Vehicle terminal security communication linkage protection method and system, vehicle terminal and vehicle
Patent Information
- Application Number
- CN202611147986.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-30
- Publication Date
- 2026-09-15
Smart Images
Figure CN122764699A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of vehicle network communication technology, specifically to a method, system, vehicle terminal, and vehicle for secure communication linkage protection of in-vehicle terminals. Background Technology
[0002] With the rapid development of intelligent connected vehicle technology, the in-vehicle terminal (T-BOX), as the core hub for vehicle external network communication, carries critical security services such as emergency call (eCall), over-the-air (OTA) data download, and remote diagnostics (Diagnostic communication over Internet Protocol, DoIP). Its communication security and Quality of Service (QoS) directly affect vehicle functional safety. The current connected vehicle environment is complex and open, with frequent network attacks such as distributed denial-of-service attacks, protocol vulnerability exploitation, and malicious packet injection. These attacks are dynamic and persistent, posing a significant threat to the stable communication of the in-vehicle terminal.
[0003] The existing network security protection and communication management of vehicle terminals are independent and lack linkage. They have not built a closed-loop collaborative protection mechanism that integrates threat perception, situation assessment, strategy decision-making, differentiated protection and isolation of underlying resources. The overall protection mode is static and passive. Summary of the Invention
[0004] In view of the shortcomings of the prior art, the purpose of this application is to provide a method, system, vehicle terminal and vehicle for secure communication linkage protection of vehicle terminals, so as to improve the anti-attack capability and security stability of vehicle communication.
[0005] In a first aspect, the present application provides a method for secure communication linkage prevention of vehicle-mounted terminals, comprising the following steps:
[0006] The system collects communication data from each layer of the vehicle terminal communication stack, performs anomaly detection and analysis on the collected communication data, and outputs the original alarm signal for network anomaly.
[0007] The original alarm signals are aggregated, correlated, and intensity rated. Security situation is scored by combining device resources, process status, and trusted connection data, and a global risk level signal is output.
[0008] Obtain the global risk level signal, match the preset policy lookup matrix to obtain the corresponding scheduling policy instruction, verify the identity of all active connections in the current network, and output the distinction between trusted and untrusted connections.
[0009] Based on the differentiation results, configure communication control strategies for different types of connections;
[0010] A control command sequence is generated based on the communication management policy, and corresponding operations are executed based on the control command sequence. The operations include at least one of terminal identity anchoring, kernel traffic marking, hardware queue isolation, trusted communication resource hard isolation, and independent resource reservation.
[0011] In the above technical solution, comprehensive and accurate perception of network attacks is achieved through multi-layer data collection and anomaly detection across the entire communication stack, avoiding the problems of missed or false alarms caused by single-dimensional detection. By combining alarm aggregation rating with multi-dimensional data on devices, processes, and connections to complete situational assessment, the limitations of single alarm judgment are overcome, achieving global risk quantification and identification. Precise matching of risk levels and scheduling strategies is achieved based on a pre-set policy matrix, while identity verification distinguishes trusted and untrusted connections, avoiding identification vulnerabilities caused by IP and port spoofing. Finally, through multi-layered underlying protection including terminal identity anchoring, kernel traffic marking, hardware queue isolation, resource hard isolation, and reservation, exclusive protection of core trusted communication resources is achieved, effectively resisting network threats such as DDoS attacks, malicious packet injection, and protocol vulnerability exploitation, comprehensively improving the communication stability and security of critical security services such as OTA, eCall, and DoIP for vehicle terminals.
[0012] One possible implementation also includes: continuously collecting and updating the security situation score in real time; triggering a gradual policy recovery adjustment when the preset threat disappearance conditions are met; dynamically updating the security situation score during the recovery process; executing a policy rollback when a preset abnormal fluctuation occurs; archiving logs after the situation is fully recovered; and completing a smooth reset of the network-wide communication service quality policy.
[0013] The aforementioned technical solution also incorporates dynamic situational awareness updates and progressive policy recovery, policy rollback, and log archiving mechanisms. These solutions address the technical challenges of service interruptions and network throughput fluctuations caused by the instantaneous revocation of traditional protection policies, as well as the vulnerability of latent attacks during the recovery phase. Real-time updates to the situational awareness score enable dynamic adaptation of the protection status. A phased, smooth recovery mode is adopted after the threat subsides, avoiding the impact of sudden policy changes on core vehicle communication services. Simultaneously, an abnormal fluctuation policy rollback mechanism is implemented to provide real-time risk control during the recovery process, preventing security risks caused by attack recurrence. Logs are archived after complete situational awareness recovery, providing comprehensive data support for subsequent attack tracing, policy iteration and optimization, and security operation and maintenance auditing.
[0014] One possible implementation involves aggregating, correlating, and intensity-rating the original alarm signals, including:
[0015] Aggregate raw alarm signals, group alarms of the same source and type within a preset time into an alarm cluster, calculate alarm intensity based on alarm confidence and weight, and mark the alarm cluster whose alarm intensity exceeds a preset intensity threshold as a critical alarm cluster;
[0016] Based on the aforementioned critical alarm cluster, and combined with device resource utilization, critical process health, and trusted connection survival rate, a four-dimensional feature vector is constructed.
[0017] Based on the four-dimensional feature vector, a security situation score is performed, and global risk level signals of different levels are output in a hierarchical manner.
[0018] The aforementioned technical solution defines the specific implementation logic for alarm processing and situational assessment, resolving the problems of redundant and chaotic alarms, inability to quantify attack intensity, single-dimensional situational assessment, and inaccurate risk classification in traditional systems. By aggregating alarms of the same source and type to form alarm clusters, interference from massive amounts of duplicate alarms is eliminated, effectively simplifying alarm data and reducing system computing power consumption. Alarm intensity is calculated based on alarm confidence and weight, and severe alarm clusters are marked, accurately quantifying the severity of attacks. A four-dimensional feature vector containing alarms, device resources, process status, and trusted connections is constructed to replace the traditional single-dimensional assessment method, making security situational assessment more comprehensive and closely aligned with the actual operating conditions of vehicle terminals. By outputting global risk level signals in a tiered manner, precise and quantitative tiering criteria are provided for subsequent differentiated strategy scheduling, ensuring the accuracy and effectiveness of risk adaptation strategies.
[0019] In one possible implementation, the preset policy lookup matrix is a mapping relationship between different global risk level signals and resource scheduling policies, and the resource scheduling policies include bandwidth allocation policies, queue priority policies, processor scheduling policies, and network connection management policies.
[0020] The aforementioned technical solution defines differentiated scheduling rules for a pre-defined strategy lookup matrix, matching corresponding dedicated protection strategies to different risk levels. This addresses the technical shortcomings of traditional vehicle-mounted protection strategies, such as a one-size-fits-all approach, insufficient protection for high-risk situations, and resource waste in low-risk situations. Through a tiered strategy configuration of static fair scheduling, non-service traffic limiting, trusted bandwidth reservation, and simplified network-wide protection, dynamic and precise adaptation between security risk levels and communication and computing resource scheduling is achieved: ensuring fair utilization of network resources under normal conditions; regulating non-service traffic and mitigating potential threats under minor risks; prioritizing the protection of core trusted service resources under high-risk attacks; and minimizing service and maintaining a security baseline under extreme compromise situations. This ensures vehicle-mounted communication security while also considering the overall communication service quality and resource utilization of the terminal, achieving a dynamic balance between security protection and service experience.
[0021] One possible implementation involves verifying the identity of all active connections on the current network, including:
[0022] When the business process to be protected starts, request a process identity token;
[0023] The validity of the process identity token is verified based on the preset public key of the car manufacturer's root certificate;
[0024] After completing identity verification, the system associates the corresponding communication session, determines whether the currently active connection is a trusted connection, and outputs the result of the connection trustworthiness distinction.
[0025] The aforementioned technical solution establishes a cryptographic-based connection identity verification mechanism, abandoning the traditional shallow identification method that relies on IP addresses and ports. This addresses the security vulnerabilities of traditional connection identification, such as susceptibility to forgery, inaccurate determination of trusted connections, and difficulty in accurately identifying illegitimate connections. By proactively requesting an identity token through core business processes and combining it with the vehicle manufacturer's root certificate public key for legitimacy verification, the uniqueness, authenticity, and immutability of identity authentication are guaranteed by an authoritative certificate system. The verified legitimate identity is uniquely bound to the communication session, achieving precise trustworthiness determination from the process to the session level, thus fundamentally preventing attacks such as forged connections and malicious access.
[0026] One possible implementation is that the hardware queue isolation maps trusted traffic carrying a preset identifier to a separate, high-priority direct memory access ring buffer.
[0027] In the above technical solution, this application specifies the specific implementation method of hardware queue isolation, opens up the linkage channel from upper layer trusted identity recognition to lower layer hardware resource isolation, and solves the problems of traditional software layer protection being easily tampered with, unclear traffic priority distinction, and trusted traffic being easily squeezed out.
[0028] One possible implementation is that when the global risk level signal is at the high-risk attack status level, a preset bandwidth is reserved for trusted traffic through a resource reservation mechanism, and independent central processing unit cores and memory resources are allocated.
[0029] In the above technical solution, this application adds a dedicated resource reservation mechanism for high-risk attack situations, which solves the fatal problem that when the vehicle terminal encounters high-intensity DDoS attacks and malicious traffic bombardment, the core business bandwidth, computing power and memory resources are squeezed out, resulting in the interruption of critical security services such as emergency calls and remote diagnosis.
[0030] One possible implementation is that the trigger condition for complete situational recovery is: the situational score for multiple consecutive evaluation cycles is lower than a preset low threshold, and there is no preset high-confidence attack alarm signal output.
[0031] The above technical solution clarifies the dual triggering conditions for complete situational recovery, solving the problems of traditional protection and recovery mechanisms having a single judgment standard, being susceptible to interference from latent attacks, and causing secondary intrusions due to premature withdrawal of protection strategies.
[0032] One possible implementation is that the situation recovery process adopts a phased progressive control mechanism, which divides the total recovery time equally into multiple stages, and linearly adjusts the trusted channel guarantee bandwidth and untrusted traffic rate limiting parameters stage by stage. When an abnormality is detected in the security situation score, the corresponding stage scheduling strategy is immediately rolled back.
[0033] The above technical solution defines a phased, gradual situational recovery and dynamic rollback mechanism, which solves the problems of network instability and service interruption caused by the instantaneous recovery of traditional protection strategies, as well as the inability to quickly cover up attack recurrences during the recovery process.
[0034] Secondly, the vehicle-mounted terminal security communication linkage protection system of the present invention includes:
[0035] The intrusion detection engine unit is used to collect communication data from each layer of the vehicle terminal communication stack, perform anomaly detection and analysis on the collected communication data, and output the original alarm signal of network anomaly.
[0036] The security situation assessment and event classification unit is used to aggregate, correlate and intensity-rating the original alarm signals, combine device resources, process status and trusted connection data to score the security situation, and output a global risk level signal.
[0037] The dynamic service quality policy engine unit is used to obtain the global risk level signal, match the preset policy lookup matrix to obtain the corresponding scheduling policy instruction, perform identity verification on all active connections in the current network, and output the distinction result between trusted and untrusted connections.
[0038] A trusted communication channel management unit is used to configure communication control strategies for different types of connections based on the differentiation results.
[0039] The resource scheduling execution unit is used to generate and execute a sequence of control commands, and to perform corresponding operations based on the sequence of control commands. The operations include at least one of terminal identity anchoring, kernel traffic marking, hardware queue isolation, trusted communication resource hard isolation, and independent resource reservation.
[0040] The above technical solution addresses the shortcomings of traditional protection systems, such as fragmented functions, lack of coordination mechanisms, and passive / static protection. The intrusion detection engine unit achieves full-dimensional, non-intrusive traffic awareness, ensuring comprehensive attack detection with low overhead; the security posture assessment and event classification unit achieves alarm noise reduction and risk quantification and grading, providing data support for intelligent decision-making; the dynamic service quality policy engine unit achieves dynamic matching of risk posture and protection policies, and accurate verification of trusted identities, serving as the core of the system's intelligent decision-making; the trusted communication channel management unit achieves refined management and control of the entire lifecycle of trusted sessions; and the resource scheduling and execution unit implements multi-level policies at the kernel, driver, and hardware levels.
[0041] Thirdly, the present invention provides a vehicle-mounted terminal, wherein the vehicle-mounted terminal is equipped with the vehicle-mounted terminal security communication linkage protection system as described in the present invention.
[0042] Fourthly, the vehicle of the present invention includes a vehicle body, wherein the vehicle body is provided with an on-board terminal security communication linkage protection system as described in the present invention. Attached Figure Description
[0043] To more clearly illustrate the technical solutions in the embodiments of this application or the background art, the accompanying drawings used in the embodiments of this application will be described below.
[0044] Figure 1 This is a block diagram of a vehicle disclosed in an embodiment of this application;
[0045] Figure 2 This is a block diagram of a vehicle-mounted terminal disclosed in an embodiment of this application;
[0046] Figure 3 This is a schematic diagram of the structure of a vehicle-mounted terminal security communication linkage protection system disclosed in an embodiment of this application;
[0047] Figure 4 This is a flowchart of a vehicle-mounted terminal security communication linkage protection method disclosed in an embodiment of this application.
[0048] Explanation of reference numerals in the attached figures:
[0049] 1. Vehicle body; 2. Vehicle terminal; 21. Vehicle terminal security communication linkage protection system; 210. Intrusion detection engine unit; 211. Security situation assessment and event classification unit; 212. Dynamic service quality strategy engine unit; 213. Trusted communication channel management unit; 214. Resource scheduling execution unit. Detailed Implementation
[0050] The embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The detailed description of the following embodiments and the accompanying drawings are used to illustrate the principles of this application by way of example, but should not be used to limit the scope of this application, that is, this application is not limited to the described embodiments.
[0051] Please see Figure 1 , Figure 1 This is a schematic diagram of the vehicle structure disclosed in an embodiment of this application. The vehicle can be, but is not limited to, a pure electric vehicle (PEV / BEV), a hybrid electric vehicle (HEV), a range-extended electric vehicle (REEV), a plug-in hybrid electric vehicle (PHEV), or a new energy vehicle. One vehicle includes a vehicle body 1, and the vehicle body 1 is equipped with an on-board terminal 2 as described in this application. In this application, " / " represents "or".
[0052] Please see Figure 2 , Figure 2 This is a schematic diagram of the vehicle-mounted terminal disclosed in the embodiments of this application. A vehicle-mounted terminal 2 is equipped with the vehicle-mounted terminal security communication linkage protection system 21 as described in this application.
[0053] Please see Figure 3 , Figure 3This is a schematic diagram of the vehicle-mounted terminal secure communication linkage protection system disclosed in this application. The system includes an intrusion detection engine unit 210, a security situation assessment and event classification unit 211, a dynamic quality of service (QoS) policy engine unit 212, a trusted communication channel management unit 213, and a resource scheduling execution unit 214. The intrusion detection engine unit 210 collects communication data from each layer of the vehicle-mounted terminal's communication stack, performs anomaly detection and analysis on the collected communication data, and outputs raw alarm signals indicating network anomalies. The security situation assessment and event classification unit 211 aggregates, correlates, and performs intensity rating processing on the raw alarm signals, combines device resources, process status, and trusted connection data to perform a security situation score, and outputs a global risk level signal. The dynamic QoS policy engine unit 212 obtains the global risk level signal, matches it with a preset policy lookup matrix to obtain the corresponding scheduling policy instruction, performs identity verification on all active connections in the current network, and outputs a distinction result between trusted and untrusted connections. The trusted communication channel management unit 213 configures communication control policies for different types of connections based on the distinction result. The resource scheduling execution unit 214 is used to generate a control command sequence based on the communication management policy, and to execute the corresponding operation based on the control command sequence. The operation includes at least one of terminal identity anchoring, kernel traffic marking, hardware queue isolation, trusted communication resource hard isolation, and independent resource reservation.
[0054] In one possible embodiment, the security situation assessment and event classification unit 211 is also used to continuously collect and update the security situation score in real time, trigger progressive policy recovery and control when the preset threat decay conditions are met, dynamically update the security situation score during the recovery process, execute policy rollback when abnormal fluctuations occur, and archive the log after the situation is fully restored, thus completing the smooth reset of the network-wide communication service quality policy.
[0055] This application addresses the shortcomings of traditional protection systems, such as fragmented functions, lack of coordination mechanisms, and passive and static protection. The intrusion detection engine unit 210 achieves full-dimensional, non-intrusive traffic awareness, ensuring comprehensive attack detection with low overhead; the security posture assessment and event classification unit 211 achieves alarm noise reduction and risk quantification and grading, providing data support for intelligent decision-making; the dynamic service quality policy engine unit 212 achieves dynamic matching of risk posture and protection policies, and accurate verification of trusted identities, serving as the core of the system's intelligent decision-making; the trusted communication channel management unit 213 achieves refined management and control of the entire lifecycle of trusted sessions; and the resource scheduling and execution unit 214 implements multi-level policy implementation at the kernel, driver, and hardware levels.
[0056] The following is a detailed explanation of each unit:
[0057] 1. Intrusion Detection Engine Unit 210
[0058] The intrusion detection engine unit 210 is deployed in the network protocol stack bypass or communication module driver layer. It uses traffic mirroring to obtain all incoming and outgoing network data packets of the vehicle terminal without loss, without tampering with the main business communication link, and has the characteristics of low overhead and non-intrusive collection. The intrusion detection engine unit 210 deploys lightweight probes across multiple layers of the T-BOX communication stack, with data collection dimensions covering the network layer, transport layer, application layer, and system layer: At the network layer, it captures packets at the entry and exit points of the Internet Protocol (IP) stack, obtaining all IP stream tuples, packet sizes, and timing information; at the transport layer, it detects the connection status of Transmission Control Protocol (TCP) / User Datagram Protocol (UDP), including new connection rate, half-open connection rate, and abnormal reset; at the application layer, it parses the headers and payloads of vehicular protocols such as Scalable Service-Oriented Middleware over IP (SOME / IP), Message Queuing Telemetry Transport (MQTT), and HyperText Transfer Protocol (HTTP), verifying format compliance and sequence number continuity; and at the system layer, it detects the Socket API call sequence and process network behavior.
[0059] The intrusion detection engine unit 210 performs real-time analysis on the data packets acquired by the mirroring based on a predefined rule set (including abnormal traffic rate thresholds, malformed packet characteristics, malicious payload characteristics, and abnormal connection behavior baselines). The detection algorithms include three categories: network parameter threshold detection, abnormal connection behavior model detection, and security signature detection. Among them, network parameter threshold detection includes synchronization flooding detection rules and traffic mutation detection rules, which can identify abnormal behaviors such as a single IP continuously sending synchronization (SYN) requests at high frequency and a sudden increase in traffic at a preset time. Abnormal connection behavior model detection extracts features such as data packet size distribution, sending and receiving intervals, and active duration, and uses a single-class support vector machine for anomaly scoring. Security signature detection maintains a known attack feature library and achieves rapid alerts by matching scanning tool fingerprints and malicious payload hashes. Once various network anomalies and attack behaviors are identified, standardized original alarm events are immediately generated and pushed to the security posture assessment and event classification unit 211.
[0060] 2. Security Situation Assessment and Incident Classification Unit 211
[0061] The security situation assessment and event classification unit 211 continuously receives the full raw alarm stream from the intrusion detection engine unit 210. Internally, it independently maintains a dedicated state machine and alarm association rule base, possessing complete processing capabilities for alarm aggregation, attack chain association, and threat intensity classification. At the alarm aggregation level, it aggregates multiple duplicate alarms from the same source and of the same attack type within a preset time period into a single alarm cluster. For example, it merges multiple port scan alarms generated by the same external IP, avoiding massive redundant alarms interfering with situation assessment. At the alarm association level, it connects fragmented attack behaviors according to the state machine's temporal logic, integrating the progressive behavior of "port scanning - protocol detection - malicious packet injection" into a complete intrusion chain, recreating the real attack scenario.
[0062] After alarm aggregation and correlation are completed, the security posture assessment and event classification unit 211 combines the device's central processing unit (CPU) utilization, memory utilization, network interface resource utilization, critical process health, and trusted connection survival rate to complete a four-dimensional posture quantification score, and finally outputs a structured and hierarchical global security posture level signal for the current moment, specifically divided into five standard levels:
[0063] Level 0 (normal), Level 1 (attention), Level 2 (suspicious), Level 3 (attack), and Level 4 (collapsed) provide a quantitative triggering basis for backend dynamic strategy scheduling.
[0064] In one possible embodiment, the security situation assessment and event classification unit 211 is also used to continuously collect and update the security situation score in real time, trigger progressive policy recovery and control when the preset threat decay conditions are met, dynamically update the security situation score during the recovery process, execute policy rollback when abnormal fluctuations occur, archive logs after the situation is fully restored, and complete the smooth reset of the network-wide communication service quality policy.
[0065] 3. Dynamic Service Quality Strategy Engine Unit 212
[0066] This dynamic service quality policy engine unit 212 serves as the system's decision-making center. Its core is the pre-set policy lookup matrix, which is the central carrier for achieving situation-driven dynamic scheduling. The pre-set policy lookup matrix uses the five global security situation levels output by the security situation assessment unit as its row dimensions, and bandwidth allocation, CPU scheduling priority, hardware queue priority, maximum connection limit, traffic rate limiting threshold, and illegal connection interception rules as its resource control column dimensions, achieving a precise one-to-one mapping between "situation level" and "resource policy." The security situation level signal is the highest priority trigger input for this unit, possessing millisecond-level policy response capabilities.
[0067] Upon receiving status signals of different levels, the system automatically matches and activates corresponding scheduling strategies: Upon receiving a Level 0 normal signal, a static fair scheduling strategy is loaded; upon receiving a Level 1 suspicious scan or a Level 2 protocol violation signal, non-core traffic limiting and abnormal connection control strategies are loaded; upon receiving a Level 3 denial-of-service attack signal, a dedicated attack mitigation strategy set is immediately loaded, and trusted bandwidth reservation and hardware queue priority scheduling mechanisms are activated; upon receiving a Level 4 confirmed intrusion signal, a simplified network-wide protection strategy is activated, retaining only trusted secure communication channels. Simultaneously, this unit interfaces with a hardware security module to perform identity verification on all active connections across the network, overcoming the traditional vulnerability of easily spoofed IP / ports, accurately distinguishing trusted service connections from untrusted and attack-related connections, and providing precise decision-making basis for differentiated protection.
[0068] For each level of global risk, this application predefines a complete set of QoS policies, including bandwidth allocation policies, queue priority policies, CPU scheduling policies, and network connection management policies, forming a standardized pre-defined policy lookup matrix. The specific policy correspondence is shown in the table below:
[0069]
[0070] 4. Trusted Communication Channel Management Unit 213
[0071] The Trusted Communication Channel Management Unit 213 interacts deeply and works in real time with the Hardware Security Module (HSM) to complete the entire process of trusted session anchoring, kernel identifier conversion, and exclusive tag configuration. The specific workflow is as follows: First, the system retrieves a list of all currently active trusted connection sessions that have completed two-way certificate authentication from the HSM in real time. This includes legitimate business connections such as Transport Layer Security (TLS) trusted sessions established between the vehicle and the OEM's security gateway, emergency call (eCall), over-the-air (OTA) download, and dedicated encrypted sessions for Diagnostic over Internet Protocol (DoIP) services. Second, the system converts the certificate-level trusted session information into underlying resource identifiers that can be recognized by the vehicle terminal's operating system kernel. These identifiers include socket files, descriptors, network namespaces, and unique process identifiers, enabling precise binding between upper-layer trusted identities and underlying system resources. Finally, the system receives policy instructions from the dynamic quality of service policy engine unit 212 in real time. Through operating system system calls and communication module driver interfaces, it configures exclusive internal tags for the data streams corresponding to all trusted connections, completing the underlying identity anchoring of trusted traffic and providing a unique identification basis for subsequent hardware-layer and kernel-layer resource hard isolation.
[0072] Meanwhile, the Trusted Communication Channel Management Unit 213 is responsible for the full lifecycle management of the trusted communication channel. Based on the connection trustworthiness classification results, it configures high-priority, resource guarantee, and hardware isolation protection strategies for trusted connections; it configures conventional rate limiting and bandwidth reuse strategies for ordinary untrusted connections; and it configures blocking, rate limiting, and isolation strategies for attack connections, thereby achieving refined and differentiated network-wide communication control.
[0073] 5. Resource Scheduling Execution Unit 214
[0074] The resource scheduling execution unit 214 is the execution mechanism of the system's underlying kernel and hardware driver layer. It is deployed in the operating system kernel network subsystem and communication module driver layer and is the final carrier for the implementation of upper-layer strategies.
[0075] The resource scheduling execution unit 214 specifically responds to various control policies and instructions issued by the upper-layer dynamic quality of service policy engine unit 212 and trusted communication channel management unit 213, completing multi-level execution at the kernel layer, driver layer, and hardware layer. The specific execution logic is as follows: the kernel network traffic control module identifies the unique internal markers of trusted traffic in real time, automatically modifies the kernel packet filter and queue scheduler configurations, and schedules trusted data packets with unique markers to preset high-priority hardware queues; the communication module driver layer synchronously responds to configuration instructions, prioritizing the processing and forwarding of trusted service data packets in high-priority hardware queues during hardware interrupt handling, and shielding resource preemption interference from ordinary traffic and attack traffic.
[0076] Meanwhile, the resource scheduling execution unit 214 can transform upper-layer policy instructions into executable flow control instructions, resource management instructions, and firewall rate limiting and blocking instructions. It implements identity anchoring, traffic marking, queue isolation, resource hard isolation, and dedicated resource reservation step by step from the application layer, kernel layer, driver layer, and hardware layer, realizing the underlying closed-loop execution of software and hardware collaboration. Ultimately, it ensures that trusted core business communication resources are exclusively used, scheduled with priority, and cannot be squeezed out by attack traffic.
[0077] Please see Figure 4 , Figure 4 This is a flowchart of a vehicle-mounted terminal secure communication linkage protection method disclosed in an embodiment of this application. A vehicle-mounted terminal secure communication linkage protection method includes the following steps:
[0078] Collect communication data from each layer of the vehicle terminal communication stack, perform anomaly detection and analysis on the collected communication data, and output the original alarm signal for network anomalies.
[0079] The system aggregates, correlates, and performs intensity rating on the original alarm signals. It then combines data on device resources, process status, and trusted connections to score the security posture and outputs a global risk level signal.
[0080] Obtain the global risk level signal, match the preset policy lookup matrix to obtain the corresponding scheduling policy instruction, verify the identity of all active connections in the current network, and output the distinction between trusted and untrusted connections.
[0081] Configure communication control policies for different types of connections based on the differentiation results;
[0082] A control command sequence is generated based on the communication management policy, and corresponding operations are executed based on the control command sequence. The operations include at least one of terminal identity anchoring, kernel traffic marking, hardware queue isolation, trusted communication resource hard isolation, and independent resource reservation.
[0083] In one possible embodiment, the method further includes: continuously collecting and updating the security situation score in real time; triggering a gradual policy recovery adjustment when the preset threat decay conditions are met; dynamically updating the security situation score during the recovery process; executing a policy rollback when a preset abnormal fluctuation occurs; archiving logs after the situation is fully recovered; and completing a smooth reset of the network-wide communication service quality policy.
[0084] Unlike traditional protection strategies that abruptly revert to their previous, unpredictable recovery, this application employs a controllable and smooth recovery mechanism. This avoids service interruptions, resource contention, and throughput fluctuations caused by sudden policy changes, while also mitigating the risk of latent attacks exploiting the recovery window. The entire recovery process involves continuous monitoring of the situation and scoring. If any fluctuations are detected, such as attack recurrence, abnormal traffic increases, or abnormal process states, the system immediately reverts to the previous security strategy, ensuring a secure and controllable recovery process. Once the situation has completely stabilized, all attack alerts, policy scheduling, resource allocation, and recovery logs are archived for model iteration and policy optimization, achieving a stable and smooth reset of the entire network's QoS policies.
[0085] In one possible embodiment, the aggregation, correlation, and intensity rating processing of the original alarm signals includes:
[0086] The system aggregates raw alarm signals, grouping alarms of the same source and type within a preset time period into alarm clusters. Alarm strength is calculated based on alarm confidence and weights, and alarm clusters with strength exceeding a preset threshold are marked as critical alarm clusters. A four-dimensional feature vector is constructed based on these critical alarm clusters, combined with device resource utilization, critical process health, and trusted connection survival rate. Security posture scoring is performed based on this four-dimensional feature vector, and different levels of global risk level signals are output.
[0087] For example, the specific execution process for alarm and situational awareness assessment is as follows:
[0088] First, the original alarm signals are aggregated. Alarms of the same source and type within a preset time period are grouped into an alarm cluster. The alarm intensity of each alarm cluster is then calculated using the alarm intensity calculation formula, which is as follows: .
[0089] Here, Intensity represents the alert strength, used to quantify the overall severity of the attack threat posed by the corresponding alert cluster. Preset reliability represents the credibility of a single original alert, pre-calibrated by the intrusion detection engine based on attack feature matching accuracy and anomaly deviation. Weight represents the threat proportion of alerts of different attack types, used to distinguish the severity levels of different behaviors such as port scanning, protocol violations, and denial-of-service attacks.
[0090] When the calculated alarm intensity exceeds the system's preset intensity threshold, the alarm cluster is marked as a severe alarm cluster, effectively eliminating massive amounts of duplicate alarms, achieving clustering and integration of attack behaviors, and accurately quantifying the attack intensity.
[0091] Secondly, a four-dimensional feature vector is constructed based on critical alarm clusters, device resource utilization, critical process health, and trusted connection survival rate: ; This represents the number of critical alarm clusters per unit time. This refers to the degree of abnormality in hardware resource utilization. For the health of core business processes; This refers to the survival rate of trusted connections.
[0092] Finally, a weighted matrix operation is used to complete the real-time situation assessment:
[0093]
[0094] in: This represents the overall network security situation score at time t; the higher the score, the higher the risk. It is a four-dimensional dynamic weight vector that can be adaptively adjusted according to the vehicle's driving mode and parking mode; It is the transpose matrix of the four-dimensional eigenvectors.
[0095] Level mapping is accomplished by combining multiple threshold levels:
[0096] Level 0 (Normal): No pre-set high-confidence attack alerts;
[0097] Level 1 (Attention): There is network probing and minor traffic anomalies.
[0098] Level 2 (Suspicious): There are instances of intrusion attempts, such as protocol violations and brute-force attacks.
[0099] Level 3 (Attack): high-risk behaviors such as DoS attack, malicious packet injection and resource preemption are confirmed to occur;
[0100] Level 4 (Compromised): Backdoor persistence, core configuration tampering and abnormal HSM verification are detected, and it is determined that the terminal has been intruded.
[0101] Wherein, are low, medium and high risk situation thresholds respectively, and support adaptive configuration according to vehicle-mounted scenarios.
[0102] In a possible embodiment, the preset policy search matrix is a mapping relationship between different global risk level signals and resource scheduling policies, and the resource scheduling policies include a bandwidth allocation policy, a queue priority policy, a processor scheduling policy and a network connection management policy.
[0103] In the dynamic policy reconstruction execution process, the system first inputs the currently determined global risk level in real time, and simultaneously traverses and collects the list of all network activity connections of the entire network of the current vehicle-mounted terminal; then according to the current global risk level, retrieves the preset policy search matrix, and accurately matches and loads the full set of executable policy instruction sets corresponding to the level.
[0104] The system traverses each connection in the whole network activity connection list one by one, calls the trusted communication channel management unit 213 to perform identity verification on the connection, and completes the credibility screening of the connection: if the identity verification is passed, the connection is determined to be a trusted service connection, the exclusive control policy for the trusted channel is extracted from the currently loaded policy instruction set, and the protection configurations of high-priority guarantee, resource reservation and hardware priority scheduling are implemented on the connection; if the identity verification fails, the connection is determined to be untrusted traffic or attack traffic, and the control policies of flow limiting, speed limiting, connection restriction and IP interception are implemented on it.
[0105] After the policy matching is completed, the system automatically translates and compiles the differentiated control policies into a control command sequence that can be executed atomically in batches at the bottom layer, which specifically includes three types of core instructions: tc (traffic control), used to implement bandwidth reservation, traffic shaping, queue priority mapping and abnormal traffic speed limiting; cgroups (CPU control), used to implement CPU core binding, real-time scheduling policy configuration, memory resource isolation and exclusive reservation; iptables (firewall), used to implement accurate blocking of malicious source IPs, speed limiting for illegal new connections and access authority control for untrusted traffic. The system executes atomized unified execution on the batch command sequence, ensures that policy switching is implemented instantaneously, accurately and without conflict, and realizes dynamic intelligent reconstruction and differentiated linked protection of the whole network communication resources.
[0106] In a possible embodiment, performing identity verification on all current active connections in the network includes:
[0107] When a business process to be protected starts, it requests a process identity token. The business processes to be protected include core vehicle security processes such as eCall emergency call process, OTA upgrade process, and DoIP remote diagnostic process. After the process starts, it actively requests a unique and encrypted process identity token from the hardware security module.
[0108] The legitimacy of the process identity token is verified based on the preset vehicle manufacturer root certificate public key; according to the vehicle manufacturer root certificate public key system fixed by the T-BOX at the factory, the cryptographic verification of token issuance authority, integrity and timeliness is completed to prevent forgery, tampering and reuse of identity.
[0109] After identity verification, the system associates the corresponding communication session, determines whether the currently active connection is a trusted connection, and outputs the connection trustworthiness distinction result. It uniquely binds the legitimate token process to the corresponding Socket communication session, achieving trusted connection determination based on cryptographic identity and completely avoiding vulnerabilities bypassed by traditional IP and port spoofing.
[0110] In one possible embodiment, the sequence of control commands includes flow control commands, resource management commands, and firewall rate limiting and blocking commands.
[0111] Among them, flow control commands are used to implement bandwidth reservation, traffic shaping, queue priority mapping, and traffic rate limiting; resource management commands are used to implement CPU scheduling priority configuration, memory resource isolation and reservation; and firewall rate limiting and blocking commands are used to implement malicious source IP blocking, rate limiting of unauthorized new connections, and access control for untrusted traffic. These three types of commands work together to form a complete communication and resource management execution system, enabling refined protection at the software layer.
[0112] In one possible implementation, kernel traffic labeling involves: assigning a fixed internal identifier to legitimate and trusted traffic; and uniformly assigning a unique internal identifier to trusted process traffic at the kernel network layer, serving as the sole basis for the underlying hardware to distinguish trusted traffic. Hardware queue isolation involves mapping trusted traffic carrying preset identifiers to independent, high-priority direct memory access (DMI) ring buffers. The communication module driver identifies the internal identifier of the data packet and allocates trusted traffic to an independent DMI ring buffer, which enjoys an independent hardware transmission channel and will not have its processing resources preempted by other traffic.
[0113] In one possible implementation, when the global risk level signal is at the high-risk attack status level, a preset bandwidth is reserved for trusted traffic through a resource reservation mechanism, and independent central processing unit cores and memory resources are allocated.
[0114] When the system determines that it has entered a high-risk attack situation, it activates the resource hard isolation reservation mechanism, locks the preset bandwidth of the trusted communication channel, and allocates independent computing power and memory resources to trusted services to prevent attack traffic from crowding out core business resources.
[0115] In one possible embodiment, the trigger condition for complete situational recovery is: the situational score for multiple consecutive assessment cycles is lower than a preset low threshold, and there is no preset high-confidence attack alarm signal output.
[0116] The security situation assessment and event classification unit 211 continuously updates the situation score at a fixed cycle. Only when two hard conditions are met simultaneously can the threat be determined to have completely subsided: First, the overall network security situation score is consistently lower than the preset low-risk threshold within multiple consecutive assessment cycles; second, no preset high-confidence attack-type original alarm signals are generated in the system. Both conditions are indispensable to avoid prematurely revoking protection strategies while attacks are still lurking.
[0117] In one possible embodiment, the situation recovery process adopts a phased and gradual control mechanism, which divides the total recovery time equally into multiple stages, and linearly adjusts the trusted channel guarantee bandwidth and untrusted traffic rate limiting parameters stage by stage. When an anomaly is detected in the security situation score, the corresponding stage scheduling strategy is immediately rolled back.
[0118] For example, first define the total duration of the recovery process. (e.g., 60 seconds), divided into K stages (e.g., K=10, each stage 6 seconds). In each stage k, the key parameters are linearly adjusted according to the following formula: Trusted Channel Guarantee Bandwidth Untrusted traffic rate limiting ;in, This is a guaranteed value during an attack. This is a normal value; Strict speed limits during attacks The speed limit is set to normal. The next step is rollback detection: during the recovery process, SS(t) is continuously monitored; if SS(t) exceeds a preset moderate threshold at any stage... If the attack recurs, the recovery process is immediately paused, and the system reverts to the strategy parameters of the previous stage for continuous observation. If the attack is confirmed to have recurred, the system immediately jumps back to the Level 3 strategy. Finally, in the recovery completion stage: when k=K, all parameters are restored to normal values (Level 0), the system issues a "recovery complete" event, and records a complete log of the attack and response for use in optimizing the model and strategy.
[0119] The following example illustrates the complete closed-loop process of multi-unit linkage protection in this system, using a full business scenario where T-BOX suffers a DoS port attack.
[0120] 1. Perception and Assessment Phase
[0121] The intrusion detection engine unit 210 identifies external attack sources continuously sending abnormal packets at high frequency through traffic monitoring. When the traffic indicators exceed normal thresholds, it triggers anomaly detection rules. The security posture assessment and event classification unit 211 receives the alarm, determines the attack posture as high-risk based on the attack behavior characteristics, and outputs the corresponding level signal to the dynamic service quality policy engine unit 212.
[0122] 2. Decision-making and hard isolation execution phase
[0123] Upon receiving a high-risk signal, the dynamic service quality policy engine unit 212 switches to attack mitigation mode and simultaneously executes multiple control actions:
[0124] Strategy A (Identity Recognition): The Trusted Communication Channel Management Unit 213 retrieves all trusted service sessions within the hardware security module to distinguish between trusted service connections and external attack traffic.
[0125] Strategy B (Resource Isolation and Protection): The system issues traffic marking and scheduling control instructions to the kernel, marks trusted business data packets with exclusive internal identifiers, allocates independent high-priority transmission queues and guarantees basic bandwidth; at the same time, it implements rate limiting control on attack source traffic and isolates it to an independent low-priority queue.
[0126] Strategy C (Hardware Coordination): Bind the kernel's trusted traffic virtual queue to the high-priority transmission channel of the communication module hardware, and prioritize the forwarding of trusted service data packets at the hardware level.
[0127] 3. Recovery Phase
[0128] After the attack traffic was continuously throttled and controlled, the terminal load gradually decreased, and there were no new preset high-confidence attack alarms for several consecutive cycles. The security posture level was gradually downgraded to the normal level. The dynamic service quality policy engine unit 212 did not directly revoke all protection policies, but initiated a smooth recovery process. It gradually adjusted the control parameters in stages according to the above bandwidth and rate limit parameter calculation formulas, monitored the posture data throughout the process, and immediately rolled back the protection policies once the attack recurred, until the entire network returned to normal and a complete security log was archived.
[0129] The above scenario fully demonstrates the core collaborative workflow of this invention, from perception (generating original alarms), assessment and decision-making (situation assessment and policy triggering) to execution (identity recognition and hard resource isolation). Each step is closely linked, transforming traditionally isolated detection and response into an automated, resilient assurance closed loop.
[0130] The following section uses TBOX, which runs on Linux, as an example to introduce the three-layer collaborative implementation logic of "resource hard isolation based on cryptographic identity" in this application, and completes end-to-end trusted communication resource isolation guarantee:
[0131] 1. Application layer or session layer identity anchoring
[0132] After the vehicle's core business application is started, it establishes an encrypted and trusted session with the remote service. Identity authentication is completed through two-way certificate verification by the hardware security module, and the trusted session is bound and anchored to the corresponding communication link.
[0133] 2. Operating System Kernel Layer Marking and Scheduling
[0134] The Trusted Channel Management module reads all trusted session links, assigns a unique internal identifier to trusted data packets through the kernel flow control component, configures high-priority scheduling queues, and allocates basic bandwidth guarantees to the queues.
[0135] 3. Driver layer to hardware layer mapping
[0136] The communication module driver binds the kernel's high-priority virtual queue to the hardware's dedicated transmission channel. The hardware transmission link prioritizes the processing of trusted labeled data packets, ensuring that the trusted service transmission channel remains unobstructed even if attack traffic consumes a large amount of system resources.
[0137] Through the coordinated operation of the above three-layer system, this application achieves end-to-end hard isolation protection from cryptographic identity to communication hardware resources, ensuring the ultimate resilience of core business communication in complex network attack environments.
[0138] The examples described above can be modified or altered by those skilled in the art based on the above description, and all such modifications and alterations should fall within the protection scope of the appended claims. Those skilled in the art can understand that implementing all or part of the processes of the above embodiments and making equivalent changes according to the claims of this application still fall within the scope of this application.
Claims
1. A method for secure communication linkage protection of vehicle-mounted terminals, characterized in that, Includes the following steps: The system collects communication data from each layer of the vehicle terminal communication stack, performs anomaly detection and analysis on the collected communication data, and outputs the original alarm signal for network anomaly. The original alarm signals are aggregated, correlated, and intensity rated. Security situation is scored by combining device resources, process status, and trusted connection data, and a global risk level signal is output. Obtain the global risk level signal, match the preset policy lookup matrix to obtain the corresponding scheduling policy instruction, verify the identity of all active connections in the current network, and output the distinction between trusted and untrusted connections. Based on the differentiation results, configure communication control strategies for different types of connections; A control command sequence is generated based on the communication management policy, and corresponding operations are executed based on the control command sequence. The operations include at least one of terminal identity anchoring, kernel traffic marking, hardware queue isolation, trusted communication resource hard isolation, and independent resource reservation.
2. The vehicle-mounted terminal secure communication linkage protection method according to claim 1, characterized in that, Also includes: The security situation score is continuously collected and updated in real time. When the preset threat decay conditions are met, a gradual strategy recovery adjustment is triggered. During the recovery process, the security situation score is dynamically updated, and when preset abnormal fluctuations occur, the strategy rollback is executed.
3. The vehicle-mounted terminal secure communication linkage protection method according to claim 1, characterized in that, The aggregation, correlation, and intensity rating processing of the original alarm signals includes: Aggregate raw alarm signals, group alarms of the same source and type within a preset time into an alarm cluster, calculate alarm intensity based on alarm confidence and weight, and mark the alarm cluster whose alarm intensity exceeds a preset intensity threshold as a critical alarm cluster; Based on the aforementioned critical alarm cluster, and combined with device resource utilization, critical process health, and trusted connection survival rate, a four-dimensional feature vector is constructed. The security situation score is performed based on the four-dimensional feature vector, and global risk level signals of different levels are output in a hierarchical manner.
4. The vehicle-mounted terminal secure communication linkage protection method according to claim 1, characterized in that, The preset strategy lookup matrix is a mapping relationship between different global risk level signals and resource scheduling strategies. The resource scheduling strategies include bandwidth allocation strategies, queue priority strategies, processor scheduling strategies, and network connection management strategies.
5. The vehicle-mounted terminal secure communication linkage protection method according to claim 1, characterized in that, Verify the identity of all active connections on the current network, including: When the business process to be protected starts, request a process identity token; The validity of the process identity token is verified based on the preset public key of the car manufacturer's root certificate; After completing identity verification, the system associates the corresponding communication session, determines whether the currently active connection is a trusted connection, and outputs the result of the connection trustworthiness distinction.
6. The vehicle-mounted terminal secure communication linkage protection method according to claim 1, characterized in that, The hardware queue isolation is as follows: trusted traffic carrying a preset identifier is mapped to an independent, high-priority direct memory access ring buffer.
7. The vehicle-mounted terminal secure communication linkage protection method according to claim 1, characterized in that, When the global risk level signal is at the high-risk attack status level, a preset bandwidth is reserved for trusted traffic through a resource reservation mechanism, and independent central processing unit cores and memory resources are allocated.
8. The vehicle-mounted terminal secure communication linkage protection method according to claim 2, characterized in that, The triggering condition for complete situational recovery is: the situational score for multiple consecutive evaluation cycles is lower than the preset low threshold, and there is no preset high-confidence attack alarm signal output.
9. The vehicle-mounted terminal secure communication linkage protection method according to claim 2, characterized in that, The situation recovery process adopts a phased and gradual control mechanism, which divides the total recovery time into multiple stages, and linearly adjusts the trusted channel guarantee bandwidth and untrusted traffic rate limiting parameters stage by stage. When an anomaly is detected in the security situation score, the corresponding stage scheduling strategy is immediately rolled back.
10. A vehicle-mounted terminal security communication linkage protection system, characterized in that, include: The intrusion detection engine unit (210) is used to collect communication data from each layer of the vehicle terminal communication stack, perform anomaly detection and analysis on the collected communication data, and output the original alarm signal of network anomaly. The security situation assessment and event classification unit (211) is used to aggregate, correlate and intensity-rating the original alarm signals, combine the device resources, process status and trusted connection data to score the security situation, and output the global risk level signal. The dynamic service quality strategy engine unit (212) is used to obtain the global risk level signal, match the preset strategy lookup matrix to obtain the corresponding scheduling strategy instruction, perform identity verification on all active connections in the current network, and output the distinction result between trusted and untrusted connections. Trusted Communication Channel Management Unit (213) is used to configure communication control policies for different types of connections based on the differentiation results; The resource scheduling execution unit (214) is used to generate a control command sequence based on the communication management policy and execute corresponding operations based on the control command sequence. The operations include at least one of terminal identity anchoring, kernel traffic marking, hardware queue isolation, trusted communication resource hard isolation, and independent resource reservation.
11. A vehicle-mounted terminal, characterized in that, The vehicle terminal (2) is equipped with the vehicle terminal security communication linkage protection system (21) as described in claim 10.
12. A vehicle, characterized in that, Includes a vehicle body (1), wherein the vehicle body is provided with an on-board terminal (2) as described in claim 11.