CN116405305A

CN116405305A - Signal-based secure communication method, device and medium

Info

Publication number: CN116405305A
Application number: CN202310429698.8A
Authority: CN
Inventors: 滕欢; 王鹏
Original assignee: Robert Bosch GmbH
Current assignee: Robert Bosch GmbH
Priority date: 2023-04-20
Filing date: 2023-04-20
Publication date: 2023-07-07

Abstract

The present disclosure provides a method for transmitting data, comprising: obtaining a set of signals to be transmitted; determining authentication information for one or more signals, wherein the one or more signals are a subset of the set of signals; generating a data unit for the set of signals based on the set of signals and the authentication information; and transmitting the data unit.

Description

Signal-based secure communication method, device and medium

Technical Field

The present disclosure relates generally to the field of communications, and more particularly to a signal-based secure communication method, apparatus, and medium.

Background

With the development of automobile electronic technology and the increasing enrichment of the whole automobile functions, the number of electronic control units (Electronic Control Unit, ECU) in the automobile is also increasing. To promote the openness and standardization of the development of the automotive industry, software architectures such as the automotive open system architecture (Automotive Open System Architecture, AUTOSAR) have been proposed in the industry to achieve decoupling of ECU hardware from system software, thereby facilitating the development and updating of vehicle electronic system software.

Meanwhile, as the number of ECUs connected by an on-board network (e.g., a CAN bus-based network) increases, how to achieve reliable communication between ECUs and between ECU internal software modules using limited bandwidth and ECU computing capabilities becomes a challenge. Particularly, after some communications enable an automotive safety communication (Secure Onboard Communication, secOC) framework, problems such as resource occupation of the ECU and efficiency of the communications become further focuses of attention.

Accordingly, it is desirable to provide an efficient communication mechanism to reduce consumption of system resources and improve communication efficiency while achieving secure communication in an in-vehicle network.

Disclosure of Invention

According to one aspect of the present disclosure, there is provided a method for transmitting data, comprising: obtaining a set of signals to be transmitted; determining authentication information for one or more signals, wherein the one or more signals are a subset of the set of signals; generating a data unit for the set of signals based on the set of signals and the authentication information; and transmitting the data unit.

According to another aspect of the present disclosure, there is provided a method for receiving data, comprising: receiving a data unit comprising a set of signals and authentication information for one or more signals, wherein the one or more signals are a subset of the set of signals; and responsive to the authentication information being verified as valid, determining that the one or more signals are valid signals.

According to still another aspect of the present disclosure, there is provided an apparatus for transmitting data, including: a memory storing instructions; and a processor coupled to the memory, the instructions, when executed by the processor, perform a method according to the present disclosure.

According to yet another aspect of the present disclosure, there is provided an apparatus for receiving data, comprising: a memory storing instructions; and a processor coupled to the memory, the instructions, when executed by the processor, perform a method according to the present disclosure.

According to yet another aspect of the present disclosure, there is provided an apparatus for transmitting data, comprising means for performing the method according to the present disclosure.

According to yet another aspect of the present disclosure, there is provided an apparatus for receiving data, comprising means for performing the method according to the present disclosure.

According to yet another aspect of the present disclosure, there is provided a computer readable medium having instructions which, when executed by a processor, cause the processor to perform a method according to the present disclosure.

Drawings

Various embodiments of the claimed subject matter will now be described, by way of example, with reference to the accompanying drawings. The use of the same reference symbols in different drawings indicates identical or similar items.

Fig. 1 shows a schematic diagram of an AUTOSAR-based system 100 according to an embodiment of the present disclosure.

Fig. 2 shows a schematic diagram of transmitting protocol data units (Protocol Data Unit, PDUs) between a sender and a receiver according to an embodiment of the present disclosure.

Fig. 3 shows a schematic diagram of a transmitting end according to an embodiment of the present disclosure.

Fig. 4A-4E illustrate schematic diagrams of data units according to embodiments of the present disclosure.

Fig. 5 illustrates a flow chart of a method 500 for transmitting data according to an embodiment of the present disclosure.

Fig. 6 shows a schematic diagram of a receiving end according to an embodiment of the present disclosure.

Fig. 7 illustrates a flow chart of a method 700 for receiving data according to an embodiment of the present disclosure.

Fig. 8 illustrates a block diagram of an apparatus 800 for signal-based secure communications according to an embodiment of the present disclosure.

Detailed Description

In the following description, numerous specific details are set forth in order to provide a thorough understanding of embodiments of the present disclosure. One skilled in the relevant art will recognize, however, that the disclosure may be practiced without one or more of the specific details, or with alternative methods, components, etc. In some instances, well-known structures, operations are not shown or described in detail to avoid unnecessarily obscuring the present disclosure.

Fig. 1 shows a schematic diagram of an AUTOSAR-based system 100 according to an embodiment of the present disclosure. The system 100 may be implemented on a control unit (e.g., ECU) of a vehicle, the system 100 being composed of an application layer 110, a runtime environment (Runtime Environment, RTE) 120, basic Software (BSW) 130, and hardware 140.

In one embodiment, the application layer 110 includes a plurality of software components (Software Component, SWC) therein corresponding to a plurality of automotive electronic functions. Each SWC contains an implementation and description of specific module functions and provides an interface with RTE 120. RTE 120 manages the communication of data interactions of the SWC, and when the SWC communicates with the local ECU or other components in the ECU, the data needs to be sent to RTE 120 through an interface, and RTE 120 is responsible for coordinating data transmission. The BSW 130 includes modules such as a service layer, an ECU abstraction layer, a microcontroller abstraction layer, and complex drivers for providing underlying services such as hardware drivers, network communications, real-time task scheduling, and the like. Hardware 140 provides hardware resources for the above application layer 110, RTE 120, and BSW 130, including hardware elements such as the ECU's microcontroller, memory, input/output, analog-to-digital converters, and the like.

Fig. 2 shows a schematic diagram of transmitting PDUs between a sender and a receiver according to an embodiment of the present disclosure. The PDU is the basic data transmission unit of the AUTOSAR communication system. The sender 210 and the receiver 220 of the PDU 260 are two different ECUs. To ensure secure communication between sender 210 and receiver 220, a SecOC framework may be used to provide a valid and viable authentication mechanism for PDU 260.

In one embodiment, PDU 260 includes a set of multiple signals 230A-230F and Freshness Value (FV) 240 and message authentication code (Message Authentication Code, MAC) 250.FV 240 is a continuously updated value based on, for example, a message count or clock, etc., to indicate the freshness of signals 230A-230F. Before data transmission, the sender 210 calculates the MAC 250 from all signals 230A-230F, FV 240 to be transmitted and the key information using an encryption algorithm. The sender packages the signals 230A-230F, FV 240 and MAC 250 to create PDU 260 and sends PDU 260 to the receiver 220. By including FV 240, MAC 250 in PDU 260, the recipient may verify the received FV 240 and MAC 250 to prevent replay attacks and message tampering from posing a security threat to the vehicle.

However, in practical applications, many signals need to be sent periodically, and even if the corresponding signals are not updated, the ECU still needs to repeatedly calculate the MAC of each set of signals, consuming a large amount of ECU resources. Meanwhile, although not all signals have security requirements, the MAC needs to be determined based on the entire set of signals in the calculation process of the MAC, increasing the time required to obtain the MAC. Furthermore, the SecOC framework-based authentication mechanism can only secure communications across ECUs, and cannot provide protection for communications between SWCs within a single ECU. Therefore, a new secure communication mechanism needs to be considered to solve the above-mentioned drawbacks. As will be further described below in connection with fig. 3, 4A-4E.

Fig. 3 shows a schematic diagram of a transmitting end according to an embodiment of the present disclosure. In one embodiment, the transmitting end 310 includes a transmit signal obtaining module 320, an authentication information determining module 330, a data unit generating module 360, and a transmitting module 370. The sender 310 may be implemented in the application layer 110 as shown in fig. 1. The sender 310 may be part of the data sender SWC or a separate SWC to receive the signal to be sent from other SWCs in the application layer 110.

The transmit signal obtaining module 320 is configured to obtain a set of signals to be transmitted. Fig. 4A shows a schematic diagram of a data unit according to one embodiment of the present disclosure. Similar to signals 230A-230F in FIG. 2, signals 430A-430F represent a set of signals to be transmitted.

The authentication information determination module 330 is configured to determine a signal to be protected among the signals 430A-430F and to determine authentication information for the signal. In the embodiment of fig. 4A, authentication information determination module 330 determines signal 430B as the signal to be protected, and then authentication information determination module 330 determines authentication information for signal 430B, including freshness value 440 and authentication code 450.

In one embodiment, authentication information determination module 330 optionally includes a freshness value determination module 340 and/or an authentication code determination module 350 to determine a freshness value and/or an authentication code for a signal to be protected. In the embodiment of fig. 4A, the freshness value 440 reflects only the freshness of the signal 430B to be protected. Accordingly, the authentication code 450 may be determined based on the signal 430B, a data identification (DATAID) corresponding to the signal 430B, the freshness value 440, and the key according to a certain encryption algorithm. The data identification is a predefined set of data in the vehicle that is used to represent the type of signal 430B. The process of introducing a data identification into the authentication code 450 can further ensure the validity of the signal 430B. In one embodiment, for the manner of symmetric encryption between ECUs, the key may be a preset key for the encryption algorithm common to a plurality of ECUs. For example, the authentication code determination module 350 may obtain a key from a hardware security module (Hardware Security Module, HSM) located in the BSW 130 of fig. 1 to calculate the authentication code 450.

It should be noted that the signal to be protected may be more than one signal. As shown in the embodiment of fig. 4B, the authentication information determination module 330 may determine authentication information for a signal group consisting of

signals

430C, 430D, which accordingly contains a freshness value 440 and an authentication code 450 for the

signals

430C, 430D.

The data unit generating module 360 is configured to package the set of signals to be sent and the authentication information, and generate a data unit for the set of signals. Fig. 4A-4E exemplarily show the generated data units. Unlike the FV 240, MAC 250 located at the end of the PDU in the embodiment of fig. 2, the authentication information (freshness value 440, authentication code 450) in fig. 4A-4E may be flexibly located elsewhere. For example, in fig. 4A, the freshness value 440 and the authentication code 450 for the signal 430B to be protected are located in adjacent positions behind the signal 430B; in fig. 4B, the freshness value 440 and the authentication code 450 for the

signal

430C, 430D to be protected are located in adjacent positions behind the signal 430D; in fig. 4C, the freshness value 440 and the authentication code 450 for the signal 430B to be protected are located in adjacent positions in front of the signal 430B; in fig. 4D, the freshness value 440 and the authentication code 450 for the signal to be protected 430B are located at the start of the data unit; in fig. 4E, the freshness value 440 and the authentication code 450 for the signal to be protected 430B are located at the end position of the data unit. It should be appreciated that the authentication information may be located virtually anywhere in the data unit, and that the authentication information may include only one of the freshness value 440 and the authentication code 450. Meanwhile, the relative positional relationship of the freshness value 440 and the authentication code 450 is also exemplary, and the freshness value 440 and the authentication code 450 may be separated by any signal distance. In one embodiment, the freshness value 440 may be located at a position after the authentication code 450.

The sending module 370 is configured to send the generated data unit to the data receiving party SWC. The data receiving side SWC may be located in the same ECU as or different from the data transmitting side SWC. In one embodiment, the transmitting module 370 implements data transmission by transmitting data units to the RTE of the AUTOSAR.

At step S510, the method includes obtaining a set of signals to be transmitted. The set of signals includes one or more signals to be protected.

At step S520, the method includes determining authentication information for one or more signals, wherein the one or more signals are a subset of the set of signals. In one embodiment, the authentication information includes an authentication code, and wherein the authentication code is determined based on the one or more signals, a data identification corresponding to the one or more signals, a freshness value corresponding to the one or more signals, and a key. In one embodiment, the authentication information includes a freshness value corresponding to the one or more signals.

At step S530, the method includes generating a data unit for the set of signals based on the set of signals and the authentication information. In one embodiment, in the data unit, the authentication information is located at one of the following locations: a starting position of the data unit; an end position of the data unit; or adjacent to the one or more signals.

At step S540, the method includes transmitting the data unit. In one embodiment, transmitting the data unit includes transmitting the data unit to a runtime environment of an open system architecture of the automobile.

Fig. 6 shows a schematic diagram of a receiving end according to an embodiment of the present disclosure. In one embodiment, the receiving end 610 shown in fig. 6 is configured to receive data units from the transmitting end 310 of fig. 3. In one embodiment, the receiving end 610 includes a data unit receiving module 620 and a verification module 630. The receiving end 610 may be implemented in the application layer 110 as shown in fig. 1. The receiving end 610 may be part of the data receiving SWC or be a stand alone SWC and send the verified information to other SWCs in the application layer 110. In one embodiment, the sender 310 and receiver 610 may form one SWC to protect data communications of other SWCs in the local ECU.

The data unit receiving module 620 is configured to receive, for example, a data unit sent by the sending end 310. The data unit may include a set of signals and authentication information for one or more signals of the set of signals. For example, the data unit is a data unit as shown in fig. 4A, which includes a set of signals 430A-430F and authentication information (freshness value 440 and authentication code 450) for the signal 430B to be protected. In one embodiment, the data unit receiving module 620 may receive data units from a runtime environment of an automotive open system architecture.

The verification module 630 is configured to verify the authentication information, and determine that the signal to be protected is a valid signal in response to the authentication information being verified as valid. In one embodiment, the verification module 630 optionally includes a freshness value verification module 640 and/or an authentication code verification module 650 to verify the received freshness value and/or authentication code. In the embodiment of fig. 4A, the freshness value verification module 640 may obtain a freshness value corresponding to the signal 430B to be protected from a central node responsible for global freshness value management of the vehicle, and by comparison, the freshness value verification module 640 may determine whether the received signal 430B is a replay attack. Accordingly, the authentication code verification module 650 may recalculate the authentication code based on the signal 430B, the data identification corresponding to the signal 430B, the freshness value 440, and the key according to the corresponding encryption algorithm. The authentication code verification module 650 can determine whether the signal 430B has been tampered with by comparing whether the calculated authentication code is consistent with the received authentication code 450. The authentication code verification module 650 may also obtain a key from a hardware security module (Hardware Security Module, HSM) located in the BSW 130 of fig. 1 to calculate the authentication code. While fig. 4A is taken as an example, it should be appreciated that the receiving end 610 may process data units from the transmitting end 310 as in fig. 4B-4E, and any other form, accordingly.

At step S710, the method includes receiving a data unit including a set of signals and authentication information for one or more signals, wherein the one or more signals are a subset of the set of signals. In one embodiment, receiving the data unit includes receiving the data unit from a runtime environment of an open system architecture of the automobile. In one embodiment, in the data unit, the authentication information is located at one of the following locations: a starting position of the data unit; an end position of the data unit; or adjacent to the one or more signals.

At step S720, the method includes determining that the one or more signals are valid signals in response to the authentication information being verified as valid. In one embodiment, the authentication information comprises an authentication code, and wherein the method comprises verifying the authentication code based on the one or more signals, a data identification corresponding to the one or more signals, a freshness value corresponding to the one or more signals, and a key. In one embodiment, the authentication information includes a freshness value corresponding to the one or more signals.

According to the scheme of the embodiment of the disclosure, the protection of key data at the signal level is realized. On one hand, because the signals for calculating the authentication code are fewer, the ECU resource cost and the processing time cost during data transmission and data reception are saved; on the other hand, since the scheme of the present disclosure is implemented at the application layer, communication between SWCs can be protected, both inside the local ECU and across ECUs.

It should be understood that the data units in this disclosure, such as in fig. 2, 4A-4E, are merely exemplary. The data units according to embodiments of the present disclosure may further include additional data such as a header, and the number of signals in each data unit is also merely exemplary and is not limited by the above-described embodiments.

In one embodiment, device 800 may include a control unit of a vehicle, such as an Electronic Control Unit (ECU), an Electronic Management Unit (EMU), and so forth.

The device 800 includes a processor 802 coupled to an internal communication bus 808, the processor 802 for executing instructions in a memory 804 to perform the methods described in this disclosure. Examples of the processor 802 may include a Central Processing Unit (CPU), a microcontroller, and so forth. Memory 804 suitable for tangibly embodying computer program instructions and data includes various forms of memory, e.g., EPROM, EEPROM, and flash memory devices, among others. Device 800 may also include an input interface 810 and an output interface 812. The input interface 810 is for receiving input signals and data, including sensing signals such as sensors coupled to the control unit. Output interface 812 is used to transmit output signals and data, e.g., to transmit information to other control units via a bus. In addition, device 800 may also include an analog-to-digital converter 806 for converting analog signals from the various sensors to digital signals.

The various methods, steps, operations, units, modules, components, models, and networks described in connection with the present disclosure may be implemented as hardware, software executed by a processor, firmware, or any combination thereof. According to one or more aspects of the present disclosure, a computer program product for a signal-based secure communication method may include processor-executable computer instructions for implementing one or more of the methods or steps described above with reference to fig. 5 or 7. According to other aspects of the disclosure, a computer readable medium may store computer instructions for a signal-based secure communication method, which when executed by a processor may cause the processor to perform one or more of the methods or steps described above with reference to fig. 5 or 7. Computer-readable media includes both non-transitory computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. Any connection is properly termed a computer-readable medium.

In addition to what is described herein, various modifications may be made to the embodiments and implementations of the present disclosure without departing from the scope of the embodiments and implementations. The specification and examples herein are, accordingly, to be regarded in an illustrative rather than a restrictive sense. The scope of the disclosure should be measured solely by reference to the claims.

Claims

1. A method for transmitting data, comprising:

obtaining a set of signals to be transmitted;

determining authentication information for one or more signals, wherein the one or more signals are a subset of the set of signals;

generating a data unit for the set of signals based on the set of signals and the authentication information; and

and transmitting the data unit.

2. The method of claim 1, wherein the authentication information comprises an authentication code, and wherein the authentication code is determined based on the one or more signals, a data identification corresponding to the one or more signals, a freshness value corresponding to the one or more signals, and a key.

3. The method of claim 1, wherein the authentication information comprises a freshness value corresponding to the one or more signals.

4. The method of claim 1, wherein in the data unit, the authentication information is located at one of:

a starting position of the data unit;

an end position of the data unit; or alternatively

Adjacent to the one or more signals.

5. The method of claim 1, wherein transmitting the data unit comprises transmitting the data unit to a runtime environment of an automotive open system architecture.

6. A method for receiving data, comprising:

receiving a data unit comprising a set of signals and authentication information for one or more signals, wherein the one or more signals are a subset of the set of signals; and

in response to the authentication information being verified as valid, the one or more signals are determined to be valid signals.

7. The method of claim 6, wherein receiving a data unit comprises receiving the data unit from a runtime environment of an automotive open system architecture.

8. The method of claim 6, wherein in the data unit, the authentication information is located at one of:

a starting position of the data unit;

an end position of the data unit; or alternatively

Adjacent to the one or more signals.

9. The method of claim 6, wherein the authentication information comprises an authentication code, and wherein the method comprises verifying the authentication code based on the one or more signals, a data identification corresponding to the one or more signals, a freshness value corresponding to the one or more signals, and a key.

10. The method of claim 6, wherein the authentication information comprises a freshness value corresponding to the one or more signals.

11. An apparatus for transmitting data, comprising:

a memory storing instructions; and

a processor coupled to the memory, the instructions, when executed by the processor, performing the method of any of claims 1-5.

12. An apparatus for receiving data, comprising:

a memory storing instructions; and

a processor coupled to the memory, the instructions, when executed by the processor, performing the method of any of claims 6-10.

13. An apparatus for transmitting data, comprising means for performing the method of any of claims 1-5.

14. An apparatus for receiving data, comprising means for performing the method of any of claims 6-10.

15. A computer readable medium having instructions which, when executed by a processor, cause the processor to perform the method of any of claims 1-10.