Hierarchical fault data encryption transmission method for high-security vehicle

Abstract

The application relates to the technical field of encrypted communication, in particular to a hierarchical fault data encryption transmission method of a high-security vehicle, which comprises the following steps: acquiring an alarm payload and calculating a physical change rate; extracting a system frame number and a superframe number of a current physical layer channel as orthogonal parameters, deriving a stream key in cooperation with a pre-shared root key, and encrypting the alarm payload into emergency ciphertext; overwriting a channel identifier in a protocol data unit of a to-be-sent message into a preset escape identifier, overwriting the emergency ciphertext into a reserved padding area in the protocol data unit which is not covered by an integrity check value, and transmitting to a receiving end; the receiving end bypasses a continuity check on a packet sequence number according to the intercepted escape identifier, extracts the emergency ciphertext in the reserved padding area, and decrypts the emergency ciphertext by using the synchronized orthogonal parameters. The application can solve the problem that emergency alarm payload cannot be immediately inserted in an encrypted link, and realizes zero-delay transmission of the alarm payload.

Description

Technical Field

[0001] This application relates to the technical field of encrypted communication, and in particular to a method for encrypted transmission of graded fault data in high-security vehicles. Background Technology

[0002] High-security vehicles commonly employ the MACsec protocol for encrypted encapsulation of the data link layer in deterministic Ethernet communication. In this protocol's mechanism, the sender assigns a strictly incremental sequence number to the security label of each encrypted message, while the receiver simultaneously maintains an anti-replay window. When the sequence number of a received message is backwards or duplicated, the anti-replay mechanism identifies it as an attack message and discards it via hardware. Vehicles continuously generate massive amounts of chassis vibration or routine environmental monitoring signals under complex driving conditions. These low-level messages rapidly consume sequence number resources within the security channel during queuing transmission. If a vehicle experiences a sudden, catastrophic physical deformation, the high-level alarm payload generated by the underlying sensors needs to be inserted into the current mission cycle for transmission with extremely low physical delay.

[0003] Chinese invention patent CN116980361B discloses a message transmission method, apparatus, and storage medium based on a frame preemption mechanism. This scheme divides messages into fast message frames and preemptible message frames according to their priority, and independently configures MACsec information, including a secure channel identifier, key, and packet sequence number, for messages of different priorities. During the sending end's queue scheduling, if a high-priority encrypted message is detected, the MAC unit directly interrupts the transmission of the current low-priority message and switches to the dedicated secure channel for sending fast message frames. The receiving end matches the corresponding decryption information according to the message priority, independently decrypts the fast message frames, and buffers fragmented preemptible message frames, performing message reassembly and decryption only after all fragments are collected.

[0004] This channel separation mechanism relies on logical queue scheduling and independent state machine maintenance within the protocol stack. When the system triggers high-priority packet preemption, the data still needs to undergo the complete MACsec protocol encapsulation process within a dedicated secure channel, including sequence number allocation and integrity check value calculation. This processing mechanism deeply binds the data stream to the standard encryption pipeline. In extreme cases of high-risk vehicle failure, data generated by the underlying sensors needs to bypass the protocol stack and be queued for immediate preemptive transmission at the physical layer level. Conventional scheduling methods based on channel isolation cannot eliminate the inherent computational boundaries brought about by the integrity check algorithm. If the underlying hardware directly performs radio frequency slot insertion that breaks the standard deterministic Ethernet frame structure, the injected ciphertext data will inevitably trigger check failure and be blocked at the receiving end because it is outside the MACsec integrity coverage. The channel-level isolation strategy, while maintaining multi-priority parallelism, blocks the transmission path of emergency data within the protocol framework that must pass integrity verification, causing the physical layer's extremely fast out-of-order preemption action and the link layer's anti-replay check to create a mutual exclusion at the underlying structure. Summary of the Invention

[0005] To address the issue of emergency alarm payloads not being able to be inserted into encrypted links in a timely manner and to achieve zero-delay transparent transmission of alarm payloads, this application provides a method for tiered fault data encryption transmission in high-security vehicles.

[0006] The method for encrypted transmission of graded fault data of a high-safety vehicle provided in this application adopts the following technical solution: The method for encrypted transmission of graded fault data of a high-safety vehicle includes: Acquire alarm loads collected by vehicle sensors and calculate the physical rate of change of the alarm loads; If the physical change rate is not greater than the preset drift threshold, increment the local silent counter to pause the consumption of the packet sequence number pre-allocated by the main encryption pipeline; when the silent counter overflows, merge the alarm payload and consume a single packet sequence number to calculate the integrity check value, and execute standard protocol encryption. If the rate of physical change exceeds the preset disaster threshold, a hardware interrupt is triggered, and a clock freeze command is issued to lock the operation boundary between the current packet sequence number and the integrity check value of the main encryption pipeline. Extract the system frame number and superframe number of the current physical layer channel as orthogonal parameters, derive the stream key from the pre-shared root key, and encrypt the alarm payload into emergency ciphertext; The channel identifier in the protocol data unit of the message to be sent is overwritten with a preset escape identifier, and the emergency ciphertext is overwritten into the reserved filling area in the protocol data unit that is not covered by the integrity check value, and then transmitted to the receiving end. The receiving end performs a continuity check on the packet sequence number based on the intercepted escape identifier bypass, extracts the emergency ciphertext from the reserved padding area, and decrypts the emergency ciphertext using the synchronized orthogonal parameters.

[0007] Optionally, triggering a hardware interrupt and issuing a clock freeze command to lock the computational boundary between the current packet sequence number and the integrity check value of the main encryption pipeline includes: The level state of the unmasked interrupt pin is toggled to trigger the hardware interrupt, routing the alarm payload to an emergency cryptographic core that is physically isolated from the main encryption pipeline; The emergency cryptographic core sends a clock gating signal to the main encryption pipeline as a clock freeze command to block the internal driving clock of the main encryption pipeline; Based on the blocked internal driving clock, the pointer state machine that maintains the packet sequence number in the main encryption pipeline is frozen to maintain hardware-level locking of the operation boundary.

[0008] Optionally, the step of extracting the system frame number and superframe number of the current physical layer channel as orthogonal parameters to collaboratively derive the stream key from the pre-shared root key includes: The system frame number and the superframe number are extracted from the physical layer channel to the emergency cryptographic core via a transparent path that includes a cross-layer mapping channel; Within the emergency cryptographic core, bit concatenation is performed on the system frame number and the superframe number, which are the orthogonal parameters, to generate a feature string; The feature string is used as a salt value and is input together with the pre-shared root key into a one-way hash function, from which the stream key, independent of the main encryption pipeline, is derived; The lifecycle of the stream key is strictly bound to the hardware interrupt, and the key register used to store the stream key is cleared after the emergency cipher core completes the output of the emergency ciphertext.

[0009] Optionally, encrypting the alarm payload into emergency ciphertext, overwriting the channel identifier in the protocol data unit of the message to be sent with a preset escape identifier, and overwriting the emergency ciphertext into the reserved padding area in the protocol data unit that is not covered by the integrity check value, includes: Generate an independent fast checksum for the alarm payload, and concatenate the independent fast checksum with the alarm payload; The emergency ciphertext is generated by performing an XOR operation between the stream key and the alarm payload after concatenating the independent fast check code; Identify the integrity check coverage boundary defined by the security label and data payload within the protocol data unit of the message to be sent, and overwrite the channel identifier in the sub-header of the protocol data unit with the escape identifier; While maintaining the data within the integrity check coverage boundary unchanged, the emergency cryptographic core writes the emergency ciphertext bit by bit into the protocol reserved field outside the integrity check coverage boundary, and uses the protocol reserved field as the reserved filling area that is not covered by the integrity check value.

[0010] Optionally, the transmission to the receiving end includes: Calculate the remaining available bit width of the reserved padding area within the protocol data unit; When the remaining available bit width is less than the bit width of the emergency ciphertext, a resource punching instruction is generated; According to the resource punching instruction, the subsequent symbol emission resources in the current task cycle are deprived, and a target physical layer resource block is generated. Using the target physical layer resource block, the protocol data unit with expanded bit width to accommodate the complete emergency ciphertext is transmitted over the air interface within the current task cycle.

[0011] Optionally, the step of depriving subsequent symbol transmission resources within the current task cycle according to the resource puncturing instruction, generating a target physical layer resource block, and using the target physical layer resource block to carry the expanded bit width protocol data unit for air interface transmission within the current task cycle to accommodate the complete emergency ciphertext includes: In response to the resource punching command, the currently active message chain is locked; Clear the queued conventional physical layer resource blocks in the message link to preempt the subsequent symbol transmission resources, and use the cleared conventional physical layer resource blocks as the target physical layer resource blocks; Using the target physical layer resource block, the protocol data unit with an expanded bit width to accommodate the complete emergency ciphertext is carried out to perform the air interface transmission within the current task cycle.

[0012] Optionally, the step of decrypting the emergency ciphertext using the synchronized orthogonal parameters includes: When the first round of decryption verification based on the orthogonal parameters fails, the retransmission request signaling generated by the receiving end for the emergency ciphertext is intercepted. Extract the transient Doppler phase shift deflection angle generated by the physical layer channel demodulation at the receiving end, and map the transient Doppler phase shift deflection angle to generate a low-quality channel mask; The low-reliability bits most severely affected by physical fading in the bit string of the cached emergency ciphertext are identified using the poor channel quality mask. A localized, traversal, blind flip error correction attempt is performed only on the identified low-reliability bits. After each bit flip, the decrypted plaintext is generated using the synchronized stream key, and the decryption verification is performed again using the independent fast checksum contained in the decrypted plaintext until the decryption verification passes.

[0013] Optionally, the step of mapping the transient Doppler phase shift deflection angle to generate a channel quality poor mask, and the step of performing a local ergonomic blind flip error correction attempt only for the located low-reliability bits, include: Extract the phase shift fluctuation feature vector of the transient Doppler phase shift deflection angle within a preset time window; The preset confidence threshold is dynamically adjusted using the phase shift fluctuation feature vector. Independently extract the log-likelihood ratio soft decision sequence of the physical layer baseband demodulator of the receiving end for each bit of the emergency ciphertext; The confidence level of the log-likelihood ratio soft decision sequence is directly evaluated, and the bit positions whose absolute values ​​are lower than the dynamically adjusted preset confidence threshold are directly mapped to generate the poor channel quality mask. According to a preset period, a hard flip attempt of 0 or 1 is independently performed on the low reliability bit located as a local traversal blind flip error correction attempt.

[0014] Optionally, the step of decrypting the emergency ciphertext using the synchronized orthogonal parameters includes: When the first round of decryption verification based on the orthogonal parameters fails, the retransmission request signaling generated by the receiving end for the emergency ciphertext is intercepted. Extract the subcarrier amplitude fading variance from the channel state information report of the receiving end, and convert the subcarrier amplitude fading variance into a spatial frequency domain fluctuation parameter; Extract the fluctuation sequence of the spatial frequency domain fluctuation parameter within a preset time window as the amplitude fading feature vector; The preset confidence threshold is dynamically adjusted using the amplitude fading feature vector. Independently extract the log-likelihood ratio soft decision sequence of the physical layer baseband demodulator of the receiving end for each bit of the emergency ciphertext; The confidence level of the log-likelihood ratio soft decision sequence is directly evaluated, and the bit positions whose absolute values ​​are lower than the dynamically adjusted preset confidence threshold are directly mapped to generate a poor channel quality mask. The low-reliability bits most severely affected by physical fading in the bit string of the cached emergency ciphertext are identified using the poor channel quality mask. According to a preset period, a hard flip attempt of 0 or 1 is performed independently only for the low reliability bit located as a local traversal blind flip error correction attempt. After each bit flip, the decrypted plaintext is generated using the synchronized stream key, and the decryption verification is performed again using the independent fast check code contained in the decrypted plaintext until the decryption verification passes.

[0015] Optionally, the process of waiting for the silent counter to overflow, merging the alarm payload and consuming a single packet sequence number to calculate an integrity check value, and performing standard protocol encryption includes: When the silent counter increments to a preset overflow limit, the count value recorded by the silent counter is converted into metadata tags; The metadata tags are concatenated with the backlog of alarm payloads to generate a complete data block; The main encryption pipeline is driven to consume a single packet sequence number to perform the integrity check value calculation and standard protocol encryption on the entire data block.

[0016] In summary, this application includes the following beneficial technical effects: 1. By calculating the physical change rate of the alarm payload, a hardware interrupt is triggered when the rate exceeds the disaster threshold, and the calculation boundary of the current packet sequence number and integrity check value of the main encryption pipeline is frozen. The system frame number and superframe number of the physical layer channel are extracted as orthogonal parameter derived stream keys to encrypt the alarm payload into emergency ciphertext. The channel identifier is then overwritten as an escape identifier, and the emergency ciphertext is overwritten into the reserved filling area that is not covered by the integrity check value for transmission. The receiving end bypasses the packet sequence number continuity check based on the escape identifier and decrypts it using the synchronized orthogonal parameter. This bypasses the sequence number consumption and integrity check calculation boundary of the main encryption pipeline, realizing zero-delay transparent transmission of the alarm payload in the encrypted link.

[0017] 2. In cases where the remaining available bit width in the reserved filling area is insufficient for the emergency ciphertext bit width, a resource punching instruction is generated to deprive the subsequent symbol transmission resources in the current task cycle and clear the queued regular physical layer resource blocks. The target physical layer resource block is then generated to carry the expanded bit width protocol data unit for air interface transmission. This dynamically expands the transmission capacity when physical layer resources are limited, avoiding transmission failure or data truncation caused by the emergency ciphertext bit width exceeding the limit.

[0018] 3. When the receiver fails the first round of decryption verification based on orthogonal parameters, it intercepts the retransmission request signaling and extracts the transient Doppler phase shift deflection angle mapping to generate a poor channel quality mask. It then identifies the low-reliability bits in the urgent ciphertext that are most severely affected by physical fading and performs local traversal blind flip error correction attempts only on these bits. After each bit flip, it re-verifies until it passes. In this way, it corrects the bit errors introduced by physical layer fading without triggering retransmission, thereby improving the recovery success rate of the urgent ciphertext under poor channel conditions. Attached Figure Description

[0019] Figure 1 A flowchart of a graded fault data encryption transmission method provided in an embodiment of the present invention; Figure 2 A comparison diagram of the frame structure before and after the protocol data unit is overwritten, as provided in an embodiment of the present invention. Detailed Implementation

[0020] The following combination Figures 1-2 This application will be described in further detail.

[0021] This application discloses a method for encrypted transmission of graded fault data in high-security vehicles. To implement this transmission method, this embodiment first constructs an underlying hardware architecture and communication topology to support its operation. Specifically, the method relies on a system comprising a high-security vehicle gateway and a multi-core scheduler for execution, with the core hardware connections as follows: The high-safety vehicle hierarchical scheduling gateway is coupled to the suspended vertical accelerometer, brake cylinder pressure sensor, and vehicle body gyroscope deployed under the chassis. It is connected to the high-safety vehicle's multi-core MAC hardware scheduler via a dedicated clock gating line and an unshielded interrupt pin. Internally, the high-safety vehicle's multi-core MAC hardware scheduler physically isolates at least two core encrypted hardware entities: the main MACsec pipeline core and the emergency cryptographic core, each with its own independent clock domain. The drive clocks for the main MACsec pipeline core and the emergency cryptographic core are output by independent phase-locked loops, each with its own independent register file, cache, and bus interface, connected only to the ciphertext transport bus via a dedicated clock gating line and an unshielded interrupt pin. A cross-layer mapping channel is established between the physical layer baseband module and the MAC layer, mapping the register values ​​of the system frame number, superframe number, transient Doppler phase shift deflection angle, and channel status information report to the dual-port random access memory address of the MAC layer. Simultaneously, the physical layer baseband module is directly coupled to the receiver's MAC high-speed parsing sentinel to establish an end-to-end data transmission path.

[0022] Combination Figure 1The overall transmission method begins with acquiring the alarm payload, triggers branch processing based on decision conditions, and forms a closed-loop iterative error correction path in the decryption and verification stage. After successful verification and outputting the plaintext alarm payload, it directly leads to the termination state. The following steps elaborate on this method in detail: S1 interrupts the current based on the rate of physical change.

[0023] The high-safety vehicle hierarchical scheduling gateway reads the current sampled values ​​of the chassis sensors every 2ms control cycle. It then subtracts the current sampled value from the cached value of the previous control cycle and divides by the control cycle to obtain the physical change rate of the alarm load. The dimension of the physical change rate is determined according to the type of the sampled source: g / ms for the suspension vertical accelerometer and kPa / ms for the brake cylinder pressure sensor. The high-safety vehicle hierarchical scheduling gateway holds a drift threshold register and a catastrophic threshold register. The drift threshold register stores the upper limit value corresponding to the sensor's own noise floor (0.05g / ms for the suspension vertical accelerometer). The catastrophic threshold register stores the lower limit value corresponding to irreversible physical deformation of the vehicle (1.5g / ms for the suspension vertical accelerometer and 30kPa / ms for the brake cylinder pressure sensor). Both sets of thresholds are written to the vehicle before it leaves the factory based on fatigue test data for that chassis model and are signed with a pre-shared root key to prevent tampering.

[0024] When the physical change rate is not greater than the drift threshold, the alarm load is determined to be background vibration and sent to the entry point of step S2 along the low-priority branch inside the state machine. When the physical change rate is greater than the disaster threshold, the high-security vehicle hierarchical scheduling gateway latches the core byte of the alarm load into the emergency channel buffer. The emergency channel buffer has a bit width of 512 bytes, and bytes exceeding the bit width are truncated according to the nearest timestamp. At the same time, the high-security vehicle hierarchical scheduling gateway flips the level of the non-masked interrupt pin connected to the emergency cryptographic core. The flipping of the level of the non-masked interrupt pin serves as the hardware trigger condition for the emergency cryptographic core to enter step S3. Alarm loads with a physical change rate between the drift threshold and the disaster threshold are directly sent to the main MACsec pipeline core for standard protocol encryption via the normal channel.

[0025] S2 silent counter throttling is used to preserve packet sequence number bandwidth.

[0026] During this control cycle, no background vibration loads are enqueued in the main MACsec pipeline core's ingress queue. The packet sequence number pointer remains at the position of the previous message exit, and the pre-allocated packet sequence number reserve is retained. The local silent counter of the high-security vehicle hierarchical scheduling gateway is synchronously incremented once. The silent counter has a bit width of 6 bits, and the overflow limit is preset to 50. This limit corresponds to a 100ms cumulative duration under a 2ms control cycle, which is 1 / 4 of the standard width of the receiver's anti-replay window, far below the threshold for triggering window sliding. Within this cumulative duration, background vibration loads are appended frame by frame in raw byte form to the tail of the backlog queue inside the high-security vehicle hierarchical scheduling gateway, and the pre-allocated sequence number reserve in the packet sequence number resource pool is not consumed.

[0027] After the silent counter increments to its overflow limit, the overflow flag is raised. The high-security vehicle hierarchical scheduling gateway packages the recorded count value into an 8-byte metadata tag. The tag fields sequentially carry the count value, the cumulative start and end timestamps, and the sensor source identifier. The metadata tag and all background vibration loads in the backlog queue are concatenated to form a single overall data block, which is delivered to the main MACsec pipeline core by the high-security vehicle hierarchical scheduling gateway in one go. The main MACsec pipeline core retrieves a single packet sequence number from the packet sequence number resource pool, calculates the integrity check value for the entire data block as a single encryption object, performs block encryption, encapsulates it into a secure message, and pushes it to the physical layer from the regular channel exit. After the entire data block exits, the silent counter is cleared, the backlog queue is emptied, and the packet sequence number pointer of the main MACsec pipeline core advances one step, waiting for the next throttling cycle.

[0028] The S3 emergency cryptographic core takes over and freezes the main core's operational boundaries.

[0029] After sampling a high level on the rising edge of the unmasked interrupt pin's level transition, the emergency cryptographic core's interrupt controller latches the transition event into the interrupt status register. The internal clock gating generator of the emergency cryptographic core outputs a continuous steady-state low-level signal as the clock gating signal. This gating signal is sent to the clock entry of the main MACsec pipeline core via a dedicated hardware-level clock gating line. During this control cycle, the internal drive clock of the main MACsec pipeline core is gated low, the next transition condition of the packet sequence number pointer state machine cannot be met, the content of the pointer register remains frozen, and the input register of the linked integrity check value calculation unit is synchronously frozen. The computation context is locked at the last calculation boundary before the gating trigger.

[0030] While the main core freezes, the emergency cryptographic core reads the system frame number and superframe number from the dual-port random access memory via the cross-layer mapping channel. The system frame number is 10 bits wide, ranging from 0 to 1023, corresponding to a radio frame count that rolls every 10ms; the superframe number is 16 bits wide, ranging from 0 to 65535, and increments once each time the system frame number wraps back to zero. The two frame numbers are maintained independently in the hardware counter of the physical layer baseband module. The transmitting and receiving ends maintain consistency through periodic broadcasts via the air interface synchronization signal block, and the frame number deviation between the transmitting and receiving ends is strictly less than half a frame.

[0031] The system frame number read by the emergency cryptographic core is located in the high-order bits of the feature string, and the superframe number is located in the low-order bits. The two are concatenated bit by bit to form a 26-bit feature string. The feature string is fed into the salt port of the one-way hash function as the salt value, and the pre-shared root key is fed into the key port. The one-way hash function uses a key derivation function based on HMAC-SHA-256, or HMAC-SHA-384 or KDF based on AES-CMAC, and outputs a 128-bit stream key. The stream key is sent to the XOR operation unit via the key bus inside the emergency cryptographic core. The current session key of the main MACsec pipeline core has no derivation association with this stream key. The lifecycle of the stream key is strictly bound to the triggered hardware interrupt, and the key register used to store the stream key is cleared after the emergency cryptographic core completes the output of the emergency ciphertext.

[0032] S4 preserves the overwriting of fill areas and the writing of escape markers.

[0033] The XOR operation unit receives the stream key derived from the emergency cryptographic core and the alarm payload buffered in the emergency channel buffer. It generates an independent fast check code (such as a CRC check sequence) for the alarm payload and concatenates them. Then, it XORs the stream key with the alarm payload after concatenating the independent fast check code bit by bit to output the emergency ciphertext.

[0034] Combination Figure 2 The emergency cryptographic core simultaneously identifies the protocol data unit structure of the message to be sent, locating the start bit of the security tag and the end bit of the data payload according to the MACsec frame format. The bit interval between them is defined as the integrity check coverage boundary. The emergency cryptographic core overwrites the 6-bit field carrying the channel identifier in the protocol data unit header with the preset escape flag 0x3F, while the remaining fields in the header retain their original values. Bytes within the integrity check coverage boundary maintain the ciphertext form generated by the MACsec standard protocol encryption, and the integrity check value calculated at the freeze time of the main MACsec pipeline core is written unchanged at the end of the message. The reserved field at the end of the protocol data unit is marked as a reserved padding area that does not participate in the integrity check value calculation in the MACsec frame format declaration. Figure 2In the frame structure before and after overwriting, the original reserved fields are replaced in place with reserved padding areas, and the overwriting positions of the channel identifier and the writing positions of the emergency ciphertext are arranged outside both ends of the integrity check coverage boundary. The emergency cipher core uses the start bit of the reserved padding area as the target address and writes the emergency ciphertext bit by bit into the reserved padding area. This write operation does not touch any bytes within the integrity check coverage boundary, and the written integrity check value remains valid.

[0035] When the remaining available bit width of the reserved padding area is less than the bit width of the emergency ciphertext, the high-security vehicle's multi-core MAC hardware scheduler generates a resource puncturing instruction. After the resource puncturing instruction is sent to the message link controller of the high-security vehicle's multi-core MAC hardware scheduler, the currently active message link is locked, and the regular physical layer resource blocks queued for transmission within the link are cleared all at once. The regular service data carried within the regular physical layer resource blocks is temporarily stored in place in the retransmission buffer held by the scheduling gateway for recovery and retransmission in subsequent task cycles. The physical layer resource blocks released by the clearing action are combined into a target physical layer resource block. Using the target physical layer resource block, protocol data units with expanded bit width to accommodate the complete emergency ciphertext are transmitted over the air interface within the current task cycle.

[0036] After the protocol data unit completes transmission at the physical layer, the emergency cryptographic core withdraws the clock gating signal, the internal drive clock of the main MACsec pipeline core is restored, the packet sequence number pointer state machine is unfrozen, the normal channel resumes service, and the silent counter and backlog queue operate as usual.

[0037] S5 receiver bypass verification and Doppler compensation iterative decryption.

[0038] The high-speed MAC parsing sentinel at the receiving end continuously monitors arriving protocol data units at the physical layer demodulation output. The sub-header parser reads the 6-bit channel identifier field of each arriving packet. When the channel identifier field is 0x3F, the sub-header parser outputs a bypass flag, and the sequence number continuity verification process is bypassed in this parsing. When the field has other values, the protocol data unit enters the regular MACsec decryption channel.

[0039] After the bypass flag is triggered, the subheading parser reads a bit string of the same length as the emergency ciphertext from the start bit of the reserved padding area at the end of the protocol data unit, and buffers it in the decryption buffer at the receiver. The receiver obtains the same system frame number and superframe number as the sender via the air interface synchronization channel, and generates a 26-bit feature string according to the high-to-low bit concatenation order agreed upon in step S3 of this method. The feature string and the pre-shared root key held by this receiver are fed into a one-way hash function, outputting a 128-bit stream key consistent with the sender. The stream key is XORed bit-by-bit with the emergency ciphertext bit string in the decryption buffer to generate the decrypted plaintext. The first round of decryption verification is performed using the independent fast checksum contained in the decrypted plaintext. If the verification passes, the plaintext alarm payload in the decrypted plaintext is extracted and sent to the emergency braking or deformation isolation mechanism of the vehicle via the actuation command interface.

[0040] When the first round of decryption verification based on orthogonal parameters fails, the decryption verification failure state machine intercepts the retransmission request signaling for urgent ciphertext from the receiver, preventing this signaling from being sent back to the sender. The receiver reads the transient Doppler phase shift deflection angle from the dual-port random access memory via a cross-layer mapping channel. The transient Doppler phase shift deflection angle is the phase deflection amount output by the baseband demodulator during the channel estimation stage, and it resides at a specified address in two's complement form.

[0041] The receiver continuously samples the transient Doppler phase shift deflection angle within a preset time window of 10ms. The phase shift fluctuation sequence is low-pass filtered and outputs a 16-dimensional phase shift fluctuation feature vector. This phase shift fluctuation feature vector is used to dynamically adjust a preset confidence threshold. The log-likelihood ratio soft decision sequence natively output by the physical layer baseband demodulator for each bit of the urgent ciphertext is extracted independently. The confidence of this log-likelihood ratio soft decision sequence is directly evaluated, and the bit positions whose absolute values ​​are lower than the dynamically adjusted preset confidence threshold are directly mapped to generate a channel quality poor mask. This channel quality poor mask is used to accurately and objectively identify the low-reliability bits in the bit string of the buffered urgent ciphertext that are most severely affected by physical fading.

[0042] The receiver's local blind flip error correction unit operates on a preset period of 10ns. Each period, it independently performs a hard flip attempt (0 or 1) on the identified low-reliability bit, serving as a local, traversal blind flip error correction attempt. After each bit flip, a decrypted plaintext is generated using the synchronized stream key, and the decryption verification is performed again using the independent fast checksum contained within the plaintext. The result of each round of decryption verification is sent to the decryption verification unit. If the verification passes, the decrypted plaintext is extracted, a plaintext alarm payload is output, and the iteration terminates. If the verification fails, the next hard flip attempt on the low-reliability bit is triggered. The maximum number of iteration rounds is preset to 1000. If the verification still fails after reaching the maximum, the current urgent ciphertext is marked as unrecoverable and discarded, effectively avoiding iterative deadlock.

[0043] When the transient Doppler phase shift deflection angle cannot be obtained due to severe non-line-of-sight obstruction or baseband demodulator output failure, the receiver reads the subcarrier amplitude fading variance from the channel state information report. The subcarrier amplitude fading variance is obtained by the receiver's channel estimator accumulating the squared amplitude deviation over a window for each subcarrier, and then transformed into a spatial frequency domain fluctuation parameter through a preset nonlinear mapping function. The fluctuation sequence of the spatial frequency domain fluctuation parameter within a preset time window is extracted as the amplitude fading feature vector. This amplitude fading feature vector is used to dynamically adjust a preset confidence threshold; the log-likelihood ratio soft decision sequence of the physical layer baseband demodulator's original output for each bit of the urgent ciphertext is independently extracted; the confidence of this log-likelihood ratio soft decision sequence is directly evaluated, and the bit positions with absolute values ​​lower than the dynamically adjusted preset confidence threshold are directly mapped to generate a poor channel quality mask. This poor channel quality mask is used to identify the low-reliability bits in the buffered urgent ciphertext bit string most severely affected by physical fading. Subsequently, according to the preset cycle, a hard flip attempt of 0 or 1 is performed independently only for the low reliability bit that is located as a local traversal blind flip error correction attempt. After each bit flip, the decrypted plaintext is generated using the synchronized stream key, and the decryption verification is performed again using the independent fast check code contained in the decrypted plaintext until the decryption verification passes.

[0044] This application also discloses a hierarchical fault data encryption transmission system for high-security vehicles, which includes a hierarchical scheduling gateway for high-security vehicles, a multi-core MAC hardware scheduler for high-security vehicles, a physical layer baseband module, and a high-speed MAC parsing sentinel at the receiving end.

[0045] The high-safety vehicle hierarchical scheduling gateway is coupled to the vehicle chassis's suspended vertical accelerometer, brake cylinder pressure sensor, and body gyroscope. It is configured to read sensor sample values ​​and calculate the physical rate of change of alarm loads at preset control cycles. The gateway includes a drift threshold register, a catastrophic threshold register, a silent counter, a backlog queue, and an emergency channel buffer. The drift threshold register stores an upper limit value corresponding to the sensor's own noise floor, while the catastrophic threshold register stores a lower limit value corresponding to irreversible physical deformation of the vehicle. The silent counter is 6 bits wide, with a preset overflow limit of 50, and is configured to increment alarm loads with a physical rate of change not exceeding the drift threshold to pause the consumption of packet sequence numbers pre-allocated by the main MACsec pipeline core. The emergency channel buffer is 512 bytes wide and is configured to latch the core bytes of alarm loads with a physical rate of change exceeding the catastrophic threshold. The gateway further includes a non-maskable interrupt pin connected to the emergency cryptographic core, configured to toggle the pin's level when the physical rate of change exceeds the catastrophic threshold.

[0046] The multi-core MAC hardware scheduler of the high-security vehicle is coupled to the hierarchical scheduling gateway of the high-security vehicle via a dedicated clock gating line and an unmasked interrupt pin. Internally, it physically isolates at least two core encryption hardware entities: the main MACsec pipeline core and the emergency cryptographic core, with independent clock domains. The driving clocks of the main MACsec pipeline core and the emergency cryptographic core are output by independent phase-locked loops. Each has its own independent register file, cache, and bus interface, and is connected to the ciphertext transport bus only through a dedicated clock gating line and an unmasked interrupt pin.

[0047] The main MACsec pipeline core is configured to receive whole data blocks delivered from the high-security vehicle hierarchical scheduling gateway via the regular channel. It consumes a single packet sequence number to calculate the integrity check value of the whole data block according to the MACsec standard protocol and performs block encryption. The main MACsec pipeline core internally contains a packet sequence number pointer state machine and an integrity check value calculation unit. The packet sequence number pointer state machine is configured to keep its pointer register contents frozen when the internal drive clock of the main MACsec pipeline core is gated. The input registers of the integrity check value calculation unit are synchronously frozen, and the calculation context is locked to the last calculation boundary before the gating trigger.

[0048] The emergency cryptographic core includes an interrupt controller, a clock gating generator, a one-way hash function module, an XOR operation unit, a protocol data unit overwrite module, and a key bus. The interrupt controller is coupled to an unmasked interrupt pin and is configured to latch the toggle event to the interrupt status register after sampling a high level on the rising edge of the pin's toggle. The clock gating generator is coupled to a dedicated clock gating line and is configured to output a continuous steady-state low-level signal as the clock gating signal fed into the clock input of the main MACsec pipeline core. The salt port of the one-way hash function module is coupled to a dual-port random access memory via a cross-layer mapping channel. It is configured to read the system frame number and superframe number, placing the system frame number in the high-order bits and the superframe number in the low-order bits, and concatenate them bit-by-bit to form a 26-bit feature string as the salt value. The key port is coupled to a pre-shared root key memory and is configured to output a 128-bit stream key. The lifecycle of this stream key is strictly bound to a hardware interrupt, and the key register used to store the stream key is cleared after the emergency cipher core completes the output of the emergency ciphertext. The one-way hash function module includes a key derivation function based on HMAC-SHA-256, and may also include HMAC-SHA-384 or a KDF based on AES-CMAC. The XOR operation unit is connected to the output of the one-way hash function module via a key bus, and its other input is coupled to an emergency channel buffer. It is configured to generate an independent fast checksum for the alarm payload, concatenate the independent fast checksum with the alarm payload, and then XOR the stream key with the bit string of the alarm payload after concatenating the independent fast checksum bit-by-bit to output the emergency ciphertext. The protocol data unit overwrite module is configured to locate the start bit of the security tag and the end bit of the data payload according to the MACsec frame format to define the integrity check coverage boundary, overwrite the 6-bit field of the channel identifier carried in the protocol data unit subheading to the preset escape identifier 0x3F, and write the emergency ciphertext bit by bit into the reserved padding area at the end of the protocol data unit that does not participate in the integrity check value calculation, with the start bit of the reserved padding area as the target address.

[0049] The high-security carrier's multi-core MAC hardware scheduler further includes a resource puncturing generation module and a message link controller. The resource puncturing generation module is configured to generate a resource puncturing instruction when the remaining available bit width of the reserved padding area is less than the bit width of the emergency ciphertext. The message link controller is configured to, in response to the resource puncturing instruction, lock the currently active message link, clear the queued regular physical layer resource blocks within the message link to preempt subsequent symbol transmission resources, use the cleared regular physical layer resource block as the target physical layer resource block, and utilize the target physical layer resource block to carry the expanded protocol data units (with the bit width increased to accommodate the complete emergency ciphertext) for over-the-air transmission within the current task cycle.

[0050] The physical layer baseband module is coupled to the multi-core MAC hardware scheduler of the high-security vehicle and the vehicle's RF antenna. It includes independently maintained system frame number hardware counters and superframe number hardware counters. The system frame number hardware counter has a 10-bit width, and the superframe number hardware counter has a 16-bit width. Both are periodically broadcast via an air interface synchronization signal block to maintain consistency with the receiver's source counters, ensuring that the frame number deviation between the transmitter and receiver is less than half a frame. The physical layer baseband module is configured to perform air interface transmission within the current task cycle after the protocol data units have been written.

[0051] The receiver-side MAC high-speed parsing sentinel is coupled to the physical layer demodulation output of the receiver. It includes a subheader parser, a decryption buffer, a one-way hash function module, an XOR operation unit, a decryption verification unit, a decryption verification failure state machine, a phase shift fluctuation feature extractor, a soft-decision mask mapper, and a local blind flip error correction unit. The subheader parser is configured to read the 6-bit channel identifier field of the arriving protocol data unit. When the field value is 0x3F, it outputs a bypass flag to bypass the continuity verification process for the packet sequence number, and reads a bit string of the same length as the emergency ciphertext from the start bit of the reserved padding area and buffers it in the decryption buffer. The receiver's one-way hash function module is identical to the transmitter's one-way hash function module and is configured to derive a 128-bit stream key from a feature string concatenated with the synchronously acquired system frame number and superframe number, and the pre-shared root key. The XOR operation unit of the receiving end is configured to XOR the stream key with the emergency ciphertext bit string in the decryption buffer bitwise to generate decrypted plaintext. The first round of decryption verification is performed using the independent fast check code contained in the decrypted plaintext. If the verification passes, the plaintext alarm payload in the decrypted plaintext is extracted and sent to the emergency braking or deformation isolation mechanism of the vehicle via the actuation command interface.

[0052] The decryption verification failure state machine is configured to intercept retransmission request signaling for urgent ciphertexts when the first round of decryption verification based on orthogonal parameters fails, preventing it from being sent back to the sender. The phase shift fluctuation feature extractor is coupled to the physical layer baseband demodulator via a cross-layer mapping channel and is configured to continuously sample transient Doppler phase shift deflection angles within a preset 10ms time window. The phase shift fluctuation sequence is low-pass filtered to output a 16-dimensional phase shift fluctuation feature vector. The phase shift fluctuation feature extractor is also configured to read the subcarrier amplitude fading variance from the channel state information report when the transient Doppler phase shift deflection angle cannot be obtained. The subcarrier amplitude fading variance is converted into spatial frequency domain fluctuation parameters through a preset nonlinear mapping function, and the fluctuation sequence of these spatial frequency domain fluctuation parameters within a preset time window is extracted as the amplitude fading feature vector. The soft-decision mask mapper is coupled to the phase shift fluctuation feature extractor and the physical layer baseband demodulator. It is configured to dynamically adjust a preset confidence threshold using the phase shift fluctuation feature vector or amplitude fading feature vector. It independently extracts the log-likelihood ratio soft-decision sequence of the original output of the physical layer baseband demodulator for each bit of the emergency ciphertext. It directly evaluates the confidence of the log-likelihood ratio soft-decision sequence and directly maps the bit positions with absolute values ​​lower than the dynamically adjusted preset confidence threshold to generate a low-channel-quality mask, thereby identifying the low-reliability bits in the bit string of the buffered emergency ciphertext that are most severely affected by physical fading. The local blind flip error correction unit is configured to perform a hard flip attempt of 0 or 1 independently for each low-reliability bit in each cycle, as a local traversal blind flip error correction attempt. After each bit flip, the decrypted plaintext is generated using the synchronized stream key, and the decryption verification is performed again using the independent fast check code contained in the decrypted plaintext. The decryption verification result of a single round is sent to the decryption verification unit. The maximum number of iterations of the local blind flip error correction unit is preset to 1000 rounds. If the verification fails after reaching the maximum, the current emergency ciphertext is marked as unrecoverable and discarded.

[0053] The components in the high-security vehicle hierarchical scheduling gateway, the high-security vehicle multi-core MAC hardware scheduler, the physical layer baseband module, and the receiver MAC high-speed parsing sentinel all contain application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or programmable logic devices containing processors and memory. The memory stores program instructions that can be executed by the processor to implement the functions of each component. The microscopic execution details of the functions of each component have been described in detail in the foregoing method embodiments and will not be repeated here.

[0054] Those skilled in the art should understand that in the high-security vehicle multi-core MAC hardware scheduler architecture described in this embodiment, as long as its hardware system includes at least a main MACsec pipeline core that performs standard protocol encryption tasks and an emergency cryptographic core that performs emergency ciphertext processing, and has the corresponding hardware-level association and clock freezing mechanism of this application, any additional auxiliary computing cores will not affect the operation of the above-mentioned inter-core collaboration mechanism. Such multi-core derived systems also fall entirely within the protection scope of the claims of this application.

[0055] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A method for encrypted transmission of graded fault data in high-safety vehicles, characterized in that, include: Acquire alarm loads collected by vehicle sensors and calculate the physical rate of change of the alarm loads; If the physical change rate is not greater than the preset drift threshold, increment the local silent counter to pause the consumption of the packet sequence number pre-allocated by the main encryption pipeline; when the silent counter overflows, merge the alarm payload and consume a single packet sequence number to calculate the integrity check value, and execute standard protocol encryption. If the rate of physical change exceeds the preset disaster threshold, a hardware interrupt is triggered, and a clock freeze command is issued to lock the operation boundary between the current packet sequence number and the integrity check value of the main encryption pipeline. Extract the system frame number and superframe number of the current physical layer channel as orthogonal parameters, derive the stream key from the pre-shared root key, and encrypt the alarm payload into emergency ciphertext; The channel identifier in the protocol data unit of the message to be sent is overwritten with a preset escape identifier, and the emergency ciphertext is overwritten into the reserved filling area in the protocol data unit that is not covered by the integrity check value, and then transmitted to the receiving end. The receiving end performs a continuity check on the packet sequence number based on the intercepted escape identifier bypass, extracts the emergency ciphertext from the reserved padding area, and decrypts the emergency ciphertext using the synchronized orthogonal parameters.

2. The method for encrypted transmission of graded fault data of high-safety vehicles according to claim 1, characterized in that, The triggering of a hardware interrupt and the issuance of a clock freeze command to lock the computational boundary between the current packet sequence number and the integrity check value of the main encryption pipeline includes: The level state of the unmasked interrupt pin is toggled to trigger the hardware interrupt, routing the alarm payload to an emergency cryptographic core that is physically isolated from the main encryption pipeline; The emergency cryptographic core sends a clock gating signal to the main encryption pipeline as a clock freeze command to block the internal driving clock of the main encryption pipeline; Based on the blocked internal driving clock, the pointer state machine that maintains the packet sequence number in the main encryption pipeline is frozen to maintain hardware-level locking of the operation boundary.

3. The method for encrypted transmission of graded fault data of high-safety vehicles according to claim 2, characterized in that, The step of extracting the system frame number and superframe number of the current physical layer channel as orthogonal parameters and collaboratively deriving the stream key from the pre-shared root key includes: The system frame number and the superframe number are extracted from the physical layer channel to the emergency cryptographic core via a transparent path that includes a cross-layer mapping channel; Within the emergency cryptographic core, bit concatenation is performed on the system frame number and the superframe number, which are the orthogonal parameters, to generate a feature string; The feature string is used as a salt value and is input together with the pre-shared root key into a one-way hash function, from which the stream key, independent of the main encryption pipeline, is derived; The lifecycle of the stream key is strictly bound to the hardware interrupt, and the key register used to store the stream key is cleared after the emergency cipher core completes the output of the emergency ciphertext.

4. The method for encrypted transmission of graded fault data of high-safety vehicles according to claim 3, characterized in that, The step of encrypting the alarm payload into emergency ciphertext, overwriting the channel identifier in the protocol data unit of the message to be sent with a preset escape identifier, and overwriting the emergency ciphertext into the reserved padding area in the protocol data unit that is not covered by the integrity check value includes: Generate an independent fast checksum for the alarm payload, and concatenate the independent fast checksum with the alarm payload; The emergency ciphertext is generated by performing an XOR operation between the stream key and the alarm payload after concatenating the independent fast check code; Identify the integrity check coverage boundary defined by the security label and data payload within the protocol data unit of the message to be sent, and overwrite the channel identifier in the sub-header of the protocol data unit with the escape identifier; While maintaining the data within the integrity check coverage boundary unchanged, the emergency cryptographic core writes the emergency ciphertext bit by bit into the protocol reserved field outside the integrity check coverage boundary, and uses the protocol reserved field as the reserved filling area that is not covered by the integrity check value.

5. The method for encrypted transmission of graded fault data of a high-safety transport vehicle according to claim 4, characterized in that, The transmission to the receiving end includes: Calculate the remaining available bit width of the reserved padding area within the protocol data unit; When the remaining available bit width is less than the bit width of the emergency ciphertext, a resource punching instruction is generated; According to the resource punching instruction, the subsequent symbol emission resources in the current task cycle are deprived, and a target physical layer resource block is generated. Using the target physical layer resource block, the protocol data unit with expanded bit width to accommodate the complete emergency ciphertext is transmitted over the air interface within the current task cycle.

6. The method for encrypted transmission of graded fault data of a high-safety transport vehicle according to claim 5, characterized in that, The step of preempting subsequent symbol transmission resources within the current task cycle according to the resource puncturing instruction, generating a target physical layer resource block, and using the target physical layer resource block to carry the expanded bit width protocol data unit for air interface transmission within the current task cycle to accommodate the complete emergency ciphertext includes: In response to the resource punching command, the currently active message chain is locked; Clear the queued conventional physical layer resource blocks in the message link to preempt the subsequent symbol transmission resources, and use the cleared conventional physical layer resource blocks as the target physical layer resource blocks; Using the target physical layer resource block, the protocol data unit with an expanded bit width to accommodate the complete emergency ciphertext is carried out to perform the air interface transmission within the current task cycle.

7. The method for encrypted transmission of graded fault data of a high-safety transport vehicle according to claim 6, characterized in that, The method of decrypting the urgent ciphertext using the synchronized orthogonal parameters includes: When the first round of decryption verification based on the orthogonal parameters fails, the retransmission request signaling generated by the receiving end for the emergency ciphertext is intercepted. Extract the transient Doppler phase shift deflection angle generated by the physical layer channel demodulation at the receiving end, and map the transient Doppler phase shift deflection angle to generate a low-quality channel mask; The low-reliability bits most severely affected by physical fading in the bit string of the cached emergency ciphertext are identified using the poor channel quality mask. A localized, traversal, blind flip error correction attempt is performed only on the identified low-reliability bits. After each bit flip, the decrypted plaintext is generated using the synchronized stream key, and the decryption verification is performed again using the independent fast checksum contained in the decrypted plaintext until the decryption verification passes.

8. The method for encrypted transmission of graded fault data of a high-safety transport vehicle according to claim 7, characterized in that, The process of mapping the transient Doppler phase shift deflection angle to generate a poor channel quality mask, and the process of performing a localized ergonomic blind flip error correction attempt only on the located low-reliability bits, include: Extract the phase shift fluctuation feature vector of the transient Doppler phase shift deflection angle within a preset time window; The preset confidence threshold is dynamically adjusted using the phase shift fluctuation feature vector. Independently extract the log-likelihood ratio soft decision sequence of the physical layer baseband demodulator of the receiving end for each bit of the emergency ciphertext; The confidence level of the log-likelihood ratio soft decision sequence is directly evaluated, and the bit positions whose absolute values ​​are lower than the dynamically adjusted preset confidence threshold are directly mapped to generate the poor channel quality mask. According to a preset period, a hard flip attempt of 0 or 1 is independently performed on the low reliability bit located as a local traversal blind flip error correction attempt.

9. The method for encrypted transmission of graded fault data of a high-safety transport vehicle according to claim 6, characterized in that, The method of decrypting the urgent ciphertext using the synchronized orthogonal parameters includes: When the first round of decryption verification based on the orthogonal parameters fails, the retransmission request signaling generated by the receiving end for the emergency ciphertext is intercepted. Extract the subcarrier amplitude fading variance from the channel state information report of the receiving end, and convert the subcarrier amplitude fading variance into a spatial frequency domain fluctuation parameter; Extract the fluctuation sequence of the spatial frequency domain fluctuation parameter within a preset time window as the amplitude fading feature vector; The preset confidence threshold is dynamically adjusted using the amplitude fading feature vector. Independently extract the log-likelihood ratio soft decision sequence of the physical layer baseband demodulator of the receiving end for each bit of the emergency ciphertext; The confidence level of the log-likelihood ratio soft decision sequence is directly evaluated, and the bit positions whose absolute values ​​are lower than the dynamically adjusted preset confidence threshold are directly mapped to generate a poor channel quality mask. The low-reliability bits most severely affected by physical fading in the bit string of the cached emergency ciphertext are identified using the poor channel quality mask. According to a preset period, a hard flip attempt of 0 or 1 is performed independently only for the low reliability bit located as a local traversal blind flip error correction attempt. After each bit flip, the decrypted plaintext is generated using the synchronized stream key, and the decryption verification is performed again using the independent fast check code contained in the decrypted plaintext until the decryption verification passes.

10. The method for encrypted transmission of graded fault data of a high-safety transport vehicle according to claim 1, characterized in that, The process of waiting for the silent counter to overflow, merging the alarm payload, consuming a single packet sequence number to calculate an integrity check value, and performing standard protocol encryption includes: When the silent counter increments to a preset overflow limit, the count value recorded by the silent counter is converted into metadata tags; The metadata tags are concatenated with the backlog of alarm payloads to generate a complete data block; The main encryption pipeline is driven to consume a single packet sequence number to perform the integrity check value calculation and standard protocol encryption on the overall data block.

Images