Clock fingerprint-based in-vehicle zero-trust security detection method and system

Abstract

The application relates to the technical field of intelligent networked automobile vehicle-mounted network security, and discloses a vehicle-mounted zero-trust security detection method and system based on a clock fingerprint. The application first extracts the inherent crystal oscillator clock offset of a vehicle-mounted ECU as an unforgeable hardware fingerprint through an RLS algorithm to construct a reference fingerprint library; secondly, the real-time trust value of a node is calculated based on an asymmetric trust updating mechanism, small-step recovery trust is performed when fingerprint matching, and large-step punishment is performed when continuous deviation; and finally, hierarchical response is triggered based on a blocking threshold. The application does not need to modify the existing CAN bus protocol and ECU hardware, the detection accuracy of perfect camouflage attack reaches 99.72%, the average response time is less than 30 ms, the false alarm rate is lower than 0.1%, and the application is suitable for the vehicle-mounted bus intrusion protection needs of various mass-produced vehicle models.

Description

Technical Field

[0001] This invention belongs to the field of intelligent connected vehicle network security technology, and particularly relates to a zero-trust security detection method and system for vehicles based on clock fingerprinting. Background Technology

[0002] As automotive electronic and electrical architectures rapidly evolve towards intelligence and connectivity, Controller Area Network (CAN) remains the primary communication carrier for core subsystems such as vehicle powertrain, chassis, and body control, thanks to its advantages of high real-time performance and low cost. However, the CAN protocol was designed for a closed and trusted environment and lacks built-in security mechanisms such as message source authentication and access control. Attackers can infiltrate the vehicle network through attack surfaces such as the in-vehicle infotainment system, remote communication units, and diagnostic interfaces to carry out attacks such as message injection, replay, and identity spoofing, directly threatening vehicle driving safety.

[0003] Existing in-vehicle network intrusion detection technologies are mainly divided into two categories: The first category consists of detection schemes based on content matching, statistical analysis, or deep learning. These schemes identify anomalies by extracting features such as packet ID, data payload, transmission frequency, and timing relationships, and have a certain degree of effectiveness in identifying common attacks such as DoS attacks and fuzzy attacks. However, these schemes all rely on anomalies in packet content or behavioral patterns as the basis for judgment. When an attacker launches an "identity spoofing attack," that is, first forcing the target legitimate ECU into a bus-off state through means such as bus error injection, and then taking over the ID transmission rights of that ECU, perfectly replicating its transmission cycle and data payload, the attack traffic appears completely legitimate at the logic layer, content layer, and statistical layer. Existing schemes cannot verify the physical hardware authenticity of the packets, resulting in extremely high false negative rates or even complete failure.

[0004] The second category is detection schemes based on ECU clock offset fingerprints. These schemes utilize the inherent, unforgeable clock offset characteristics of the ECU's hardware crystal oscillator. They use recursive least squares (RLS) to fit the offset slope of the message arrival time series as a hardware identifier, thus solving the physical identity tracing problem to some extent. However, existing schemes still have significant drawbacks: First, in setting security thresholds, they typically use statistical distribution methods such as maximum residual or 3σ, resulting in loose decision boundaries. When the attacker's crystal oscillator offset rate is extremely close to that of legitimate nodes, minute malicious offsets can be masked by normal noise tolerance, leading to detection lag or even missed detections. Second, the detection logic often uses a binary decision mechanism, where a single residual exceeding the boundary is considered abnormal. Without introducing a continuous trust assessment mechanism, it cannot distinguish between instantaneous network jitter and persistent attacks, resulting in a high false alarm rate. Third, they lack a response mechanism adapted to the high real-time requirements of automotive systems, making it difficult to balance detection sensitivity and system robustness, and unable to cope with highly realistic, intermittent spoofing attack scenarios. Summary of the Invention

[0005] To address the technical problems in the prior art, this invention uses the inherent, unforgeable clock offset of the ECU hardware as an identity benchmark and designs an asymmetric dynamic trust assessment mechanism with a penalty factor much larger than the recovery factor. Combined with a decision threshold and a hysteresis blocking strategy, it can accurately distinguish between instantaneous network jitter and persistent attacks, significantly improving the accuracy of spoofing attack detection while meeting the real-time requirements of in-vehicle systems.

[0006] To achieve the above technical objectives, this invention is implemented through the following technical solution: a zero-trust security detection method for vehicles based on clock fingerprinting, applied to the CAN bus communication scenario of intelligent connected vehicles, including the steps of collecting the timestamps of CAN messages sent by each ECU and fitting clock offset characteristics, and further including the following steps:

[0007] S1. Continuously collect the actual arrival timestamps of CAN messages sent by each ECU on the bus through the vehicle gateway or bus security monitoring device. Based on the nominal transmission period of the corresponding message ID of each ECU, extract the inherent and tamper-proof clock offset time sequence of the ECU hardware as the hardware identity fingerprint.

[0008] S2. Initialize the dynamic trust value for each ECU, and use the clock offset time series extracted in S1 as input to fit the real-time clock offset slope of the ECU.

[0009] S3. Generate a contraction-type tight envelope threshold range in advance based on baseline calibration data, compare the real-time clock offset slope with the tight envelope threshold range, and dynamically update the trust value of the corresponding ECU using an asymmetric rule where the penalty factor is at least one order of magnitude greater than the recovery factor.

[0010] S4. Pre-divide the security level range corresponding to the trust value, and execute the graded security response strategy according to the range to which the current trust value of the ECU belongs, so as to realize the intrusion detection and protection of the vehicle CAN bus.

[0011] Furthermore, the extraction and fitting process of the ECU hardware clock offset features in step S2 is specifically as follows:

[0012] S21. During the fingerprint registration phase, for each ECU's unique CANID, the median of the arrival time intervals of 1000 consecutively collected normal messages is used as the nominal transmission period T of the message corresponding to that CANID.

[0013] S22. For the first Read the received timestamp of the arriving target CANID message. Calculate the theoretical arrival time according to the formula. ,in This is the initial synchronization point during the fingerprint registration phase. The average transmission period of the message;

[0014] Calculate the first Cumulative clock offset of each message That is, the difference between the actual arrival time and the theoretical arrival time:

[0015] ;

[0016] Constructing a linear observation model ,in, This is the clock offset rate to be extracted. For the initial phase deviation, It is random delay noise;

[0017] S23. Parameter estimation is performed using the recursive least squares method, with the optimization objective being to minimize the sum of squared residuals at all observation points. Where, S is the value to be estimated. The parameter variable of clock skew rate, This represents the initial phase deviation;

[0018] Upon receiving a new target CANID message, the parameter estimate is recursively updated. The clock skew rate is obtained after the algorithm converges. This serves as the unique hardware clock fingerprint for the ECU corresponding to the CANID;

[0019] S24. The converged clock offset rate It is bound to the corresponding CANID and ECU number and stored in the encrypted security database of the vehicle gateway.

[0020] Furthermore, the process of constructing the compact envelope threshold interval and generating the legitimate node fingerprint database in step S3 specifically includes the following steps:

[0021] S31. During the baseline calibration training phase, based on the best-fit line corresponding to the ECU reference clock offset obtained by the RLS algorithm, calculate the fitting residual for each training frame:

[0022] The fitting residual This refers to random time errors caused by non-attack factors such as bus arbitration delay, gateway jitter, and operating system interrupt delay.

[0023] S32. Calculate the maximum value of all fitted residuals during the training phase, and introduce a threshold shrinkage coefficient. Set the tight safety threshold corresponding to this ECU. ,in, The value is 0.6;

[0024] S33. Generate a unique fingerprint entry for each CANID and store it in the local fingerprint database encrypted by the vehicle gateway.

[0025] Furthermore, the baseline calibration trigger condition in step S3 is as follows: the baseline calibration is automatically performed once every time the vehicle is powered on and started, and the calibration process continues until 1000 normal messages of the corresponding ECU are collected.

[0026] Furthermore, in step S33, each identity fingerprint entry includes a reference clock offset. Tight safety threshold Average message transmission cycle The quadruple corresponding to the ECU number: The fingerprint database serves as a trusted anchor for intrusion detection. When the cumulative clock offset of subsequent packets continues to exceed the corresponding tight security threshold range, it is determined to be identity fraud.

[0027] Furthermore, the trust value update formula for the asymmetric rule in step S3 is:

[0028] When the real-time clock skew slope is within the tight envelope safety threshold, the system determines that an identity deviation has occurred, and immediately initiates a rapid penalty mechanism, specifically:

[0029] ;

[0030] in, The clock offset slope, As a trust restoration factor, As a trust-punishing factor, For clock offset residuals, This is the safety threshold.

[0031] Furthermore, the trust penalty factor The value range is [0.2, 0.5], the trust recovery factor. The value range is [0.01, 0.05].

[0032] Furthermore, the hysteresis determination and graded response process based on dynamic trust values ​​in step S4 specifically includes the following steps:

[0033] S41. Divide the dynamic trust value with a range of [0,1] into two types of regions: trusted tolerance region and blocking attack region. The trusted tolerance region is further divided into a security sub-interval and an early warning sub-interval. The trusted tolerance region serves as a trust buffer to avoid false alarms caused by instantaneous physical noise or single calculation errors.

[0034] S42. Attack detection is performed using a hysteresis comparison mechanism: When the ECU trust value is within the trusted tolerance zone, if the trust value remains around 1.0, it is determined that the physical fingerprint is a complete match; if the trust value decreases but does not fall below a preset threshold, it is determined that the physical fingerprint is a complete match. This is considered a trust decay period, where local clock offset fluctuations do not reach statistical significance for an attack, and the overall output is labeled "normal" without triggering blocking; when the ECU trust value continues to decrease and falls below a preset threshold... When the cumulative fingerprint deviation exceeds the range of random noise, an identity hijacking attack is confirmed, an "attack" label is output, and a blocking signal is triggered.

[0035] S43. The decision output logic is implemented using the following mathematical rules: For the kth received message, the system decision output... for:

[0036] ;

[0037] in =0 indicates that the message is allowed to pass normally. =1 indicates message blocking. This represents the real-time trust value of the ECU corresponding to the k-th frame message. The preset blocking threshold;

[0038] S44. Based on the penalty factor of the asymmetric trust update rule, construct an integral-triggered response mode: after a spoofing attack occurs, the trust value declines at a fixed slope with the duration of the attack, from the start of the attack until the trust value falls below a preset blocking threshold. The time interval is the detection response time.

[0039] Furthermore, the hierarchical safety response strategy is as follows: messages sent by ECUs located in the safety sub-interval are allowed to pass normally;

[0040] The message sampling frequency of ECUs in the warning sub-zone is increased to three times the original frequency, and a security warning is reported to the vehicle domain controller at the same time; all messages sent by ECUs in the blocking zone are directly discarded, and an intrusion alarm is reported to the vehicle security platform at the same time.

[0041] This invention further discloses a clock fingerprint-based vehicle-mounted zero-trust security detection system, deployed on a vehicle gateway or intelligent driving domain controller hardware carrier, including a message acquisition unit for acquiring raw CAN bus messages and an encrypted storage unit for storing legitimate node identity information. The system's operating logic is based on a clock fingerprint-based vehicle-mounted zero-trust security detection method, and also includes:

[0042] The clock offset extraction unit is used to continuously collect the actual arrival timestamps of CAN messages sent by each ECU on the bus. Based on the nominal transmission period of the corresponding message ID of each ECU, it extracts the inherent and tamper-proof clock offset time sequence of the ECU hardware as a hardware identity fingerprint.

[0043] The clock fingerprint fitting unit is used to initialize a dynamic trust value for each ECU and fit the real-time clock offset slope of the ECU with the extracted clock offset time series as input.

[0044] The dynamic trust evaluation unit is used to pre-generate a contraction-type tight decision threshold range based on baseline calibration data, compare the real-time clock offset slope with the tight decision threshold range, and dynamically update the trust value of the corresponding ECU using an asymmetric rule where the penalty factor is at least one order of magnitude greater than the recovery factor.

[0045] The safety response execution unit is used to pre-divide the security level ranges corresponding to trust values, and execute graded safety response strategies according to the range to which the ECU's current trust value belongs, thereby realizing intrusion detection and protection of the vehicle's CAN bus.

[0046] The beneficial effects of this invention are as follows:

[0047] 1. This invention extracts the inherent, unalterable clock offset features of the ECU hardware as an identity fingerprint. It does not rely on the logical layer features of message content and sending behavior, and can accurately identify identity hijacking attacks that are perfectly disguised at the logical layer. This breaks through the detection blind spot of traditional detection methods in highly covert attack scenarios where the content is legal but the source is illegal.

[0048] 2. This invention employs a contraction-type tight envelope threshold combined with an asymmetric trust update rule where the penalty factor is much larger than the recovery factor. This not only improves the detection sensitivity to minute hardware fingerprint deviations by tightening the threshold, but also eliminates the interference of instantaneous physical noise and occasional jitter through the accumulation and smoothing mechanism of trust values, thus balancing detection accuracy and noise resistance.

[0049] 3. This invention uses a hysteresis comparison hierarchical response mechanism based on dynamic trust values ​​to set up a trust buffer to avoid false blocking caused by single deviations. At the same time, it executes differentiated security policies according to the trust value level, minimizing the impact of false alarms on the normal driving function of vehicles while ensuring timely attack response, thus adapting to the high reliability operation requirements of vehicular networks.

[0050] 4. This invention achieves online fitting of clock offset characteristics by using the recursive least squares method, which eliminates the need to store massive amounts of historical message data, has low computational complexity and low resource consumption, and can be deployed in real time on resource-constrained vehicle hardware such as vehicle gateways and domain controllers, meeting the real-time processing requirements of streaming data in vehicle networks. Attached Figure Description

[0051] Figure 1 This is a diagram of the in-vehicle zero-trust security architecture based on clock fingerprinting and dynamic trust assessment of the present invention.

[0052] Figure 2 This is a schematic diagram of the clock offset accumulation effect of the present invention;

[0053] Figure 3 This is a clock bias curve diagram of multiple ECU nodes in this invention;

[0054] Figure 4 This is a heatmap of the fingerprint discrimination matrix of the present invention;

[0055] Figure 5 This is a diagram illustrating the detection effect of spoofing attacks on a typical node of the present invention.

[0056] Figure 6 This is a dynamic evolution diagram of the trust value of a typical node in this invention. Detailed Implementation

[0057] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0058] Reference Figure 1 As can be seen, the present invention provides a zero-trust security detection method and system for in-vehicle systems based on clock fingerprinting, which is applied to the CAN bus communication scenario of intelligent connected vehicles. The method includes steps such as collecting the timestamps of CAN messages sent by each ECU and fitting clock offset characteristics, and also includes the following steps:

[0059] S1. Continuously collect the actual arrival timestamps of CAN messages sent by each ECU on the bus through the vehicle gateway or bus security monitoring device. Based on the nominal transmission period of the corresponding message ID of each ECU, extract the inherent and tamper-proof clock offset time sequence of the ECU hardware as the hardware identity fingerprint.

[0060] S2. Initialize the dynamic trust value for each ECU, and use the clock offset time series extracted in S1 as input to fit the real-time clock offset slope of the ECU.

[0061] S3. Generate a contraction-type tight envelope threshold range in advance based on baseline calibration data, compare the real-time clock offset slope with the tight envelope threshold range, and dynamically update the trust value of the corresponding ECU using an asymmetric rule where the penalty factor is at least one order of magnitude greater than the recovery factor.

[0062] S4. Pre-divide the security level range corresponding to the trust value, and execute the graded security response strategy according to the range to which the current trust value of the ECU belongs, so as to realize the intrusion detection and protection of the vehicle CAN bus.

[0063] Specifically:

[0064] In one embodiment, refer to Figure 1 As can be seen, this embodiment is applied to the CAN bus protection scenario of the power domain of intelligent connected vehicles. The deployment carrier is the vehicle gateway, which is used to detect advanced identity hijacking attacks in which attackers spoof the identity of a legitimate engine ECU through the compromised in-vehicle infotainment system (IVI). The specific implementation process is as follows:

[0065] Pre-configuration and baseline calibration phase: When the vehicle is powered on for the first time before leaving the factory, baseline calibration is performed on the engine ECU with ID 0x02 on the power domain bus. The gateway's data plane message acquisition unit continuously collects 1000 frames of normal messages with this ID. The physical fingerprint extractor of the control plane uses recursive least squares (RLS) fitting to obtain the reference clock offset rate of this ECU. The statistical fitting residuals are used to calculate the tight safety threshold, the baseline fingerprint entries are stored in the gateway's encrypted storage unit, and a dynamic trust value is initialized for the ECU. The preset blocking threshold is 1.0. It is 0.4;

[0066] During normal operation: When the vehicle is driving normally, the gateway in the data plane continuously collects all messages on the CAN bus, inputs the message ID and arrival timestamp into the physical fingerprint extractor in the control plane, and obtains the real-time clock offset rate corresponding to the current message ID in real time, which is then output to the dynamic trust evaluation engine. The dynamic trust evaluation engine compares the real-time clock offset rate with the pre-stored reference clock offset rate. The residuals are compared and calculated. If the residuals are within the tight safety threshold range, the real-time trust value of the ECU is updated through the trust recovery factor. When the trust value is maintained above 0.4, the "Adaptive Policy Execution Point (PEP)" is determined to be a legitimate message, and the Forward action is executed to forward the message to the target node normally.

[0067] Attack Occurrence and Detection Phase: After an attacker infiltrates the vehicle's IVI device, they first force the legitimate engine ECU into a bus-off silent state via the UDS protocol's communication control service. Then, the IVI is spoofed with ID 0x02, strictly adhering to the original 10ms nominal transmission cycle and load pattern to send messages, attempting to achieve perfect spoofing at the logical layer. At this point, the gateway collects the messages with this ID, and the physical fingerprint extractor fits the real-time clock offset rate to the reference clock offset rate. If the deviation exceeds the tight security threshold, the dynamic trust assessment engine updates the trust value with a penalty factor that is 20 times the recovery factor. The trust value decreases by the corresponding amount for each abnormal message received.

[0068] Tiered response phase: When the trust value is still higher than 0.4, the gateway increases the sampling frequency of the ID message and reports a security warning to the power domain controller; when 8 abnormal messages are received in a row, the trust value drops below the 0.4 threshold, the adaptive policy execution point determines it to be an identity hijacking attack, executes the Drop action, directly discards all messages of the ID, and reports an intrusion alarm to the vehicle security platform to block the attacker's disguised messages from entering the vehicle bus, thus completing the protection.

[0069] This embodiment does not require modification of the existing CAN bus protocol, nor does it require adding new hardware modules on the ECU side. Detection and protection can be achieved solely through software deployment on the gateway side, making it compatible with the in-vehicle network architecture of existing mass-produced vehicles.

[0070] In one embodiment, refer to Figure 2 As can be seen, this embodiment is an embodiment of ECU hardware clock fingerprint registration and extraction, applied to the fingerprint database initialization stage of the vehicle gateway. Corresponding to the RLS-based clock fingerprint extraction method, and referring to the cumulative clock offset trend shown in the attached figure, the specific implementation process is as follows:

[0071] Sample Acquisition Phase: Two engine ECUs from the same batch and with identical models, such as NodeA and NodeB, were selected. Both have a built-in crystal oscillator with a nominal frequency of 40MHz, and their corresponding CAN message IDs are set to 0x123 with a nominal transmission period of 10ms. During the baseline calibration phase upon the vehicle's first power-on, the vehicle gateway continuously acquired 1000 frames of normal messages sent by each of the two ECUs, recorded the reception timestamp of each frame, and calculated the median of the message arrival time intervals as the average transmission period. Record the initial synchronization time .

[0072] Cumulative offset calculation stage: For the message sequence of each ECU, the theoretical arrival time of each frame is calculated sequentially according to the message sequence number k. Then, the difference between the actual arrival time and the theoretical arrival time is calculated as the cumulative clock offset. ;

[0073] A trend line was plotted with the message sequence number as the horizontal axis and the cumulative clock offset as the vertical axis. The actual frequency of the crystal oscillator of Node A is higher than the nominal value, and the cumulative clock offset increases with the message sequence number. The actual frequency of the crystal oscillator of Node B is lower than the nominal value, and the cumulative clock offset decreases with a negative slope. The difference in slope between the two is an inherent hardware attribute of the ECU and is not affected by software configuration.

[0074] In the RLS fitting and fingerprint extraction stage: a recursive least squares method is used to linearly fit the cumulative clock offset sequence. The optimization objective is to minimize the sum of squared residuals at all observation points. The fitting process does not require storing all historical message data; the parameter estimates are recursively updated for each new message received. After the algorithm converges, the clock offset rate of Node A is obtained. NodeB clock skew Each of the two ECUs serves as a unique hardware identification fingerprint.

[0075] In the compact threshold and fingerprint database construction phase: based on the best straight line obtained from the fitting, the fitting residuals of all messages in the training phase are calculated, and the maximum value of the residuals is calculated. Introducing a threshold shrinkage coefficient The tight safety threshold of the corresponding ECU is obtained. , For each ECU, a four-tuple fingerprint entry containing CANID, reference clock offset, tight safety threshold, and average transmission cycle is constructed and stored in the encrypted secure storage unit of the vehicle gateway to complete the fingerprint registration process.

[0076] The fingerprint extracted in this embodiment is determined solely by the physical structure of the ECU hardware crystal oscillator. Attackers cannot alter this feature by tampering with the message ID, payload, or simulating the transmission cycle through software. Therefore, it can serve as a trusted anchor point for subsequent identity authentication.

[0077] In one embodiment, a real-time intrusion detection scenario applied to the CAN bus of the power domain of an intelligent connected vehicle is used. The protected object is the engine ECU with ID 0x123, and the preset operating parameters are as follows: Trust Restoration Factor Trust penalty factor Blocking threshold The dynamic trust value of the ECU is initialized to 1.0. The specific implementation process is as follows:

[0078] Normal operation phase: During normal vehicle operation, the on-board gateway calculates the clock offset residual for each message with ID 0x123 received. ,when At that time, a physical fingerprint match is determined, and the trust restoration rules are executed: The ECU trust value remained around 1.0, within the trusted tolerance zone, and the system determined the messages to be legitimate, forwarding them all normally.

[0079] Intermittent noise handling scenario: A message is affected by a momentary bus arbitration congestion, resulting in a clock offset residual. If the threshold is exceeded, the trust penalty rule is executed, and the trust value drops from 1.0 to 0.7, which is still within the trust tolerance zone, and the system does not trigger a blocking action; the clock offset residuals of the subsequent three consecutive frames all return to the threshold range, and the trust value gradually rises back to 1.0, avoiding false alarms caused by a single physical jitter.

[0080] Attack Detection Phase: After forcing a legitimate engine ECU into a bus-off state via the UDS protocol, the attacker uses the compromised in-vehicle infotainment system to send messages with a spoofed ID of 0x123. The attacker strictly adheres to the nominal 10ms transmission cycle and legitimate payload pattern when sending messages. However, due to inherent differences in the hardware crystal oscillator, the clock offset residual of each message frame consistently exceeds the safety threshold. With each received abnormal message frame, the trust value decreases sequentially according to the penalty factor: after the first abnormal message frame... After the second frame After the third frame If the threshold value falls below 0.4, the system determines that an identity hijacking attack has occurred.

[0081] Tiered response phase: When the trust value is in the trusted tolerance zone of 0.4~1.0, the system increases the sampling frequency of the message with that ID to 3 times the original frequency, and reports a security warning to the power domain controller at the same time; when the trust value drops to 0.1 and enters the blocking zone, the system directly discards all messages with ID 0x123, and reports an intrusion alarm to the vehicle security platform. It only takes 3 message cycles from the occurrence of the attack to the completion of the blocking, and the total response time is 30ms, which is far below the time threshold at which a power domain attack can cause driving risks.

[0082] This embodiment uses an asymmetric trust update mechanism that can tolerate occasional physical layer noise interference while also responding quickly to persistent spoofing attacks, thus balancing the requirements of detection robustness and response speed in automotive scenarios.

[0083] In one embodiment, refer to Figure 3 , Figure 4 , Figure 5 , Figure 6 As can be seen, this embodiment is an example of algorithm deployment and effectiveness verification of the present invention. The deployment environment is an embedded computing unit of an in-vehicle gateway equipped with the PyTorch framework, used to verify the detection capability of this solution against highly covert camouflage attacks. The specific implementation process is as follows:

[0084] Baseline fingerprint database construction: Normal CAN bus communication traffic from the publicly available Car-Hacking dataset was selected as the training data source. This dataset was collected via the OBD-II interface, with timestamp accuracy at the microsecond level, which can completely preserve the microscopic physical characteristics of the ECU crystal oscillator. After traversing all active CANIDs in the dataset and removing occasional IDs with fewer than 1000 frames of messages, 21 representative ECU nodes (including key vehicle control nodes such as power domain ID0x260 and body domain ID0x316) were selected as training objects. For each target ID, the RLS algorithm was used to linearly fit its message arrival time series to obtain the reference clock offset rate of each node. Based on a threshold shrinkage coefficient of 0.6, the corresponding compact safety threshold for each node was calculated. A four-tuple fingerprint entry containing CANID, reference clock offset rate, compact safety threshold, and average transmission cycle was constructed for each ID and stored in the encrypted baseline fingerprint database.

[0085] Construction of the spoofing attack test set: To address the lack of advanced identity spoofing attack samples in public datasets, an adversarial test set is synthesized using a traffic trajectory reconstruction strategy. First, an engine ECU with ID 0x260 is selected from the benchmark fingerprint database as the "victim," and 1000 consecutive frames of normal packets are extracted as the background traffic before the attack, preserving its original ID, data payload, and transmission cycle characteristics. Then, ID 0x18F00400, which has a different hardware origin from 0x260, is selected as the "attacker." While keeping the packet ID, DLC, and data payload of 0x260 completely unchanged, the transmission interval sequence of the attacker's packet flow is replaced in the forged packets. The packet arrival timestamp is recalculated based on the attacker's hardware crystal oscillator characteristics to generate the attack phase packet sequence. The background traffic and the attack phase packet sequence are seamlessly spliced ​​on the timeline to obtain a spoofing attack test set that is completely legitimate at the logical layer and differs only in the physical layer clock fingerprint.

[0086] Algorithm Verification and Results: The synthesized test set was input into the deployed detection algorithm of this invention, with the trust recovery factor set to 0.02, the trust penalty factor to 0.3, and the blocking threshold to 0.4. In the background traffic phase before the attack, all packets were allowed to pass normally, and the trust value remained stable in the range of 0.95 to 1.0. After the attack, due to the continuous deviation between the packet clock fingerprint and the baseline value, the trust value dropped rapidly at a rate of 0.3 / frame, and fell below the blocking threshold of 0.4 in only 3 packet cycles, triggering the blocking action. The attack detection accuracy in this test reached 99.8%, and the false positive rate was less than 0.1%, verifying the effective detection capability of this solution against highly covert and camouflaged attacks.

[0087] Reference Figure 4This embodiment is used to verify the distinguishability of the ECU clock fingerprint extracted by this solution, as well as the physical source traceability capability of the vehicle bus logic ID. It is based on the aforementioned benchmark fingerprint library containing 21 key ECU nodes of the vehicle. The specific implementation process is as follows:

[0088] Sample selection phase: The top 10 CANIDs with the highest message collection volume and communication activity are selected from the benchmark fingerprint database as verification samples, covering the core control nodes of the power domain, body domain and chassis domain, including typical logical IDs such as ID0x002, 0x2c0, 0x350 and 0x430.

[0089] Discrimination calculation stage: The reference clock offset rate corresponding to each ID is used as a unique feature vector. The Euclidean distance between the clock offset rates of each pair of IDs is calculated as a fingerprint discrimination metric. The larger the distance value, the greater the difference in the physical characteristics of the crystal oscillator of the hardware corresponding to the two IDs, and the higher the discrimination of identity recognition. The obtained 10×10 distance matrix is ​​plotted as a discrimination heatmap, with the color depth corresponding to the distance value. The darker the color, the higher the discrimination.

[0090] Results Verification Phase: The generated heatmap exhibits significant block clustering characteristics: the clock offset distance between ID0x002 and the other 9 IDs is 74ppm, corresponding to the dark blue block in the heatmap, verifying that the engine control unit corresponding to this ID has unique crystal oscillator physical characteristics, with extremely high distinguishability from other node fingerprints, and an individual recognition accuracy of up to 100%; while the clock offset distance between each pair of the three logical IDs ID0x2c0, 0x350, and 0x430 is less than 0.2ppm, corresponding to the light yellow block in the heatmap, and the fingerprint features of the three are basically overlapping, which can determine that the three logical IDs belong to the same physical body controller (BCM) and share the same hardware clock source, realizing the traceability and identification of multiple logical IDs to a single physical ECU.

[0091] This embodiment verifies that the clock fingerprint extracted by this solution can distinguish different physical ECUs with an accuracy of over 99%. In addition to intrusion detection, it can also support extended functions such as locating abnormal nodes on the vehicle bus and tracing the source of attacks, adapting to the full-scenario requirements of safe operation of the whole vehicle.

[0092] Reference Figure 5 This embodiment is a performance verification embodiment for spoofing attack detection of the present invention, applied to the performance testing scenario of intrusion detection function of vehicle gateway, to verify the effectiveness of the solution in detecting identity hijacking attacks with perfect spoofing at the logic layer. The specific implementation process is as follows:

[0093] Test preparation phase: Four representative CANIDs from the core control domain of the vehicle were selected as test objects, namely power domain IDs 0x18f and 0x260, body domain ID 0x316, and chassis domain ID 0x329. The reference clock offset rate of each ID was fitted in advance using the RLS algorithm, and the tight safety threshold of each ID was calculated based on a shrinkage coefficient of 0.6, generating the corresponding baseline fingerprint line (corresponding to the green dashed line in the test figure) and the safety trust interval (corresponding to the light green strip area in the figure). At the same time, three sets of comparative detection schemes were set as performance baselines: a timing anomaly detection model based on BiLSTM, a topology anomaly detection model based on MR-CGSC, and a traditional clock fingerprint detection scheme based on a fixed threshold.

[0094] Attack testing phase: Attack simulations were conducted for each test ID. First, 1000 frames of normal packets corresponding to the ID were collected as background traffic before the attack. The ID, data payload, and sending period of all packets conformed to the communication rules of legitimate nodes. The real-time cumulative clock offset curve (blue solid line) recorded by the detection system of this invention completely matched the baseline fingerprint line and all fell within the security trust range. The false alarm rate in the normal phase was 0.07%. An attack trigger point was set at the 1001st frame (corresponding to the attack start time marked by the red dotted line in the figure). The packet timestamp was reconstructed using the clock characteristics of the attacker's hardware. The packet ID, payload, and sending period were still completely consistent with the legitimate node, simulating a perfectly disguised identity hijacking attack at the logical layer.

[0095] Detection effect verification phase: After the attack was triggered, the real-time cumulative clock offset curves of the four test IDs showed abrupt slope changes due to the difference in the attacker's crystal oscillator frequency. Among them, the offset curve of ID0x329 broke out of the security trust interval in the 212th frame after the attack occurred, and the offset curve of ID0x260 broke out of the security trust interval in the 189th frame. The system of this invention simultaneously determined that the attack had occurred and triggered blocking. In contrast, the BiLSTM and MR-CGSC models in the comparison scheme did not detect the attack because there were no abnormalities in the message content, timing pattern, and topology relationship. The traditional fixed threshold detection scheme triggered an alarm only in the 876th frame after the attack occurred due to the lenient threshold.

[0096] Performance quantification results: The average detection time for the four test IDs was 187ms, with a detection accuracy of 99.72%. Compared with traditional detection solutions, the response speed is improved by 78%. In contrast, the detection accuracy of logic layer detection solutions for this type of highly covert attack is 0%. This verifies the advantage of the present invention, which can identify perfectly disguised logic layer attacks by relying only on physical layer hardware fingerprints, and can meet the real-time detection requirements of vehicle networks for highly covert attacks.

[0097] To further verify the advantages of the Zero Trust Mechanism (CIDS) proposed in this chapter over traditional detection methods from a quantitative perspective, this invention compares the classic machine learning algorithms (SVM, Random Forest), temporal deep learning models (BiLSTM), and the CIDS method on the same spoofing attack test set. Table 1 details the performance metrics of each model in the spoofing attack scenario:

[0098] SVM Content(ID+Data) 70.00 00.00 00.00 RandomForest Content(ID+Data) 70.00 00.00 00.00 BiLSTM Content + Time Sequence 45.02 38.74 54.55 CIDS (Zero Trust) Physical clock fingerprint 100 93.37 96.57

[0099] The core purpose of this comparative experiment is to demonstrate the inherent applicable boundaries of different detection mechanisms and verify the core conclusion that "relying solely on logical layer features cannot defend against highly concealed identity hijacking attacks, and physical layer hardware fingerprints are the only reliable trust anchor point in this type of scenario." The performance and underlying logic of each detection scheme can be broken down into three parts for explanation:

[0100] Traditional traffic detection models such as SVM and Random Forest all have logically modifiable features as their inputs, including statistics such as packet ID, data payload field, packet length, and average sending cycle. The essence of their detection logic is to "learn the content feature distribution of normal traffic and judge traffic that deviates from this distribution as abnormal".

[0101] In the perfect spoofing attack scenario of this experiment, the attacker completely replicated all logical layer features such as message content and sending cycle of the legitimate node. The attack traffic and normal traffic completely overlapped in the feature space, and there was no distinguishable dividing hyperplane. Therefore, the model could not identify any anomalies, and the recall rate and F1 score were close to 0, resulting in 100% false negatives. This result directly proves that detection schemes that rely solely on logical layer content features are inherently unable to cope with high-level identity spoofing attacks that involve "perfect spoofing at the logical layer and differences only at the physical layer," and have an irreparable detection blind spot.

[0102] BiLSTM, as a temporal deep learning model, uses the detection logic of capturing the contextual dependencies of the message arrival time series and identifying the "inconsistency" of the temporal pattern. Compared with traditional machine learning schemes that rely solely on static statistical features, it can capture the temporal jitter at the moment of attack switching and the small deviations when the attacker simulates the sending rhythm. Therefore, in the experiment, it achieved a recall rate of 38.74% and improved the F1 score to 54.55%.

[0103] However, this type of model still falls within the scope of "logic-level behavioral feature detection" and has two inherent drawbacks that cannot be ignored:

[0104] ① Insufficient recall: If the attacker can perfectly align the sending sequence of the legitimate nodes (the attack scenario in this experiment is close to this ideal state), then there will be no identifiable anomalies at the timing level, and more than 60% of the attack traffic will be judged as normal.

[0105] ② Low accuracy: Bus arbitration jitter and instantaneous congestion in normal communication scenarios can also cause deviations in timing patterns. The false alarm rate of the model exceeds 50%, which does not meet the high reliability requirement of "not arbitrarily blocking normal communication" of the vehicle network and cannot be used as a reliable basis for identity authentication.

[0106] The essential difference between this invention and all the above-mentioned solutions lies in that it completely eliminates the dependence on the characteristics of the logic layer and behavior layer, and directly anchors the inherent physical properties of the ECU crystal oscillator as the basis for identity verification. This property is determined by the hardware structure and cannot be tampered with or forged by attackers through software means. Therefore, it achieves an overwhelming advantage in performance.

[0107] Only when the hardware crystal oscillator that sends the message does not match the reference fingerprint will a continuous fingerprint deviation be triggered, eventually causing the trust value to fall below the blocking threshold. Normal physical jitter and network congestion will not be judged as attacks. Every blocking command issued by the system has 100% confidence, completely avoiding false alarms from interfering with the normal operation of the vehicle.

[0108] Recall rate 93.37%: The less than 7% of false negatives are due to the fault tolerance buffer deliberately designed by the solution: In the initial stage of an attack, it takes several frames of message fingerprint deviation to accumulate, so that the trust value drops to the blocking threshold. The delay of this process is usually only tens of milliseconds, which is far lower than the time window in which vehicle attacks can cause harm to driving safety, and does not affect the actual protection effect at all. Except for this acceptable delay, all attack messages can be accurately intercepted.

[0109] F1 score of 96.57%: Its overall performance completely surpasses all logic layer detection solutions, filling the detection blind spots of existing technologies in highly concealed identity hijacking scenarios.

[0110] This comparative experiment demonstrates from a technical mechanism perspective that, in the face of the highest level of identity hijacking attacks where the logic layer is completely disguised, all detection schemes based on logic and behavioral layer features have inherent flaws. Only by introducing physical layer immutable hardware fingerprints as the foundation of trust can a complete vehicle network defense system covering all attack scenarios be constructed.

[0111] Reference Figure 6 The core objective of this study, which analyzes the trust value evolution characteristics throughout the entire lifecycle of a spoofing attack, is to verify the rationality of the parameter design of the dynamic trust assessment model and its two core advantages in adapting to vehicular network scenarios: "noise resistance and false alarm prevention during the normal phase" and "rapid attack blocking during the attack phase." This can be explained from three dimensions: underlying design logic, concrete operational process, and scenario value.

[0112] The high stability of the trust value during the normal communication phase (to the left of the attack trigger point) is the result of the combined effect of two mechanisms: "compact envelope threshold" and "asymmetric additive recovery," which fully meets the core requirements of functional safety in vehicular networks.

[0113] Mechanism Coordination Logic: The CAN bus inherently contains non-attack factors such as physical layer clock jitter, message arbitration delay, and gateway processing jitter, which may cause the clock offset residual of a single frame message to briefly exceed the threshold. On the one hand, the tight envelope threshold design of 0.6 times the maximum residual already covers more than 99% of normal communication fluctuation scenarios. The residuals of the vast majority of normal messages are within the threshold range and will not trigger trust penalties, and the trust value is always maintained at 1.0. On the other hand, if occasional extreme bus congestion causes the residual of a single frame to exceed the threshold, the trust value will only decrease by a penalty of 0.3 (e.g., from 1.0 to 0.7) once. As long as the message fingerprint returns to normal, the trust value can be restored by 0.02 per frame. 15 normal frames of messages can restore the trust value to 1.0. The trust drop caused by single-frame jitter will be quickly smoothed out and will not accumulate to the blocking threshold of 0.4.

[0114] The core requirement of in-vehicle networks is to ensure the continuity of normal business operations. If communication between core ECUs such as the engine, steering, and braking systems is mistakenly interrupted, it can directly lead to driving safety accidents. The high stability achieved in this phase controls the system's false alarm rate to below 0.1%, fully meeting the highest level of automotive functional safety requirements, ASIL-D.

[0115] The precipitous and irreversible drop in trust value after an attack is a deliberately designed security feature of the asymmetric penalty mechanism. This fundamentally eliminates the possibility of attackers "laundering" their identities, thus meeting the protection requirements for high real-time threats from vehicle-mounted attacks.

[0116] The underlying logic is irreversible: After an attacker takes over the communication rights of the target ID, due to the inherent differences in the hardware crystal oscillator, the clock offset residual of all messages will continuously exceed the security threshold, continuously triggering the trust penalty mechanism. This model sets the penalty factor (0.3) to be 15 times the recovery factor (0.02). For each abnormal message received, the trust value decreases by 0.3. Even if the attacker occasionally has a single frame residual that coincides with the threshold, only 0.02 trust value can be recovered. The recovery speed is much slower than the penalty speed. Therefore, the trust value will only continue to fall and there is no possibility of it rebounding back to the trusted range.

[0117] Taking ID 0x329 as an example: the trust value was 1.0 before the attack occurred, and after the attack was triggered:

[0118] Attack packet frame 1: Trust value = 1.0 - 0.3 = 0.7 (still within the trusted range; the system only triggers an alert and increases the sampling frequency, without blocking communication).

[0119] Attack packet frame 2: Trust value = 0.7 - 0.3 = 0.4 (reaching the blocking threshold boundary)

[0120] Attack packet frame 3: Trust value = 0.4 - 0.3 = 0.1 (If the trust value falls below the blocking threshold of 0.4, the system will immediately discard all packets with this ID and report an attack alarm).

[0121] Subsequent continuous attacks: The trust value continues to drop to 0.0, completely locking the attacker into an untrusted state. Even if the attacker occasionally simulates a single frame message that meets the threshold, it can only raise the trust value to 0.12, which is still far below the blocking threshold, and there is no possibility of "whitewashing" and restoring communication privileges.

[0122] Vehicle identity hijacking attacks are highly real-time in nature; attackers can manipulate vehicle actuators such as the accelerator and brakes by sending only a few malicious control messages. Therefore, the detection response speed must be faster than the time window in which the attack occurs. Under this mechanism, the average response time is only 2-3 message cycles (corresponding to only 20-30ms for a 10ms message cycle), far below the industry-recognized 100ms vehicle security response threshold. Furthermore, the irreversible penalty logic completely prevents attackers from regaining trust through intermittent spoofing, achieving precise and permanent isolation of malicious nodes.

[0123] The two evolutionary features mentioned above together verify the asymmetric update design of the dynamic trust assessment model, which perfectly solves the long-standing contradiction in the field of vehicle network security that "false alarm rate and response speed cannot be achieved at the same time": it not only ensures the high reliability of normal communication, but also achieves rapid blocking of highly covert attacks, providing core decision support capabilities for zero-trust vehicle security architecture.

[0124] This invention also discloses a clock fingerprint-based vehicle-mounted zero-trust security detection system, deployed on a vehicle gateway or intelligent driving domain controller hardware carrier, including a message acquisition unit for acquiring raw CAN bus messages and an encrypted storage unit for storing legitimate node identity information. The system's operating logic is based on a clock fingerprint-based vehicle-mounted zero-trust security detection method, and further includes:

[0125] The clock offset extraction unit is used to continuously collect the actual arrival timestamps of CAN messages sent by each ECU on the bus. Based on the nominal transmission period of the corresponding message ID of each ECU, it extracts the inherent and tamper-proof clock offset time sequence of the ECU hardware as a hardware identity fingerprint.

[0126] The clock fingerprint fitting unit is used to initialize a dynamic trust value for each ECU and fit the real-time clock offset slope of the ECU with the extracted clock offset time series as input.

[0127] The dynamic trust evaluation unit is used to pre-generate a contraction-type tight decision threshold range based on baseline calibration data, compare the real-time clock offset slope with the tight decision threshold range, and dynamically update the trust value of the corresponding ECU using an asymmetric rule where the penalty factor is at least one order of magnitude greater than the recovery factor.

[0128] The safety response execution unit is used to pre-divide the security level range corresponding to the trust value, and execute the hierarchical safety response strategy according to the range to which the current trust value of the ECU belongs, so as to realize the intrusion detection and protection of the vehicle CAN bus.

[0129] The message acquisition unit acquires the original bus messages from the power domain, chassis domain, and body domain in parallel through three CAN FD controllers. The hardware timestamp accuracy reaches 1μs. After filtering out erroneous frames and remote frames, the messages are sent to the clock offset extraction unit. The encrypted storage unit uses AES-256 encryption to store the reference fingerprint quadruple of 21 core ECUs, which can only be accessed by the gateway security core.

[0130] The clock offset extraction unit calculates the theoretical arrival time of the message for each CAN ID based on the pre-stored average transmission cycle, and obtains the difference between the actual and theoretical time as the cumulative clock offset sequence; the clock fingerprint fitting unit recursively fits the real-time slope of the offset sequence using the RLS algorithm, and the initial trust value of each ECU is 1.0.

[0131] The dynamic trust assessment unit presets a threshold shrinkage coefficient of 0.6 to generate a tight decision threshold, sets a recovery factor of 0.02 and a penalty factor of 0.3 (15 times the recovery factor, satisfying the asymmetric requirement of more than one order of magnitude), recovers 0.02 per frame during fingerprint matching, and penalizes 0.3 per frame when the threshold is continuously exceeded.

[0132] The security response execution unit divides the trust interval: when the value is >0.4, normal passage is allowed; when the value is 0.2~0.4, the sampling frequency is increased and an alarm is reported; when the value is <0.2, the ID message is directly blocked and the vehicle-side security platform is reported.

[0133] This embodiment requires no modification to the existing ECU hardware and bus protocol. In actual testing, the detection accuracy of identity hijacking attacks with perfect spoofing at the logic layer reached 99.72%, with an average response time of 27ms and a false alarm rate of less than 0.1%, meeting the functional safety requirements of mass-produced vehicles.

[0134] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various equivalent changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A zero-trust security detection method for vehicles based on clock fingerprinting, applied to the CAN bus communication scenario of intelligent connected vehicles, comprising the steps of collecting the timestamps of CAN messages sent by each ECU and fitting clock offset characteristics, characterized in that, It also includes the following steps: S1. Continuously collect the actual arrival timestamps of CAN messages sent by each ECU on the bus through the vehicle gateway or bus security monitoring device. Based on the nominal transmission period of the corresponding message ID of each ECU, extract the inherent and tamper-proof clock offset time sequence of the ECU hardware as the hardware identity fingerprint. S2. Initialize the dynamic trust value for each ECU, and use the clock offset time series extracted in S1 as input to fit the real-time clock offset slope of the ECU. S3. Generate a contraction-type tight envelope threshold range in advance based on baseline calibration data, compare the real-time clock offset slope with the tight envelope threshold range, and dynamically update the trust value of the corresponding ECU using an asymmetric rule where the penalty factor is at least one order of magnitude greater than the recovery factor. S4. Pre-divide the security level range corresponding to the trust value, and execute the graded security response strategy according to the range to which the current trust value of the ECU belongs, so as to realize the intrusion detection and protection of the vehicle CAN bus.

2. The vehicle-mounted zero-trust security detection method based on clock fingerprinting according to claim 1, characterized in that, The extraction and fitting process of the ECU hardware clock offset features in step S2 is as follows: S21. During the fingerprint registration phase, for each ECU's unique CANID, the median of the arrival time intervals of 1000 consecutively collected normal message frames is used as the nominal transmission period for the message corresponding to that CANID. ; S22. For the first Read the received timestamp of the arriving target CANID message. Calculate the theoretical arrival time using the formula. ,in This is the initial synchronization point during the fingerprint registration phase. The average transmission period of the message; Calculate the first Cumulative clock offset of each message That is, the difference between the actual arrival time and the theoretical arrival time: ； Constructing a linear observation model ,in, This is the clock offset rate to be extracted. For the initial phase deviation, It is random delay noise; S23. Parameter estimation is performed using the recursive least squares method, with the optimization objective being to minimize the sum of squared residuals at all observation points. Where S is the value to be estimated. The parameter variable of clock skew rate, This represents the initial phase deviation; Upon receiving a new target CANID message, the parameter estimate is recursively updated. The clock skew rate is obtained after the algorithm converges. This serves as the unique hardware clock fingerprint for the ECU corresponding to the CANID; S24. The converged clock offset rate It is bound to the corresponding CANID and ECU number and stored in the encrypted security database of the vehicle gateway.

3. The vehicle-mounted zero-trust security detection method based on clock fingerprinting according to claim 1, characterized in that, The process of constructing the compact envelope threshold range and generating the legitimate node fingerprint database in step S3 specifically includes the following steps: S31. During the baseline calibration training phase, based on the best-fit line corresponding to the ECU reference clock offset obtained by the RLS algorithm, calculate the fitting residual for each training frame: The fitting residual This refers to random time errors caused by non-attack factors such as bus arbitration delay, gateway jitter, and operating system interrupt delay. S32. Calculate the maximum value of all fitted residuals during the training phase, and introduce a threshold shrinkage coefficient. Set the tight safety threshold corresponding to this ECU. ,in, The value is 0.6; S33. Generate a unique fingerprint entry for each CANID and store it in the local fingerprint database encrypted by the vehicle gateway.

4. The vehicle-mounted zero-trust security detection method based on clock fingerprinting according to claim 3, characterized in that, The baseline calibration trigger condition in step S3 is as follows: the baseline calibration is automatically performed once every time the vehicle is powered on and started, and the calibration process continues until 1000 normal messages of the corresponding ECU are collected.

5. The vehicle-mounted zero-trust security detection method based on clock fingerprinting according to claim 3, characterized in that, In step S33, each identity fingerprint entry includes a reference clock offset. Tight safety threshold Average message transmission cycle The quadruple corresponding to the ECU number: The fingerprint database serves as a trusted anchor for intrusion detection. When the cumulative clock offset of subsequent packets continues to exceed the corresponding tight security threshold range, it is determined to be identity fraud.

6. The vehicle-mounted zero-trust security detection method based on clock fingerprinting according to claim 1, characterized in that, The confidence value update formula for the asymmetric rule in step S3 is as follows: When the real-time clock skew slope is within the tight envelope safety threshold, the system determines that an identity deviation has occurred, and immediately initiates a rapid penalty mechanism, specifically: ； in, The clock offset slope, As a trust restoration factor, As a trust-punishing factor, For clock offset residuals, This is the safety threshold.

7. The vehicle-mounted zero-trust security detection method based on clock fingerprinting according to claim 6, characterized in that, The trust penalty factor The value range is [0.2, 0.5], the trust recovery factor. The value range is [0.01, 0.05].

8. The vehicle-mounted zero-trust security detection method based on clock fingerprinting according to claim 1, characterized in that, Step S4, which involves dividing the security level range corresponding to the trust value, specifically includes the following steps: S41. Divide the dynamic trust value with a range of [0,1] into two types of regions: trusted tolerance region and blocking attack region. The trusted tolerance region is further divided into a security sub-interval and an early warning sub-interval. The trusted tolerance region serves as a trust buffer to avoid false alarms caused by instantaneous physical noise or single calculation errors. S42. Attack detection is performed using a hysteresis comparison mechanism: When the ECU trust value is within the trusted tolerance zone, if the trust value remains around 1.0, it is determined that the physical fingerprint is a complete match; if the trust value decreases but does not fall below a preset threshold, it is determined that the physical fingerprint is a complete match. This is considered a period of trust decay, where local clock offset fluctuations do not reach statistical significance for an attack, and the overall output is labeled "normal" without triggering blocking; when the ECU trust value continues to decrease and falls below a preset threshold... When the cumulative fingerprint deviation exceeds the range of random noise, an identity hijacking attack is confirmed, an "attack" label is output, and a blocking signal is triggered. S43. The decision output logic is implemented using the following mathematical rules: For the kth received message, the system decision output... for: ； in =0 means the message is allowed to pass normally. =1 indicates message blocking. This represents the real-time trust value of the ECU corresponding to the k-th frame message. The preset blocking threshold; S44. Based on the penalty factor of the asymmetric trust update rule, construct an integral-triggered response mode: after a spoofing attack occurs, the trust value declines at a fixed slope with the duration of the attack, from the start of the attack until the trust value falls below a preset blocking threshold. The time interval is the detection response time.

9. The vehicle-mounted zero-trust security detection method based on clock fingerprinting according to claim 8, characterized in that, The hierarchical safety response strategy is as follows: messages sent by ECUs located in the safety sub-interval are allowed to pass normally; The message sampling frequency of ECUs in the warning sub-zone is increased to three times the original frequency, and a security warning is reported to the vehicle domain controller at the same time; all messages sent by ECUs in the blocking zone are directly discarded, and an intrusion alarm is reported to the vehicle security platform at the same time.

10. A clock fingerprint-based vehicle-mounted zero-trust security detection system, deployed on a vehicle gateway or intelligent driving domain controller hardware carrier, comprising a message acquisition unit for acquiring raw CAN bus messages and an encrypted storage unit for storing legitimate node identity information, characterized in that, Using the clock fingerprint-based vehicle zero-trust security detection method according to any one of claims 1-9 as the system operating logic, it further includes: The clock offset extraction unit is used to continuously collect the actual arrival timestamps of CAN messages sent by each ECU on the bus. Based on the nominal transmission period of the corresponding message ID of each ECU, it extracts the inherent and tamper-proof clock offset time sequence of the ECU hardware as a hardware identity fingerprint. The clock fingerprint fitting unit is used to initialize a dynamic trust value for each ECU and fit the real-time clock offset slope of the ECU with the extracted clock offset time series as input. The dynamic trust evaluation unit is used to pre-generate a contraction-type tight decision threshold range based on baseline calibration data, compare the real-time clock offset slope with the tight decision threshold range, and dynamically update the trust value of the corresponding ECU using an asymmetric rule where the penalty factor is at least one order of magnitude greater than the recovery factor. The safety response execution unit is used to pre-divide the security level range corresponding to the trust value, and execute the hierarchical safety response strategy according to the range to which the current trust value of the ECU belongs, so as to realize the intrusion detection and protection of the vehicle CAN bus.

Images