WO2022032548A1 - 车载网络安全通信方法、装置和设备 - Google Patents

车载网络安全通信方法、装置和设备 Download PDF

Info

Publication number
WO2022032548A1
WO2022032548A1 PCT/CN2020/108772 CN2020108772W WO2022032548A1 WO 2022032548 A1 WO2022032548 A1 WO 2022032548A1 CN 2020108772 W CN2020108772 W CN 2020108772W WO 2022032548 A1 WO2022032548 A1 WO 2022032548A1
Authority
WO
WIPO (PCT)
Prior art keywords
value
initial value
vehicle
message
storage module
Prior art date
Application number
PCT/CN2020/108772
Other languages
English (en)
French (fr)
Inventor
耿峰
沙庆迪
钟胤
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20949047.3A priority Critical patent/EP4191940A4/en
Priority to CN202080004755.2A priority patent/CN112673656B/zh
Priority to PCT/CN2020/108772 priority patent/WO2022032548A1/zh
Publication of WO2022032548A1 publication Critical patent/WO2022032548A1/zh
Priority to US18/167,627 priority patent/US20230199500A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/12—Arrangements for remote connection or disconnection of substations or of equipment thereof
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/002—Countermeasures against attacks on cryptographic mechanisms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/61—Time-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks
    • H04L2012/40208—Bus networks characterized by the use of a particular bus standard
    • H04L2012/40215—Controller Area Network CAN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/84—Vehicles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W56/00—Synchronisation arrangements
    • H04W56/001—Synchronization between nodes
    • H04W56/002—Mutual synchronization

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a method, apparatus and device for vehicle network security communication.
  • controller area network Controller Area network
  • LIN Local Interconnection Network
  • FlexRay multimedia transmission system MOST (Media Oriented Systems Transport), vehicle-mounted Ethernet, etc.
  • CAN Controller Area
  • MOST Media Oriented Systems Transport
  • CAN protocol Due to the advantages of CAN protocol in real-time and reliability, it has been widely used in vehicle network communication.
  • the CAN bus adopts the message-oriented protocol and the architecture of the broadcast bus network, and it is difficult to directly deploy the security measures in the prior art into the vehicle network communication.
  • the AUTOSAR (Automotive Open System Architecture) organization supplemented the SecOC (Secure Onboard Communication) information security component, and introduced the standard of communication encryption and verification in the vehicle communication bus, which is the Protocol Data Unit (PDU).
  • the ECU (Electronic Control Unit) message at the message level provides an effective authentication mechanism to ensure the freshness of the PDU message and prevent message replay attacks.
  • the AUTOSAR SecOC specification provides two options for fresh values: timestamp and monotonic counter.
  • the time stamp scheme relies on synchronizing UTC (Coordinated Universal Time) universal time among all ECUs, but problems such as clock jitter and abnormal time stamp synchronization will cause the receiver to fail to receive CAN messages, resulting in system functional safety issues.
  • the monotonic counter scheme the implementation of the fresh value synchronization mechanism is too complicated, and there are many unpredictable and unstable factors in the fresh value synchronization process, which cannot guarantee timely periodic synchronization, resulting in an enlarged window for replay attacks.
  • the present application provides a vehicle network security communication method, device and device, so that in vehicle network communication, the fresh value can be effectively synchronized during the entire vehicle life cycle of the vehicle, preventing replay attacks, and does not rely on an additional fresh value synchronization mechanism , which reduces the complexity and implementation difficulty of the fresh value synchronization scheme and reduces the consumption of computing resources.
  • an embodiment of the present application provides a vehicle network security communication method, and the method is applied to a sending device, including:
  • a first message is sent, the first message containing the second value.
  • the fresh value can be synchronized effectively and reliably during the life cycle of the whole vehicle, which reduces the risk of replayable attacks, and does not rely on an additional fresh value synchronization mechanism, thereby reducing the complexity of the fresh value synchronization scheme.
  • the complexity and implementation difficulty reduce the consumption of computing resources.
  • the fresh value FV may be an N-bit integer
  • the N-bit integer ensures that the FV increases monotonically during the life cycle of the entire vehicle.
  • the maximum value of the number of messages to be sent can be estimated according to the life cycle of the entire vehicle and the frequency of message sending in the vehicle communication network, and an N-bit integer is determined as a counter based on the maximum value.
  • the difference between the second value and the initial value is a predetermined value
  • the predetermined value is a fixed or variable positive number
  • the predetermined value is a positive number, so as to ensure that the refreshed first FV increases monotonically, and the positive number may be a fixed value or a variable value.
  • the predetermined value is related to the life cycle of the entire vehicle.
  • the predetermined value may be determined on the basis of the life cycle length of the entire vehicle and in combination with the number of times the first FV can be refreshed in the sending device.
  • the predetermined value should not be set too large to avoid consuming the entire vehicle life cycle defined by the N-bit integer too quickly; the predetermined value should not be set too small to avoid premature failure of vehicle components due to frequent refresh.
  • the initial value of the first FV is 0, the value of the FV refreshed last time, or the value of the reset FV.
  • the value of the reset FV is related to a vehicle state parameter.
  • the vehicle state parameter includes at least one of an accumulated mileage or an accumulated travel time of the vehicle.
  • the second value of the first FV is increased by a predetermined value or the amount of information sent during time T1 and time T2 is increased to obtain a third value, and the The binary value is refreshed to the third value, wherein the time T1 is earlier than the time T2.
  • an embodiment of the present application provides a vehicle network security communication method, and the method is applied to a receiving device, including:
  • the initial value of the second FV is refreshed to the second value of the first FV, wherein the first condition includes that the second value of the first FV is greater than or equal to the initial value of the second FV and the predetermined value.
  • the predetermined value is a positive number with a fixed or variable value.
  • the predetermined value is associated with the vehicle's entire vehicle life cycle
  • the initial value of the second FV is 0, the value of the FV refreshed last time, or the value of the reset FV.
  • the value of the reset FV is related to a vehicle state parameter.
  • the vehicle state parameter includes at least one of an accumulated mileage or an accumulated travel time of the vehicle.
  • an embodiment of the present application provides a device for sending an in-vehicle network, the device comprising:
  • a first processing module configured to obtain the initial value of the first fresh value FV, obtain the second value of the first FV according to the initial value, and refresh the initial value to the second value;
  • a first sending module configured to send a first message, where the first message includes the aforementioned second value.
  • the sending device of the in-vehicle network may further include a first storage module, and the initial value of the first FV is stored in the first storage module.
  • the first storage module may be non-volatile storage.
  • an embodiment of the present application provides a device for receiving a vehicle network, the device comprising:
  • a first receiving module configured to receive a first message, the first message including the second value of the first fresh value FV;
  • the second processing module is configured to obtain the initial value of the second fresh value FV, and when the first condition is satisfied, refresh the initial value of the second FV to the second value of the first FV, where the first condition includes the first FV
  • the second value of is greater than or equal to the sum of the initial value of the second FV and the predetermined value.
  • the receiving device of the in-vehicle network may further include a second storage module, and the initial value of the second FV is stored in the second storage module.
  • the second storage module may be non-volatile storage.
  • the first storage module and the second storage module may be the same or different.
  • an in-vehicle network communication device comprising:
  • a first processing module configured to obtain an initial value of the first fresh value FV, obtain a second value according to the initial value, and refresh the initial value to the second value;
  • a first sending module configured to send a first message, the first message including the second value of the first FV
  • a first receiving module configured to receive the first message
  • the second processing module is configured to obtain the initial value of the second fresh value FV, and refresh the initial value of the second FV to the second value when the first condition is satisfied, where the first condition includes that the second value of the first FV is greater than or equal to the sum of the initial value of the second FV and the predetermined value.
  • the device may further include a storage module, and the initial value of the first FV and the initial value of the second FV are stored in the storage module.
  • the storage module may be non-volatile storage.
  • the in-vehicle network communication device may further include at least one of a first storage module or a second storage module, and the aforementioned initial value of the first FV is stored in the first storage module , the initial value of the second FV is stored in the second storage module.
  • the first storage module or the second storage module may be non-volatile storage.
  • embodiments of the present application provide a computer-readable storage medium on which a computer program is stored, and when the computer program is executed, implements the methods of the foregoing first and second aspects.
  • an embodiment of the present application provides a communication device, including a processor, which is coupled to a memory, and a computer program is stored on the memory, and the processor is configured to execute the computer program stored on the memory, so as to realize the above-mentioned The method of an embodiment of the first aspect and the second aspect.
  • the fresh value can be effectively and reliably synchronized during the life cycle of the entire vehicle, which reduces the risk of replayable attacks, and does not rely on an additional fresh value synchronization mechanism, thereby reducing the complexity of the fresh value synchronization scheme. degree and implementation difficulty, reducing the consumption of computing resources.
  • FIG. 1 is a schematic flowchart of a vehicle network communication method in the prior art
  • FIG. 2 is a schematic flowchart of another vehicle-mounted network communication method in the prior art
  • FIG. 3 is a schematic flowchart of another vehicle network communication method in the prior art
  • FIG. 5 is a schematic flowchart of a vehicle network security communication method
  • FIG. 6 is a schematic structural diagram of a sending device of a vehicle-mounted network
  • FIG. 7 is a schematic structural diagram of a receiving device of a vehicle-mounted network
  • FIG. 8 is a schematic structural diagram of an in-vehicle network communication device
  • FIG. 9 is a schematic structural diagram of a communication device
  • FIG. 1 and FIG. 2 are both schematic flowcharts of a vehicle-mounted network communication method in the prior art, specifically two existing fresh value synchronization solutions in vehicle-mounted CAN communication.
  • Figure 1 is a centralized fresh value management CFVM (Centralized Freshness Value Management) method
  • Figure 2 is a distributed fresh value management DFVM (Decentralized Freshness Value Management) method.
  • CFVM Centralized Freshness Value Management
  • DFVM Distributed Freshness Value Management
  • the robustness is better than the centralized fresh value management method, and the security risk is smaller than CFVM, but DFVM occupies more controllers
  • the LAN CAN ID resources occupy more computing resources as a whole to maintain more fresh value synchronization.
  • the design of three synchronization counters and a complex synchronization mechanism will make the solution too complicated to ensure periodic synchronization of fresh values. This can cause the replayable attack window to enlarge.
  • FIG. 3 is a schematic flow chart of another vehicle network communication method in the prior art, specifically the fresh value synchronization method of the AUTOSAR SecOC scheme.
  • the implementation of this scheme has an ideal assumption, that is, the fresh value of the sender is required to be permanent and monotonous.
  • the specific steps are as follows:
  • Step S310 The sender ensures that the counter increases monotonically before sending the message, and updates the fresh value
  • Step S320 the sender sends a message to the receiver, and the message includes a message authentication code MAC (Message Authentication Code);
  • MAC Message Authentication Code
  • Step S330 the receiving end performs MAC verification after receiving the message
  • Step S340 After the MAC verification is successful, the sender updates the fresh value.
  • the fresh value is designed to be monotonically increasing, and the writing strategy needs to be triggered during the operation of the vehicle to write the fresh value into the non-volatile storage.
  • the write strategy includes: 1. Write before the vehicle is powered off or the ECU goes to sleep, this strategy is suitable for constant-current devices; 2. Periodic write, the write cycle can refer to the write failure of non-volatile storage Life cycle is determined.
  • the unsynchronized writing cycles of the sender and receiver may also cause the probabilistic fresh values to become unsynchronized, for example, when the sender's non-volatile storage
  • the value of FV ⁇ the value of FV in the non-volatile storage of the receiving end may cause the verification information of the receiving end to fail, resulting in abnormal communication.
  • the fresh value since the fresh value is actively maintained by the sender and updated passively at the receiver, for example, if the components of the sender are repaired and replaced, the fresh values of the sender and the receiver will be out of sync.
  • FIG. 4 is a schematic flowchart of a vehicle network security communication method provided by an embodiment of the present application. The method is applied to a sending device. The following takes CAN bus communication commonly used in the vehicle communication field as an example for detailed introduction.
  • Step S410 After the sending device is powered on, the initial value of the first fresh value FV is obtained.
  • the initial value may be 0, or may be the value of the FV refreshed last time.
  • the initial value of the first FV may be the value of the reset FV in the case of repair or replacement of vehicle components.
  • the fresh value FV can be an N-bit integer, and the N-bit integer guarantees that the FV increases monotonically during the life cycle of the entire vehicle.
  • the length N can be determined on the basis of the estimated maximum value of the number of messages sent according to the life cycle of the entire vehicle and the message sending frequency in the vehicle communication network. This N-bit integer is implemented by a counter. When determining the aforementioned length N, the life cycle of the entire vehicle and the load constraints of CAN bus communication should be taken into account. As an example, the aforementioned length N may be determined by:
  • the total number of messages that can be sent in the vehicle life cycle is ⁇ 2 N , N+24 ⁇ CAN message load, that is:
  • t is the message sending interval of CAN communication, in milliseconds (millisecond, ms), and T is the life cycle of the vehicle, in years;
  • the freshness values of various components in the vehicle can be reset by adding a new diagnostic command.
  • the reset FV should not have been used during vehicle operation.
  • the reset FV can be determined according to the mileage accumulated by the vehicle or the accumulated travel time of the vehicle and estimated according to the above method.
  • the maximum life cycle of the vehicle is 34.865 years
  • the message sending interval of CAN communication is 1 millisecond
  • the fresh value defined by the 40-bit counter is taken as an example.
  • the vehicle life cycle is 34.865 years
  • the message sending interval of CAN communication is 1 millisecond
  • the fresh value defined by the 40-bit counter is taken.
  • the date and the production date of the vehicle are converted to the difference in milliseconds, and the fresh value of the reset is further obtained according to the difference.
  • Step S420 Further, obtain the second value of the first FV according to the obtained initial value of the first FV.
  • a predetermined value may be added to the initial value of the first FV to obtain a second value, and the second value of the first FV is greater than the initial value.
  • the predetermined value is a positive number, so that the aforementioned second value can be ensured to be larger than the initial value.
  • the positive number may be a positive number with a fixed value, or a positive number with a variable value.
  • Step S430 Further, refresh the initial value of the first FV to the second value.
  • the aforementioned refresh is implemented by writing the second value of the first FV into the first storage module, and when the second value is written After the first storage module, the aforementioned second value will be used as the initial value of the first FV.
  • the operation of reading the written FV from the storage module is performed.
  • an abnormal alarm is reported.
  • the second value (or the refreshed initial value described above) is increased by a predetermined value or the amount of information sent during time T1 and time T2 is increased to obtain a third value, and the second value is (or the aforementioned refreshed initial value) is refreshed to the third value.
  • time T1 is the time when the second value is obtained
  • T2 is the time when the third value is obtained
  • the difference between T2 and T1 can be defined as the refresh period.
  • a new FV can be obtained and refreshed by adding a predetermined value to the previous FV according to the aforementioned refresh cycle. It can be understood that during the period from T1 to T2, the transmitter can always be in a power supply state or a normal working state, that is, there is no power failure or abnormal working state, and the initial value of FV has not been refreshed for other reasons.
  • the refresh cycle can refer to the design cycle value of the rewrite capability supported by the hardware (for example: seconds, minutes or hours).
  • the rewriting cycle should meet the premise that the writing is effective in the life cycle of the whole vehicle, and cannot be rewritten too frequently.
  • the product can be erased and written for a maximum of 125,000 times.
  • Refresh cycle min(2 40 , vehicle life cycle*24*365*60*60*1000)/n/1000/(60*60) Formula (2)
  • n is the maximum rewritable number of times of non-volatile storage.
  • a refresh period of 2.443 hours can be obtained. It can be seen from formula (2) that the larger the maximum erasable times, the smaller the reliable refresh cycle can be designed.
  • the refresh cycle cannot be set too small to avoid consuming the entire vehicle life cycle defined by the complete fresh value too quickly.
  • the refresh period can be set according to the statistical average single driving time.
  • Step S440 Further, the aforementioned sending apparatus sends a first message, where the first message includes the aforementioned second value of the first FV.
  • FIG. 5 is a schematic flowchart of an in-vehicle network security communication method provided by an embodiment of the present application. The method is applied to a receiving device. The following will continue to take CAN bus communication as an example for detailed introduction.
  • Step S510 After the receiving apparatus is powered on, the initial value of the second fresh value FV is obtained.
  • the initial value may be 0, or may be the value of the FV refreshed last time.
  • the initial value of the second FV may be the value of the reset FV in the case of repair or replacement of vehicle components.
  • Step S520 Further, the receiving apparatus receives a first message, the first message is sent from the aforementioned sending apparatus, and the first message includes the second value of the first FV.
  • Step S530 Further, when the first condition is satisfied, refresh the initial value of the second FV to the second value of the aforementioned first FV.
  • the first condition includes that the second value of the first FV is greater than or equal to the sum of the initial value of the second FV and the predetermined value.
  • the aforementioned refresh is implemented by writing the second value of the aforementioned first FV into the second storage module, when the After the second value is written into the first storage module, the second value will be used as the initial value of the second FV.
  • the operation of reading the written FV from the storage module is performed.
  • an abnormal alarm is reported.
  • FIG. 6 is a schematic structural diagram of an in-vehicle network sending apparatus 600 provided by an embodiment of the present application, which is used to execute the in-vehicle network security communication method shown in FIG. 4 .
  • the device includes the following modules:
  • the first processing module 620 is configured to obtain the initial value of the first fresh value FV, obtain the second value of the first FV according to the initial value, and refresh the initial value of the first FV to the second value;
  • the first sending module 630 is configured to send a first message, where the first message includes the second value of the first FV.
  • the sending apparatus further includes a first storage module 610, and the initial value of the first FV is stored in the first storage module.
  • FIG. 7 is a schematic structural diagram of an in-vehicle network receiving apparatus 700 provided by an embodiment of the present application, which is used to execute the in-vehicle network security communication method shown in FIG. 5 .
  • the device includes:
  • a first receiving module 730 configured to receive a first message, where the first message includes a second value of the first fresh value FV;
  • the second processing module 720 is configured to obtain the initial value of the second fresh value FV, and when the first condition is satisfied, to refresh the initial value of the second FV to the second value of the first FV, where the first condition includes the first
  • the second value of an FV is greater than or equal to the sum of the initial value of the second FV and the predetermined value.
  • the receiving apparatus further includes a second storage module 710, and the aforementioned initial value of the second FV is stored in the second storage module.
  • the first storage module 610 is different from the second storage module 710 , and the first storage module 610 and the second storage module 710 are respectively arranged in the sending apparatus 600 and the receiving apparatus 700 .
  • the first storage module 610 is the same as the second storage module 710, that is, the storage module can cooperate with the functional modules of the transmitting device 600 and the receiving device 700 at the same time and store the initial value of the first FV and the second FV respectively. the initial value of .
  • FIG. 8 is an in-vehicle network communication device 800 provided by an embodiment of the present application, and the communication device executes the in-vehicle network security communication method shown in FIG. 4 and FIG. 5 . It includes the following modules:
  • the first processing module 620 is configured to obtain the initial value of the first fresh value FV, obtain the second value according to the initial value, and refresh the initial value to the second value;
  • a first sending module 630 configured to send a first message, where the first message includes the second value of the first FV;
  • a first receiving module 730 configured to receive the first message
  • the second processing module 720 is configured to obtain the initial value of the second fresh value FV, and when the first condition is satisfied, refresh the initial value of the second FV to the aforementioned second value, and the second condition includes the second value of the first FV Greater than or equal to the sum of the initial value of the second FV and the predetermined value.
  • the in-vehicle network communication device may further include a first storage module 610 and a second storage module 710, the initial value of the first FV is stored in the first storage module 610, and the initial value of the second FV is stored in the The second storage module 710 .
  • first storage module 610 and the second storage module 710 may be the same storage module, and the initial value of the first FV and the initial value of the second FV are stored in the storage module respectively.
  • An embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed, implements the vehicle network security communication method provided by the embodiments shown in FIG. 4 and FIG. 5 of the present application.
  • FIG. 9 is a schematic structural diagram of a communication device 900 provided by an embodiment of the present application, including:
  • the processor 910 is configured to execute the computer program stored in the memory 920, so as to implement the vehicle network security communication method provided by the embodiments shown in FIG. 4 and FIG. 5 of the present application.
  • the memory 920 is coupled to the processor 910 .
  • the processor 910 may be one or more processors, which is not limited in this application.
  • the communication device may further include the above-mentioned memory 920, and a computer program is stored on the memory 920.
  • words such as “first” and “second” are used to identify the same or similar items that have basically the same function and effect. Distinguishing, for example, the first fresh value and the second fresh value is only for distinguishing different fresh values, unless otherwise expressly specified and limited, the order of which is not limited, nor should it be construed as an indication or implication. Those skilled in the art can understand that words such as “first” and “second” do not limit the quantity and execution order.
  • the “automobile”, “vehicle” and “complete vehicle” in the embodiments of this application may be fuel vehicles, hybrid vehicles, electric vehicles, and fuel cell vehicles, wherein electric vehicles include pure electric vehicles, extended-range electric vehicles, etc., This application does not specifically limit this.
  • Computer-readable media may include computer-readable storage media, which correspond to tangible media, such as data storage media, or include any communication media that facilitate transfer of a computer program from one place to another (eg, according to a communication protocol) .
  • a computer-readable medium may generally correspond to (1) a non-transitory tangible computer-readable storage medium, or (2) a communication medium such as a signal or carrier wave.
  • Data storage media can be any available media that can be accessed by one or more computers or one or more processors to retrieve instructions, code and/or data structures for implementing the techniques described in this application.
  • the computer program product may comprise a computer-readable medium.
  • such computer-readable storage media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, flash memory, or may be used to store instructions or data structures desired program code in the form of any other medium that can be accessed by a computer.
  • any connection is properly termed a computer-readable medium.
  • a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave are used to transmit instructions from a website, server, or other remote source
  • the coaxial cable Wire, fiber optic cable, twisted pair, DSL or wireless technologies such as infrared, radio and microwave are included in the definition of medium.
  • computer-readable storage media and data storage media do not include connections, carrier waves, signals, or other transitory media, but are instead directed to non-transitory, tangible storage media.
  • magnetic disks and optical disks include compact disks (CDs), laser disks, optical disks, digital versatile disks (DVDs), and Blu-ray disks, where disks typically reproduce data magnetically, while disks reproduce optically with lasers data. Combinations of the above should also be included within the scope of computer-readable media.
  • DSPs digital signal processors
  • ASICs application specific integrated circuits
  • FPGAs field programmable logic arrays
  • processors may refer to any of the foregoing structure or any other structure suitable for implementation of the techniques described herein.
  • the foregoing techniques may be fully implemented in one or more circuits or logic elements.
  • the techniques of this application may be implemented in a wide variety of devices or apparatuses, including in-vehicle equipment, an integrated circuit (IC), or a set of ICs (eg, a chip set).
  • IC integrated circuit
  • a set of ICs eg, a chip set.
  • Various components, modules are described in this application to emphasize functional aspects of means for performing the disclosed techniques, but do not necessarily require realization by different hardware. Indeed, as described above, the various modules may be combined in hardware in conjunction with suitable software and/or firmware, or provided by interoperating hardware including one or more processors as described above.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Small-Scale Networks (AREA)

Abstract

本申请提供了一种车载网络安全通信方法、装置和设备，在车载网络通信中保证新鲜值在车辆的整车生命周期内有效同步，防止重放攻击。该设备包括：第一处理模块，用于获取第一新鲜值FV的初始值，根据该初始值获得第二值，将初始值刷新为前述第二值；第一发送模块，用于执行第一消息发送，该第一消息包含前述第一FV的第二值；第一接收模块，用于接收第一消息；第二处理模块，用于获取第二新鲜值FV的初始值，满足第一条件时，将第二FV刷新为第二值，第二条件包括第一FV的第二值大于或等于第二FV的初始值与预定值之和。

Description

车载网络安全通信方法、装置和设备 技术领域
本申请涉及通信技术领域，尤其涉及一种车载网络安全通信方法、装置和设备。
背景技术
近些年，汽车技术朝着智能化、电动化、网联化、共享化方向快速发展，车辆内部电子设备的数量、连接和交互也不断增多，逐渐形成了以控制器局域网络CAN(Controller Area Network)、本地互联网络LIN(Local Interconnection Network)、FlexRay、多媒体传输系统MOST(Media Oriented Systems Transport)、车载以太Ethernet等为代表的车载通信网络。在现有的车载网络中，大部分基本都是在没有安全措施或者安全措施较低的情况进行数据传输的，容易受到黑客的恶意攻击。
由于CAN协议在实时性、可靠性方面的优势，在车载网络通信中获得了广泛的应用。然而，CAN总线采用了面向消息的协议和广播总线网络的体系结构，难以将现有技术中的安全措施直接部署到车载网络通信中。一旦发生攻击者访问CAN总线的情况，攻击者注入的每个帧都有可能被读取为合法的帧，从而实现控制车辆的功能，如加速或制动操作，由此导致汽车存在安全隐患。
对于以上问题，汽车开放架构AUTOSAR(Automotive Open System Architecture)组织补充了SecOC(Secure Onboard Communication)信息安全组件，在车载通信总线中引入通信加密和验证的标准，为协议数据单元(Protocol Data Unit,PDU)消息级别上电子控制单元ECU(Electronic Control Unit)消息提供有效的认证机制，确保PDU消息的新鲜度，防止消息重放攻击。AUTOSAR SecOC规范给出新鲜值可采用时间戳和单调计数器两种可选方案。时间戳方案依赖在所有ECU间同步UTC(Coordinated Universal Time)世界标准时间，但是时钟抖动和时间戳同步异常等问题会导致接收器无法接收CAN消息，导致系统功能安全问题。对于单调计数器方案，新鲜值同步机制的实现过于复杂，新鲜值同步过程中存在诸多不可预见的不稳定因素，无法保证及时进行周期性同步，导致重放攻击的窗口放大。
由此可见，目前亟需一种简单有效的车载网络安全通信方法，保证新鲜值在车辆的整车生命周期内有效同步，防止重放攻击。
发明内容
本申请提供了一种车载网络安全通信方法、装置和设备，使车载网络通信中，新鲜值在车辆的整车生命周期内保证有效同步，防止重放攻击，且不依赖额外的新鲜值同步机制，降低了新鲜值同步方案的复杂度和实现难度，减少了对计算资源的消耗。
第一方面，本申请实施例提供一种车载网络安全通信方法，该方法应用于发送装置，包括：
获取第一新鲜值FV(Freshness Value)的初始值；
根据该初始值获得该第一FV的第二值，该第二值大于该初始值；
将该初始值刷新为该第二值；
发送第一消息，该第一消息包含该第二值。
通过本申请的技术方案，新鲜值在整车生命周期内能够进行有效、可靠地同步，减 小了可重放攻击的风险，且不依赖额外的新鲜值同步机制，降低了新鲜值同步方案的复杂度和实现难度，减少了对计算资源的消耗。
结合第一方面，在一些可能的实施方式中，新鲜值FV可以为一个N-bit整数，该N-bit整数保证该FV在整车生命周期内单调递增。长度N可以根据整车生命周期以及该车载通信网络中的消息发送频率预估消息发送数量的最大值，以该最大值为基础确定一个N-bit整数作为计数器。
结合第一方面，在一些可能的实施方式中，该第二值与该初始值的差值为预定值，该预定值为数值固定或者可变的正数。
在该可能的实施方式中，该预定值为正数，从而可以保证刷新后的第一FV单调递增，该正数可以为固定数值，也可以为可变数值。
结合第一方面，在一些可能的实施方式中，该预定值与整车生命周期相关。
在该可能的实施方式中，该预定值可以在整车生命周期长度的基础上，结合第一FV在该发送装置中可刷新的次数进行确定。该预定值不应设置过大，以避免过快消耗由N-bit整数所定义的整车生命周期；该预定值也不应设置过小，以避免由于频繁刷新导致车载部件的过早失效。
结合第一方面，在一些可能的实施方式中，第一FV的初始值为0、前次刷新的FV的值或者重置的FV的值。
在该可能的实施方式中，重置的FV的值与车辆状态参数相关。示例性地，该车辆状态参数包括车辆累计行驶里程或者累计行驶时间中至少一项。
结合第一方面，在一些可能的实施方式中，在T2时刻，将第一FV的第二值增加预定值或者增加在T1时刻和T2时刻期间发送的信息的数量，获得第三值，将第二值刷新为第三值，其中，T1时刻早于T2时刻。
第二方面，本申请实施例提供一种车载网络安全通信方法，该方法应用于接收装置，包括：
获取第二新鲜值FV的初始值；
接收第一消息，该第一消息包含前述第一FV的第二值；
满足第一条件时，将该第二FV的初始值刷新为该第一FV的第二值，其中，该第一条件包括该第一FV的第二值大于或等于该第二FV的初始值与预定值之和。
结合第二方面，在一些可能的实施方式中，该预定值为数值固定或者可变的正数。
结合第二方面，在一些可能的实施方式中，预定值与车辆的整车生命周期关联
结合第二方面，在一些可能的实施方式中，第二FV的初始值为0、前次刷新的FV的值或者重置的FV的值。
在该可能的实施方式中，重置的FV的值与车辆状态参数相关。示例性地，该车辆状态参数包括车辆累计行驶里程或者累计行驶时间中至少一项。
第三方面，本申请实施例提供一种车载网络的发送装置，该装置包括：
第一处理模块，用于获取第一新鲜值FV的初始值，根据该初始值获得第一FV的第二值，将该初始值刷新为第二值；
第一发送模块，用于执行第一消息发送，该第一消息包含前述第二值。
结合第三方面，在一些可能的实施方式中，该车载网络的发送装置中还可以包括第一存储模块，第一FV的初始值存储于第一存储模块。示例性地，第一存储模块可以为非 易失性存储。
第四方面，本申请实施例提供一种车载网络的接收装置，该装置包括：
第一接收模块，用于接收第一消息，该第一消息包含第一新鲜值FV的第二值；
第二处理模块，用于获取第二新鲜值FV的初始值，满足第一条件时，用于将第二FV的初始值刷新为第一FV的第二值，该第一条件包括第一FV的第二值大于或等于第二FV的初始值与预定值之和。
结合第四方面，在一些可能的实施例中，该车载网络的接收装置中还可以包括第二存储模块，第二FV的初始值存储于该第二存储模块。具体地，该第二存储模块可以为非易失性存储。
结合第四方面，在一些可能的实施例中，该第一存储模块与该第二存储模块可以相同或者不同。
第五方面，本申请实施例提供一种车载网络通信设备，该设备包括：
第一处理模块，用于获取第一新鲜值FV的初始值，根据该初始值获得第二值，将该初始值刷新为第二值；
第一发送模块，用于发送第一消息，该第一消息包含第一FV的第二值；
第一接收模块，用于接收第一消息；
第二处理模块，用于获取第二新鲜值FV的初始值，满足第一条件时，将前述第二FV的初始值刷新为第二值，该第一条件包括第一FV的第二值大于或等于第二FV的初始值与预定值之和。
结合第五方面，在一些可能的实施例中，该设备还可以包括存储模块，前述第一FV的初始值和前述第二FV的初始值存储于该存储模块。具体地，该存储模块可以为非易失性存储。
结合第五方面，在一些可能的实施例中，该车载网络通信设备中还可以包括第一存储模块或第二存储模块中的至少一种，前述第一FV的初始值存储于第一存储模块，前述第二FV的初始值存储于第二存储模块。具体地，该第一存储模块或第二存储模块可以为非易失性存储。
第六方面，本申请实施例提供一种计算机可读存储介质，其上存有计算机程序，该计算机程序被执行时实现如前述第一方面和第二方面实施例的方法。
第七方面，本申请实施例提供一种通信设备，包括处理器，该处理器与存储器耦合，该存储器上存储有计算机程序,该处理器用于执行该存储器上存储的计算机程序，以实现如前述第一方面和第二方面实施例的方法。
本申请的技术方案，新鲜值在整车生命周期内能够进行有效、可靠的同步，减小了可重放攻击的风险，且不依赖额外的新鲜值同步机制，降低了新鲜值同步方案的复杂度和实现难度，减少了对计算资源的消耗。
附图说明
图1为现有技术中的一种车载网络通信方法的流程示意图；
图2为现有技术中的又一种车载网络通信方法的流程示意图；
图3为现有技术中的另一种车载网络通信方法的流程示意图；
图4为一种车载网络安全通信方法的流程示意图；
图5为一种车载网络安全通信方法的流程示意图；
图6为一种车载网络的发送装置的示意性结构图；
图7为一种车载网络的接收装置的示意性结构图；
图8为一种车载网络通信设备的示意性结构图；
图9为一种通信设备的示意性结构图；
具体实施方式
以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施方式仅用以解释本申请，而非用于限定本申请。
以下将以CAN总线通信为例，结合说明书附图对本申请的具体实施方式进行说明。
图1和图2均是现有技术中的车载网络通信方法的流程示意图，具体为现有的两种车载CAN通信中的新鲜值同步方案。其中，图1是集中式新鲜值管理CFVM(Centralized Freshness Value Management)方法，图2是分布式新鲜值管理DFVM(Decentralized Freshness Value Management)方法。对于集中式新鲜值管理方法来说，CFVM和所有ECU共享一个密钥，通信安全风险集中于CFVM一点，需要考虑备份机制，CFVM需要常供电常在线以保障新鲜值可以顺利地同步。对于分布式新鲜值管理方法来说，尽管在同步消息失败的情况下不影响其它消息，鲁棒性优于集中式新鲜值管理方法，安全风险也小于CFVM，但DFVM占用了更多的控制器局域网CAN ID资源，整体占用更多的计算资源用于维护更多新鲜值同步。现有技术中对于新鲜值同步的实现，如AUTOSAR SecOC配置3的新鲜值同步实现方式中，三个同步计数器和复杂同步机制的设计会导致方案实现过于复杂，无法保证周期性同步新鲜值，由此可能导致可重放攻击窗口放大。
图3是现有技术中的另一种车载网络通信方法的流程示意图，具体为AUTOSAR SecOC方案的新鲜值同步方法，该方案的实现有一个理想的假设前提，即要求发送端的新鲜值永久、单调地递增，具体步骤如下：
步骤S310：发送端在发送消息前保证计数器单调递增，对新鲜值进行更新；
步骤S320：发送端向接收端发送消息，该消息包含了消息认证码MAC(Message Authentication Code)；
步骤S330：接收端接收消息后进行MAC验证；
步骤S340：MAC验证成功后，发送端对新鲜值进行更新。
然而，在实际的技术方案实现中，新鲜值必须复写到非易失性存储中才能做到永久维护，由此也会面临来自非易失性存储可靠性的挑战。
新鲜值被设计成单调递增，在车辆运行过程中需要写入策略触发，将新鲜值写入非易失性存储中。示例性地，写入策略包括：1、在车辆下电或ECU休眠前写入，该策略适用于常电设备；2、周期性写入，写入周期可参考非易失性存储的写失效生命周期进行确定。由于车辆的下电或ECU的不确定性和不可预知性，发送端和接收端写入周期的不同步也可能导致概率性的新鲜值不同步，例如，当发送端非易失性存储中的FV的值<接收端非易失性存储中的FV的值，可能会导致接收端校验信息不通过，从而出现通信异常。另外，由于新鲜值是发送端主动维护的，接收端被动更新，示例性地，如果发送端的部件出现维修换件的情况，也会造成发送端和接收端的新鲜值不同步。
图4是本申请实施例提供的一种车载网络安全通信方法的流程示意图，该方法应用于发送装置，以下以车载通信领域普遍应用的CAN总线通信为例进行详细介绍。
步骤S410：发送装置上电后，获取第一新鲜值FV的初始值。作为示例，该初始值可 以为0，也可以为前次刷新的FV的值。在进行车辆部件的维修或者更换的情况下，第一FV的初始值可以为重置的FV的值。
新鲜值FV可以为一个N-bit整数，该N-bit整数保证该FV在整车生命周期内单调递增。长度N可以根据整车生命周期以及该车载通信网络中的消息发送频率预估消息发送数量的最大值，以该最大值为基础确定。该N-bit整数通过计数器实现。在确定前述的长度N时，要兼顾到整车生命周期和CAN总线通信的负载约束。作为示例，前述的长度N可以通过以下方法进行确定：
整车生命周期内可发送的消息总数<2 N,N+24≤CAN消息负载,即：
60*60*24*365*T*10 3/t<2 N             公式(1)
上式中，t是CAN通信的消息发送间隔，单位为毫秒(millisecond,ms)，T为整车生命周期，单位为年；
在CAN消息负载为64字节的条件下，N的最大值为40；
以CAN通信的消息发送间隔为1毫秒为例，按照公式(1)进行计算可知，整车生命周期最大为34.865年。亦即，由该40-bit计数器定义的新鲜值可以保证在34.865年内单调递增。
作为示例，在车载部件进行维修换件导致发送端和接收端的新鲜值不同步的场景下，可以通过新增诊断命令重置车辆内部各部件的新鲜值。重置的FV在车辆运行期间应当没有被使用过。可以根据车辆累计行驶的里程或者车辆的累计行驶时间，按照上述方法进行估算，确定重置的FV。
作为一个具体实施方式，按照前述条件：整车生命周期最大为34.865年、CAN通信的消息发送间隔为1毫秒、40-bit计数器定义的新鲜值，以累计行驶里程为例，假设该车辆的累计行驶里程为5万公里，以普通人步行平均速度5公里/小时为基础(假设该5万公里是以5公里/小时的速度行驶的，车辆实际行驶速度通常会远高于5公里/小时，这样估算是为了保证重置的新鲜值尽量单调递增)，估算出该车辆可能已行驶的最大时间10000小时，对应重置新鲜值＝10000*60*60*10 3。
作为又一个具体实施方式，按照前述条件：整车生命周期为34.865年、CAN通信的消息发送间隔为1毫秒、40-bit计数器定义的新鲜值，以累计行驶时间为例，根据重置新鲜值的日期与该车辆的生产日期，换算出以毫秒为单位的差值，进一步根据该差值得到重置的新鲜值。
步骤S420：进一步地，根据所获取的第一FV的初始值获得其第二值。作为示例，可以在第一FV初始值的基础上增加一预定值，获得第二值，第一FV的该第二值大于初始值。该预定值为正数，从而可以确保前述的第二值大于初始值。该正数可以为一数值固定的正数，也可以为一数值可变的正数。
步骤S430：进一步地，将第一FV的初始值刷新为该第二值。示例性地，在第一FV的初始值存储于第一存储模块的条件下，前述的刷新是通过将第一FV的第二值写入该第一存储模块中实现，当第二值写入该第一存储模块中后，前述第二值将作为第一FV的初始值。可选地，前述的将第一FV的第二值写入第一存储模块后，执行从该存储模块中读取所写入的FV的操作。可选地，在读取校验失败的条件下，上报异常告警。
进一步地，在T2时刻，将第二值(或者前面所述的刷新后的初始值)增加预定值或者增加在T1时刻和T2时刻期间发送的信息的数量，获得第三值，将第二值(或者前面所述 的刷新后的初始值)刷新为第三值。具体地，T1时刻为获得第二值的时刻，T2为获得第三值的时刻，T2与T1的差值可以定义为刷新周期。可选地，可以根据车辆的运行状态，按照前述的刷新周期在前一FV的基础上增加预定值获得新的FV并进行刷新。可以理解的，在T1到T2期间，发送端可以一直处于供电状态，或正常工作状态，即没有出现过断电，或异常工作状态，FV的初始值也没有因为其它原因被刷新过。
作为示例，刷新周期可以参考硬件可支持的复写能力设计周期值(例如：秒或者分钟或者小时)，具体周期值应根据整车厂所采购器件的非易失性存储的写失效生命周期来评估，复写周期应满足整车生命周期内写有效为前提，不可以过于频繁地进行复写。以某非易失性产品为例进行具体的示例性描述，该产品在保证存储数据最长10年可用的前提下，最大可擦写次数125000次。假设新鲜值FV由长度N＝40bit的计数器定义，在CAN消息的发送间隔为1ms的条件下，至少可以覆盖整车生命周期的最大值34.865年，可按照公式(2)定义整车生命周期内可靠的刷新周期。
刷新周期＝min(2 40，整车生命周期*24*365*60*60*1000)/n/1000/(60*60)   公式(2)
在公式(2)中，n为非易失性存储的最大可擦写次数。根据公式(2)进行估算，在可擦写次数取最大值125000次的条件下，可以获得刷新周期为2.443小时。由式(2)可以看出，最大可擦写次数越大，则可靠的刷新周期就可以设计的越小。另一方面，刷新周期也不可以设置过小，以避免过快消耗由完整新鲜值定义的整车生命周期。可选地，刷新周期可以根据统计平均单次驾驶时间内进行设置。
步骤S440：进一步地，前述的发送装置发送第一消息，该第一消息包含前述第一FV的第二值。
图5是本申请实施例提供的一种车载网络安全通信方法的流程示意图，该方法应用于接收装置，以下继续以CAN总线通信为例进行详细介绍。
步骤S510:接收装置上电后，获取第二新鲜值FV的初始值。作为示例，该初始值可以为0，也可以为前次刷新的FV的值。在进行车辆部件的维修或者更换的情况下，第二FV的初始值可以为重置的FV的值。
步骤S520:进一步地，接收装置接收第一消息，该第一消息发送自前述的发送装置，该第一消息包含了第一FV的第二值。
步骤S530:进一步地，在满足第一条件的情况下，将第二FV的初始值刷新为前述第一FV的第二值。其中，该第一条件包括第一FV的第二值大于或等于第二FV的初始值与预定值之和。示例性地，在第二FV的初始值存储于第二存储模块的条件下，前述的刷新是通过将前述第一FV的第二值写入该第二存储模块中实现，当第一FV的第二值写入该第一存储模块中后，该第二值将作为第二FV的初始值。可选地，前述的将第一FV的第二值写入第一存储模块后，执行从该存储模块中读取所写入的FV的操作。可选地，在读取校验失败的条件下，上报异常告警。
图6是本申请实施例提供的一种车载网络的发送装置600的示意性结构图，用于执行图4所示的车载网络安全通信方法。
该装置包括以下模块：
第一处理模块620，用于获取第一新鲜值FV的初始值，根据该初始值获得第一FV的第二值，将第一FV的初始值刷新为第二值；
第一发送模块630，用于发送第一消息，该第一消息包含第一FV的第二值。
作为一个具体实施方式，该发送装置还包括第一存储模块610，第一FV的初始值存储于该第一存储模块。
可以理解的，本申请实施例中具体的描述可以参考前面的图4对应的方法实施例中的描述，在此不作赘述。
图7是本申请实施例提供的一种车载网络的接收装置700的示意性结构图，用于执行图5所示的车载网络安全通信方法。
该装置包括：
第一接收模块730，用于接收第一消息，第一消息包含第一新鲜值FV的第二值；
第二处理模块720，用于获取第二新鲜值FV的初始值，满足第一条件时，用于将该第二FV的初始值刷新为第一FV的第二值，该第一条件包括第一FV的第二值大于或等于第二FV的初始值与预定值之和。
作为一个具体实施方式，该接收装置还包括第二存储模块710，前述的第二FV的初始值存储于该第二存储模块。
作为又一个具体实施方式，第一存储模块610与第二存储模块710不相同，第一存储模块610和第二存储模块710分别布置于发送装置600和接收装置700。
作为另一个具体实施方式，第一存储模块610与第二存储模块710相同，即存储模块可以同时与发送装置600和接收装置700的功能模块配合并分别存储第一FV的初始值和第二FV的初始值。
可以理解的，本申请实施例中具体的描述可以参考前面的图5对应的方法实施例中的描述，在此不作赘述。
图8是本申请实施例提供的一种车载网络通信设备800，该通信设备执行如图4和图5所示的车载网络安全通信方法。包括如下模块：
第一处理模块620，用于获取第一新鲜值FV的初始值，根据初始值获得第二值，将初始值刷新为第二值；
第一发送模块630，用于发送第一消息，第一消息包含第一FV的第二值；
第一接收模块730，用于接收第一消息；
第二处理模块720，用于获取第二新鲜值FV的初始值，满足第一条件时，将第二FV的初始值刷新为前述的第二值，第二条件包括第一FV的第二值大于或等于第二FV的初始值与预定值之和。
作为一个具体实施方式，该车载网络通信设备还可以包括第一存储模块610和第二存储模块710，前述第一FV的初始值存储于第一存储模块610，前述第二FV的初始值存储于第二存储模块710。
作为又一个具体实施方式，上述第一存储模块610与第二存储模块710可以是同一存储模块，前述第一FV的初始值和前述第二FV的初始值分别存储于该存储模块。
为了描述的方便和简洁，上述描述的装置和设备的具体工作过程，可以参照前述方法实施例中的对应过程，在此不再赘述。
本申请实施例提供的一种计算机可读存储介质，其上存有计算机程序，该计算机程序被执行时实现如本申请图4和图5所示实施例提供的车载网络安全通信方法。
图9是本申请实施例提供的一种通信设备900的示意性结构图，包括：
处理器910，该处理器用于执行存储器920上存储的计算机程序，以实现如本申请 图4和图5所示实施例提供的车载网络安全通信方法。可选地，该存储器920与该处理器910耦合。
该处理器910可以是一个或多个处理器，本申请不作限制。
可选地，该通信设备还可以包括上述存储器920，该存储器920上存储有计算机程序。
需要说明的是，上述实施例是以CAN总线为例进行说明的，但不构成对本申请的限定，上述方案同样可以适用于采用其它车载网络通信方式的技术方案。
本申请实施例的具体实施方式部分使用的术语仅用于对本申请的具体实施方式进行解释，而非旨在限定本申请实施例。
需要说明的是，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或者相似项进行区分，例如第一新鲜值和第二新鲜值仅仅是为了区分不同的新鲜值，除非另有明确的规定和限定，并不对其先后顺序进行限定，也不能理解为指示或者暗示。本领域技术人员可以理解，“第一”、“第二”等字样并不对数量和执行次序进行限定。
本申请中实施例中的“汽车”、“车辆”和“整车”可以是燃油汽车、混合动力汽车、电动汽车、燃料电池汽车，其中，电动汽车包括纯电动汽车、增程式电动汽车等，本申请对此不做具体限定。
本领域技术人员能够领会，结合本文公开描述的各种说明性逻辑框、模块和算法步骤所描述的功能可以硬件、软件、固件或其任何组合来实施。如果以软件来实施，那么各种说明性逻辑框、模块、和步骤描述的功能可作为一或多个指令或代码在计算机可读介质上存储或传输，且由基于硬件的处理单元执行。计算机可读介质可包含计算机可读存储介质，其对应于有形介质，例如数据存储介质，或包括任何促进将计算机程序从一处传送到另一处的介质(例如，根据通信协议)的通信介质。以此方式，计算机可读介质大体上可对应于(1)非暂时性的有形计算机可读存储介质，或(2)通信介质，例如信号或载波。数据存储介质可为可由一或多个计算机或一或多个处理器存取以检索用于实施本申请中描述的技术的指令、代码和/或数据结构的任何可用介质。计算机程序产品可包含计算机可读介质。
作为实例而非限制，此类计算机可读存储介质可包括RAM、ROM、EEPROM、CD-ROM或其它光盘存储装置、磁盘存储装置或其它磁性存储装置、快闪存储器或可用来存储指令或数据结构的形式的所要程序代码并且可由计算机存取的任何其它介质。并且，任何连接被恰当地称作计算机可读介质。举例来说，如果使用同轴缆线、光纤缆线、双绞线、数字订户线(DSL)或例如红外线、无线电和微波等无线技术从网站、服务器或其它远程源传输指令，那么同轴缆线、光纤缆线、双绞线、DSL或例如红外线、无线电和微波等无线技术包含在介质的定义中。但是，应理解，计算机可读存储介质和数据存储介质并不包括连接、载波、信号或其它暂时介质，而是实际上针对于非暂时性有形存储介质。如本文中所使用，磁盘和光盘包含压缩光盘(CD)、激光光盘、光学光盘、数字多功能光盘(DVD)和蓝光光盘，其中磁盘通常以磁性方式再现数据，而光盘利用激光以光学方式再现数据。以上各项的组合也应包含在计算机可读介质的范围内。
可通过例如一或多个数字信号处理器(DSP)、通用微处理器、专用集成电路(ASIC)、现场可编程逻辑阵列(FPGA)或其它等效集成或离散逻辑电路等一或多个处理器来执行指令。因此，如本文中所使用的术语“处理器”可指前述结构或适合于实施本文中所描述的技术的任一其 它结构中的任一者。而且，前述技术可完全实施于一或多个电路或逻辑元件中。
本申请的技术可在各种各样的装置或设备中实施，包含车载设备、集成电路(IC)或一组IC(例如，芯片组)。本申请中描述各种组件、模块是为了强调用于执行所揭示的技术的装置的功能方面，但未必需要由不同硬件实现。实际上，如上文所描述，各种模块可结合合适的软件和/或固件组合在硬件中，或者通过互操作硬件(包含如上文所描述的一个或多个处理器)来提供。
在上述实施例中，对各个实施例的描述各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
以上所述，仅为本申请的具体实施方式，对于本领域技术人员来说，在本申请揭露的范围内可轻易想到变化或替代，都应涵盖在本申请的保护范围之内。本申请的保护范围应以权利要求的保护范围为准。

Claims (28)

  1. 一种车载网络安全通信方法，其特征在于，应用于发送装置，包括：
    获取第一新鲜值FV的初始值；
    根据所述初始值获得所述第一FV的第二值，所述第二值大于所述初始值；
    将所述初始值刷新为所述第二值；
    发送第一消息，所述第一消息包含所述第二值。
  2. 根据权利要求1所述的方法，其特征在于，所述第二值与所述初始值的差值为预定值，所述预定值为数值固定或者可变的正数。
  3. 根据权利要求1或2所述的方法，其特征在于，所述预定值与车辆的整车生命周期关联。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，在T2时刻，将所述第二值增加所述预定值或者增加在T1时刻和T2时刻期间发送的信息的数量，获得第三值，将所述第二值刷新为所述第三值，其中所述T1时刻早于所述T2时刻。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述第一FV的初始值为0、前次刷新的FV的值或者重置的FV的值。
  6. 根据权利要求5所述的方法，其特征在于，所述重置的FV的值与车辆状态参数关联，所述车辆状态参数包括车辆累计行驶里程或者累计行驶时间中至少一项。
  7. 一种车载网络安全通信方法，其特征在于，应用于接收装置，包括：
    获取第二新鲜值FV的初始值；
    接收第一消息，所述第一消息包含第一FV的第二值；
    满足第一条件时，将所述第二FV的初始值刷新为所述第一FV的第二值，其中，所述第一条件包括所述第一FV的第二值大于或等于所述第二FV的初始值与预定值之和。
  8. 根据权利要求7所述的方法，其特征在于，所述预定值为数值固定或者可变的正数。
  9. 根据权利要求7或8所述的方法，其特征在于，所述预定值与车辆的整车生命周期关联。
  10. 根据权利要求7-9任一项所述的方法，其特征在于，所述第二FV的初始值为0、前次刷新的FV的值或者重置的FV的值。
  11. 根据权利要求10所述的方法，其特征在于，所述重置的FV与车辆状态参数关联，所述车辆状态参数包括车辆累计行驶里程或者累计行驶时间中至少一项。
  12. 一种车载网络的发送装置，其特征在于，所述装置包括：
    第一处理模块，用于获取第一新鲜值FV的初始值，根据所述初始值获得第一FV的第二值，将所述初始值刷新为所述第二值；
    第一发送模块，用于发送第一消息，所述第一消息包含所述第二值。
  13. 根据权利要求12所述的装置，其特征在于，所述第二值与所述初始值的差值为预定值，所述预定值与车辆的整车生命周期关联。
  14. 根据权利要求12或13所述的装置，其特征在于，所述预定值为数值固定或者可变的正数。
  15. 根据权利要求12-14任一项所述的装置，其特征在于，所述第一处理模块用于在T2时刻，将所述第一FV的第二值增加所述预定值或者增加在T1时刻和所述T2时刻 期间发送的信息的数量，获得第三值，将所述第二值刷新为所述第三值，其中所述T1时刻早于所述T2时刻。
  16. 根据权利要求12-15任一项所述的装置，其特征在于，所述装置还包括第一存储模块，所述第一FV的初始值存储于所述第一存储模块。
  17. 一种车载网络的接收装置，其特征在于，所述装置包括：
    第一接收模块，用于接收第一消息，所述第一消息包含第一新鲜值FV的第二值；
    第二处理模块，用于获取第二新鲜值FV的初始值，满足第一条件时，用于将所述第二FV的初始值刷新为所述第一FV的第二值，所述第一条件包括所述第一FV的第二值大于或等于所述第二FV的初始值与预定值之和。
  18. 如权利要求17所述的装置，其特征在于，所述初始值为0、前次刷新的FV的值或者重置的FV的值。
  19. 根据权利要求17或者18所述的装置，其特征在于，所述预定值与车辆的整车生命周期关联。
  20. 根据权利要求17-19任一项所述的装置，其特征在于，所述预定值为数值固定或者可变的正数。
  21. 根据权利要求17-20任一项所述的装置，其特征在于，所述装置还包括第二存储模块，所述第二FV存储于所述第二存储模块。
  22. 根据权利要求16或21所述的装置，其特征在于，所述第一存储模块与所述第二存储模块可以相同或者不同。
  23. 一种车载网络通信设备，其特征在于，所述设备包括：
    第一处理模块，用于获取第一新鲜值FV的初始值，根据所述初始值获得第二值，将所述初始值刷新为所述第二值；
    第一发送模块，用于发送第一消息，所述第一消息包含所述第一FV的第二值；
    第一接收模块，用于接收所述第一消息；
    第二处理模块，用于获取第二新鲜值FV的初始值，满足第一条件时，将所述第二FV的初始值刷新为所述第二值，所述第一条件包括所述第一FV的第二值大于或等于所述第二FV的初始值与预定值之和。
  24. 根据权利要求23所述的设备，其特征在于，所述第一处理模块用于在T2时刻，将所述第一FV的第二值增加所述预定值或者增加在T1时刻和所述T2时刻期间发送的信息的数量，获得第三值，将所述第二值刷新为第三值，其中所述T1时刻早于所述T2时刻。
  25. 根据权利要求23或24所述的设备，其特征在于，所述设备还可以包括存储模块，所述第一FV的初始值和所述第二FV的初始值存储于所述存储模块。
  26. 根据权利要求23或24所述的设备，其特征在于，所述设备还可以包括第一存储模块或者第二存储模块中的至少一种，所述第一FV的初始值存储于所述第一存储模块，所述第二FV的初始值存储于所述第二存储模块。
  27. 一种计算机可读存储介质，其上存有计算机程序，其特征在于，所述计算机程序被执行时实现如权利要求1-11任一项所述的方法。
  28. 一种通信设备，其特征在于，包括处理器，所述处理器与存储器耦合，所述存储器上存储有计算机程序，所述处理器用于执行所述存储器上存储的所述计算机程序， 以实现如权利要求1-11任一项所述的方法。
PCT/CN2020/108772 2020-08-13 2020-08-13 车载网络安全通信方法、装置和设备 WO2022032548A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP20949047.3A EP4191940A4 (en) 2020-08-13 2020-08-13 METHOD, APPARATUS AND DEVICE FOR SECURE COMMUNICATION IN A VEHICLE NETWORK
CN202080004755.2A CN112673656B (zh) 2020-08-13 2020-08-13 车载网络安全通信方法、装置和设备
PCT/CN2020/108772 WO2022032548A1 (zh) 2020-08-13 2020-08-13 车载网络安全通信方法、装置和设备
US18/167,627 US20230199500A1 (en) 2020-08-13 2023-02-10 Secure Onboard Network Communication Method, Apparatus, and Device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/108772 WO2022032548A1 (zh) 2020-08-13 2020-08-13 车载网络安全通信方法、装置和设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/167,627 Continuation US20230199500A1 (en) 2020-08-13 2023-02-10 Secure Onboard Network Communication Method, Apparatus, and Device

Publications (1)

Publication Number Publication Date
WO2022032548A1 true WO2022032548A1 (zh) 2022-02-17

Family

ID=75413904

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/108772 WO2022032548A1 (zh) 2020-08-13 2020-08-13 车载网络安全通信方法、装置和设备

Country Status (4)

Country Link
US (1) US20230199500A1 (zh)
EP (1) EP4191940A4 (zh)
CN (1) CN112673656B (zh)
WO (1) WO2022032548A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP7226543B2 (ja) * 2019-06-04 2023-02-21 株式会社デンソー 電子制御装置および通信システム
CN113132485B (zh) * 2021-04-20 2022-07-01 吉林大学 一种面向网联车与路边单元通信的安全连接方法
CN113472620A (zh) * 2021-06-23 2021-10-01 重庆长安汽车股份有限公司 一种车内消息认证新鲜值的管理方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106972926A (zh) * 2017-03-29 2017-07-21 北京经纬恒润科技有限公司 一种无线汽车钥匙的加密解密方法、装置及系统
CN108075897A (zh) * 2016-11-07 2018-05-25 福特全球技术公司 控制器局域网消息认证
CN109729056A (zh) * 2017-10-30 2019-05-07 北京长城华冠汽车科技股份有限公司 基于车联网的整车网络安全防护方法及整车网络架构
WO2020006052A1 (en) * 2018-06-29 2020-01-02 Micron Technology, Inc. Secure wireless lock-actuation exchange
US10721619B2 (en) * 2014-05-13 2020-07-21 Telefonaktiebolaget Lm Ericsson (Publ) Methods and network nodes for managing wireless device associated information in a wireless communication network

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102333100B (zh) * 2007-11-08 2013-11-06 华为技术有限公司 进行认证的方法及终端
WO2014169451A1 (zh) * 2013-04-17 2014-10-23 华为技术有限公司 数据传输方法和装置
US10242197B2 (en) * 2016-09-23 2019-03-26 Intel Corporation Methods and apparatus to use a security coprocessor for firmware protection
WO2018119852A1 (en) * 2016-12-29 2018-07-05 Gemalto Smart Cards Technology Co., Ltd. Method for mutual authentication between device and secure element
US10791125B2 (en) * 2018-01-03 2020-09-29 Ford Global Technologies, Llc End-to-end controller protection and message authentication
CN111899103B (zh) * 2018-10-25 2024-05-03 创新先进技术有限公司 基于区块链的交易处理方法及装置、电子设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10721619B2 (en) * 2014-05-13 2020-07-21 Telefonaktiebolaget Lm Ericsson (Publ) Methods and network nodes for managing wireless device associated information in a wireless communication network
CN108075897A (zh) * 2016-11-07 2018-05-25 福特全球技术公司 控制器局域网消息认证
CN106972926A (zh) * 2017-03-29 2017-07-21 北京经纬恒润科技有限公司 一种无线汽车钥匙的加密解密方法、装置及系统
CN109729056A (zh) * 2017-10-30 2019-05-07 北京长城华冠汽车科技股份有限公司 基于车联网的整车网络安全防护方法及整车网络架构
WO2020006052A1 (en) * 2018-06-29 2020-01-02 Micron Technology, Inc. Secure wireless lock-actuation exchange

Also Published As

Publication number Publication date
EP4191940A1 (en) 2023-06-07
CN112673656B (zh) 2022-08-09
EP4191940A4 (en) 2023-09-27
US20230199500A1 (en) 2023-06-22
CN112673656A (zh) 2021-04-16

Similar Documents

Publication Publication Date Title
WO2022032548A1 (zh) 车载网络安全通信方法、装置和设备
US10969850B2 (en) Method for transmitting and receiving wake-up signal in vehicle network
US11169821B2 (en) Method of operating selective wake-up of communication node in vehicle network
US20180279098A1 (en) Operation method of communication node supporting network management functions in vehicle network
CN107465588B (zh) 多路总线网络的状态控制方法、装置及网络管理系统
US10630538B2 (en) Software update method and apparatus for vehicle
JP6881231B2 (ja) 車載中継装置、情報処理方法、プログラム、中継装置、及び情報処理システム
US10861258B2 (en) Method for preventing diagnostic errors in vehicle network and apparatus therefor
JP2017069941A (ja) 不正検知電子制御ユニット、車載ネットワークシステム及び通信方法
US20140247831A1 (en) Method for Transmitting Messages in a Communication Network
US20210194922A1 (en) Monitoring a network connection for eavesdropping
US20200136857A1 (en) Method and apparatus for allocating priority transmission opportunities in vehicle network
US11616843B2 (en) Method and apparatus for operating communication node using network management function in vehicle network
EP3761568A1 (en) Method of controlling communication over a local interconnect network bus
Rosenstatter et al. Extending AUTOSAR's Counter-Based Solution for Freshness of Authenticated Messages in Vehicles
CN111490918B (zh) 车载以太网网络唤醒系统、方法、装置和计算机设备
CN113542265B (zh) 局部网络安全管理、装置、计算机设备及存储介质
KR20190070076A (ko) 분산 네트워크 시스템의 전자 제어 장치 및 상기 전자 제어 장치의 분산 합의 프로토콜 방법
US11126240B2 (en) Communication node in vehicle network and operation method of the communication node
CN111194033A (zh) 车内安全通信方法、系统及计算机存储介质
CN112540798A (zh) 车辆操作系统的唤醒方法、装置及系统
CN115047852A (zh) 一种车辆软件刷写方法和系统
CN113037759B (zh) 适配autosar汽车电子架构的新鲜度值管理方法及装置
WO2022246760A1 (zh) 一种车内通信方法及装置
CN114157489A (zh) 基于周期性鉴权握手机制的通信域控制器安全通信方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20949047

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020949047

Country of ref document: EP

Effective date: 20230228

NENP Non-entry into the national phase

Ref country code: DE