deemed to have failed and the attack ends. S23. The attacking side conducts network eavesdropping and hijacking attacks on the specified network connection method of the OBD system, with the goal of obtaining vehicle data in the OBD system. Network eavesdropping and hijacking attacks include fake base station attacks and sniffing attacks. If the vehicle data in the OBD system is successfully obtained, the attack is considered successful; otherwise, the attack is considered unsuccessful. Network eavesdropping and hijacking attacks obtain vehicle data from the OBD system by establishing an unauthorized connection between the attacker and the OBD system. The process of establishing an unauthorized connection between the attacker and the OBD system includes: S231. The attacking side obtains the 256-bit link key KEY that comes with the OBD system and sends an authentication request to the OBD system. The authentication request includes the network address ADDR_A of the attacking side and a random number RANDA generated by a random number generator. ADDR_A is a 48-bit MAC address. S232. The OBD system uses an improved E1 algorithm to process the link key KEY, network address ADDR_A, and random number RANDA to generate the first response message and the first authentication offset; The attacking side processes the link key KEY, network address ADDR_A, and random number RANDA using the same improved E1 algorithm to generate a second response message and a second authentication offset. The improved execution flow of the E1 algorithm includes: S2321. Using the AES-CMAC algorithm, derive three subkeys K1, K2, and K3 based on the 256-bit link key KEY; The network address from the attacking side is extended using a hash algorithm to obtain a 128-bit extended network address, denoted as ADDR_EXT: ADDR_EXT = ADDR_A || SHA3(ADDR_A)[0:80]; The random number from the attacking side is divided into two parts, denoted as RANDA1 and RANDA2: RANDA1 = RANDA[0:128]; RANDA2 = RANDA[129:256]; S2322. Use K1 to encrypt ADDR_EXT to obtain the state: state= AES_Encrypt(ADDR_EXT, K1); S2323. A nonlinear transformation of the state using the S-box (Substitution-Box) yields state1: state1 = SubBytes_auto(state); Among them, SubBytes_auto is a byte substitution (S-box) operation specifically optimized for automotive electronic OBD systems; S2324. Perform an XOR operation on RANDA1 and RANDA2 to obtain compressed_RANDA, and then perform an XOR operation on compressed_RANDA and state1 to obtain the updated state1; S2325. Alternately use K2 and K3 to encrypt the updated state1 for 6 rounds to obtain the encrypted result state2; S2326. Output the first 64 bits of state2 as an acknowledgment message: (auth_code): state2[0:64]; Perform a SHA3 hash operation on state2 and output the result as the authentication offset: (offset): SHA3(state2)[0:32]; S233. The OBD system sends the first response message to the attacking side; S234. The attacking side compares the first response message and the second response message. If they match, the authentication is successful, an unauthorized connection is established, and the OBD system saves the first authentication offset and the attacking side saves the second authentication offset. The OBD system supports the use of EAP-AKA and 5G AKA algorithms for authenticating cellular network access, as well as the use of EAP-TLS algorithm for authenticating non-cellular network access.

[0070] Step S3: Record the attack results of each network attack. The attack results include the attack type, whether the attack was successful, and the time required for a successful attack.

[0071] Step S4: Calculate the security assessment performance value of the OBD system based on the attack results. The formula for calculating the security assessment performance value is as follows:

[0072] In the formula, Indicates the safety assessment performance value; This indicates the total number of network connection methods supported by the OBD system; Indicates that for the first Total number of network attacks launched using the network connection methods supported by the OBD system; Indicates that for the first The total number of successful network attacks initiated using the network connection methods supported by the OBD system; Indicates the preset for the first Attack time thresholds for network connection methods supported by various OBD systems; Indicates that for the first The average time taken for all successful network attacks on all network connection methods supported by the OBD system; , These are the preset weighting coefficients.

[0073] Step S5: Generate an automated penetration test report based on the attack results and security assessment performance values. The automated penetration test report includes: statistics on the number of attacks under each network connection method, distribution of attack types, attack success rate, average attack success time, as well as security assessment performance values, security status of the OBD system communication module, risk points, repair links for risk points, and the harm of risk points. The security status of the OBD system communication module is determined by comparing the security assessment performance value with a preset security threshold. Risk points are identified by analyzing the types of successful attacks, the frequency of successful attacks, and the authentication offset. The links to fix vulnerabilities and the extent of their impact are obtained by querying a pre-defined vulnerability database based on the identified vulnerabilities.

[0074] The following are embodiments of a penetration testing system based on a vehicle communication network provided in this application. This penetration testing system based on a vehicle communication network belongs to the same inventive concept as the penetration testing methods in the above embodiments. For details not described in detail in the embodiments of the penetration testing system, please refer to the embodiments of the penetration testing methods based on vehicle communication networks described above.

[0075] like Figure 2 As shown, the penetration testing system based on vehicle communication networks includes: The OBD communication connection management module is used to enable all network connection methods supported by the OBD system, so that the OBD system can establish a communication connection with the target side. The network scanning and attack execution module is used to perform network scanning on the attacking side by sequentially utilizing each network connection method supported by the OBD system, and to launch a specified number of network attacks on each network connection method of the OBD system based on the network scanning results. The attack result recording and storage module is used to record the attack results of each network attack. The attack results include the attack type, whether the attack was successful, and the time required for a successful attack. The security assessment performance value calculation module is used to calculate the security assessment performance value of the OBD system based on the attack results. The automated test report generation module is used to generate automated penetration test reports based on attack results and security assessment performance values.

[0076] The penetration testing system in this embodiment is used to implement a penetration testing method based on vehicle communication networks.

[0077] This application also provides an electronic device for implementing the various embodiments of this application. Figure 3 To illustrate the hardware structure of an electronic device according to various embodiments of this application, as shown in the following diagram... Figure 3 As shown, the electronic device includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor.

[0078] Those skilled in the art will understand that the electronic device structure involved in the embodiments of this application does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0079] In embodiments of this application, electronic devices include, but are not limited to, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also represent various forms of mobile devices and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of this application described and / or claimed herein.

[0080] In this application embodiment, the processor can be implemented using at least one of an Application-Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a processor, a controller, a microcontroller, a microprocessor, or an electronic unit designed to perform the functions described herein. In some cases, such implementations can be implemented within a controller. For software implementations, implementations such as processes or functions can be implemented with separate software modules that allow the performance of at least one function or operation. The software code can be implemented by a software application (or program) written in any suitable programming language, and the software code can be stored in memory and executed by the controller.

[0081] In addition, the electronic device includes some functional modules not shown, which will not be described in detail here.

[0082] Those skilled in the art will understand that the various aspects of the electronic device provided in this application can be implemented as a system, method, or program product. Therefore, the various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0083] This application also provides a storage medium storing a program product capable of implementing a penetration testing method based on a vehicle communication network. In some possible implementations, various aspects of this application can also be implemented as a program product comprising program code that, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this application.

[0084] The storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example,, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0085] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A penetration testing method based on vehicle communication networks, characterized in that, include: S1. Turn on all network connection methods supported by the OBD system to establish a communication connection between the OBD system and the target side; S2. On the attacking side, network scans are performed sequentially using each network connection method supported by the OBD system, and network attacks are launched a specified number of times for each network connection method of the OBD system based on the network scan results; wherein, each network attack is configured with a different network address and name; S3. Record the results of each network attack, including the attack type, whether the attack was successful, and the time required for a successful attack. S4. Calculate the security performance value of the OBD system based on the attack results; S5. Generate automated penetration test reports based on attack results and security assessment performance values.

2. The penetration testing method as described in claim 1, characterized in that, In step S1, the network connection methods supported by the OBD system include 4G, 5G, Bluetooth, and WiFi.

3. The penetration testing method as described in claim 1, characterized in that, In step S2, the steps to launch a network attack include: S21. Launch a denial-of-service attack against the specified network connection method of the OBD system; S22. If a denial-of-service attack causes the communication connection between the OBD system and the target side to be interrupted, then proceed to step S23; If the denial-of-service attack does not cause the communication connection between the OBD system and the target side to be interrupted, the attack is deemed to have failed and the attack ends. S23. The attacking side conducts network eavesdropping and hijacking attacks on the specified network connection method of the OBD system, with the goal of obtaining vehicle data in the OBD system; If vehicle data is successfully obtained from the OBD system, the attack is considered successful; otherwise, the attack is considered unsuccessful.

4. The penetration testing method as described in claim 3, characterized in that, In step S23, network eavesdropping and hijacking attacks obtain vehicle data from the OBD system by establishing an unauthorized connection between the attacking side and the OBD system. The process of establishing an unauthorized connection between the attacking side and the OBD system includes: S231. The attacking side obtains the link key that comes with the OBD system and sends an authentication request to the OBD system. The authentication request includes the network address of the attacking side and a random number generated by a random number generator. S232. The OBD system uses an improved E1 algorithm to process the link key, network address, and random number to generate the first response message and the first authentication offset; The attacking side processes the link key, network address, and random number using the same improved E1 algorithm to generate a second response message and a second authentication offset. S233. The OBD system sends the first response message to the attacking side; S234. The attacking side compares the first response message and the second response message. If they match, the authentication is successful, an unauthorized connection is established, and the OBD system saves the first authentication offset and the attacking side saves the second authentication offset.

5. The penetration testing method as described in claim 1, characterized in that, In step S4, the formula for calculating the safety assessment performance value is as follows: In the formula, Indicates the safety assessment performance value; This indicates the total number of network connection methods supported by the OBD system; Indicates that for the first Total number of network attacks launched using the network connection methods supported by the OBD system; Indicates that for the first The total number of successful network attacks initiated using the network connection methods supported by the OBD system; Indicates the preset for the first Attack time thresholds for network connection methods supported by various OBD systems; Indicates that for the first The average time taken for all successful network attacks on all network connection methods supported by the OBD system; , These are the preset weighting coefficients.

6. The penetration testing method as described in claim 1, characterized in that, The content of an automated penetration test report includes: statistics on the number of attacks for each network connection method, distribution of attack types, attack success rate, average time to attack success, and security assessment performance values.

7. The penetration testing method as described in claim 6, characterized in that, The content of an automated penetration test report also includes: the security status of the OBD system communication module and its risk points, links to fix these risk points, and the impact of these risk points.

8. A penetration testing system based on a vehicle communication network, characterized in that, To implement the penetration testing method as described in any one of claims 1-7, comprising: The OBD communication connection management module is used to enable all network connection methods supported by the OBD system, so that the OBD system can establish a communication connection with the target side. The network scanning and attack execution module is used to perform network scanning on the attacking side by sequentially utilizing each network connection method supported by the OBD system, and to launch a specified number of network attacks on each network connection method of the OBD system based on the network scanning results. The attack result recording and storage module is used to record the attack results of each network attack. The attack results include the attack type, whether the attack was successful, and the time required for a successful attack. The security assessment performance value calculation module is used to calculate the security assessment performance value of the OBD system based on the attack results. The automated test report generation module is used to generate automated penetration test reports based on attack results and security assessment performance values.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes a computer program, it implements the steps of the penetration testing method as described in any one of claims 1-7.

10. A storage medium storing a computer program, characterized in that, When a computer program is executed by a processor, it implements the steps of the penetration testing method as described in any one of claims 1-7.

Images