A can bus adaptive key refresh system and method for in-vehicle and out-of-vehicle cooperative defense

Abstract

The application provides a CAN bus adaptive key refreshing system and method for in-vehicle and out-vehicle cooperative defense, comprising: obtaining security event information of a vehicle external network through an out-vehicle intrusion detection system, and obtaining CAN bus communication flow characteristics through an in-vehicle CAN bus intrusion detection system, to generate an out-vehicle risk score and an in-vehicle risk score respectively, obtain a comprehensive risk score, and perform smoothing processing on the comprehensive risk score to obtain a smoothed comprehensive risk score; based on the smoothed comprehensive risk score, dynamically adjusting a refreshing strategy of a group key to complete CAN bus adaptive key refreshing. Compared with the prior art, the application can dynamically adjust the key refreshing strategy according to the current safety state of the vehicle, improve the resistance of the CAN bus to replay attacks, fake attacks and denial of service attacks, while maintaining low communication overhead and high real-time performance, and is suitable for intelligent networked vehicle CAN bus security protection scenarios.

Description

Technical Field

[0001] This invention belongs to the field of vehicle network security technology, specifically relating to a CAN bus adaptive key refresh system and method for collaborative defense between vehicle interiors and exteriors. Background Technology

[0002] With the rapid development of intelligent connected vehicles and vehicle-to-everything (V2X) technology, automobiles are gradually evolving from traditional transportation tools into intelligent terminals integrating perception, communication, computing, and control. Modern vehicles typically deploy dozens or even hundreds of Electronic Control Units (ECUs). These ECUs interact via a Controller Area Network (CAN) bus, jointly supporting key functions such as powertrain control, chassis control, body control, and intelligent driving. Due to its advantages of high real-time performance, strong reliability, and low deployment cost, the CAN bus remains the most widely used communication protocol in in-vehicle networks and a crucial infrastructure for the transmission of core control information in intelligent vehicles.

[0003] However, the CAN protocol originated in the relatively closed automotive environment, with its design primarily focused on communication efficiency and real-time performance, while neglecting network security. The protocol itself lacks security mechanisms such as authentication, data encryption, and access control, making it difficult for nodes in the network to verify the authenticity of message origins. Once an attacker gains network access, they can disrupt normal communication through message replay, identity forgery, malicious injection, and denial-of-service attacks, thereby affecting the stable operation of critical vehicle functions. Recent security studies targeting intelligent vehicles have shown that the CAN bus has gradually become a significant target for in-vehicle network attacks.

[0004] Meanwhile, with the increasing integration of wireless communication technologies such as V2X, 5G, WiFi, and Bluetooth into smart cars, information interaction between vehicles and the external environment is becoming increasingly frequent. Attack paths have also expanded from traditional in-vehicle physical access to remote wireless access. Attackers may enter the in-vehicle network through the OBD interface, or they may launch attacks using the in-vehicle entertainment system, remote communication modules, or V2X interfaces. In this context, vehicle security issues are no longer limited to the in-vehicle network itself, but have gradually evolved into collaborative security issues involving both the in-vehicle control domain and the external communication domain.

[0005] To address CAN bus security threats, researchers have proposed various protection schemes, including authentication mechanisms, intrusion detection, and group key management. Among them, HIPCAM (High Performance CAN Authentication Mechanism) utilizes the remaining fields in the HMAC authentication code to update the group key, achieving lightweight authentication and key management without adding extra communication messages. It balances real-time performance with security, thus possessing high application value. However, current research indicates that HIPCAM remains a typical fixed-policy key management mechanism. Its key refresh process primarily relies on communication processes and lacks awareness of the current network security status. When the system faces replay attacks, spoofing attacks, or denial-of-service attacks, the key update strategy cannot dynamically adjust according to changes in risk, limiting its proactive defense capabilities.

[0006] On the other hand, the current vehicle-to-everything (V2X) security system has gradually formed a basic framework of "external vehicle security monitoring + internal vehicle intrusion detection," but the two types of security systems mostly operate independently, and risk information lacks effective linkage. External detection systems can detect abnormal communication behavior, and internal detection systems can identify CAN bus attacks, but the detection results are often only used for alarms and are difficult to further drive the dynamic adjustment of security protection strategies. This "separation of detection and defense" model limits the security mechanism's ability to respond to complex attack scenarios.

[0007] Therefore, how to integrate information on security incidents inside and outside the vehicle, build a unified risk perception and assessment mechanism, and directly apply the risk assessment results to the group key management process to achieve attack perception-driven adaptive key refresh, thereby improving the proactive defense capability of the CAN bus in complex vehicle networking environments, has become an important direction worthy of further exploration in current vehicle networking security research. Summary of the Invention

[0008] To overcome the shortcomings of existing HIPCAM group key management mechanisms, such as lack of attack detection capabilities, fixed key refresh strategies, and lack of coordinated operation between in-vehicle and external security systems, this invention proposes a CAN bus adaptive key refresh system for collaborative in-vehicle and external defense. Based on the lightweight HIPCAM group key management mechanism, this system introduces an in-vehicle and external collaborative risk assessment mechanism. It unifies the modeling of security events generated by external communication networks with in-vehicle CAN bus detection results, and dynamically adjusts the group key refresh strategy based on the comprehensive risk assessment results. This achieves attack-aware-driven adaptive key management, improving the vehicle's ability to resist replay attacks, identity spoofing attacks, and malicious message injection attacks while ensuring real-time CAN bus communication performance.

[0009] To achieve the above objectives, the present invention provides the following technical solution: An adaptive key refresh system for CAN bus for collaborative defense between vehicle interiors and exteriors includes: The in-vehicle and out-of-vehicle scoring acquisition module is used to acquire security event information of the vehicle's external network through the external intrusion detection system and to acquire CAN bus communication traffic characteristics through the in-vehicle CAN bus intrusion detection system, so as to generate external risk scores and in-vehicle risk scores respectively. The comprehensive score calculation module is used to merge the external risk score and the internal risk score to obtain a comprehensive risk score, and to smooth the comprehensive risk score to obtain a smoothed comprehensive risk score. An adaptive key refresh module is used to dynamically adjust the group key refresh strategy based on a smoothed comprehensive risk score to complete the adaptive key refresh of the CAN bus. The refresh strategy includes adjusting the key refresh cycle according to the risk level and introducing a risk disturbance factor during the key update process to generate a new group key.

[0010] Preferably, the process of generating an external risk score includes: The system collects raw observation information from the vehicle's external network via an external communication module and receives external security alarm information from a cloud-based security platform. This raw observation information and external security alarm information are then sent to an external intrusion detection system for anomaly identification. The onboard gateway performs event deduplication, time alignment, format standardization, credibility filtering, and risk value normalization to form standardized external security event information, thus constructing a set of external risk events. This standardized external security event information includes abnormal V2X communication events, unauthorized wireless access events, abnormal remote connection events, remote attack events, and cloud-based security alarm events. For each type of external vehicle safety incident, the degree of danger is evaluated from four dimensions: the impact of the safety incident on the vehicle's key functions, the possibility of propagation to the in-vehicle CAN bus, the degree of attack exploitability, and the scope of impact. The evaluation results are then normalized to construct a set of risk event weights. The external risk score is calculated by weighting and summing the risk event weight set and the external risk event set.

[0011] Preferably, the process of generating an in-vehicle risk score includes: Real-time monitoring of in-vehicle CAN bus communication traffic; CAN messages are divided according to a sliding time window; and the abnormality of CAN identifier, abnormality of message transmission frequency, abnormality of communication cycle, and abnormality of data payload are extracted as key features. All key features are calculated based on the communication baseline pre-established under normal vehicle operation. The weight coefficients of each key feature are dynamically determined based on the detection sensitivity of each key feature to typical CAN attacks and the degree of impact on key vehicle functions. The basic in-vehicle risk score is calculated by weighted summation. The information entropy of each packet is calculated by grouping according to the CAN identifier. The entropy offset of each packet relative to the normal baseline and the entropy change between adjacent time windows are calculated respectively. The in-vehicle entropy anomaly score is obtained by weighting and summing the data according to the importance of the vehicle function corresponding to each packet. The in-vehicle entropy anomaly score is used as a risk correction term and then superimposed on the basic in-vehicle risk score and normalized to obtain the optimized in-vehicle risk score.

[0012] Preferably, the process of adjusting the key refresh cycle according to the risk level includes: Based on the smoothed comprehensive risk score, segmented risk driving factors are constructed according to the preset first risk threshold and second risk threshold. Using the risk-driving factor as the denominator and the default key refresh period as the numerator, the dynamic key refresh period is calculated. The dynamic key refresh period is negatively correlated with the comprehensive risk score and is not lower than a preset lower limit.

[0013] Preferably, the process of generating a new group key includes: The smoothed comprehensive risk score is then quantified using a fixed-length method to obtain a quantified risk value. The quantified risk value is concatenated with the current key version number, communication group identifier and the scheduled effective time of the new key, and then mapped through a hash function and truncated into a bit sequence of the same length as the group key to generate a risk disturbance value. Based on the HIPCAM group key update formula, the aforementioned risk perturbation value is XORed to generate a new group key: , in, Represents a hash mapping function; This is the current group key. This indicates the updated HIPCAM value generated during the current authentication phase. This represents the risk disturbance value.

[0014] Preferably, it also includes a key management module for performing group key storage, key update value generation, key version management, key synchronization switching, and key synchronization failure recovery: The vehicle gateway and each electronic control unit in the same communication group are respectively set with a current key slot and a key slot to be activated. The current key slot is used to store the current group key and version number, and the key slot to be activated is used to store the group key to be activated, version number, and scheduled activation time. After the vehicle gateway generates a new group key, it sends an authenticated key synchronization instruction to all electronic control units in the same communication group. The synchronization instruction includes the communication group identifier, the new key version number, the quantified risk value, and the scheduled effective time. There is no need to transmit the complete group key. After receiving the synchronization command, each electronic control unit verifies the integrity of the command and the continuity of the version number. Then, based on the same quantified risk value, the current key version number, the communication group identifier, and the scheduled effective time, it independently calculates the risk disturbance value and generates a new group key in the key slot to be effective. When the local clock reaches the predetermined effective time, each electronic control unit synchronously switches to the new group key; within the preset transition time window, both the old and new versions of the group key are retained for message authentication, and the old group key is deleted after the transition time window ends. The group key synchronization time is made shorter than the actual key refresh cycle to ensure that all electronic control units complete synchronization before the next round of key refresh; When the electronic control unit detects that the key version is not continuous, the synchronization command verification fails, or the update is not completed within the specified time, it sends a resynchronization request to the vehicle gateway, which then resends the current version information and synchronization parameters through the certified recovery channel.

[0015] Preferably, it also includes a communication group dynamic reconfiguration step: When the smoothed comprehensive risk score continues to exceed the preset danger threshold, the original communication group is dynamically reconstructed based on the current comprehensive risk score. The electronic control units corresponding to power control, braking control and steering control are divided into high-security communication groups, and the electronic control units corresponding to the in-vehicle entertainment system and comfort control module are divided into ordinary communication groups. New group keys are generated for different communication groups to achieve secure isolation between critical control systems and non-critical systems.

[0016] This invention also provides a CAN bus adaptive key refresh method for collaborative defense between vehicle interiors and exteriors, used in the system described above, comprising: Security event information of the vehicle's external network is obtained through the external intrusion detection system, and CAN bus communication traffic characteristics are obtained through the in-vehicle CAN bus intrusion detection system, so as to generate external risk scores and in-vehicle risk scores respectively. The external risk score and the internal risk score are merged to obtain a comprehensive risk score, and the comprehensive risk score is smoothed to obtain a smoothed comprehensive risk score. Based on the smoothed comprehensive risk score, the group key refresh strategy is dynamically adjusted to complete the CAN bus adaptive key refresh; the refresh strategy includes adjusting the key refresh cycle according to the risk level and introducing a risk disturbance factor during the key update process to generate a new group key.

[0017] Compared with existing technologies, the beneficial effects of this invention are as follows: Based on the lightweight HIPCAM group key management mechanism, this invention introduces an in-vehicle and out-of-vehicle collaborative risk assessment model and an Adaptive HIPCAM adaptive key refresh mechanism, realizing integrated collaborative defense of comprehensive risk assessment, dynamic key refresh, group key synchronization, and communication group reconfiguration. Compared with existing HIPCAM mechanisms, this invention can dynamically adjust the key management strategy according to the real-time risks of the vehicle, improve the randomness of the group key, shorten the attack window, and enhance the vehicle's ability to resist replay attacks, identity spoofing attacks, and malicious message injection attacks without increasing the CAN bus communication load, while maintaining good real-time performance and engineering application value. Attached Figure Description

[0018] To more clearly illustrate the technical solution of the present invention, the drawings used in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a system architecture diagram of an embodiment of the present invention; Figure 2 This is a flowchart of a method according to an embodiment of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] Example 1 like Figure 1As shown, after vehicle startup, the communication group is first initialized, assigning initial group keys to the Electronic Control Units (ECUs) within the same communication group, and establishing information exchange relationships between the external communication domain, the vehicle gateway, and the in-vehicle CAN bus. The external communication domain includes V2X communication modules, cellular communication modules, WiFi modules, Bluetooth modules, and a cloud security platform; the in-vehicle communication domain mainly includes multiple ECUs such as those for the powertrain, chassis, body, and in-vehicle entertainment systems, completing data exchange via the CAN bus to provide the basic operating environment for subsequent risk perception and dynamic group key management.

[0023] An adaptive key refresh system for CAN bus-based collaborative defense between vehicle and external environments includes: an internal / external environment score acquisition module, a comprehensive score calculation module, and an adaptive key refresh module. The internal / external environment score acquisition module and the comprehensive score calculation module together constitute... Figure 1 The risk assessment module. The adaptive key refresh module is... Figure 1 The AdaptiveHIPCAM control module in [the system].

[0024] The in-vehicle and out-of-vehicle scoring acquisition module is used to acquire security event information of the vehicle's external network through the external intrusion detection system and to acquire CAN bus communication traffic characteristics through the in-vehicle CAN bus intrusion detection system, so as to generate external risk scores and in-vehicle risk scores respectively.

[0025] A further implementation method includes generating an external risk score by: The system utilizes V2X, cellular, WiFi, and Bluetooth modules within the vehicle's external communication domain to collect raw observation information such as communication messages, connection status, and access logs from external networks, and receives external security alerts from the cloud-based security platform. The communication modules are primarily responsible for basic data collection; the raw observation information they collect cannot be directly used as input for external risk scoring.

[0026] The raw observation information and external security alarm information are sent to the vehicle-to-everything (V2X) intrusion detection system for anomaly identification. The vehicle gateway then performs event deduplication, time alignment, format standardization, credibility filtering, and risk value normalization to form standardized V2X security event information that can be used for risk calculation. These standardized V2X security events include abnormal V2X communication events, unauthorized wireless access events, abnormal remote connection events, remote attack events, and cloud-based security alarm events.

[0027] Based on the processed and standardized external vehicle safety event information, a set of external vehicle risk events is constructed: in, Let represent the standardized risk value of the i-th type of external vehicle safety event after anomaly identification and preprocessing, and let n represent the number of categories of external vehicle safety events, satisfying the following: , in, The value is determined based on the attack intensity, duration, alarm reliability, and impact range of the corresponding security event. The higher the risk value, the greater the threat posed to vehicle safety by this type of external security event.

[0028] Based on the set of external vehicle risk events, the degree of danger of different types of external vehicle safety events is quantified, and a set of risk event weights is constructed based on the quantification results. Specifically, the degree of danger of various external vehicle safety events is evaluated from four aspects: the degree of impact of safety events on key vehicle functions, the possibility of propagation to the in-vehicle CAN bus, the degree of exploitability of attacks, and the scope of impact.

[0029] Let the critical functional impact, in-vehicle propagation potential, attack exploitability, and impact range of the i-th type of external vehicle security incident be as follows: , , and All evaluation indicators have been normalized, and their values ​​range from [value range missing]. The degree of danger of the i-th type of external vehicle safety incident Represented as: , in, , , and These represent adjustment coefficients corresponding to the degree of impact on critical functions, the possibility of propagation within the vehicle, the exploitability of the attack, and the scope of impact, respectively, and satisfy the following conditions: The evaluation metrics include: Critical Function Impact Level (CFM) indicates the degree of impact of a security event on vehicle power control, braking control, steering control, and body control; In-Vehicle Propagation Probability (ICP) indicates the possibility that an attack could further penetrate the vehicle's CAN bus via the onboard gateway; Attack Exploitability (APOP) indicates the ease with which an attacker could exploit the security event to gain further access or control of the vehicle; and Impact Scope (ASP) indicates the number of communication modules, electronic control units, and vehicle functions that the security event might affect. These evaluation metrics can be determined based on preset security rules, historical attack data, and expert experience.

[0030] Based on the degree of danger of various types of external vehicle safety incidents, they are normalized to obtain the risk weight corresponding to the i-th type of external vehicle safety incident: Therefore, a weighted set of external risk events is constructed: And satisfy: .

[0031] The higher the degree of danger of an external safety event, the greater its risk weight. Safety events that may affect the vehicle gateway, power control, braking control, or steering control, and have the ability to propagate to the in-vehicle CAN bus, are assigned a higher risk weight; safety events that only affect ordinary information services and are difficult to propagate to the in-vehicle control domain are assigned a lower risk weight.

[0032] Based on the weighted set of external risk events and the set of external risk events, calculate the vehicle's current comprehensive external risk score: in, This represents the standardized event value obtained after anomaly identification and preprocessing for the i-th type of external vehicle safety event within the current detection time window. It is used to reflect the frequency of occurrence, duration, attack intensity, and alarm reliability of this type of event. This represents the risk weight corresponding to the i-th type of external vehicle safety event, used to reflect the importance of this type of event to vehicle safety; This represents the overall risk score of the vehicle's current external communication environment. The higher the score, the greater the risk of the vehicle being subjected to external cyberattacks and the further propagation of such attacks into the vehicle's control domain. If no valid external security incidents are detected within the current detection window, the overall external risk score will be adjusted. Set to 0.

[0033] A further implementation method includes generating an in-vehicle risk score by: Real-time monitoring of in-vehicle CAN bus communication traffic, and categorized by length. The sliding time window is used to divide CAN messages. For each type of CAN message appearing in the current time window, information such as CAN identifier, message timestamp, data length, and data payload is obtained. Based on the communication baseline pre-established under normal vehicle operation, the abnormality of CAN identifier, message transmission frequency, communication cycle, and data payload are calculated respectively.

[0034] Under normal vehicle operation, a set of valid CAN identifiers is established based on historical CAN communication data, and the reference transmission frequency, standard deviation of transmission frequency, reference communication period, and data payload statistical parameters corresponding to each type of CAN identifier are statistically analyzed. Let the set of valid CAN identifiers be: in, Indicates the number of valid CAN identifiers. For the current time window... For CAN-like messages, if their CAN identifier belongs to the set of valid CAN identifiers, and the sending node corresponding to the identifier conforms to a preset mapping relationship with the communication domain, then their identifier abnormality level is set to 0; otherwise, it is set to 1. Let the current time window contain the first... The number of CAN-type messages is Therefore, its actual transmission frequency is: Let the reference transmission frequency and the standard deviation of the transmission frequency for this type of message be respectively... and The degree of abnormality in the transmission frequency is: in, This is the transmission frequency deviation adjustment coefficient. A very small positive number is set to prevent the denominator from being zero. The greater the deviation between the actual transmission frequency and the reference transmission frequency, the... The closer it is to 1.

[0035] Furthermore, the message arrival time interval is calculated based on the timestamps of two consecutive frames of messages with the same CAN identifier, and the median of the arrival time intervals within the current time window is used as the actual communication period. Let the actual communication period and the reference communication period be respectively... and The degree of communication cycle anomaly is: in, This is the communication cycle deviation adjustment coefficient. When the actual communication cycle deviates significantly from the reference communication cycle, it indicates that the message may exhibit abnormal behavior such as replay, delay injection, message blocking, or high-frequency transmission.

[0036] Furthermore, let the first The data payload length of a CAN-like message is The current message number The payload value of 1 byte The corresponding mean and standard deviation of the normal load are respectively and The anomaly level of the data load is then: in, This is the data load deviation adjustment factor. The greater the deviation between the data load and the normal historical distribution, the more... The closer it is to 1.

[0037] For all CAN identifiers appearing within the current time window, the maximum value of the anomaly severity corresponding to each type of message is selected as the overall anomaly characteristic of the CAN bus: in, This represents the set of CAN identifiers appearing within the current time window. This is used to construct a set of in-vehicle risk features: All of the above features are normalized to The larger the range and the larger the characteristic value, the greater the degree to which the corresponding CAN communication behavior deviates from the normal operating state.

[0038] The weighting coefficients of each key feature are determined based on its detection sensitivity to typical CAN attacks and its impact on critical vehicle functions. For each feature... The detection sensitivity is calculated using historically labeled attack samples: in, and These respectively represent the features used. The number of detected attack samples and the number of missed attack samples. Let the features be... The influence coefficient on key functions such as power, braking, steering and body control is Its value is mapped to the preset vehicle functional safety level. If the range is defined, then the feature importance is: in, In this embodiment, we take The importance of each feature is normalized to obtain the dynamic weights: make , , , Then it satisfies The basic in-vehicle risk score is expressed as follows: To avoid mutual cancellation between different CAN identifiers when using a single global information entropy, this invention employs a timing entropy offset calculation method grouped by CAN identifier. For the first... CAN-like messages encode the data payload into Let there be discrete states, and let state... The probability of occurrence within the current time window is Then the current information entropy is: Let the baseline information entropy of this type of message under normal operating conditions be... The information entropy of the previous time window is Then the first The temporal entropy offset of the message type is: in, As the adjustment coefficient for baseline offset and short-term changes, in this embodiment, we take... Let the first... The importance coefficient of the vehicle function corresponding to the type of message is Then its normalized weight is The in-vehicle entropy anomaly score is represented as follows: Using the in-vehicle entropy anomaly score as a risk correction term, the optimized in-vehicle risk score is obtained: in, This is the entropy anomaly correction coefficient. This method simultaneously considers the entropy offset of each CAN identifier relative to the normal baseline and the entropy changes between adjacent time windows, which can reduce the risk of missed detections caused by the mutual cancellation of different message distributions.

[0039] The comprehensive risk calculation module is used to fuse external and internal risk scores to obtain a comprehensive risk score, and then smooth the comprehensive risk score to obtain a smoothed comprehensive risk score. More specifically, to solve the problem that traditional HIPCAM only updates keys based on the in-vehicle communication status, this invention proposes an in-vehicle and external collaborative risk fusion method, which unifies the modeling of external and internal risk scores to form a comprehensive vehicle risk score. The comprehensive risk calculation method is as follows: in, This represents the external risk weight, with a value range of 0 ≤ ≤1. When the vehicle is in an open road environment and frequently engages in V2X communication, the external risk weight should be appropriately increased; when the vehicle is in a closed environment or has limited wireless communication, the internal risk weight should be increased, so that the comprehensive risk assessment is more consistent with the actual operating status of the vehicle.

[0040] To avoid misjudgments caused by transient abnormal events, this invention employs an Exponential Moving Average (EMA) algorithm to smooth the comprehensive risk score, and its update method is as follows: in, This represents the smoothed overall risk score at the current moment. The smoothing coefficient satisfies The EMA algorithm can effectively reduce risk fluctuations caused by occasional anomalies and improve the stability and reliability of risk assessment results.

[0041] More specifically, the vehicle safety status is quantitatively classified based on the smoothed comprehensive risk score. In this embodiment, the first risk threshold is set to T1=0.30, and the second risk threshold is set to T2=0.70. When 0≤smoothed comprehensive risk score<0.30, the system is in a normal state and maintains the default HIPCAM refresh cycle; when 0.30≤smoothed comprehensive risk score<0.70, the system is in a vigilant state and shortens the group key refresh cycle; when 0.70≤smoothed comprehensive risk score≤1, the system is in a dangerous state and enters active defense mode.

[0042] The adaptive key refresh module is used to dynamically adjust the group key refresh strategy based on the smoothed comprehensive risk score to complete the adaptive key refresh of the CAN bus. The refresh strategy includes adjusting the key refresh cycle according to the risk level and introducing a risk disturbance factor during the key update process to generate a new group key.

[0043] A further implementation method includes adjusting the key refresh cycle according to the risk level, comprising: Based on the smoothed comprehensive risk score, a risk driving factor is constructed; the default key refresh cycle is then modified based on the risk driving factor to obtain a dynamic key refresh cycle, which is negatively correlated with the comprehensive risk score.

[0044] More specifically, after completing the comprehensive risk assessment of the vehicle's interior and exterior, this invention will smooth the comprehensive risk score. This serves as the input to the Adaptive HIPCAM control module (i.e., the adaptive key refresh module). The smoothed comprehensive risk score has been normalized to... In this embodiment, the first risk threshold and the second risk threshold are respectively set to the range. and Based on this, a continuous segmented risk driver factor is constructed: in, This represents the risk driver. When... hour, The system is in normal condition; when hour, The system is in a state of alert; when hour, The system is in a dangerous state. Therefore, a clear quantitative correspondence is established between the risk state and the key refresh strength.

[0045] Set the default key refresh period for HIPCAM to be... The actual key refresh cycle is then expressed as: Therefore, under normal conditions Under alert status In dangerous situations As the comprehensive risk score increases, the actual key refresh cycle continuously shortens, and the shortest is no less than [a certain value]. This avoids the impact of unlimitedly increasing the refresh rate on the real-time performance of the CAN bus.

[0046] A further implementation method includes generating a new group key by: The traditional HIPCAM mechanism generates the next round's group key by performing a bitwise XOR operation between the current group key and the HIPCAM update value generated in the current authentication phase. The group key update formula is as follows: in, Indicates the current group key. This represents the HIPCAM update value generated during the current authentication phase, and ⊕ indicates a bitwise XOR operation. The above formula relies only on the current group key and the HIPCAM update value, and does not incorporate the vehicle's real-time risk status into the group key generation process.

[0047] Based on the traditional HIPCAM group key update formula, this invention performs fixed-length quantization on the smoothed comprehensive risk score and generates a risk disturbance value by combining the key version number, communication group identifier, and key activation time. This ensures that each electronic control unit within the same communication group receives consistent key update input. Let the risk quantization bit length be... The quantified risk value is: In this embodiment, the following is taken Let the current key version number be... The communication group identifier is The new key is scheduled to take effect at [time]. The risk disturbance value is then expressed as: in, Represents a hash mapping function. This means truncating the hash result to the same value as the group key. Bit length, This indicates data concatenation. The improved group key update formula is: in, This is the current group key. This is the HIPCAM update value generated during the current authentication phase. Because the risk disturbance value is simultaneously bound to the risk status, key version, communication group, and effective time, even if different communication groups generate the same HIPCAM update value at close range, the generated new group keys will still be different.

[0048] Furthermore, Figure 1 The key management module shown is used to perform group key storage, key update value generation, key version management, key synchronization switching, and key synchronization failure recovery. The vehicle gateway and each electronic control unit (ECU) within the same communication group each have a current key slot and a pending key slot. The current key slot stores the current group key and its version number, while the pending key slot stores the new group key, the new key version number, and the scheduled effective time. The vehicle gateway generates a pending group key based on the current group key, HIPCAM update value, quantified comprehensive risk score, communication group identifier, new key version number, and scheduled effective time, and sends an authenticated key synchronization command to each ECU within the communication group. After verifying the integrity and version number continuity of the synchronization command, each ECU independently generates a pending group key based on the same parameters and synchronously completes the key switch when the scheduled effective time arrives. During a preset transition time window, the system retains both the old and new versions of the group key for message authentication; after the transition time window ends, the old group key is deleted. When the electronic control unit detects that the key version is not continuous, the synchronization command verification fails, or the update is not completed within the specified time, it sends a resynchronization request to the vehicle gateway, which then resends the current version information and synchronization parameters through the certified recovery channel.

[0049] Specifically, the vehicle gateway and each electronic control unit are each configured with a current key slot and a pending key slot. The current key slot is used for storage. and version number The key slot to be activated is used to store... Version number and effective date After generating a new group key, the vehicle gateway sends an authenticated key synchronization command to each electronic control unit within the communication group. The synchronization command includes at least the communication group identifier. New key version number Quantitative risk value and effective date No need to transmit the complete group key.

[0050] After receiving the key synchronization command, each electronic control unit first verifies the integrity of the command and the continuity of the version number, and then, based on the same... , , and Independently calculate risk disturbance value And generate in the key slot to be activated When the local clock reaches At that time, each electronic control unit synchronously switches to the new group key. (The key has a length of...) During the transition window, both the old and new versions of the key are retained for authentication; after the transition window ends, the old group key is deleted. The group key synchronization process satisfies the following: in, This indicates the time from when the vehicle gateway sends a synchronization command to when all electronic control units (ECUs) in the communication group complete the calculation of the key to be effective. If an ECU detects that the key version is not continuous, the synchronization command verification fails, or the update is not completed within the specified time, it sends a resynchronization request to the vehicle gateway. The vehicle gateway then resends the current version information and synchronization parameters through the authenticated recovery channel to avoid CAN message authentication failure due to key synchronization issues.

[0051] More specifically, when the comprehensive risk score continuously exceeds a preset danger threshold, this invention activates a dynamic communication group reconfiguration mechanism. Let the vehicle's original communication group be represented as: The system re-divides communication groups based on the current comprehensive risk score, and the re-division method is expressed as follows: in, This represents the communication group reconfiguration function. When a vehicle is subjected to a high-risk attack, the system divides critical ECUs such as power control, braking control, and steering control into a high-security communication group, and the in-vehicle entertainment system and comfort control module into a normal communication group, and generates new group keys for each group. This limits the propagation of attacks between different communication domains and improves the security isolation capability of critical control systems.

[0052] In summary, this invention, based on the lightweight HIPCAM group key management mechanism, introduces an in-vehicle and out-of-vehicle collaborative risk assessment model and an Adaptive HIPCAM adaptive key refresh mechanism, achieving integrated collaborative defense encompassing comprehensive risk assessment, dynamic key refresh, group key synchronization, and communication group reconfiguration. Compared to existing HIPCAM mechanisms, this invention can dynamically adjust the key management strategy according to the vehicle's real-time risks, improving group key randomness, shortening the attack window, and enhancing the vehicle's ability to resist replay attacks, identity spoofing attacks, and malicious message injection attacks without increasing the CAN bus communication load, while maintaining good real-time performance and engineering application value.

[0053] Example 2 like Figure 2As shown, the present invention also provides a CAN bus adaptive key refresh method for collaborative defense between vehicle interiors and exteriors, used in the system of embodiment one, comprising: Security event information of the vehicle's external network is obtained through the external intrusion detection system, and CAN bus communication traffic characteristics are obtained through the in-vehicle CAN bus intrusion detection system, so as to generate external risk scores and in-vehicle risk scores respectively. The external risk score and the internal risk score are merged to obtain a comprehensive risk score, and the comprehensive risk score is smoothed to obtain a smoothed comprehensive risk score. Based on the smoothed comprehensive risk score, the group key refresh strategy is dynamically adjusted to complete the CAN bus adaptive key refresh. The refresh strategy includes adjusting the key refresh cycle according to the risk level and introducing a risk disturbance factor during the key update process to generate a new group key.

[0054] The above embodiments are merely descriptions of preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A CAN bus adaptive key refresh system for collaborative defense between vehicle interiors and exteriors, characterized in that, include: The in-vehicle and out-of-vehicle scoring acquisition module is used to acquire security event information of the vehicle's external network through the external intrusion detection system and to acquire CAN bus communication traffic characteristics through the in-vehicle CAN bus intrusion detection system, so as to generate external risk scores and in-vehicle risk scores respectively. The comprehensive score calculation module is used to merge the external risk score and the internal risk score to obtain a comprehensive risk score, and to smooth the comprehensive risk score to obtain a smoothed comprehensive risk score. The adaptive key refresh module is used to dynamically adjust the group key refresh strategy based on the smoothed comprehensive risk score, and complete the adaptive key refresh of the CAN bus. The refresh strategy includes adjusting the key refresh cycle according to the risk level and introducing a risk disturbance factor during the key update process to generate a new group key.

2. The system according to claim 1, characterized in that, Methods for generating vehicle exterior risk scores include: The system collects raw observation information from the vehicle's external network via an external communication module and receives external security alarm information from a cloud-based security platform. This raw observation information and external security alarm information are then sent to an external intrusion detection system for anomaly identification. The onboard gateway performs event deduplication, time alignment, format standardization, credibility filtering, and risk value normalization to form standardized external security event information, thus constructing a set of external risk events. This standardized external security event information includes abnormal V2X communication events, unauthorized wireless access events, abnormal remote connection events, remote attack events, and cloud-based security alarm events. For each type of external vehicle safety incident, the degree of danger is evaluated from four dimensions: the impact of the safety incident on the vehicle's key functions, the possibility of propagation to the in-vehicle CAN bus, the degree of attack exploitability, and the scope of impact. The evaluation results are then normalized to construct a set of risk event weights. The external risk score is calculated by weighting and summing the risk event weight set and the external risk event set.

3. The system according to claim 1, characterized in that, The process of generating an in-vehicle risk score includes: Real-time monitoring of in-vehicle CAN bus communication traffic; CAN messages are divided according to a sliding time window; and the abnormality of CAN identifier, abnormality of message transmission frequency, abnormality of communication cycle, and abnormality of data payload are extracted as key features. All key features are calculated based on the communication baseline pre-established under normal vehicle operation. The weight coefficients of each key feature are dynamically determined based on the detection sensitivity of each key feature to typical CAN attacks and the degree of impact on key vehicle functions. The basic in-vehicle risk score is calculated by weighted summation. The information entropy of each packet is calculated by grouping according to the CAN identifier. The entropy offset of each packet relative to the normal baseline and the entropy change between adjacent time windows are calculated respectively. The in-vehicle entropy anomaly score is obtained by weighting and summing the data according to the importance of the vehicle function corresponding to each packet. The in-vehicle entropy anomaly score is used as a risk correction term and then superimposed on the basic in-vehicle risk score and normalized to obtain the optimized in-vehicle risk score.

4. The system according to claim 1, characterized in that, The process of adjusting the key refresh cycle based on risk level includes: Based on the smoothed comprehensive risk score, segmented risk driving factors are constructed according to the preset first risk threshold and second risk threshold. Using the risk-driving factor as the denominator and the default key refresh period as the numerator, the dynamic key refresh period is calculated. The dynamic key refresh period is negatively correlated with the comprehensive risk score and is not lower than a preset lower limit.

5. The system according to claim 1, characterized in that, The process of generating a new group key includes: The smoothed comprehensive risk score is then quantified using a fixed-length method to obtain a quantified risk value. The quantified risk value is concatenated with the current key version number, communication group identifier and the scheduled effective time of the new key, and then mapped through a hash function and truncated into a bit sequence of the same length as the group key to generate a risk disturbance value. Based on the HIPCAM group key update formula, the aforementioned risk perturbation value is XORed to generate a new group key: ， in, Represents a hash mapping function; The current group key. This indicates the updated HIPCAM value generated during the current authentication phase. This represents the risk disturbance value.

6. The system according to claim 1, characterized in that, It also includes a key management module for performing group key storage, key update value generation, key version management, key synchronization switching, and key synchronization failure recovery. The vehicle gateway and each electronic control unit in the same communication group are respectively set with a current key slot and a key slot to be activated. The current key slot is used to store the current group key and version number, and the key slot to be activated is used to store the group key to be activated, version number, and scheduled activation time. After the vehicle gateway generates a new group key, it sends an authenticated key synchronization instruction to all electronic control units in the same communication group. The synchronization instruction includes the communication group identifier, the new key version number, the quantified risk value, and the scheduled effective time. There is no need to transmit the complete group key. After receiving the synchronization command, each electronic control unit verifies the integrity of the command and the continuity of the version number. Then, based on the same quantified risk value, the current key version number, the communication group identifier, and the scheduled effective time, it independently calculates the risk disturbance value and generates a new group key in the key slot to be effective. When the local clock reaches the predetermined effective time, each electronic control unit synchronously switches to the new group key; within the preset transition time window, both the old and new versions of the group key are retained for message authentication, and the old group key is deleted after the transition time window ends. The group key synchronization time is made shorter than the actual key refresh cycle to ensure that all electronic control units complete synchronization before the next round of key refresh; When the electronic control unit detects that the key version is not continuous, the synchronization command verification fails, or the update is not completed within the specified time, it sends a resynchronization request to the vehicle gateway, which then resends the current version information and synchronization parameters through the certified recovery channel.

7. The system according to claim 1, characterized in that, It also includes the dynamic reconfiguration step of the communication group: When the smoothed comprehensive risk score continues to exceed the preset danger threshold, the original communication group is dynamically reconstructed based on the current comprehensive risk score. The electronic control units corresponding to power control, braking control and steering control are divided into high-security communication groups, and the electronic control units corresponding to the in-vehicle entertainment system and comfort control module are divided into ordinary communication groups. New group keys are generated for different communication groups to achieve secure isolation between critical control systems and non-critical systems.

8. A CAN bus adaptive key refresh method for collaborative defense between vehicle interiors and exteriors, used in the system described in any one of claims 1-7, characterized in that, include: Security event information of the vehicle's external network is obtained through the external intrusion detection system, and CAN bus communication traffic characteristics are obtained through the in-vehicle CAN bus intrusion detection system, so as to generate external risk scores and in-vehicle risk scores respectively. The external risk score and the internal risk score are merged to obtain a comprehensive risk score, and the comprehensive risk score is smoothed to obtain a smoothed comprehensive risk score. Based on the smoothed comprehensive risk score, the group key refresh strategy is dynamically adjusted to complete the CAN bus adaptive key refresh. The refresh strategy includes adjusting the key refresh cycle according to the risk level and introducing a risk disturbance factor during the key update process to generate a new group key.

Images