Data transmission anomaly detection method and system, vehicle and readable storage medium

Abstract

The invention relates to the technical field of electronic upgrading, and discloses a data transmission anomaly detection method and system, a vehicle and a readable storage medium, a vehicle-mounted terminal sends an upgrading data packet to an electronic controller, the electronic controller responds to the upgrading data packet sent by the vehicle-mounted terminal and sends an encrypted information reply request to the vehicle-mounted terminal, and the electronic controller sends the encrypted information reply request to the vehicle-mounted terminal. The vehicle-mounted terminal receives the encrypted information reply request sent by the electronic controller, decrypts the encrypted information and then sends an information decryption response to the electronic controller, the electronic controller records a second moment when the information decryption response sent by the vehicle-mounted terminal is received, and the electronic controller sends the information decryption response to the vehicle-mounted terminal. And the time difference between the second moment and the first moment is calculated, and if the time difference is greater than the preset time difference threshold, it is determined that data transmission is abnormal, so that it can be ensured that the received data comes from a correct OTA initiator, and the safety of the electronic controller is ensured.

Description

A method, system, vehicle, and readable storage medium for detecting abnormal data transmission. Technical Field

[0001] This invention relates to the field of electronic upgrade technology, and specifically to a method, system, vehicle, and readable storage medium for detecting abnormal data transmission. Background Technology

[0002] In the automotive electronics industry, with the development of vehicle electrification and intelligence, the controllers in automotive electronics are gradually becoming more agile in development, with shorter development times. They often require program upgrades after product delivery, i.e., Over-the-Air (OTA) upgrades. At the same time, as the concept of software-defined vehicles gradually becomes more popular, some functions will be added and improved after product delivery, which also requires OTA.

[0003] During the upgrade process of the Microcontroller Unit (MCU) in the existing Electronic Control Unit (ECU), the intelligent vehicle terminal (Telematics Box, TBOX) downloads the upgrade data package of the ECU from a remote location. As the OTA initiator, it transmits the data package to the ECU for program update via the CAN (Controller Area Network) bus. However, because the data load of the CAN bus is relatively low, the data package is generally not encrypted. This allows malicious ECUs or tools to intercept the data package and send their malicious programs to the working ECU. The working ECU cannot identify the source of the program, which may lead to security risks after the update and affect the security of the vehicle system. Summary of the Invention

[0004] In view of this, the present invention provides a method, system, vehicle, and readable storage medium for detecting abnormal data transmission, in order to solve the problem that malicious ECUs or tools can intercept data packets and send their malicious programs to the working ECUs. The working ECUs cannot identify the source of the programs, and the updates may cause security risks, affecting the security of the vehicle system.

[0005] In a first aspect, the present invention provides a data transmission anomaly detection method applied to an electronic controller. The method includes: in response to receiving an upgrade data packet sent by an in-vehicle terminal, sending a data reception response and an encrypted information reply request to the in-vehicle terminal, and recording a first moment when the encrypted information reply request is sent; recording a second moment when the information decryption response sent by the in-vehicle terminal is received; calculating the time difference between the second moment and the first moment, and determining whether the time difference is greater than a preset time difference threshold. If the time difference is greater than the preset time difference threshold, then determining that the data transmission is abnormal.

[0006] The data transmission anomaly detection method provided by this invention involves an on-board terminal sending an upgrade data packet to an electronic controller. In response to the upgrade data packet, the electronic controller sends a data reception response and an encrypted information reply request to the on-board terminal, and records the first moment the encrypted information reply request is sent. The on-board terminal receives the data reception response and encrypted information reply request from the electronic controller, decrypts the encrypted information, and sends an information decryption response to the electronic controller. The electronic controller records the second moment of receiving the information decryption response from the on-board terminal, calculates the time difference between the second moment and the first moment, and determines whether the time difference is greater than a preset time difference threshold. If the time difference is greater than the preset time difference threshold, a data transmission anomaly is determined. This method ensures that the received data originates from the correct OTA initiator, guaranteeing the security of the electronic controller.

[0007] In one optional implementation, the encrypted information reply request is an encrypted time synchronization request, and the preset time difference threshold is obtained through the following steps: in response to receiving the encrypted time synchronization request sent by the vehicle terminal, the encrypted time synchronization request is decrypted to obtain the running time of the vehicle terminal, and the user's own running time is synchronized with the running time of the vehicle terminal; an information reply request is sent to the vehicle terminal, and the third moment of sending the information reply request is recorded; the fourth moment of receiving the corresponding information from the vehicle terminal is recorded, and the preset time difference threshold is determined based on the time difference between the fourth moment and the third moment.

[0008] The electronic controller of this invention sends an information reply request to the vehicle terminal, records the time of sending the information reply request and the time of receiving the information reply, and uses the transmission and reception time of CAN messages as a preset time difference threshold to obtain a more accurate preset time difference threshold, thereby determining whether malicious interception behavior has occurred.

[0009] In one optional implementation, before synchronizing its own running time with the vehicle terminal time, the method further includes: determining whether the decrypted time protocol format is consistent with the time protocol format recorded by itself; if the decrypted time protocol format is consistent with the time protocol format recorded by itself, then performing the step of synchronizing its own running time with the running time of the vehicle terminal; if the decrypted time protocol format is inconsistent with the time protocol format recorded by itself, then determining that the vehicle terminal identity verification has failed, and marking the vehicle terminal identity as abnormal.

[0010] After receiving and decrypting the encrypted time synchronization request sent by the vehicle terminal, the electronic controller of the present invention first determines whether the decrypted time protocol format is consistent with the time protocol format recorded by itself. If they are inconsistent, it terminates any subsequent detection operations, thereby saving data transmission and reception resources, improving efficiency, and ensuring the security of its own electronic controller.

[0011] In one alternative implementation, after determining that the data transmission is abnormal, the method further includes: stopping the reception of upgrade data packets sent by the vehicle terminal, or marking the received upgrade data packets sent by the vehicle terminal as abnormal.

[0012] Upon detecting a data transmission anomaly, this invention immediately stops receiving upgrade data packets or marks the upgrade data packets as abnormal to ensure the safety of the electronic controller.

[0013] In one optional implementation, after receiving the upgrade data packet sent by the vehicle terminal for the first time, it is randomly selected whether to send an encrypted information reply request; if it is determined to send an encrypted information reply request, the steps of sending a data reception response and an encrypted information reply request to the vehicle terminal are executed; if it is determined not to send an encrypted information reply request, a data reception response is sent to the vehicle terminal, and the steps of randomly selecting whether to send an encrypted information reply request are repeated after receiving the upgrade data packet sent by the vehicle terminal for the next time.

[0014] This invention does not limit the timing of when the electronic controller sends encrypted information to reply to the request, which can effectively prevent malicious tools from preparing in advance, increase the difficulty of malicious tools, and further improve the security of the electronic controller.

[0015] Secondly, the present invention provides a data transmission anomaly detection method applied to an in-vehicle terminal. The method includes: sending an upgrade data packet to an electronic controller; receiving a data reception response and an encrypted information reply request sent by the electronic controller; decrypting the encrypted information; and sending an information decryption response to the electronic controller, so that the electronic controller records the second moment of receiving the information decryption response sent by the in-vehicle terminal. Based on the comparison between the time difference between the first moment and the second moment of sending the encrypted information reply request to the in-vehicle terminal and a preset time difference threshold, the method determines whether the data transmission is abnormal.

[0016] In one optional implementation, the encrypted information reply request is an encrypted time synchronization request. Before sending the upgrade data packet to the electronic controller, the method further includes: sending an encrypted time synchronization request to the electronic controller; receiving an information reply request sent by the electronic controller; replying to the electronic controller with corresponding information, so that the electronic controller records the fourth moment of receiving the corresponding information replied by the vehicle terminal, and determines the preset time difference threshold based on the time difference between the fourth moment and the third moment of sending the information reply request.

[0017] Thirdly, the present invention provides a data transmission anomaly detection system, the system comprising an in-vehicle terminal and an electronic controller, wherein the in-vehicle terminal sends an upgrade data packet to the electronic controller; in response to receiving the upgrade data packet sent by the in-vehicle terminal, the electronic controller sends a data reception response and an encrypted information reply request to the in-vehicle terminal, and records the first moment of sending the encrypted information reply request; the in-vehicle terminal receives the data reception response and the encrypted information reply request sent by the electronic controller, decrypts the encrypted information, and sends an information decryption response to the electronic controller; the electronic controller records the second moment of receiving the information decryption response sent by the in-vehicle terminal, calculates the time difference between the second moment and the first moment, and determines whether the time difference is greater than a preset time difference threshold; if the time difference is greater than the preset time difference threshold, then a data transmission anomaly is determined.

[0018] The data transmission anomaly detection system provided by this invention involves an in-vehicle terminal sending an upgrade data packet to an electronic controller. In response, the electronic controller sends a data reception response and an encrypted information reply request to the in-vehicle terminal, and records the first moment the encrypted information reply request is sent. The in-vehicle terminal receives the data reception response and encrypted information reply request from the electronic controller, decrypts the encrypted information, and sends an information decryption response to the electronic controller. The electronic controller records the second moment of receiving the information decryption response from the in-vehicle terminal, calculates the time difference between the second moment and the first moment, and determines whether the time difference is greater than a preset time difference threshold. If the time difference is greater than the preset time difference threshold, a data transmission anomaly is determined, ensuring that the received data originates from the correct OTA initiator and guaranteeing the security of the electronic controller.

[0019] Fourthly, the present invention provides a vehicle, including: a data transmission anomaly detection system as described in the third aspect.

[0020] Fifthly, the present invention provides a computer-readable storage medium storing computer instructions, which are used to cause a computer to execute the data transmission anomaly detection method of the first aspect or any corresponding embodiment described above, or to execute the data transmission anomaly detection method of the second aspect or any corresponding embodiment described above. Attached Figure Description

[0021] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0022] Figure 1 is a schematic diagram of upgrading an existing controller;

[0023] Figure 2 is a structural example diagram of a data transmission anomaly detection system according to an embodiment of the present invention;

[0024] Figure 3 is a flowchart illustrating a data transmission anomaly detection system according to an embodiment of the present invention.

[0025] Figure 4 is an interactive schematic diagram of a data transmission anomaly detection system according to an embodiment of the present invention;

[0026] Figure 5 is a structural example diagram of a vehicle according to an embodiment of the present invention;

[0027] Figure 6 is a structural block diagram of a data transmission anomaly detection device according to an embodiment of the present invention;

[0028] Figure 7 is a structural block diagram of another data transmission anomaly detection device according to an embodiment of the present invention;

[0029] Figure 8 is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] As shown in Figure 1, in the existing solution, during the OTA process, the TBOX downloads the ECU's upgrade package from a remote location. As the OTA initiator, it transmits data packets to the ECU via the CAN bus to update the program. The ECU stores the data packets in the MCU's Flash memory and executes the new program after verification. The protocol used in the upgrade process is not limited to CAN or CANFD; any device that can accurately time and send the same data at any given moment with the same amount of time is acceptable. This invention uses the CAN bus as an example. However, because the data load of the CAN bus is relatively low and the MCU's computing power is weak, it generally only encrypts the handshake and authentication process, not the data itself. If a malicious ECU or other tool intercepts the bus data during the handshake and authentication process between the TBOX and the ECU and sends its malicious program to the working ECU, the working ECU cannot identify the source of the program, which may lead to security risks after the update.

[0032] This invention provides a data transmission anomaly detection system, as shown in Figure 2. The system includes an electronic controller 1 and an in-vehicle terminal 2. The in-vehicle terminal 2 sends an upgrade data packet to the electronic controller 1. In response to receiving the upgrade data packet from the in-vehicle terminal 2, the electronic controller 1 sends a data reception response and an encrypted information reply request to the in-vehicle terminal 2, and records the first moment when the encrypted information reply request is sent. The in-vehicle terminal 2 receives the data reception response and the encrypted information reply request from the electronic controller 1, decrypts the encrypted information, and sends an information decryption response to the electronic controller 1. The electronic controller 1 records the second moment when it receives the information decryption response from the in-vehicle terminal 2, calculates the time difference between the second moment and the first moment, and determines whether the time difference is greater than a preset time difference threshold. If the time difference is greater than the preset time difference threshold, a data transmission anomaly is determined.

[0033] As shown in Figure 3, this embodiment of the invention takes into account that a malicious ECU or other tool can intercept the data sent by the vehicle terminal 2 to the electronic controller 1 via the CAN bus, regardless of the data being sent. The malicious data is then sent to the electronic controller 1. The time required to complete the interception and retransmission is longer than the time required for normal data transmission and reception. The type of electronic controller 1 is not limited and can be set according to the actual application scenario. For example, an engine controller can be used.

[0034] After the vehicle terminal 2 downloads the upgrade data packet (OTA data) from the electronic controller 1 remotely, it can send the upgrade data to the electronic controller 1 via the CAN bus. Because the data load of the CAN bus is limited, the upgrade data packet can be sent to the electronic controller 1 completely through multiple transmissions. The vehicle terminal 2 sends the OTA data to the electronic controller 1 via the CAN bus. After receiving the OTA data sent by the vehicle terminal 2, the electronic controller 1 can send an encrypted information reply request while sending a reception response to the vehicle terminal 2, and record the first moment t1 when the encrypted information reply request is sent. The encryption method of the encrypted information can only be decrypted by the correct vehicle terminal 2 and electronic controller 1. Therefore, it can be guaranteed that malicious tools cannot decrypt the encrypted information, nor can they make a correct reply and thus cannot make any changes. It can also verify that the received data was sent by the vehicle terminal 2. This is just an example.

[0035] After receiving the data reception response and encrypted information reply request sent by the electronic controller 1, the vehicle terminal 2 can decrypt the encrypted information using a key and reply. Simultaneously, it sends a second OTA data to the electronic controller 1. Upon receiving the reply and OTA data from the vehicle terminal 2, the electronic controller 1 records the second time t2, calculates the time difference T1 between the second and first times, and compares this time difference with a preset time difference threshold. This preset time difference threshold can be obtained from normal CAN communication tests, representing the normal data transmission and reception time. Since malicious tools intercept data and send their own malicious data to the electronic controller 1 takes longer, if the time difference exceeds the preset threshold, it indicates abnormal data transmission during the OTA process, suggesting a malicious controller or tool attack, and the OTA upgrade is stopped. If the time difference is not greater than the preset threshold, it indicates a normal transmission and reception process, and the OTA upgrade can continue normally. It can also determine if the reply format matches its recorded format for dual authentication. The timing of the electronic controller 1 sending the encrypted information reply request is not limited; it can be done during the OTA upgrade data packet transmission and reception process.

[0036] The data transmission anomaly detection system provided by this invention involves an in-vehicle terminal sending an upgrade data packet to an electronic controller. In response, the electronic controller sends a data reception response and an encrypted information reply request to the in-vehicle terminal, and records the first moment the encrypted information reply request is sent. The in-vehicle terminal receives the data reception response and encrypted information reply request from the electronic controller, decrypts the encrypted information, and sends an information decryption response to the electronic controller. The electronic controller records the second moment of receiving the information decryption response from the in-vehicle terminal, calculates the time difference between the second moment and the first moment, and determines whether the time difference is greater than a preset time difference threshold. If the time difference is greater than the preset time difference threshold, a data transmission anomaly is determined, ensuring that the received data originates from the correct OTA initiator and guaranteeing the security of the electronic controller.

[0037] Specifically, the encrypted information reply request is an encrypted time synchronization request. The vehicle terminal 2 sends an encrypted time synchronization request to the electronic controller 1. In response to receiving the encrypted time synchronization request sent by the vehicle terminal 2, the electronic controller 1 decrypts the encrypted time synchronization request to obtain the running time of the vehicle terminal 2, synchronizes its own running time with the running time of the vehicle terminal 2, and sends an information reply request to the vehicle terminal 2. The third moment of sending the information reply request is recorded. The vehicle terminal 2 receives the information reply request sent by the electronic controller 1 and replies with the corresponding information to the electronic controller 1. The electronic controller 1 records the fourth moment of receiving the corresponding information from the vehicle terminal 2 and determines a preset time difference threshold based on the time difference between the fourth moment and the third moment.

[0038] The embodiments of the present invention do not limit the encrypted information reply request. It can be based on the actual needs of OTA upgrade or application settings. Taking the encrypted time synchronization request as an example, the time synchronization of electronic controller 1 and vehicle terminal 2 can be realized, thereby improving the accuracy of the preset time difference threshold determination.

[0039] Before upgrading the electronic controller 1, the vehicle-mounted terminal 2 in this embodiment of the invention needs to use encryption to request and synchronize time. Specifically, it sends an encrypted time synchronization request to the electronic controller 1. Upon receiving the encrypted time synchronization request from the vehicle-mounted terminal 2, the electronic controller 1 can decrypt the request using a unified decryption key to obtain the running time of the vehicle-mounted terminal 2. It can then synchronize its own running time with the running time of the vehicle-mounted terminal 2. After synchronization, it can send a message reply request to the vehicle-mounted terminal 2 and record the third moment t3 at which the message reply request was sent. After receiving the message reply request, the vehicle-mounted terminal 2 replies and sends the reply information to the electronic controller 1. At this time, the electronic controller 1 records the received reply. The fourth time point t4 of the information can be determined based on the time difference T2 between the fourth time point and the third time point, as shown in Figure 3. The preset time difference threshold can be set to twice T2. If T1 is greater than twice T2, it indicates that a malicious tool has intercepted the information. T2 is usually less than the time of two CAN message frames, while the time of one CAN message frame is usually 0.2ms-0.28ms. For example, T2 is less than 0.4ms. Alternatively, the preset time difference threshold can be set based on the time of three CAN message frames. This can accommodate situations where information transmission and reception are slow due to network problems during CAN message transmission and reception. If T1 is greater than the time of three CAN message frames, it indicates that a malicious tool has intercepted the information and a man-in-the-middle attack has occurred. This is just an example.

[0040] The electronic controller of this invention sends an information reply request to the vehicle terminal, records the time of sending the information reply request and the time of receiving the information reply, and uses the transmission and reception time of CAN messages as a preset time difference threshold to obtain a more accurate preset time difference threshold, thereby determining whether malicious interception behavior has occurred.

[0041] In one optional implementation, before synchronizing its own running time with the time of the vehicle terminal 2, it is determined whether the decrypted time protocol format is consistent with the time protocol format recorded by itself; if the decrypted time protocol format is consistent with the time protocol format recorded by itself, the step of synchronizing its own running time with the running time of the vehicle terminal 2 is executed; if the decrypted time protocol format is inconsistent with the time protocol format recorded by itself, it is determined that the identity verification of the vehicle terminal 2 has failed, and the identity of the vehicle terminal 2 is marked as abnormal.

[0042] After receiving and decrypting an encrypted time synchronization request, the electronic controller 1 of this invention can determine whether the decrypted time protocol format is consistent with its own recorded time protocol format. If the decrypted time protocol format is consistent with its own recorded time protocol format, it means that the vehicle terminal 2 that sent the encrypted time synchronization request matches its own identity. Then, it can synchronize its own running time with the running time of the vehicle terminal 2 and send a message reply request to it. As an example only, if the decrypted time protocol format is inconsistent with its own recorded time protocol format, it can be considered that the vehicle terminal 2 does not match its own identity, that is, the identity verification of the vehicle terminal 2 fails. The identity of the vehicle terminal 2 can be marked as abnormal, and no data sent by the vehicle terminal 2 can be received. It can also terminate the execution of a series of data transmission abnormality detection operations for the vehicle terminal 2.

[0043] After receiving and decrypting the encrypted time synchronization request sent by the vehicle terminal, the electronic controller of the present invention first determines whether the decrypted time protocol format is consistent with the time protocol format recorded by itself. If they are inconsistent, it terminates any subsequent detection operations, thereby saving data transmission and reception resources, improving efficiency, and ensuring the security of its own electronic controller.

[0044] Specifically, after determining that the data transmission is abnormal, the electronic controller 1 stops receiving upgrade data packets sent by the vehicle terminal 2, or marks the received upgrade data packets sent by the vehicle terminal 2 as abnormal.

[0045] After determining that the data transmission is abnormal, the electronic controller 1 of this embodiment of the invention can immediately stop receiving the upgrade data packet sent by the vehicle terminal 2, or it can continue to receive the upgrade data packet to "deceive" malicious tools or other man-in-the-middle attacks. However, after the electronic controller 1 completes the reception of the upgrade data packet, it can mark the upgrade data packet as abnormal, that is, not process the received data and maintain the integrity of the original program.

[0046] Upon determining that a data transmission anomaly has occurred, the present invention immediately stops receiving upgrade data packets or marks the upgrade data packets as abnormal to ensure the safety of the electronic controller 1.

[0047] In one optional implementation, after receiving an upgrade data packet from the vehicle terminal 2, the electronic controller 1 randomly selects whether to send an encrypted information reply request; if it determines to send an encrypted information reply request, it executes the steps of sending a data reception response and an encrypted information reply request to the vehicle terminal 2; if it determines not to send an encrypted information reply request, it sends a data reception response to the vehicle terminal 2, and repeats the steps of randomly selecting whether to send an encrypted information reply request after receiving an upgrade data packet from the vehicle terminal 2 for the next time.

[0048] Because the CAN bus data load is limited in this embodiment of the invention, the vehicle terminal 2 typically sends upgrade data packets to the electronic controller 1 several times to ensure complete transmission of the upgrade data packet. After receiving the upgrade data packet from the vehicle terminal 2, the electronic controller 1 can randomly choose whether to send an encrypted information reply request. If it decides to send an encrypted information reply request, it sends a data reception response and an encrypted information reply request to the vehicle terminal 2. If it decides not to send an encrypted information reply request, it can send only a data reception response to the vehicle terminal 2. This is just an example. The vehicle terminal 2 can also perform the operations performed by the electronic controller 1, including determining whether the identity of the electronic controller 1 matches its own and whether there is any malicious attack. When the vehicle terminal 2 detects a malicious attack, it can encrypt and notify the electronic controller 1 to stop receiving. This is just an example.

[0049] This invention does not limit the timing of when the electronic controller sends encrypted information to reply to the request, which can effectively prevent malicious tools from preparing in advance, increase the difficulty of malicious tools, and further improve the security of the electronic controller.

[0050] This invention also provides a data transmission anomaly detection method, which is applied to the electronic controller 1 and the vehicle terminal 2 shown in FIG2. As shown in FIG4, the electronic controller 1 is used to execute steps S101 to S102, and the vehicle terminal 2 is used to execute steps S201 to S202.

[0051] Step S201: The vehicle terminal sends an upgrade data packet to the electronic controller.

[0052] In step S101, the electronic controller responds to receiving the upgrade data packet sent by the vehicle terminal by sending a data reception response and an encrypted information reply request to the vehicle terminal, and records the first moment when the encrypted information reply request is sent.

[0053] In step S202, the vehicle terminal receives the data reception response and encrypted information reply request sent by the electronic controller, decrypts the encrypted information, and then sends an information decryption response to the electronic controller.

[0054] In step S102, the electronic controller records the second moment of receiving the information decryption response sent by the vehicle terminal, calculates the time difference between the second moment and the first moment, and determines whether the time difference is greater than a preset time difference threshold. If the time difference is greater than the preset time difference threshold, it is determined that the data transmission is abnormal.

[0055] In this embodiment of the invention, the vehicle terminal sends OTA data to the electronic controller via the CAN bus. After receiving the OTA data sent by the vehicle terminal, the electronic controller can send an encrypted information reply request at the same time as sending a receive response to the vehicle terminal, and record the first moment when the encrypted information reply request is sent. The encryption method of the encrypted information can only be decrypted by the correct vehicle terminal and the electronic controller. Therefore, it can be guaranteed that malicious tools cannot decrypt the encrypted information, nor can they make a correct reply and thus cannot make any changes. It can also verify that the received data was sent by the vehicle terminal. This is just an example.

[0056] After receiving the data reception response and encrypted information reply request from the electronic controller, the vehicle terminal can decrypt the encrypted information using a key and reply. Simultaneously, it sends a second OTA data update to the electronic controller. Upon receiving the reply and OTA data from the vehicle terminal, the electronic controller records the second moment, calculates the time difference between the second and first moments, and compares this time difference with a preset time difference threshold. This preset time difference threshold can be obtained from normal CAN communication tests, representing the normal data transmission and reception time. Since malicious tools intercept data and send their own malicious data to the electronic controller takes longer, if the time difference exceeds the preset threshold, it indicates abnormal data transmission during the OTA process, suggesting a malicious controller or tool attack, and the OTA upgrade is stopped. If the time difference is less than the preset threshold, it indicates a normal transmission and reception process, and the OTA upgrade can continue normally. This is just an example.

[0057] The data transmission anomaly detection method provided by this invention involves an on-board terminal sending an upgrade data packet to an electronic controller. In response to the upgrade data packet, the electronic controller sends a data reception response and an encrypted information reply request to the on-board terminal, and records the first moment the encrypted information reply request is sent. The on-board terminal receives the data reception response and encrypted information reply request from the electronic controller, decrypts the encrypted information, and sends an information decryption response to the electronic controller. The electronic controller records the second moment of receiving the information decryption response from the on-board terminal, calculates the time difference between the second moment and the first moment, and determines whether the time difference is greater than a preset time difference threshold. If the time difference is greater than the preset time difference threshold, a data transmission anomaly is determined. This method ensures that the received data originates from the correct OTA initiator, guaranteeing the security of the electronic controller.

[0058] This embodiment also provides a vehicle, as shown in FIG5, which includes a data transmission anomaly detection system.

[0059] This embodiment also provides a data transmission anomaly detection device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0060] This embodiment provides a data transmission anomaly detection device applied to an electronic controller, as shown in Figure 6. It includes: a first moment recording module 601, used to respond to receiving an upgrade data packet sent by an in-vehicle terminal, send a data reception response and an encrypted information reply request to the in-vehicle terminal, and record the first moment of sending the encrypted information reply request; a second moment recording module 602, used to record the second moment of receiving an information decryption response sent by the in-vehicle terminal; and a data transmission detection module 603, used to calculate the time difference between the second moment and the first moment, and determine whether the time difference is greater than a preset time difference threshold. If the time difference is greater than the preset time difference threshold, then a data transmission anomaly is determined.

[0061] In some optional implementations, the encrypted information reply request is an encrypted time synchronization request. The data transmission detection module 603 includes: a time synchronization unit, used to decrypt the encrypted time synchronization request in response to receiving the encrypted time synchronization request sent by the vehicle terminal, obtain the running time of the vehicle terminal, and synchronize its own running time with the running time of the vehicle terminal; a third time recording unit, used to send the information reply request to the vehicle terminal and record the third time of sending the information reply request; and a fourth time recording unit, used to record the fourth time of receiving the corresponding information from the vehicle terminal, and determine a preset time difference threshold based on the time difference between the fourth time and the third time.

[0062] In some optional implementations, before synchronizing its own running time with the vehicle terminal time, the data transmission anomaly detection device further includes: a format consistency judgment module, used to determine whether the decrypted time protocol format is consistent with its own recorded time protocol format; a time synchronization module, used to perform the step of synchronizing its own running time with the vehicle terminal running time if the decrypted time protocol format is consistent with its own recorded time protocol format; and an anomaly marking module, used to determine that the vehicle terminal identity verification has failed and mark the vehicle terminal identity as an anomaly if the decrypted time protocol format is inconsistent with its own recorded time protocol format.

[0063] In some optional implementations, after determining that the data transmission is abnormal, the data transmission abnormality detection device further includes: a data abnormality processing module, used to stop receiving upgrade data packets sent by the vehicle terminal, or to mark the received upgrade data packets sent by the vehicle terminal as abnormal.

[0064] In some optional implementations, the first moment recording module 601 includes: a transmission selection unit, configured to randomly select whether to send an encrypted information reply request after receiving an upgrade data packet sent by the vehicle terminal for the current time; an information transmission unit, configured to execute the steps of sending a data reception response and an encrypted information reply request to the vehicle terminal if it is determined to send an encrypted information reply request; and an end operation unit, configured to send a data reception response to the vehicle terminal if it is determined not to send an encrypted information reply request, and to repeat the steps of randomly selecting whether to send an encrypted information reply request after receiving an upgrade data packet sent by the vehicle terminal for the next time.

[0065] This embodiment provides a data transmission anomaly detection device applied to an in-vehicle terminal, as shown in Figure 7. It includes: a data packet sending module 701, used to send an upgrade data packet to an electronic controller; and an information reply module 702, used to receive a data reception response and an encrypted information reply request sent by the electronic controller, decrypt the encrypted information, and then send an information decryption response to the electronic controller. This allows the electronic controller to record the second moment of receiving the information decryption response from the in-vehicle terminal, and to determine whether the data transmission is abnormal based on a comparison between the time difference between the first moment and the second moment of sending the encrypted information reply request to the in-vehicle terminal and a preset time difference threshold.

[0066] In some optional implementations, before sending the upgrade data packet to the electronic controller, the data transmission anomaly detection device further includes: a time synchronization request sending module, used to send an encrypted time synchronization request to the electronic controller; and an information reply module, used to receive the information reply request sent by the electronic controller, reply to the electronic controller with corresponding information, so that the electronic controller records the fourth moment of receiving the corresponding information replied by the vehicle terminal, and determines a preset time difference threshold based on the time difference between the fourth moment and the third moment of sending the information reply request.

[0067] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0068] In this embodiment, the data transmission anomaly detection device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0069] This invention also provides a computer device having the data transmission anomaly detection device shown in Figures 6 and 7 above.

[0070] Please refer to Figure 8, which is a schematic diagram of a computer device according to an optional embodiment of the present invention. As shown in Figure 8, the computer device includes one or more processors 10, a memory 20, and interfaces for connecting the various components, including high-speed interfaces and low-speed interfaces. The various components communicate with each other using different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 8 uses one processor 10 as an example.

[0071] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0072] The memory 20 stores instructions executable by at least one processor 10 to cause at least one processor 10 to perform the method shown in the above embodiments.

[0073] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0074] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0075] The computer device also includes an input device 30 and an output device 40. The processor 10, memory 20, input device 30, and output device 40 can be connected via a CAN bus or other means; Figure 8 shows an example of connection via a CAN bus.

[0076] Input device 30 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the computer device, such as a touchscreen, keypad, mouse, trackpad, touchpad, joystick, one or more mouse buttons, trackball, joystick, etc. Output device 40 may include display devices, auxiliary lighting devices (e.g., LEDs), and haptic feedback devices (e.g., vibration motors). The aforementioned display devices include, but are not limited to, liquid crystal displays, light-emitting diodes, displays, and plasma displays. In some alternative embodiments, the display device may be a touchscreen.

[0077] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0078] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for detecting abnormal data transmission, characterized in that, The method, applied to an electronic controller, includes: in response to receiving an upgrade data packet sent by an in-vehicle terminal, sending a data reception response and an encrypted information reply request to the in-vehicle terminal, and recording the first moment when the encrypted information reply request is sent; recording the second moment when the information decryption response sent by the in-vehicle terminal is received; calculating the time difference between the second moment and the first moment, and determining whether the time difference is greater than a preset time difference threshold; if the time difference is greater than the preset time difference threshold, determining that the data transmission is abnormal.

2. The method according to claim 1, characterized in that, The encrypted information reply request is an encrypted time synchronization request. The preset time difference threshold is obtained through the following steps: in response to receiving the encrypted time synchronization request sent by the vehicle terminal, the encrypted time synchronization request is decrypted to obtain the running time of the vehicle terminal, and the running time of the user is synchronized with the running time of the vehicle terminal. Send a message reply request to the vehicle terminal and record the third moment when the message reply request is sent; record the fourth moment when the corresponding message is received from the vehicle terminal, and determine the preset time difference threshold based on the time difference between the fourth moment and the third moment.

3. The method according to claim 2, characterized in that, Before synchronizing its own running time with the vehicle terminal time, the method further includes: determining whether the decrypted time protocol format is consistent with the time protocol format recorded by itself; if the decrypted time protocol format is consistent with the time protocol format recorded by itself, then performing the step of synchronizing its own running time with the running time of the vehicle terminal; if the decrypted time protocol format is inconsistent with the time protocol format recorded by itself, then determining that the vehicle terminal identity verification has failed, and marking the vehicle terminal identity as abnormal.

4. The method according to claim 1, characterized in that, After determining that the data transmission is abnormal, the method further includes: stopping the reception of upgrade data packets sent by the vehicle terminal, or marking the received upgrade data packets sent by the vehicle terminal as abnormal.

5. The method according to claim 1, characterized in that, After receiving the upgrade data packet sent by the vehicle terminal, randomly select whether to send an encrypted information reply request; if it is determined to send an encrypted information reply request, then execute the steps of sending a data reception response and an encrypted information reply request to the vehicle terminal; if it is determined not to send an encrypted information reply request, then send a data reception response to the vehicle terminal, and repeat the steps of randomly selecting whether to send an encrypted information reply request after receiving the upgrade data packet sent by the vehicle terminal for the next time.

6. A method for detecting abnormal data transmission, characterized in that, The method, applied to an in-vehicle terminal, includes: sending an upgrade data packet to an electronic controller; receiving a data reception response and an encrypted information reply request sent by the electronic controller; decrypting the encrypted information; and sending an information decryption response to the electronic controller, so that the electronic controller records the second moment of receiving the information decryption response sent by the in-vehicle terminal; and determining whether the data transmission is abnormal based on a comparison between the time difference between the first moment and the second moment of sending the encrypted information reply request to the in-vehicle terminal and a preset time difference threshold.

7. The method according to claim 6, characterized in that, The encrypted information reply request is an encrypted time synchronization request. Before sending the upgrade data packet to the electronic controller, the method further includes: sending an encrypted time synchronization request to the electronic controller; receiving the information reply request sent by the electronic controller; replying to the electronic controller with corresponding information, so that the electronic controller records the fourth moment when it receives the corresponding information replied by the vehicle terminal, and determines the preset time difference threshold based on the time difference between the fourth moment and the third moment when the information reply request was sent.

8. A data transmission anomaly detection system, characterized in that, The system includes an in-vehicle terminal and an electronic controller. The in-vehicle terminal sends an upgrade data packet to the electronic controller. In response to receiving the upgrade data packet from the in-vehicle terminal, the electronic controller sends a data reception response and an encrypted information reply request to the in-vehicle terminal, and records the first moment when the encrypted information reply request is sent. The in-vehicle terminal receives the data reception response and the encrypted information reply request from the electronic controller, decrypts the encrypted information, and sends an information decryption response to the electronic controller. The electronic controller records the second moment when it receives the information decryption response from the in-vehicle terminal, calculates the time difference between the second moment and the first moment, and determines whether the time difference is greater than a preset time difference threshold. If the time difference is greater than the preset time difference threshold, a data transmission anomaly is determined.

9. A vehicle, characterized in that, The vehicle includes the data transmission anomaly detection system as described in claim 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the data transmission anomaly detection method according to any one of claims 1 to 5, or the data transmission anomaly detection method according to any one of claims 6 to 7.

Images