Communication method and device and electronic equipment

Abstract

The invention discloses a communication method and device and electronic equipment, and the method comprises the steps: carrying out the encryption transmission of a data frame between first equipment and second equipment according to a mode of specifying the position of encrypted data, carrying out the encryption transmission of the data frame according to a mode of specifying the algorithm of the encrypted data, and when there are multiple second equipment, carrying out the encryption transmission of the data frame; the first device only knows the encryption mode of the single line, and the plurality of second devices cannot decode the encryption mode of the opposite side; secondly, the first equipment verifies data in an initial data frame of the first equipment according to the verification data, when the data contents of the first equipment and the second equipment are the same, the encryption mode is quitted, the encrypted data is used for data transmission, the encrypted data does not occupy the data volume, and the data transmission is carried out with the maximum data volume; and the first device also records the number of times when the verification data are different, and when the number of times is greater than a threshold value, an alarm signal is sent out. The security of data transmission is improved, and the data volume of data transmission is ensured at the same time.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication, and more particularly to a communication method and device and electronic equipment. BACKGROUND

[0002] The Controller Area Network (CAN) is an international standard serial communication protocol. In the current automotive intelligent industry, more and more electronic control systems are developed. Because the data types and reliability requirements for communication between these systems are different, CAN communication encryption is inevitable in vehicle communication.

[0003] Generally, the CAN communication encryption method of a vehicle is generally required by the host factory of the vehicle, and the product manufacturer will develop the encryption content according to the requirements. The encryption content is easily leaked by any party in the product manufacturer, resulting in leakage of the encryption protocol of the vehicle system. At the same time, the host factory originally interfaces with the first product manufacturer and the second product manufacturer. When the host factory wants to add a third product manufacturer, the host factory or the first product manufacturer can inform the third product manufacturer of the encryption method. The third product manufacturer does not need to develop extra, and can directly replace the product of the second product manufacturer. Conversely, it can also replace the product of the first product manufacturer, or the first and second parties can also sell the product to other customers separately. This will cause the products of all parties to be easily replaced.

[0004] Therefore, how to ensure that the CAN communication encryption method of the vehicle is more reliable and does not occupy transmission resources has become a problem to be solved. SUMMARY

[0005] Therefore, the embodiments of the present application provide a communication method, device and electronic equipment, which can realize effective encryption of CAN communication, and does not occupy transmission resources after encryption.

[0006] The present application adopts the following technical solutions.

[0007] In a first aspect, the embodiments of the present application provide a communication method applied to a first device, and the method comprises: sending a first data frame to a second device; the first data frame comprises first service data and first encryption data located at a first position; receiving check data of the second device; the check data is used to indicate that the first data frame and a second data frame sent by the second device are calculated according to a first encryption algorithm set by the second device; in the case that the check data and the content of all data in the first data frame are the same, sending a third data frame to the second device; the third data frame comprises second service data; the data amount of the first data frame and the third data frame is the same, and the data amount of the second service data is the sum of the data amount of the first service data and the data amount of the first encryption data.

[0008] In some embodiments, before receiving verification data from the second device, the method further includes: Receive a second data frame from the second device; the second data frame includes: third service data and second encrypted data located at a second position; the content of the first service data is the same as that of the third service data; send a fourth data frame to the second device, the fourth data frame being used to indicate: obtained by operating on the first data frame and the second data frame according to the set second encryption algorithm.

[0009] In some embodiments, receiving a second data frame from a second device includes: The arrangement of the first business data in the first data frame is different from the arrangement of the third business data in the second data frame.

[0010] In some embodiments, the first device maintains a check count for the first data frame, and after receiving the second data frame from the second device, the method further includes: If the verification data is different from the data in the first data frame, update the verification count.

[0011] In some embodiments, when the content of the verification data is different from that of the data in the first data frame, the method further includes updating the verification count: The number of verifications is determined when the verification data is different from the data content in the first data frame; an alarm signal is issued based on the number of verifications being greater than or equal to a first threshold.

[0012] Secondly, embodiments of this application provide a communication method applied to a second device, the method comprising: The system receives a first data frame sent by a first device; the first data frame includes: first service data and first encrypted data located at a first position; it sends verification data to the first device; the verification data is used to indicate: the result obtained by processing the first data frame and the second data frame of the second device according to the set first encryption algorithm; the second data frame includes: third service data and second encrypted data located at a second position; the content of the first service data and the third service data is the same; the data arrangement of the first service data in the first data frame is different from the data arrangement of the third service data in the second data frame.

[0013] In some embodiments, after receiving the first data frame sent by the first device, the method further includes: Send a second data frame to the first device; receive a fourth data frame sent by the first device, the fourth data frame being used to indicate that the first data frame and the second data frame are obtained by processing according to the second encryption algorithm set by the first device.

[0014] Thirdly, embodiments of this application provide a communication device applied to a first device, the device comprising: A first sending module is configured to send a first data frame to a second device; the first data frame includes: first service data and first encrypted data located at a first position; a first receiving module is configured to receive verification data from the second device; the verification data is used to indicate that it is obtained by calculating the first data frame and the second data frame sent by the second device according to the first encryption algorithm set by the second device; a second sending module is configured to send a third data frame to the second device if the content of the verification data is the same as that of all data in the first data frame; the third data frame includes: second service data; the data volume of the first data frame and the third data frame is the same, and the data volume of the second service data is the sum of the data volume of the first service data and the data volume of the first encrypted data.

[0015] Fourthly, embodiments of this application provide a communication device applied to a second device, the device comprising: The second receiving module is used to receive a first data frame sent by the first device; the first data frame includes: first service data and first encrypted data located at a first position; the third sending module is used to send verification data to the first device; the verification data is used to indicate: obtained by operating on the first data frame and the second data frame of the second device according to the set first encryption algorithm; the second data frame includes: third service data and second encrypted data located at a second position; the content of the first service data and the third service data is the same; the data arrangement of the first service data in the first data frame is different from the data arrangement of the third service data in the second data frame.

[0016] Fifthly, embodiments of this application provide an electronic device, which includes: a processor; and a memory storing computer-readable instructions, which, when executed by the processor, implement the communication method described above.

[0017] In this application's scheme, on one hand, the data frame used for transmitting data is used as the handshake key. Specifically, the first device specifies the position of the first encrypted data within the data frame and sends the data frame to the second device. The second device receives the data, specifies the position of the second encrypted data within the data frame, and sends the data frame back to the first device, completing the first handshake. Further, the first device uses a second encryption algorithm to encrypt the data frame during transmission, and the second device uses the first encryption algorithm to encrypt the data frame, obtaining verification data and completing the second handshake. The encryption time for both handshakes is generally between 50 and 200 milliseconds, which not only achieves effective encryption but also makes the encryption method simpler and more reliable. Furthermore, since the position information and encryption method of the encrypted data are set by the first device, when multiple second devices are present, the second devices cannot obtain each other's encrypted information, thus avoiding unilateral leakage.

[0018] On the other hand, after the first device receives the verification data, it compares the data in the device's initial data frame, which includes the first encrypted data at a specified position, with the verification data. If the content of the two data is the same, the data frame that serves as the handshake key is used to transmit the data. If the content of the two data is different, the number of verifications is recorded, and an alarm message is issued when the number of verifications exceeds the set threshold. After completing the two handshakes, the occupied encryption bits are released, which avoids the encryption bits from being transmitted with the data, thus increasing the risk of being captured and deciphered, without reducing the amount of data transmitted.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0021] Figure 1 This is a schematic diagram of a communication method provided in an embodiment of this application.

[0022] Figure 2 This is a comparative schematic diagram of a communication encryption method provided in an embodiment of this application.

[0023] Figure 3 This is a flowchart illustrating a communication method provided in an embodiment of this application.

[0024] Figure 4 This is a flowchart illustrating a communication method for encrypted data provided in an embodiment of this application.

[0025] Figure 5 This is a flowchart illustrating a communication method for verifying data provided in an embodiment of this application.

[0026] Figure 6 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application.

[0027] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0028] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through specific embodiments. Detailed Implementation

[0029] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0030] In typical technology, the encryption method for vehicle CAN communication is specified by the vehicle manufacturer, and the product supplier will formulate the encryption content according to the requirements, such as... Figure 2 The original encryption method shown presents a problem when there are multiple product vendors. All of them would know the encrypted content, and any leak of the encrypted content by any vendor would lead to the leakage of the vehicle system's encryption protocol. Furthermore, taking a standard CAN communication data frame as an example, its maximum data volume is 8 bytes (64 bits). If one byte (byte3) in the standard frame is used as the encryption bit, then byte3 will continuously carry encrypted data during data transmission, reducing the data transmission by one byte. When the data capacity is insufficient, an additional Identifier field (ID) is needed to ensure the accuracy and reliability of data transmission, but this can easily cause potential congestion on the CAN bus. In addition, if the encryption bit in the data frame is continuously transmitted with the data transmission, it will be easier for other devices to capture and parse the encryption method, resulting in product leakage.

[0031] The communication method provided in this application is intended to solve the above-mentioned technical problems of the prior art.

[0032] The technical solution of this application and how it solves the above-mentioned technical problems will be described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0033] Figure 1 This is a schematic diagram of a communication method provided in an embodiment of this application. Figure 2 This is a comparative schematic diagram illustrating a communication encryption method provided in an embodiment of this application. For example... Figure 1As shown, the communication method execution entity provided in this application embodiment includes a first module 101, a second module 102, and a third module 103.

[0034] In one alternative implementation, the first module 101, the second module 102, and the third module 103 refer to software units or modules. Each of these modules can be used to send, receive, and verify transmitted data.

[0035] In another alternative implementation, the first module 101 and the second module 102 refer to hardware devices.

[0036] For example, the first module 101, the second module 102, and the third module 103 may include, but are not limited to, electronic devices with data processing capabilities such as computers, host computers, servers, or data centers.

[0037] Optionally, the first module 101, the second module 102, and the third module 103 can communicate via wired or wireless connections. Wired connections may include, but are not limited to, buses, fiber optic cables, or network cables. Wireless connections may include, for example, Controller Area Network (CAN), Transmission Control Protocol / Internet Protocol (TCP / IP), Wireless Local Area Network (WLAN), and Remote Direct Memory Access (RDMA) over Converged Ethernet (RoCE).

[0038] The following is combined Figure 1 The communication methods of the first module 101, the second module 102, and the third module 103 shown are illustrated by way of example: the first module 101 can be a communication device of the vehicle OEM, the second module 102 can be a communication device of the product supplier, and the third module 103 can be a communication device of the product supplier; when the first module 101 and the second module 102 transmit encrypted data, the first module 101 is used to send, receive, and verify the transmitted data of the second module 102; the first module 101 also transmits encrypted data with the third module 103, and the first module 101 is used to send, receive, and verify the transmitted data of the third module 103.

[0039] Among them, such as Figure 2The first improved encryption method shown uses encryption method 1 for encrypted transmission between the first module 101 and the second module 102, encryption method 2 for encrypted transmission between the first module 101 and the third module 103, and encryption method 3 for encrypted transmission between the first module 102 and the third module 103; as shown. Figure 2 The second improved encryption method shown uses encryption method 1 for encrypted transmission between the first module 101 and the second module 102, encryption method 2 for encrypted transmission between the first module 101 and the third module 103, and no data transmission between the second module 102 and the third module 103.

[0040] Below Figure 1 Based on the first module 101, the second module 102, and the third module 103 shown, the communication method provided in the embodiments of this application will be further described, such as... Figure 3 The diagram illustrates a communication method. In a specific embodiment, this communication method can be applied to, for example... Figure 6 The communication device 600 and the electronic device 110 equipped with the communication device 600 are shown. Figure 7 The specific process of the embodiments of this application will be described below. Of course, it is understood that this method can be executed by a cloud server with computing power.

[0041] In the embodiments of this application, both the first device and the second device are tools or devices used to transmit information and realize communication, including but not limited to electronic devices with data processing capabilities such as computers, servers or data centers.

[0042] In Example 1, the first device is specifically a vehicle manufactured by the vehicle OEM, and the second device is specifically a component provided by the customer's product supplier for the vehicle, such as a sensor, controller, or actuator.

[0043] In Example 2, the first device is specifically a vehicle manufactured by the vehicle OEM, and the second device is specifically a component provided to the vehicle by the supplier, such as a sensor, controller, or actuator.

[0044] In Example 3, the first device is specifically a vehicle component provided by Party A's product supplier for the vehicle, and the second device is specifically a vehicle component provided by Party A's product supplier for the vehicle.

[0045] The above three examples are merely optional methods for the first and second devices provided in the embodiments of this application, and should not be construed as limiting this application. Depending on the types of the first and second devices, the communication method provided in the embodiments of this application can also be applied to more scenarios.

[0046] The following will address... Figure 3The flowchart shown illustrates the communication method provided in this application embodiment. Specifically, the communication method may include steps 301 to 303.

[0047] Step 301: The first device sends a first data frame to the second device.

[0048] The content corresponding to step 301 includes: the second device receiving the first data frame sent by the first device.

[0049] The first data frame includes: first business data and first encrypted data located at a first position.

[0050] Optionally, the first device may be Figure 1 or Figure 2 The first module 101, the second device can be Figure 1 or Figure 2 The second module 102 or the third module 103.

[0051] In this embodiment, the first data frame is a data frame sent by the first device for transmitting business data and carrying encrypted data.

[0052] In this embodiment of the application, the first service data is the data that needs to be transmitted between the first device and the second device.

[0053] In this embodiment of the application, the first encrypted data is an encryption key that converts the first business data from plaintext to ciphertext; wherein, both the first business data and the first encrypted data occupy data bits in the first data frame.

[0054] For example, in the CAN communication of a vehicle, data is transmitted using standard data frames, which can carry a maximum of 8 bytes. Any byte from byte0 to byte7 can be used as encrypted data. For ease of understanding, taking Byte3 as encrypted data as an example, this embodiment selects 8-bit data with mirroring function in the high four bits (A7-A4) and low four bits (A3-A0), and excludes the cases where the high four bits or low four bits are all 0 or all 1, that is, excludes 0x00 and 0xFF. The remaining Byte3 combination methods include the 14 combination methods shown in Table 1.

[0055] For example, according to Table 1, a set of data containing 14 combinations can be obtained. This set of data is defined as A[i] in the first device, where i is a natural number, and A

[14] = {0x18, 0x24, 0x3C, 0x42, 0x5A, 0x66, 0x7E, 0x81, 0x99, 0xA5, 0xBD, 0xC3, 0xDB, 0xE7}; and is represented as B[j] in the second device, where j is a natural number, so B

[14] = {0x18, 0x24, 0x3C, 0x42, 0x5A, 0x66, 0x7E, 0x81, 0x99, 0xA5, 0xBD, 0xC3, 0xDB, 0xE7}.

[0056] Table 1

[0057] For example, in order to ensure that the data obtained by the first device after encryption according to the set encryption algorithm will not overflow, it is necessary to filter out the 6 combinations marked as excluded in Table 1. According to the remaining 8 combinations, a set of data A[8] of the first device can be obtained. The data contained in A[8] includes {0x18, 0x24, 0x3C, 0x42, 0x5A, 0x81, 0xA5, 0xC3}. A set of data B[8] of the second device also includes {0x18, 0x24, 0x3C, 0x42, 0x5A, 0x81, 0xA5, 0xC3}. By randomly arranging the data contained in A[8] and B[8] respectively, more than 40,000 permutations will be generated, that is, 8! = 40320. Then, the encryption method of data transmission can be used by specifying the first position of the first encrypted data in the first device and the second position of the second encrypted data in the second device.

[0058] For example, the first device sends a first data frame A[i], arranges the data in the first data frame according to a first arrangement method specified by the first device, and adds one or more interference data.

[0059] Optionally, the first device specifies the arrangement of the data contained in A[8] as the first arrangement and adds one or more interference data to A[8]. For example, two interference data are added, namely 0x10 and 0x00, to obtain the first data frame A[i]. The value of i is a natural number from 1 to 10. A

[10] = {0x10, 0x00, 0xA5, 0x3C, 0x18, 0x24, 0x42, 0x5A, 0xC3, 0x81}. When the first device sends the first data frame to the second device, the first position of the first encrypted data is specified in the manner of i = 2 + i. For example, when sending the data located at i = 0, i.e., A[0], the data actually sent is located at i = 2 + i, i.e., A[2] = 0xA5.

[0060] For example, the second device receives the first data frame A[i], arranges the data in the first data frame according to the second arrangement method specified by the first device, adds one or more interference data, obtains and sends the second data frame B[j] to the first device, and completes the first handshake between the first device and the second device.

[0061] Optionally, according to the arrangement of the data contained in B[8] specified by the first device as the second arrangement, the second device adds one or more interference data to B[8], for example, adding interference data as 0x33, to obtain the second data frame B[j], where the value of j is a natural number from 1 to 9, B[9]={0x18, 0xC3, 0xA5, 0x24, 0x42, 0x81, 0x3C, 0x5A, 0x33}; the second position of the second encrypted data is specified according to the method of j=7-j; for example, when j=0, that is, B[0], the actual data pointed to is the data located at j=7-j, that is, B[7]=0x5A.

[0062] For example, when the first arrangement of data in A[8] specified by the first device is the same as the second arrangement of data in B[8], the encryption methods of each device can be prevented from being leaked by adding interference data. When the first arrangement of data in A[8] specified by the first device is different from the second arrangement of data in B[8], the encryption methods of each device can be better prevented from being leaked due to the double support of interference data and arrangement order. Therefore, as long as the first encrypted data pointed to by the first position in the first data frame A[i] and the second encrypted data pointed to by the second position in the second data frame B[j] are the same data, the encryption method is not limited, so that the first device and the second device can only know the encryption method and encrypted data of one party and cannot know the encryption method of the other party.

[0063] Alternatively, both byte2 and byte3 can be used as encrypted data simultaneously to enhance the encryption level.

[0064] Step 302: The second device sends verification data to the first device.

[0065] The content corresponding to step 302 includes: the first device receiving the verification data from the second device.

[0066] The verification data is used to indicate that it is obtained by processing the first data frame and the second data frame sent by the second device according to the first encryption algorithm set by the second device.

[0067] In this embodiment of the application, the verification data serves as reference data for determining whether the data encryption was successful during data transmission, and the first encryption algorithm is an encryption algorithm that converts the verification data from plaintext to ciphertext.

[0068] For example, when the first device receives the second data frame B[j] sent by the second device, it performs an operation on the first and second data frames according to the second encryption algorithm C=A[i]+B[j] set by the first device. For example, according to step 301, the first encrypted data actually points to the data located at i=2+i, A[2]=0xA5, and the second encrypted data actually points to the data located at j=7-j, B[7]=0x5A. The result of the operation is C=0xA5+0x5A=0xFF, and the fourth data frame C is sent to the second device.

[0069] For example, when the second device receives the fourth data frame C, it obtains the verification data D according to the first encryption algorithm D=CB[j] set by the second device, and sends the verification result to the first device. For example, when the result of the above data operation is C=0xFF, the verification data operation yields D=0xFF–0x5A=0xA5.

[0070] Step 303: If the verification data is identical to all the data in the first data frame, the first device sends a third data frame to the second device.

[0071] Correspondingly, the second device receives the third data frame sent by the first device.

[0072] The third data frame includes second service data; the first and third data frames have the same data size, and the second service data size is the sum of the first service data size and the first encrypted data size. In this embodiment, the third data frame converts the data used for data encryption in the first data frame into data for transmission services.

[0073] In this embodiment of the application, the second service data is the data that the first device sends to the second device that needs to be transmitted, wherein the second service data occupies all the data bits in the third data frame.

[0074] For example, the first device compares the verification data D with the first data frame A[i] in the device. If the verification data is the same as all the data in the first data frame, i.e., D=A[i], the verification is successful, indicating that the handshake between the first device and the second device is successful. If the verification data is different from the data in the first data frame, i.e., D≠A[i], the verification is unsuccessful, indicating that the handshake between the first device and the second device is unsuccessful. For example, if the verification result is D=0xA5, and the data A[2]=0xA5 actually pointed to by the first encrypted data of the first device is the same, the verification is successful.

[0075] For example, if the content of the verification data is the same as that of all data in the first data frame, the first device exits the encryption verification state, releases the location of the first encrypted data in the first data frame, and converts it into the location carrying business data. At this time, the first data frame is only used for data transmission.

[0076] In this embodiment, firstly, by using the first and second data frames according to their corresponding encryption methods, including specifying the data reference position or setting the data encryption algorithm, it can be ensured that the first and second devices only know their own encryption methods and it is difficult for them to obtain the other party's encryption method. This effectively avoids one-sided data leakage caused by the two communicating parties knowing each other's encryption formulas and encryption arrays. Secondly, after successful data verification, the first device releases the encryption bits in the first data frame and uses the entire first data frame to transmit business data, thereby increasing the overall amount of data transmitted. Finally, based on the single-byte handshake scheme set above, more complex handshake schemes such as double-byte or multi-byte handshake schemes can also be superimposed, further increasing the difficulty of being cracked.

[0077] Regarding how to encrypt data between two parties during communication transmission, embodiments of this application provide an optional implementation method, such as... Figure 4 The flowchart shown is a communication method for encrypted data, which may specifically include the following steps 401 to 405.

[0078] Step 401: The first device sends a first data frame to the second device.

[0079] The content corresponding to step 401 includes: the second device receiving the first data frame sent by the first device.

[0080] Step 402: The second device sends a second data frame to the first device.

[0081] The content corresponding to step 402 includes: the first device receiving the second data frame from the second device.

[0082] The second data frame includes: third service data and second encrypted data located in the second position; the content of the first service data is the same as that of the third service data.

[0083] In this embodiment of the application, the second data frame is a data frame sent by the second device for transmitting business data and carrying encrypted data.

[0084] In this embodiment, the third service data is the data that the second device sends to the first device to be transmitted; the second encrypted data is the encryption key that converts the third service data from plaintext to ciphertext; wherein, both the third service data and the second encrypted data occupy data bits in the second data frame.

[0085] For example, when the first device sends a first data frame to the second device, in addition to the first encrypted data A[2]=0xA5 actually sent when i=0, i.e., A[0], as listed in step 301, the first device can also specify other locations as the first encrypted data. For example, when sending data at i=7, i.e., A[7], the actual data sent is A[9]=0x81, or when sending data at i=8, i.e., A[8], i is set to 0 according to the method of i=i+2, and the actual data sent is A[0]=0x10. At this time, the second device will also change the second data frame according to the received first data frame to ensure that the data actually pointed to by the second data frame B[j] is consistent with the data actually sent by the first device.

[0086] Alternatively, other encryption methods can be used, as long as i and j cycle within a certain range and the data they refer to is valid.

[0087] In one implementation, receiving a second data frame from a second device includes the following method: The arrangement of the first business data in the first data frame is different from the arrangement of the third business data in the second data frame.

[0088] For example, when no interference data is added by the first device and the second device, both the first data frame and the second data frame contain the data {0x18, 0x24, 0x3C, 0x42, 0x5A, 0x81, 0xA5, 0xC3}. Due to the different arrangement of the data, the first device can set 8! = 40320 arrangements for the first data frame. Similarly, there are also 8! = 40320 arrangements for the second data frame, which greatly increases the difficulty of deciphering the data of both parties in the encrypted verification state.

[0089] Step 403: The first device sends a fourth data frame to the second device.

[0090] The content corresponding to step 403 includes: the second device receiving the fourth data frame sent by the first device.

[0091] The fourth data frame is used to indicate that it is obtained by processing the first and second data frames according to the set second encryption algorithm.

[0092] In this embodiment, the fourth data frame is a data frame sent by the first device for transmitting business data and carrying encrypted data.

[0093] For example, the first device receives the second data frame B[j] sent by the second device, and obtains the calculation result, i.e. the fourth data frame, based on the first data frame A[i] and the set second encryption algorithm C=A[i]+B[j]. For example, based on the first encrypted data A[2]=0xA5 and the second encrypted data B[7]=0x5A in step 301, C=0xA5+0x5A=0xFF is obtained, and the fourth data frame C is sent to the second device.

[0094] Optionally, the first device can also transmit data with multiple second devices. For example, the first device may be the communication equipment of the vehicle manufacturer, and multiple product vendors may act as second devices, transmitting data with the first device. That is, the first device transmits data with the communication equipment of the first product vendor and simultaneously transmits data with the communication equipment of the second product vendor. Each of the three parties executes the aforementioned encryption method, and they do not use each other's encryption methods. Therefore, when other product vendors want to obtain encrypted data, they need the encryption methods of at least two parties. Consequently, neither the first nor the second product vendors can disclose the vehicle manufacturer's products to other product vendors, thus improving the reliability of product confidentiality.

[0095] Optionally, combined with Figure 2The diagram shows encrypted data transmission between the first module 101 and the second module 102, encrypted data transmission between the first module 101 and the third module 103, and no data transmission between the second module 102 and the third module 103. Similarly, both parties transmitting data execute their respective encryption methods. Therefore, assuming that the second-party product supplier will not disclose the encryption method to the third-party product supplier, when the vehicle OEM discloses the encryption method to the third-party product supplier, the third-party product supplier can obtain encryption authentication from both the first and second-party product suppliers. When the first-party product supplier discloses the encryption method to the third-party product supplier, the third-party product supplier can only obtain encryption authentication from the vehicle OEM and cannot obtain encryption authentication from the second-party product supplier. Thus, the probability that the third-party product supplier can obtain the encryption method of the second-party product supplier is 33%. Similarly, neither the first nor the second-party product suppliers can sell their products separately to any other product supplier.

[0096] Step 404: The second device sends verification data to the first device.

[0097] The content corresponding to step 404 includes: the first device receiving the verification data from the second device.

[0098] Step 405: If the verification data is identical to all the data in the first data frame, the first device sends a third data frame to the second device.

[0099] Correspondingly, the second device receives the third data frame sent by the first device.

[0100] The specific steps of steps 401 and 404 to 405 can be found in steps 301 to 303, and will not be repeated here.

[0101] In this embodiment, the first device and the second device perform a first handshake using first encrypted data and second encrypted data, followed by a second handshake using first and second encryption algorithms. Multiple encrypted data can be added as needed, increasing the difficulty of deciphering the encrypted information. Simultaneously, when the verification data matches the content of all data in the first data frame, the space occupied by the encrypted data is converted for data transmission, increasing the amount of transmitted data. Furthermore, when the first device performs encrypted transmission with multiple second devices, since the data arrangement and encryption formula are set by the first device, the multiple second devices cannot know each other's encryption methods, and the second devices can also encrypt each other, ensuring reliable encryption performance.

[0102] Based on the above, and considering the situation where the content of the verification data differs from that in the first data frame, this application provides an optional implementation method, such as... Figure 5The flowchart shown is a communication method for verifying data, which may specifically include the following steps 501 to 508.

[0103] Step 501: The first device sends a first data frame to the second device.

[0104] Correspondingly, the second device receives the first data frame sent by the first device.

[0105] Step 502: The second device sends a second data frame to the first device.

[0106] Correspondingly, the first device receives the second data frame from the second device.

[0107] Step 503: The first device sends a fourth data frame to the second device.

[0108] Correspondingly, the second device receives the fourth data frame sent by the first device.

[0109] Step 504: The second device sends verification data to the first device.

[0110] Correspondingly, the first device receives the verification data from the second device.

[0111] Step 505: If the verification data is identical to all the data in the first data frame, the first device sends a third data frame to the second device.

[0112] Correspondingly, the second device receives the third data frame sent by the first device.

[0113] Step 506: If the content of the verification data is different from that of the data in the first data frame, update the verification count.

[0114] For example, when the first device receives the verification data sent by the second device, if the verification data is different from the data in the first data frame, a verification failure is recorded, and the first and second devices restart. The first device resends the first data frame to the second device and enters the handshake state again.

[0115] Step 507: Determine the number of verifications required if the verification data is different from the data content in the first data frame.

[0116] For example, if the verification data is different from the data in the first data frame, the first device will accumulate one verification failure count.

[0117] Step 508: Based on the number of verifications being greater than or equal to the first threshold, an alarm signal is issued.

[0118] In this embodiment of the application, the first threshold is a constant set by the first device.

[0119] For example, the first threshold can be set to 5. When the number of verifications accumulated by the first device exceeds 5, the first device issues an alarm signal to ensure that abnormal data transmission can be detected in a timely manner.

[0120] For example, the CAN communication of a vehicle is generally set to 10ms. The encrypted transmission between the first and second devices can be completed by five steps: the first device sends a first data frame to the second device, the second device sends a second data frame to the first device, the first device sends a fourth data frame to the second device, the second device sends verification data to the first device, and the first device performs data verification. Therefore, the CAN communication time is 50ms. Even if the number of verifications is accumulated to 5, which takes the longest time, the CAN communication time is 200ms, which will not affect the transmission of business data and can avoid being tracked.

[0121] The specific steps of steps 501 to 505 can be found in steps 301 to 303, and will not be repeated here.

[0122] In this embodiment of the application, when the verification fails, the first device and the second device will restart. At this time, if you want to crack the encrypted data, you will re-collect the data. The fastest time from each data collection to the next data collection is 5 minutes. Furthermore, the data in the first data frame and the second data frame can be randomly set in different arrangements from 8! = 40320 arrangements, which makes the decryption time cost very high. At the same time, the interference data also increases the difficulty of cracking.

[0123] To achieve the functions of the above embodiments, the communication method includes hardware structures and / or software modules corresponding to each function. Those skilled in the art should readily recognize that, based on the units and method steps described in conjunction with the embodiments disclosed in this application, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application scenario and design constraints of the technical solution.

[0124] exist Figures 3 to 5 Based on the communication method shown, the communication device provided in the embodiments of this application will be further described, such as... Figure 6 The diagram shows the structure of a communication device, wherein the communication device 600 of the first device includes: a first transmitting module 610, a first receiving module 620, and a second transmitting module 630.

[0125] The first sending module 610 is configured to send a first data frame to the second device; the first data frame includes: first service data and first encrypted data located at a first position; wherein, the first sending module 610 may include, for example,Figure 1 The first module shown.

[0126] The first receiving module 620 is used to receive verification data from the second device; the verification data is used to indicate that it is obtained by calculating the first data frame and the second data frame sent by the second device according to the first encryption algorithm set by the second device; wherein, the first receiving module 620 may include, for example, Figure 1 The first module shown.

[0127] The second sending module 630 is configured to send a third data frame to the second device if the content of the verification data is identical to that of all data in the first data frame. The third data frame includes second service data; the first and third data frames have the same data size, and the data size of the second service data is the sum of the data size of the first service data and the data size of the first encrypted data. The second sending module 630 may include, for example: Figure 1 The first module shown.

[0128] In some embodiments, the first receiving module 620 includes: receiving a second data frame from a second device; the second data frame includes: third service data and second encrypted data located at a second position; the first service data and the third service data have the same content; and sending a fourth data frame to the second device, the fourth data frame being used to indicate: obtained by operating on the first data frame and the second data frame according to a set second encryption algorithm.

[0129] In some embodiments, the first receiving module 620 further includes: indicating that the data arrangement of the first service data in the first data frame is different from the data arrangement of the third service data in the second data frame.

[0130] In other embodiments, the second sending module 630 includes: updating the number of verifications when the content of the verification data is different from that of the data in the first data frame.

[0131] In other embodiments, the second sending module 630 further includes: determining the number of verifications when the verification data is different from the data content in the first data frame; and issuing an alarm signal based on the number of verifications being greater than or equal to a first threshold.

[0132] exist Figures 3 to 5 Based on the communication method shown, the embodiments of this application also provide a communication device for further description, such as... Figure 6 The diagram shows the structure of a communication device, wherein the communication device 700 of the second device includes: a second receiving module 710 and a third transmitting module 720.

[0133] The second receiving module 710 is configured to receive a first data frame sent by the first device; the first data frame includes: first service data and first encrypted data located at a first position; wherein, the second receiving module 710 may include, for example, Figure 1 The second or third module shown.

[0134] The third sending module 720 is used to send verification data to the first device. The verification data indicates that the first data frame and the second data frame of the second device are processed according to a set first encryption algorithm. The second data frame includes third service data and second encrypted data located at a second position. The content of the first service data and the third service data is the same. The data arrangement of the first service data in the first data frame is different from the data arrangement of the third service data in the second data frame. The third sending module 720 may include, for example, […]. Figure 1 The second or third module shown.

[0135] In some embodiments, the second receiving module 710 includes: sending a second data frame to the first device; receiving a fourth data frame sent by the first device, the fourth data frame indicating that it is obtained by processing the first data frame and the second data frame according to a second encryption algorithm set by the first device.

[0136] According to one aspect of the embodiments of this application, Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 As shown, the electronic device 110 includes a processor 111 and one or more memories 112. The one or more memories 112 are used to store program instructions executed by the processor 111. When the processor 111 executes the program instructions, it implements the above-described interface processing method.

[0137] Furthermore, the processor 111 may include one or more processing cores. The processor 111 runs or executes instructions, programs, code sets, or instruction sets stored in the memory 112, and retrieves data stored in the memory 112. Optionally, the processor 111 may be implemented using at least one hardware form selected from Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 111 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor and may be implemented using a separate communication chip.

[0138] According to one aspect of this application, a computer-readable storage medium is also provided, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable storage medium carries computer-readable instructions that, when executed by a processor, implement the methods in any of the above embodiments.

[0139] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0140] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0141] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0142] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0143] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A communication method, characterized in that, Applied to a first device, the method includes: Send a first data frame to the second device; the first data frame includes: first service data and first encrypted data located at a first position; Receive verification data from the second device; the verification data is used to indicate that it is obtained by calculating the first data frame and the second data frame sent by the second device according to the first encryption algorithm set by the second device. If the verification data is identical to all data in the first data frame, a third data frame is sent to the second device; the third data frame includes: second service data; the first data frame and the third data frame have the same data volume, and the data volume of the second service data is the sum of the data volume of the first service data and the data volume of the first encrypted data.

2. The method according to claim 1, characterized in that, Before receiving the verification data from the second device, the method further includes: The second data frame is received from the second device; the second data frame includes: third service data and second encrypted data located at a second position; the first service data is the same as the content of the third service data. A fourth data frame is sent to the second device, the fourth data frame being used to indicate that the first data frame and the second data frame are obtained by processing according to the set second encryption algorithm.

3. The method according to claim 2, characterized in that, The method of receiving the second data frame from the second device includes: The arrangement of the first service data in the first data frame is different from the arrangement of the third service data in the second data frame.

4. The method according to claim 1, characterized in that, The first device maintains the verification count of the first data frame. After receiving the second data frame from the second device, the method further includes: If the content of the verification data is different from that of the data in the first data frame, the number of verifications is updated.

5. The method according to claim 4, characterized in that, The method further includes updating the verification count when the content of the verification data is different from that of the data in the first data frame. The number of verifications when the verification data is different from the data content in the first data frame; An alarm signal is issued if the number of verifications is greater than or equal to a first threshold.

6. A communication method, characterized in that, Applied to a second device, the method includes: Receive a first data frame sent by a first device; the first data frame includes: first service data and first encrypted data located at a first position; Verification data is sent to the first device; the verification data is used to indicate that it is obtained by processing the first data frame and the second data frame of the second device according to the set first encryption method; the second data frame includes: third service data and second encrypted data located in the second position; the content of the first service data and the third service data are the same; the data arrangement of the first service data in the first data frame is different from the data arrangement of the third service data in the second data frame.

7. The method according to claim 6, characterized in that, After receiving the first data frame sent by the first device, the method further includes: Send the second data frame to the first device; The system receives a fourth data frame sent by the first device, the fourth data frame being used to indicate that the first data frame and the second data frame are obtained by processing according to the second encryption algorithm set by the first device.

8. A communication device, characterized in that, Applied to a first device, the device includes: A first sending module is configured to send a first data frame to a second device; the first data frame includes: first service data and first encrypted data located at a first position; A first receiving module is configured to receive verification data from the second device; the verification data is used to indicate that it is obtained by performing calculations on the first data frame and the second data frame sent by the second device according to a first encryption algorithm set by the second device. The second sending module is configured to send a third data frame to the second device when the content of the verification data is the same as that of all data in the first data frame; the third data frame includes: second service data; the data volume of the first data frame and the third data frame is the same, and the data volume of the second service data is the sum of the data volume of the first service data and the data volume of the first encrypted data.

9. A communication device, characterized in that, Applied to a second device, the device includes: The second receiving module is configured to receive a first data frame sent by the first device; the first data frame includes: first service data and first encrypted data located at a first position; The third sending module is used to send verification data to the first device; the verification data is used to indicate that it is obtained by operating on the first data frame and the second data frame of the second device according to the set first encryption algorithm; the second data frame includes: third service data and second encrypted data located in a second position; the content of the first service data and the third service data is the same; the data arrangement of the first service data in the first data frame is different from the data arrangement of the third service data in the second data frame.

10. An electronic device, characterized in that, The electronic device includes: processor; A memory storing electronically readable instructions, which, when executed by the processor, implement the communication method as described in any one of claims 1 to 7.

Images