Method and system for defending physical manipulation attack and new energy vehicle

Abstract

The invention discloses a physical manipulation attack defense method and system and a new energy vehicle, and the method comprises the steps: enabling a related part to transmit a second hardware identifier to a vehicle control unit during each power-on; the vehicle control unit receives the second hardware identifier of the related part and compares the second hardware identifier with the memorized first hardware identifier corresponding to the related part; wherein a first hardware identifier, which is learned and memorized when the vehicle leaves a factory or after the part is normally replaced, of the related part is stored in the vehicle control unit; if the comparison result is inconsistent, the vehicle control unit sends an alarm instruction to the instrument; and the instrument gives an alarm according to the alarm instruction. Physical manipulation attacks are defended through the method.

Description

Technical Field

[0001] This application belongs to the field of new energy vehicle technology, and relates to a method, system and new energy vehicle for defending against physical manipulation attacks. Background Technology

[0002] New energy vehicles (especially new energy commercial vehicles) are a crucial component of modern logistics and public transportation, making their operational safety and system reliability paramount. Currently, there is a requirement that "vehicles should possess security mechanisms to defend against physical manipulation attacks," but the industry lacks a comprehensive method to address this requirement. Therefore, developing an efficient and easily implementable method for defending new energy commercial vehicles against physical manipulation attacks is both necessary and urgent. Summary of the Invention

[0003] Objective: In view of at least one of the above technical problems, this application provides a method, system and new energy vehicle for defending against physical manipulation attacks, which can achieve defense against physical manipulation attacks based on cloud and local.

[0004] Technical solution: To solve the above-mentioned technical problems, the technical solution adopted in this application is as follows:

[0005] Firstly, a method for defending against physical manipulation attacks is provided, including:

[0006] Each time power is applied, the relevant components send a second hardware identifier to the vehicle controller;

[0007] The vehicle controller receives the second hardware identifier of the relevant component and compares the second hardware identifier with the first hardware identifier of the corresponding relevant component stored in memory; wherein, the vehicle controller stores the first hardware identifier of the relevant component learned and memorized when the vehicle leaves the factory or after normal component replacement;

[0008] If the second hardware identifier does not match the first hardware identifier of the corresponding component, the vehicle controller sends an alarm command to the instrument panel.

[0009] The instrument responds to receiving an alarm command and issues an alarm accordingly.

[0010] In some embodiments, the first hardware identifiers of the relevant components stored in the vehicle controller, which were learned and memorized at the time the vehicle left the factory, include:

[0011] When a vehicle leaves the factory, if the vehicle includes an on-board telematics terminal, the on-board telematics terminal sends an adaptation command to the relevant components; if the vehicle does not include an on-board telematics terminal, the instrument panel sends an adaptation command to the relevant components.

[0012] Upon receiving the adaptation command, the relevant component sends a first hardware identifier to the vehicle controller.

[0013] The vehicle controller learns and memorizes the first hardware identifier of the corresponding component.

[0014] In some embodiments, the method for defending against physical manipulation attacks further includes:

[0015] After a normal component replacement, if the vehicle includes an onboard telematics terminal, the onboard telematics terminal sends an adaptation command to the relevant component. The relevant component sends a third hardware identifier to the vehicle controller. The vehicle controller receives the third hardware identifier of the relevant component and re-memorizes the first hardware identifier of the corresponding relevant component based on the third hardware identifier. After power-on, the vehicle controller sends a cancel alarm command to the instrument panel, and the instrument panel clears the alarm based on the cancel alarm command.

[0016] In other embodiments, the method for defending against physical manipulation attacks further includes:

[0017] After a normal component replacement, if the vehicle does not include an onboard telematics terminal, the instrument cluster will send an adaptation command to the relevant component after the physical buttons on the steering wheel are pressed in a fixed sequence. The relevant component will then send a third hardware identifier to the vehicle controller. The vehicle controller will receive the third hardware identifier of the relevant component and re-memorize the first hardware identifier of the corresponding component based on the third hardware identifier. After power-on, the vehicle controller will send a cancel alarm command to the instrument cluster, and the instrument cluster will clear the alarm based on the cancel alarm command.

[0018] In some embodiments, the components involved include at least one of a driving recorder, an in-vehicle battery swapping controller, an in-vehicle infotainment system, and an in-vehicle telematics terminal.

[0019] In some embodiments, each involved component is equipped with a unique hardware identifier.

[0020] Furthermore, the hardware identifier adopts an SN code or a traceability code. The customization principle of the hardware identifier includes: (1 byte) customer abbreviation + (1 byte) product code + (6 bytes) serial number, totaling 8 bytes.

[0021] In this embodiment, the customer abbreviation is a fixed character "X"; the product code is divided into low-end, high-end, and top-end; low-end is "0", high-end is "1", and top-end is "2"; the serial number is composed of the numbers "0~9".

[0022] In this embodiment, the components, vehicle controller, and instrument cluster communicate via a CAN bus.

[0023] Secondly, a device for defending against physical manipulation attacks is provided, including a processor and a storage medium;

[0024] The storage medium is used to store instructions;

[0025] The processor is configured to operate according to the instructions to execute the method.

[0026] Thirdly, a system for defending against physical manipulation attacks is provided, including a vehicle controller.

[0027] Each time power is applied, the relevant components send a second hardware identifier to the vehicle controller;

[0028] The vehicle controller receives the second hardware identifier of the relevant component and compares the second hardware identifier with the first hardware identifier of the corresponding relevant component stored in memory; wherein, the vehicle controller stores the first hardware identifier of the relevant component learned and memorized when the vehicle leaves the factory or after normal component replacement;

[0029] If the second hardware identifier does not match the first hardware identifier of the corresponding component, the vehicle controller sends an alarm command to the instrument panel.

[0030] The instrument responds to receiving an alarm command and issues an alarm accordingly.

[0031] Fourthly, a new energy vehicle is provided, equipped with the aforementioned defense against physical manipulation attacks or the aforementioned defense against physical manipulation attacks system.

[0032] Compared with the prior art, the beneficial effects achieved by this application are as follows: (1) This application proposes for the first time a method to defend against physical manipulation attacks that meets the requirements. By pre-compiling a unique hardware identifier in the ROM or HSM of the involved component, the first hardware identifier of the involved component is sent to the vehicle controller for learning and memorization when the vehicle leaves the factory or after normal component replacement. Each time the power is turned on, the involved component sends a second hardware identifier to the vehicle controller. The vehicle controller VCU receives the second hardware identifier and compares it with the memorized first hardware identifier of the corresponding involved component. If the comparison is inconsistent, an alarm command is sent to the instrument IC to issue an alarm. This method defends against physical manipulation attacks. (2) The method of this application is flexible and does not rely on a single fixed component. It can be implemented in various vehicle network architectures. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a schematic diagram of the framework of a defense system against physical manipulation attacks according to an embodiment of this application.

[0035] Figure 2This is a schematic diagram of the communication matrix in an embodiment of this application;

[0036] Figure 3 This is a schematic diagram of the method for defending against physical manipulation attacks according to an embodiment of this application;

[0037] Figure 4 This is a schematic diagram of the normal component replacement process in the embodiments of this application. Detailed Implementation

[0038] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit this application or its application or use.

[0039] In the description of this application, it should be understood that the terms "center," "longitudinal," "lateral," "upper," "lower," "front," "rear," "left," "right," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only used to explain the relative positional relationship and movement between components in a specific orientation. If the specific orientation changes, the directional indication will also change accordingly. These terms are used only for the convenience of describing this application and for simplifying the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0040] Furthermore, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0041] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art will understand the specific meaning of the above terms in this application based on the specific circumstances.

[0042] The technical terms used in this application are explained as follows:

[0043] TCO - Driving recorder;

[0044] TBOX - Vehicle-mounted Remote Information Processing Terminal;

[0045] EBC - On-board battery swapping controller;

[0046] IVI - In-vehicle infotainment system;

[0047] ROM (Read-Only Memory) is a type of memory that is read-only.

[0048] HSM - Hardware Security Module.

[0049] like Figure 3 As shown, this application provides a method for defending against physical manipulation attacks, including:

[0050] S1. When the vehicle leaves the factory, if the vehicle includes an on-board telematics terminal (TBOX), the TBOX sends an adaptation command to the relevant components. If the vehicle does not include an on-board telematics terminal (TBOX), the instrument IC sends an adaptation command to the relevant components. Upon receiving the adaptation command, the relevant components send a first hardware identifier to the vehicle controller (VCU). The vehicle controller (VCU) learns and memorizes the first hardware identifier of the corresponding relevant components.

[0051] In this embodiment, the component involved has an 8-bit unique hardware identifier pre-installed in the ROM or HSM.

[0052] In this embodiment, the components involved include at least one of the following: a vehicle recorder (TCO), an onboard battery swapping controller (EBC), an onboard infotainment system (IVI), and an onboard telematics terminal (TBOX).

[0053] It should be noted that each component involved is equipped with a unique hardware identifier.

[0054] In some embodiments, the hardware identifier is an SN code or a traceability code, and the principles for customizing the hardware identifier include:

[0055] (1 byte) Customer abbreviation + (1 byte) Product code + (6 bytes) Serial number, totaling 8 bytes.

[0056] In this embodiment, the customer abbreviation uses the fixed character "X";

[0057] Product code: Divided into low-end, high-end, and top-end; low-end "0", high-end "1", and top-end "2";

[0058] Serial number: consists of the digits "0~9";

[0059] The specific configuration can be defined by the supplier. Hardware identification code example:

[0060] XCMG high-configuration IDCU SN code / traceability number: ASCII string: X1000001;

[0061] The corresponding hexadecimal number is: 5831303030303031.

[0062] S2. Each time power is supplied, the relevant components send a second hardware identifier to the vehicle controller (VCU);

[0063] The vehicle control unit (VCU) receives the second hardware identifier of the relevant component and compares the second hardware identifier with the first hardware identifier of the corresponding relevant component stored in memory; wherein, the vehicle control unit (VCU) stores the first hardware identifier of the relevant component learned and memorized when the vehicle leaves the factory.

[0064] If the second hardware identifier does not match the first hardware identifier of the corresponding component, the vehicle controller (VCU) sends an alarm command to the instrument IC.

[0065] The instrument IC generates an alarm based on the alarm command.

[0066] It should be noted that issuing an alarm based on an alarm command may include displaying the alarm content or simultaneously issuing audible and visual alarms.

[0067] If, after a period of use, some components of a new energy vehicle need to be repaired or replaced due to reasons such as damage or malfunction, the hardware markings of some of these components will change.

[0068] Based on this, such as Figure 4 As shown, the method for defending against physical manipulation attacks further includes:

[0069] S3. After a normal component replacement, if the vehicle includes a vehicle telematics terminal (TBOX), the TBOX sends an adaptation command to the relevant component. The relevant component sends a third hardware identifier to the vehicle controller (VCU). The VCU receives the third hardware identifier of the relevant component and re-memorizes the first hardware identifier of the corresponding component based on the third hardware identifier. After power-on, the VCU sends a cancel alarm command to the instrument IC, and the instrument IC clears the alarm according to the cancel alarm command.

[0070] After a normal component replacement, if the vehicle does not include a vehicle telematics terminal (TBOX), the instrument cluster IC sends an adaptation command to the relevant component after the physical buttons on the steering wheel are pressed in a fixed sequence. The relevant component then sends a third hardware identifier to the vehicle controller (VCU). The VCU receives the third hardware identifier of the relevant component and re-memorizes the first hardware identifier of the corresponding component based on the third hardware identifier. After power-on, the VCU sends a cancel alarm command to the instrument cluster IC, which then clears the alarm according to the cancel alarm command.

[0071] In this embodiment, the components involved, the vehicle controller (VCU), and the instrument IC communicate via a CAN bus.

[0072] In some embodiments, the components involved, the vehicle controller (VCU), and the instrument IC are all equipped with a unique source address (such as an IP address), and the corresponding hardware device is identified through the corresponding source address during communication.

[0073] like Figure 1 As shown in the illustration, an embodiment of this application provides a system for defending against physical manipulation attacks, including components requiring protection against such attacks (such as a vehicle control unit (TCO), a vehicle telematics terminal (TBOX), a vehicle battery swapping controller (EBC), and an in-vehicle infotainment system (IVI), a vehicle control unit (VCU), an instrument cluster (IC), and a gateway (GW). If the vehicle includes a vehicle telematics terminal (TBOX), the TBOX is communicatively connected to a cloud platform.

[0074] Specific application example: In this embodiment, a method for defending against physical manipulation attacks includes:

[0075] 1) The components involved have an 8-bit unique hardware identifier pre-installed in the ROM or HSM;

[0076] 2) When leaving the factory, the instrument IC or the vehicle remote information processing terminal TBOX issues an adaptation command. The relevant components issue the first hardware identifier, which is forwarded by the gateway to the CAN bus where the vehicle controller is located. Then the vehicle controller VCU learns and memorizes the first hardware identifier of the corresponding relevant components.

[0077] 3) Each time power is supplied, the relevant components send out a pre-made 8-bit unique hardware identifier, which is forwarded to the CAN bus where the vehicle controller is located via the gateway. The vehicle controller compares the second hardware identifier in the CAN message with the first hardware identifier in its memory.

[0078] 4) If the comparison fails (inconsistency), the vehicle controller sends an alarm message, which is forwarded to the instrument panel via the gateway, and the instrument panel displays the alarm information.

[0079] 5) When replacing components, if the vehicle has an On-Board Telematics Unit (TBOX), the TBOX will issue an adaptation command after receiving instructions from the cloud platform. The affected components will then issue hardware identifiers, and the vehicle controller will re-memorize the first hardware identifier and clear the alarm. If the vehicle does not have a TBOX, the instrument cluster will issue an adaptation command after receiving a fixed sequence of key combinations. The affected components will then issue hardware identifiers, and the vehicle controller will re-memorize the first hardware identifier and clear the alarm.

[0080] The overall communication matrix is ​​as follows Figure 2 As shown, it involves component name, source address, bytes, bits, description, and remarks. In this embodiment, the hardware identifier uses an 8-bit serial number (SN).

[0081] This application provides a device for defending against physical manipulation attacks, including a processor and a storage medium;

[0082] The storage medium is used to store instructions;

[0083] The processor is configured to operate according to the instructions to execute the method.

[0084] This application provides a system for defending against physical manipulation attacks, including the aforementioned device for defending against physical manipulation attacks.

[0085] In this embodiment, a system for defending against physical manipulation attacks includes a vehicle controller.

[0086] Each time power is applied, the relevant components send a second hardware identifier to the vehicle controller;

[0087] The vehicle controller receives the second hardware identifier of the relevant component and compares the second hardware identifier with the first hardware identifier of the corresponding relevant component stored in memory; wherein, the vehicle controller stores the first hardware identifier of the relevant component learned and memorized when the vehicle leaves the factory or after normal component replacement;

[0088] If the second hardware identifier does not match the first hardware identifier of the corresponding component, the vehicle controller sends an alarm command to the instrument panel.

[0089] The instrument responds to receiving an alarm command and issues an alarm accordingly.

[0090] The vehicle controller stores the first hardware identifiers of the relevant components that were learned and memorized when the vehicle left the factory, including:

[0091] When a vehicle leaves the factory, if the vehicle includes an on-board telematics terminal, the on-board telematics terminal sends an adaptation command to the relevant components; if the vehicle does not include an on-board telematics terminal, the instrument panel sends an adaptation command to the relevant components.

[0092] Upon receiving the adaptation command, the relevant component sends a first hardware identifier to the vehicle controller.

[0093] The vehicle controller learns and memorizes the first hardware identifier of the corresponding component.

[0094] The vehicle controller stores the first hardware identifiers of the components involved, learned and memorized after normal component replacement, including:

[0095] After a normal component replacement, if the vehicle includes an onboard telematics terminal, the onboard telematics terminal sends an adaptation command to the relevant component. The relevant component sends a third hardware identifier to the vehicle controller. The vehicle controller receives the third hardware identifier of the relevant component and re-memorizes the first hardware identifier of the corresponding relevant component based on the third hardware identifier. After power-on, the vehicle controller sends a cancel alarm command to the instrument panel, and the instrument panel clears the alarm based on the cancel alarm command.

[0096] After a normal component replacement, if the vehicle does not include an onboard telematics terminal, the instrument cluster will send an adaptation command to the relevant component after the physical buttons on the steering wheel are pressed in a fixed sequence. The relevant component will then send a third hardware identifier to the vehicle controller. The vehicle controller will receive the third hardware identifier of the relevant component and re-memorize the first hardware identifier of the corresponding component based on the third hardware identifier. After power-on, the vehicle controller will send a cancel alarm command to the instrument cluster, and the instrument cluster will clear the alarm based on the cancel alarm command.

[0097] This application provides a new energy vehicle equipped with the aforementioned defense against physical manipulation attacks or the aforementioned defense against physical manipulation attacks system.

[0098] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0099] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0100] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0101] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0102] The above description is only a preferred embodiment of this application. It should be noted that those skilled in the art should understand that various changes and improvements may be made to this application without departing from the principles and spirit. These improvements should also be considered within the scope of protection of this application and are not limited to the above embodiments.

Claims

1. A method for defending against physical manipulation attacks, characterized in that, include: Each time power is applied, the relevant components send a second hardware identifier to the vehicle controller; The vehicle controller receives the second hardware identifier of the relevant component and compares the second hardware identifier with the first hardware identifier of the corresponding relevant component stored in memory; wherein, the vehicle controller stores the first hardware identifier of the relevant component learned and memorized when the vehicle leaves the factory or after normal component replacement; If the second hardware identifier does not match the first hardware identifier of the corresponding component, the vehicle controller sends an alarm command to the instrument panel. The instrument issues an alarm based on the alarm command.

2. The method for defending against physical manipulation attacks according to claim 1, characterized in that, The vehicle controller stores the first hardware identifiers of the relevant components that were learned and memorized when the vehicle left the factory, including: When a vehicle leaves the factory, if the vehicle includes an on-board telematics terminal, the on-board telematics terminal sends an adaptation command to the relevant components; if the vehicle does not include an on-board telematics terminal, the instrument panel sends an adaptation command to the relevant components. Upon receiving the adaptation command, the relevant component sends a first hardware identifier to the vehicle controller. The vehicle controller learns and memorizes the first hardware identifier of the corresponding component.

3. The method for defending against physical manipulation attacks according to claim 1 or 2, characterized in that, Also includes: After a normal component replacement, if the vehicle includes an onboard telematics terminal, the onboard telematics terminal sends an adaptation command to the relevant component. The relevant component sends a third hardware identifier to the vehicle controller. The vehicle controller receives the third hardware identifier of the relevant component and re-memorizes the first hardware identifier of the corresponding relevant component based on the third hardware identifier. After power-on, the vehicle controller sends a cancel alarm command to the instrument panel, and the instrument panel clears the alarm based on the cancel alarm command.

4. The method for defending against physical manipulation attacks according to claim 1 or 2, characterized in that, Also includes: After a normal component replacement, if the vehicle does not include an onboard telematics terminal, the instrument cluster will send an adaptation command to the relevant component after the physical buttons on the steering wheel are pressed in a fixed sequence. The relevant component will then send a third hardware identifier to the vehicle controller. The vehicle controller will receive the third hardware identifier of the relevant component and re-memorize the first hardware identifier of the corresponding component based on the third hardware identifier. After power-on, the vehicle controller will send a cancel alarm command to the instrument cluster, and the instrument cluster will clear the alarm based on the cancel alarm command.

5. The method for defending against physical manipulation attacks according to claim 1, characterized in that, The components involved include at least one of the following: driving recorder, vehicle battery swapping controller, vehicle infotainment system, and vehicle telematics terminal.

6. The method for defending against physical manipulation attacks according to claim 1, characterized in that, Each component involved is equipped with a unique hardware identifier.

7. The method for defending against physical manipulation attacks according to claim 6, characterized in that, The hardware identifier uses an SN code or a traceability code. The customization principle of the hardware identifier includes: customer abbreviation + product code + serial number.

8. A device for defending against physical manipulation attacks, characterized in that, Including processor and storage media; The storage medium is used to store instructions; The processor is configured to operate according to the instructions to perform the method according to any one of claims 1 to 7.

9. A system for defending against physical manipulation attacks, characterized in that, Including the vehicle controller, Each time power is applied, the relevant components send a second hardware identifier to the vehicle controller; The vehicle controller receives the second hardware identifier of the relevant component and compares the second hardware identifier with the first hardware identifier of the corresponding relevant component stored in memory; wherein, the vehicle controller stores the first hardware identifier of the relevant component learned and memorized when the vehicle leaves the factory or after normal component replacement; If the second hardware identifier does not match the first hardware identifier of the corresponding component, the vehicle controller sends an alarm command to the instrument panel. The instrument issues an alarm based on the alarm command.

10. A new energy vehicle, characterized in that, It is equipped with the physical manipulation attack defense device as described in claim 8 or the physical manipulation attack defense system as described in claim 9.

Images