Network access permission setting method of vehicle-mounted ECU, TMC and ECU

Abstract

The invention provides a network access permission setting method of a vehicle-mounted ECU, a TMC and the ECU, and belongs to the technical field of vehicle electronics, and the method comprises the following steps: sending an IDPS proxy resource list to be measured to an IMA of the ECU; obtaining an initial integrity calculation result which is uploaded by the IMA and is obtained through calculation based on the IDPS proxy resource list; after the initial integrity calculation result is compared with the credible reference, credible registration is carried out on the IMA; sending a measurement challenge message to the registered IMA, and obtaining a returned measurement response message; the measurement response message is obtained by performing integrity calculation on resource data corresponding to the current IDPS agent by the registered IMA based on the measurement challenge message to obtain a real-time measurement value and then combining the real-time measurement value with a random number; an integrity state of the registered IMA is determined based on the metric response message, and network access rights of the ECU are adjusted based on the integrity state.

Description

Technical Field

[0001] This invention relates to the field of vehicle electronics technology, specifically to a method for setting network access permissions for a vehicle ECU, a TMC, and an ECU. Background Technology

[0002] With the rapid development of intelligent connected vehicles, the connectivity and intelligence of in-vehicle electronic systems are constantly improving, significantly increasing the cybersecurity risks faced by vehicles. Intrusion Detection and Prevention Systems (IDPS), as a crucial line of defense for in-vehicle cybersecurity, typically employ a distributed architecture, deploying lightweight agents in multiple electronic control units (ECUs) across the powertrain, body, and smart cockpit domains to detect and protect against in-vehicle network attacks.

[0003] However, existing technologies lack sufficient security protection for IDPS proxies themselves, leaving the vehicle network defense system vulnerable to being bypassed or weakened. This is mainly reflected in the following aspects: 1. Existing ECU software integrity verification mechanisms (such as secure boot) mainly target the whole machine firmware or main application, and do not protect the IDPS agent as an independent key security object. They lack special integrity verification of its core resources such as code, configuration files and policy library. Attackers can disable the IDPS agent by tampering with the above resources.

[0004] 2. Existing integrity verification is usually only performed during the ECU startup phase, which cannot cover runtime attacks during long-term vehicle operation and makes it difficult to detect dynamic tampering of the IDPS agent in a timely manner.

[0005] 3. There is a lack of a unified trusted control mechanism among distributed IDPS agents. Even if individual agents are compromised, the ECU to which they belong can still access the vehicle network, and the attack risk can easily spread between different domains.

[0006] Therefore, there is an urgent need for an in-vehicle security protection technology solution that can continuously ensure the trustworthiness of the IDPS agent and dynamically limit the spread of security risks during ECU operation. Summary of the Invention

[0007] In view of this, it is necessary to provide a method for setting network access permissions for vehicle ECUs, TMCs, and ECUs, so as to continuously ensure the trustworthiness of IDPS agents and dynamically limit the spread of security risks during ECU operation.

[0008] To address the aforementioned problems, in a first aspect, the present invention provides a method for setting network access permissions for an in-vehicle ECU, the method being applied to a TMC, the method comprising: Send the list of IDPS agent resources to be measured to the ECU's IMA; Obtain the initial integrity calculation result uploaded by the IMA based on the IDPS proxy resource list; After the initial integrity calculation result is compared and approved with the preset trust benchmark, the IMA is registered in a trusted manner. Send a metric challenge message to the registered IMA and obtain a metric response message returned by the registered IMA; the metric response message is obtained by the registered IMA performing integrity calculations on the resource data corresponding to the current IDPS agent based on the metric challenge message to obtain a real-time metric value, and then combining the real-time metric value with a random number; the metric challenge message includes a random number, the range of IDPS agent resources to be measured, and a response time limit. The integrity status of the registered IMA is determined based on the metric response message, and the network access permissions of the ECU are adjusted based on the integrity status.

[0009] In one possible implementation, before sending the metric challenge message to the registered IMA, the following is also included: Obtain the list of IDPS proxy resources to be measured this time; Based on the list of IDPS proxy resources to be measured and the set response timeout, an initial measurement challenge message is generated; The initial metric challenge message is encrypted using a key generated from random numbers, and the corresponding HMAC value is calculated. Based on the initial metric challenge message and the HMAC value, the final metric challenge message is generated.

[0010] In one possible implementation, an integrity calculation is performed on the resource data corresponding to the current IDPS agent based on the metric challenge message to obtain a real-time metric value, including: Within the response timeout period corresponding to the measurement challenge message, read the resource data corresponding to the current IDPS proxy from the IDPS proxy resource list that needs to be measured this time corresponding to the measurement challenge message; The integrity of the resource data corresponding to the current IDPS agent is calculated based on the hash algorithm to obtain the real-time metric value.

[0011] In one possible implementation, determining the integrity status of a registered IMA based on the metric response message includes: After verifying that the measurement response message has not been tampered with during transmission based on the session key between the TMC and the ECU, the measurement response message is decrypted to extract the real-time measurement value. The extracted real-time metrics are compared with the trusted baseline values ​​of IDPS proxy resources, and the integrity status of the registered IMA is determined based on the comparison results.

[0012] In one possible implementation, the method for setting network access permissions for the vehicle ECU also includes: If the integrity status of a registered IMA is determined to be abnormal or compromised based on the measurement response message, the recovery level of the IDPS agent is determined based on the integrity status, historical records, and ECU type of the registered IMA. The recovery level includes one of the following: soft recovery that does not affect the main function of the ECU, hard recovery that requires restarting the ECU process or performing a secure OTA on the ECU, and OTA refresh of the complete IDPS agent image through a secure channel. Based on the recovery level, a recovery command containing repair resources is sent to the registered IMA to restore the registered IMA.

[0013] In one possible implementation, the method for setting network access permissions for the vehicle ECU also includes: After performing a soft recovery on the registered IMA, resend the metric challenge message to the registered IMA and retrieve the metric response message returned by the registered IMA. Based on the reacquired metric response message, the new integrity status of the registered IMA is determined, and after determining that the registered IMA meets the trust benchmark based on the new integrity status, the network access permissions of the ECU are restored.

[0014] In one possible implementation, the method for setting network access permissions for the vehicle ECU also includes: After determining that the registered IMA meets the untrustworthy benchmark based on the new integrity status, the registered IMA is either hard-recovered or OTA-refreshed.

[0015] Secondly, the present invention also provides a method for setting network access permissions for an in-vehicle ECU, the method being applied to the ECU's IMA, the method comprising: Receive the list of IDPS agent resources to be measured sent by TMC; The initial integrity calculation result is calculated based on the IDPS proxy resource list, and the initial integrity calculation result is sent to the TMC; After the TMC compares the initial integrity calculation result with the preset trusted benchmark and registers the IMA in a trusted manner, it receives a measurement challenge message sent by the TMC; the measurement challenge message includes a random number, the range of IDPS proxy resources to be measured this time, and the response time limit; Based on the metric challenge message, an integrity calculation is performed on the resource data corresponding to the current IDPS agent to obtain a real-time metric value. Then, the real-time metric value is combined with a random number to obtain a metric response message. The measurement response message is sent to the TMC, and the permission instruction sent by the TMC is received. The network access permissions of the ECU are adjusted based on the permission instruction. The permission instruction is an instruction sent by the TMC based on the integrity status of the registered IMA after determining the integrity status based on the measurement response message.

[0016] Thirdly, the present invention also provides a TMC, including a memory and a processor, wherein, The memory is used to store programs; The processor, coupled to the memory, is used to execute the program stored in the memory to implement the steps of the network access permission setting method for the vehicle ECU as described in any of the preceding claims.

[0017] Fourthly, the present invention also provides an ECU, including a memory and a processor, wherein, The memory is used to store the IMA; The processor, coupled to the memory, is used to execute the IMA in the memory to implement the steps of the network access permission setting method for the vehicle ECU as described above.

[0018] The beneficial effects of adopting the above implementation method are as follows: The network access permission setting method, TMC and ECU provided by the present invention send the IDPS proxy resource list to be measured to the IMA of the ECU through the TMC. After the initial integrity calculation result obtained based on the IDPS proxy resource list is compared with the preset trusted benchmark and passes the comparison, the IMA is trusted and registered. Only after the IMA is trusted and registered can the subsequent real-time measurement value calculation and integrity status determination be performed, thereby improving security.

[0019] Moreover, this invention is based on the real-time measurement value obtained by integrity calculation based on IDPS agent resources, and determines the integrity status of IMA based on the real-time measurement value, thereby adjusting the network access permissions of ECU, realizing the protection of IDPS agent as an independent key security object, and preventing IDPS agent from being invalidated by tampering with IDPS agent resources.

[0020] Furthermore, this invention is implemented through the interaction between the TMC and the ECU's IMA. The execution of this method is not limited to the ECU startup phase; it can be performed even during vehicle operation. Real-time metric values ​​are calculated to adjust the ECU's network access permissions, thereby continuously ensuring the trustworthiness of the IDPS agent during ECU operation and improving the real-time performance of vehicle security protection.

[0021] Moreover, this invention dynamically binds the security status of the IDPS agent and IMA to the network access permissions of the ECU, effectively limiting the spread of attacks in the vehicle network, thereby achieving the goal of continuously ensuring the trustworthiness of the IDPS agent and dynamically limiting the spread of security risks during ECU operation. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A flowchart of an embodiment of the network access permission setting method for an in-vehicle ECU provided by the present invention; Figure 2 A flowchart illustrating another embodiment of the method for setting network access permissions for an in-vehicle ECU provided by the present invention; Figure 3 A flowchart of yet another embodiment of the network access permission setting method for an in-vehicle ECU provided by the present invention; Figure 4 A schematic diagram of the system architecture for the network access permission setting method for an in-vehicle ECU provided by the present invention; Figure 5 A timing diagram for calculating integrity metrics and dynamic network access control based on integrity metrics provided by this invention; Figure 6 A timing diagram for the secure recovery of a compromised IDPS proxy provided by this invention; Figure 7 A schematic diagram of an embodiment of the electronic device provided by the present invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0025] In the description of the embodiments of this application, unless otherwise stated, "a plurality of" means two or more.

[0026] In the embodiments of the present invention, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, apparatus, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to such process, method, product or device.

[0027] The naming or numbering of steps in the embodiments of the present invention does not mean that the steps in the method flow must be executed in the time / logical order indicated by the naming or numbering. The execution order of the named or numbered process steps can be changed according to the technical purpose to be achieved, as long as the same or similar technical effect can be achieved.

[0028] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0029] This invention provides a method for setting network access permissions for an in-vehicle ECU, a TMC, and an ECU, which will be described below.

[0030] This invention provides a method for setting network access permissions for an in-vehicle ECU. This method is applied to a TMC (Transmission Control Center), meaning it can be implemented by executing an application program on the TMC. Figure 1 As shown, the method includes: S101. Send the list of IDPS agent resources to be measured to the ECU's IMA.

[0031] It is understandable that the TMC (Trusted Measurement Center) sends a list of IDPS agent resources to be measured to the IMA (Integrity Measurement Architecture). The list of resources includes at least the storage address or identifier of the IDPS agent's code segment, configuration file, and policy library.

[0032] The TMC is located in the core node of the vehicle (such as T-Box, central gateway), with built-in HSM, responsible for initiating measurement challenges, verifying response results, dynamically managing permissions, and scheduling recovery processes.

[0033] S102. Obtain the initial integrity calculation result uploaded by the IMA based on the IDPS proxy resource list.

[0034] Understandably, IMA performs an initial integrity calculation on the corresponding resources based on the resource list and reports the calculation results to TMC.

[0035] S103. After the initial integrity calculation result is compared with the preset trust benchmark and passes the comparison, the IMA is registered in a trustworthy manner.

[0036] Understandably, TMC compares this result with the trusted benchmark stored in the hardware root of trust to complete the trusted registration of the IMA. Only IMAs that have completed trusted registration can perform the following steps to improve security.

[0037] S104. Send a metric challenge message to the registered IMA and obtain the metric response message returned by the registered IMA; the metric response message is obtained by the registered IMA performing integrity calculations on the resource data corresponding to the current IDPS agent based on the metric challenge message to obtain a real-time metric value, and then combining the real-time metric value with a random number; the metric challenge message includes a random number, the range of IDPS agent resources to be measured this time, and the response time limit.

[0038] Understandably, after receiving a metric challenge, IMA reads the key resource data corresponding to the current IDPS agent within a specified time limit, performs integrity calculations on the resources, and generates real-time metric values.

[0039] IMA combines real-time metrics with random challenge data (i.e., random numbers), encrypts and authenticates the data using an established secure session, generates a metric response message, and sends it to TMC.

[0040] S105. Determine the integrity status of the registered IMA based on the measurement response message, and adjust the network access permissions of the ECU based on the integrity status.

[0041] Understandably, after receiving the measurement response, TMC verifies the integrity and origin of the response message, compares the real-time measurement value with the trusted benchmark stored in the hardware root of trust, and determines the integrity status of the IMA based on the comparison result.

[0042] Once the TMC obtains the integrity status of the IMA, it dynamically adjusts the network access permissions of the target ECU according to the preset status-permission mapping rules. The specific process is as follows: 1. Integrity State Mapping Based on the measurement results, TMC identifies the IMA as trusted, anomalous, or compromised, and determines the corresponding network access permission level.

[0043] 2. Issuance of access control policies When the IMA state changes, the TMC issues corresponding access control commands to the vehicle network infrastructure to restrict or isolate the communication range, port, or protocol type of the target ECU.

[0044] 3. Permission execution and state maintenance The vehicle network infrastructure implements network access control according to the latest access control policies, and the TMC synchronously records status changes and access adjustment information for subsequent auditing and recovery judgment.

[0045] In some embodiments, before sending the metric challenge message to the registered IMA, the method further includes: Obtain the list of IDPS proxy resources to be measured this time; Based on the list of IDPS proxy resources to be measured and the set response timeout, an initial measurement challenge message is generated; The initial metric challenge message is encrypted using a key generated from random numbers, and the corresponding HMAC value is calculated. Based on the initial metric challenge message and the HMAC (Hash-based Message Authentication Code) value, the final metric challenge message is generated.

[0046] Understandably, the steps for generating a measurement challenge message are as follows: ① Generate a random number (32 bytes or other preset length); ② Add the list of IDPS proxy resources to be measured to the message; ③ Specify the response timeout; ④ Encrypt the entire message using the session key and calculate the HMAC; ⑤ Send it to the target IMA through a secure channel.

[0047] In some embodiments, based on the metric challenge message, an integrity calculation is performed on the resource data corresponding to the current IDPS agent to obtain a real-time metric value, including: Within the response timeout period corresponding to the measurement challenge message, read the resource data corresponding to the current IDPS proxy from the IDPS proxy resource list that needs to be measured this time corresponding to the measurement challenge message; The integrity of the resource data corresponding to the current IDPS agent is calculated based on the hash algorithm to obtain the real-time metric value.

[0048] Understandably, when calculating real-time metrics, response timeouts should be avoided as much as possible, and calculations should be completed within the response time. In practice, a hash algorithm can be used to calculate the resource digest.

[0049] In some embodiments, determining the integrity status of a registered IMA based on the metric response message includes: After verifying that the measurement response message has not been tampered with during transmission based on the session key between the TMC and the ECU, the measurement response message is decrypted to extract the real-time measurement value. The extracted real-time metrics are compared with the trusted baseline values ​​of IDPS proxy resources, and the integrity status of the registered IMA is determined based on the comparison results.

[0050] Understandably, the process for determining the integrity status of a registered IMA is as follows: ① Use the session key to verify the message HMAC to confirm that the message has not been tampered with during transmission; ②Decrypt the message and extract real-time metrics and related information (random number, timestamp, IMA status); ③ Read the trusted baseline value (factory default or security update hash value) of the corresponding IDPS agent key resource from the hardware trust root. ④ Compare real-time measurements with reliable benchmark values: a) If the hash values ​​are completely identical, the integrity status of the IMA is determined to be "trustworthy"; b) If the hash values ​​are inconsistent but the message is valid, the integrity status of the IMA is determined to be "suspicious"; c) If the hash values ​​are inconsistent and message verification fails or times out, the integrity status of the IMA is determined to be "fractured".

[0051] In some embodiments, the method for setting network access permissions for an in-vehicle ECU further includes: If the integrity status of a registered IMA is determined to be abnormal or compromised based on the measurement response message, the recovery level of the IDPS agent is determined based on the integrity status, historical records, and ECU type of the registered IMA. The recovery level includes one of the following: soft recovery that does not affect the main function of the ECU, hard recovery that requires restarting the ECU process or performing a secure OTA on the ECU, and OTA refresh of the complete IDPS agent image through a secure channel. Based on the recovery level, a recovery command containing repair resources is sent to the registered IMA to restore the registered IMA.

[0052] Understandably, the IMA's recovery level assessment criteria are as follows: Current integrity status: Trustworthy, Suspicious, Faulty.

[0053] Historical recovery record: Whether a soft recovery or hard recovery has been performed recently.

[0054] ECU type and function sensitivity: For critical ECUs such as those in the power domain and autonomous driving domain, priority should be given to recovery methods that do not interrupt the main functions.

[0055] Explanation of IMA recovery levels: Soft recovery: Suitable for abnormal conditions or file tampering, without affecting the main functions of the ECU; Hard recovery: Applicable when soft recovery fails, involving process restart or secure OTA; OTA refresh: Applicable when hard restore still fails, it distributes the complete IDPS proxy image through a secure channel.

[0056] When TMC determines that IMA is in an abnormal or compromised state, it initiates a tiered recovery process for the IDPS agent, which includes: 1. Recovery Strategy Selection Based on the current status of the IMA, historical records, and ECU type, TMC determines the recovery level and prioritizes soft recovery methods that do not affect the main functions of the ECU.

[0057] 2. Soft recovery execution TMC sends a recovery command containing the repaired resources to IMA. IMA then performs overwrite repair on the tampered configuration files or policy libraries locally and verifies the repair results.

[0058] In some embodiments, the method for setting network access permissions for an in-vehicle ECU further includes: After performing a soft recovery on the registered IMA, resend the metric challenge message to the registered IMA and retrieve the metric response message returned by the registered IMA. Based on the reacquired metric response message, the new integrity status of the registered IMA is determined, and after determining that the registered IMA meets the trust benchmark based on the new integrity status, the network access permissions of the ECU are restored.

[0059] Understandably, after the soft recovery is completed, TMC immediately triggers an integrity measurement operation to confirm whether the repair was successful. If the measurement result meets the trust benchmark, that is, the registered IMA meets the trust benchmark based on the new integrity status, then the normal network privileges of the IMA are restored.

[0060] In some embodiments, the method for setting network access permissions for an in-vehicle ECU further includes: After determining that the registered IMA meets the untrustworthy benchmark based on the new integrity status, the registered IMA is either hard-recovered or OTA-refreshed.

[0061] Understandably, when a soft recovery fails, TMC triggers a secure reboot (i.e., a hard recovery) or a software refresh process (OTA refresh) for the IDPS agent until the recovery is completed or the target ECU is determined to be unrecoverable.

[0062] In summary, the solution provided by this invention is a method for remote measurement and security recovery of the integrity of an in-vehicle IDPS agent based on a hardware root of trust. By constructing a closed-loop defense mechanism of "measurement-control-recovery", it achieves trusted management of the entire lifecycle of the distributed IDPS agent, solving the problems of IDPS agents being easily tampered with and difficult to detect and recover in a timely manner in the prior art.

[0063] The core idea of ​​this invention is to build a protection system that combines centralized measurement, dynamic management and control, and hierarchical recovery based on a hardware root of trust, specifically including: 1. Periodically perform remote measurements on the distributed IDPS agent through the central trusted node (TMC) to continuously verify its integrity; 2. Dynamically bind integrity measurement results to vehicle network access permissions to restrict the network behavior of abnormal nodes and prevent the spread of attacks; 3. For abnormal or compromised IDPS proxies, a tiered recovery mechanism is adopted to achieve rapid and secure functional recovery; 4. Secure the transmission of measurement and recovery commands through a secure communication channel.

[0064] The solution provided by this invention can be composed of four core components, which work together to realize the complete process of "measurement-control-recovery".

[0065] 1. Trusted Measurement Center (TMC): Located in the core node of the vehicle (such as T-Box, central gateway), it has a built-in HSM (Hardware Security Module) and is responsible for initiating measurement challenges, verifying response results, dynamically managing permissions, and scheduling recovery processes. 2. Integrity Measurement Agent (IMA): Deployed at each target ECU (Electronic Control Unit), responsible for receiving measurement challenges, calculating the integrity value of the current IDPS agent, and executing repair instructions; 3. Secure communication channel: Based on automotive-grade cryptographic algorithms, it realizes two-way authentication and encrypted communication between TMC and IMA to ensure data transmission security; 4. Tiered Response and Recovery Engine: Integrated into TMC, it performs permission adjustments and tiered repairs based on measurement results, achieving dynamic management of "normal operation if trusted, restricted permissions if suspicious, and isolation and repair if compromised".

[0066] This invention also provides a method for setting network access permissions for an in-vehicle ECU, the method being applied to the ECU's IMA, such as... Figure 2 As shown, the method includes: S201. Receive the list of IDPS agent resources to be measured sent by TMC; S202. Calculate the initial integrity calculation result based on the IDPS proxy resource list, and send the initial integrity calculation result to the TMC; S203. After the TMC compares the initial integrity calculation result with the preset trusted benchmark and registers the IMA in a trusted manner, it receives a measurement challenge message sent by the TMC; the measurement challenge message includes a random number, the range of IDPS proxy resources to be measured this time, and the response time limit; S204. Based on the metric challenge message, perform integrity calculation on the resource data corresponding to the current IDPS agent to obtain a real-time metric value, and then combine the real-time metric value with a random number to obtain a metric response message. S205. Send the measurement response message to the TMC, receive the permission instruction sent by the TMC, and adjust the network access permissions of the ECU based on the permission instruction; the permission instruction is an instruction sent by the TMC based on the integrity status of the registered IMA after determining the integrity status based on the measurement response message.

[0067] It is understandable that the method of IMA applied to ECU corresponds to the method applied to TMC and can be used as a reference for each other.

[0068] In some embodiments, such as Figure 3 As shown, the process of the method provided by the present invention includes: S1. System Initialization and Security Channel Establishment During the vehicle power-on or in-vehicle network initialization phase, a trusted communication and measurement infrastructure environment is first established, forming a system architecture such as... Figure 4 As shown, the specific steps include: 1. ECU Basic Trusted Startup Each target ECU executes its own secure boot process, performs integrity verification on the ECU main firmware, ensures that the operating system and basic operating environment have not been tampered with, and provides a trusted execution environment for subsequent measurements.

[0069] 2. Trusted Measurement Center (TMC) and Integrity Measurement Agent (IMA) Identity Authentication and Session Establishment The Trusted Measurement Center and the integrity measurement agents within each ECU perform two-way authentication based on pre-set keys or certificates, complete key negotiation, and establish an encrypted communication session for the secure transmission of subsequent measurement data and control commands.

[0070] Regarding the Integrity Measurement Agent: It should be noted that not all ECUs in the vehicle's electronic and electrical architecture are equipped with an IMA. IMA is only deployed on target ECUs with secure boot and a hardware root of trust, used to perform integrity measurements on critical resources carrying the IDPS agent. For ECUs that do not meet the deployment requirements, no IMA is configured, and their security status is managed or indirectly constrained by a centralized security management node.

[0071] The key negotiation typically employs an elliptic curve key negotiation mechanism based on asymmetric cryptography, with the negotiation process executed internally or by an auxiliary mechanism of the hardware root of trust.

[0072] 3. Registration of measurement objects and verification of benchmarks TMC sends a list of IDPS agent resources to be measured to IMA. The list of resources includes at least the storage address or identifier of the IDPS agent's code segment, configuration file, and policy library.

[0073] IMA performs an initial integrity calculation on the corresponding resources based on the resource list and reports the calculation result to TMC. TMC compares the result with the trusted benchmark stored in the hardware root of trust to complete the trusted registration of IMA.

[0074] S2, Periodic Remote Integrity Measurement During vehicle operation, TMC performs periodic or event-triggered remote integrity measurements on registered IMAs to detect whether the IDPS agent has been tampered with at runtime. The specific steps are as follows: 1. Measurement Challenge Generation and Distribution TMC generates a metric challenge message containing random numbers based on a preset strategy, specifying the scope of IDPS proxy resources to be metricd and the response time limit in the message. Proxy resources include code snippets, configuration files, policy libraries, etc.

[0075] The steps for generating a challenge message are as follows: ① Generate a random number (32 bytes or other preset length); ② Add the list of IDPS proxy resources to be measured to the message; ③ Specify the response timeout; ④ Encrypt the entire message using the session key and calculate the HMAC (Hash-based Message Authentication Code); ⑤ Send the message to the target IMA through a secure channel.

[0076] 2. Real-time integrity calculation After receiving the metric challenge, IMA reads the key resource data corresponding to the current IDPS agent within the specified time limit, performs integrity calculation on the resource, and generates a real-time metric value (using a HASH algorithm to calculate the resource digest).

[0077] 3. Measurement Response Generation and Feedback IMA combines real-time metrics with random challenge data, uses an established secure session for encryption and authentication, generates a metric response message, and sends it to TMC.

[0078] 4. Verification of measurement results and determination of status After receiving the measurement response, TMC verifies the integrity and origin of the response message, compares the real-time measurement value with the trusted benchmark stored in the hardware root of trust, and determines the integrity status of the IMA based on the comparison result.

[0079] The process for comparing the metrics is as follows: ① Use the session key to verify the message HMAC to confirm that the message has not been tampered with during transmission; ②Decrypt the message and extract real-time metrics and related information (random number, timestamp, IMA status); ③ Read the trusted baseline value (factory default or security update hash value) of the corresponding IDPS agent key resource from the hardware trust root. ④ Compare real-time measurements with reliable benchmark values: a) If the hash values ​​are completely identical, the IMA status is determined to be "trustworthy"; b) If the hash values ​​are inconsistent but the message is valid, it is considered "suspicious"; c) If the hash values ​​are inconsistent and message verification fails or times out, it is determined to be "trapped"; The determination result is recorded in the integrity status log and used for subsequent access control and recovery scheduling.

[0080] S3. Measurement-based dynamic network access control Once the TMC obtains the integrity status of the IMA, it dynamically adjusts the network access permissions of the target ECU according to the preset status-permission mapping rules. The specific process is as follows: 1. Integrity State Mapping Based on the measurement results, TMC identifies the IMA as trusted, anomalous, or compromised, and determines the corresponding network access permission level.

[0081] 2. Issuance of access control policies When the IMA state changes, the TMC issues corresponding access control commands to the vehicle network infrastructure to restrict or isolate the communication range, port, or protocol type of the target ECU.

[0082] 3. Permission execution and state maintenance The vehicle network infrastructure implements network access control according to the latest access control policies, and the TMC synchronously records status changes and access adjustment information for subsequent auditing and recovery judgment.

[0083] The timing diagrams for S2 and S3 can be referenced. Figure 5 As shown.

[0084] Example of permission mapping rules is shown in Table 1: Table 1: Permission Mapping Rules

[0085] S4, Security Recovery of Damaged IDPS Proxy The timing diagram for S4 can be referenced. Figure 6 As shown, when TMC determines that IMA is in an abnormal or compromised state, it initiates a tiered recovery process for the IDPS agent, which specifically includes: 1. Recovery Strategy Selection Based on the current status of the IMA, historical records, and ECU type, TMC determines the recovery level and prioritizes soft recovery methods that do not affect the main functions of the ECU.

[0086] 2. Soft recovery execution TMC sends a recovery command containing the repaired resources to IMA. IMA then performs overwrite repair on the tampered configuration files or policy libraries locally and verifies the repair results.

[0087] 3. Take another measurement after recovery After the soft recovery is completed, the TMC immediately triggers an integrity measurement (repeating the action in 3.2) to confirm whether the repair was successful; if the measurement result meets the trust benchmark, the normal network privileges of the ECU's IMA are restored.

[0088] 4. Upgrade and recovery process When a soft recovery fails, TMC triggers a secure reboot or software refresh process for the IDPS agent until the recovery is complete or the target ECU is determined to be unrecoverable.

[0089] Regarding the criteria for assessing the recovery level of IMA: Current integrity status: Trustworthy, Suspicious, Faulty.

[0090] Historical recovery record: Whether a soft recovery or hard recovery has been performed recently.

[0091] ECU type and function sensitivity: For critical ECUs such as those in the power domain and autonomous driving domain, priority should be given to recovery methods that do not interrupt the main functions.

[0092] Explanation of IMA recovery levels: Soft recovery: Suitable for abnormal conditions or file tampering, without affecting the main functions of the ECU; Hard recovery: Applicable when soft recovery fails, involving process restart or secure OTA; OTA refresh: Applicable when hard restore still fails, it distributes the complete IDPS proxy image through a secure channel.

[0093] Regarding the differences in soft recovery content: Soft recovery for suspicious states: primarily covers signed backups of critical configuration files or policy libraries; Soft recovery for compromised systems: This may simultaneously overwrite parts of the program or update minor version patches; The recovery process verifies the backup resource signature to ensure that the resources have not been tampered with, and completes the overwrite without interrupting the main functions of the ECU.

[0094] The present invention has the following beneficial effects: 1. Implement continuous integrity verification of the IDPS agent during operation to improve the real-time performance of vehicle security protection; 2. Dynamically bind security status to network permissions to effectively limit the spread of attacks in the vehicle network; 3. Through a tiered recovery mechanism, IDPS agent functionality is quickly restored while ensuring driving safety; 4. Build a centralized and collaborative protection system to enhance the security resilience of the vehicle network and seamlessly integrate with existing security mechanisms.

[0095] The core of this invention can be summarized as follows: 1. IDPS proxy remote measurement mechanism based on hardware root of trust: Using HSM as the root of trust, we perform specialized remote measurement on key resources of the IDPS agent to ensure that the measurement results are not forged.

[0096] 2. Dynamic binding mechanism between integrity status and network permissions: The system dynamically adjusts in-vehicle network access permissions based on measurement results to achieve trusted authorization, anomaly restriction, and vulnerability isolation.

[0097] 3. Hierarchical self-recovery mechanism: By combining soft recovery, hardware recovery, and OTA refresh, secure and rapid repair of the IDPS proxy can be achieved.

[0098] 4. Centralized global collaborative management and control architecture: TMC manages the distributed IMA in a unified manner, enabling cross-domain collaborative protection and centralized control.

[0099] The present invention also provides a TMC, including a memory and a processor, wherein, The memory is used to store programs; The processor, coupled to the memory, is used to execute the program stored in the memory to implement the steps of the network access permission setting method for the vehicle ECU as described in any of the preceding claims.

[0100] The present invention also provides an ECU, including a memory and a processor, wherein, The memory is used to store the IMA; The processor, coupled to the memory, is used to execute the IMA in the memory to implement the steps of the network access permission setting method for the vehicle ECU as described above.

[0101] like Figure 7 As shown, the present invention also provides an electronic device 700, which can be the aforementioned TMC or ECU, wherein the ECU stores an IMA architecture. The electronic device 700 includes a processor 701 and a memory 702. Figure 7 Only some components of the electronic device 700 are shown, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead.

[0102] In some embodiments, memory 702 may be an internal storage unit of electronic device 700, such as a hard disk or memory of electronic device 700. In other embodiments, memory 702 may also be an external storage device of electronic device 700, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. equipped on electronic device 700.

[0103] Furthermore, the memory 702 may include both internal storage units of the electronic device 700 and external storage devices. The memory 702 is used to store application software and various types of data installed on the electronic device 700.

[0104] In some embodiments, processor 701 may be a central processing unit (CPU), microprocessor, or other data processing chip, used to run program code stored in memory 702 or process data, such as the network access permission setting method for vehicle ECU in this invention.

[0105] In some embodiments of the present invention, when the processor 701 executes the network access permission setting program for the vehicle ECU in the memory 702, the following steps can be implemented: Send the list of IDPS agent resources to be measured to the ECU's IMA; Obtain the initial integrity calculation result uploaded by the IMA based on the IDPS proxy resource list; After the initial integrity calculation result is compared and approved with the preset trust benchmark, the IMA is registered in a trusted manner. Send a metric challenge message to the registered IMA and obtain a metric response message returned by the registered IMA; the metric response message is obtained by the registered IMA performing integrity calculations on the resource data corresponding to the current IDPS agent based on the metric challenge message to obtain a real-time metric value, and then combining the real-time metric value with a random number; the metric challenge message includes a random number, the range of IDPS agent resources to be measured, and a response time limit. The integrity status of the registered IMA is determined based on the metric response message, and the network access permissions of the ECU are adjusted based on the integrity status.

[0106] Alternatively, the following steps can be performed: Receive the list of IDPS agent resources to be measured sent by TMC; The initial integrity calculation result is calculated based on the IDPS proxy resource list, and the initial integrity calculation result is sent to the TMC; After the TMC compares the initial integrity calculation result with the preset trusted benchmark and registers the IMA in a trusted manner, it receives a measurement challenge message sent by the TMC; the measurement challenge message includes a random number, the range of IDPS proxy resources to be measured this time, and the response time limit; Based on the metric challenge message, an integrity calculation is performed on the resource data corresponding to the current IDPS agent to obtain a real-time metric value. Then, the real-time metric value is combined with a random number to obtain a metric response message. The measurement response message is sent to the TMC, and the permission instruction sent by the TMC is received. The network access permissions of the ECU are adjusted based on the permission instruction. The permission instruction is an instruction sent by the TMC based on the integrity status of the registered IMA after determining the integrity status based on the measurement response message.

[0107] It should be understood that when the processor 701 executes the network access permission setting program for the vehicle ECU in the memory 702, in addition to the functions mentioned above, it can also perform other functions, as detailed in the description of the corresponding method embodiments above.

[0108] Furthermore, the embodiments of the present invention do not specifically limit the type of electronic device 700 mentioned. Electronic device 700 can be a mobile phone, tablet computer, personal digital assistant (PDA), wearable device, laptop computer, or other portable electronic device. Exemplary embodiments of portable electronic devices include, but are not limited to, portable electronic devices running iOS, Android, Microsoft, or other operating systems. The aforementioned portable electronic device can also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, electronic device 700 may not be a portable electronic device, but rather a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0109] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network access permission setting method for an on-board ECU provided by the methods described above, the method comprising: Send the list of IDPS agent resources to be measured to the ECU's IMA; Obtain the initial integrity calculation result uploaded by the IMA based on the IDPS proxy resource list; After the initial integrity calculation result is compared and approved with the preset trust benchmark, the IMA is registered in a trusted manner. Send a metric challenge message to the registered IMA and obtain a metric response message returned by the registered IMA; the metric response message is obtained by the registered IMA performing integrity calculations on the resource data corresponding to the current IDPS agent based on the metric challenge message to obtain a real-time metric value, and then combining the real-time metric value with a random number; the metric challenge message includes a random number, the range of IDPS agent resources to be measured, and a response time limit. The integrity status of the registered IMA is determined based on the metric response message, and the network access permissions of the ECU are adjusted based on the integrity status.

[0110] Alternatively, the method includes: Receive the list of IDPS agent resources to be measured sent by TMC; The initial integrity calculation result is calculated based on the IDPS proxy resource list, and the initial integrity calculation result is sent to the TMC; After the TMC compares the initial integrity calculation result with the preset trusted benchmark and registers the IMA in a trusted manner, it receives a measurement challenge message sent by the TMC; the measurement challenge message includes a random number, the range of IDPS proxy resources to be measured this time, and the response time limit; Based on the metric challenge message, an integrity calculation is performed on the resource data corresponding to the current IDPS agent to obtain a real-time metric value. Then, the real-time metric value is combined with a random number to obtain a metric response message. The measurement response message is sent to the TMC, and the permission instruction sent by the TMC is received. The network access permissions of the ECU are adjusted based on the permission instruction. The permission instruction is an instruction sent by the TMC based on the integrity status of the registered IMA after determining the integrity status based on the measurement response message.

[0111] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0112] The above provides a detailed description of the network access permission setting method for vehicle ECU, TMC, and ECU provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for setting network access permissions for an in-vehicle ECU, characterized in that, The method is applied to TMC, and the method includes: Send the list of IDPS agent resources to be measured to the ECU's IMA; Obtain the initial integrity calculation result uploaded by the IMA based on the IDPS proxy resource list; After the initial integrity calculation result is compared and approved with the preset trust benchmark, the IMA is registered in a trusted manner. Send a metric challenge message to the registered IMA and obtain a metric response message returned by the registered IMA; the metric response message is obtained by the registered IMA performing integrity calculations on the resource data corresponding to the current IDPS agent based on the metric challenge message to obtain a real-time metric value, and then combining the real-time metric value with a random number; the metric challenge message includes a random number, the range of IDPS agent resources to be measured, and a response time limit. The integrity status of the registered IMA is determined based on the metric response message, and the network access permissions of the ECU are adjusted based on the integrity status.

2. The method for setting network access permissions for an in-vehicle ECU according to claim 1, characterized in that, Before sending the metric challenge message to the registered IMA, the following is also included: Obtain the list of IDPS proxy resources to be measured this time; Based on the list of IDPS proxy resources to be measured and the set response timeout, an initial measurement challenge message is generated; The initial metric challenge message is encrypted using a key generated from random numbers, and the corresponding HMAC value is calculated. Based on the initial metric challenge message and the HMAC value, the final metric challenge message is generated.

3. The method for setting network access permissions for an in-vehicle ECU according to claim 2, characterized in that, Based on the metric challenge message, integrity calculations are performed on the resource data corresponding to the current IDPS agent to obtain real-time metric values, including: Within the response timeout period corresponding to the measurement challenge message, read the resource data corresponding to the current IDPS proxy from the IDPS proxy resource list that needs to be measured this time corresponding to the measurement challenge message; The integrity of the resource data corresponding to the current IDPS agent is calculated based on the hash algorithm to obtain the real-time metric value.

4. The method for setting network access permissions for an in-vehicle ECU according to claim 1, characterized in that, Determining the integrity status of registered IMAs based on the metric response message includes: After verifying that the measurement response message has not been tampered with during transmission based on the session key between the TMC and the ECU, the measurement response message is decrypted to extract the real-time measurement value. The extracted real-time metrics are compared with the trusted baseline values ​​of IDPS proxy resources, and the integrity status of the registered IMA is determined based on the comparison results.

5. The method for setting network access permissions for an in-vehicle ECU according to any one of claims 1-4, characterized in that, Also includes: If the integrity status of a registered IMA is determined to be abnormal or compromised based on the measurement response message, the recovery level of the IDPS agent is determined based on the integrity status, historical records, and ECU type of the registered IMA. The recovery level includes one of the following: soft recovery that does not affect the main function of the ECU, hard recovery that requires restarting the ECU process or performing a secure OTA on the ECU, and OTA refresh of the complete IDPS agent image through a secure channel. Based on the recovery level, a recovery command containing repair resources is sent to the registered IMA to restore the registered IMA.

6. The method for setting network access permissions for an in-vehicle ECU according to claim 5, characterized in that, Also includes: After performing a soft recovery on the registered IMA, resend the metric challenge message to the registered IMA and retrieve the metric response message returned by the registered IMA. Based on the reacquired metric response message, the new integrity status of the registered IMA is determined, and after determining that the registered IMA meets the trust benchmark based on the new integrity status, the network access permissions of the ECU are restored.

7. The method for setting network access permissions for an in-vehicle ECU according to claim 6, characterized in that, Also includes: After determining that the registered IMA meets the untrustworthy benchmark based on the new integrity status, the registered IMA is either hard-recovered or OTA-refreshed.

8. A method for setting network access permissions for a vehicle ECU, characterized in that, The method is applied to the IMA of an ECU, and the method includes: Receive the list of IDPS agent resources to be measured sent by TMC; The initial integrity calculation result is calculated based on the IDPS proxy resource list, and the initial integrity calculation result is sent to the TMC; After the TMC compares the initial integrity calculation result with the preset trusted benchmark and registers the IMA in a trusted manner, it receives a measurement challenge message sent by the TMC; the measurement challenge message includes a random number, the range of IDPS proxy resources to be measured this time, and the response time limit; Based on the metric challenge message, an integrity calculation is performed on the resource data corresponding to the current IDPS agent to obtain a real-time metric value. Then, the real-time metric value is combined with a random number to obtain a metric response message. The measurement response message is sent to the TMC, and the permission instruction sent by the TMC is received. The network access permissions of the ECU are adjusted based on the permission instruction. The permission instruction is an instruction sent by the TMC based on the integrity status of the registered IMA after determining the integrity status based on the measurement response message.

9. A TMC, characterized in that, Including memory and processor, among which, The memory is used to store programs; The processor, coupled to the memory, is used to execute the program stored in the memory to implement the steps of the network access permission setting method for an in-vehicle ECU as described in any one of claims 1 to 7.

10. An ECU, characterized in that, Including memory and processor, among which, The memory is used to store the IMA; The processor, coupled to the memory, is used to execute the IMA in the memory to implement the steps of the network access permission setting method for the vehicle ECU as described in claim 8.

Images