Secoc vehicle safety communication method based on dynamic key management enhancement

Abstract

The application discloses a kind of SecOC vehicle-mounted safety communication methods based on dynamic key management enhancement, by introducing key distribution center, the on-demand distribution of SecOC key, dynamic update and whole life cycle management are realized.ECU is negotiated by KDC client and KDC server Unique preset key;KDC client requests service ticket based on the service identification of application to KDC server;SecOC key is dynamically assigned by KDC, supports automatic rotation based on time strategy and emergency update based on security event.SecOC message uses gPTP timestamp as freshness value, after data unit and freshness value are spliced, message authentication code is calculated.In the application, key is no longer static preset, but is dynamically distributed by KDC and supports online update, combined with two-way certificate authentication and timestamp two-factor authentication, realize the whole life cycle safety management of vehicle service key, effectively deal with key leakage risk.

Description

Technical Field

[0001] This invention relates to the field of vehicle network security, and in particular to a SecOC vehicle security communication method based on dynamic key management enhancement. Background Technology

[0002] Intelligent connected vehicles connect to external networks, making them vulnerable to attacks. Network intrusions can compromise the vehicle and control critical systems such as braking and steering. SecOC (Secure Onboard Communication) effectively defends against such attacks by verifying data integrity and authenticity, protecting the vehicle and passenger safety. SecOC is a key technology for achieving secure and reliable communication in intelligent connected vehicles and is of great significance for promoting the development of the intelligent connected vehicle industry.

[0003] Traditional vehicles use a "one vehicle, one key" model, where all ECUs share the same key. If this key is leaked, the entire vehicle communication system can be attacked. The key can only be changed by offline flashing, and it is impossible to isolate the keys between different security domains.

[0004] Currently, SecOC typically pre-installs static keys into the ECU during the production phase, which suffers from poor scalability and difficulty in updating. If there is a lack of encrypted channels or physical security protection during the initial distribution phase, the keys may be stolen or leaked. Furthermore, the Cybersecurity Classified Protection System 2.0 standard explicitly requires dynamic key updates.

[0005] In summary, the core problems with existing SecOC key management schemes are: static key pre-configuration, inability to dynamically update keys, and lack of lifecycle management. To address these issues, a secure, flexible, and controllable scheme for allocating SecOC keys is needed. Summary of the Invention

[0006] To address the shortcomings of existing technologies, the present invention aims to provide a SecOC vehicle-mounted secure communication method based on enhanced dynamic key management.

[0007] To achieve the objectives of this invention, the technical solution adopted is as follows:

[0008] A SecOC vehicle-mounted secure communication method enhanced by dynamic key management includes the following steps:

[0009] When the vehicle ECU is activated for the first time, it completes gPTP time synchronization, registers with the KDC server through the KDC client, and negotiates a unique pre-set key with the KDC server.

[0010] The KDC client on the vehicle ECU requests a service ticket from the KDC server based on the application's service identifier. The KDC server dynamically distributes service keys. The ticket is encrypted with a preset key and cached locally. When needed, the ticket is decrypted to obtain the service key. Vehicle ECUs use the same service identifier and have the same service key. The service key has a lifecycle and supports automatic rotation and renewal based on a time-based policy.

[0011] The application sender constructs a SecOC message, using a gPTP timestamp as the freshness value, and uses the data unit and freshness value as the message source to be authenticated. It uses HMAC-SHA256 to calculate the message authentication code, and the key comes from the distribution of KDC and has been securely stored.

[0012] The application receiver verifies whether the freshness value in the SecOC message is within the valid time window. If it is invalid, the message is discarded. If it is valid, the receiver uses HMAC-SHA256 to calculate the message authentication code of the message to be authenticated in the message and compares it with the message authentication code in the message. If they match, the authentication is passed and the message is valid; otherwise, it is considered an illegal message and is discarded.

[0013] Furthermore, KDC-based dynamic key distribution includes: identity authentication and pre-configured key negotiation; service key distribution and storage.

[0014] Furthermore, identity authentication and pre-configured key negotiation specifically include:

[0015] The KDC server uses a pre-configured access permission list to allow only configured ECUs to initiate authentication requests. This access permission list includes the authorized ECU identity ID, certificate information, and corresponding service permissions. The KDC server and ECUs implement two-way authentication using digital certificates.

[0016] After successful authentication, the ECU and KDC server exchange ECDH public key parameters. The public key parameters are signed with the private keys corresponding to the certificates of both parties, and a preset key is calculated through ECDH.

[0017] Furthermore, service key distribution and storage specifically include:

[0018] The KDC client on the ECU sends a request to the KDC server, including the service identifier and device identity ID; the KDC server checks whether the ECU has permission to access the target service in the access permission list and verifies the association between the service identifier and the ECU identity ID;

[0019] After the authorization verification is successful, the KDC server derives a service key and attaches a gPTP timestamp to form a ticket. The ticket is then encrypted using a preset key and the AES-128-GCM algorithm. The ECU decrypts the ticket using the preset key, verifies the validity of the timestamp, and caches the ticket locally. When needed, the service key is obtained by decrypting the ticket using the preset key.

[0020] Furthermore, the KDC server and ECU implement two-way authentication of digital certificates, including:

[0021] 1. The ECU initiates a registration request to the KDC server through the KDC client, carrying its own certificate and identity ID;

[0022] 2. The KDC server verifies the validity of the ECU certificate and checks whether it is in the access permission table;

[0023] 3. The KDC server returns its own certificate for the ECU to verify.

[0024] Furthermore, the service key rotation strategy includes:

[0025] Key lifecycle strategy: High-risk domains (powertrain domain / chassis domain) and low-risk domains (infotainment domain / body domain) support different validity periods, and the key validity period can be dynamically adjusted in minutes;

[0026] Security policy linkage mechanism: Supports emergency key rotation, which immediately triggers key updates when abnormal network traffic or security events are detected.

[0027] Furthermore, service key lifecycle management:

[0028] The lifespan of a key is divided into an update time and an expiration time. When the gPTP time reaches the key's update time, the key update process is automatically triggered to apply for a new key. At this time, the old key is still in use, and the new key has not yet taken effect. When the old key's expiration time arrives, the old key becomes invalid, and the new key takes effect.

[0029] Furthermore, the service key is designed to be fault-tolerant. Even after an old key expires, a period of fault tolerance is retained to prevent network latency from causing verification failures of received messages.

[0030] The beneficial effects of this invention are that, compared with the prior art, this invention combines KDC dynamic key management to realize full lifecycle security management of vehicle SecOC keys, significantly improves key security, and provides reliable protection for the information security of intelligent connected vehicles.

[0031] This invention effectively ensures the security of the key distribution process through two-factor authentication using two-way certificates and timestamps provided by KDC; the keys used by SecOC can be isolated according to domain and service, and can be dynamically updated to minimize the impact of key leakage. Attached Figure Description

[0032] Figure 1 It consists of SecOC security messages;

[0033] Figure 2 It is a system architecture that uses Some / IP combined with SecOC to achieve secure communication;

[0034] Figure 3 It is a Some / IP message format. Detailed Implementation

[0035] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of this application.

[0036] SecOC, as an information security technology in automotive networks, has the following key features: key management and distribution, which uses keys to calculate message authentication codes to verify the integrity and authenticity of data and prevent tampering attacks; and freshness management, which uses freshness value mechanisms, such as timestamps and counters, to ensure the uniqueness of messages and prevent replay attacks.

[0037] The SecOC security message consists of the following: Figure 1 As shown, this includes data packets, freshness values, and message authentication codes.

[0038] In this invention, SecOC uses gPTP (Generalized Precision Time Protocol) to achieve microsecond-level global clock synchronization, replacing the local clock, and uses the gPTP timestamp as the freshness value (FV) to be input into the calculation of the SecOC message authentication code (MAC). This solves the problem that the traditional freshness value relies on the local clock and is vulnerable to attack, and improves the ability to defend against replay attacks.

[0039] This invention implements dynamic key distribution and lifecycle management based on a Key Distribution Center (KDC), systematically solving the static limitations of pre-configured keys. The keys required in SecOC are distributed by the KDC, which can be deployed on an in-vehicle high-performance computing unit (HPC). The dynamic key distribution based on the KDC consists of three processes:

[0040] Step 1: Identity authentication and pre-configured key negotiation;

[0041] The KDC server uses a pre-configured access permission list to allow only the configured ECUs to initiate authentication requests; this access permission list contains the authorized ECU identity ID, certificate information, and corresponding service permissions.

[0042] The KDC Server and ECU implement two-way authentication of digital certificates:

[0043] The ECU initiates a registration request to the KDC server via the KDC client (KDC Agent), carrying its own certificate and identity ID; the KDC server verifies the validity of the ECU certificate and checks whether it is in the access permission table; the KDC server returns its own certificate for the ECU to verify.

[0044] Generate a pre-set key based on ECDH;

[0045] After successful authentication, the ECU exchanges ECDH public key parameters with the KDC server. The public key parameters need to be signed with the private keys corresponding to the certificates of both parties to prove the authenticity of the certificates. A preset key is calculated through ECDH. The preset key is only used to encrypt the service key distributed in subsequent sessions and has forward security.

[0046] Step 2: Service key distribution and storage;

[0047] The KDC client (KDC Agent) on the ECU sends a request to the KDC server, which includes the service ID and the device identity ID;

[0048] The KDC server checks whether the ECU in the access permission list has permission to access the target service and verifies the association between the service identifier and the ECU identity ID;

[0049] After the authorization verification is successful, the KDC server derives a service key, attaches a gPTP timestamp, forms a ticket, and encrypts the ticket using a preset key and the AES-128-GCM algorithm to ensure the confidentiality and integrity of the ticket.

[0050] The ECU uses a preset key to decrypt the ticket and verify the validity of the timestamp. The ticket can be cached locally. When needed, the service key is obtained by decrypting the ticket using the preset key. The preset key is securely stored in the HSM.

[0051] Step 3: Service key rotation strategy and lifecycle management;

[0052] Key lifecycle strategy: High-risk domains (powertrain domain / chassis domain) and low-risk domains (infotainment domain / body domain) support different validity periods, and the key validity period can be dynamically adjusted in minutes;

[0053] Security policy linkage mechanism: Supports emergency key rotation, which can immediately trigger key updates when abnormal network traffic or security events are detected;

[0054] The key update strategy divides the key's lifespan into update time and expiration time: When the gPTP time reaches the key's update time, the key update process is automatically triggered, and a new key is requested. At this time, the old key is still in use, and the new key is not yet effective; after the old key's expiration time arrives, the old key becomes invalid, and the new key becomes effective. Fault tolerance design: After the old key expires, a fault tolerance period is still maintained to prevent received message verification failures due to network latency.

[0055] Taking Some / IP as an example, by combining Some / IP's efficient service communication with SecOC's end-to-end security mechanism, the vehicular network can resist increasingly complex attack threats while ensuring low latency and high throughput.

[0056] like Figure 2 As shown, the system architecture for secure communication between ECUs in the vehicle network uses Some / IP combined with SecOC to achieve secure communication. The SecOC communication process is as follows:

[0057] When ECU_A and ECU_B are activated for the first time, they complete gPTP time synchronization and register with the KDC server through the KDC client (KDC Agent), and negotiate a unique pre-set key with the KDC server respectively;

[0058] The KDC clients (KDC Agents) on ECU_A and ECU_B request service tickets from the KDC server (KDC Server) based on the application's service identifier and store the service key to the hardware security module; the applications on ECU_A and ECU_B use the same service identifier, so their service keys are the same;

[0059] The application sender constructs SecOC messages, using gPTP timestamps as the freshness value (FV); Figure 3 The data unit Authentic Payload and Freshness Value FV in Some / IP are used as the message source to be authenticated. The message authentication code MAC is calculated using HMAC-SHA256. The key comes from the distribution of KDC and has been securely stored.

[0060] The application receiver verifies whether the FV in the SecOC message is within the valid time window. If invalid, the message is discarded. If valid, the receiver uses HMAC-SHA256 to calculate the Message Authentication Code (MAC) of the message to be authenticated in the Some / IP message and compares it with the MAC in the message. If they match, the authentication is successful and the message is valid; otherwise, it is considered an illegal message and is discarded.

[0061] The beneficial effects of this invention are compared with those of the prior art:

[0062] Breaking through the limitations of static keys and enabling dynamic updates: The core innovation of this invention lies in the fact that the keys used by SecOC are no longer static keys pre-set during the production phase, but are dynamically distributed by the KDC during vehicle operation. Keys support automatic rotation based on time policies (such as updates on a minute-by-minute basis) and emergency updates based on security events (such as immediate replacement upon detection of an attack), completely solving the technical problem of traditional solutions' inability to update keys online.

[0063] Full lifecycle security management: This invention realizes full lifecycle management of SecOC keys from generation, distribution, use, rotation to destruction. The keys have clear update time and expiration time, support smooth transition between old and new keys, and significantly improve key security.

[0064] Keys are isolated by domain to minimize the impact of leakage: The keys used by SecOC can be isolated according to security domains (power domain, chassis domain, infotainment domain, etc.) and services, and the leakage of a single key will not affect the communication security of other domains;

[0065] Two-factor authentication ensures secure distribution: Through the two-way certificate authentication and gPTP timestamp two-factor authentication mechanism provided by KDC, the security of the key distribution process is effectively guaranteed, preventing man-in-the-middle attacks and replay attacks.

[0066] The applicant of this invention has provided a detailed description of the embodiments of the invention in conjunction with the accompanying drawings. However, those skilled in the art should understand that the above embodiments are merely preferred embodiments of the invention. The detailed description is only intended to help readers better understand the spirit of the invention and is not intended to limit the scope of protection of the invention. On the contrary, any improvements or modifications made based on the inventive spirit of the invention should fall within the scope of protection of the invention.

Claims

1. A SecOC vehicle-mounted secure communication method based on dynamic key management enhancement, characterized in that, Including the following steps: When the vehicle ECU is activated for the first time, it completes gPTP time synchronization, registers with the KDC server through the KDC client, and negotiates a unique pre-set key with the KDC server. The KDC client on the vehicle ECU requests a service ticket from the KDC server based on the application's service identifier. The KDC server dynamically distributes service keys. The ticket is encrypted with a preset key and cached locally. When needed, the ticket is decrypted to obtain the service key. Vehicle ECUs use the same service identifier and have the same service key. The service key has a lifecycle and supports automatic rotation and renewal based on a time-based policy. The application sender constructs a SecOC message, using a gPTP timestamp as the freshness value, and uses the data unit and freshness value as the message source to be authenticated. It uses HMAC-SHA256 to calculate the message authentication code, and the key comes from the distribution of KDC and has been securely stored. The application receiver verifies whether the freshness value in the SecOC message is within the valid time window. If it is invalid, the message is discarded. If it is valid, the message authentication code of the message to be authenticated in the message is calculated using HMAC-SHA256. The message is then compared with the message authentication code in the message. If they match, the authentication is successful and the message is valid. Otherwise, it will be considered an illegal message and discarded; KDC-based dynamic key distribution includes: identity authentication and pre-configured key negotiation; service key distribution and storage; Identity authentication and pre-configured key negotiation specifically include: the KDC server, through a pre-configured access permission list, only allows the configured ECUs to initiate authentication requests; this access permission list contains the authorized ECU identity ID, certificate information, and corresponding service permissions; the KDC server and the ECU implement two-way authentication of digital certificates: after successful authentication, the ECU and the KDC server exchange ECDH public key parameters, which are signed using the private keys corresponding to the certificates of both parties, and the pre-configured key is calculated through ECDH; Service key distribution and storage specifically include: the KDC client on the ECU sends a request to the KDC server, including the service identifier and device identity ID; the KDC server checks whether the ECU has permission to access the target service in the access permission list and verifies the association between the service identifier and the ECU identity ID; after the permission verification is successful, the KDC server derives the service key, attaches a gPTP timestamp, forms a ticket, and encrypts the ticket using a preset key and the AES-128-GCM algorithm; the ECU uses the preset key to decrypt the ticket, verifies the validity of the timestamp, and caches the ticket locally. When needed, the service key is obtained by decrypting the ticket using the preset key.

2. The SecOC vehicle-mounted secure communication method based on dynamic key management enhancement according to claim 1, characterized in that, The KDC server and ECU implement two-way authentication of digital certificates, including: The ECU initiates a registration request to the KDC server through the KDC client, carrying its own certificate and identity ID; the KDC server verifies the legality of the ECU certificate and checks whether it is in the access permission table; the KDC server returns its own certificate for the ECU to verify.

3. The SecOC vehicle-mounted secure communication method based on dynamic key management enhancement according to claim 1, characterized in that, Service key rotation strategies include: Key lifecycle policy: High-risk and low-risk domains support different validity periods, and key validity periods can be dynamically adjusted in minutes; Security policy linkage mechanism: Supports emergency key rotation, which immediately triggers key updates when abnormal network traffic or security events are detected.

4. The SecOC vehicle-mounted secure communication method based on dynamic key management enhancement according to claim 1, characterized in that, Service key lifecycle management: The lifespan of a key is divided into an update time and an expiration time. When the gPTP time reaches the key's update time, the key update process is automatically triggered to apply for a new key. At this time, the old key is still in use, and the new key has not yet taken effect. When the old key's expiration time arrives, the old key becomes invalid, and the new key takes effect.

5. The SecOC vehicle-mounted secure communication method based on dynamic key management enhancement according to claim 4, characterized in that, The service key is designed to be fault-tolerant. Even after the old key expires, a period of fault tolerance will still be retained to prevent network latency from causing the verification of received messages to fail.

Images