A vehicle control method and device, vehicle and storage medium

Abstract

The application provides a vehicle control method and device, a vehicle and a storage medium. The method comprises: acquiring a data frame on a vehicle-mounted network; performing a filtering operation on the data frame according to a preset filtering strategy to obtain a first filtered data frame; performing anomaly detection on the first data frame according to a preset detection rule to obtain a second data frame that passes the anomaly detection, wherein the preset detection rule is used to represent an anomaly detection rule corresponding to the type of the first data frame; performing a routing mapping operation on the second data frame to obtain a vehicle control signal; and controlling the vehicle according to the vehicle control signal. The gateway routing, information security protection and vehicle control are cooperatively interacted and effectively integrated in the area controller. Thus, the number of hardware modules and the number of network communication nodes are reduced, the weight of the whole vehicle communication wire harness and the cost of the hardware controller are reduced, the response delay caused by external communication between the hardware modules is shortened, and the cooperative response speed is improved.

Description

Technical Field

[0001] This application relates to the field of vehicle control technology, specifically to a vehicle control method, device, vehicle, and storage medium. Background Technology

[0002] As automotive electronic and electrical architectures evolve from distributed to domain-centralized and regional architectures, vehicle functional area control is gradually being replaced by a small number of high-performance Zone Control Units (ZCUs) that replace the traditional dozens of discrete vehicle control modules.

[0003] In related technologies, vehicle control functions are typically handled by a separate vehicle control module, gateway routing functions are implemented by a separate central gateway, and information security protection relies on a separate encryption hardware module or security gateway module. In other words, these technologies distribute vehicle control, gateway routing, and information security protection functions across different hardware modules within the vehicle architecture.

[0004] However, separating vehicle control, gateway routing, and information security protection functions into different hardware modules leads to problems such as redundant hardware modules, complex wiring harness layout, and delayed response between hardware modules. Therefore, how to effectively integrate vehicle control, gateway routing, and information security protection functions within a single area controller, and ensure effective coordination between these functions, is a technical problem that urgently needs to be solved by those skilled in the art.

[0005] It should be noted that the information disclosed in the background section of this application is intended only to enhance the understanding of the general background of this application, and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0006] This application provides a vehicle control method, device, vehicle, and storage medium to help solve the technical problem of how to effectively integrate vehicle control, gateway routing, and information security protection functions within a single area controller, and ensure effective coordination between these functions.

[0007] In a first aspect, embodiments of this application provide a vehicle control method applied to an area controller, the method comprising: Acquire data frames from the vehicle network; The data frame is filtered according to a preset filtering strategy to obtain a filtered first data frame. The preset filtering strategy is used to limit the type of the filtered data frame. According to the preset detection rules, the first data frame is subjected to anomaly detection to obtain a second data frame that passes the anomaly detection. The preset detection rules are used to characterize the anomaly detection rules corresponding to the type of the first data frame. Perform a routing mapping operation on the second data frame to obtain the vehicle control signal; The vehicle is controlled according to the vehicle control signal.

[0008] In this embodiment, a first data frame is obtained by filtering data frames on the vehicular network (gateway routing and information security protection function); an anomaly detection operation (information security protection function) is performed on the first data frame to obtain a second data frame; route mapping is performed on the second data frame (gateway routing function) to obtain vehicle control signals; and the vehicle is controlled according to the vehicle control signals (vehicle control function). This achieves the collaborative interaction and effective integration of gateway routing, information security protection, and vehicle control in the area controller. This reduces the number of hardware modules and network communication nodes, lowers the weight of the vehicle communication harness and the cost of the hardware controller, shortens the response delay caused by external communication between hardware modules, and improves the collaborative response speed.

[0009] In one possible implementation, the anomaly detection includes transmission period detection, signal value range detection, and protocol specification detection, and the preset detection rules include preset period constraints, preset value ranges, and preset protocol specifications. The data frame transmission period detection is used to detect whether the transmission period of the first data frame meets the preset period constraint, the data frame signal value range detection is used to detect whether the signal value in the first data frame belongs to the preset value range, and the data frame protocol specification detection is used to detect whether the protocol format of the first data frame conforms to the preset protocol specification.

[0010] In this embodiment of the application, by using the above three dimensions of anomaly detection, anomalies in the first data frame can be comprehensively identified, thereby improving the recognition rate of anomaly detection and the reliability of the information security protection function of the regional controller.

[0011] Meanwhile, the aforementioned anomaly detection does not require external AI computing power; real-time security detection of data frames can be achieved at the microcontroller level. Abnormal data frames can directly block subsequent routing operations, realizing a closed loop from anomaly detection and detection result determination to subsequent execution. Furthermore, the anomaly detection is implemented through a software module, which can fully utilize the existing microcontroller computing power and storage resources of the area controller without the need for additional independent security chips, making it suitable for cost-sensitive vehicle platforms.

[0012] In one possible implementation, before performing a filtering operation on the data frame according to a preset filtering strategy to obtain the filtered first data frame, the method further includes: Determine the corresponding preset filtering strategy based on the vehicle's operating mode; The operating mode includes a first operating mode and a second operating mode, wherein the number of data frame types filtered in the first operating mode is greater than that in the second operating mode.

[0013] In this embodiment, by setting different preset filtering strategies for different operating modes, the data access strategy can be flexibly adjusted according to the actual application scenario of the vehicle, avoiding the limitations of a single strategy in dealing with different scenarios and improving the scenario adaptability of the vehicle control method.

[0014] One possible implementation also includes: If a request to switch vehicle operating modes is received, the device that sent the request will be authenticated. If the identity verification is successful, the vehicle operation mode will be switched.

[0015] In this embodiment of the application, by introducing an identity authentication mechanism before switching vehicle operating modes, illegal switching requests can be effectively intercepted, ensuring that the vehicle operating mode is effectively prevented from being maliciously tampered with throughout the entire life cycle of vehicle production, transportation, sales and user use.

[0016] In one possible implementation, the step of filtering the data frame according to a preset filtering strategy to obtain a filtered first data frame includes: According to the preset filtering strategy, the data frame is subjected to data frame identification information filtering operation and data frame length filtering operation to obtain the filtered first data frame.

[0017] In this embodiment, by combining data frame identification information and data frame length for verification, multi-dimensional filtering of data frames can be achieved, effectively compensating for the shortcomings of single-dimensional filtering operations and improving the reliability of the filtering operation. This provides a certain degree of information security protection, essentially preventing invalid or malicious data from flowing into subsequent processing flows, and improving the stability and security of the area controller's operation.

[0018] One possible implementation also includes: If the first data frame fails the anomaly detection, the anomaly detection result corresponding to the first data frame is stored in the security log, and an alarm message is output.

[0019] In this embodiment, storing anomaly information using a security log facilitates subsequent fault handling and security auditing. Outputting alarm messages helps remind users or area controllers to take appropriate action, improving the stability of the vehicle control method.

[0020] One possible implementation also includes: When the network segment in the vehicle network meets the preset sleep conditions, check for any unprocessed alarm messages. If there are unprocessed alarm messages, the hibernation operation of the network segment will be delayed.

[0021] In this embodiment of the application, by adopting network segment delay sleep, it is possible to avoid the failure to handle anomalies in a timely manner due to network segment sleep, thereby improving the real-time performance of anomaly response and the reliability of control.

[0022] Secondly, embodiments of this application provide a vehicle control device, including: The data frame acquisition module is used to acquire data frames on the vehicle network; A filtering module is used to perform filtering operations on the data frame according to a preset filtering strategy to obtain a filtered first data frame. The preset filtering strategy is used to limit the type of the filtered data frame. The detection module is used to perform anomaly detection on the first data frame according to the preset detection rules, and obtain a second data frame that passes the anomaly detection. The preset detection rules are used to characterize the anomaly detection rules corresponding to the type of the first data frame. The routing module is used to perform routing mapping operations on the second data frame to obtain vehicle control signals; The control module is used to control the vehicle according to the vehicle control signal.

[0023] Thirdly, embodiments of this application provide a vehicle, including: a region controller, the region controller being configured to perform the method described in any one of the first aspects.

[0024] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of the first aspects. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of this application; Figure 2 This is a schematic flowchart of a vehicle control method provided in an embodiment of this application; Figure 3A schematic diagram illustrating the correspondence between anomaly detection and preset detection rules provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a vehicle control device provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] To better understand the technical solution of this application, the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0028] It should be understood that the described embodiments are merely some, not all, of the embodiments in this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0029] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0030] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0031] See Figure 1 This is a schematic diagram illustrating an application scenario of a related technology provided in an embodiment of this application. For example... Figure 1 As shown, the application scenario includes a vehicle 100, which includes a gateway routing module 101, an information security protection module 102, and a vehicle control module 103.

[0032] In related technologies, the gateway routing module 101 is used to implement the gateway routing function, the information security protection module 102 is used to implement the information security protection function, and the vehicle control module 103 is used to implement the vehicle body control function.

[0033] Among them, the gateway routing module 101, the information security protection module 102, and the vehicle control module 103 are all independent physical hardware units, and the modules communicate with each other through CAN bus or LIN bus.

[0034] However, separating vehicle control, gateway routing, and information security protection functions into different hardware modules leads to problems such as redundant hardware modules, complex wiring harness layout, and delayed response between hardware modules. Therefore, how to effectively integrate vehicle control, gateway routing, and information security protection functions within a single area controller, and ensure effective coordination between these functions, is a technical problem that urgently needs to be solved by those skilled in the art.

[0035] To address the aforementioned issues, this application provides a vehicle control method applied to a region controller. By filtering data frames on the vehicular network (gateway routing and information security protection functions), a first data frame is obtained; anomaly detection is performed on the first data frame (information security protection function) to obtain a second data frame; routing mapping is performed on the second data frame (gateway routing function) to obtain a vehicle control signal; and the vehicle is controlled based on the vehicle control signal (vehicle control function). This achieves coordinated interaction and effective integration of gateway routing, information security protection, and vehicle control within the region controller. This reduces the number of hardware modules and network communication nodes, lowers the weight of the vehicle communication harness and the cost of the hardware controller, shortens the response delay caused by external communication between hardware modules, and improves the coordinated response speed.

[0036] Specifically, the following detailed description is provided in conjunction with the accompanying drawings and specific embodiments.

[0037] See Figure 2 This is a schematic flowchart of a vehicle control method provided in an embodiment of this application. Figure 2 As shown, this method is applied to a regional controller and specifically includes the following steps.

[0038] Step S201: Acquire data frames on the vehicle network.

[0039] In this context, the in-vehicle network refers to the network communication architecture deployed in a vehicle, connecting various control units to achieve data interaction and resource sharing. In practical applications, in-vehicle networks include, but are not limited to, Controller Area Network (CAN) bus, Controller Area Network with Flexible Data-rate (CAN FD) bus, Local Interconnect Network (LIN) bus, and in-vehicle Ethernet.

[0040] Data frames on the vehicle network refer to data units transmitted on the vehicle network, which may carry vehicle status information, control command information, or diagnostic information.

[0041] In practical applications, data frames typically have different formats on different in-vehicle networks. For example, when the in-vehicle network is a CAN bus, the data frame can be a CAN message following the CAN protocol; while when the in-vehicle network is a LIN bus, the data frame can be a LIN message following the LIN protocol. Data frames on the in-vehicle network can be monitored and acquired in real time through the gateway routing domain module (software module) of the area controller.

[0042] Of course, those skilled in the art can adjust the specific form of the vehicle network and data frames according to actual needs, and the embodiments of this application do not impose specific limitations on this.

[0043] Step S202: Perform a filtering operation on the data frame according to the preset filtering strategy to obtain the first filtered data frame.

[0044] The preset filtering policy is used to limit the types of data frames to be filtered. In practical applications, the preset filtering policy is usually pre-configured in the area controller (e.g., stored in the routing table in the form of a whitelist), and can be loaded when the area controller is powered on to determine the types of data frames that the area controller can currently process.

[0045] During vehicular network communication, a large number of broadcast data frames are typically transmitted in real time, some of which may not need to be processed by the area controller. By setting a preset filtering strategy, the area controller can initially filter out the valid data types that require subsequent processing, i.e., the first data frame, thereby avoiding interference from invalid data frames.

[0046] In this embodiment, the type of data frame can be distinguished by the identification information of the data frame. It is understood that the identification information of the data frame can be used to characterize the source and function of the data frame.

[0047] For example, when the vehicle network is a CAN bus, the type of data frame can be characterized by the CAN ID in the CAN message. Different CAN IDs can indicate different data frame sources. A message with CAN ID 0x1A0 may originate from the vehicle's engine control unit, while a message with CAN ID 0x3B0 may originate from the door control unit.

[0048] Meanwhile, some CAN IDs may correspond to vehicle control function messages (such as lighting control, window lifting control, etc.), while other CAN IDs may correspond to diagnostic function messages (such as fault diagnosis requests, etc.).

[0049] To improve the reliability of data frame filtering operations, in one possible implementation, step S202 includes: performing data frame identification information filtering and data frame length filtering operations on the data frame according to a preset filtering strategy to obtain the filtered first data frame.

[0050] In other words, the data frame type in the preset filtering strategy can be determined by both the data frame length and the data frame identification information.

[0051] The data frame identification information has been described in detail above. The data frame length refers to the number of data bytes contained within the data frame.

[0052] For example, in CAN messages, the data frame typically contains a field that indicates the length of the data frame, such as the Data Length Code (DLC). In CAN messages, the data frame length is usually specified by the CAN ID, such as 0-8 bytes.

[0053] In practical applications, by verifying the length of the data frame, it is possible to effectively identify whether the data format meets expectations and to eliminate erroneous or malicious attack messages with abnormal data lengths (such as lengths of 0 or exceeding the preset range).

[0054] In one possible implementation, the order of the above filtering operations can be adjusted, such as the data frame length filtering operation first and the data frame identification information filtering operation later. This allows data frames that do not meet the length specifications to be quickly filtered out before the data frame identification information filtering operation, reducing the processing burden of the subsequent data frame identification information filtering operation and improving the overall filtering efficiency.

[0055] Of course, those skilled in the art can adjust the order of the above data frame length filtering operation and data frame identification information filtering operation according to actual needs, and the embodiments of this application do not impose specific restrictions on this.

[0056] In this embodiment, by combining data frame identification information and data frame length for verification, multi-dimensional filtering of data frames can be achieved, effectively compensating for the shortcomings of single-dimensional filtering operations and improving the reliability of the filtering operation. This provides a certain degree of information security protection, essentially preventing invalid or malicious data from flowing into subsequent processing flows, and improving the stability and security of the area controller's operation.

[0057] In practical applications, since the data frame length filtering operation can be regarded as an information security protection function, but it is usually implemented by the gateway routing domain module (software module), the filtering operation can be regarded as a combination of information security protection function and gateway routing function.

[0058] Of course, those skilled in the art can adjust the specific implementation of the above filtering operation according to actual needs, and the embodiments of this application do not impose specific limitations on this.

[0059] Step S203: Perform anomaly detection on the first data frame according to the preset detection rules to obtain a second data frame that passes the anomaly detection.

[0060] In practical applications, the first data frame obtained after the above filtering operations is usually considered a legitimate data frame, meaning that a routing mapping operation needs to be performed on the first data frame. However, this does not mean that the first data frame is completely free of security risks, i.e., the first data frame is not entirely compliant.

[0061] Therefore, in this embodiment, an anomaly detection operation is also required for the first data frame. That is, the first data frame is detected to see if it conforms to preset detection rules in terms of data frame transmission characteristics, data content, etc. First data frames that do not conform to the preset detection rules are filtered out, and second data frames that conform to the preset detection rules are obtained to continue to perform subsequent operations.

[0062] The preset detection rules are used to characterize the anomaly detection rules corresponding to the type of the first data frame. It is understood that different data frame types may correspond to different preset detection rules, or they may correspond to the same preset detection rule.

[0063] In practical applications, anomaly detection rules are usually pre-configured in the area controller. The anomaly detection rules to be used can be determined based on the type of the filtering operation mentioned above, and initialized when the area controller is powered on; alternatively, all anomaly detection rules can be fully initialized directly.

[0064] In this embodiment of the application, the preset detection rules may include preset protocol specifications, and the anomaly detection includes protocol specification detection. The data frame protocol specification detection is used to detect whether the protocol format of the first data frame conforms to the preset protocol specifications.

[0065] Specifically, protocol specification detection involves detecting the communication protocol format of the first data frame according to a preset protocol specification, such as detecting whether the frame structure of the first data frame conforms to the preset protocol specification.

[0066] For example, the protocol detection specification corresponding to the CAN message is the CAN protocol specification. CAN messages typically contain a fixed field structure such as start of frame, arbitration segment, control segment, data segment, and end of frame. The area controller can detect whether the first data frame has a complete frame structure and whether the order of the fields in the frame structure is correct.

[0067] Understandably, protocol specification testing can ensure the integrity and accuracy of data frames from the underlying communication protocol.

[0068] To improve the effectiveness of information security protection, one possible implementation is to limit the anomaly detection.

[0069] See Figure 3 This is a schematic diagram illustrating the correspondence between anomaly detection and preset detection rules provided in an embodiment of this application.

[0070] like Figure 3 As shown, anomaly detection includes transmission period detection, signal value range detection, and protocol specification detection. The preset detection rules include preset period constraints, preset value ranges, and preset protocol specifications.

[0071] The data frame protocol specification detection is used to check whether the protocol format of the first data frame conforms to the preset protocol specification. For details on data frame protocol specification detection, please refer to the above text; for the sake of brevity, it will not be repeated here.

[0072] Data frame transmission period detection is used to check whether the transmission period of the first data frame meets the preset period constraint. The preset period constraint is usually pre-configured in the area controller. The corresponding preset period constraint can be determined by the type of the first data frame, or a fixed preset period constraint can be used directly.

[0073] Specifically, for periodically transmitted messages on the vehicular network, the transmission time interval should remain relatively stable. To improve the reliability of periodic detection, in one possible implementation, the preset period constraint may include a preset period, a period tolerance range, and an anomaly confirmation threshold.

[0074] Specifically, for data frame types with periodic transmission characteristics, when the deviation between the actual transmission period of a data frame and the preset period exceeds the period tolerance range, a period anomaly can be recorded. If the number of period anomalies reaches the preset anomaly confirmation threshold, the data frame is determined to have failed the transmission period detection.

[0075] For example, for a certain data frame type, its preset period can be 10 milliseconds, and the period tolerance range can be set to ±5 milliseconds, meaning that an actual transmission period between 5 and 15 milliseconds is considered normal. The anomaly confirmation threshold can be set to three consecutive period anomalies. In other words, if the actual period of a data frame's three consecutive transmissions exceeds the range of 5 to 15 milliseconds, then the transmission period of that data frame is determined to be abnormal.

[0076] It should be noted that the specific values ​​of the above-mentioned periodic tolerance range (e.g., 5-50 milliseconds) and anomaly confirmation threshold (e.g., 2-5 times) can be adjusted according to factors such as the type of data frame, and this application embodiment does not impose specific restrictions on them.

[0077] Of course, the preset period constraint may also include only the standard transmission period, and this application embodiment does not impose specific restrictions on this.

[0078] Furthermore, the data frame signal value range detection is used to detect whether the signal values ​​in the first data frame belong to a preset value range. Specifically, the data segment of the first data frame typically contains one or more specific signal values, which correspond to various vehicle parameters (such as vehicle speed, voltage, temperature, etc.). The preset value range defines the reasonable range of values ​​allowed for each signal under normal operating conditions, such as from the minimum to the maximum value. If the signal in the data frame exceeds the preset value range, the signal value is determined to be abnormal, meaning that the data frame fails the anomaly detection.

[0079] In this embodiment of the application, by using the above three dimensions of anomaly detection, anomalies in the first data frame can be comprehensively identified, thereby improving the recognition rate of anomaly detection and the reliability of the information security protection function of the regional controller.

[0080] Meanwhile, the aforementioned anomaly detection does not require external AI computing power; real-time security detection of data frames can be achieved at the microcontroller level. Abnormal data frames can directly block subsequent routing operations, realizing a closed loop from anomaly detection and detection result determination to subsequent execution. Furthermore, the anomaly detection is implemented through software functional domains, which can fully utilize the existing microcontroller computing power and storage resources of the area controller without the need for additional independent security chips, making it suitable for cost-sensitive vehicle platforms.

[0081] In one possible implementation, the preset detection rules may also include a data frame rate constraint. The data frame rate constraint is used to detect whether the number of first data frames received per unit time exceeds a preset rate threshold. When the number of first data frames received per unit time exceeds the preset rate threshold, it may indicate that the vehicular network is under a denial-of-service attack, and in this case, the data frame can be determined to be abnormal.

[0082] Furthermore, it can be combined with pattern matching state machine detection based on the identifier information sequence of the first data frame, or with lightweight machine learning models to assist in anomaly detection.

[0083] In this embodiment, the above-mentioned anomaly detection steps are typically implemented by an information security protection domain module (software module). However, if it is a CAN message on a CAN bus, the above function can be implemented through a CAN bus intrusion detection system (IDS).

[0084] Of course, those skilled in the art can adjust the specific implementation of the above-mentioned anomaly detection according to actual needs, and the embodiments of this application do not impose specific limitations on this.

[0085] Step S204: Perform a routing mapping operation on the second data frame to obtain the vehicle control signal.

[0086] Specifically, the area controller can parse the second data frame and extract the signals carried therein, and according to a preset mapping relationship, convert the received second data frame (the instruction sent by the data frame sender) to generate vehicle control signals for controlling the vehicle's actuators.

[0087] Specifically, the area controller can parse the second data frame, extract the signals carried within, and, according to a preset mapping relationship, map and convert these signals from one network (e.g., the powertrain CAN bus) to the corresponding signals on another network (e.g., the body CAN bus). Through this signal-level routing and conversion, the area controller can obtain the vehicle control signals used to execute specific control commands.

[0088] In practical applications, the area controller can be pre-configured with a signal routing mapping table, which defines the correspondence between signals from different networks. The aforementioned routing mapping operation can be implemented by the gateway routing domain module in the area controller.

[0089] For example, the area controller can extract and convert a control signal (such as engine speed signal or gear signal) from the powertrain domain CAN bus (P-CAN) to the corresponding signal format of the body domain CAN bus (B-CAN). In the above process, the area controller is responsible for parsing the data field of the second data frame, extracting the specific signal value, and converting it according to the preset mapping rules to generate the vehicle control signal.

[0090] Of course, those skilled in the art can adjust the above routing mapping operations according to actual needs, and the embodiments of this application do not impose specific limitations on this.

[0091] Step S205: Control the vehicle according to the vehicle control signal.

[0092] In this embodiment of the application, based on the vehicle control signal generated by the above steps, the area controller can perform corresponding control functions on the vehicle according to the vehicle control signal.

[0093] In practical applications, this step can be implemented through the vehicle control domain module (software module) in the area controller.

[0094] For example, if the vehicle control signal is a door unlock signal, the area controller can drive the door lock motor to perform the unlocking action through the vehicle control domain module; if the vehicle control signal is a headlight turn-on signal, the area controller can control the headlight relay to close through the vehicle control domain module, thereby illuminating the corresponding headlight.

[0095] In this embodiment, a first data frame is obtained by filtering data frames on the vehicular network (gateway routing and information security protection function); an anomaly detection operation (information security protection function) is performed on the first data frame to obtain a second data frame; route mapping is performed on the second data frame (gateway routing function) to obtain vehicle control signals; and the vehicle is controlled according to the vehicle control signals (vehicle control function). This achieves the collaborative interaction and effective integration of gateway routing, information security protection, and vehicle control in the area controller. This reduces the number of hardware modules and network communication nodes, lowers the weight of the vehicle communication harness and the cost of the hardware controller, shortens the response delay caused by external communication between hardware modules, and improves the collaborative response speed.

[0096] In practical applications, to improve scenario adaptability, one possible implementation includes, before filtering the data frame according to a preset filtering strategy to obtain the filtered first data frame, the following steps are also included: Based on the vehicle's operating mode, determine the corresponding preset filtering strategy.

[0097] The operating modes include a first operating mode and a second operating mode. The number of data frame types filtered in the first operating mode is greater than that in the second operating mode.

[0098] In other words, the first operating mode corresponds to a stricter data access control strategy, where the area controller filters out more types of data frames and only allows a small number of critical types of data frames to pass through; while the second operating mode corresponds to a relatively lenient data access control strategy, allowing more types of data frames to pass through the filtering operation.

[0099] In practical applications, the first operating mode can be the factory mode, and the second operating mode can be the user mode.

[0100] Specifically, factory mode refers to the vehicle being in production line mode. In this mode, the area controller can monitor only a subset of data frames, such as diagnostic function data frames and basic vehicle control data frames (e.g., 10-30 frames). For example, if the vehicle network is a CAN network, the whitelist in the routing table only allows diagnostic CAN IDs (e.g., 0x7DF, 0x761, etc.) and vehicle control CAN IDs to be routed through the gateway. Similarly, subsequent anomaly detection will only be performed on the aforementioned subset of data frames.

[0101] In contrast, user mode refers to the normal usage mode after the vehicle is delivered to the user. In this mode, all types of data frames can be monitored and detected, including various functions required for daily driving, thus meeting the user's needs. Similarly, subsequent anomaly detection also needs to be performed on all types of data frames.

[0102] In practical applications, during the power-on initialization phase, the area controller can read the operating mode flag stored in the non-volatile memory (NVM) to determine the current operating mode of the vehicle.

[0103] In this embodiment, by setting different preset filtering strategies for different operating modes, the data access strategy can be flexibly adjusted according to the actual application scenario of the vehicle, avoiding the limitations of a single strategy in dealing with different scenarios and improving the scenario adaptability of the vehicle control method.

[0104] In practical applications, in order to ensure the security of the vehicle operating mode switching process and prevent unauthorized illegal switching behavior, in one possible implementation, if a request to switch the vehicle operating mode is received, the device that sent the request is authenticated. If the identity verification is successful, the vehicle operation mode will be switched.

[0105] Specifically, the request to switch vehicle operating modes is usually initiated by external diagnostic equipment, and the identity authentication operation can be implemented based on vehicle diagnostic communication protocols, such as the ISO 14229 Unified Diagnostic Service Protocol.

[0106] In this embodiment, the information security domain module in the area controller can interact with the requesting device through a challenge-response mechanism using a security authentication service defined in the protocol (such as the secure access service with diagnostic service identifier 0x29).

[0107] For example, the area controller generates a random number (challenge) and sends it to the requesting device. The requesting device uses its internal key to calculate the random number and returns the result (response). The area controller verifies the correctness of the calculation result to confirm the legitimate identity of the device.

[0108] In practical applications, identity authentication can also be replaced by authentication methods based on Public Key Infrastructure (PKI) certificate chains or dynamic password authentication methods based on time synchronization. This application embodiment does not impose specific restrictions on this.

[0109] In this embodiment of the application, by introducing an identity authentication mechanism before switching vehicle operating modes, illegal switching requests can be effectively intercepted, ensuring that the vehicle operating mode is effectively prevented from being maliciously tampered with throughout the entire life cycle of vehicle production, transportation, sales and user use.

[0110] To facilitate exception handling, in one possible implementation, if the first data frame fails the exception detection, the exception detection result corresponding to the first data frame is stored in the security log, and an alarm message is output.

[0111] The anomaly detection results can include abnormal data frames (which may include data frame identifiers and timestamps) and the anomaly type of the data frames, such as protocol format anomalies, transmission cycle anomalies, and value range anomalies. The anomaly detection results can be packaged into a log record and stored in the security log.

[0112] Furthermore, the security log may also include events such as authentication failure or failure to pass filtering operations during the above mode switching, and this application embodiment does not impose specific limitations on this.

[0113] While storing safety logs, the system can also output alarm messages to alert drivers or developers of abnormalities in the area controller. In practical applications, alarm messages can be output via instrument panel display control signals or by illuminating specific fault indicator lights.

[0114] In practical applications, security logs are stored in non-volatile memory, with a storage capacity of no less than 512 records, and a circular overwrite storage strategy can be adopted.

[0115] In this embodiment, storing anomaly information using a security log facilitates subsequent fault handling and security auditing. Outputting alarm messages helps remind users or area controllers to take appropriate action, improving the stability of the vehicle control method.

[0116] To enable remote monitoring and early warning of security status, if the vehicle is equipped with an in-vehicle network terminal (T-BOX) and its in-vehicle communication module is online, the area controller can compress security logs and upload them to the cloud server via the in-vehicle communication module. This allows the cloud platform to promptly obtain information on vehicle security attacks, facilitating big data analysis or remote security response.

[0117] For vehicles without a T-BOX or in offline scenarios, the method for obtaining safety logs can be flexibly configured. For example, the area controller can support periodic extraction of safety logs via an external diagnostic tool. Alternatively, it can establish a connection with a mobile terminal device via Bluetooth or Bluetooth Low Energy, allowing the safety logs to be uploaded to the cloud via the mobile terminal.

[0118] Understandably, the diverse log upload methods described above can adapt to the data interaction needs of different vehicle configurations and scenarios, thus improving the overall applicability of the solution.

[0119] To improve the real-time response to anomalies, one possible implementation involves detecting whether there are any unprocessed alarm messages when a network segment in the vehicle network meets preset sleep conditions; if there are unprocessed alarm messages, the sleep operation of the network segment is delayed.

[0120] Specifically, an in-vehicle network typically consists of multiple network segments, each interacting with data through a gateway interface within a region controller. Preset hibernation conditions refer to a network segment having no message interactions within a preset time period and meeting preset hibernation criteria (such as receiving a hibernation command).

[0121] When a network segment is about to hibernate, the area controller (such as the network management software module in the area controller) will first check if there are any unprocessed alarm messages (i.e., there are active security events). If so, the area controller will prevent the network segment from immediately entering hibernation, but will keep the network segment in the awake state for a preset time (such as 30 seconds).

[0122] In this embodiment of the application, by adopting network segment delay sleep, it is possible to avoid the failure to handle anomalies in a timely manner due to network segment sleep, thereby improving the real-time performance of anomaly response and the reliability of control.

[0123] The following explanation will focus on a passenger vehicle with a regional electronic and electrical architecture, which is equipped with a regional controller (ZCU).

[0124] Specifically, after powering on, the ZCU can initialize the vehicle control domain module, gateway routing domain module, and information security protection domain module sequentially or synchronously. Among them, the information security protection domain module reads the operating mode flag from the NVM and loads the corresponding preset filtering policies and preset detection rules.

[0125] When the vehicle is operating in factory mode, the ZCU only monitors a subset of CAN IDs, allowing only diagnostic IDs and basic body control IDs to pass through. After completing the required tests in factory mode, the mode is switched to user mode via authentication.

[0126] When the vehicle is operating in user mode, if an anomaly is detected in the CAN message cycle (i.e., the first data frame fails the anomaly detection), the anomaly detection result corresponding to the CAN message is stored in the safety log, and an alarm message is output to prevent its forwarding across network segments. Simultaneously, the area controller writes the abnormal event to the safety log. If the current vehicle is a T-BOX configured model and the onboard communication module is online, the safety log is compressed and uploaded to the cloud; for non-T-BOX models, the log can be retrieved via a diagnostic tool or Bluetooth.

[0127] To ensure the integrity of security incident handling, when a network segment in the vehicle network meets the preset sleep conditions, it checks for any unprocessed alarm messages. If such messages are found, the sleep operation of that network segment is delayed, and the relevant network segment remains awake for up to 30 seconds to complete the security incident handling.

[0128] Corresponding to the above embodiments, this application also provides a vehicle control device.

[0129] See Figure 4 This is a schematic diagram of the structure of a vehicle control device provided in an embodiment of this application. Figure 4 As shown, the vehicle control device 400 includes a data frame acquisition module 401, a filtering module 402, a detection module 403, a routing module 404, and a control module 405.

[0130] Specifically, the data frame acquisition module 401 is used to acquire data frames on the vehicle network.

[0131] The filtering module 402 is used to perform filtering operations on the data frame according to a preset filtering strategy to obtain a filtered first data frame. The preset filtering strategy is used to limit the type of the filtered data frame.

[0132] The detection module 403 is used to perform anomaly detection on the first data frame according to a preset detection rule to obtain a second data frame that passes the anomaly detection. The preset detection rule is used to characterize the anomaly detection rule corresponding to the type of the first data frame.

[0133] The routing module 404 is used to perform routing mapping operations on the second data frame to obtain vehicle control signals.

[0134] The control module 405 is used to control the vehicle according to the vehicle control signal.

[0135] Corresponding to the above embodiments, this application also provides a vehicle including a region controller, which is used to perform some or all of the steps in the above method embodiments.

[0136] Corresponding to the above embodiments, this application also provides an electronic device.

[0137] See Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 5 As shown, the electronic device 500 may include a processor 501, a memory 502, and a communication unit 503. These components communicate via one or more buses. Those skilled in the art will understand that the electronic device structure shown in the figure does not constitute a limitation on the embodiments of this application. It may be a bus topology or a star topology, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0138] The communication unit 503 is used to establish a communication channel, thereby enabling the electronic device to communicate with other devices.

[0139] The processor 501, serving as the control center of the electronic device, connects various parts of the electronic device 500 via various interfaces and lines. It executes software programs and / or modules stored in the memory 502, and calls data stored in the memory 502, to perform various functions and / or process data within the electronic device 500. The processor 501 can be composed of integrated circuits (ICs), such as a single packaged IC or multiple packaged ICs with the same or different functions connected together. For example, the processor 501 may consist only of a central processing unit (CPU). In this embodiment, the CPU may have a single processing core or include multiple processing cores.

[0140] Memory 502 is used to store the execution instructions of processor 501. Memory 502 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0141] When the execution instructions in memory 502 are executed by processor 501, the electronic device 500 is able to perform some or all of the steps in the above method embodiments.

[0142] Corresponding to the above embodiments, this application also provides a computer-readable storage medium, wherein the computer-readable storage medium may store a program, wherein when the program runs, it can control the device where the computer-readable storage medium is located to execute some or all of the steps in the above method embodiments. In specific implementation, the computer-readable storage medium may be a disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0143] Corresponding to the above embodiments, this application also provides a computer program product containing executable instructions that, when executed on a computer, cause the computer to perform some or all of the steps in the above method embodiments.

[0144] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, the simultaneous existence of A and B, or the existence of B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects have an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, and c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0145] Those skilled in the art will recognize that the units and algorithm steps described in the embodiments disclosed herein can be implemented using electronic hardware, computer software, or a combination of electronic hardware and software. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0146] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0147] In the several embodiments provided in this application, any function, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, read-only memory (ROM) or random access memory (RAM), a magnetic disk, or an optical disk.

[0148] The above description is merely a specific embodiment of this application. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application. The protection scope of this application shall be determined by the scope of the appended claims.

Claims

1. A vehicle control method, characterized in that, Applied to a region controller, the method includes: Acquire data frames from the vehicle network; The data frame is filtered according to a preset filtering strategy to obtain a filtered first data frame. The preset filtering strategy is used to limit the type of the filtered data frame. According to the preset detection rules, the first data frame is subjected to anomaly detection to obtain a second data frame that passes the anomaly detection. The preset detection rules are used to characterize the anomaly detection rules corresponding to the type of the first data frame. Perform a routing mapping operation on the second data frame to obtain the vehicle control signal; The vehicle is controlled according to the vehicle control signal.

2. The method according to claim 1, characterized in that, The anomaly detection includes transmission period detection, signal value range detection, and protocol specification detection. The preset detection rules include preset period constraints, preset value ranges, and preset protocol specifications. The data frame transmission period detection is used to detect whether the transmission period of the first data frame meets the preset period constraint, the data frame signal value range detection is used to detect whether the signal value in the first data frame belongs to the preset value range, and the data frame protocol specification detection is used to detect whether the protocol format of the first data frame conforms to the preset protocol specification.

3. The method according to claim 1, characterized in that, Before performing a filtering operation on the data frame according to a preset filtering strategy to obtain the filtered first data frame, the process further includes: Determine the corresponding preset filtering strategy based on the vehicle's operating mode; The operating mode includes a first operating mode and a second operating mode, wherein the number of data frame types filtered in the first operating mode is greater than that in the second operating mode.

4. The method according to claim 3, characterized in that, Also includes: If a request to switch vehicle operating modes is received, the device that sent the request will be authenticated. If the identity verification is successful, the vehicle operation mode will be switched.

5. The method according to claim 1, characterized in that, The step of filtering the data frame according to a preset filtering strategy to obtain a filtered first data frame includes: According to the preset filtering strategy, the data frame is subjected to data frame identification information filtering operation and data frame length filtering operation to obtain the filtered first data frame.

6. The method according to claim 1, characterized in that, Also includes: If the first data frame fails the anomaly detection, the anomaly detection result corresponding to the first data frame is stored in the security log, and an alarm message is output.

7. The method according to claim 6, characterized in that, Also includes: When the network segment in the vehicle network meets the preset sleep conditions, check for any unprocessed alarm messages. If there are unprocessed alarm messages, the hibernation operation of the network segment will be delayed.

8. A vehicle control device, characterized in that, include: The data frame acquisition module is used to acquire data frames on the vehicle network; A filtering module is used to perform filtering operations on the data frame according to a preset filtering strategy to obtain a filtered first data frame. The preset filtering strategy is used to limit the type of the filtered data frame. The detection module is used to perform anomaly detection on the first data frame according to the preset detection rules, and obtain a second data frame that passes the anomaly detection. The preset detection rules are used to characterize the anomaly detection rules corresponding to the type of the first data frame. The routing module is used to perform routing mapping operations on the second data frame to obtain vehicle control signals; The control module is used to control the vehicle according to the vehicle control signal.

9. A vehicle, characterized in that, include: A region controller, the region controller being used to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 7.

Images