Can bus data access method, device and computer equipment

Abstract

The application relates to a CAN bus data access method, device and computer equipment. The method comprises the following steps: sending an access request for target data to an authorized end; receiving authorization key information fed back by the authorized end based on the access request; the authorization key information comprises a homomorphic encryption protocol and a homomorphic decryption private key corresponding to the target data; obtaining a homomorphic encryption CAN message corresponding to the target data from a CAN bus, performing homomorphic calculation on the homomorphic encryption CAN message based on the homomorphic encryption protocol, and obtaining the target data in an encrypted state; and decrypting the target data in the encrypted state based on the homomorphic decryption private key, and obtaining the target data in plaintext. The method can effectively prevent the CAN communication protocol from being reversely analyzed, and can meet the fine authority management of different access requirements under the premise of guaranteeing data security.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a CAN bus data access method, a CAN bus data access device, and a computer device. Background Technology

[0002] Controller Area Network (CAN) bus, as a highly reliable serial communication protocol, is widely used in engineering machinery, automobiles, industrial control, and other fields. Initially designed for closed, trusted internal network environments, CAN bus typically broadcasts communication messages in plaintext on the bus. However, with the rise of the internet, remote maintenance, and third-party data services, CAN bus is increasingly facing security threats from both internal and external sources. To ensure CAN communication security, encryption schemes for the CAN message data field have emerged. However, most existing encryption schemes have the following drawbacks: they only encrypt the communication content; the plaintext CAN message obtained after decryption at the receiving end has a direct correspondence with the original physical quantity. Attackers can reverse-engineer the CAN communication protocol by monitoring message changes and device operating status. Furthermore, once the decryption key is granted, the receiver can decrypt all CAN messages sent by the corresponding node, making fine-grained access control of specific data items impossible.

[0003] Therefore, how to achieve encrypted data parsing while ensuring the confidentiality of the CAN communication protocol, and how to provide accurate and controllable data access authorization for different access needs, is an urgent problem to be solved in this field. Summary of the Invention

[0004] Therefore, it is necessary to provide a CAN bus data access method, a CAN bus data access device, and a computer device to address the aforementioned technical problems.

[0005] This application provides a CAN bus data access method, applied at an access end, the method comprising: Send an access request for the target data to the authorizing end; The system receives authorization key information fed back by the authorization terminal based on the access request; the authorization key information includes the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data; Obtain the homomorphically encrypted CAN message corresponding to the target data from the CAN bus, perform homomorphic calculation on the homomorphically encrypted CAN message based on the homomorphic encryption protocol, and obtain the target data in the encrypted state. The target data in the encrypted state is decrypted using the homomorphic decryption private key to obtain the plaintext target data.

[0006] In one embodiment, the homomorphic encryption protocol includes a homomorphic encryption offset and a homomorphic encryption resolution; the step of performing homomorphic computation on the homomorphically encrypted CAN message based on the homomorphic encryption protocol to obtain target data of the encrypted state includes: performing homomorphic multiplication on the homomorphically encrypted CAN message based on the homomorphic encryption resolution to obtain intermediate encrypted data; and performing homomorphic addition on the intermediate encrypted data based on the homomorphic encryption offset to obtain target data of the encrypted state.

[0007] In one embodiment, the homomorphically encrypted CAN message is generated by the data end through homomorphic encryption of the original CAN message of the target data.

[0008] In one embodiment, both the homomorphic encryption protocol and the homomorphic encrypted CAN message are encrypted based on a homomorphic encryption algorithm; the homomorphic encryption algorithm is any one of the Paillier homomorphic encryption algorithm, BGV homomorphic encryption algorithm, BFV homomorphic encryption algorithm, or CKKS homomorphic encryption algorithm.

[0009] In one embodiment, a CAN bus data access method is also provided, applied to an authorizing end. The method includes: in response to an access request for target data sent by an accessing end, obtaining a homomorphic encryption protocol and a homomorphic decryption private key corresponding to the target data; sending authorization key information to the accessing end; the authorization key information includes the homomorphic encryption protocol and the homomorphic decryption private key, so that the accessing end can perform homomorphic calculation and decryption on the homomorphically encrypted CAN message corresponding to the target data obtained from the CAN bus based on the authorization key information, so as to obtain the plaintext target data.

[0010] In one embodiment, before responding to the access request, the method further includes: generating a homomorphic encryption key pair; the homomorphic encryption key pair includes a homomorphic encryption public key and a homomorphic encryption private key; performing homomorphic encryption on a plaintext complete parsing protocol based on the homomorphic encryption public key to obtain a homomorphic encryption complete protocol; the plaintext complete parsing protocol corresponds to all authorized data items of the authorizing end, and the homomorphic encryption protocol in the authorization key information is obtained based on the homomorphic encryption complete protocol; sending the homomorphic encryption public key to the data end, so that the data end performs homomorphic encryption on the original CAN message of each data item based on the homomorphic encryption public key to generate a corresponding homomorphic encrypted CAN message.

[0011] In one embodiment, when the target data is a portion of all authorized data items, obtaining the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data includes: extracting a homomorphic encryption sub-protocol corresponding to the target data from the complete homomorphic encryption protocol, as the homomorphic encryption protocol corresponding to the target data; the homomorphic encryption sub-protocol includes a homomorphic encryption offset and a homomorphic encryption resolution; generating a homomorphic decryption private key corresponding to the target data based on the homomorphic encryption private key; the homomorphic decryption private key can only decrypt encrypted data obtained after homomorphic calculation of the homomorphic encrypted CAN message based on the homomorphic encryption resolution and the homomorphic encryption offset.

[0012] In one embodiment, a CAN bus data access device is also provided, applied at an access end, comprising: a sending module for sending an access request for target data to an authorization end; a receiving module for receiving authorization key information fed back by the authorization end based on the access request; the authorization key information including a homomorphic encryption protocol and a homomorphic decryption private key corresponding to the target data; a parsing module for obtaining a homomorphically encrypted CAN message corresponding to the target data from the CAN bus, performing homomorphic calculation on the homomorphically encrypted CAN message based on the homomorphic encryption protocol to obtain the target data in an encrypted state; and a decryption module for decrypting the target data in the encrypted state based on the homomorphic decryption private key to obtain the target data in plaintext.

[0013] In one embodiment, a CAN bus data access device is also provided, applied to an authorization end, comprising: an acquisition module, configured to acquire a homomorphic encryption protocol and a homomorphic decryption private key corresponding to the target data in response to an access request for target data sent by an access end; and an authorization module, configured to send authorization key information to the access end; the authorization key information includes the homomorphic encryption protocol and the homomorphic decryption private key, so that the access end can perform homomorphic calculation and decryption on the homomorphically encrypted CAN message corresponding to the target data obtained from the CAN bus based on the authorization key information, so as to obtain the plaintext target data.

[0014] In one embodiment, a computer device is also provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of any of the methods described above.

[0015] One of the above technical solutions has the following advantages or beneficial effects: The above CAN bus data access method protects the CAN application layer parsing protocol with homomorphic encryption and completes data parsing in the ciphertext field, so that the plaintext protocol information is not exposed during the message transmission on the CAN bus and the parsing process at the receiving end, thus preventing the CAN communication protocol from being reverse-analyzed; at the same time, by distributing the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data to the access end, it achieves precise access authorization for specified data items, rather than complete authorization for all data items. Attached Figure Description

[0016] Figure 1 This is an application environment diagram of a CAN bus data access method in one embodiment; Figure 2 This is a flowchart illustrating a CAN bus data access method in one embodiment; Figure 3 This is a flowchart illustrating a CAN bus data access method in another embodiment; Figure 4 This is a flowchart illustrating the CAN bus data access method in yet another embodiment; Figure 5 This is a structural block diagram of a CAN bus data access device in one embodiment; Figure 6 This is a block diagram of a CAN bus data access device in another embodiment; Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0018] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0019] It should be noted that all information and data involved in this application (including but not limited to data used for analysis, stored data, and displayed data) are information and data authorized by the client or fully authorized by all parties, and the collection, use and processing of related data must comply with relevant laws, regulations and standards.

[0020] The CAN bus data access method provided in this application can be applied to, for example... Figure 1 In the application environment shown, the authorizing terminal 200 can be a central gateway, domain controller, or cloud platform responsible for key management and access control in engineering machinery, vehicles, or industrial control systems; the access terminal 100 can be a central control unit inside the equipment, or an external third-party data acquisition terminal, engineering machinery management equipment, or remote operation and maintenance platform; the data terminal 300 can be various electronic control units (ECUs), sensors, engines, or actuators connected to the CAN bus; the data terminal 300 and the access terminal 100 can each be connected to the CAN bus 400. The CAN bus 400 is a broadcast serial communication protocol, and its messages are visible to all access nodes. The authorizing terminal 200 and the access terminal 100 are connected via a network, which can be any of a local area network, the Internet, a mobile communication network, or a dedicated communication link, without specific limitations here. Specifically, the data terminal 300 can broadcast encrypted CAN messages through the CAN bus 400, the access terminal 100 can collect encrypted CAN messages from the CAN bus 400, and the authorizing terminal 200 communicates with the access terminal 100, receiving access requests and issuing authorization key information.

[0021] In one embodiment, such as Figure 2 As shown, taking the access end as an example, a CAN bus data access method is provided, including the following steps: S201, Send an access request for the target data to the authorized end.

[0022] The target data refers to specific physical quantity data that the accessing end wishes to obtain, such as engine coolant temperature, fuel consumption, and speed in the field of construction machinery, but it is not limited to this field. The access request can carry identification information of the target data so that the authorizing end can identify and locate the corresponding data item. The accessing end and the authorizing end can be different functional modules integrated within the same physical device (such as the central gateway of construction machinery), in which case the access request is sent through communication between internal modules; or they can be different physical devices (such as a third-party data terminal and a manufacturer's cloud platform), in which case the access request is sent through network communication.

[0023] S202, Receive authorization key information from the authorization end based on the access request; the authorization key information includes the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data.

[0024] The homomorphic encryption protocol refers to the CAN application layer parsing protocol after homomorphic encryption processing. This protocol specifies the calculation rules for converting the raw data carried in the CAN message into a real physical quantity. In CAN bus communication, the raw data collected by the sensor needs to undergo linear transformation to obtain the real physical quantity. The general calculation formula is: Physical quantity = Original value × Resolution + Offset. Resolution and offset are the core parameters of the CAN application layer parsing protocol. In this step, the homomorphic encryption protocol can be understood as a set including the homomorphic encryption resolution and homomorphic encryption offset corresponding to the target data. The homomorphic decryption private key is the decryption key that matches the above homomorphic encryption protocol and is used to decrypt the encrypted state data obtained after specific homomorphic calculation. The homomorphic decryption private key can be a restricted key derived by the authorized end based on the homomorphic encryption private key it holds, or it can be a conversion key generated through proxy re-encryption technology. This embodiment does not specifically limit this.

[0025] S203: Obtain the homomorphic encrypted CAN message corresponding to the target data from the CAN bus, perform homomorphic calculation on the homomorphic encrypted CAN message based on the homomorphic encryption protocol, and obtain the target data in the encrypted state.

[0026] Among them, the homomorphic encrypted CAN message is a ciphertext message generated by the data end after collecting the raw data and encapsulating it into a standard CAN message, and then using the homomorphic encryption public key to homomorphically encrypt the data field of the CAN message; the data end continuously broadcasts the homomorphic encrypted CAN message to the CAN bus, and any node connected to the bus can listen to the message, but only the access end with the correct homomorphic decryption private key can ultimately decipher its content.

[0027] Homomorphic computation refers to the process of performing mathematical operations on ciphertext data directly based on the homomorphic encryption resolution and offset in the homomorphic encryption protocol without decrypting the homomorphically encrypted CAN message. In a specific embodiment, the access end first performs a homomorphic multiplication operation on the homomorphically encrypted CAN message and the homomorphic encryption resolution to obtain intermediate encrypted data; then, it performs a homomorphic addition operation on the intermediate encrypted data and the homomorphic encryption offset to obtain the target data in the encrypted state. The entire calculation process is completed within the ciphertext domain, without exposing the original plaintext CAN message or the plaintext parsing protocol parameters, resulting in strong data security. Furthermore, homomorphic computation can be performed locally on the access end without interaction with the authorizing end, reducing network communication overhead and the computational load on the authorizing end.

[0028] S204, decrypt the target data in the encrypted state based on the homomorphic decryption private key to obtain the plaintext target data.

[0029] The access terminal uses the homomorphic decryption private key in the authorized key information to perform a decryption operation on the target data of the encrypted state obtained by the above homomorphic calculation, and finally obtains the plaintext target physical quantity data, such as the engine water temperature is 80℃. The access terminal cannot use the homomorphic decryption private key to decrypt the ciphertext of other unauthorized data, nor can it decrypt the ciphertext data generated without the correct homomorphic calculation path.

[0030] In the aforementioned CAN bus data access method, the accessing end sends an access request for the target data to the authorizing end. After receiving the authorization key information from the authorizing end, it obtains the homomorphically encrypted CAN message corresponding to the target data from the CAN bus. Based on the homomorphic encryption protocol, it performs homomorphic calculation on the homomorphically encrypted CAN message to obtain the encrypted target data, and then uses the homomorphic decryption private key to decrypt and obtain the plaintext target data. This method protects the CAN application layer parsing protocol with homomorphic encryption and completes data parsing within the ciphertext domain, ensuring that the plaintext protocol information is not exposed during the transmission of messages on the CAN bus and the parsing process at the receiving end, thus preventing the CAN communication protocol from being reverse-engineered. Simultaneously, by distributing the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data to the accessing end, it achieves precise access authorization for specified data items, rather than complete authorization for all data items.

[0031] In one embodiment, the homomorphic encryption protocol includes a homomorphic encryption offset and a homomorphic encryption resolution; the step in S203 of performing homomorphic calculations on the homomorphically encrypted CAN message based on the homomorphic encryption protocol to obtain the target data of the encrypted state specifically includes: performing homomorphic multiplication on the homomorphically encrypted CAN message based on the homomorphic encryption resolution to obtain intermediate encrypted data; and performing homomorphic addition on the intermediate encrypted data based on the homomorphic encryption offset to obtain the target data of the encrypted state.

[0032] Among them, the homomorphic encryption offset and homomorphic encryption resolution are the core parameters of the CAN application layer parsing protocol. By homomorphically encrypting them respectively and including them in the homomorphic encryption protocol, the access end can complete the data parsing without knowing the plaintext protocol, which effectively ensures the confidentiality of the protocol. The order of homomorphic multiplication and homomorphic addition operations corresponds completely to the plaintext parsing formula (physical quantity = original value × resolution + offset) to ensure the correctness of the ciphertext domain calculation result.

[0033] In one embodiment, the homomorphically encrypted CAN message is generated by the data end through homomorphic encryption of the original CAN message of the target data.

[0034] like Figure 4As shown in the diagram, this figure illustrates the basic connection relationship between the authorizing end 200, the access end 100, the data end 300, and the CAN bus 400. The data end 300, as the data generator, can encapsulate the raw data from sensors and other devices into raw CAN messages according to the CAN bus specification after collecting the raw data. It then uses the public key obtained in advance from the authorizing end 200 to perform homomorphic encryption on the raw CAN messages, generating homomorphically encrypted CAN messages and broadcasting them to the CAN bus. It should be understood that the data end does not need to know which access ends are collecting data, nor does it participate in the authorization process, thus effectively reducing the implementation complexity of the data end.

[0035] In one embodiment, both the homomorphic encryption protocol and the homomorphic encrypted CAN message are encrypted using a homomorphic encryption algorithm; the homomorphic encryption algorithm is any one of the Paillier homomorphic encryption algorithm, BGV homomorphic encryption algorithm, BFV homomorphic encryption algorithm, or CKKS homomorphic encryption algorithm.

[0036] Among them, the Paillier homomorphic encryption algorithm is a publicly available additive homomorphic encryption algorithm that supports both additive and scalar multiplication homomorphism, and can meet the calculation requirements of CAN physical quantity analytical formulas; the BGV and BFV homomorphic encryption algorithms support fully homomorphic operations on the integer field and are suitable for scenarios with high precision requirements; the CKKS homomorphic encryption algorithm supports floating-point approximation calculations and is suitable for scenarios with high computational efficiency requirements; the appropriate homomorphic encryption algorithm can be selected according to the application scenario's requirements for computational precision and speed.

[0037] In one embodiment, such as Figure 3 As shown, taking the authorized end as an example, a CAN bus data access method is also provided, including the following steps: S301, in response to the access request for target data sent by the accessing end, obtain the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data.

[0038] Before receiving the access request, the authorizing end has completed the generation of the homomorphic encryption key pair and the construction of the complete homomorphic encryption protocol. Based on the target data identifier carried in the access request, the authorizing end extracts or determines the homomorphic encryption protocol corresponding to the target data from the pre-stored complete homomorphic encryption protocol, and obtains or generates the corresponding homomorphic decryption private key.

[0039] S302, send authorization key information to the access terminal; the authorization key information includes homomorphic encryption protocol and homomorphic decryption private key, so that the access terminal can perform homomorphic calculation and decryption on the homomorphic encrypted CAN message corresponding to the target data obtained from the CAN bus based on the authorization key information, so as to obtain the plaintext target data.

[0040] The authorizing end packages the homomorphic encryption protocol and homomorphic decryption private key into authorization key information and sends it to the accessing end through a secure channel. The secure channel can be established through symmetric encryption, Secure Sockets Layer (SSL) protocol, etc., to protect the confidentiality and integrity of the authorization key information during transmission.

[0041] In the above embodiments, the authorizing end responds to the access request from the accessing end by obtaining the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data, and sends authorization key information to the accessing end. This enables the accessing end to perform homomorphic computation on the homomorphically encrypted CAN message obtained from the CAN bus based on the authorization key information and decrypt it to obtain the plaintext target data. This method separates the authorization management function from the data end, allowing the authorizing end to uniformly manage the distribution of keys and protocols, achieving centralized permission management, reducing the implementation complexity of the data end, and providing a technical foundation for fine-grained data access authorization.

[0042] In one embodiment, before responding to an access request, the method further includes an initialization phase: generating a homomorphic encryption key pair; the homomorphic encryption key pair includes a homomorphic encryption public key and a homomorphic encryption private key; homomorphically encrypting the plaintext complete parsing protocol based on the homomorphic encryption public key to obtain a homomorphic encryption complete protocol; the plaintext complete parsing protocol corresponds to all authorized data items of the authorizing end; and sending the homomorphic encryption public key to the data end so that the data end homomorphically encrypts the original CAN message of each data item based on the homomorphic encryption public key to generate the corresponding homomorphic encrypted CAN message.

[0043] The plaintext complete parsing protocol includes the plaintext offset and plaintext resolution for each data item provided by the authorizing end. During the initialization phase, the authorizing end uses a homomorphic encryption public key to homomorphically encrypt each item in the plaintext complete parsing protocol, generating a complete homomorphic encryption protocol and storing it securely. Simultaneously, the homomorphic encryption public key is distributed to each data end, which uses this public key to homomorphically encrypt its own generated raw CAN messages. The homomorphic encryption protocol in the authorization key information is obtained based on this complete homomorphic encryption protocol. By separating the initialization phase from the response request phase, the authorizing end does not need to encrypt the protocol in real time with each access request, improving response speed and ensuring the consistency of the homomorphic encryption public key throughout the system.

[0044] In one embodiment, when the target data is a portion of all authorized data items, obtaining the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data specifically includes: extracting a homomorphic encryption sub-protocol corresponding to the target data from the complete homomorphic encryption protocol, as the homomorphic encryption protocol corresponding to the target data; the homomorphic encryption sub-protocol includes a homomorphic encryption offset and a homomorphic encryption resolution; generating a homomorphic decryption private key corresponding to the target data based on the homomorphic encryption private key; the homomorphic decryption private key can only decrypt the encrypted data obtained after homomorphic calculation of the homomorphic encrypted CAN message based on the homomorphic encryption resolution and homomorphic encryption offset.

[0045] This embodiment corresponds to a fine-grained authorization application scenario, such as when the accessing end only requests access to fuel consumption data. In this case, the authorizing end extracts only the homomorphic encryption offset and resolution corresponding to the fuel consumption data from the complete homomorphic encryption protocol as a homomorphic encryption sub-protocol, and generates a restricted homomorphic decryption private key. This restricted key is bound to allowed computation paths during generation, and decryption can only succeed if the ciphertext is generated through homomorphic multiplication and homomorphic addition calculations based on the homomorphic encryption resolution and offset corresponding to fuel consumption. Although the accessing end can collect homomorphically encrypted CAN messages of other data from the CAN bus, it cannot correctly perform homomorphic computation because it does not obtain the corresponding homomorphic encryption sub-protocol; even if it does perform computation, the generated ciphertext cannot be decrypted by the restricted key. This embodiment ensures the confidentiality of the core protocol while enabling the accessing end to only decrypt the encrypted data corresponding to the target data, and not to decrypt other unauthorized data.

[0046] In one embodiment, the specific implementation of generating the homomorphic decryption private key corresponding to the target data based on the homomorphic encryption private key can employ a key derivation algorithm. Specifically, the authorizing end concatenates the homomorphic encryption private key with the identifier of the target data, performs a hash operation on the concatenated data, and generates a restricted homomorphic decryption private key based on the hash operation result. Alternatively, the authorizing end uses the homomorphic encryption private key as the root key and the identifier of the target data as the derivation factor, and uses a key derivation function to calculate the root key and the derivation factor to generate a derived key as the homomorphic decryption private key. In another embodiment, the homomorphic decryption private key can also be the decryption private key owned by the access end; in this case, the authorizing end generates a proxy re-encryption key based on the homomorphic encryption private key and the access end's own decryption public key, and includes the proxy re-encryption key in the authorization key information and sends it to the access end; the access end uses the proxy re-encryption key to re-encrypt the target data obtained from the homomorphic calculation, obtains the re-encrypted data, and then uses its own decryption private key to decrypt the re-encrypted data to obtain the plaintext target data. All of the above implementation methods can ensure that the accessing end can only decrypt the encrypted data corresponding to the target data, and cannot decrypt other unauthorized data.

[0047] In one embodiment, the CAN bus data access system can also employ a hybrid encryption mechanism. For high-frequency CAN data such as handle values ​​and angle sensor data that require low latency, symmetric encryption algorithms (such as AES) can be used for encrypted transmission to meet real-time requirements; symmetric encryption algorithms can also be used to protect the secure transmission of homomorphic encryption private keys issued by the authorizing end to the access end. For CAN application layer parsing protocols and CAN messages requiring fine-grained authorization access, homomorphic encryption algorithms are used for protection.

[0048] In addition, in some embodiments of the system, hash functions and message authentication codes can be introduced to verify the integrity of CAN messages, preventing data from being tampered with during transmission; and / or a heartbeat handshake mechanism can be used to detect the connection status of remote communication, triggering protection actions when the connection is abnormal; and / or a dual-queue structure can be used to distinguish between real-time control commands and cached monitoring data, combined with an exponential backoff retransmission mechanism to ensure the reliable delivery of critical commands. These auxiliary security measures can be used to ensure the confidentiality, integrity, and availability of data transmission.

[0049] Those skilled in the art should understand that the encryption algorithms, authentication mechanisms, and authorization architectures described in the above embodiments can be equivalently replaced according to actual computing power, real-time requirements, and security levels without departing from the scope of protection of this application. For example, symmetric encryption algorithms can be replaced with asymmetric encryption algorithms (such as RSA, ECC) or hybrid encryption architectures to sacrifice some computational overhead in exchange for improved key distribution convenience; in addition to Paillier, homomorphic encryption algorithms can also adopt BGV, BFV, or CKKS fully homomorphic / approximately homomorphic schemes, or be replaced with the Multi-Party Secure Computation (MPC) protocol to achieve cryptographic parsing under different trust models; the MAC message authentication mechanism can be replaced with a digital signature algorithm based on asymmetric cryptography (such as ECDSA, SM2), which is suitable for scenarios with higher requirements for non-repudiation; the data access authorization subsystem can interface with standard identity and access management frameworks, such as OAuth 2.0 and OpenID. The Connect or RBAC / ABAC policy engine can be used to replace the customized key distribution logic in this embodiment; the communication fault monitoring and retransmission mechanism can be further extended to a centralized network management platform based on the SNMP protocol, or combined with the persistent storage of edge gateway logs to realize historical fault tracing and predictive maintenance.

[0050] The deficiencies of the above solutions and the proposed solutions are the result of the inventor's practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed in this disclosure below should be considered as the inventor's contribution to this disclosure.

[0051] It should be understood that, for the foregoing method embodiments, although the steps in the flowcharts are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the method embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0052] Based on the same inventive concept, this application also provides a CAN bus data access device for implementing the CAN bus data access method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more CAN bus data access device embodiments provided below can be found in the limitations of the CAN bus data access method described above, and will not be repeated here.

[0053] In one embodiment, such as Figure 5 As shown, a CAN bus data access device is provided for use at the access end, including: a transmitting module 510, a receiving module 520, a parsing module 530, and a decryption module 540, wherein: Sending module 510 is used to send an access request for target data to the authorizing end; The receiving module 520 is used to receive the authorization key information fed back by the authorizing end based on the access request; the authorization key information includes the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data; The parsing module 530 is used to obtain the homomorphic encrypted CAN message corresponding to the target data from the CAN bus, and perform homomorphic calculation on the homomorphic encrypted CAN message based on the homomorphic encryption protocol to obtain the target data in the encrypted state. The decryption module 540 is used to decrypt the target data in the encrypted state based on the homomorphic decryption private key to obtain the target data in plaintext.

[0054] In some embodiments, the homomorphic encryption protocol includes a homomorphic encryption offset and a homomorphic encryption resolution; the parsing module 530 is specifically used to: perform homomorphic multiplication on the homomorphic encrypted CAN message based on the homomorphic encryption resolution to obtain intermediate encrypted data; and perform homomorphic addition on the intermediate encrypted data based on the homomorphic encryption offset to obtain the target data of the encrypted state.

[0055] In some embodiments, homomorphically encrypted CAN messages are generated by the data end through homomorphic encryption of the original CAN message of the target data.

[0056] In some embodiments, both the homomorphic encryption protocol and the homomorphic encrypted CAN message are encrypted based on a homomorphic encryption algorithm; the homomorphic encryption algorithm is any one of the Paillier homomorphic encryption algorithm, the BGV homomorphic encryption algorithm, the BFV homomorphic encryption algorithm, or the CKKS homomorphic encryption algorithm.

[0057] In some embodiments, the target data is a subset of all data items available from the authorized end; the homomorphic encryption protocol is a homomorphic encryption sub-protocol corresponding to the subset of data items, and the homomorphic encryption sub-protocol includes the homomorphic encryption offset and homomorphic encryption resolution corresponding to the subset of data items; the homomorphic decryption private key is a restricted homomorphic decryption private key, which can only decrypt the encrypted data obtained after homomorphic calculation of the homomorphic encrypted CAN message based on the homomorphic encryption resolution and homomorphic encryption offset.

[0058] In some embodiments, the sending module 510 is specifically configured to send an access request carrying an identifier of the target data to the authorizing end. The receiving module 520 is specifically configured to receive authorization key information through a secure channel, which is established by a symmetric encryption algorithm or a Secure Sockets Layer protocol.

[0059] In one embodiment, such as Figure 6 As shown, a CAN bus data access device is provided for use at an authorization end, including: an acquisition module 610 and an authorization module 620, wherein: The acquisition module 610 is used to respond to the access request for target data sent by the access terminal and acquire the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data; The authorization module 620 is used to send authorization key information to the access terminal. The authorization key information includes a homomorphic encryption protocol and a homomorphic decryption private key, so that the access terminal can perform homomorphic calculation and decryption on the homomorphically encrypted CAN message corresponding to the target data obtained from the CAN bus based on the authorization key information to obtain the plaintext target data.

[0060] In some embodiments, the apparatus further includes an initialization module 630, configured to: generate a homomorphic encryption key pair before responding to an access request; the homomorphic encryption key pair includes a homomorphic encryption public key and a homomorphic encryption private key; perform homomorphic encryption on the plaintext complete parsing protocol based on the homomorphic encryption public key to obtain a homomorphic encryption complete protocol; the plaintext complete parsing protocol corresponds to all authorized data items of the authorizing end, and the homomorphic encryption protocol in the authorization key information is obtained based on the homomorphic encryption complete protocol; and send the homomorphic encryption public key to the data end so that the data end performs homomorphic encryption on the original CAN message of each data item based on the homomorphic encryption public key to generate a corresponding homomorphic encrypted CAN message.

[0061] In some embodiments, the target data is a subset of all authorized data items; the acquisition module 610 is specifically used to: extract the homomorphic encryption sub-protocol corresponding to the target data from the complete homomorphic encryption protocol, and use it as the homomorphic encryption protocol corresponding to the target data; the homomorphic encryption sub-protocol includes a homomorphic encryption offset and a homomorphic encryption resolution; generate a homomorphic decryption private key corresponding to the target data based on the homomorphic encryption private key; the homomorphic decryption private key can only decrypt the encrypted data obtained after homomorphic calculation of the homomorphic encrypted CAN message based on the homomorphic encryption resolution and homomorphic encryption offset.

[0062] In some embodiments, the acquisition module 610 is specifically used to: concatenate the homomorphic encryption private key with the identifier of the target data, perform a hash operation on the concatenated data, and generate a homomorphic decryption private key based on the hash operation result.

[0063] In some embodiments, the homomorphic decryption private key is the decryption private key owned by the access terminal; the acquisition module 610 is further configured to generate a proxy re-encryption key based on the homomorphic encryption private key and the access terminal's own decryption public key; the authorization module 620 is further configured to include the proxy re-encryption key in the authorization key information and send it to the access terminal, so that the access terminal can use the proxy re-encryption key to re-encrypt the target data in the encrypted state, and then use its own decryption private key to decrypt and obtain the plaintext target data.

[0064] In some embodiments, the authorization key information is sent after symmetric encryption; and / or, CAN messages corresponding to high-frequency, low-latency CAN data are transmitted using symmetric encryption, while the rest are transmitted using the homomorphic encryption CAN messages described above.

[0065] Each module in the two CAN bus data access devices described above can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0066] Furthermore, in the above-described implementation of the CAN bus data access device, the logical division of each program module is merely illustrative. In practical applications, the above functions can be assigned to different program modules as needed, for example, for the sake of corresponding hardware configuration requirements or the convenience of software implementation. That is, the internal structure of the CAN bus data access device can be divided into different program modules to complete all or part of the functions described above.

[0067] In one embodiment, a computer device is provided, the internal structure of which can be as follows: Figure 7As shown, the computer device includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interface is used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a CAN bus data access method. The display unit is used to form a visually visible image and can be a display screen, projection device, or virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0068] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0069] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the CAN bus data access method applied to the access end described above.

[0070] In another embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the CAN bus data access method applied to the authorized end as described above.

[0071] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0072] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0073] The terms “comprising” and “having”, and any variations thereof, in the embodiments herein are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or (module) units is not limited to the steps or units listed, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0074] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method of CAN bus data access, characterized in that, Applied to the access end, the method includes: Send an access request for the target data to the authorizing end; The system receives authorization key information fed back by the authorization terminal based on the access request; the authorization key information includes the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data; Obtain the homomorphically encrypted CAN message corresponding to the target data from the CAN bus, perform homomorphic calculation on the homomorphically encrypted CAN message based on the homomorphic encryption protocol, and obtain the target data in the encrypted state. The target data in the encrypted state is decrypted using the homomorphic decryption private key to obtain the plaintext target data.

2. The method of claim 1, wherein, The homomorphic encryption protocol includes a homomorphic encryption offset and a homomorphic encryption resolution; The process of performing homomorphic computation on the homomorphically encrypted CAN message based on the homomorphic encryption protocol to obtain the target data of the encrypted state includes: Based on the homomorphic encryption resolution, homomorphic multiplication is performed on the homomorphic encrypted CAN message to obtain intermediate encrypted data; Based on the homomorphic encryption offset, homomorphic addition is performed on the intermediate encrypted data to obtain the target data in the encrypted state.

3. The method according to claim 1, characterized in that, The homomorphically encrypted CAN message is generated by the data terminal homomorphically encrypting the original CAN message of the target data.

4. The method according to any one of claims 1 to 3, characterized in that, Both the homomorphic encryption protocol and the homomorphic encrypted CAN message are encrypted using a homomorphic encryption algorithm. The homomorphic encryption algorithm is any one of the Paillier homomorphic encryption algorithm, BGV homomorphic encryption algorithm, BFV homomorphic encryption algorithm, or CKKS homomorphic encryption algorithm.

5. A method of CAN bus data access, characterized in that, Applied to the authorization end, the method includes: In response to an access request for target data sent by the accessing end, obtain the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data; The access terminal is sent authorization key information; the authorization key information includes the homomorphic encryption protocol and the homomorphic decryption private key, so that the access terminal can perform homomorphic calculation and decryption on the homomorphically encrypted CAN message corresponding to the target data obtained from the CAN bus based on the authorization key information, so as to obtain the plaintext target data.

6. The method of claim 5, wherein, Before responding to the access request, the method further includes: Generate a homomorphic encryption key pair; the homomorphic encryption key pair includes a homomorphic encryption public key and a homomorphic encryption private key; The plaintext complete parsing protocol is homomorphically encrypted using the homomorphic encryption public key to obtain the homomorphic encryption complete protocol; the plaintext complete parsing protocol corresponds to all authorized data items of the authorizing end, and the homomorphic encryption protocol in the authorization key information is obtained based on the homomorphic encryption complete protocol; The homomorphic encryption public key is sent to the data terminal so that the data terminal can perform homomorphic encryption on the original CAN message of each data item based on the homomorphic encryption public key to generate the corresponding homomorphic encrypted CAN message.

7. The method of claim 6, wherein, When the target data is a portion of all authorized data items, obtaining the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data includes: The homomorphic encryption sub-protocol corresponding to the target data is extracted from the complete homomorphic encryption protocol and used as the homomorphic encryption protocol corresponding to the target data; the homomorphic encryption sub-protocol includes a homomorphic encryption offset and a homomorphic encryption resolution; A homomorphic decryption private key is generated based on the homomorphic encryption private key to correspond to the target data; the homomorphic decryption private key can only decrypt encrypted data obtained by homomorphically calculating the homomorphic CAN message based on the homomorphic encryption resolution and the homomorphic encryption offset.

8. A CAN bus data access device, characterized by Applied to the access end, including: The sending module is used to send access requests for target data to the authorization end; The receiving module is configured to receive authorization key information fed back by the authorizing end based on the access request; the authorization key information includes the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data; The parsing module is used to obtain the homomorphic encrypted CAN message corresponding to the target data from the CAN bus, and perform homomorphic calculation on the homomorphic encrypted CAN message based on the homomorphic encryption protocol to obtain the target data in the encrypted state. The decryption module is used to decrypt the target data in the encrypted state based on the homomorphic decryption private key to obtain the plaintext target data.

9. A CAN bus data access device, characterized by Applied to the licensing end, including: The acquisition module is used to respond to an access request for target data sent by the access terminal and acquire the homomorphic encryption protocol and homomorphic decryption private key corresponding to the target data; An authorization module is used to send authorization key information to the access terminal; the authorization key information includes the homomorphic encryption protocol and the homomorphic decryption private key, so that the access terminal can perform homomorphic calculation and decryption on the homomorphically encrypted CAN message corresponding to the target data obtained from the CAN bus based on the authorization key information, so as to obtain the plaintext target data. 10.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-9. When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4 or claims 5 to 7.

Images