KR102194469B1 - Method and apparatus of securing message in communication controller for a vehicle - Google Patents

Abstract

Disclosed are a security method of a communication control device for a vehicle and an apparatus thereof. The security method of a communication control device for a vehicle comprises the steps of: receiving a vehicle control message from a first communication node; receiving an occupancy rate from a micro controller unit (MCU); generating a message authentication code using a first authentication step that uses a hash function and a second authentication step that uses a secret key when the received occupancy rate is less than a first occupancy rate, generating a message authentication code using only one of the first authentication step and the second authentication step when the received occupancy rate is the first occupancy rate or a second occupancy rate, and maintaining a standby state without the first authentication step or the second authentication step when the received occupancy rate is greater than the second occupancy rate; generating, when the received message exceeds the criteria of a predetermined priority, a message authentication code using the first authentication step and the second authentication step even when the received occupancy rate is the first occupancy rate or the second occupancy rate; changing the received message to a message in a different format using the generated message authentication code; and transmitting the changed message to a second communication node. According to the present invention, it is possible to strengthen authentication according to a priority of a message.

Description

TECHNICAL FIELD The method and apparatus for securing a vehicle communication control device and the same

The present invention relates to a security method of a communication control device for a vehicle, and a device thereof, wherein a message security method of a communication control device for a vehicle selectively authenticates a message received from an ECU according to the occupancy rate of the MCU and the importance level of the message when driving the vehicle. And to the device.

As IT technology continues to develop, various IT devices are being installed in vehicles as well as home appliances. As IT devices began to be installed in vehicles, the ECU (Electronic Control Unit), which is an electronic control unit in the vehicle, has also come to support various functions, and the quantity to be loaded is also increasing, and is distributed in the appropriate place of the vehicle as needed.

Since ECUs distributed in a vehicle must interact and operate in an organic manner, they must basically recognize the state of each other through communication. To this end, dozens of ECUs in the vehicle are connected to the vehicle network. As is known, vehicle networks are expanding to various communication methods (LIN, MOST, Flexray, CAN-FD, Ethernet, bluetooth, etc.) with CAN (Controller Area Network) playing a de facto standard role.

The number of communication nodes installed in vehicles is increasing, that the application of autonomous driving has to handle a relatively larger communication load than before, that interworking with external networks is required, and the frequency of exposure to various cyber attacks is increased. Considering that the security range and functions are expanding due to the increase in security, there are cases in which message authentication cannot be performed due to the lack of processing capability of the MCU in the communication control device inside the vehicle, increasing the risk of vehicle operation control. It is a situation.

The problem to be solved by the present invention is to adjust the number of message authentication according to the occupancy of the MCU, or if the occupancy of the MCU is high, encryption by using an existing authentication code without new authentication or by changing the message transmission cycle or message transmission order. To reduce the burden on the MCU by changing the authentication, in addition to providing a message security method and device for a vehicle communication control device that increases the number of message authentication or changes the order of message transmission even if the share is high according to the priority of the message. .

According to an embodiment of the present invention for solving the above technical problem, a security method of a vehicle communication control device includes: receiving a vehicle control message from a first communication node; Receiving an occupancy rate from a microcontroller unit (MCU); When the received share is less than the first share, a message authentication code is generated using a first authentication step using a hash function and a second authentication step using a secret key, and the received share is the first share to the second share. In the case of occupancy, a message authentication code is generated using only one of the first authentication step and the second authentication step, and when the received share exceeds the second share, the first authentication step or Maintaining a standby state without the second authentication step; When the received message exceeds a predetermined priority criterion, a message authentication code is generated using the first authentication step and the second authentication step even if the received share is the first share to the second share. Generating; Converting the received message into a message of a different format using the generated message authentication code; And transmits the changed message to a second communication node.

The security method of the vehicle communication control device further includes the step of changing the received message to a message of a different format by using a previously generated message authentication code, when a predetermined time elapses in the maintained standby state, Transmitting the changed message to the second communication node may include transmitting the changed message to the second communication node by changing the order according to the predetermined priority.

According to another embodiment of the present invention for solving the above technical problem, a security device for a vehicle communication control device includes: a receiver configured to receive a vehicle control message from a first communication node and receive occupancy rate from a microcontroller unit (MCU); When the received share is less than the first share, a message authentication code is generated using a first authentication step using a hash function and a second authentication step using a secret key, and the received share is the first share to the second share. In the case of occupancy, a message authentication code is generated using only one of the first authentication step and the second authentication step, and when the received share exceeds the second share, the first authentication step or If the standby state is maintained without the second authentication step, and the received message exceeds a predetermined priority criterion, the first authentication step even if the received share is the first share to the second share And a control unit that generates a message authentication code using a second authentication step. A message conversion unit that converts the received message into a message of a different format using the generated message authentication code; And a transmitter for transmitting the changed message to a second communication node.

The present invention reduces the burden on the MCU by adjusting the number of encryption authentication of a message, or by using an existing authentication code when the occupancy of the MCU is very high, or by changing the message transmission cycle or sequence, and without authentication due to the occupancy of the MCU. There is an advantage of preventing messages from being transmitted, enhancing security with a certain amount of encryption without burdening the MCU, and enhancing authentication according to the priority of messages or transmitting messages with priority.

1 is a diagram showing a flowchart of a method for securing a communication control device for a vehicle according to an embodiment of the present invention.
2 is a diagram showing the structure of a CAN message frame.
3 is a diagram illustrating an Ethernet message frame structure.
4 is a diagram showing a block diagram of a security device of a communication control device for a vehicle according to an embodiment of the present invention.

Advantages and features of the present invention, and a method of achieving them will become apparent with reference to the embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments described herein and may be embodied in other forms. Rather, the embodiments introduced herein are provided so that the disclosed content may be thorough and complete, and the spirit of the present invention may be sufficiently conveyed to those skilled in the art.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In the present application, terms such as "comprise" or "have" are intended to designate the presence of features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, but one or more other features. It is to be understood that the presence or addition of elements or numbers, steps, actions, components, parts, or combinations thereof, does not preclude in advance the possibility of being added.

Unless otherwise defined, all terms including technical or scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present invention belongs. Terms such as those defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning of the related technology, and should not be interpreted as an ideal or excessively formal meaning unless explicitly defined in this application. Does not.

A preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing a flowchart of a method for securing a communication control device for a vehicle according to an embodiment of the present invention.

Referring to FIG. 1, in step 110, an apparatus for performing a security method of a vehicle communication control device (hereinafter referred to as a “security device for a vehicle communication control device”) receives a vehicle control message from a first communication node.

The communication node means an end node, and it is preferable to understand the end node as an ECU (Electronic Control Unit) that controls devices installed in a vehicle to provide a special purpose or function. ECU refers to an electronic control device that controls the state of a car's engine, automatic transmission, and ABS with a computer.

The message is preferably a CAN message. CAN (Controller Area Network) is a standard communication standard designed to allow microcontrollers or devices to communicate with each other without a host computer in a vehicle. In CAN communication, data transmission and reception are performed using message frames.

2 is a diagram showing the structure of a CAN message frame.

Referring to FIG. 2, the data frame of the CAN message includes an SOF field 201, an Arbitration field 202, a Control field 203, a Data field 204, a CRC field 205, an ACK field 206, and an EOF field. It consists of 207. The SOF (Start Of Frame) field 201 consists of one dominant bit, indicates the beginning of a message and is used for synchronization of all nodes. The Arbitration field 202 is composed of an ID having a size of 11 bits or 29 bits and a 1 bit RTR (Remote Transmission Request) bit. This field is used to reconcile the collisions between messages that occur when two or more nodes transmit messages simultaneously. The value of the RTR bit is used to determine whether it is a data frame ('d') or a remote frame ('r'). The control field 203 is composed of a 2-bit IDE (IDentifier Extension) bit and a 4-bit data length code (DLC). R0 is a reserved bit (Extended CAN 2.0B R0, R1). The Data field 204 can be used up to 8 bytes, is used to store data, and includes data transmitted from a specific node to another node. The CRC field 205 is composed of a 15-bit CRC sequence generated by using a bit string from OF to a data field and a CRC delimeter of one'r' bit. This is used to check for errors in the message. A Cyclic Redundancy Check (ACK) field 206 is composed of an ACK slot of one bit and one ACK delimeter ('d'). When an arbitrary node receives the correct message, the moment the ACK field is received, the value of the ACK slot is set to'd' and transmission continues on the bus. The EOF (End Of Frame) field 207 is composed of 7'r' bits and is used for the purpose of indicating the end of a message.

The security devices and communication nodes of the vehicle communication control device can support CAN protocol, MOST protocol, Ethernet protocol, etc., depending on the implementation method, and can be connected in various types (star, ring, bus, mesh, ...) topology.

Communication nodes have their own IP addresses set, can receive messages including IP addresses from higher nodes, and can set IP addresses included in received messages as their own IP addresses. This is only an example, and the IP address of the communication node can be set through various methods.

The security device of the vehicle communication control device may store identification information of communication nodes constituting the vehicle network, perform authentication on the accessed communication node, and allow or block access according to the authentication result.

In step 120, the security device of the vehicle communication control device receives the share (or utilization rate) from the microcontroller (Micro Controller Unit) included in the vehicle communication control device. The MCU is a dedicated processor for controlling the communication control device for a vehicle, and can be considered to correspond to the central processing unit (CPU) of a computer.

In step 130, the security device of the vehicle communication control device changes the encryption authentication method of the received message according to the received share and a predetermined priority.

In the encryption authentication method, when the received message is a CAN message, the security device of the vehicle communication control device converts the CAN message into an Ethernet message. Specifically, the security device of the vehicle communication control device generates a message authentication code, and generates an Ethernet message based on the generated message authentication code and some frames of the CAN message.

3 is a diagram illustrating an Ethernet message frame structure.

Referring to FIG. 3, an Ethernet message is composed of a Header field and an Ethernet Data field, and the Ethernet Data field is composed of a Padding field, a CAN Header field, a Data field, and a Security field. Here, the Header field 301 is configured based on the Arbitration field and the Control field of the CAN message, and the Data field 302 is configured according to the Data field of the CAN message. The security field 303 includes at least one message authentication code generated by the security device of the vehicle communication control device.

The method of generating the message authentication code is performed in an encryption process of two authentication steps. In the first authentication step, the security device of the vehicle communication control device generates the received CAN message as a hash value through a predetermined hash algorithm using an integrity encryption method. The hash function is a function that maps a string to a fixed-length binary string. Integrity here means leaving data that can prove that the unique value of the input data is maintained.

In the second authentication step, the security device of the vehicle communication control device encrypts the received CAN message by adding a shared secret key using a predetermined authentication algorithm. The shared secret key must be held by both the sending side and the receiving side.

The security device of the vehicle communication control device generates a message authentication code through a first authentication step and a second authentication step. After that, the generated message authentication code is included in the Ethernet message.

In one embodiment of the present invention, when the received MCU occupancy rate is less than the first occupancy rate, the security device of the vehicle communication control apparatus generates a message authentication code through the authentication steps of both authentication steps. After that, the security device of the vehicle communication control device generates an Ethernet message based on the generated message authentication code. Preferably the first share is 70%.

When the received MCU occupancy is greater than or equal to the first occupancy and less than the second occupancy, the security device of the vehicle communication control apparatus generates a message authentication code by performing only one of the two authentication steps. After that, the security device of the vehicle communication control device generates an Ethernet message based on the generated message authentication code. Preferably the second occupancy is 90%.

In another embodiment of the present invention, even when the first occupancy rate is less than the second occupancy rate, if the predetermined priority is higher than the reference level, the security device of the vehicle communication control device authenticates the message through the authentication steps of both authentication steps. Generate the code. Priority is given for each message according to the importance level when driving the vehicle, and the priority is determined in advance and stored in a table format in the security device of the vehicle communication control device.

If the received MCU occupancy is greater than or equal to the second occupancy, the security device of the vehicle communication control device waits without generating a message authentication code.

However, if the standby state is maintained continuously, a problem occurs in that the message is transmitted without authentication, and thus the message can be delivered through authentication in a degree that does not burden the MCU.

According to an embodiment of the present invention, after a predetermined time elapses in the standby state, the security device of the vehicle communication control device reuses the previously generated message authentication code for at least one message received during the standby state period. . Thereafter, the security device of the vehicle communication control device generates an Ethernet message based on the reused message authentication code. The previously generated message authentication code is stored in the security device of the vehicle communication control device.

The CAN message received during the standby state is called M ₁ , M ₂ , M ₃ , M ₄ , and the previously generated message authentication code is (m ₁ , m ₂ ), (m ₃ , m ₄ ), (m ₅ , If m ₆ ), (m ₇ , m ₈ ) (assuming that the message authentication code is 2 bytes and m is 1 byte), the security device of the vehicle communication control device adds the previously generated message authentication code to M ₁ Is the Ethernet message of M ₁ (m ₁ , m ₂ ), M ₂ is the Ethernet message of M ₂ (m ₃ , m ₄ ), M ₃ is the Ethernet message of M ₃ (m ₅ , m ₆ ), M ₄ converts to an Ethernet message of M ₄ (m ₇ , m ₈ ).

According to another embodiment of the present invention, after a predetermined time elapses in the standby state, the security device of the vehicle communication control device recombines at least one message received during the standby state period by recombining the previously generated message authentication code. use. After that, the security device of the vehicle communication control device generates an Ethernet message based on the reassembled message authentication code.

The CAN message received during the standby state is called M ₁ , M ₂ , M ₃ , M ₄ , and the previously generated message authentication code is (m ₁ , m ₂ ), (m ₃ , m ₄ ), (m ₅ , If m ₆ ), (m ₇ , m ₈ ) (assuming that the message authentication code is 2 bytes and m is 1 byte), the security device of the vehicle communication control device recombines the previously generated message authentication code and then recombines it. M ₁ is an Ethernet message of M ₁ (m ₁ , m ₄ ), M ₂ is an Ethernet message of M ₂ (m ₃ , m ₆ ), and M ₃ is M ₃ (m ₅ , m ₈ ) Ethernet message, M ₄ converts M ₄ (m ₇ , m ₂ ) Ethernet message.

According to another embodiment of the present invention, after a predetermined time has elapsed in the standby state, the security device of the vehicle communication control device transmits at least one message received during the standby state period to the length of the previously generated message authentication code. Change. Thereafter, the security device of the vehicle communication control device generates an Ethernet message based on the message authentication code whose length has been changed.

The CAN message received during the standby state is called M ₁ , M ₂ , M ₃ , M ₄ , and the previously generated message authentication code is (m ₁ , m ₂ ), (m ₃ , m ₄ ), (m ₅ , If m ₆ ), (m ₇ , m ₈ ) (assuming that the message authentication code is 2 bytes and m is 1 byte), the security device of the vehicle communication control device adds the previously generated message authentication code to M ₁ Is the Ethernet message of M ₁ (m ₁ , m ₂ , m ₃ ), M ₂ is the Ethernet message of M ₂ (m ₄ ), and M ₃ is the Ethernet message of M ₃ (m ₅ , m ₆ , m ₇ ) As, M ₄ converts to Ethernet message of M ₄ (m ₇ ).

In these cases, since the authentication code has been previously received by the receiver, it is possible to decode whether the authentication value is the same value or not through a comparison operation. By doing so, the security device of the vehicle communication control device does not generate a new message authentication code, and recycles the existing message authentication code, thereby reducing the load on the MCU.

In step 140, the security device of the vehicle communication control device transmits the authenticated message to the second communication node through the changed encryption authentication method.

In general, the security device of the vehicle communication control device periodically transmits an authenticated message to the second communication node.

The security device of the vehicle communication control device may change the order of the authenticated messages according to a predetermined priority and transmit the message. For example, if the priority is M ₂ , M ₁ , M ₄ , M ₃ in the M ₁ , M ₂ , M ₃ , M ₄ message, the security device of the vehicle communication control device is M ₁ (m ₁ , m ₂ ), M ₂ (m ₃ , m ₄ ), M ₃ (m ₅ , m ₆ ), M ₄ (m ₇ , m ₈ ) Ethernet messages to M ₂ (m ₃ , m ₄ ), M ₁ (m ₁ , m ₂ ), M ₄ (m ₇ , m ₈ ), M ₃ (m ₅ , m ₆ ) The authenticated message may be transmitted to the second communication node by changing the order. In this case, the security device of the vehicle communication control device may transmit the authenticated message by changing the period. For example, Ethernet messages from M ₂ (m ₃ , m ₄ ), M ₁ (m ₁ , m ₂ ), M ₄ (m ₇ , m ₈ ), M ₃ (m ₅ , m ₆ ) according to priority Is transmitted in a 2-second period, and the authenticated message may be transmitted to the second communication node by changing the period in 1-second, 2-second, and 3-second intervals. Alternatively, an authenticated message may be transmitted with a random transmission period.

4 is a diagram showing a block diagram of a security device of a communication control device for a vehicle according to an embodiment of the present invention.

Referring to FIG. 4, the vehicle communication control device 500 includes a security device 510 and an MCU 520, and the security device 510 includes a receiver 511, a control unit 512, and a message conversion unit 513. , A transmission unit 514 and a storage unit 515.

The receiving unit 511 receives a vehicle control message from the first ECU 400, which is a first communication node.

The communication node means an end node, and the end node is an ECU that controls devices that are mounted on a vehicle and installed to provide a special purpose or function. ECU refers to an electronic control device that controls the state of a car's engine, automatic transmission, and ABS with a computer.

The message is preferably a CAN message. CAN is a standard communication standard designed to allow microcontrollers or devices to communicate with each other without a host computer in a vehicle. In CAN communication, data transmission and reception are performed using message frames. The data frame of the CAN message consists of an SOF field, an Arbitration field, a Control field, a Data field, a CRC field, an ACK field, and an EOF field.

The security devices 510 and ECUs 400 and 600 of the vehicle communication control device 500 can support CAN protocol, MOST protocol, Ethernet protocol, etc. depending on the implementation method, and can support various types (star, ring, bus, mesh, ..) Can be connected in the form of a topology.

ECUs 400 and 600 have their own IP addresses set, can receive a message including an IP address from an upper node, and can set an IP address included in the received message as their own IP address. This is only an example, and the IP address of the communication node can be set through various methods.

The security device 510 of the vehicle communication control device 500 stores identification information of communication nodes constituting the vehicle network, performs authentication for the accessed communication node, and allows or blocks access according to the authentication result. You can also do it.

The receiving unit 511 receives the market share (or utilization rate) from the microcontroller 520, which is a microcontroller included in the vehicle communication control device 500. The MCU 520 is a dedicated processor for controlling a communication control device for a vehicle and may be considered to correspond to a central processing unit (CPU) of a computer.

The control unit 512 changes the encryption authentication method of the received message according to the received share.

In the encryption authentication method, when the received message is a CAN message, the message conversion unit 513 converts the CAN message into an Ethernet message. Specifically, the control unit 512 generates a message authentication code, and the message conversion unit 513 generates an Ethernet message based on the generated message authentication code and some frames of the CAN message.

Ethernet message is composed of Header field and Ethernet Data field, and Ethernet Data field is composed of Padding field, CAN Header field, Data field and Security field. Here, the Header field is configured based on the Arbitration field and the Control field of the CAN message, and the Data field is configured according to the Data field of the CAN message. The Security field contains at least one message authentication code generated by the security device of the vehicle communication control device.

The method of generating the message authentication code is performed in an encryption process of two authentication steps. In the first authentication step, the controller 512 generates the received CAN message as a hash value through a predetermined hash algorithm using an integrity encryption method. The hash function is a function that maps a string to a fixed-length binary string. Integrity here means leaving data that can prove that the unique value of the input data is maintained.

In the second authentication step, the controller 512 encrypts the received CAN message by adding a shared secret key using a predetermined authentication algorithm. The shared secret key must be held by both the sending side and the receiving side.

The control unit 512 generates a message authentication code through a first authentication step and a second authentication step. After that, the message conversion unit 513 includes the generated message authentication code in the Ethernet message.

In an embodiment of the present invention, when the received MCU occupancy rate is less than the first occupancy rate, the control unit 512 generates a message authentication code through both authentication steps. After that, the message conversion unit 513 generates an Ethernet message based on the generated message authentication code. Preferably the first share is 70%.

When the received MCU share is greater than or equal to the first share and less than the second share, the controller 512 generates a message authentication code by performing only one of the two authentication steps. After that, the message conversion unit 513 generates an Ethernet message based on the generated message authentication code. Preferably the second occupancy is 90%.

In another embodiment of the present invention, even if the received MCU occupancy is greater than or equal to the first occupancy and less than the second occupancy, if the predetermined priority is higher than the reference, the controller 512 passes through the authentication steps of both authentication steps. Generate message authentication code. Priority is given for each message according to an importance level when driving a vehicle, and the priority is predetermined and stored in a table format in the storage unit 515.

When the received MCU occupancy rate is greater than or equal to the second occupancy rate, the controller 512 waits without generating a message authentication code.

However, if the standby state is maintained continuously, a problem occurs in that a message is transmitted without authentication, and thus a message can be delivered through authentication in a degree that does not burden the MCU.

According to an embodiment of the present invention, after a predetermined time elapses in the standby state, the controller 512 reuses the previously generated message authentication code for at least one message received during the standby state period. After that, the message conversion unit 513 generates an Ethernet message based on the reused message authentication code. The previously generated message authentication code is stored in the storage unit 515.

The CAN message received during the standby state is called M ₁ , M ₂ , M ₃ , M ₄ , and the previously generated message authentication code is (m ₁ , m ₂ ), (m ₃ , m ₄ ), (m ₅ , m ₆ ), (m ₇ , m ₈ ) (assuming that the message authentication code is 2 bytes and m is 1 byte), the control unit 512 reuses the previously generated message authentication code, and the message conversion unit ( 513) is m ₁ is a _{m 1 (m 1, m 2} ) to the Ethernet message, m ₂ is an Ethernet message of _{m 2 (m 3, m 4} ), m 3 is _{m 3 (m 5, m 6} ) of the As an Ethernet message, M ₄ converts into an Ethernet message of M ₄ (m ₇ , m ₈ ).

According to another embodiment of the present invention, after a predetermined time elapses in the standby state, the control unit 512 recombines the previously generated message authentication code and uses at least one message received during the standby state period. Thereafter, the message conversion unit 513 generates an Ethernet message based on the reassembled message authentication code.

The CAN message received during the standby state is called M ₁ , M ₂ , M ₃ , M ₄ , and the previously generated message authentication code is (m ₁ , m ₂ ), (m ₃ , m ₄ ), (m ₅ , m ₆ ), (m ₇ , m ₈ ) (assuming that the message authentication code is 2 bytes and m is 1 byte), the control unit 512 recombines the previously generated message authentication code, and then the message conversion unit ( 513) is a recombined message authentication code, and M ₁ is an Ethernet message of M ₁ (m ₁ , m ₄ ), M ₂ is an Ethernet message of M ₂ (m ₃ , m ₆ ), and M ₃ is M ₃ the Ethernet message of _{(m 5, m 8),} m 4 is converted into the Ethernet message _{m 4 (m 7, m 2} ).

According to another embodiment of the present invention, after a predetermined time elapses in the standby state, the control unit 512 changes the length of the previously generated message authentication code for at least one message received during the standby state period. . After that, the message conversion unit 513 generates an Ethernet message based on the message authentication code whose length has been changed.

The CAN message received during the standby state is called M ₁ , M ₂ , M ₃ , M ₄ , and the previously generated message authentication code is (m ₁ , m ₂ ), (m ₃ , m ₄ ), (m ₅ , If m ₆ ), (m ₇ , m ₈ ) (assuming that the message authentication code is 2 bytes and m is 1 byte), the control unit 512 changes the length of the previously generated message authentication code to convert the message. Part 513 is M ₁ is an Ethernet message of M ₁ (m ₁ , m ₂ , m ₃ ), M ₂ is an Ethernet message of M ₂ (m ₄ ), and M ₃ is M ₃ (m ₅ , m ₆₎ , m ₇ ) of Ethernet message, M ₄ converts to M ₄ (m ₇ ) Ethernet message.

In these cases, since the authentication code has been previously received by the receiver, it is possible to decode whether the authentication value is the same value or not through a comparison operation. By doing so, the security device of the vehicle communication control device does not generate a new message authentication code, and recycles the existing message authentication code, thereby reducing the load on the MCU.

The transmission unit 514 transmits the authenticated message to the second communication node through the changed encryption authentication method. In general, the transmission unit 514 periodically transmits the authenticated message to the second communication node.

In another embodiment of the present invention, the control unit 512 may change the order of the authenticated messages according to a predetermined priority stored in the storage unit 515 and transmit the transmitted unit 514. For example, in the M ₁ , M ₂ , M ₃ , M ₄ message, if the priority is M ₂ , M ₁ , M ₄ , M ₃ , M ₁ (m ₁ , m ₂ ), M ₂ (m ₃ , m ₄ ), M ₃ (m ₅ , m ₆ ), M ₄ (m ₇ , m ₈ ) Ethernet messages of the control unit 512 are M ₂ (m ₃ , m ₄ ), M ₁ (m ₁ , m ₂ ), M ₄ (m ₇ , m ₈ ), M ₃ (m ₅ , m ₆ ), and the transmitting unit 514 transmits the authenticated message to the second communication node according to the changed order. May be.

In this case, the control unit 512 may change the period of the authenticated message and transmit the transmitted unit 514. For example, depending on the priority, for example, M ₂ (m ₃ , m ₄ ), M ₁ (m ₁ , m ₂ ), M ₄ (m ₇ , m ₈ ), M ₃ (m ₅ , m ₆₎ ) Transmits the Ethernet message every 2 seconds, the control unit 512 changes the period at intervals of 1 second, 2 seconds, and 3 seconds, and the transmission unit 514 transmits the authenticated message to the second communication node according to the changed period. May be. Alternatively, an authenticated message may be transmitted with a random transmission period.

The method according to the above embodiments can be written as a program that can be executed on a computer, and can be implemented in a general-purpose digital computer that operates the program using a computer-readable recording medium. Further, the data structure, program command, or data file that can be used in the above-described embodiments of the present invention may be recorded on a computer-readable recording medium through various means. The computer-readable recording medium may include all types of storage devices that store data that can be read by a computer system. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and floptical disks. A hardware device specially configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like may be included. Further, the computer-readable recording medium may be a transmission medium that transmits a signal specifying a program command, a data structure, or the like. Examples of the program instructions may include not only machine language codes generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

So far, the present invention has been looked at around its preferred embodiments. Those of ordinary skill in the art to which the present invention pertains will be able to understand that the present invention can be implemented in a modified form without departing from the essential characteristics of the present invention. Therefore, the disclosed embodiments should be considered from an illustrative point of view rather than a limiting point of view. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope equivalent thereto should be construed as being included in the present invention.

1st ECU: 400 2nd ECU: 600
Vehicle communication control device: 500 Security device: 510
MCU: 520 receiver: 511
Control unit: 512 Message conversion unit: 513
Transmitter: 514 Storage: 515

Claims (4)

Receiving a vehicle control message from a first communication node;
Receiving an occupancy rate from a microcontroller unit (MCU);
When the received share is less than the first share, a message authentication code is generated using a first authentication step using a hash function and a second authentication step using a secret key, and the received share is the first share to the second share. In the case of occupancy, a message authentication code is generated using only one of the first authentication step and the second authentication step, and when the received share exceeds the second share, the first authentication step or Maintaining a standby state without the second authentication step;
When the received message exceeds a predetermined priority criterion, a message authentication code is generated using the first authentication step and the second authentication step even if the received share is the first share to the second share. Generating;
Converting the received message into a message of a different format using the generated message authentication code; And
And transmitting the changed message to a second communication node. The method of claim 1,
When the waiting state elapses a predetermined time, changing the received message to a message of a different format using a previously generated message authentication code, further comprising,
The step of transmitting the changed message to the second communication node comprises changing the order of the changed message according to the predetermined priority and transmitting the changed message to the second communication node. . A receiving unit for receiving a vehicle control message from the first communication node and receiving occupancy rate from a microcontroller unit (MCU);
When the received share is less than the first share, a message authentication code is generated using a first authentication step using a hash function and a second authentication step using a secret key, and the received share is the first share to the second share. In the case of occupancy, a message authentication code is generated using only one of the first authentication step and the second authentication step, and when the received share exceeds the second share, the first authentication step or If the standby state is maintained without the second authentication step, and the received message exceeds a predetermined priority criterion, the first authentication step even if the received share is the first share to the second share And a control unit that generates a message authentication code using a second authentication step.
A message conversion unit that converts the received message into a message of a different format using the generated message authentication code; And
And a transmission unit for transmitting the changed message to a second communication node. The method of claim 3,
When a predetermined time elapses in the waiting state, the control unit extracts a previously generated message authentication code, and the message conversion unit changes the received message to a message of a different format based on the extracted message authentication code. and,
And transmitting the changed message to a second communication node by changing an order of the changed message according to the predetermined priority.

Images