Secure communication dynamic key management method and device, equipment and storage medium

Abstract

A secure communication dynamic key management method, apparatus and device, and a storage medium relate to the field of electronic control communication security, and comprise: storing a generated key in a hardware security module, and dynamically updating the key based on a key update strategy; carrying out encryption protection on the CAN message based on the secret key; and when a disassembly signal is detected, destroying the key based on a hardware-level key fusing mechanism and locking the writing permission of the public storage area. According to the method, dynamic rotation of the key is realized through a key updating strategy, the anti-cracking capability of an encryption algorithm is improved, the key is stored in a hardware security module instead of a public storage area, and the key is destroyed based on a hardware-level key fusing mechanism when a disassembly signal is detected, so that key security protection at a hardware level is realized, and the security of the key is improved. And the safety of vehicle control communication is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of electric control communication security, in particular to a secure communication dynamic key management method, device, equipment and storage medium. BACKGROUND

[0002] In modern intelligent vehicle control systems, the security of remote vehicle control interaction protocols is directly related to driving safety and user privacy protection. With the rapid development of vehicle network technology, vehicle control instructions (such as window control, air conditioning switch and braking instructions) are transmitted through CAN bus, which has become an industry standard. Therefore, the security of CAN bus transmission has become an important issue that cannot be ignored.

[0003] In related technologies, the more common way is to preset a fixed key in the Flash storage area, perform handshake verification of T-Box and ECU according to the fixed key, and perform security protection measures and report exceptions when the verification is abnormal.

[0004] However, the existing fixed key signature verification method has certain security risks. The single mode of fixed encryption algorithm is easy to be cracked when attacked. The key stored in the Flash storage area lacks hardware-level protection and is easy to be stolen when disassembled and cracked at the hardware level. Therefore, the security of the existing vehicle control communication interaction is insufficient and needs to be improved. SUMMARY

[0005] The present application provides a secure communication dynamic key management method, device, equipment and storage medium, which can solve the technical problems that the existing fixed key signature verification method is easy to be cracked and lacks hardware-level protection, resulting in insufficient security of vehicle control communication interaction.

[0006] In a first aspect, the embodiments of the present application provide a secure communication dynamic key management method, comprising: storing the generated key in a hardware security module and dynamically updating the key based on a key update strategy; encrypting and protecting the CAN message based on the key; when a disassembly signal is detected, destroying the key and locking the public storage area write permission based on the hardware-level key fuse mechanism.

[0007] In combination with the first aspect, in an implementation mode, the generated key is stored in the hardware security module, comprising: calling a key filling interface to store the generated key in a key slot of the hardware security module; The key includes at least one security key corresponding to at least one security algorithm.

[0008] In combination with the first aspect, in an implementation, the dynamic key update based on the key update strategy comprises: calling a key erasing interface to erase the old key; updating the key and writing the updated key into a new key slot of the hardware security module; returning a key update state.

[0009] In combination with the first aspect, in an implementation, the CAN message is encrypted and protected based on the key, comprising: performing end-to-end encapsulation encryption on the CAN message according to the key and a corresponding security algorithm to obtain an encrypted message; wherein the encrypted message comprises a random number, an ID and a payload.

[0010] In combination with the first aspect, in an implementation, the key is destroyed and the write permission of the public storage area is locked based on a hardware-level key blowing mechanism, comprising: erasing all keys in the hardware security module; erasing all key slots in the hardware security module; permanently locking the write permission of the public storage area.

[0011] In combination with the first aspect, in an implementation, the dynamic key management method for secure communication further comprises: performing multi-level fault diagnosis on vehicle control, and executing a preset abnormal protection strategy and reporting an abnormal state when an abnormality is diagnosed; wherein the multi-level fault diagnosis comprises communication timeout diagnosis, end-to-end message checking, security layer diagnosis and application function layer diagnosis.

[0012] In combination with the first aspect, in an implementation, the communication timeout diagnosis comprises real-time heartbeat monitoring; the end-to-end message checking comprises CRC checking and counter verification on the CAN message; the security layer diagnosis comprises hardware security module decryption behavior monitoring; the application function layer diagnosis comprises security situation assessment based on the communication timeout diagnosis, the end-to-end message checking, the security layer diagnosis and vehicle function state signals.

[0013] Secondly, the application further provides a dynamic key management device for secure communication, comprising: a key management unit configured to store the generated key in a hardware security module and dynamically update the key based on a key update strategy; a message encryption unit configured to encrypt and protect a CAN message based on the key; a key blowing unit configured to destroy the key and lock the write permission of the public storage area based on a hardware-level key blowing mechanism when a disassembly signal is detected.

[0014] In a third aspect, the present application provides a secure communication dynamic key management device, comprising a processor, a memory, and a secure communication dynamic key management program stored in the memory and executable by the processor, wherein the secure communication dynamic key management program, when executed by the processor, implements the steps of the secure communication dynamic key management method according to any one of the above.

[0015] In a fourth aspect, the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a secure communication dynamic key management program, wherein the secure communication dynamic key management program, when executed by the processor, implements the steps of the secure communication dynamic key management method according to any one of the above.

[0016] The technical scheme provided by the embodiments of the present application has the beneficial effects of: The key is dynamically rotated through the key update strategy, the cracking resistance of the encryption algorithm is improved, the key is stored in the hardware security module instead of the public storage area, and the key is destroyed based on the hardware-level key fuse mechanism when the disassembly signal is detected, so as to realize the key security protection at the hardware level, and the security of the vehicle control communication is effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 FIG. 1 is a flowchart of an embodiment of the secure communication dynamic key management method of the present application; Figure 2 FIG. 2 is a flowchart of a detailed process of the key dynamic update of the embodiment of the present application; Figure 3 FIG. 3 is a flowchart of a detailed process of the hardware-level anti-disassembly fuse mechanism of the embodiment of the present application; Figure 4 FIG. 4 is a functional module diagram of an embodiment of the secure communication dynamic key management device of the present application; Figure 5 FIG. 5 is a hardware structure diagram of the secure communication dynamic key management device involved in the embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the present application.

[0019] Firstly, some technical terms in this application are explained and described to facilitate the understanding of the application by those skilled in the art.

[0020] CAN: Controller Area Network, refers to the Controller Area Network, which is a serial communication bus protocol dedicated to vehicle electronic systems.

[0021] Flash: refers to the automotive electronic system of car-grade flash memory chip, used for permanent storage of program code and static data.

[0022] ECU: Electronic Control Unit, refers to the core hardware controller of the automotive electronic system, responsible for real-time acquisition of sensor data, execution of control logic and driving of actuators.

[0023] E2E: End-to-End, refers to the instruction transmission process from the cloud platform to the vehicle controller in the vehicle control system.

[0024] HSE: Hardware Security Engine, refers to the hardware-level security module dedicated to vehicle systems, designed for key management, encryption operations and security isolation.

[0025] JTAG extraction: through physical connection of JTAG interface of vehicle electronic control unit, direct reading of data in electronic control unit internal memory.

[0026] T-Box: Telematics Box, refers to the secure communication hub between the vehicle and the cloud, as a communication module of the vehicle system, responsible for receiving cloud instructions, performing security verification, and forwarding to the vehicle controller.

[0027] HMAC: Hash-based Message Authentication Code, is a hardware-level message authentication mechanism, which combines a hash function with a key to generate a fixed-length authentication code, used to verify the integrity and authenticity of the message.

[0028] In order to make the purpose, technical scheme and advantages of the application clearer, the embodiments of the application will be further described in detail below with reference to the drawings.

[0029] In a first aspect, the embodiments of the application provide a secure communication dynamic key management method.

[0030] In an embodiment, with reference to Figure 1 , Figure 1 is a flowchart of an embodiment of the secure communication dynamic key management method of the application. As Figure 1The secure communication dynamic key management method includes the following steps: S101, store the generated key in a hardware security module, and dynamically update the key based on a key update strategy; S102, encrypt and protect the CAN message based on the key; S103, when a disassembly signal is detected, destroy the key based on a hardware-level key blowing mechanism and lock the write permission of the public storage area.

[0031] Specifically, the embodiment stores the key in the HSE hardware security module, which is not exposed to the general memory area and can prevent the key from being extracted by JTAG, thereby improving the anti-key extraction capability and improving the communication security. According to the key update strategy, the key and the security algorithm are dynamically switched, which can support flexible switching and upgrading of the algorithm and the key.

[0032] The embodiment encrypts the CAN message according to the stored key, which can prevent the CAN message from being intercepted and imitated, thereby improving the security of the CAN message.

[0033] Meanwhile, when a disassembly signal is detected, i.e., when each important part or the HSE itself is subjected to a physical disassembly attack, the key is destroyed based on a hardware-level key blowing mechanism, thereby preventing the key from being stolen, and the write permission of the public storage area is locked to prevent the control program from being maliciously tampered with.

[0034] In this embodiment, the dynamic rotation of the key is realized through the key update strategy, the anti-cracking capability of the encryption algorithm is improved, the key is stored in the hardware security module instead of the public storage area, and when a disassembly signal is detected, the key is destroyed based on a hardware-level key blowing mechanism to realize hardware-level key security protection, thereby effectively improving the security of vehicle control communication.

[0035] Further, in an embodiment, the generated key is stored in a hardware security module, including: The generated key is stored in the key slot of the hardware security module by calling the key filling interface.

[0036] Further, in an embodiment, the key includes at least one security key corresponding to at least one security algorithm.

[0037] Specifically, in the embodiment, when the key binding request is first received, the TSP vehicle remote control monitoring platform issues an initial key to the ECU controller through an encryption instruction, including an initial key of multiple security algorithms, such as AES128 and / or RSA2048, etc.

[0038] Then the ECU controller calls the key filling interface of the HSE hardware security module to store the generated key in the key slot of the HSE firmware.

[0039] It should be noted that the key does not exist in the controller Flash public space, and the HSE hardware security module is two separate storage modules in the Flash public storage space. A plurality of key slots are arranged in the HSE hardware security module for storing the key.

[0040] In the embodiment, the key is stored in the independent storage space in the HSE hardware security module, which effectively improves the security of the key. At the same time, the complex security algorithm of multiple types will cause the CPU load rate to rise, and after introducing the HSE firmware, the operation of the security algorithm no longer occupies too much CPU load rate, which can reduce the CPU load rate and improve the software running efficiency.

[0041] Further, in an embodiment, Figure 2 The detailed flowchart of the key dynamic update of the embodiment of the application is shown in Figure 2 As shown, the key is dynamically updated based on the key update strategy, which includes: S201, calling a key erasing interface to erase the old key; S202, updating the key and writing the updated key into a new key slot of the hardware security module; S203, returning a key update state.

[0042] Specifically, in the key dynamic update process, the vehicle remote monitoring platform issues a key update instruction and a new key to the T-Box through an encrypted instruction. The key update instruction can carry an algorithm identifier and a timestamp to prevent replay attacks.

[0043] Then, after receiving the key update instruction and the new key, the T-Box verifies the validity of the key update instruction and the new key, and issues a key update request to the controller after verification.

[0044] After receiving the key update request, the controller also verifies the validity, and then erases the old key by calling the HSE key erasing interface, updates the key, and writes the new key into the new key slot.

[0045] In the embodiment, by setting the key update mechanism, the dynamic rotation of multiple keys can be realized. Compared with the existing fixed key algorithm and static key storage method, the dynamic key rotation of the present scheme has higher flexibility and can achieve better security protection effect. At the same time, when upgrading the algorithm, the existing static storage method needs to be re-flashed as a whole, while the present scheme can be dynamically updated.

[0046] Further, in an embodiment, the CAN message is encrypted and protected based on the key, which includes: The CAN message is end-to-end encapsulated and encrypted according to the key and the corresponding security algorithm to obtain an encrypted message; The encrypted message includes a random number, an ID, and a payload.

[0047] Specifically, to ensure communication security, the embodiment introduces a CAN message end-to-end protection mechanism, and E2E bus security verification and encryption are coordinated. In the instruction interaction ID, the embodiment encapsulates an E2E encryption header in the CAN message. The encrypted message after encapsulation includes a random number, an ID, and a payload. The random number generation and the encryption of the message payload are performed by the HSE firmware, and the received message is decrypted and verified.

[0048] The random number field in the CAN message can ensure that each transmitted message is unique and prevent replay attacks. The ID is used to identify the message source and type, guiding the subsequent processing flow. The payload includes the actual interaction instruction message after encryption processing. The encryption and decoding processes are both performed by the HSE firmware.

[0049] For messages that need to be encrypted, the T-Box sends an encryption request to the HSE via the ECU. The HSE then encrypts the message to generate an encrypted message composed of a random number, an ID, and a payload, and returns the encrypted message to the ECU. The ECU then returns the encrypted message to the T-Box for external transmission.

[0050] For messages that need to be decrypted, the T-Box first transmits the received security frame to the ECU. The security frame also includes a CRC detection field. The ECU first performs preliminary verification based on the CRC detection field, and then sends it to the HSE firmware for decryption processing. After the HSE firmware completes the decoding, it returns the plaintext instructions to the ECU controller.

[0051] In addition, the HSE firmware can store multiple keys, and the keys can be updated flexibly. Accordingly, the transmission and encryption of messages can also switch between different keys and corresponding security algorithms. For example, in message encryption, the encryption party can randomly select or select keys and security algorithms according to a predetermined rotation order for encryption. In message decryption, the corresponding keys and security algorithms of the encryption party can be selected for decryption processing.

[0052] In this embodiment, compared to the traditional CAN bus plaintext transmission method, the end-to-end bus message protection mechanism is established, and through dynamic random numbers, CRC verification, and HMAC authentication, the instructions can be effectively prevented from being intercepted or imitated, and the CAN message transmission security is protected.

[0053] Further, in an embodiment, Figure 3 The hardware-level anti-disassembly fuse mechanism of the embodiment of the present application is shown in the flowchart as Figure 3 The hardware-level key fuse mechanism destroys the key and locks the public storage area write permission, including: S301, erase all keys in the hardware security module; S302, erase all key slots in the hardware security module; S303, permanently lock the write permission of the public storage area.

[0054] Specifically, to defend against physical disassembly attacks at the hardware level, embodiments also provide a hardware-level key protection mechanism.

[0055] When the anti-disassembly detection mechanism of the T-Box determines that there is a high-risk disassembly or tampering behavior, the controller executes the hardware-level anti-disassembly fuse mechanism. The hardware-level anti-disassembly fuse mechanism includes first erasing all keys in the HSE hardware security module, then physically erasing all key slots in the HSE firmware, and permanently locking the write permission of the Flash public storage area.

[0056] It should be noted that the hardware-level anti-disassembly fuse mechanism as the last protection means will only be executed when a physical attack or irreversible security risk is detected.

[0057] In this embodiment, through the hardware-level anti-disassembly fuse mechanism, when the T-Box triggers the anti-disassembly signal, the HSE immediately erases the key slots and permanently locks the Flash write permission, realizing hardware-level self-destruction. It can effectively defend against physical attack means at the hardware level.

[0058] Further, in an embodiment, the secure communication dynamic key management method further includes: Performing multi-level fault diagnosis on vehicle control, and executing a preset abnormal protection strategy and reporting an abnormal state when an abnormality is diagnosed; Wherein, the multi-level fault diagnosis includes communication timeout diagnosis, end-to-end message verification, security layer diagnosis and application function layer diagnosis.

[0059] Further, in an embodiment, the communication timeout diagnosis includes real-time heartbeat monitoring; The end-to-end message verification includes CRC verification and counter verification of CAN messages; The security layer diagnosis includes hardware security module decryption behavior monitoring; The application function layer diagnosis includes security situation assessment based on comprehensive communication timeout diagnosis, end-to-end message verification, security layer diagnosis and vehicle function state signal.

[0060] Specifically, compared with the existing security diagnosis which only has two levels of communication timeout and function diagnosis, the multi-level fault diagnosis mechanism of the embodiment includes four levels of diagnosis process including communication timeout diagnosis, E2E verification, security layer diagnosis and application function layer diagnosis.

[0061] Among them, the communication timeout diagnosis is monitored by real-time heartbeat monitoring. When the controller does not receive heartbeat information for a plurality of times (the specific number of times can be defined and adjusted by the vehicle manufacturer according to the specific vehicle model and scene, for example, set to 10 times), the corresponding safety protection strategy is executed. Among them, the TSP cloud monitoring platform and the T-Box vehicle networking controller, and the T-Box and the vehicle controller are all monitored by real-time heartbeat communication.

[0062] When the expected heartbeat signal is not received for a plurality of preset times, the following actions can be performed: local warning, triggering the indicator light of the instrument panel to remind the driver that the communication system is abnormal; function limitation: suspending non-critical remote instructions (such as remote air conditioning start, remote window control, etc.) through the link, and retaining the core safety communication function; event reporting: the diagnostic event manager DEM records the fault code and reports it.

[0063] E2E verification is a diagnosis of the integrity of the end-to-end protection mechanism of the CAN bus message, including CRC verification and counter verification. The diagnostic event manager records the E2E verification failure error code.

[0064] When the E2E verification of the safety message (such as vehicle control instruction) on the CAN bus continuously fails for more than a set number of times (the specific number of times can be autonomously defined by the vehicle manufacturer according to the vehicle functional safety requirements, for example, set to 3 times), the following actions can be performed: fault recording, recording and reporting fault codes; communication degradation: through controller software configuration to suspend receiving and processing all control instructions requiring safety authentication, preventing the controller from executing malicious instructions that may be tampered with or imitated, until the communication is restored or the key is updated.

[0065] The security layer diagnosis is to monitor whether the decryption is successful when the HSE hardware security module decrypts the instruction. If it continuously returns to a set number of times (for example, set to 5 times), the following actions can be performed: automatically trigger the key switching algorithm, the controller sends a key switching request to the T-Box according to the DID (Data Identifier) service number predefined by the vehicle manufacturer; fault code reporting: DEM records and reports fault codes. In addition, during the key switching process, the vehicle system can be maintained in the same communication degradation mode as when the E2E verification is abnormal, and the execution of the control instruction is suspended.

[0066] The application function layer diagnosis is to execute function limitation and vehicle speed limitation according to the business diagnosis scene, report and record the corresponding fault codes, and perform key fuse when necessary.

[0067] In the application function layer diagnosis, the key function state and the comprehensive safety situation of the vehicle need to be evaluated and diagnosed, and this level is the highest level of response. Through receiving and comprehensively judging the fault information from the communication timeout diagnosis, the message end-to-end check and safety layer diagnosis, and the function state signals of the vehicle itself (such as driving system failure or illegal physical disassembly signal light, etc.), the system can be obtained.

[0068] When a persistent security attack is detected (for example, persistent receipt of fault information reported by the safety layer diagnosis), it is confirmed that the T-Box is attacked by illegal disassembly, or the key function of the vehicle (such as the driving function or the braking function) appears an abnormality related to the safety instruction, the system can execute the following safety protection actions according to the diagnosed business scene in stages: Vehicle speed limit and function degradation, sending instructions to the controller to limit the driving torque output, and limiting the maximum vehicle speed to below 50km / h, forcing the vehicle to enter the limp mode, ensuring the basic moving ability while ensuring safety.

[0069] Drive restriction: In an extreme scenario (for example, confirmed as a theft), an instruction can be sent to limit the engine start or drive motor output.

[0070] Key fuse: When it is confirmed that there is a physical attack or irreversible security risk, a disassembly signal is sent to the HSE firmware to execute the key fuse mechanism. That is, the key fuse interface is called, all keys are erased immediately by the HSE firmware, and the Flash write permission is permanently locked, thereby protecting the keys from being stolen from the hardware root.

[0071] Global reporting: DEM records the security event fault code, and reports the current vehicle state (such as “speed limited” or “key fused”) to the cloud monitoring platform through the T-Box, so as to start the corresponding response process subsequently.

[0072] In the embodiment, through setting multi-level fault diagnosis and safety response linkage, more accurate fault positioning and more effective active defense can be realized.

[0073] In a second aspect, the embodiments of the present application also provide a safety communication dynamic key management device.

[0074] In an embodiment, with reference to Figure 4 , Figure 4 is a functional module schematic diagram of an embodiment of the safety communication dynamic key management device of the present application. As Figure 4 shown, the safety communication dynamic key management device comprises: The key management unit 401 is configured to store the generated key in the hardware security module, and dynamically update the key based on a key update strategy; The message encryption unit 402 is configured to encrypt and protect the CAN message based on the key; The key fusing unit 403 is configured to destroy the key and lock the write permission of the public storage area based on a hardware-level key fusing mechanism when the disassembly signal is detected.

[0075] Corresponding to each step in the method, each module in the device has the same function and implementation process, which will not be described here.

[0076] In a third aspect, the embodiments of the present application provide a secure communication dynamic key management device, which can be a HSE hardware security module or other vehicle-mounted device with data processing function.

[0077] Reference Figure 5 , Figure 5 The figure is a schematic diagram of the hardware structure of the secure communication dynamic key management device involved in the embodiments of the present application. In the embodiments of the present application, the secure communication dynamic key management device can include a processor, a memory, a communication interface, and a communication bus.

[0078] The communication bus can be of any type and is used to interconnect the processor, the memory, and the communication interface.

[0079] The communication interface includes input / output (I / O) interfaces, physical interfaces, and logical interfaces, which are used to interconnect the devices inside the secure communication dynamic key management device, and interfaces used to interconnect the secure communication dynamic key management device with other devices (such as other computing devices or user devices).

[0080] The memory can be various types of storage media, such as random access memory (RAM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0081] The processor can be a general-purpose processor that can call the secure communication dynamic key management program stored in the memory and execute the secure communication dynamic key management method provided by the embodiments of the present application. The method executed by the secure communication dynamic key management program when called can refer to the various embodiments of the secure communication dynamic key management method of the present application, which will not be described here.

[0082] Those skilled in the art can understand that Figure 5The hardware structure shown in the figures is not intended to limit the present application, and can include more or fewer components than shown, or combine some components, or arrange the components differently.

[0083] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium.

[0084] The computer readable storage medium of the present application stores a secure communication dynamic key management program, wherein the secure communication dynamic key management program, when executed by a processor, implements the steps of the secure communication dynamic key management method as follows: The generated key is stored in a hardware security module, and the key is dynamically updated based on a key update strategy; The CAN message is encrypted and protected based on the key; When the disassembly signal is detected, the key is destroyed and the public storage area write permission is locked based on the hardware level key fuse mechanism.

[0085] The method implemented when the secure communication dynamic key management program is executed can refer to the embodiments of the secure communication dynamic key management method of the present application, which will not be described here.

[0086] It should be noted that the above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0087] The terms "include" and "have" and any variations thereof in the specification and claims of the present application and the above-described figures are intended to cover the non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, product or device. The terms "first", "second" and "third" and the like descriptions are used to distinguish different objects, and do not represent the order or limit the types of "first", "second" and "third".

[0088] In the description of the embodiments of the present application, "exemplary", "for example" or "for instance" is used to mean as an example, illustration or description. Any embodiment or design scheme described as "exemplary", "for example" or "for instance" in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the words "exemplary", "for example" or "for instance" are intended to present the relevant concept in a specific manner.

[0089] In the description of the embodiments of the present application, unless otherwise specified, " / " means the meaning of or, for example, A / B can mean A or B; the text "and / or" only describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can mean that A exists alone, A and B exist together, and B exists alone, and in addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0090] In some processes described in the embodiments of the present application, a plurality of operations or steps are included in a specific order, but it should be understood that these operations or steps can be executed or executed in parallel without the order in which they appear in the embodiments of the present application, and the serial number of the operation is only used to distinguish different operations, and the serial number itself does not represent any execution order. In addition, these processes can include more or fewer operations, and these operations or steps can be executed in sequence or in parallel, and these operations or steps can be combined.

[0091] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by software and the necessary general hardware platform, of course, it can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, an optical disk) as described above, and includes a plurality of instructions for making a terminal device execute the method of each embodiment of the present application.

[0092] The above is only the preferred embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation using the content of the specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for managing dynamic keys for secure communication, characterized in that, include: The generated key is stored in a hardware security module and dynamically updated based on a key update policy; The CAN message is encrypted and protected based on the key. When a disassembly signal is detected, the key is destroyed and write access to the public storage area is locked based on a hardware-level key fuse mechanism.

2. The secure communication dynamic key management method according to claim 1, characterized in that, The step of storing the generated key in the hardware security module includes: The generated key is stored in the key slot of the hardware security module by calling the key filling interface; The key includes at least one security key, which corresponds to at least one security algorithm.

3. The secure communication dynamic key management method according to claim 1, characterized in that, The dynamic updating of the key based on the key update strategy includes: Call the key erasure interface to erase the old key; Update the key and write the updated key into the new key slot of the hardware security module; Returns the key update status.

4. The secure communication dynamic key management method according to claim 1, characterized in that, The encryption protection of CAN messages based on the key includes: The CAN message is end-to-end encapsulated and encrypted according to the key and the corresponding security algorithm to obtain an encrypted message. The encrypted message includes a random number, an ID, and a payload.

5. The secure communication dynamic key management method according to claim 1, characterized in that, The method of destroying the key and locking write access to the public storage area based on the hardware-level key circuit breaker mechanism includes: Erase all keys in the hardware security module; Erase all key slots in the hardware security module; Permanently lock write access to the public storage area.

6. The secure communication dynamic key management method according to claim 1, characterized in that, The method further includes: Perform multi-level fault diagnosis on vehicle control, and execute preset abnormality protection strategies and report abnormal status when abnormalities are diagnosed. The multi-level fault diagnosis includes communication timeout diagnosis, end-to-end message verification, security layer diagnosis, and application function layer diagnosis.

7. The secure communication dynamic key management method according to claim 6, characterized in that, The communication timeout diagnosis includes real-time heart rate monitoring; The end-to-end message verification includes CRC verification and counter verification of CAN messages; The security layer diagnostics include monitoring the decryption behavior of the hardware security module; The application function layer diagnostics include a security posture assessment that integrates the communication timeout diagnostics, the end-to-end message verification, the security layer diagnostics, and the vehicle function status signals.

8. A secure communication dynamic key management device, characterized in that, include: A key management unit is used to store the generated key in the hardware security module and dynamically update the key based on a key update policy; A message encryption unit is used to encrypt and protect CAN messages based on the key; The key fuse unit is used to destroy the key and lock write access to the public storage area based on a hardware-level key fuse mechanism when a tampering signal is detected.

9. A secure communication dynamic key management device, characterized in that, The secure communication dynamic key management device includes a processor, a memory, and a secure communication dynamic key management program stored in the memory and executable by the processor, wherein when the secure communication dynamic key management program is executed by the processor, it implements the steps of the secure communication dynamic key management method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a secure communication dynamic key management program, wherein when the secure communication dynamic key management program is executed by a processor, it implements the steps of the secure communication dynamic key management method as described in any one of claims 1 to 7.

Images