A method for data processing and security management of internet of vehicles

Abstract

The present application relates to the technical field of Internet of Vehicles, and particularly relates to a method for processing and managing data of Internet of Vehicles, which acquires the communication message timing of the CAN bus of a target vehicle and extracts a sensitive data frame containing a time stamp; then collects original data load, ECU component fingerprint features and user privacy sensitivity distribution information at the corresponding moment; fuses the above information to cooperatively process the original load and generate a safe output timing after desensitization and authentication; the method couples differential privacy technology and a hardware fingerprint authentication mechanism: dynamically applies noise according to privacy sensitivity to resist privacy inference attacks while ensuring data availability; uses ECU physical layer fingerprint to verify the authenticity of data sources, effectively identifies and blocks counterfeit messages injected by counterfeit devices, and realizes privacy protection and identity trusted verification of the whole life cycle of data without additional hardware, which significantly improves the security, integrity and attack resistance of the internal communication system of intelligent networked vehicles.

Description

Technical Field

[0001] This invention relates to the field of vehicle networking technology, and in particular to a method for vehicle networking data processing and security management. Background Technology

[0002] With the rapid development of intelligent connected vehicle technology, in-vehicle communication systems are becoming increasingly complex. The Controller Area Network (CAN bus), as the core channel for data interaction between various Electronic Control Units (ECUs), carries a large amount of sensitive data related to vehicle operating status, driving habits, and user personal information. While supporting applications such as remote diagnostics, intelligent driving, and vehicle networking services, this data also faces serious security and privacy risks. On the one hand, the CAN bus uses a broadcast communication mechanism and lacks native data encryption and access control mechanisms. Attackers can steal or forge messages by accessing the OBD interface or through remote penetration, leading to the exposure of user privacy or even malicious control of the vehicle. On the other hand, traditional data anonymization methods often use static masks or simple generalization techniques, which are insufficient to resist advanced privacy inference techniques such as differential attacks while ensuring data availability.

[0003] Furthermore, current vehicle networking systems primarily rely on logical IDs or fixed keys for ECU authentication, making them vulnerable to replay attacks, man-in-the-middle attacks, and counterfeit device access, and unable to effectively identify illegal or tampered components. In recent years, component fingerprinting technology based on physical layer features has emerged, utilizing minute differences in ECU hardware such as signal rise time, clock drift, and voltage fluctuations to construct unique identifiers, providing a deeper level of security for in-vehicle communication. However, existing technologies have not yet achieved synergistic optimization of privacy protection and identity authentication, and lack a security management mechanism for the entire lifecycle of CAN bus data.

[0004] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main objective of this invention is to provide a method for vehicle network data processing and security management, which aims to solve the technical problem that existing vehicle network technologies lack a mechanism for co-optimizing differential privacy desensitization and component fingerprint-based identity authentication, making it difficult to effectively defend against privacy inference attacks and illegal device impersonation threats while ensuring the availability of CAN bus data.

[0006] To achieve the above objectives, the present invention provides a method for vehicle network data processing and security management, the method comprising: The timing sequence of communication messages on the CAN bus inside the target vehicle is obtained. The timing sequence of communication messages includes multiple sensitive data frames, and each sensitive data frame has a bus acquisition timestamp. Collect the original CAN bus data payload information of the target vehicle at the timestamp of each bus, as well as the fingerprint features of the ECU components and the distribution information of user privacy sensitivity of the target vehicle; Based on the original data payload information of the CAN bus corresponding to the timestamp of each bus acquisition, the fingerprint features of the ECU components, and the distribution information of user privacy sensitivity, the original data payload is subjected to security management processing to generate a desensitized and authenticated secure output timing sequence.

[0007] Optionally, the step of acquiring the communication message timing of the CAN bus inside the target vehicle includes multiple sensitive data frames, each of which has a bus acquisition timestamp, including: Obtain the vehicle identification code of the target vehicle, and retrieve the corresponding component fingerprint database and bus message database based on the vehicle identification code; Receives user-defined data sampling frequency and privacy protection range, wherein the privacy protection range includes the start CAN ID and the end CAN ID; Based on the data sampling frequency, the start CAN ID, and the end CAN ID, multiple sensitive data frames are selected from the bus message library, and the reception time of each sensitive data frame is extracted synchronously as the bus acquisition timestamp of each sensitive data frame.

[0008] Optionally, the step of collecting the raw CAN bus data payload information of the target vehicle at each of the bus acquisition timestamps, as well as the ECU component fingerprint features and user privacy sensitivity distribution information of the target vehicle, includes: The electronic control unit (ECU) feature information and bus data parsing protocol of the target vehicle are obtained. The ECU feature information includes the ECU physical identifier and firmware version number. The fingerprint feature extraction neighborhood range is determined based on the ECU physical identifier and the bus data parsing protocol; Based on the physical identifier of the ECU, obtain the original CAN bus data payload information corresponding to each bus acquisition timestamp; The fingerprint calculation region is determined based on the ECU physical identifier and the fingerprint feature extraction neighborhood range, and the fingerprint features of ECU components and the distribution information of user privacy sensitivity within the calculation region are obtained.

[0009] Optionally, determining the fingerprint feature extraction neighborhood range based on the ECU physical identifier and the bus data parsing protocol includes: The average transmission interval of communication messages is calculated based on the physical identifier of the ECU, and the first neighborhood time length is obtained from the neighborhood time mapping table based on the average transmission interval. The second neighborhood time length is determined based on the bus data parsing protocol, and the second neighborhood time length is a preset multiple of the protocol data parsing cycle; The time length of the first neighborhood is compared with the time length of the second neighborhood, and the larger value is taken as the base neighborhood time. The fingerprint feature extraction neighborhood range is obtained by adding a time jitter margin to the basic neighborhood duration.

[0010] Optionally, the step of performing security management processing on each of the original data payloads based on the CAN bus original data payload information corresponding to each bus acquisition timestamp, the ECU component fingerprint features, and the user privacy sensitivity distribution information, to generate a de-identified and authenticated secure output timing sequence, includes: Based on the fingerprint features of the ECU components, the distribution information of user privacy sensitivity, and the original data payload information of the CAN bus corresponding to each bus acquisition timestamp, the actual security management component corresponding to each bus acquisition timestamp is calculated. Based on the actual security management component corresponding to each bus acquisition timestamp, the original data payloads are desensitized and authenticated to obtain the security data output value corresponding to each bus acquisition timestamp, and the desensitized and authenticated security output timing sequence is generated.

[0011] Optionally, the step of performing desensitization and authentication processing on each of the original data payloads based on the actual security management component corresponding to each bus acquisition timestamp to obtain the security data output value corresponding to each bus acquisition timestamp includes: Traverse multiple sensitive data frames in the timing sequence of the communication message to obtain the first group of sensitive data frames; Extract the first bus acquisition timestamp of the first group of sensitive data frames, and obtain the first actual security management component based on the first bus acquisition timestamp; Based on the first actual security management component, the first group of sensitive data frames is divided into a privacy-sensitive dominant region and an identity authentication dominant region. For the first set of sensitive data frames, a first security management component is extracted from the privacy-sensitive dominant region, and a second security management component is extracted from the identity authentication dominant region; The first security management component and the second security management component are combined with a security policy to generate a security data output value corresponding to the first bus acquisition timestamp; The security data output values ​​corresponding to each bus acquisition timestamp are obtained by acquiring the security data output values ​​corresponding to the first bus acquisition timestamp.

[0012] Optionally, the step of extracting a first security management component in the privacy-sensitive dominant region and a second security management component in the identity authentication dominant region for the first group of sensitive data frames includes: Obtain security policy thresholds; In the privacy-sensitive dominant region, differential privacy noise is added to the first group of sensitive data frames based on the security policy threshold, and the noise value after privacy data perturbation is separated and extracted to obtain the first security management component. In the identity authentication dominant area, after fingerprint matching calibration of the first group of sensitive data frames, signature verification processing is performed in combination with the security policy threshold, and the component fingerprint authentication results are separated and extracted to obtain the second security management component.

[0013] Optionally, in the identity authentication dominant region, after performing fingerprint matching calibration on the first set of sensitive data frames, signature verification processing is performed in conjunction with the security policy threshold, and the component fingerprint authentication results are separated and extracted to obtain the second security management component, including: In the first set of sensitive data frames, the original data payload and noise interference components of each sampling point in the identity authentication dominant area are obtained; Noise interference is filtered out at each sampling point in the identity authentication dominant area by a fingerprint matching calibrator to obtain calibrated fingerprint features, and the fingerprint field in the original data payload is replaced with the calibrated fingerprint features. Based on the calibrated fingerprint features and the security policy threshold, the first set of sensitive data frames is subjected to signature verification processing, and the component fingerprint authentication results are separated and extracted to obtain the second security management component.

[0014] Optionally, the construction steps of the fingerprint matching calibrator include: Collect sample ECU fingerprint noise record set and sample raw data payload set, and annotate based on the sample ECU fingerprint noise record set and the sample raw data payload set to obtain sample clean fingerprint feature set; The fingerprint matching calibrator is trained and generated using the sample ECU fingerprint noise record set and the sample original data payload set as inputs, and the sample clean fingerprint feature set as a supervision signal.

[0015] In addition, to achieve the above objectives, the present invention also provides a computer-readable storage medium storing a program for vehicle network data processing and security management, wherein when the program for vehicle network data processing and security management is executed by a processor, it implements the steps of the method for vehicle network data processing and security management as described above.

[0016] This invention provides a method for vehicle-to-everything (V2X) data processing and security management. Addressing the simultaneous privacy leakage and ECU (Electronic Control Unit) attack risks inherent in the V2X CAN bus, this method achieves collaborative processing of differential privacy desensitization and component fingerprint authentication. By dynamically adapting privacy protection strategies to the distribution of user privacy sensitivity, it effectively resists advanced privacy theft techniques such as differential attacks while ensuring the availability of V2X data, significantly enhancing the privacy protection of sensitive information. Furthermore, by introducing pre-stored ECU component fingerprint features to verify the authenticity of data sources, it solves the technical defects of traditional logical ID authentication, which is easily cracked and counterfeited, at the physical hardware level. This allows for accurate identification of illegally accessed counterfeit ECUs, effectively preventing security threats such as forged data injection and illegal vehicle control. Moreover, this solution is directly compatible with existing CAN bus communication architectures, requiring no additional hardware, resulting in low implementation costs. It simultaneously meets the requirements of both V2X data sharing security and in-vehicle communication security, adapting to the multi-scenario application needs of current intelligent connected vehicles. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating an embodiment of the method for vehicle network data processing and security management according to the present invention; Figure 2 This is a flowchart illustrating another embodiment of the method for vehicle network data processing and security management of the present invention.

[0018] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0020] Reference Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the method for vehicle network data processing and security management according to the present invention.

[0021] In one embodiment, the method for vehicle network data processing and security management includes: Step S100: Obtain the communication message timing of the CAN bus inside the target vehicle. The communication message timing includes multiple sensitive data frames, and each sensitive data frame has a bus acquisition timestamp.

[0022] The target vehicle can be an intelligent connected vehicle entity that executes vehicle-to-everything (V2X) data processing and security management methods. It can serve as the physical carrier for data acquisition and security processing, and support CAN bus communication and the ECU operating environment. The in-vehicle CAN bus can be a controller area network (CAN) communication channel used to connect various electronic control units (ECUs) and transmit structured messages. It can be used to achieve low-latency, high-reliability data interaction between ECUs within the vehicle. Furthermore, the in-vehicle CAN bus can include, but is not limited to, linear CAN buses, star CAN buses, and hybrid CAN buses. The communication message timing sequence can be a CAN bus message sequence arranged in chronological order, which can be used to reflect the dynamic data stream of the vehicle's operating status and provide timing for security processing. In this embodiment, the communication message timing sequence can be obtained by continuously capturing messages and recording the reception time at the OBD interface or CAN transceiver using a bus monitoring device. Sensitive data frames can be CAN messages containing user privacy or vehicle control-related fields, which can be used to identify data units that require desensitization and authentication. For example, sensitive data frames can include, but are not limited to, location information frames, driving behavior frames, and user identity frames. The bus acquisition timestamp can record the precise moment when sensitive data frames are acquired on the CAN bus. This can be used to establish a temporal correlation between data payload and vehicle status, supporting spatiotemporal consistency verification. Obtaining the communication message timing of the target vehicle's CAN bus can be achieved by continuously receiving and buffering CAN messages through a bus monitoring module, appending local timestamps to form an ordered sequence. Furthermore, obtaining the communication message timing of the target vehicle's CAN bus can be achieved by a bus monitoring device continuously capturing messages and recording the reception time at the OBD interface or CAN transceiver, thus constructing a complete timing foundation for the data to be processed.

[0023] Step S200: Collect the original CAN bus data payload information corresponding to the timestamps of each bus of the target vehicle, as well as the fingerprint features of the ECU components of the target vehicle and the distribution information of user privacy sensitivity.

[0024] The CAN bus raw data payload information can be the unprocessed valid data field content in sensitive data frames, which can be used as the input source for desensitization processing and contains raw semantics that can be used to infer user privacy or vehicle status. In an exemplary embodiment, the CAN bus raw data payload information can be obtained by parsing signal values ​​that conform to the DBC file definition from the data segment of the CAN frame. ECU component fingerprint features can be unique identifier vectors formed by the physical layer characteristics of the ECU hardware, which can be used to verify the authenticity of the message source and prevent the injection of illegal data by forged ECUs. Furthermore, ECU component fingerprint features can be generated by measuring non-clonable analog circuit features such as signal rise time, clock drift, and voltage fluctuations. Exemplarily, ECU component fingerprint features can include, but are not limited to, timing feature fingerprints, electrical feature fingerprints, and manufacturing process deviation fingerprints. User privacy sensitivity distribution information can be a quantitative assessment result of the privacy risk level of each field in the CAN payload, which can be used to guide the differential privacy mechanism to dynamically allocate noise intensity and balance availability and security. In a specific embodiment, user privacy sensitivity distribution information can be obtained by classifying and scoring field semantics based on a preset privacy label system or an online learning model.

[0025] Collecting the raw CAN bus data payload information of the target vehicle at the timestamps of each bus can be achieved by extracting the data payload that conforms to the sensitive field definition in the corresponding message based on the timestamp in the communication message sequence. Furthermore, this operation can be implemented by parsing signal values ​​conforming to the DBC file definition from the data segments of the CAN frame, thereby separating the privacy-sensitive data content that needs protection. Collecting the fingerprint features of the target vehicle's ECU components can be achieved by acquiring and storing their physical layer signal features through a dedicated sampling circuit during system initialization or ECU access. Furthermore, this operation can be achieved by performing a one-time fingerprint registration when the ECU is first powered on and dynamically collecting and comparing fingerprint features before each communication, thereby establishing a baseline for the identity of legitimate ECUs. Collecting the user privacy sensitivity distribution information of the target vehicle can be achieved by labeling CAN signal fields with privacy levels according to preset rules or machine learning models. Furthermore, this operation can be achieved by mapping field sensitivity based on a static configuration table and dynamically adjusting sensitivity weights based on user authorization behavior, thereby providing a strategy basis for differentiated desensitization.

[0026] Step S300: Based on the CAN bus original data payload information corresponding to the timestamp of each bus acquisition, the fingerprint features of ECU components, and the distribution information of user privacy sensitivity, perform security management processing on each original data payload to generate a desensitized and authenticated secure output timing sequence.

[0027] The desensitized and authenticated secure output sequence can be a trusted data sequence processed by differential privacy desensitization and fingerprint authentication. This sequence can be used as a compliant data stream for secure use by upper-layer applications, simultaneously meeting privacy protection and identity trust requirements. In this embodiment, the desensitized and authenticated secure output sequence is generated from the original data payload through security management processing, retaining its correspondence with the bus acquisition timestamp. Security management processing is performed on each original data payload based on the CAN bus original data payload information corresponding to each bus acquisition timestamp, the fingerprint features of ECU components, and the user privacy sensitivity distribution information. This can involve jointly performing identity authentication and differential privacy perturbation: first verifying the legality of the message source fingerprint, then applying adaptive noise according to the sensitivity distribution. Furthermore, this operation can be implemented through a serial processing flow of authentication followed by desensitization, or a parallel processing flow of merging the results after parallel computation of authentication and desensitization, thereby simultaneously achieving the dual security goals of anti-forgery and anti-inference. Generating the desensitized and authenticated secure output sequence can be achieved by recombining the authenticated and desensitized data payload into an output sequence according to its original time sequence structure. Furthermore, this operation can be achieved by preserving the original timestamp order and replacing the payload content, thereby outputting a safe and compliant data stream that can be directly used for connected vehicle services.

[0028] Taking remote vehicle health diagnosis as an example, the vehicle network data processing and security management method in this embodiment can be as follows: a maintenance platform requests engine operation data of a vehicle for the past week; the system extracts sensitive data frames containing speed, oil temperature, and fault codes from the CAN bus; strong noise perturbation is applied to geographical location-related fields based on user privacy sensitivity distribution information; and the authenticity of each message source is verified using pre-stored engine control unit fingerprint features. Finally, a safe output sequence is generated that retains only necessary diagnostic information and cannot be used to infer user whereabouts, for cloud analysis. For example, in the scenario of intelligent driving data sharing, the vehicle network data processing and security management method in this embodiment can be as follows: an autonomous driving R&D company collects multi-vehicle test data for model training; the vehicle end collects CAN payloads such as braking, steering, and radar fusion in real time; the desensitization intensity is dynamically adjusted according to the degree to which each signal reveals driving intention; and non-original sensor data is excluded through component fingerprints to ensure that the training set both protects user privacy and has representativeness of real driving behavior.

[0029] In one embodiment, the communication message timing of the target vehicle's in-vehicle CAN bus is obtained. The communication message timing includes multiple sensitive data frames, each of which has a bus acquisition timestamp, including: Obtain the vehicle identification code of the target vehicle, and retrieve the corresponding component fingerprint database and bus message database based on the vehicle identification code.

[0030] The vehicle identification code (VIC) can be a unique vehicle identifier composed of letters and numbers, which can be used as an index key to retrieve the component fingerprint database and bus message database bound to the target vehicle. In this embodiment, the VIC can be obtained by reading the vehicle's OBD interface, body nameplate, or onboard T-Box module. The component fingerprint database can be a structured database storing the physical layer fingerprint features corresponding to each ECU of the target vehicle, which can be used to provide a set of base features for legitimate ECUs for identity authentication. For example, the component fingerprint database can collect the fingerprints of each ECU during vehicle production or initial registration and store them indexed by CANID or ECU logical address. Furthermore, the component fingerprint database can be associated with the bus message database through the VIC to jointly constitute vehicle-specific security. The bus message database can be a data set recording the target vehicle's historical or real-time CAN messages, which can be used as a source pool for sensitive data frames and supports filtering by ID range and timing conditions. In an exemplary embodiment, the bus message database can continuously monitor the CAN bus and archive and store messages by reception time and CANID.

[0031] Obtaining the vehicle identification number (VIN) of the target vehicle can be achieved by reading the vehicle's unique identifier string from the onboard system interface. Furthermore, obtaining the VIN allows for the establishment of a mapping relationship between the individual vehicle and a dedicated security resource database. Retrieving the corresponding component fingerprint database and bus message database based on the VIN can be done by querying local or remote databases using the VIN as the key, loading the matching fingerprint and message datasets. Moreover, retrieving the corresponding component fingerprint database and bus message database based on the VIN ensures that subsequent processing is based on the vehicle's unique and legitimate identity baseline and authentic communication records.

[0032] It receives the user-defined data sampling frequency and privacy protection range, where the privacy protection range includes the start CANID and the end CANID.

[0033] The user-defined data sampling frequency can be the number of times sensitive data frames are collected per unit time, which can be used to control the granularity of data processing and system load, avoiding redundant collection. In a specific embodiment, the user-defined data sampling frequency may include, but is not limited to, fixed-interval sampling, event-triggered sampling, and adaptive dynamic sampling. The privacy protection range can be a range of CAN message IDs that require security management, which can be used to limit the scope of desensitization and authentication operations, focusing on high-risk data fields. For example, the privacy protection range may include, but is not limited to, the powertrain ID segment, the body control ID segment, and the infotainment ID segment. The starting CANID can be the minimum value of the CAN message identifier within the privacy protection range, which can be used to define the lower bound of the ID for sensitive data frame screening. The ending CANID can be the maximum value of the CAN message identifier within the privacy protection range, which can be used to define the upper bound of the ID for sensitive data frame screening. Receiving the user-defined data sampling frequency and privacy protection range can be achieved by parsing the user-input sampling parameters and CANID range through a human-machine interface or configuration file. Furthermore, receiving the user-defined data sampling frequency and privacy protection range can enable personalized customization of data collection strategies, improving the targeting of processing.

[0034] Based on the data sampling frequency, start CANID, and end CANID, multiple sensitive data frames are selected from the bus message library, and the reception time of each sensitive data frame is extracted synchronously as the bus acquisition timestamp of each sensitive data frame.

[0035] The reception time can be the local time when a sensitive data frame recorded in the bus message library is captured by the system, and can be used as the original basis for generating the bus acquisition timestamp. Furthermore, the reception time, after standardization, becomes the bus acquisition timestamp, used for subsequent spatiotemporal alignment processing. Multiple sensitive data frames are selected from the bus message library based on the data sampling frequency, start CANID, and end CANID. This can be achieved by traversing the bus message library and retaining messages whose CANIDs fall within a specified range and meet the sampling time interval requirements. Furthermore, selecting multiple sensitive data frames from the bus message library based on the data sampling frequency, start CANID, and end CANID can be achieved through uniform sampling within a sliding window or event density-weighted sampling, thereby accurately extracting the data to be processed and reducing interference from irrelevant messages. The reception time of each sensitive data frame is synchronously extracted as the bus acquisition timestamp for each sensitive data frame. This can be achieved by directly using the reception time recorded in the bus message library for the selected sensitive data frames as their timestamps. Furthermore, the reception time of each sensitive data frame is extracted synchronously and used as the bus acquisition timestamp of each sensitive data frame to ensure that the time information is consistent with the original communication behavior, supporting subsequent timing consistency verification.

[0036] Taking user-initiated privacy management as an example, the vehicle network data processing and security management method in this embodiment can be that the car owner sets the vehicle APP to sample only the power system messages with ID range 0x200 to 0x3FF 10 times per second. The system loads the fingerprint features of the vehicle's engine, transmission, and other ECUs and corresponding historical messages based on the vehicle identification code, filters out sensitive data frames that meet the ID range and frequency requirements, and uses their reception time as the bus collection timestamp. Subsequently, only these frames are anonymized and authenticated, which protects driving habit privacy without affecting the normal data sharing of other systems. For example, in the scenario of compliant after-sales data collection, the vehicle network data processing and security management method in this embodiment can be that when 4S store technicians are authorized to perform repairs, they set the sampling frequency to 5 frames per second and the privacy protection range to the body control module ID segment 0x400-0x4FF. The system automatically retrieves the component fingerprint database corresponding to the vehicle identification code to verify the legality of ECUs such as door control and seats, and extracts sensitive data frames and their reception times within the corresponding time period from the bus message library, generating a timestamped security output sequence for fault analysis.

[0037] In one embodiment, the raw CAN bus data payload information corresponding to the timestamps of each bus acquisition of the target vehicle is collected, as well as the fingerprint features of the target vehicle's ECU components and the distribution information of user privacy sensitivity, including: Obtain the electronic control unit (ECU) characteristic information and bus data parsing protocol of the target vehicle. The ECU characteristic information includes the ECU physical identifier and firmware version number. The electronic control unit (ECU) feature information can be a set of metadata describing the ECU's identity and configuration attributes, which can be used to provide identity and protocol basis for fingerprint extraction and data parsing. In this embodiment, the ECU feature information may include, but is not limited to, the ECU physical identifier, firmware version number, and communication baud rate configuration. The ECU physical identifier can be a unique device identification code burned by the manufacturer or hard-coded in the hardware, which can be used as an anchor point to associate the ECU's identity with its communication behavior, and to define the scope of fingerprint extraction and data payload acquisition. For example, the ECU physical identifier can be obtained by reading the ECU's internal registers or responding to diagnostic requests. The firmware version number can be a string or value that identifies the ECU software version, which can be used to help determine whether the ECU's behavior pattern meets expectations and to exclude abnormal fingerprints caused by firmware tampering. The bus data parsing protocol can be a structured mapping rule that defines CAN message ID, signal position, scaling factor, and unit, which can be used to convert the raw byte stream into semantically meaningful engineering values, supporting field-level privacy assessment and fingerprint association. In an exemplary embodiment, the bus data parsing protocol can achieve signal decoding by loading a vehicle-specific DBC or ARXML file. Obtaining the electronic control unit (ECU) characteristic information and bus data parsing protocol of the target vehicle can be achieved by reading ECU metadata from the vehicle configuration database or through a diagnostic interface, and loading the corresponding DBC protocol file. Furthermore, this operation can be implemented by real-time reading from the on-board diagnostic port or by calling from a pre-configured library, thereby establishing a foundation for mapping between ECU identity and CAN signal semantics.

[0038] The fingerprint feature extraction neighborhood is determined based on the ECU physical identifier and bus data parsing protocol; The fingerprint feature extraction neighborhood can be a message time window or ID set strongly correlated with the physical identifier of a specific ECU in the CAN communication timing. This can be used to define the data boundary for fingerprint calculation and avoid interference from irrelevant ECU signals in feature extraction. In one embodiment, the fingerprint feature extraction neighborhood can be determined by matching the ECU physical identifier with the list of CAN IDs it is responsible for transmitting, and by combining this with the bus data parsing protocol to determine the effective signal period. Determining the fingerprint feature extraction neighborhood based on the ECU physical identifier and the bus data parsing protocol can be achieved by associating the ECU physical identifier with the set of CAN message IDs it is responsible for transmitting, and defining the neighborhood in the time or ID dimension according to the effective signal period defined by the protocol. Furthermore, this operation can be implemented by defining a discrete neighborhood based on the message ID set or a continuous time window neighborhood based on the signal update frequency, thereby narrowing the fingerprint extraction range and improving feature purity.

[0039] Based on the physical identifier of the ECU, obtain the original CAN bus data payload information corresponding to the timestamp of each bus acquisition; Based on the physical identifier of the ECU, the raw data payload information of the CAN bus corresponding to the timestamp of each bus acquisition is obtained. This can be achieved by filtering the data frames sent by the ID corresponding to the physical identifier of the ECU in the communication message sequence and extracting their payload content. Furthermore, this operation can be implemented by matching the source ID through a message filtering engine, thereby ensuring that the processed data strictly corresponds to the specified ECU and avoiding cross-source contamination.

[0040] The fingerprint calculation area is determined based on the physical identifier of the ECU and the neighborhood range of fingerprint feature extraction, and the fingerprint features of ECU components and the distribution information of user privacy sensitivity within the calculation area are obtained.

[0041] The fingerprint calculation region can be a high-precision time segment further focused within the fingerprint feature extraction neighborhood, used for the actual acquisition of physical layer features. It can provide stable and clean signal samples to calculate the fingerprint features of ECU components. For example, the fingerprint calculation region is jointly determined by the ECU physical identifier and the fingerprint feature extraction neighborhood, serving as a joint operation domain for fingerprint acquisition and privacy sensitivity assessment. Determining the fingerprint calculation region based on the ECU physical identifier and the fingerprint feature extraction neighborhood can involve selecting a high signal-to-noise ratio period with clear signal edges and no bus conflicts within the neighborhood. Furthermore, this operation can be achieved by selecting multiple identical signal phase points within a statistical region or by using a dynamic sliding window to select the optimal sampling segment, thereby improving the repeatability and discriminability of component fingerprint features. Obtaining the ECU component fingerprint features and user privacy sensitivity distribution information within the calculation region can be achieved by simultaneously performing physical layer feature sampling and signal semantic sensitivity annotation within the fingerprint calculation region. In one exemplary embodiment, this operation can be achieved by acquiring analog signals in parallel for fingerprint generation and parsing digital payloads for privacy scoring, or by time-division multiplexing the same data segment to complete the two types of processing sequentially, thereby enabling the alignment and coordination of identity authentication and privacy assessment in time and space.

[0042] For example, in the scenario of ECU replacement verification in the aftermarket, the vehicle network data processing and security management method of this embodiment can be as follows: After the user replaces the non-original brake control module, the system reads the physical identifier and firmware version number of the new ECU, determines the range of message IDs that it should send by combining the vehicle DBC protocol, and delineates the fingerprint feature extraction neighborhood range; then, during the braking command triggering period, the rising edge area of ​​ABS-related messages on the CAN bus is selected as the fingerprint calculation area, clock drift features are collected and compared with the registration library, and the privacy sensitivity of fields such as vehicle speed and pedal travel is evaluated; if the fingerprint does not match or the sensitive fields are not desensitized according to the strategy, the ECU data is rejected from being uploaded to the cloud.

[0043] In one embodiment, the fingerprint feature extraction neighborhood is determined based on the ECU physical identifier and the bus data parsing protocol, including: The average transmission interval of communication messages is calculated based on the physical identifier of the ECU, and the first neighborhood time length is obtained from the neighborhood time mapping table based on the average transmission interval. The average communication message transmission interval can be a statistical average of the time intervals during which a specific ECU continuously transmits the same CAN message during operation. This average can be used as a behavioral fingerprint basis reflecting the ECU's internal clock accuracy and task scheduling characteristics. In an exemplary embodiment, the average communication message transmission interval can be calculated by averaging the arrival times of the same CANID message in multiple bus acquisition timestamps. The neighborhood time mapping table can be a pre-stored nonlinear mapping table from the average communication message transmission interval to the first neighborhood time length. This can be used to convert ECU behavioral statistics into a time window length suitable for fingerprint extraction. For example, the neighborhood time mapping table can include, but is not limited to, piecewise linear mapping tables, exponential decay mapping tables, and lookup tables based on cluster centers. The first neighborhood time length can be the time window length corresponding to the behavioral characteristics derived from the ECU's physical identifier. This can be used to ensure coverage of typical signal fluctuation cycles determined by the ECU's hardware characteristics.

[0044] Calculating the average transmission interval of communication messages based on the ECU's physical identifier can be achieved by filtering messages with unique CANIDs based on the ECU's physical identifier, calculating the time difference between consecutive messages using bus acquisition timestamps, and then averaging the difference. Furthermore, this operation can be implemented by differentially and averaging the timestamp sequences of messages with the same CANID across multiple acquisition cycles, thereby quantifying the ECU's inherent communication rhythm and providing input for behavior-driven neighborhood construction. Obtaining the first neighborhood time length from the neighborhood time mapping table based on the average transmission interval can be achieved by using the calculated average transmission interval as an index to look up the corresponding first neighborhood time length in a pre-stored mapping table. In a specific embodiment, this operation can be implemented by estimating continuous values ​​between discrete mapping points using interpolation, or by using hash buckets to quickly match approximate intervals, thereby transforming statistical behavioral characteristics into executable time window parameters.

[0045] The second neighborhood time length is determined based on the bus data parsing protocol, and the second neighborhood time length is a preset multiple of the protocol data parsing cycle; The protocol data parsing period can be the nominal transmission period of a certain type of CAN message defined in the bus data parsing protocol. It can be used as a time base at the protocol level to determine the effective boundaries of structured data. The second neighborhood time length can be the time length obtained by multiplying the protocol data parsing period by a preset multiple. It can be used to ensure that the fingerprint calculation area completely includes at least one or more data update periods defined by the protocol. Determining the second neighborhood time length based on the bus data parsing protocol can be done by reading the nominal period of the target message from a protocol file such as DBC and multiplying it by a preset integer multiple (such as 1.5 or 2). Furthermore, this operation can be achieved by parsing the period field in the protocol description file and applying a multiplier factor, thereby ensuring that the window covers the complete protocol semantic period and preventing signal truncation.

[0046] The time length of the first neighborhood is compared with the time length of the second neighborhood, and the larger value is taken as the base neighborhood time. The base neighborhood duration can be the larger of the first and second neighborhood durations. It can be used to integrate the dual constraints of hardware behavior and protocol structure to form a robust initial time window. Comparing the first and second neighborhood durations and selecting the larger value as the base neighborhood duration can be achieved by numerically comparing the two neighborhood lengths and choosing the larger one. In an exemplary embodiment, this operation can be implemented by directly comparing the two values ​​using conditional logic, thus balancing individual ECU behavior differences with protocol specification requirements and avoiding an excessively narrow window.

[0047] By adding a time jitter margin to the basic neighborhood duration, the range of fingerprint feature extraction neighborhood is obtained.

[0048] The time jitter margin can be an additional time buffer added to address the timing uncertainties in the actual vehicle environment. It can be used to compensate for signal arrival time offsets caused by bus load, ECU scheduling delays, or temperature drift. For example, the time jitter margin can include, but is not limited to, network congestion margin, scheduling jitter margin, and environmental temperature drift margin. The fingerprint feature extraction neighborhood range can be the final time window formed by superimposing the time jitter margin on the basic neighborhood duration. It can be used as a unified spatiotemporal operating domain for simultaneously acquiring physical layer fingerprints and assessing privacy sensitivity. In a specific embodiment, the fingerprint feature extraction neighborhood range can be determined jointly by the basic neighborhood duration and the time jitter margin, serving as a prerequisite for subsequent fingerprint calculation region delineation. Adding the time jitter margin to the basic neighborhood duration to obtain the fingerprint feature extraction neighborhood range can be achieved by adding a preset or adaptively calculated time jitter margin to the basic neighborhood duration to form the final neighborhood range. Furthermore, this operation can be achieved by setting a fixed margin (such as ±2ms) or by dynamically adjusting the margin based on the historical jitter standard deviation, thereby improving the robustness of the neighborhood range in a real vehicle environment and ensuring the integrity of the fingerprint signal.

[0049] Taking identity authentication under high load conditions as an example, the method for vehicle network data processing and security management in this embodiment can be as follows: When a vehicle changes lanes at high speed, multiple ADAS systems are activated simultaneously, and the CAN bus load increases sharply, causing message delay; the system calculates the average actual transmission interval of the nominal 30ms period based on the physical identifier of the forward-facing camera ECU, which is 32.4ms, and looks up the neighborhood time mapping table to obtain the first neighborhood time length as 40ms; the protocol defines the period as 30ms, and the preset multiple is 1.5, so the second neighborhood time length is 45ms; the larger value is taken as the basic neighborhood time length of 45ms, and then a 5ms time jitter margin is added to finally form a 50ms fingerprint feature extraction neighborhood range; within this window, a clear signal rising edge is successfully captured for fingerprint comparison, and at the same time, the privacy sensitivity labeling of fields such as lane departure and vehicle speed is completed.

[0050] In one embodiment, the original data payloads are processed for security management based on the CAN bus raw data payload information corresponding to each bus acquisition timestamp, ECU component fingerprint features, and user privacy sensitivity distribution information, generating a desensitized and authenticated secure output timing sequence, including: Based on the fingerprint features of ECU components, the distribution information of user privacy sensitivity, and the original data payload information of the CAN bus corresponding to the timestamp of each bus acquisition, the actual security management component corresponding to each bus acquisition timestamp is calculated. The actual security management component can be a fusion security strategy parameter calculated from the fingerprint features of ECU components, user privacy sensitivity distribution information, and CAN bus raw data payload information. It can be used to uniformly characterize the authentication status and privacy protection strength that should be applied to the raw data payload at a specific timestamp. In this embodiment, the actual security management component can transform the three types of inputs into an executable security control vector through a multi-source feature fusion algorithm (such as weighted mapping, rule engines, or lightweight neural networks).

[0051] Based on the actual security management component corresponding to each bus acquisition timestamp, the original data payload is desensitized and authenticated to obtain the security data output value corresponding to each bus acquisition timestamp, and a desensitized and authenticated security output timing sequence is generated.

[0052] The security data output value can be the data result corresponding to a single timestamp after desensitization and authentication processing guided by the actual security management components. This serves as the basic unit for constructing the security output sequence, while simultaneously meeting the requirements of source trust and content privacy protection. For example, the security data output value is generated by processing the original data payload according to the actual security management components, and then combined according to the bus acquisition timestamp order to form a desensitized and authenticated security output sequence. Based on the fingerprint features of ECU components, user privacy sensitivity distribution information, and the original CAN bus data payload information corresponding to each bus acquisition timestamp, the actual security management components corresponding to each bus acquisition timestamp are calculated. This can be achieved by jointly modeling the three types of input features and outputting a security strategy parameter to guide subsequent processing. Furthermore, this operation can be implemented through a rule-driven approach (e.g., desensitization is enabled if fingerprint matching is successful, and the strength is determined by sensitivity) or a model-driven approach (outputting continuous security weights through a pre-trained lightweight model), thereby enabling dynamic coupling configuration of identity authentication and privacy protection strategies.

[0053] The original data payloads are anonymized and authenticated based on the actual security management components corresponding to the timestamps collected by each bus. This can be achieved by determining whether to retain data based on the authentication flags in the actual security management components, while simultaneously applying appropriate noise according to the privacy strength parameters. In an exemplary embodiment, this operation can be implemented by first performing fingerprint comparison; if successful, a differential privacy mechanism is invoked to perturb highly sensitive fields, and the authentication result is encoded as a metadata tag and output along with the anonymized payload. This ensures that only data from legitimate sources is anonymized, and the degree of anonymization matches the privacy risk. The secure data output values ​​corresponding to the timestamps collected by each bus are obtained by encapsulating the processed data payloads into secure output units with time stamps, thereby forming structured, traceable secure data records.

[0054] Taking data feedback during OTA upgrades as an example, the vehicle network data processing and security management method in this embodiment can be that the vehicle continuously uploads CAN bus diagnostic data when performing remote software updates. The system calculates the actual security management component for each message: if the brake control unit fingerprint matches and contains highly sensitive driving habit fields, then strong differential privacy noise is applied; if a non-original ECU fingerprint is detected, the frame is directly discarded. The final generated security data output value prevents attackers from injecting malicious data by forging ECUs and avoids the cloud from reconstructing the user's daily driving route through aggregation analysis. For example, in the scenario of insurance UBI (Usage-Based Insurance) data reporting, the vehicle network data processing and security management method in this embodiment can be that the vehicle terminal reports driving behavior data on a minute-by-minute basis. The system dynamically adjusts the disturbance amplitude of fields such as rapid acceleration and emergency braking according to the actual security management component—applying greater noise to highly sensitive periods that frequently occur near residential areas, while verifying the consistency of the engine and body control module fingerprints to ensure that the reported data truly reflects the driver's driving behavior rather than being forged by a simulator.

[0055] In one embodiment, the original data payload is desensitized and authenticated based on the actual security management component corresponding to each bus acquisition timestamp to obtain the security data output value corresponding to each bus acquisition timestamp, including: Traverse multiple sensitive data frames in the communication message sequence to obtain the first set of sensitive data frames; The first set of sensitive data frames can be a collection of data units identified in the communication message sequence as containing information related to user privacy or hardware identity, which is used for subsequent area division and security processing.

[0056] Extract the first bus acquisition timestamp of the first group of sensitive data frames, and obtain the first actual security management component based on the first bus acquisition timestamp; The first actual security management component can be a dynamic security configuration parameter retrieved from the pre-stored security management strategy library based on the first bus acquisition timestamp, corresponding to that time point, and used to guide subsequent intra-frame region division.

[0057] Based on the first actual security management component, the first group of sensitive data frames is divided into a privacy-sensitive dominant region and an identity authentication dominant region. The privacy-sensitive dominant region can be a set of data fields in the sensitive data frame identified by the first actual security management component, with user privacy risks as the primary security consideration. It can serve as the main scope for differential privacy desensitization, ensuring that highly sensitive information cannot be inferred in the output. Furthermore, the privacy-sensitive dominant region can include, but is not limited to, location trajectory regions, driving habit regions, and user identity association regions. The identity authentication dominant region can be a set of signal fields in the sensitive data frame identified by the first actual security management component, strongly correlated with the physical behavior characteristics of the ECU. It can be used to verify whether the message source matches the pre-stored fingerprint characteristics of ECU components, preventing data injection by counterfeit devices. Furthermore, the identity authentication dominant region can include, but is not limited to, timing jitter regions, electrical response regions, and manufacturing deviation mapping regions. This partitioning operation can be based on the field classification labels or weight distribution in the first actual security management component, assigning different signal fields within the data frame to corresponding security processing regions. Furthermore, this partitioning operation can be achieved through static partitioning based on a preset field role mapping table or adaptive partitioning based on dynamic clustering signal characteristics of the real-time security management component, thereby decoupling and directing the execution of security processing tasks within the same data frame.

[0058] For the first set of sensitive data frames, the first security management component is extracted from the privacy-sensitive dominant region, and the second security management component is extracted from the identity authentication dominant region. The first security management component can be a parameter extracted from the privacy-sensitive dominant region, representing the privacy protection strategy to be applied to that region. It can be used to guide the implementation of noise perturbations conforming to differential privacy theory on high-privacy-risk fields. The second security management component can be an authentication status parameter extracted from the identity authentication dominant region, representing the degree of matching between that region and the legitimate ECU fingerprint. It can be used to determine whether the current message originates from trusted hardware, serving as a prerequisite for allowing data output. Furthermore, the first and second security management components can be input together into the security policy synthesis module to determine the final output behavior. The second security management component can also participate in security policy synthesis in conjunction with the first security management component, influencing whether the de-identification result takes effect. Extracting the first security management component from the privacy-sensitive dominant region can involve parsing de-identification parameters corresponding to the privacy sensitivity, such as noise scale or perturbation type, from the un-de-identified fields, thus providing a precise strength configuration basis for the differential privacy mechanism. Extracting the second security component from the identity authentication dominant region can involve comparing the signal characteristics of the current region with pre-stored ECU component fingerprints, outputting a matching score or binary authentication result, thereby generating authentication criteria for determining the legitimacy of the data source.

[0059] The first security management component and the second security management component are combined to generate a security data output value corresponding to the first bus acquisition timestamp; The security policy synthesis process can be a logical or numerical fusion of the first and second security management components to generate the final processing instruction, which can be used to achieve coordinated control of privacy protection and identity authentication at the decision-making level. Furthermore, security policy synthesis can be implemented through a rule engine (discarding data if authentication fails) or a weighting function (e.g., modulating desensitization intensity based on authentication confidence). This synthesis operation can combine the two components according to a preset logic to form the final security output control instruction. Further, this synthesis operation can be implemented using logical gating (e.g., AND: output only when authentication is successful and the privacy policy is effective) or continuous fusion (e.g., scaling noise intensity with authentication confidence), thereby achieving collaborative decision-making between privacy desensitization and identity authentication, avoiding invalid processing of illegal data. The operation of generating the security data output value corresponding to the first bus acquisition timestamp can be based on the security policy synthesis result, selectively desensitizing or discarding the original data payload, and encapsulating it into a time-stamped output unit, thereby producing spatiotemporally consistent, source-trusted, and content-privacy-compliant single-point security data.

[0060] The security data output values ​​corresponding to the acquisition timestamps of each bus are obtained by following the method of obtaining the security data output values ​​corresponding to the first bus acquisition timestamp.

[0061] Taking the upload of autonomous driving test data as an example, the vehicle-to-everything (V2X) data processing and security management method in this embodiment can be that the vehicle collects CAN signals such as steering angle, throttle opening, and GPS coordinates on public roads. The system divides the data frames into a privacy-sensitive dominant region (including location and driving style) and an identity authentication dominant region (including ECU timing jitter characteristics). The former applies Laplace noise based on the distribution of user privacy sensitivity, while the latter verifies whether it comes from the original steering control module. If authentication fails (e.g., using a modified ECU), even if the data seems reasonable, it is rejected for output to prevent attackers from polluting the training set by forging sensor data. For example, in the scenario of abnormal behavior monitoring on the V2X platform, the V2X data processing and security management method in this embodiment can be that the cloud requests braking system data for a certain period of time for analyzing potential faults. The vehicle terminal divides each frame of data into regions: the identity authentication dominant region verifies the fingerprint consistency of the braking control unit, and the privacy-sensitive dominant region generalizes the perturbation of frequently braking locations. The security policy synthesis module ensures that a secure data output value is generated only when the hardware is real and the location information has been desensitized, which supports fault diagnosis and prevents leakage of frequently visited locations.

[0062] In one embodiment, for the first set of sensitive data frames, a first security management component is extracted from the privacy-sensitive dominant region, and a second security management component is extracted from the identity authentication dominant region, including: Obtain security policy thresholds.

[0063] The security policy threshold can be a quantitative benchmark parameter used to uniformly regulate the intensity of differential privacy noise and the strictness of identity authentication verification. It can serve as a shared control variable for collaborative decision-making between privacy protection and identity authentication, ensuring that the two security mechanisms operate in a unified manner. In this embodiment, the security policy threshold can be read from the system configuration storage or runtime as a unified threshold parameter for security control. Furthermore, the security policy threshold can be preset by the system, configured by the user, or dynamically adjusted according to the operating environment (such as network connection status, vehicle location area, etc.). For example, the security policy threshold may include, but is not limited to, a privacy budget threshold, a fingerprint matching tolerance threshold, and an authentication confidence threshold.

[0064] In the privacy-sensitive dominant region, differential privacy noise is added to the first group of sensitive data frames based on the security policy threshold, and the noise value after privacy data perturbation is separated and extracted to obtain the first security management component.

[0065] The noise value after privacy data perturbation can be the random perturbation amount actually injected into the privacy-sensitive dominant region field during differential privacy noise addition processing. It can be used as a component of the first security management component, supporting auditing and policy backtracking. In an exemplary embodiment, the noise value after privacy data perturbation is generated by differential privacy noise addition processing and extracted to form the first security management component. In the privacy-sensitive dominant region, differential privacy noise addition processing is performed on the first set of sensitive data frames based on a security policy threshold. This can be achieved by determining the privacy budget (e.g., ε) in the differential privacy mechanism based on the security policy threshold and generating noise conforming to a Laplace or Gaussian distribution, which is then superimposed onto the original field. Furthermore, in the privacy-sensitive dominant region, differential privacy noise addition processing on the first set of sensitive data frames based on the security policy threshold can be achieved by using a Laplace mechanism to add noise to numerical signals or using a random response mechanism to perturb categorical signals, thereby ensuring that the privacy-sensitive field meets provable differential privacy guarantees. Separating and extracting the noise value after privacy data perturbation to obtain the first security management component can be achieved by decoupling the noise value actually used in the differential privacy processing from the perturbed data and encapsulating it separately, making the desensitization process traceable and verifiable, and providing explicit input for security policy synthesis.

[0066] In the identity authentication dominant area, after fingerprint matching and calibration of the first set of sensitive data frames, signature verification is performed in combination with security policy thresholds, and the fingerprint authentication results of the components are separated and extracted to obtain the second security management component.

[0067] The component fingerprint authentication result can be the legality judgment result output after fingerprint matching calibration and signature verification processing in the identity authentication-dominated area. It can be used as the core content of the second security management component to characterize whether the current message originates from a trusted ECU. In a specific embodiment, the component fingerprint authentication result is output by the signature verification processing and is separated and extracted to form the second security management component. In the identity authentication-dominated area, fingerprint matching calibration is performed on the first set of sensitive data frames. This can involve extracting the physical layer features (such as rise time and clock drift) of the current message in the identity authentication-dominated area and comparing them with the pre-stored ECU component fingerprints to preliminarily assess the consistency between the message source and the legitimate ECU. Signature verification processing combined with security policy thresholds can be based on the fingerprint matching result and the security policy thresholds to perform lightweight message authentication (such as HMAC) to confirm that the message has not been tampered with and that its source is trustworthy. For example, signature verification processing combined with security policy thresholds can be implemented by using symmetric signature verification based on the ECU's unique key or by adopting a keyless verification mechanism based on physical feature hashing, thereby strengthening the anti-forgery capability of identity authentication and preventing man-in-the-middle or replay attacks. Separate and extract the fingerprint authentication results of the components to obtain the second security management component. This can be achieved by independently extracting and structuring the binary or continuous authentication results output by the signature verification process, providing a clear basis for identity legitimacy for security policy synthesis.

[0068] Taking cross-border vehicle-to-everything (V2X) data compliant transmission as an example, the V2X data processing and security management method in this embodiment can be as follows: when a vehicle travels to different jurisdictions, the system dynamically adjusts the security policy threshold to meet local privacy regulations (such as GDPR requiring a smaller ε value); in privacy-sensitive dominant areas, stronger noise is injected based on the new threshold and the actual noise value is recorded; in identity authentication dominant areas, the same threshold is used to tighten the fingerprint matching tolerance to prevent foreign attackers from injecting forged data using counterfeit ECUs; the final output security data not only meets regional compliance requirements but also ensures the authenticity of the hardware source. For example, in the scenario of uploading after-sales diagnostic data, the V2X data processing and security management method in this embodiment can be as follows: when a 4S store requests to obtain recent fault codes and related signals of a vehicle, the vehicle system applies differential privacy noise based on the security policy threshold to the throttle opening, which may expose the user's driving habits, in the privacy-sensitive dominant area and saves the noise value; at the same time, in the identity authentication dominant area, the engine control unit fingerprint is verified, and the same threshold is used to determine whether to accept the message; only when the authentication is successful and the noise meets the preset range is the security data output value containing the noise value and authentication result uploaded to prevent the repair shop from receiving tampered or simulated data.

[0069] In one embodiment, in the identity authentication dominant region, after fingerprint matching calibration of the first set of sensitive data frames, signature verification processing is performed in conjunction with security policy thresholds, and the component fingerprint authentication results are separated and extracted to obtain the second security management component, including: In the first set of sensitive data frames, the original data payload and noise interference components of each sampling point in the identity authentication dominant area are obtained.

[0070] The noise interference component can be defined as a non-ideal disturbance superimposed on the original ECU physical signal during CAN bus transmission. It can characterize the negative impact of the environment on fingerprint feature acquisition and needs to be separated to recover the true hardware characteristics. Furthermore, the noise interference component can include, but is not limited to, electromagnetic interference components, line attenuation components, and clock jitter components. This operation can involve signal decomposition of the analog or digital sampling sequence of the authentication-dominant area to separate the original data payload carrying fingerprint information from the noise interference component superimposed on it, thereby achieving the technical effect of providing structured input for subsequent noise filtering.

[0071] Noise interference is filtered out at each sampling point in the identity authentication dominant area by a fingerprint matching calibrator to obtain calibrated fingerprint features, and the fingerprint field in the original data payload is replaced with the calibrated fingerprint features.

[0072] The fingerprint matching calibrator can be a signal processing module used to filter out noise interference and restore the true physical characteristics of the ECU from the sampled signals in the authentication-dominant region. It can improve the accuracy of component fingerprint feature extraction and overcome the interference of bus environment noise on hardware identification. In an exemplary embodiment, the fingerprint matching calibrator can perform noise separation and feature reconstruction on the original sampled points based on a pre-trained filtering model or adaptive signal processing algorithm. The calibrated fingerprint features can be high-fidelity ECU physical layer feature vectors obtained after the fingerprint matching calibrator filters out noise interference components. These can be used as reliable input for signature verification processing, ensuring that authentication is based on real hardware behavior rather than disturbed signals. Furthermore, the calibrated fingerprint features can replace the fingerprint field in the original data payload and serve as the core basis for signature verification processing. This operation, which filters out noise interference from each sampled point in the authentication-dominant region using the fingerprint matching calibrator, involves inputting the sampled points into the fingerprint matching calibrator and using its built-in model to suppress noise interference components, preserving or enhancing inherent features related to the ECU manufacturing process. For example, this operation can be implemented using a statistical model-based filtering method or a deep learning-based end-to-end denoising network, thereby improving the robustness and consistency of fingerprint feature extraction. Replacing the fingerprint field in the original data payload with calibrated fingerprint features can be achieved by writing the recovered high-fidelity fingerprint features into the corresponding position in the message, overwriting the potentially disturbed original values, thus ensuring that subsequent authentication processes are based on accurate hardware identity information.

[0073] The first set of sensitive data frames is processed for signature verification based on the calibrated fingerprint features and security policy thresholds, and the fingerprint authentication results of the components are separated and extracted to obtain the second security management component.

[0074] This operation, based on calibrated fingerprint features and security policy thresholds, performs signature verification processing on the first set of sensitive data frames. This can involve generating or verifying a message authentication code using the calibrated fingerprint features and comparing it with the security policy threshold to determine legitimacy. In one specific embodiment, this operation can be achieved by generating an HMAC based on calibration features and verifying it with a pre-stored key, or by calculating the similarity to a registered fingerprint and determining whether it exceeds a threshold. This achieves strong verification of the ECU's identity, preventing counterfeit devices from impersonating through the logic layer. Separating and extracting the component fingerprint authentication results to obtain the second security management component can be achieved by independently encapsulating the authentication status output from the signature verification process into a structured data unit. This provides a clear, traceable, and reliable basis for security policy synthesis.

[0075] Taking fleet management in a high electromagnetic interference environment as an example, the vehicle network data processing and security management method in this embodiment can be as follows: when logistics vehicles are driving in an industrial area, the CAN bus ECU signal is distorted due to a strong electromagnetic field; the system separates the noise interference component from the brake control unit message through a fingerprint matching calibrator, restores the true rise time and voltage slope and other calibrated fingerprint features, replaces the original fingerprint field and performs signature verification; even if the signal is disturbed, the original ECU can still be accurately identified, preventing attackers from injecting forged instructions under the cover of interference.

[0076] For example, in the scenario of regulating the replacement of used car parts, the vehicle network data processing and security management method of this embodiment can be that after a user replaces a non-original engine control module, the system collects the physical signal of the new ECU in the identity authentication dominant area. After processing by the calibrator, it is found that the calibrated fingerprint feature deviates significantly from the registration record, the signature verification fails, and the fingerprint authentication result of the part is marked as illegal. This result serves as a second security management component to prevent related data from entering the desensitization output process, thus avoiding the pollution of the remote diagnostic platform by non-compliant component data.

[0077] In one embodiment, the construction steps of the fingerprint matching calibrator include: Collect the sample ECU fingerprint noise record set and the sample original data payload set, and annotate them to obtain the sample clean fingerprint feature set; Using the sample ECU fingerprint noise record set and the sample raw data payload set as inputs, and the sample clean fingerprint feature set as the supervision signal, a fingerprint matching calibrator is trained and generated.

[0078] The sample ECU fingerprint noise recording set can be a collection of ECU physical layer signal observation data collected in a real vehicle operating environment, containing various interference effects. It can be used as a noisy input source for training the fingerprint matching calibrator, reflecting signal distortion in the actual bus environment. In an exemplary embodiment, the sample ECU fingerprint noise recording set can be obtained by continuously collecting signals from multiple vehicle models and multiple ECUs during real-vehicle road testing or by injecting controlled interference and recording the response in an electromagnetic compatibility laboratory. Further, the sample ECU fingerprint noise recording set may include, but is not limited to, subsets of electromagnetic interference records, power fluctuation records, and clock jitter records. The sample raw data payload set can be a collection of CAN message payload contents collected synchronously with the sample ECU fingerprint noise recording set. It can be used to provide semantic information to help distinguish whether signal changes are caused by legitimate operations or abnormal interference. In a specific embodiment, the sample raw data payload set and the sample ECU fingerprint noise recording set together constitute the input pair for calibrator training. The sample clean fingerprint feature set can be an ideal ECU physical feature annotation set obtained by high-precision calibration or offline processing of noisy samples. It can be used as a supervisory signal to guide the fingerprint matching calibrator in learning its ability to recover real hardware features from noise. For example, a clean fingerprint feature set can be generated by methods such as laboratory-controlled environment reproduction, multi-frame averaging denoising, or expert annotation.

[0079] Collecting sample ECU fingerprint noise records and sample raw data payload sets can be achieved by simultaneously recording ECU physical layer signals and corresponding CAN data payloads under various operating conditions and interference environments. Furthermore, collecting these sets can be accomplished by continuously acquiring signals from multiple vehicle models and ECUs during real-world road testing, or by injecting controlled interference and recording the responses in an electromagnetic compatibility laboratory, thereby constructing a training data foundation covering typical noise scenarios. Annotating these sets yields a clean fingerprint feature set, which can be achieved by extracting ideal fingerprint features from noisy records using a high signal-to-noise ratio reference signal or signal processing algorithms and establishing corresponding relationships. In one specific embodiment, the clean fingerprint feature set can be obtained by annotating these sets using multi-frame moving averages to eliminate random noise before feature extraction, or by domain experts manually annotating clean features based on manufacturing batches and models, resulting in high-quality target labels for supervised learning.

[0080] Using a sample ECU fingerprint noise record set and a sample raw data payload set as input, and a sample clean fingerprint feature set as the supervision signal, a fingerprint matching calibrator is trained and generated. This can be achieved by feeding the input-output pair into a machine learning framework and optimizing the model parameters so that it can reconstruct clean fingerprints from noisy signals. For example, using a sample ECU fingerprint noise record set and a sample raw data payload set as input, and a sample clean fingerprint feature set as the supervision signal, the fingerprint matching calibrator can be trained to achieve end-to-end denoising by training a lightweight convolutional neural network or by constructing an autoencoder structure for unsupervised pre-training combined with supervised fine-tuning. This results in a highly robust fingerprint recovery model that can run in real-time under vehicle resource constraints. Taking unified safety management of a multi-brand fleet as an example, the vehicle network data processing and safety management method in this embodiment can involve the operator collecting ECU signals from vehicles of different brands under its jurisdiction in urban, highway, and mountainous scenarios, constructing a sample ECU fingerprint noise record set and corresponding payload covering various noise modes; generating a sample clean fingerprint feature set through laboratory calibration; and deploying the trained fingerprint matching calibrator on various vehicle models. Even with different electrical architectures and interference characteristics, it can still accurately recover real fingerprints, ensuring cross-platform identity authentication consistency. For example, in the scenario of compliance verification of aftermarket parts, the method of vehicle network data processing and security management in this embodiment can be that regulatory agencies collect a large number of signals from original and non-original ECUs on the same test bench, construct a noisy sample set and label pure features; the trained calibrator can be deployed in the testing equipment to determine in real time whether the ECU installed in the repaired vehicle has the original hardware fingerprint, and prevent counterfeit parts from bypassing traditional ID checks by disguising themselves through the logic layer.

[0081] In addition, to achieve the above objectives, the present invention also provides a computer-readable storage medium storing a program for vehicle network data processing and security management, wherein when the program for vehicle network data processing and security management is executed by a processor, it implements the steps of the method for vehicle network data processing and security management as described above.

[0082] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for vehicle-to-everything (V2X) data processing and security management, characterized in that, The method includes: The timing sequence of communication messages on the CAN bus inside the target vehicle is obtained. The timing sequence of communication messages includes multiple sensitive data frames, and each sensitive data frame has a bus acquisition timestamp. Collect the original CAN bus data payload information of the target vehicle at the timestamp of each bus, as well as the fingerprint features of the ECU components and the distribution information of user privacy sensitivity of the target vehicle; Based on the original data payload information of the CAN bus corresponding to the timestamp of each bus acquisition, the fingerprint features of the ECU components, and the distribution information of user privacy sensitivity, the original data payload is subjected to security management processing to generate a desensitized and authenticated secure output timing sequence.

2. The method for vehicle network data processing and security management as described in claim 1, characterized in that, The acquisition of the communication message timing of the CAN bus inside the target vehicle includes multiple sensitive data frames, each of which has a bus acquisition timestamp, including: Obtain the vehicle identification code of the target vehicle, and retrieve the corresponding component fingerprint database and bus message database based on the vehicle identification code; Receives user-defined data sampling frequency and privacy protection range, wherein the privacy protection range includes the start CANID and the end CANID; Based on the data sampling frequency, the start CAN ID, and the end CAN ID, multiple sensitive data frames are selected from the bus message library, and the reception time of each sensitive data frame is extracted synchronously as the bus acquisition timestamp of each sensitive data frame.

3. The method for vehicle network data processing and security management as described in claim 1, characterized in that, The process of collecting the raw CAN bus data payload information of the target vehicle at each bus acquisition timestamp, as well as the fingerprint features of the target vehicle's ECU components and the distribution information of user privacy sensitivity, includes: The electronic control unit (ECU) feature information and bus data parsing protocol of the target vehicle are obtained. The ECU feature information includes the ECU physical identifier and firmware version number. The fingerprint feature extraction neighborhood range is determined based on the ECU physical identifier and the bus data parsing protocol; Based on the physical identifier of the ECU, obtain the original CAN bus data payload information corresponding to each bus acquisition timestamp; The fingerprint calculation region is determined based on the ECU physical identifier and the fingerprint feature extraction neighborhood range, and the fingerprint features of ECU components and the distribution information of user privacy sensitivity within the calculation region are obtained.

4. The method for vehicle network data processing and security management as described in claim 3, characterized in that, The step of determining the fingerprint feature extraction neighborhood range based on the ECU physical identifier and the bus data parsing protocol includes: The average transmission interval of communication messages is calculated based on the physical identifier of the ECU, and the first neighborhood time length is obtained from the neighborhood time mapping table based on the average transmission interval. The second neighborhood time length is determined based on the bus data parsing protocol, and the second neighborhood time length is a preset multiple of the protocol data parsing cycle; The time length of the first neighborhood is compared with the time length of the second neighborhood, and the larger value is taken as the base neighborhood time. The fingerprint feature extraction neighborhood range is obtained by adding a time jitter margin to the basic neighborhood duration.

5. The method for vehicle network data processing and security management as described in claim 1, characterized in that, The process of performing security management processing on each of the original data payloads based on the CAN bus original data payload information corresponding to each bus acquisition timestamp, the ECU component fingerprint features, and user privacy sensitivity distribution information, to generate a de-identified and authenticated secure output timing sequence includes: Based on the fingerprint features of the ECU components, the distribution information of user privacy sensitivity, and the original data payload information of the CAN bus corresponding to each bus acquisition timestamp, the actual security management component corresponding to each bus acquisition timestamp is calculated. Based on the actual security management component corresponding to each bus acquisition timestamp, the original data payloads are desensitized and authenticated to obtain the security data output value corresponding to each bus acquisition timestamp, and the desensitized and authenticated security output timing sequence is generated.

6. The method for vehicle network data processing and security management as described in claim 5, characterized in that, The process of desensitizing and authenticating each original data payload based on the actual security management component corresponding to each bus acquisition timestamp to obtain the security data output value corresponding to each bus acquisition timestamp includes: Traverse multiple sensitive data frames in the timing sequence of the communication message to obtain the first group of sensitive data frames; Extract the first bus acquisition timestamp of the first group of sensitive data frames, and obtain the first actual security management component based on the first bus acquisition timestamp; Based on the first actual security management component, the first group of sensitive data frames is divided into a privacy-sensitive dominant region and an identity authentication dominant region. For the first set of sensitive data frames, a first security management component is extracted from the privacy-sensitive dominant region, and a second security management component is extracted from the identity authentication dominant region; The first security management component and the second security management component are combined with a security policy to generate a security data output value corresponding to the first bus acquisition timestamp; The security data output values ​​corresponding to each bus acquisition timestamp are obtained by acquiring the security data output values ​​corresponding to the first bus acquisition timestamp.

7. The method for vehicle network data processing and security management as described in claim 6, characterized in that, The step of extracting a first security management component from the privacy-sensitive dominant region and a second security management component from the identity authentication dominant region for the first group of sensitive data frames includes: Obtain security policy thresholds; In the privacy-sensitive dominant region, differential privacy noise is added to the first group of sensitive data frames based on the security policy threshold, and the noise value after privacy data perturbation is separated and extracted to obtain the first security management component. In the identity authentication dominant area, after fingerprint matching calibration of the first group of sensitive data frames, signature verification processing is performed in combination with the security policy threshold, and the component fingerprint authentication results are separated and extracted to obtain the second security management component.

8. The method for vehicle network data processing and security management as described in claim 7, characterized in that, In the identity authentication dominant region, after fingerprint matching calibration of the first group of sensitive data frames, signature verification processing is performed in conjunction with the security policy threshold, and the component fingerprint authentication results are separated and extracted to obtain the second security management component, including: In the first set of sensitive data frames, the original data payload and noise interference components of each sampling point in the identity authentication dominant area are obtained; Noise interference is filtered out at each sampling point in the identity authentication dominant area by a fingerprint matching calibrator to obtain calibrated fingerprint features, and the fingerprint field in the original data payload is replaced with the calibrated fingerprint features. Based on the calibrated fingerprint features and the security policy threshold, the first set of sensitive data frames is subjected to signature verification processing, and the component fingerprint authentication results are separated and extracted to obtain the second security management component.

9. The method for vehicle network data processing and security management as described in claim 8, characterized in that, The construction steps of the fingerprint matching calibrator include: Collect sample ECU fingerprint noise record set and sample raw data payload set, and annotate based on the sample ECU fingerprint noise record set and the sample raw data payload set to obtain sample clean fingerprint feature set; The fingerprint matching calibrator is trained and generated using the sample ECU fingerprint noise record set and the sample original data payload set as inputs, and the sample clean fingerprint feature set as a supervision signal.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program for vehicle network data processing and security management, which, when executed by a processor, implements the steps of the method for vehicle network data processing and security management as described in any one of claims 1 to 9.

Images