Method, system, vehicle and storage medium for processing synchronization messages

Abstract

The embodiment of the application provides a kind of synchronous message processing method, system, vehicle and storage medium, comprising: vehicle area controller enters wake-up state after sending network management message by the first partition and the second partition of vehicle area controller;In the case where the first partition and / or the second partition successfully sends network management message, the sending of safety vehicle communication synchronization message in the route path group of safety vehicle communication synchronization message is triggered, and the sending success notification of safety vehicle communication synchronization message is received by the basic software manager of the first partition and the basic software manager of the second partition respectively;The sending function of safety vehicle communication message is started by the basic software manager of the first partition and the basic software manager of the second partition according to the sending success notification of safety vehicle communication synchronization message. Ensure that the adversary node ECU receives SecOC synchronization message first, avoid the failure of adversary node verification SecOC message leading to functional abnormality, improve the communication reliability of domain controller.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and more particularly to a method, system, vehicle, and storage medium for processing synchronization messages. Background Technology

[0002] In a traditional AUTOSAR link, after the ECU wakes up, CanNM (CAN Network Management) first triggers the transmission of NM messages, and then COM (Communication Management) triggers the transmission of SecOC (Secure Onboard Communication) synchronization messages and SecOC messages, or the FvM initializes and sends SecOC synchronization messages. Due to the different wake-up order of RT1 (Parition1) and RT2 (Parition2), the transmission order of SecOC synchronization messages and SecOC messages may be disordered, causing the ECU to fail to verify SecOC messages. Summary of the Invention

[0003] This application provides a method, system, vehicle, and storage medium for processing synchronization messages, aiming to solve the problem of SecOC synchronization messages and SecOC message sending order disorder caused by the asynchronous wake-up times of different cores in the asymmetric multiprocessing architecture of secure airborne communication, which leads to the failure of secure vehicle communication message verification.

[0004] The first aspect of this application provides a method for processing synchronization messages, the method comprising the following steps: in response to a wake-up command, controlling an in-vehicle domain controller to enter a wake-up state, and sending network management messages through a first partition and a second partition of the in-vehicle domain controller; if the first partition and / or the second partition successfully sends the network management messages, triggering the transmission of secure in-vehicle communication synchronization messages in a secure in-vehicle communication synchronization message routing path group, and receiving a successful transmission notification of the secure in-vehicle communication synchronization messages through the basic software manager of the first partition and the basic software manager of the second partition respectively; and enabling the transmission function of secure in-vehicle communication messages using the basic software manager of the first partition and the basic software manager of the second partition according to the successful transmission notification of the synchronization messages.

[0005] By using the above technical solution, the secure vehicle communication synchronization message is sent first, and then the secure vehicle communication message is triggered, ensuring that the node ECU receives the SecOC synchronization message first. This avoids functional abnormalities caused by the node ECU failing to verify the SecOC message, and improves the reliability of secure vehicle communication in the asymmetric multiprocessing architecture of the domain controller.

[0006] Optionally, before sending network management messages through the first and second partitions of the vehicle domain controller, the process includes: acquiring secure vehicle communication messages, secure vehicle communication synchronization messages, and application messages involved in information exchange in the vehicle domain controller; and dividing the secure vehicle communication messages, the secure vehicle communication synchronization messages, and the application messages into secure vehicle communication message routing path groups, secure vehicle communication synchronization message routing path groups, and application message routing path groups, respectively.

[0007] The above technical solution achieves precise isolation of the three types of messages (safe vehicle communication messages, synchronization messages, and application messages) by grouping them, thus avoiding the chaotic sending order caused by the mixing of different types of messages.

[0008] Optionally, after sending network management messages through the first and second partitions of the vehicle domain controller, the method further includes: detecting whether the transmission duration of the network management messages of the first partition is less than or equal to a preset duration; if the transmission duration of the network management messages of the first partition is less than or equal to the preset duration, then detecting whether the network management messages of the first to Nth CAN channels in the first partition have been successfully transmitted, where N is an integer; if the network management messages of the first to Nth CAN channels have been successfully transmitted, then determining that the network management messages of the first partition have been successfully transmitted.

[0009] By using the above technical solution, the transmission time of the first partition network management message is constrained by a preset duration, which avoids invalid waiting caused by transmission timeout and improves the efficiency of message transmission timeliness determination. Combined with the transmission success status of the first to Nth CAN channels, a comprehensive determination is made to eliminate the interference of single channel anomalies on the overall result, ensuring the accuracy of the first partition network management message transmission success determination and providing a reliable prerequisite for triggering the subsequent transmission of safe vehicle communication synchronization messages.

[0010] Optionally, after detecting whether the transmission time of the network management message of the first partition is less than or equal to the preset duration, the process includes: if the transmission duration of the network management message of the first partition is greater than the preset duration, then detecting whether the network management message of the N+1 to Mth CAN channels in the first partition has been successfully transmitted, where M is an integer; if the network management message of the N+1 to Mth CAN channels has been successfully transmitted, then determining that the network management message of the first partition has been successfully transmitted.

[0011] With the above technical solution, when the network management message transmission of the first partition times out, the system automatically switches to detect other CAN channels of the first partition. By detecting other channels, the transmission status of the network management message can be quickly determined, reducing timing delays.

[0012] Optionally, after sending network management messages through the first and second partitions of the vehicle domain controller, the method further includes: detecting whether the transmission duration of the network management messages in the second partition is less than or equal to a preset duration; if the transmission duration of the network management messages in the second partition is less than or equal to the preset duration, then detecting whether the network management messages of the first to Nth CAN channels in the second partition have been successfully transmitted, where N is an integer; if the network management messages of the first to Nth CAN channels have been successfully transmitted, then determining that the network management messages of the second partition have been successfully transmitted.

[0013] By using the above technical solution, the transmission time of the second partition network management message is constrained by a preset duration, which avoids invalid waiting caused by transmission timeout and improves the efficiency of message transmission timeliness determination. Combined with the transmission success status of the first to Nth CAN channels, a comprehensive determination is made to eliminate the interference of single channel anomalies on the overall result, ensuring the accuracy of the second partition network management message transmission success determination and providing a reliable prerequisite for triggering the subsequent transmission of safe vehicle communication synchronization messages.

[0014] Optionally, after detecting whether the transmission time of the network management message of the second partition is less than or equal to the preset duration, the process includes: if the transmission duration of the network management message of the second partition is greater than the preset duration, then detecting whether the network management message of the N+1 to Mth CAN channels in the second partition has been successfully transmitted, where M is an integer; if the network management message of the N+1 to Mth CAN channels has been successfully transmitted, then determining that the network management message of the second partition has been successfully transmitted.

[0015] With the above technical solution, when the network management message transmission of the second partition times out, the system automatically switches to detect other CAN channels of the second partition. By detecting other channels, the transmission status of the network management message can be quickly determined, reducing timing delays.

[0016] Optionally, after triggering the transmission of secure vehicle communication messages in the secure vehicle communication message routing path group using the communication management module in the vehicle domain controller, the method further includes: receiving and parsing secure vehicle communication synchronization messages through the device ECU node to obtain synchronization counter values ​​and reset counter values; receiving the secure vehicle communication messages through the device ECU node and verifying the secure vehicle communication messages according to the synchronization counter values ​​and the reset counter values; if the verification passes, the device ECU node interprets the data of the secure vehicle communication messages normally; if the verification fails, the device ECU node does not perform the interpretation operation of the secure vehicle communication messages.

[0017] The above technical solution verifies the SecOC message by comparing the synchronization counter value obtained from parsing the synchronization message with the reset counter value, ensuring that the verification basis is the latest valid data and avoiding misjudgments caused by parameter failure. When the verification fails, the SecOC message is rejected, preventing tampered or forged insecure messages from entering the application layer and avoiding security risks. Only when the verification passes is the data processed normally, ensuring the stability and reliability of vehicle safety-related functions.

[0018] A second aspect of this application provides a synchronization message processing system, comprising: a network management message sending module, configured to respond to a wake-up command, control an on-board domain controller to enter a wake-up state, and send network management messages through a first partition and a second partition; a secure on-board communication synchronization message sending module, configured to trigger the sending of secure on-board communication synchronization messages in a secure on-board communication synchronization message routing path group when the network management messages are successfully sent in the first partition and / or the second partition, and receive a secure on-board communication synchronization message sending success notification through the basic software manager of the first partition and the basic software manager of the second partition respectively; and a secure on-board communication message sending module, configured to enable the secure on-board communication message sending function based on the synchronization message sending success notification using the basic software manager of the first partition and the basic software manager of the second partition.

[0019] Optionally, before sending network management messages through the first and second partitions of the vehicle domain controller, the network management message sending module is further configured to: acquire secure vehicle communication messages, secure vehicle communication synchronization messages, and application messages involved in information exchange in the vehicle domain controller; and divide the secure vehicle communication messages, the secure vehicle communication synchronization messages, and the application messages into secure vehicle communication message routing path groups, secure vehicle communication synchronization message routing path groups, and application message routing path groups, respectively.

[0020] Optionally, after sending network management messages through the first and second partitions of the vehicle domain controller, the network management message sending module is further configured to: detect whether the sending duration of the network management message of the first partition is less than or equal to a preset duration; if the sending duration of the network management message of the first partition is less than or equal to the preset duration, then detect whether the network management messages of the first to Nth CAN channels in the first partition have been successfully sent, where N is an integer; if the network management messages of the first to Nth CAN channels have been successfully sent, then determine that the network management message of the first partition has been successfully sent.

[0021] Optionally, after detecting whether the transmission time of the network management message of the first partition is less than or equal to the preset duration, the network management message transmission module is further configured to: if the transmission duration of the network management message of the first partition is greater than the preset duration, then detect whether the network management message of the N+1 to Mth CAN channels in the first partition has been successfully transmitted, where M is an integer; if the network management message of the N+1 to Mth CAN channels has been successfully transmitted, then determine that the network management message of the first partition has been successfully transmitted.

[0022] Optionally, after sending network management messages through the first and second partitions of the vehicle domain controller, the network management message sending module is further configured to: detect whether the sending duration of the network management message of the second partition is less than or equal to a preset duration; if the sending duration of the network management message of the second partition is less than or equal to the preset duration, then detect whether the network management messages of the first to Nth CAN channels in the second partition have been successfully sent, where N is an integer; if the network management messages of the first to Nth CAN channels have been successfully sent, then determine that the network management message of the second partition has been successfully sent.

[0023] Optionally, after detecting whether the transmission time of the network management message of the second partition is less than or equal to the preset duration, the network management message transmission module is further configured to: if the transmission duration of the network management message of the second partition is greater than the preset duration, then detect whether the network management message of the N+1 to Mth CAN channels in the second partition has been successfully transmitted, where M is an integer; if the network management message of the N+1 to Mth CAN channels has been successfully transmitted, then determine that the network management message of the second partition has been successfully transmitted.

[0024] Optionally, after the communication management module in the vehicle domain controller triggers the transmission of secure vehicle communication messages in the secure vehicle communication message routing path group, the secure vehicle communication message transmission module is further configured to: receive and parse secure vehicle communication synchronization messages through the device ECU node to obtain synchronization counter values ​​and reset counter values; receive the secure vehicle communication messages through the device ECU node and verify the secure vehicle communication messages according to the synchronization counter values ​​and the reset counter values; if the verification passes, the device ECU node interprets the data of the secure vehicle communication messages normally; if the verification fails, the device ECU node does not perform the interpretation operation of the secure vehicle communication messages.

[0025] A third aspect of this application provides a vehicle, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the synchronization message processing method as described in the above embodiments.

[0026] A fourth aspect of this application provides a non-volatile computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the synchronization message processing method as described in the above embodiments. Attached Figure Description

[0027] Figure 1 This is a flowchart of a method for processing synchronization messages provided in an embodiment of this application; Figure 2 This is a schematic diagram of an asymmetric multi-core architecture provided in an embodiment of this application; Figure 3 This is a diagram defining the content format of the freshness value in an embodiment of the FvM (Freshness Value Manager) of this application. Figure 4 This is a schematic diagram illustrating the content format definition of a SecOC synchronization message according to an embodiment of this application; Figure 5 This is a schematic diagram illustrating the content format definition of a SecOC message according to an embodiment of this application; Figure 6 This is a schematic diagram of message packets according to an embodiment of this application; Figure 7 This is a flowchart of a method for processing synchronization messages provided in an embodiment of this application; Figure 8 This is a structural diagram of the synchronization message processing system provided in the embodiments of this application; Figure 9 This is a structural diagram of the vehicle provided in the embodiments of this application. Detailed Implementation

[0028] To make the technical problems, technical solutions, and beneficial effects solved by this application clearer, the following detailed description is provided in conjunction with embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0029] Before describing the specific processing method of the synchronization message in this application, the terms used in this application will be explained.

[0030] RoutingPathGroups refers to the routing path groups; PduR (PDU Router); BswM (Basic Software Manager); PduR_EnableRouting is a core interface function provided by the PDU Router (PduR) module, used to enable routing and forwarding functions for specific PDUs (Protocol Data Units) or PDU groups; Partition1 refers to partition number 1 in the asymmetric multi-core architecture; Partition2 refers to partition number 2 in the asymmetric multi-core architecture. BswMNotification_FvM_SendSecSynMsg is an inter-module event notification function used to transmit "SecOC synchronization message" related status or trigger signals between BswM (Basic Software Mode Manager) and FvM (Function Virtualization Manager).

[0031] Specifically, the method for processing synchronization messages provided in this application includes the following steps: In step S101, in response to the wake-up command, the vehicle domain controller is controlled to enter the wake-up state, and network management messages are sent through the first and second partitions of the vehicle domain controller.

[0032] The synchronization message processing method of this application is applied to an asymmetric multi-core architecture, which includes a first partition (Partition1) and a second partition (Partition2). Both Partition1 and Partition2 adopt the AUTOSAR architecture, and their structures are as follows: Figure 2 As shown, both Partition 1 and Partition 2 include modules such as SecOC, FvM, PduR, and BswM. Information exchange between different Partitions is achieved through a shared data storage area. Figures 3-5 These are schematic diagrams of the FvM freshness value, SecOC synchronization message, and SecOC message content format definition. The SecOC synchronization message is sent every 30 seconds, with each 3 frames spaced 40ms apart. The device node ECU must first receive the SecOC synchronization message to update its local freshness value to the latest version before it can successfully verify the SecOC message. Otherwise, the Com layer cannot transmit the SecOC message data, and the application function logic will be affected.

[0033] Optionally, in some embodiments, before sending network management messages through the first and second partitions of the vehicle domain controller, the process includes: obtaining secure vehicle communication messages, secure vehicle communication synchronization messages, and application messages involved in information exchange in the vehicle domain controller; and dividing the secure vehicle communication messages, secure vehicle communication synchronization messages, and application messages into secure vehicle communication message routing path groups, secure vehicle communication synchronization message routing path groups, and application message routing path groups, respectively.

[0034] After the vehicle controller ECU is woken up, the vehicle domain controller enters the wake-up state. At this time, the first partition of the vehicle domain controller is triggered by CanNm (i.e., CAN network management module) to send NM network management messages and Com (communication management module) to send APP messages (i.e., application messages). The second partition is triggered by CanNm (i.e., CAN network management module) to send NM network management messages and Com (communication management module) to send APP messages (i.e. application messages).

[0035] Use a Python script to group the SecOC (Secure In-Vehicle Communication) messages, SecOC synchronization messages, and other application messages in the CAN Communication Matrix (CMX) into different routing path groups (PduRRoutingPathGroups_XX), such as... Figure 6 As shown, the transmission of packets for different routing path groups is enabled or disabled by the corresponding underlying software manager (BswM).

[0036] The above technical solution achieves precise isolation of the three types of messages (safe vehicle communication messages, synchronization messages, and application messages) by grouping them, thus avoiding the chaotic sending order caused by the mixing of different types of messages.

[0037] Optionally, in some embodiments, after sending network management messages through the first and second partitions of the vehicle domain controller, the method further includes: detecting whether the transmission duration of the network management messages of the first partition is less than or equal to a preset duration; if the transmission duration of the network management messages of the first partition is less than or equal to the preset duration, then detecting whether the network management messages of the first to Nth CAN channels in the first partition have been successfully transmitted, where N is an integer; if the network management messages of the first to Nth CAN channels have been successfully transmitted, then determining that the network management messages of the first partition have been successfully transmitted.

[0038] The preset duration can be a threshold set by the user, a threshold obtained through a limited number of experiments, or a threshold obtained through a limited number of computer simulations; no specific limitation is made here. The first partition, Partition1, is the master partition, and the second partition, Partition2, is the slave partition. The master FvM and slave FvM monitor the CAN channel network management message sending status of the first and second partitions of the central domain controller through the successful sending callback of the 54F network management message (BswMNotification_FvM_SendSecSynMsg()).

[0039] The Master FvM starts timer T1 to check whether the transmission duration T1 of the network management message in the first partition (Partition 1) is less than or equal to the preset duration. If the transmission duration T1 of the network management message in the first partition (Partition 1) is less than or equal to the preset duration, it checks whether the network management message of CAN channels 0 to 6 in the first partition has been successfully transmitted.

[0040] If the network management message of CAN channel RT1 (i.e., Partition 1) in the first partition 0~6 is successfully sent, the BswMNotification_FvM_SendSecSynMsg(uint8 Channel, uint8 Status) interface is called to notify FvM that the NM message of a certain channel has been sent (Status is: 1 means that the NM message was sent successfully, and 0 means that the NM message was not sent).

[0041] By using the above technical solution, the transmission time of the first partition network management message is constrained by a preset duration, which avoids invalid waiting caused by transmission timeout and improves the efficiency of message transmission timeliness determination. Combined with the transmission success status of the first to Nth CAN channels, a comprehensive determination is made to eliminate the interference of single channel anomalies on the overall result, ensuring the accuracy of the first partition network management message transmission success determination and providing a reliable prerequisite for triggering the subsequent transmission of safe vehicle communication synchronization messages.

[0042] Optionally, in some embodiments, after detecting whether the transmission time of the network management message of the first partition is less than or equal to a preset duration, the method includes: if the transmission duration of the network management message of the first partition is greater than the preset duration, then detecting whether the network management message of the N+1 to Mth CAN channels in the second partition has been successfully transmitted, where M is an integer; if the network management message of the N+1 to Mth CAN channels has been successfully transmitted, then determining that the network management message of the first partition has been successfully transmitted.

[0043] Understandably, if the transmission duration of the network management message of the first partition is longer than the preset duration, the FvM of the first partition RT1 checks whether the network management message of the CAN channel with channel 7 to 13 has been successfully transmitted. If the network management message of the CAN channel with channel 7 to 13 has been successfully transmitted, it is also determined that the network management message of the first partition has been successfully transmitted.

[0044] With the above technical solution, when the network management message transmission of the first partition times out, the system automatically switches to detect other CAN channels of the first partition. By detecting other channels, the transmission status of the network management message can be quickly determined, reducing timing delays.

[0045] Optionally, in some embodiments, after sending network management messages through the first and second partitions of the vehicle domain controller, the method further includes: detecting whether the transmission duration of the network management messages of the second partition is less than or equal to a preset duration; if the transmission duration of the network management messages of the second partition is less than or equal to the preset duration, then detecting whether the network management messages of the first to Nth CAN channels in the second partition have been successfully transmitted, where N is an integer; if the network management messages of the first to Nth CAN channels have been successfully transmitted, then determining that the network management messages of the second partition have been successfully transmitted.

[0046] Specifically, the Slave FvM starts timer T2 to check whether the transmission duration T2 of the network management message in the second partition (Partition 2) is less than or equal to the preset duration. If the transmission duration of the network management message in the second partition (Partition 2) is less than or equal to the preset duration, it checks whether the network management message of CAN channels 0 to 6 in the second partition has been successfully transmitted.

[0047] If the network management message of CAN channels 0-6 in the second partition is successfully sent, the BswMNotification_FvM_SendSecSynMsg(uint8 Channel, uint8 Status) interface is called to notify FvM that the NM message of a certain channel has been sent (Status is: 1 means that the NM message was sent successfully, and 0 means that the NM message was not sent).

[0048] By using the above technical solution, the transmission time of the second partition network management message is constrained by a preset duration, which avoids invalid waiting caused by transmission timeout and improves the efficiency of message transmission timeliness determination. Combined with the transmission success status of the first to Nth CAN channels, a comprehensive determination is made to eliminate the interference of single channel anomalies on the overall result, ensuring the accuracy of the second partition network management message transmission success determination and providing a reliable prerequisite for triggering the subsequent transmission of safe vehicle communication synchronization messages.

[0049] Optionally, in some embodiments, after detecting whether the transmission time of the network management message of the second partition is less than or equal to a preset duration, the method includes: if the transmission duration of the network management message of the second partition is greater than the preset duration, then detecting whether the network management message of the N+1 to Mth CAN channels in the second partition has been successfully transmitted, where M is an integer; if the network management message of the N+1 to Mth CAN channels has been successfully transmitted, then determining that the network management message of the second partition has been successfully transmitted.

[0050] Understandably, if the transmission duration T2 of the network management message of the second partition is greater than the preset duration, the FvM of the second partition RT2 (i.e., Partition2) checks whether the network management message of the CAN channel with channel 7 to 13 has been successfully transmitted. If the network management message of the CAN channel with channel 7 to 13 has been successfully transmitted, then the network management message of the second partition is determined to have been successfully transmitted.

[0051] With the above technical solution, when the network management message transmission of the second partition times out, the system automatically switches to detect other CAN channels of the second partition. The transmission status of the network management message is quickly determined by detecting other channels, which reserves time for the subsequent triggering of SecOC synchronization messages and reduces timing delays.

[0052] In step S102, if the network management message is successfully sent in the first partition and / or the second partition, the transmission of the secure vehicle communication synchronization message in the secure vehicle communication synchronization message routing path group is triggered, and the secure vehicle communication synchronization message transmission success notification is received by the basic software manager of the first partition and the basic software manager of the second partition, respectively.

[0053] If the network management message of the CAN channel in either partition RT1 or partition RT2 is successfully sent, that is, if the Master FvM detects that the CAN network management message of Partition1 has been successfully sent through the interface BswMNotification_FvM_SendSecSynMsg(), or the Slave FvM detects that the CAN network management message of Partition2 has been successfully sent, then the sending of the secure vehicle communication synchronization message in the secure vehicle communication synchronization message routing path group is triggered. If the secure vehicle communication synchronization message is successfully sent, the Master / Slave FvM is notified of the successful sending of the secure vehicle communication synchronization message through the interface ComNotification_FvM_SecSyn_CanX_Callout().

[0054] The basic software manager of the first partition and the basic software manager of the second partition receive a successful notification of the synchronization message sent for secure in-vehicle communication.

[0055] In step S103, the basic software manager of the first partition and the basic software manager of the second partition are used to enable the sending function of the safe vehicle communication message based on the successful sending notification of the synchronization message.

[0056] Specifically, the base software manager BSWM of the first partition and the base software manager BSWM of the second partition enable the transmission of SecOC messages by sending a success notification through the interface BSWM_GENERIC_BswM_ModeRequestPort_SecOCSYNC based on the secure vehicle communication synchronization message, thereby enabling the path routing group PduR_EnableRouting for SecOC messages.

[0057] The SecOC messages of the first partition RT1 and the first partition RT2 are sent normally by the Com, and the SecOC messages of the device node ECU are verified normally.

[0058] Optionally, in some embodiments, after triggering the transmission of secure vehicle communication messages in the secure vehicle communication message routing path group using the communication management module in the vehicle domain controller, the method further includes: receiving and parsing secure vehicle communication synchronization messages through the device ECU node to obtain synchronization counter values ​​and reset counter values; receiving secure vehicle communication messages through the device ECU node and verifying the secure vehicle communication messages based on the synchronization counter values ​​and reset counter values; if the verification passes, the device ECU node interprets the data of the secure vehicle communication messages normally; if the verification fails, the device ECU node does not perform the interpretation operation of the secure vehicle communication messages.

[0059] Specifically, after triggering the transmission of secure vehicle communication messages in the secure vehicle communication message routing path group using the communication management module in the vehicle domain controller, the device ECU node first receives and parses the secure vehicle communication synchronization message, extracting the synchronization counter value and reset counter value from it: Then, the secure vehicle communication message is received and verified by combining the obtained synchronization counter value and reset counter value. The verification logic usually includes: timeliness verification and consistency verification.

[0060] Further perform the corresponding operations based on the verification results: Verification passed: This indicates that the message is genuine, unaltered, and within its valid period, and that the ECU node can normally parse the message data and execute corresponding instructions (such as controlling actuator actions).

[0061] Verification failed: This indicates that the message may be forged, tampered with, or expired, and the ECU node refuses to parse the data.

[0062] The above technical solution verifies the SecOC message by comparing the synchronization counter value obtained from parsing the synchronization message with the reset counter value, ensuring that the verification basis is the latest valid data and avoiding misjudgments caused by parameter failure. When the verification fails, the SecOC message is rejected, preventing tampered or forged insecure messages from entering the application layer and avoiding security risks. Only when the verification passes is the data processed normally, ensuring the stability and reliability of vehicle safety-related functions.

[0063] To enable those skilled in the art to further understand the synchronization message processing method of the embodiments of this application, the following detailed description is provided in conjunction with specific embodiments, such as... Figure 7 As shown.

[0064] Step 1: After the ECU is woken up, CanNm triggers the sending of NM messages and Com triggers the sending of APP messages.

[0065] Step 2: Start timer T1 in the FvM of the first partition RT1 and start timer T2 in the FvM of the second partition RT2 to determine whether the NM messages of the first partition RT1 and the second partition RT2 have been successfully sent.

[0066] If the transmission duration T1 of the NM message in the first partition RT1 does not time out, then the FvM of RT1 checks whether the NM message of the CAN channel with channel 0 to 6 has been successfully transmitted. If the NM message of the first partition RT1 is successfully transmitted, then the SecOC synchronization message is triggered. If the transmission duration T1 of the NM message in the first partition RT1 times out, then the FvM of RT1 checks whether the NM message of the CAN channel with channel 7 to 13 has been successfully transmitted. If the NM message of RT1 is successfully transmitted, then the SecOC synchronization message is triggered.

[0067] If the transmission duration T2 of the NM message in the second partition RT2 does not time out, then the FvM of RT2 checks whether the NM message of the CAN channel with channel 0 to 6 has been successfully transmitted. If the NM message of the second partition RT2 is successfully transmitted, then the SecOC synchronization message is triggered. If the transmission duration T2 of the NM message in the second partition RT2 times out, then the FvM of RT2 checks whether the NM message of the CAN channel with channel 7 to 13 has been successfully transmitted. If the NM message of RT2 is successfully transmitted, then the SecOC synchronization message is triggered.

[0068] Step 3: After the SecOC synchronization message is successfully sent, the BswM of RT1 and RT2 detects that the SecOC synchronization message has been successfully sent, and the BswM of RT1 and RT2 will enable the transmission permission function of the SecOC message group.

[0069] Step 4: The SecOC messages of RT1 and RT2 are sent normally by the Com, and the SecOC messages of the device node ECU are verified normally.

[0070] Therefore, in response to the wake-up command, the vehicle domain controller enters the wake-up state and sends network management messages through its first and second partitions. If the first and / or second partitions successfully send network management messages, the transmission of secure vehicle communication synchronization messages in the secure vehicle communication synchronization message routing path group is triggered. The basic software managers of the first and second partitions respectively receive successful notifications of the secure vehicle communication synchronization message transmission. Based on the successful notifications, the basic software managers of the first and second partitions enable the secure vehicle communication message transmission function. This solves the problem of disordered SecOC synchronization messages and SecOC message transmission order caused by asynchronous wake-up times of different cores in the asymmetric multiprocessing architecture for secure vehicle communication, which leads to secure vehicle communication message verification failures. It ensures that the counterpart node ECU receives the SecOC synchronization message first, avoiding functional abnormalities caused by failed SecOC message verification by the counterpart node ECU, and improving the reliability of secure vehicle communication in the asymmetric multiprocessing architecture for secure vehicle communication.

[0071] This application also provides a synchronization message processing system 10, please refer to... Figure 8 The system includes: a network management message sending module 100, used to control the vehicle domain controller to enter the wake-up state in response to a wake-up command, and send network management messages through the first partition and the second partition; a secure vehicle communication synchronization message sending module 200, used to trigger the sending of secure vehicle communication synchronization messages in the secure vehicle communication synchronization message routing path group when the network management message is successfully sent in the first partition and / or the second partition, and to receive the secure vehicle communication synchronization message sending success notification through the basic software manager of the first partition and the basic software manager of the second partition respectively; and a secure vehicle communication message sending module 300, used to enable the secure vehicle communication message sending function according to the synchronization message sending success notification by utilizing the basic software manager of the first partition and the basic software manager of the second partition.

[0072] Optionally, in some embodiments, before sending network management messages through the first and second partitions of the vehicle domain controller, the network management message sending module 100 is further configured to: acquire secure vehicle communication messages, secure vehicle communication synchronization messages, and application messages involved in information exchange in the vehicle domain controller; and divide the secure vehicle communication messages, secure vehicle communication synchronization messages, and application messages into secure vehicle communication message routing path groups, secure vehicle communication synchronization message routing path groups, and application message routing path groups, respectively.

[0073] Optionally, in some embodiments, after sending network management messages through the first and second partitions of the vehicle domain controller, the network management message sending module 100 is further configured to: detect whether the sending duration of the network management message of the first partition is less than or equal to a preset duration; if the sending duration of the network management message of the first partition is less than or equal to the preset duration, then detect whether the network management messages of the first to Nth CAN channels in the first partition have been successfully sent, where N is an integer; if the network management messages of the first to Nth CAN channels have been successfully sent, then determine that the network management message of the first partition has been successfully sent.

[0074] Optionally, in some embodiments, after detecting whether the transmission time of the network management message of the first partition is less than or equal to a preset duration, the network management message transmission module 100 is further configured to: if the transmission duration of the network management message of the first partition is greater than the preset duration, detect whether the network management message of the N+1 to Mth CAN channels in the first partition has been successfully transmitted, where M is an integer; if the network management message of the N+1 to Mth CAN channels has been successfully transmitted, determine that the network management message of the first partition has been successfully transmitted.

[0075] Optionally, after sending network management messages through the first and second partitions of the vehicle domain controller, the network management message sending module 100 is further configured to: detect whether the sending duration of the network management message of the second partition is less than or equal to a preset duration; if the sending duration of the network management message of the second partition is less than or equal to the preset duration, then detect whether the network management messages of the first to Nth CAN channels in the second partition have been successfully sent, where N is an integer; if the network management messages of the first to Nth CAN channels have been successfully sent, then determine that the network management message of the second partition has been successfully sent.

[0076] Optionally, after detecting whether the transmission time of the network management message of the second partition is less than or equal to the preset duration, the network management message transmission module 100 is further configured to: if the transmission duration of the network management message of the second partition is greater than the preset duration, then detect whether the network management message of the N+1 to Mth CAN channels in the second partition has been successfully transmitted, where M is an integer; if the network management message of the N+1 to Mth CAN channels has been successfully transmitted, then determine that the network management message of the second partition has been successfully transmitted.

[0077] Optionally, in some embodiments, after the secure vehicle communication message in the secure vehicle communication message routing path group is triggered by the communication management module in the vehicle domain controller, the secure vehicle communication message sending module 300 is configured to: receive and parse secure vehicle communication synchronization messages through the device ECU node to obtain synchronization counter values ​​and reset counter values; receive secure vehicle communication messages through the device ECU node and verify the secure vehicle communication messages according to the synchronization counter values ​​and reset counter values; if the verification passes, the device ECU node interprets the data of the secure vehicle communication message normally; if the verification fails, the device ECU node does not perform the interpretation operation of the secure vehicle communication message.

[0078] Therefore, by responding to a wake-up command, the vehicle domain controller is controlled to enter the wake-up state and network management messages are sent through the first and second partitions of the vehicle domain controller. If the network management messages are successfully sent in the first and / or second partitions, the transmission of secure vehicle communication synchronization messages in the secure vehicle communication synchronization message routing path group is triggered. The basic software managers of the first and second partitions respectively receive successful notifications of the secure vehicle communication synchronization message transmission. Based on the successful notifications, the basic software managers of the first and second partitions enable the secure vehicle communication message transmission function. This solves the problem of disordered SecOC synchronization messages and SecOC message transmission order caused by asynchronous wake-up times of different cores in the asymmetric multiprocessing architecture of secure vehicle communication, which leads to the failure of secure vehicle communication message verification. It ensures that the counterpart node ECU receives the SecOC synchronization message first, avoiding functional abnormalities caused by the failure of SecOC message verification of the counterpart node ECU, and improving the reliability of secure vehicle communication in the asymmetric multiprocessing architecture of domain controller secure vehicle communication.

[0079] This application also provides a vehicle 60, please refer to... Figure 9 It includes a processor 610 and a memory 620, wherein the memory 610 is used to store computer programs; the processor 620 is used to execute the programs stored in the memory 610 to implement the synchronization message processing method described in any embodiment of this application.

[0080] This application also provides a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the synchronization message processing method described in any embodiment of this application.

[0081] In this application, "multiple" refers to two or more.

[0082] In this application, unless otherwise expressly defined, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0083] The terms “first,” “second,” “third,” “fourth,” etc., in this application (if present) are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0084] In this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, in this application, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0085] Unless otherwise specified, all steps in this application may be performed sequentially or randomly. For example, if the method includes steps A and B, it means that the method may include steps A and B performed sequentially, or it may include steps B and A performed sequentially. For example, if the method may also include step C, it means that step C may be added to the method in any order. For example, the method may include steps A, B, and C, or it may include steps A, C, and B, or it may include steps C, A, and B, etc.

[0086] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for processing synchronization messages, characterized in that, The method includes the following steps: In response to a wake-up command, the vehicle domain controller is controlled to enter a wake-up state, and network management messages are sent through the first and second partitions of the vehicle domain controller. After sending network management messages through the first and second partitions of the vehicle domain controller, the process includes: Detect whether the transmission duration of the network management message of the first partition is less than or equal to the preset duration; If the transmission duration of the network management message of the first partition is less than or equal to the preset duration, then it is checked whether the network management messages of the first to Nth CAN channels in the first partition have been successfully transmitted; if the network management messages of the first to Nth CAN channels have been successfully transmitted, then it is determined that the network management message of the first partition has been successfully transmitted. If the transmission duration of the network management message of the first partition is greater than the preset duration, then it is detected whether the network management message of the N+1 to Mth CAN channels in the first partition has been successfully transmitted; if the network management message of the N+1 to Mth CAN channels has been successfully transmitted, then it is determined that the network management message of the first partition has been successfully transmitted. If the network management message is successfully sent in the first partition and / or the second partition, the sending of the secure vehicle communication synchronization message in the secure vehicle communication synchronization message routing path group is triggered, and the secure vehicle communication synchronization message sending success notification is received through the basic software manager of the first partition and the basic software manager of the second partition respectively. The basic software manager of the first partition and the basic software manager of the second partition are used to enable the sending function of the secure vehicle communication message based on the successful sending notification of the secure vehicle communication synchronization message.

2. The method according to claim 1, characterized in that, Before sending network management messages through the first and second partitions of the vehicle domain controller, the process includes: Acquire secure vehicle communication messages, secure vehicle communication synchronization messages, and application messages that participate in information exchange in the vehicle domain controller; The secure vehicle communication messages, the secure vehicle communication synchronization messages, and the application messages are respectively divided into secure vehicle communication message routing path groups, secure vehicle communication synchronization message routing path groups, and application message routing path groups.

3. The method according to claim 1, characterized in that, After sending network management messages through the first and second partitions of the vehicle domain controller, the process further includes: Detect whether the transmission duration of the network management message of the second partition is less than or equal to the preset duration; If the transmission duration of the network management message in the second partition is less than or equal to the preset duration, then check whether the network management messages of the first to Nth CAN channels in the second partition have been successfully transmitted, where N is an integer; If the network management messages of the first to Nth CAN channels are successfully sent, then the network management messages of the second partition are determined to have been successfully sent.

4. The method according to claim 3, characterized in that, After detecting whether the transmission time of the network management message of the second partition is less than or equal to the preset duration, the process includes: If the transmission duration of the network management message in the second partition is greater than the preset duration, then it is detected whether the network management message of the N+1 to Mth CAN channels in the second partition has been successfully transmitted, where M is an integer; If the network management messages of the N+1 to Mth CAN channels are successfully sent, then the network management messages of the second partition are determined to have been successfully sent.

5. The method according to claim 2, characterized in that, After triggering the transmission of secure vehicle communication messages in the secure vehicle communication message routing path group using the communication management module in the vehicle domain controller, the method further includes: By receiving and parsing the secure vehicle communication synchronization message at the device ECU node, the synchronization counter value and reset counter value are obtained. The system receives the secure vehicle communication message from the device ECU node and verifies the secure vehicle communication message based on the synchronization counter value and the reset counter value. If the verification passes, the device ECU node interprets the data of the secure vehicle communication message normally; if the verification fails, the device ECU node does not perform the interpretation operation of the secure vehicle communication message.

6. A system for processing synchronization messages, characterized in that, include: The network management message sending module is used to respond to the wake-up command, control the vehicle domain controller to enter the wake-up state, and send network management messages through the first partition and the second partition; The secure vehicle communication synchronization message sending module is used to trigger the sending of secure vehicle communication synchronization messages in the secure vehicle communication synchronization message routing path group when the network management message is successfully sent in the first partition and / or the second partition, and to receive the secure vehicle communication synchronization message sending success notification through the basic software manager of the first partition and the basic software manager of the second partition respectively. After sending network management messages through the first and second partitions of the vehicle domain controller, the secure vehicle communication synchronization message sending module is used to: Detect whether the transmission duration of the network management message of the first partition is less than or equal to the preset duration; If the transmission duration of the network management message of the first partition is less than or equal to the preset duration, then it is checked whether the network management messages of the first to Nth CAN channels in the first partition have been successfully transmitted; if the network management messages of the first to Nth CAN channels have been successfully transmitted, then it is determined that the network management message of the first partition has been successfully transmitted. If the transmission duration of the network management message of the first partition is greater than the preset duration, then it is detected whether the network management message of the N+1 to Mth CAN channels in the first partition has been successfully transmitted; if the network management message of the N+1 to Mth CAN channels has been successfully transmitted, then it is determined that the network management message of the first partition has been successfully transmitted. The secure vehicle communication message sending module is used to enable the secure vehicle communication message sending function based on the successful sending notification of the secure vehicle communication synchronization message, using the basic software manager of the first partition and the basic software manager of the second partition.

7. A vehicle, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the method for processing synchronization messages as described in any one of claims 1-5.

8. A non-volatile computer-readable storage medium comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the method for processing synchronization messages as described in any one of claims 1-5.

Images