WO2022041122A1 - 一种数据传输方法以及装置 - Google Patents

一种数据传输方法以及装置 Download PDF

Info

Publication number
WO2022041122A1
WO2022041122A1 PCT/CN2020/112114 CN2020112114W WO2022041122A1 WO 2022041122 A1 WO2022041122 A1 WO 2022041122A1 CN 2020112114 W CN2020112114 W CN 2020112114W WO 2022041122 A1 WO2022041122 A1 WO 2022041122A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
ecu
protection
sent
vehicle
Prior art date
Application number
PCT/CN2020/112114
Other languages
English (en)
French (fr)
Inventor
钟胤
殷新星
张明明
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN202080004586.2A priority Critical patent/CN112602303A/zh
Priority to EP20950792.0A priority patent/EP4099591A4/en
Priority to PCT/CN2020/112114 priority patent/WO2022041122A1/zh
Publication of WO2022041122A1 publication Critical patent/WO2022041122A1/zh
Priority to US17/973,767 priority patent/US20230067338A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/321—Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2212/00—Encapsulation of packets
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers

Definitions

  • the present application relates to the field of automobiles, and in particular, to a data transmission method and device.
  • Ethernet has gradually become the backbone of in-vehicle networks.
  • Ethernet carries many communication services, such as video-on-demand, software upgrade, monitoring data upload, interactive control, diagnosis and other large amounts of data.
  • security of data transmission in the vehicle is very important.
  • various security protections are performed for the data transmitted in the vehicle, such as integrity protection, anti-replay attack protection or confidentiality protection.
  • the communication volume of the in-vehicle Ethernet is large, and the calculation amount for data protection is also larger, and higher hardware performance is required to support the calculation amount. Therefore, how to effectively protect the transmitted data under the premise of hardware performance support has become an urgent problem to be solved.
  • Embodiments of the present application provide a data transmission method and device, which are used to select an appropriate protection strategy for data to be transmitted and balance the computing resources of the ECU.
  • a first aspect of the present application provides a data transmission method, the method comprising: a first electronic control unit (electrical control unit, ECU) obtains data to be sent, the first ECU and the second ECU mentioned in the present application is any two ECUs among multiple ECUs in the same vehicle; the first ECU determines a protection strategy corresponding to the data to be sent from a variety of protection strategies, and the multiple protection strategies include a variety of different encapsulation methods for the data to be sent , the multiple protection strategies include at least two protection strategies with different calculation amounts for the data to be sent, that is, when using the at least two protection strategies to protect data, the required calculation amounts are different; first The ECU encapsulates the data to be sent according to the protection policy corresponding to the data to be sent to obtain an encapsulated message; the first ECU sends the encapsulated message to the second ECU.
  • ECU electronic control unit
  • the first ECU may select a protection policy matching the data to be sent from multiple protection policies, and may select an appropriate protection policy according to the importance of the protection policy.
  • the multiple protection strategies may include protection strategies with different calculation amounts.
  • the calculation amount mentioned in this application refers to the calculation amount required when using the protection strategy to protect the data to be sent. When the importance of the data to be sent is higher , the calculation amount corresponding to the selected protection strategy is usually higher, and when the importance of the data to be sent is lower, the calculation amount corresponding to the selected protection strategy is usually lower.
  • a matching protection strategy can be selected, so as to balance the calculation amount of data transmitted between ECUs in the vehicle, so that the data with high importance can be protected to a higher degree, and the data with low importance can be reduced to a higher degree.
  • the calculation amount of data protection so that the computing resources of the ECU in the vehicle can be used more effectively, and the effective protection of the transmitted data is realized on the basis of the performance support of the hardware in the vehicle.
  • the method provided in the present application can be applied to a vehicle, which includes multiple electronic control units (ECUs), the first ECU and the second ECU are any two ECUs among the multiple ECUs, and usually multiple ECUs connected via Ethernet.
  • ECUs electronice control units
  • the first ECU and the second ECU are any two ECUs among the multiple ECUs, and usually multiple ECUs connected via Ethernet.
  • the first ECU determines a protection policy corresponding to the data to be sent from multiple protection policies, which may include: the first ECU determines from multiple protection policies according to an identifier included in the data to be sent In the protection policy corresponding to the data to be sent, the identifier included in the data to be sent includes the identifier of the ECU that generates the data to be sent or the identifier of the data type of the data to be sent.
  • an appropriate protection strategy can be selected according to the ECU that generates the data or the data type of the data to be sent, so that a matching protection strategy can be selected for data generated by different types or different ECUs, so as to balance the in-vehicle
  • the data with a high degree of importance can be protected to a higher degree, and the amount of calculation for the protection of the data with a low degree of importance can be reduced, so that the computing resources of the ECU in the vehicle can be obtained. more efficient use.
  • the first ECU determines, according to the identifier included in the data to be sent, an identifier related to the data to be sent from a variety of protection strategies
  • the corresponding protection strategy may include: the first ECU determines the security level of the data to be sent according to the identification and the mapping relationship, and the mapping relationship includes the relationship between the identification of the ECU in the vehicle and the security level, and each ECU in the vehicle corresponds to The security level is determined according to the type of ECU in the vehicle; the first ECU determines a protection strategy corresponding to the data to be sent from a variety of protection strategies according to the security level.
  • the importance of the data to be sent can be represented by the security level, and different types of ECUs have matching security levels, so that the matching protection strategy can be selected according to the security level in the future.
  • the security level has a matching protection strategy, which can protect the data of high importance to a higher degree, and reduce the amount of calculation for protection of data of low importance, so that the computing resources of the ECU in the vehicle can be reduced. can be used more effectively.
  • the security level of the data to be sent has a positive correlation with the calculation amount corresponding to the protection strategy, that is, the higher the security level of the data to be sent, the greater the calculation amount corresponding to the corresponding protection strategy, so that the higher security level can be achieved.
  • the data is protected with a higher degree of protection, and the security of important data is improved.
  • the encapsulated message includes an identifier of a protection policy corresponding to the data to be sent, and the identifier of the protection policy is used by the second ECU to determine a way of parsing the encapsulated message.
  • the second ECU can identify the corresponding protection strategy according to the identification of the protection strategy carried in the encapsulated message, so that the second ECU can quickly and accurately identify the protection strategy of the encapsulated message , and then determine the appropriate analysis method.
  • each of the at least two protection strategies includes one or more of the following strategies: no protection, anti-replay attack protection, integrity protection or confidentiality protection, no protection means treating The transmitted data is not protected, the anti-replay attack protection means that the data to be sent is protected against replay attacks, and the integrity protection means that the integrity check code is generated for the data to be sent, and the integrity check code is used for the second ECU to check. Check whether the encapsulated packet is complete, and confidentiality protection means encrypting the data to be sent.
  • no protection, anti-replay attack protection, integrity protection or confidentiality protection are provided to protect the data to be sent.
  • the data matching protection strategy balances the computing resources of the ECU in the vehicle and improves the effective utilization of computing resources.
  • the encapsulated message carries an anti-replay counter, and the value of the anti-replay counter is displayed every time the first ECU sends a message to the second ECU. Change after sending a frame of message, so that the second ECU discards the encapsulated message when the value of the anti-replay counter is not within the preset range;
  • the protection policy corresponding to the data to be sent includes integrity protection
  • the encapsulated message includes an integrity check code
  • the integrity check code is used by the second ECU to verify whether the data obtained by parsing the encapsulated message is complete
  • the protection policy corresponding to the data to be sent includes confidentiality protection
  • the payload in the encapsulated message includes ciphertext
  • the ciphertext is obtained by encrypting the data to be sent using a preset encryption algorithm.
  • the encapsulated message may include corresponding data, thereby providing a format of the encapsulated message.
  • the encapsulated packet is a SOME/IP packet.
  • a SOME/IP message is a kind of small protection, and the ECU can quickly encapsulate the data to obtain the SOME/IP message. This application aims to protect the SOME/IP message.
  • the method further includes: The first ECU generates a derived key according to the preset pre-shared key PSK, and the derived key is used for integrity protection or confidentiality protection of the data to be sent.
  • the derived key can be generated by using the shared key, so as to completely protect the integrity or confidentiality of the data to be sent, and improve the security of the encapsulated message.
  • the present application provides a data transmission method, which is applied to a vehicle.
  • the vehicle includes a plurality of electronic control units (ECUs), the first ECU and the second ECU are any two ECUs among the plurality of ECUs, and between the plurality of ECUs Through an Ethernet connection, the method includes: the second ECU receives the encapsulated message sent by the first ECU; the second ECU obtains a protection policy corresponding to the encapsulated message, and the protection policy corresponding to the encapsulated message includes the first ECU obtaining the encapsulated message. Encapsulation mode; the second ECU parses the encapsulated packet according to the protection policy, and obtains the parsing result.
  • ECUs electronice control units
  • the second ECU may determine a protection policy corresponding to the encapsulated packet, and parse the encapsulated packet according to the protection policy.
  • the first ECU can select a protection strategy corresponding to the encapsulated message from a variety of protection strategies, and can select a matching protection strategy for different data, so as to balance the calculation amount of the data transmitted between ECUs in the vehicle and make important Data with a high degree of protection can be protected to a higher degree, and the amount of calculation for protection of data with a low degree of importance can be reduced, so that the computing resources of the ECU in the vehicle can be used more effectively.
  • the protection strategy corresponding to the encapsulated packet includes one or more of the following strategies: no protection, anti-replay attack protection, integrity protection or confidentiality protection.
  • Protection, anti-replay attack protection means that the data to be sent is protected against anti-replay attacks.
  • Integrity protection means adding an integrity check code to the encapsulated packet. The integrity check code is used to parse the encapsulated packet. When , check whether the data obtained by parsing is complete, and confidentiality protection means encrypting the data to be sent.
  • no protection, anti-replay attack protection, integrity protection or confidentiality protection are provided to protect the data to be sent.
  • Different protection strategies may have different calculation amounts, so that the data matching the data to be sent can be selected. It can balance the computing resources of the ECU in the vehicle and improve the effective utilization of computing resources.
  • the method may further include: if the second ECU If it is determined that the value of the anti-replay counter included in the encapsulation includes is not within the preset range, the encapsulated packet is discarded.
  • the anti-replay counter may be used for replay protection, and the second ECU may discard the encapsulated packets whose value of the anti-replay counter is not within the preset range, thereby avoiding replay attacks.
  • the method It also includes: determining whether the parsing result is complete in combination with the integrity check code; if the parsing result is incomplete, discarding the parsing result.
  • the parsing result of the encapsulated packet after the parsing result of the encapsulated packet is obtained, it can be verified whether the parsing result is complete, and if it is not complete, the parsing result is discarded to avoid using invalid data.
  • the second ECU parses the encapsulated packet according to the protection policy, which may include: combining with a preset decryption algorithm, parses the encapsulated packet.
  • the included payload is decrypted to obtain a parsing result.
  • the first ECU encrypts the data to be sent
  • the payload included in the encapsulated message is ciphertext
  • the second ECU can use the decryption algorithm to encrypt the ciphertext, thereby improving the security of the encapsulated message .
  • the encapsulated message includes an identifier of a protection policy corresponding to the data to be sent.
  • the present application provides a first ECU, where the first ECU has a function of implementing the data transmission method of the first aspect.
  • This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the present application provides a second ECU, where the second ECU has the function of implementing the data transmission method of the second aspect.
  • This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • an embodiment of the present application provides an ECU, including: a processor and a memory, wherein the processor and the memory are interconnected through a line, and the processor invokes program codes in the memory to execute any one of the first aspect or the first A function related to processing in the data transmission method shown in any one of the two aspects.
  • an embodiment of the present application provides a data transmission device, which may also be referred to as a digital processing chip or a chip, the chip includes a processing unit and a communication interface, the processing unit obtains program instructions through the communication interface, and the program instructions are The processing unit executes, and the processing unit is configured to perform processing-related functions in the first aspect, any optional implementation manner of the first aspect, the second aspect, or any optional implementation manner of the second aspect.
  • an embodiment of the present application provides a vehicle, the vehicle includes at least one ECU, and the at least one ECU is configured to execute the first aspect, any optional implementation of the first aspect, and the second aspect or steps in any optional embodiment of the second aspect.
  • an embodiment of the present application provides a computer-readable storage medium, including instructions, which, when run on a computer, cause the computer to execute the first aspect, any optional implementation manner of the first aspect, and the second aspect or the method in any optional embodiment of the second aspect.
  • the embodiments of the present application provide a computer program product containing instructions, which, when run on a computer, enables the computer to execute the first aspect, any optional implementation manner of the first aspect, the second aspect or the first aspect.
  • the method in any optional implementation manner of the second aspect.
  • the present application provides a data transmission system, including at least one ECU, where the at least one ECU is configured to execute the first aspect, any optional implementation manner of the first aspect, the second aspect, or any optional implementation of the second aspect Select the steps of the method in the embodiment.
  • FIG. 1 is a schematic structural diagram of a vehicle according to an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of a data transmission system provided by the application.
  • FIG. 3 provides a data transmission mode of an ECU according to the present application
  • FIG. 4A is another way of ECU transmitting data provided by this application.
  • FIG. 4B is another way of ECU transmitting data provided by this application.
  • FIG. 5 is a schematic flowchart of a data transmission method provided by the present application.
  • FIG. 6 is a schematic diagram of the format of a packaged message provided by the present application.
  • FIG. 7 is a schematic structural diagram of an ECU provided by the application.
  • FIG. 8 is a schematic structural diagram of another ECU provided by this application.
  • FIG. 9 is a schematic structural diagram of another ECU provided by the present application.
  • the data transmission methods provided in the embodiments of the present application can be applied to various scenarios related to vehicles, such as scenarios such as planning the driving path of the vehicle, monitoring the state of the vehicle, or remotely controlling the vehicle.
  • this application can also be applied to scenarios such as planning driving paths for various robots, monitoring vehicle status, or remotely controlling vehicles, such as freight robots, detection robots, sweeping robots, or other types of robots.
  • a freight robot is used as an example for the application The scenario is further described. When the freight robot is transporting, it can monitor the status of the freight robot in real time, plan the transportation path, or remotely control it, so as to complete the transportation safely and stably.
  • FIG. 1 is a schematic structural diagram of the vehicle provided by the embodiment of the present application. Configured in autopilot mode.
  • the vehicle 100 can control itself while in the autonomous driving mode, and can determine the current state of the vehicle and its surrounding environment through human operation, determine whether there are obstacles in the surrounding environment, and control the vehicle based on the information of the obstacles 100.
  • the vehicle 100 may also be placed to operate without human interaction when the vehicle 100 is in an autonomous driving mode.
  • Vehicle 100 may include various subsystems, such as travel system 102 , sensor system 104 , control system 106 , one or more peripherals 108 and power supply 110 , computer system 112 , and user interface 116 .
  • vehicle 100 may include more or fewer subsystems, and each subsystem may include multiple components. Additionally, each of the subsystems and components of the vehicle 100 may be wired or wirelessly interconnected.
  • the travel system 102 may include components that provide powered motion for the vehicle 100 .
  • travel system 102 may include engine 118 , energy source 119 , transmission 120 , and wheels/tires 121 .
  • the engine 118 may be an internal combustion engine, an electric motor, an air compression engine, or other types of engine combinations, such as a hybrid engine composed of a gasoline engine and an electric motor, and a hybrid engine composed of an internal combustion engine and an air compression engine.
  • Engine 118 converts energy source 119 into mechanical energy. Examples of energy sources 119 include gasoline, diesel, other petroleum-based fuels, propane, other compressed gas-based fuels, ethanol, solar panels, batteries, and other sources of electricity.
  • the energy source 119 may also provide energy to other systems of the vehicle 100 .
  • Transmission 120 may transmit mechanical power from engine 118 to wheels 121 .
  • Transmission 120 may include a gearbox, a differential, and a driveshaft. In one embodiment, transmission 120 may also include other devices, such as clutches.
  • the drive shaft may include one or more axles that may be coupled to one or more wheels 121 .
  • the sensor system 104 may include several sensors that sense information about the environment surrounding the vehicle 100 .
  • the sensor system 104 may include a positioning system 122 (the positioning system may be a global positioning GPS system, a Beidou system or other positioning systems), an inertial measurement unit (IMU) 124, a radar 126, a laser rangefinder 128 and camera 130.
  • the sensor system 104 may also include sensors of the internal systems of the vehicle 100 being monitored (eg, an in-vehicle air quality monitor, a fuel gauge, an oil temperature gauge, etc.). Sensing data from one or more of these sensors can be used to detect objects and their corresponding properties (position, shape, orientation, velocity, etc.). This detection and identification is a critical function for the safe operation of the autonomous vehicle 100 .
  • the sensors mentioned in the following embodiments of the present application may be the radar 126 , the laser rangefinder 128 or the camera 130 or the like.
  • the positioning system 122 may be used to estimate the geographic location of the vehicle 100 .
  • the IMU 124 is used to sense position and orientation changes of the vehicle 100 based on inertial acceleration.
  • IMU 124 may be a combination of an accelerometer and a gyroscope.
  • the radar 126 can use radio signals to perceive objects in the surrounding environment of the vehicle 100 , and can specifically be expressed as a millimeter-wave radar or a lidar. In some embodiments, in addition to sensing objects, radar 126 may be used to sense the speed and/or heading of objects.
  • the laser rangefinder 128 may utilize the laser light to sense objects in the environment in which the vehicle 100 is located.
  • the laser rangefinder 128 may include one or more laser sources, laser scanners, and one or more detectors, among other system components.
  • Camera 130 may be used to capture multiple images of the surrounding environment of vehicle 100 .
  • Camera 130 may be a still camera or a video camera.
  • Control system 106 controls the operation of the vehicle 100 and its components.
  • Control system 106 may include various components including steering system 132 , throttle 134 , braking unit 136 , computer vision system 140 , line control system 142 , and obstacle avoidance system 144 .
  • the steering system 132 is operable to adjust the heading of the vehicle 100 .
  • it may be a steering wheel system.
  • the throttle 134 is used to control the operating speed of the engine 118 and thus the speed of the vehicle 100 .
  • the braking unit 136 is used to control the deceleration of the vehicle 100 .
  • the braking unit 136 may use friction to slow the wheels 121 .
  • the braking unit 136 may convert the kinetic energy of the wheels 121 into electrical current.
  • the braking unit 136 may also take other forms to slow the wheels 121 to control the speed of the vehicle 100.
  • Computer vision system 140 may be operable to process and analyze images captured by camera 130 in order to identify objects and/or features in the environment surrounding vehicle 100 .
  • the objects and/or features may include traffic signals, road boundaries and obstacles.
  • Computer vision system 140 may use object recognition algorithms, Structure from Motion (SFM) algorithms, video tracking, and other computer vision techniques. In some embodiments, the computer vision system 140 may be used to map the environment, track objects, estimate the speed of objects, and the like.
  • the route control system 142 is used to determine the travel route and travel speed of the vehicle 100 . In some embodiments, the route control system 142 may include a lateral planning module 1421 and a longitudinal planning module 1422, respectively, for combining information from the obstacle avoidance system 144, the GPS 122, and one or more predetermined maps The data for the vehicle 100 determines the travel route and travel speed.
  • Obstacle avoidance system 144 is used to identify, evaluate, and avoid or otherwise traverse obstacles in the environment of vehicle 100 , which may be embodied as actual obstacles and virtual moving bodies that may collide with vehicle 100 .
  • the control system 106 may additionally or alternatively include components in addition to those shown and described. Alternatively, some of the components shown above may be reduced.
  • Vehicle 100 interacts with external sensors, other vehicles, other computer systems, or users through peripheral devices 108 .
  • Peripherals 108 may include wireless data transfer system 146 , onboard computer 148 , microphone 150 and/or speaker 152 .
  • peripherals 108 provide a means for a user of vehicle 100 to interact with user interface 116 .
  • the onboard computer 148 may provide information to the user of the vehicle 100 .
  • User interface 116 may also operate on-board computer 148 to receive user input.
  • the onboard computer 148 can be operated via a touch screen.
  • peripheral devices 108 may provide a means for vehicle 100 to communicate with other devices located within the vehicle.
  • Wireless data transfer system 146 may wirelessly communicate with one or more devices, either directly or via a communication network.
  • wireless data transmission system 146 may use 3G cellular communications, such as CDMA, EVDO, GSM/GPRS, or 4G cellular communications, such as LTE. Or 5G cellular communications.
  • the wireless data transmission system 146 may utilize wireless local area network (WLAN) communications.
  • WLAN wireless local area network
  • the wireless data transfer system 146 may communicate directly with the device using an infrared link, Bluetooth, or ZigBee.
  • Other wireless protocols, such as various vehicle data transmission systems, for example, wireless data transmission system 146 may include one or more dedicated short range communications (DSRC) devices, which may include vehicles and/or roadside stations public and/or private data communications between them.
  • DSRC dedicated short range communications
  • the power supply 110 may provide power to various components of the vehicle 100 .
  • the power source 110 may be a rechargeable lithium-ion or lead-acid battery.
  • One or more battery packs of such a battery may be configured as a power source to provide power to various components of the vehicle 100 .
  • power source 110 and energy source 119 may be implemented together, such as in some all-electric vehicles.
  • Computer system 112 may include at least one processor 113 that executes instructions 115 stored in a non-transitory computer-readable medium such as memory 114 .
  • Computer system 112 may also be multiple computing devices that control individual components or subsystems of vehicle 100 in a distributed fashion.
  • the processor 113 may be any conventional processor, such as a commercially available central processing unit (CPU).
  • the processor 113 may be a dedicated device such as an application specific integrated circuit (ASIC) or other hardware-based processor.
  • processors, memory, and other components of the computer system 112 may actually include not stored in the same Multiple processors, or memories, within a physical enclosure.
  • memory 114 may be a hard drive or other storage medium located within a different enclosure than computer system 112 .
  • references to processor 113 or memory 114 will be understood to include references to sets of processors or memories that may or may not operate in parallel.
  • some components such as the steering and deceleration components may each have their own processor that only performs computations related to component-specific functions .
  • the processor 113 may be located remotely from the vehicle 100 and communicate wirelessly with the vehicle 100 . In other aspects, some of the processes described herein are performed on a processor 113 disposed within the vehicle 100 while others are performed by a remote processor 113, including taking the necessary steps to perform a single maneuver.
  • the memory 114 may contain instructions 115 (eg, program logic) executable by the processor 113 to perform various functions of the vehicle 100 , including those described above.
  • Memory 114 may also contain additional instructions, including instructions to send data to, receive data from, interact with, and/or control one or more of travel system 102 , sensor system 104 , control system 106 , and peripherals 108 . instruction.
  • memory 114 may store data such as road maps, route information, vehicle location, direction, speed, and other such vehicle data, among other information. Such information may be used by the vehicle 100 and the computer system 112 during operation of the vehicle 100 in autonomous, semi-autonomous and/or manual modes.
  • a user interface 116 for providing information to or receiving information from a user of the vehicle 100 .
  • the user interface 116 may include one or more input/output devices within the set of peripheral devices 108, such as a wireless data transfer system 146, an onboard computer 148, a microphone 150 or a speaker 152, and the like.
  • Computer system 112 may control functions of vehicle 100 based on input received from various subsystems (eg, travel system 102 , sensor system 104 , and control system 106 ) and from user interface 116 .
  • the computer system 112 may communicate with other systems or components within the vehicle 100 using a can bus, such as the computer system 112 may utilize input from the control system 106 to control the steering system 132 to avoid interference by the sensor system 104 and the obstacle avoidance system 144 Obstacles detected.
  • computer system 112 is operable to provide control of various aspects of vehicle 100 and its subsystems.
  • one or more of these components described above may be installed or associated with the vehicle 100 separately.
  • memory 114 may exist partially or completely separate from vehicle 100 .
  • the above-described components may be communicatively coupled together in a wired and/or wireless manner.
  • the data transmission method provided in this application may be executed by the computer system 112, the radar 126, the laser rangefinder 128 or peripheral devices, such as the on-board computer 148 or other on-board terminals.
  • the data transmission method provided by the present application can be executed by the on-board computer 148.
  • the on-board computer 148 can plan a driving path and a corresponding speed curve for the vehicle, generate control instructions according to the driving path, and send the control instructions to the computer system 112.
  • the computer system 112 controls the steering system 132 , the accelerator 134 , the braking unit 136 , the computer vision system 140 , the line control system 142 or the obstacle avoidance system 144 in the control system 106 of the vehicle, thereby realizing the automatic driving of the vehicle.
  • the above-mentioned vehicle 100 can be a car, a truck, a motorcycle, a bus, a boat, an airplane, a helicopter, a lawn mower, a recreational vehicle, a playground vehicle, construction equipment, a tram, a golf cart, a train, a cart, etc.
  • the application examples are not particularly limited.
  • the vehicle provided by this application may include multiple ECUs, and the data transmission method provided by this application can be applied to transmit data between ECUs in the vehicle, improve the efficiency of data transmission, and make the encryption method of the transmitted message consistent with that of the ECU. hardware performance to match.
  • the present application also provides a vehicle, as shown in FIG. 2 .
  • the vehicle includes multiple ECUs, and each ECU can be connected to a corresponding controller.
  • a controller such as body control module (BCM) controller, human machine interface (human machine interface, HMI) controller, advanced driving assistance system (advanced driving assistance system, ADAS) controller or vehicle control unit (Vehicle Control Unit) , VCU) controllers, etc., between controllers or between controllers and OBD or remote communication boxes (telematics BOX, TBOX) are connected through gateways.
  • BCM body control module
  • HMI human machine interface
  • ADAS advanced driving assistance system
  • VCU vehicle control unit
  • one controller can manage or control one or more ECUs.
  • the ECU may be the ECU in each of the systems described above in FIG. 1 .
  • each control module includes or is connected to one or more ECUs, such as the aforementioned travel system 102 , sensor system 104 , steering system 132 , accelerator 134 , braking unit 136, etc., each control module includes one or more ECUs for controlling the engine, wheels, steering, accelerator or braking of the vehicle.
  • ECUs such as the aforementioned travel system 102 , sensor system 104 , steering system 132 , accelerator 134 , braking unit 136, etc.
  • each control module includes one or more ECUs for controlling the engine, wheels, steering, accelerator or braking of the vehicle.
  • Ethernet has gradually become the backbone of in-vehicle networks this year. network.
  • ECU1 can communicate with ECU2 through a gateway.
  • Data transmission can be performed between ECU1 and ECU2 through the gateway, and the format of the transmitted data can use the SOME/IP (Scalable service-Oriented MiddlewarE over IP protocol) encapsulation format to achieve stable and secure data transmission.
  • SOME/IP Scalable service-Oriented MiddlewarE over IP protocol
  • SOME/IP is a flexible service-oriented middleware based on IP protocol.
  • the main application scenarios of SOME/IP can include: remote procedure call (remote procedure call, RPC), publish/subscribe (publish/subscribe) or service discovery (service discovery) and other scenarios.
  • RPC remote procedure call
  • publish/subscribe publish/subscribe
  • service discovery service discovery
  • the communication traffic carried by Ethernet is large. If all data is encrypted and protected, the hardware performance of the vehicle system is not enough to support it.
  • This application protects SOME/IP with small communication traffic and high security level, including integrity protection, confidentiality protection or anti-replay attack protection, so as to achieve a balance between device performance and data transmission security.
  • it can also be divided into strong ECUs and weak ECUs according to the computing power of the ECUs. For example, it can be distinguished according to the calculation speed.
  • the amount of computation required to process data according to the TLS/IPSec protocol is also relatively large, while the communication traffic required by the SOME/IP protocol is small.
  • SOME/IP protocol can be used to transmit data between strong ECUs and strong ECUs, or TLS/IPSec protocol can be used to transmit data, while data transmission with weak ECUs can be Use SOME/IP protocol to transmit.
  • the data transmission method provided by the present application will be introduced in detail below. It should be noted that the data transmission method provided in this application can be applied to a vehicle that includes multiple ECUs. Hereinafter, taking any two ECUs among them, hereinafter referred to as the first ECU and the second ECU respectively, as an example, for this The data transfer method provided by the application is described in detail.
  • FIG. 5 a schematic flowchart of a data transmission method provided by the present application is as follows.
  • the first ECU acquires the security level of the data to be sent.
  • the security level is used to indicate the importance of the data to be sent, and the security level may include multiple pre-defined classifications. Data with different levels of importance may have different corresponding protection strategies.
  • the security level corresponding to each ECU can be preset, or the security level can be set for each type of data, etc. For example, if the ECU is used to control the traveling of the vehicle or assist the traveling of the vehicle, the corresponding security level of the ECU is higher, and if the ECU is used to control the media of the vehicle, such as music, radio, video or video, the security level of the ECU is lower.
  • the mapping relationship between the identifier carried in the data and the security level may be preset, and the identifier may be the identifier of the data type or the identifier of the ECU that generates the data, or the like.
  • the mapping relationship may be the relationship between the identification of the ECU and the security level.
  • the security level of each ECU in the vehicle is determined according to the type of ECU in the vehicle.
  • ECUs in a vehicle can be divided into various types, for example, ECUs that control the accelerator of the vehicle, ECUs that control the braking of the vehicle, ECUs that control the steering of the vehicle, ECUs that control the engine of the vehicle, ECUs that control sensors, and ECUs that control the vehicle’s engine.
  • ECU in the speaker ECU in the speaker, etc. It can be understood that, in each system shown in FIG. 1 , each component has one or more ECUs, and a security level can be set for each ECU based on the importance of the data transmitted by each ECU.
  • a corresponding security level can be set for each ECU, and the identification of each ECU and the security level can be used for mapping.
  • ECU ID Security Level 8859 (ECU in throttle) 5 8860 (ECU in braking) 5 8870 (ECU in steering) 5 8896 (ECU in engine) 5 8898 (ECU in speaker) 1 8905 (ECU in display) 1 ... ...
  • the higher the security level the higher the importance of the data representing the ECU, such as the vehicle's accelerator, braking, steering or the ECU in the engine is used to control the vehicle's acceleration, deceleration or steering, etc., which is related to the driving safety of the vehicle. It is closely related.
  • ECUs with a high degree of importance can correspond to protection strategies with a higher degree of protection, thereby improving the security of the data transmitted by the important ECUs, improving the driving safety of vehicles, and thus improving the safety of users.
  • step 501 in this application is an optional step, that is, it is not necessary to obtain the security level of the data to be sent, which can be adjusted according to the actual application scenario, which is not limited here.
  • the mapping relationship may be a relationship between an identifier of a data type and a security level.
  • the data type can include vehicle control data or media data, etc.
  • the vehicle control data can be further divided into data for controlling the running of the vehicle or data for controlling auxiliary components of the vehicle, such as vehicle windows, power seats, air conditioners, etc. etc., and the security level of the data that controls the travel of the vehicle is generally higher than that of the auxiliary components of the vehicle.
  • Media data may include data such as audio, video, or images. Usually, the amount of media data is relatively large. If the media data is protected, it may require a large amount of computing resources, and the importance of the media data is usually not higher than the control data of the vehicle. Therefore, the media data can be set lower security level.
  • the relationship between data types and security levels can be set in advance, as shown in Table 2.
  • the data type A represents the command to control the traveling of the vehicle, such as the transmission of data between multiple ECUs in the steering system of the vehicle, the ECU in the accelerator, the ECU in the braking unit or the engine ECU or the ECU in the transmission device, etc.
  • the commands or data that control the steering, acceleration or deceleration of the vehicle correspond to safety level 5, that is, the highest safety level, indicating a higher degree of importance.
  • Data type B may include sensors in the vehicle, such as data collected by IMU, radar, or laser rangefinder, etc., corresponding to security level 4.
  • Data type C represents the data that the vehicle communicates with other devices, for example, the vehicle establishes a connection with the user's mobile phone or the user's Bluetooth headset through the vehicle's Bluetooth, and corresponds to security level 3.
  • Data type D represents data for controlling the equipment in the vehicle, such as control data for adjusting the rearview mirror, wiper or seat of the vehicle, and corresponds to safety level 2.
  • Data type E includes media data such as video or audio data transmitted in the vehicle, such as the data of the FM radio station in the vehicle, the video played on the display screen, etc., and corresponds to security level 1, that is, the lowest security level.
  • the security level can be set according to the type of data, and the instructions or data to control the steering, acceleration or deceleration of the vehicle affect the driving safety of the vehicle, so the importance level is high, and protection can be set for it later A higher degree of protection strategy, thereby improving the driving safety of the vehicle.
  • the first ECU determines a protection policy corresponding to the data to be sent.
  • a protection policy matching the to-be-sent data is determined from multiple protection policies.
  • the protection policy can be understood as a method for encapsulating data, such as whether to encrypt or whether to add a check code.
  • Various protection strategies include various ways of encapsulating the data to be sent. For example, a variety of policies can be preset, such as no protection, encryption of the data to be sent, addition of verification to the data to be sent, or both encryption and verification of the data to be sent.
  • At least two protection strategies have different amounts of computation for processing the data to be sent. For example, if the number of policies included in the first protection policy covers and exceeds the policies included in the second protection policy, then the amount of computation required to protect data using the first protection policy is greater than that of using the second protection policy. The amount of computation required to protect.
  • each protection policy may include, but is not limited to, one or more of the following policies: no protection, protection against replay attacks, integrity protection or confidentiality protection, and the like.
  • No protection means that the data to be sent is not protected, such as no encryption, and no verification code is added. At this time, the security of the data to be sent is poor.
  • Anti-replay attack protection means that the data to be sent is protected against replay attacks (Replay Attacks). For example, it can prevent other devices from using historical data to obtain data transmitted between ECUs. It can be understood that Replay Attacks, also known as replay attacks and replay attacks, refer to the attacker sending a packet that the receiving device has received to the receiving device to deceive the receiving device, thereby stealing data. In the application embodiment, the data security of the ECU can be improved through anti-replay attack protection.
  • Integrity protection means adding an integrity check code to the encapsulated message.
  • the integrity check code is used to check whether the parsed data is complete when parsing the encapsulated message, so as to avoid incomplete or partial data reception. Content received incorrectly, etc.
  • the data to be sent can be calculated by a preset check algorithm to obtain an integrity check code and added to the message. After receiving the message, the receiving device can use the preset algorithm and the integrity check code. Check the code to verify the payload in the message to determine whether the data in the payload is complete.
  • Confidentiality protection means that the data to be sent is encrypted to prevent other devices from parsing the content included in the data to be sent when they steal the data to be sent.
  • a preset key can be used to obtain a derived key, and then all or part of the data to be sent can be encrypted using the derived key to obtain the encrypted ciphertext, which is encapsulated in the net of the message. Therefore, even if other devices receive the message, they cannot parse the content included in the message, which improves the security of the message.
  • the protection policy is not to protect data
  • the amount of computation corresponding to the protection policy is very small, and the more measurements included in the protection policy, the larger the amount of computation required to protect data using the protection policy. the more.
  • identifier 1 represents protection strategy 1
  • identifier 6 represents protection strategy 6, and so on.
  • Protection strategy 1 means no protection
  • protection strategy 6 includes integrity protection and integrity protection
  • protection strategy 7 includes anti-replay attack protection, integrity protection and confidentiality protection at the same time.
  • the amount of computation required for data protection by protection strategy 7 is greater than the amount of computation required for data protection by protection strategy 1 and protection strategy 6 .
  • the protection strategy is determined by the content of the data to be sent.
  • the following two methods are used as examples to describe the specific ways of determining the protection strategy corresponding to the data to be sent.
  • Method 1 Determine the protection policy directly according to the content of the data to be sent
  • the foregoing step 501 may not be performed.
  • the content of the data to be sent such as the identity of the ECU that generated the data to be sent, the identity of the data to be sent, or the data size of the data to be sent, etc., from a variety of preset protection strategies choose an appropriate protection strategy.
  • the protection strategy corresponding to each ECU or the protection strategy corresponding to each data type can be set in advance.
  • a mapping table may be generated in advance, and the mapping table may include the identification of each ECU and the identification of the corresponding protection strategy, or the mapping table may include the identification of the data type and the protection strategy. For example, a more protective strategy can be set for the ECU that controls the movement of the vehicle.
  • the mapping table including the identification of each ECU and the identification of the corresponding protection strategy can be as shown in Table 4.
  • the following ECUs are only a part of the exemplary ECUs, Specifically, the identification of the ECU and the corresponding protection strategy may be adjusted according to the actual application scenario, which is not limited in this application.
  • the ECUs identified as 8859, 8860, 8870 and 8896 correspond to protection strategy 7, which also includes anti-replay attack protection, integrity protection and confidentiality protection.
  • the ECU identified as 8898 and the ECU identified as 8905 correspond to protection strategy 1 , that is, no protection.
  • the data transmitted in the vehicle and transmitted by the ECU that controls the traveling of the vehicle is more important, and a safer protection strategy can be selected to ensure the transmission of important data and improve the driving safety of the vehicle.
  • the media data transmitted by the ECU corresponding to the in-vehicle audio-visual entertainment is less important than the data transmitted by the ECU that controls the traveling of the vehicle.
  • the protection strategy with less calculation amount is selected to improve the operation efficiency of the ECU in the vehicle, thereby improving the driving safety of the vehicle.
  • the first ECU can select a matching protection strategy, or, if the data to be sent includes generating the data to be sent the identifier of the ECU, then a protection strategy that matches the identifier that generates the data to be sent can be selected according to the identifier.
  • the mapping table including the identifiers of the protection policies corresponding to the data types can be as shown in Table 5.
  • Table 5 the mapping table including the identifiers of the protection policies corresponding to the data types.
  • the data type A represents the command to control the traveling of the vehicle, such as the transmission of data between multiple ECUs in the steering system of the vehicle, the ECU in the accelerator, the ECU in the braking unit or the engine ECU or the ECU in the transmission device, etc.
  • the corresponding protection strategy corresponds to protection strategy 7, including anti-replay attack protection, integrity protection and confidentiality protection.
  • Data type B may include sensors in the vehicle, such as data collected by IMU, radar, or laser rangefinder, etc., and corresponds to protection strategy 6, including integrity protection and confidentiality protection.
  • Data type C represents the data that the vehicle communicates with other devices, for example, the vehicle establishes a connection with the user's mobile phone or the user's Bluetooth headset through the vehicle's Bluetooth, and corresponds to protection strategy 6, namely integrity protection and confidentiality protection.
  • the data type D represents data for controlling devices in the vehicle, such as control data for adjusting the rearview mirrors, wipers or seats of the vehicle.
  • Data type E includes video or audio data transmitted in the vehicle, such as the data of the FM radio station in the vehicle, the video played in the display screen, etc., and corresponds to protection strategy 1, that is, no protection. Therefore, the degree of protection of the data related to the driving of the vehicle is usually equal to the driving of the vehicle, and the corresponding protection strategy involves a greater amount of calculation.
  • a matching protection policy can be selected according to the data type included in the data to be sent.
  • the matching protection strategy can be selected according to the type of data or the ECU that generates the data, so that data with a high degree of importance can choose a protection strategy with a high degree of protection, and data with a low degree of importance can choose a protection strategy with a low degree of protection. Therefore, the data with high importance can be protected by enough calculation amount, the security of data can be improved, and the amount of calculation occupied by data with low importance level can be reduced, so as to evenly distribute the calculation amount of ECU in the vehicle and improve the security of data. Computational efficiency within the vehicle, thereby improving the driving safety of the vehicle.
  • Method 2 Select the matching protection strategy through the security level
  • the security level of the data to be sent determined in the foregoing step 502 may be used, and then a protection strategy matching the security level may be selected from multiple protection strategies.
  • a protection strategy matching the security level may be selected from multiple protection strategies.
  • the mapping relationship between the security level and the protection strategy can be set in advance, and after the security level of the data to be sent is determined, the security level of the data to be sent can be selected from a variety of protection strategies according to the mapping relationship. matching protection policy.
  • mapping relationship between the security level and the protection strategy can be as shown in Table 6.
  • this is only an exemplary illustration, and the specific content of the mapping relationship between the security level and the protection strategy can be adjusted according to the actual application scenario. , which is not limited here.
  • the security level may refer to the introduction of the foregoing step 501, and the protection policy may refer to the relevant description of the foregoing Table 3, which will not be repeated here.
  • a protection strategy matching the security level of the data to be sent can be selected for subsequent encapsulation. Therefore, data with a high security level can correspond to a protection strategy with a high degree of protection, so as to improve the security of data transmission, thereby improving the safety of vehicle driving. For data with a low security level, a protection strategy with a low degree of protection can be selected, thereby reducing the amount of calculation for protecting the data and effectively improving the computing resource utilization of the ECU in the vehicle.
  • the first ECU encapsulates the data to be sent according to a protection policy corresponding to the data to be sent.
  • the data to be sent can be encapsulated according to the selected protection policy to obtain an encapsulated packet.
  • a header may be directly added to the data to be sent to obtain an encapsulated packet.
  • the protection policy corresponding to the data to be sent includes one or more policies
  • the data to be sent may be encapsulated according to the multiple policies to obtain an encapsulated packet.
  • the encapsulation process of the data to be sent will be exemplified by taking several of the strategies, such as anti-replay attack protection, integrity protection or confidentiality protection as examples.
  • Anti-replay attack protection The first ECU and the second ECU transmission can set an anti-replay counter for the transmission data, which can be set by the first ECU or set by the second ECU. After the first ECU sends a frame of data to the second ECU, the counter is incremented by 1. Therefore, when the second ECU receives the encapsulated message, only when the value of the counter included in the encapsulated message is greater than the local value of the second ECU When the value of the stored counter is reached, continue parsing the packet, otherwise discard the packet. And, after the second ECU parses the encapsulated message, the local counter is updated to the value of the counter carried in the encapsulated message. Therefore, in the anti-replay attack protection, other devices can be prevented from performing replay attacks on the first device and the second device by means of a counter, so as to avoid data theft.
  • the first ECU can use preset algorithms, such as message digest algorithm (MD), secure hash algorithm (SHA), message authentication code (MAC) algorithm , Hash-based Message Authentication Code (HMAC), Block Cipher (Counter with CBC-MAC, CCM) algorithm, CMAC (cipher-based message authentication code) algorithm or AES-GMAC (Galois message authentication code) Mode, Galois message verification code)-128 algorithm and other integrity check algorithms, take the data to be sent as input, output the integrity check code for the data to be sent, and carry it in the encapsulation message. In this way, when the second device receives the encapsulated message, it can verify whether the payload in the encapsulated message is complete according to the integrity check code.
  • MD message digest algorithm
  • SHA secure hash algorithm
  • MAC message authentication code
  • HMAC Hash-based Message Authentication Code
  • CCM Block Cipher
  • CMAC cipher-based message authentication code
  • AES-GMAC Galois message authentication code
  • the data to be sent is encrypted by a preset encryption algorithm to obtain the corresponding ciphertext, which is the payload included in the encapsulated message.
  • a shared key pre-shared key, PSK
  • PSK pre-shared key
  • a derived key is generated each time data is transmitted, and then the derived key and an encryption algorithm, such as a symmetric algorithm (data encryption standard, DES) , international data encryption algorithm (IDEA), block cipher (counter with CBC-MAC, CCM) algorithm, advanced encryption standard (advanced encryption standard, AES) algorithm, or AES-GMAC-128 algorithm, etc.
  • a symmetric algorithm data encryption standard, DES
  • IDOA international data encryption algorithm
  • block cipher counter with CBC-MAC, CCM
  • advanced encryption standard advanced encryption standard
  • AES advanced encryption standard
  • AES-GMAC-128 algorithm etc.
  • the second ECU After the second ECU receives the encapsulated message, it can decrypt the ciphertext in the encapsulated message through the corresponding decryption algorithm to obtain the plaintext corresponding to the ciphertext, that is, the aforementioned data to be sent.
  • a matching protection strategy can be selected, so as to balance the calculation amount of data transmitted between ECUs in the vehicle, so that data with high importance can be used to a higher degree. protection, and reduce the amount of calculation for protection of data with low importance, so that the computing resources of the ECU in the vehicle can be used more effectively.
  • the message encapsulating the message may refer to FIG. 6 .
  • the encapsulated message may include: Ethernet header, IP header, transmission control protocol (transmission control protocol, TCP)/user datagram protocol (user datagram protocol, UDP) header, SOME/IP header, start frame, data Security type (referred to as SecTag below), frame type, number of encapsulated frames/event blocks (optional), anti-replay counter, coordinated universal time (UTC), payload (payload), and data for integrity checking. Check code (MIC) for verification.
  • Ethernet header is the headers, and may include information such as the source address, destination address, port number, etc. of the corresponding protocol.
  • the start frame is usually a fixed value.
  • SecTag is the type of the aforementioned protection strategy in this application.
  • the protection strategy can be divided into multiple types: 0: no verification, no encryption, no replay prevention; 1: verification, no encryption, and no replay protection; 2: verification Authentication, encryption, anti-replay.
  • the anti-replay counter PN is incremented by 1 after each Ethernet packet is sent, which is used for anti-replay attacks.
  • the number of encapsulated frames/event blocks indicates the number of data frames encapsulated in the message.
  • the payload includes the data that needs to be sent to the second ECU.
  • MIC is a check code for integrity verification.
  • the process of encapsulating the data to be sent may include: after setting the Ethernet header, IP header, TCP/UDP header, and SOME/IP header, setting SecTag, that is, the identifier of the protection policy matching the data to be sent.
  • SecTag 1 or 2
  • CMAC cipher-based message authentication code
  • block cipher Counter with CBC-MAC, CCM
  • hash operation message authentication code Hash-based Message Authentication Code, HMAC
  • AES -GMAC Galois message authentication code mode, Galois message authentication code-128 algorithm generates the integrity check code of the data to be sent, namely MIC.
  • the block cipher (Counter with CBC-MAC, CCM) algorithm, the advanced encryption standard (Advanced encryption standard, AES) algorithm, or the AES-GMAC-128 algorithm can be used to convert all or part of the data to be sent. It is ciphertext and filled in Payload.
  • K is a preset key or a derived key, and the derived key is obtained by deriving the set key.
  • IV is a 32-bit anti-replay counter.
  • A If not encrypted, A is the payload, if encrypted, A is the data from the first bit in the SOME/IP header to UTC (coordinated universal time).
  • P If it is not encrypted, then P is empty. If it is encrypted, the data can be taken from the SOME/IP header to the data between UTC and the Integrity Check Code (MIC), that is, the payload segment.
  • MIC Integrity Check Code
  • C is the ciphertext, that is, the payload part of the encapsulated packet.
  • T is a 128-bit message authentication code (MAC), and the aforementioned MIC takes any 32 bits of the 128-bit MAC, such as high 32 bits or low 32 bits.
  • MAC message authentication code
  • the hardware device of the vehicle supports the AES algorithm
  • the hardware can be called for acceleration to improve computing efficiency.
  • the calculation speed of the AES algorithm is fast, and the ECU with weak computing ability in time can also process the message without delay, improve the calculation speed of the message in the vehicle, improve the data transmission efficiency in the vehicle, and make the data in the vehicle available. Fast transmission, thereby improving the driving safety of the vehicle.
  • the first ECU sends the encapsulated message to the second ECU.
  • the first ECU After the first ECU encapsulates the data to be sent according to the matching protection policy, and after obtaining the encapsulation, the first ECU can send the encapsulated message to the second ECU through the wired network.
  • the second ECU acquires a protection policy corresponding to the encapsulated packet.
  • the second ECU determines a protection policy of the encapsulated packet, and determines how to parse the encapsulated packet according to the protection policy.
  • the encapsulation packet may carry an identifier of a protection policy, such as the data security type in the aforementioned FIG. 6 . Therefore, the second ECU can directly read the identification of the protection strategy from the APP header of the encapsulated message, and determine the corresponding protection strategy according to the identification.
  • a protection policy such as the data security type in the aforementioned FIG. 6 . Therefore, the second ECU can directly read the identification of the protection strategy from the APP header of the encapsulated message, and determine the corresponding protection strategy according to the identification.
  • the protection policy may include, but is not limited to, one or more of the following policies: no protection, anti-replay attack protection, integrity protection or confidentiality protection, and the like.
  • no protection anti-replay attack protection
  • integrity protection or confidentiality protection and the like.
  • the encapsulated message may carry the identifier of the ECU that generates the data included in the encapsulated message or the identifier of the type of data included in the encapsulated message, and the second device may generate the encapsulated message according to the identifier of the type of data included in the encapsulated message.
  • the identifier of the data ECU included in the message or the identifier of the type of data included in the encapsulated message is used to determine the corresponding protection policy.
  • the specific determination method is similar to the related description in the foregoing step 502, and details are not repeated here.
  • the second ECU parses the encapsulated packet according to the protection policy to obtain a parsing result.
  • the second ECU may directly read the payload of the encapsulated packet to obtain a parsing result.
  • the protection policy corresponding to the encapsulated packet includes anti-replay attack protection
  • the header of the encapsulated packet includes the value of the anti-replay counter
  • the second ECU can read the value of the anti-replay counter, which is consistent with the local anti-replay
  • the values of the replay counters are compared, and if the value of the anti-replay counter in the encapsulated packet is not greater than the value of the local anti-replay counter, the encapsulated packet is discarded; otherwise, the encapsulated packet continues to be parsed.
  • the protection policy corresponding to the encapsulated message includes integrity protection
  • the encapsulated message includes an integrity check code
  • the second ECU can verify the payload of the encapsulated message according to the integrity check code. If the verification passes and the encryption is not performed, the payload in the encapsulated packet can be directly read to obtain the parsing result; if the verification passes and encryption is performed, the payload of the encapsulated packet can continue to be decrypted .
  • the payload of the encapsulated packet can be decrypted through a preset algorithm to obtain the plaintext, that is, the parsing result.
  • the integrity check and decryption of the encapsulated message may be performed simultaneously or separately. If performed separately, the decryption may be performed first, or the integrity check may be performed first.
  • the sequence is related to the sequence of encryption and calculation integrity check when the first ECU is encapsulated, and can be specifically determined according to the actual application scenario, which is not limited in this application.
  • the payload is verified by using the integrity check code carried in the encapsulated message, and if the verification is passed, the payload is read to obtain a parsing result.
  • the AES-GCM-128 algorithm can be used to perform integrity check only, or the AES-GCM-128 algorithm can be used to perform integrity check and decryption at the same time.
  • the AES-GCM-128 algorithm can be expressed as:
  • PorFail AES-GCM-128(K,IV,C,A,T).
  • K is a preset key or a derived key, and the derived key is obtained by deriving the set key.
  • IV is a 32-bit anti-replay counter.
  • A If not encrypted, A is the payload, if encrypted, A is the data from the first bit in the SOME/IP header to UTC (coordinated universal time).
  • T is a 128-bit message authentication code (MAC)
  • MAC message authentication code
  • MIC takes any 32 bits of the 128-bit MAC, such as the upper 32 bits or the lower 32 bits.
  • the plaintext P can be output, and when the checksum parsing fails, it returns Fail, indicating that the parsing failed or the verification failed.
  • the first ECU may select a protection strategy matching the data to be sent from multiple protection strategies, and may select an appropriate protection strategy according to the importance of the protection strategy.
  • the multiple protection strategies may include protection strategies with different calculation amounts.
  • the calculation amount of the selected protection strategy is usually higher, and when the importance of the data to be sent is lower.
  • the calculation amount of the selected protection strategy is usually lower, so that the data with a high degree of importance can be protected to a higher degree, and the amount of calculation for the protection of data with a low degree of importance is reduced, so that the ECU in the vehicle can be protected. Computing resources can be used more efficiently.
  • the second ECU consumes a higher amount of computation for parsing, and for an encapsulated message with a lower importance, the amount of computation for parsing is also lower. It can balance the computing resources of the ECU in the vehicle, improve the effective utilization of computing resources, and enable important messages to be transmitted safely, stably and efficiently.
  • the present application provides a schematic structural diagram of an ECU, which is used to execute the aforementioned steps performed by the first ECU.
  • the ECU provided by the present application shown in FIG. 7 is hereinafter referred to as the first ECU.
  • the first ECU is applied to a vehicle, the vehicle includes multiple electronic control unit ECUs, the first ECU and the second ECU are any two ECUs among the multiple ECUs, and the multiple ECUs are connected through Ethernet, and the first ECU includes :
  • the determining module 702 is configured to determine a protection policy corresponding to the data to be sent from multiple protection policies, the multiple protection policies include multiple different encapsulation methods for the data to be sent, and the multiple protection policies include a protection policy for the data to be sent. At least two protection strategies with different computations;
  • An encapsulation module 703, configured to encapsulate the data to be sent according to the protection policy corresponding to the data to be sent, to obtain an encapsulated message;
  • the transceiver module 704 is configured to send the encapsulated message to the second ECU.
  • the determining module 702 is specifically configured to determine, according to the identifier included in the data to be sent, a protection policy corresponding to the data to be sent from multiple protection policies, and the identifier included in the data to be sent includes generating The identifier of the ECU to send the data or the identifier of the data type of the data to be sent.
  • the determining module 702 is specifically configured to: determine the security level of the data to be sent according to the identifier and the mapping relationship, and the mapping relationship It includes the relationship between the identification of the ECU in the vehicle and the security level.
  • the security level corresponding to each ECU in the vehicle is determined according to the type of ECU in the vehicle; according to the security level, it is determined from various protection strategies and corresponds to the data to be sent. protection strategy.
  • the encapsulated message includes an identifier of a protection policy corresponding to the data to be sent, and the identifier of the protection policy is used by the second ECU to determine a way of parsing the encapsulated message.
  • each of the at least two protection strategies includes one or more of the following strategies: no protection, anti-replay attack protection, integrity protection or confidentiality protection, no protection means treating The transmitted data is not protected, the anti-replay attack protection means that the data to be sent is protected against replay attacks, and the integrity protection means that the integrity check code is generated for the data to be sent, and the integrity check code is used for the second ECU to check. Check whether the encapsulated packet is complete, and confidentiality protection means encrypting the data to be sent.
  • the encapsulated message carries an anti-replay counter, and the value of the anti-replay counter is displayed every time the first ECU sends a message to the second ECU. Change after sending a frame of message, so that the second ECU discards the encapsulated message when the value of the anti-replay counter is not within the preset range;
  • the protection policy corresponding to the data to be sent includes integrity protection
  • the encapsulated message includes an integrity check code
  • the integrity check code is used by the second ECU to verify whether the data obtained by parsing the encapsulated message is complete
  • the protection policy corresponding to the data to be sent includes confidentiality protection
  • the payload in the encapsulated message includes ciphertext
  • the ciphertext is obtained by encrypting the data to be sent using a preset encryption algorithm.
  • the encapsulated packet is a SOME/IP packet.
  • FIG. 8 a schematic structural diagram of another ECU provided by the present application, the ECU can be used to perform the steps performed by the second ECU in the foregoing method, and the other ECU provided by the present application shown in FIG. 8 is hereinafter referred to as Second ECU.
  • the second ECU is applied to a vehicle, the vehicle includes multiple ECUs, and the first ECU and the second ECU are any two of the multiple ECUs.
  • the second ECU may include:
  • the obtaining module 802 is configured to obtain a protection policy corresponding to the encapsulated packet, where the protection policy corresponding to the encapsulated packet includes an encapsulation manner in which the first ECU obtains the encapsulated packet;
  • the parsing module 803 is configured to parse the encapsulated packet according to the protection policy to obtain a parsing result.
  • the protection strategy corresponding to the encapsulated packet includes one or more of the following strategies: no protection, anti-replay attack protection, integrity protection or confidentiality protection.
  • Protection, anti-replay attack protection means that the data to be sent is protected against anti-replay attacks.
  • Integrity protection means adding an integrity check code to the encapsulated packet. The integrity check code is used to parse the encapsulated packet. When , check whether the data obtained by parsing is complete, and confidentiality protection means encrypting the data to be sent.
  • the parsing module 803 is further configured to, if the encapsulation includes If the value of the anti-replay counter included in it is not within the preset range, the encapsulated packet is discarded.
  • the parsing module 803 is further configured to determine the parsing result in combination with the integrity check code Whether the parsing result is complete; if the parsing result is incomplete, the parsing result is discarded.
  • the parsing module 803 is specifically configured to combine the preset decryption algorithm to decrypt the payload included in the encapsulated packet to obtain the parsing result.
  • the encapsulated packet includes an identifier of the protection policy corresponding to the to-be-encapsulated packet, so that the acquisition module can identify the protection policy corresponding to the encapsulated packet according to the identifier.
  • FIG. 9 a schematic structural diagram of another ECU provided by the present application, as described below.
  • the ECU may include a processor 901 , a transceiver 903 and a memory 902 .
  • the processor 901, the transceiver 903 and the memory 902 are interconnected by wires.
  • the memory 902 stores program instructions and data.
  • the memory 902 stores program instructions and data corresponding to the aforementioned steps in FIG. 5 .
  • the processor 901 is configured to execute the method steps executed by the first ECU or the second ECU shown in any of the foregoing embodiments in FIG. 5 .
  • the ECU may also include a transceiver 903 for receiving or transmitting data.
  • Embodiments of the present application further provide a computer-readable storage medium, where a program for generating a vehicle's running speed is stored in the computer-readable storage medium, and when the computer is running on a computer, the computer is made to execute the implementation as shown in the aforementioned FIG. 5 . Steps performed by the first ECU or the second ECU in the method described in the example.
  • the aforementioned ECU shown in FIG. 9 is a chip.
  • Embodiments of the present application further provide a data transmission system, where the data transmission system includes at least one ECU, and the at least one ECU can be used to execute the method steps executed by the first ECU or the second ECU in any of the foregoing embodiments in FIG. 5 .
  • the embodiments of the present application further provide a vehicle, the vehicle includes at least one ECU, and the at least one ECU can be used to execute the method steps executed by the first ECU or the second ECU in any of the foregoing embodiments in FIG. 5 .
  • the embodiments of the present application also provide an ECU, which may also be referred to as a digital processing chip or a chip, the chip includes a processing unit and a communication interface, the processing unit obtains program instructions through the communication interface, the program instructions are executed by the processing unit, and the processing unit uses The method steps performed by the first ECU or the second ECU shown in any of the foregoing embodiments in FIG. 5 are executed.
  • an ECU which may also be referred to as a digital processing chip or a chip
  • the chip includes a processing unit and a communication interface
  • the processing unit obtains program instructions through the communication interface
  • the program instructions are executed by the processing unit
  • the processing unit uses The method steps performed by the first ECU or the second ECU shown in any of the foregoing embodiments in FIG. 5 are executed.
  • the embodiments of the present application also provide an ECU, which may also be referred to as a digital processing chip or a chip, the chip includes a processing unit and a communication interface, the processing unit obtains program instructions through the communication interface, the program instructions are executed by the processing unit, and the processing unit uses The method steps performed by the first ECU or the second ECU shown in any of the foregoing embodiments in FIG. 5 are executed.
  • an ECU which may also be referred to as a digital processing chip or a chip
  • the chip includes a processing unit and a communication interface
  • the processing unit obtains program instructions through the communication interface
  • the program instructions are executed by the processing unit
  • the processing unit uses The method steps performed by the first ECU or the second ECU shown in any of the foregoing embodiments in FIG. 5 are executed.
  • the embodiments of the present application also provide a digital processing chip.
  • the digital processing chip integrates circuits and one or more interfaces for realizing the above-mentioned processor 901 or the functions of the processor 901 .
  • the digital processing chip can perform the method steps of any one or more of the foregoing embodiments.
  • the digital processing chip does not integrate the memory, it can be connected with the external memory through the communication interface.
  • the digital processing chip implements the actions performed by the first ECU or the second ECU in the above embodiment according to the program codes stored in the external memory.
  • the embodiments of the present application also provide a digital processing chip.
  • the digital processing chip integrates circuits and one or more interfaces for realizing the above-mentioned processor 901 or the functions of the processor 901 .
  • the digital processing chip can perform the method steps of any one or more of the foregoing embodiments.
  • the digital processing chip does not integrate the memory, it can be connected with the external memory through the communication interface.
  • the digital processing chip implements the actions performed by the first ECU or the second ECU in the above embodiment according to the program codes stored in the external memory.
  • the embodiments of the present application also provide a computer program product, which, when driving on the computer, causes the computer to execute the steps executed by the first ECU or the second ECU in the method described in the foregoing embodiment shown in FIG. 5 .
  • the ECU provided in this embodiment of the present application may be a chip, and the chip includes: a processing unit and a communication unit.
  • the processing unit may be, for example, a processor, and the communication unit may be, for example, an input/output interface, a pin, or a circuit.
  • the processing unit can execute the computer-executed instructions stored in the storage unit, so that the chip in the server executes the data transmission method described in the embodiment shown in FIG. 5 above.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc.
  • the storage unit may also be a storage unit located outside the chip in the wireless access device, such as only Read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), etc.
  • ROM Read-only memory
  • RAM random access memory
  • the aforementioned processing unit or processor may be a central processing unit (CPU), a network processor (neural-network processing unit, NPU), a graphics processing unit (graphics processing unit, GPU), a digital signal processing digital signal processor (DSP), application specific integrated circuit (ASIC) or field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general purpose processor may be a microprocessor or it may be any conventional processor or the like.
  • the device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be A physical unit, which can be located in one place or distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.
  • U disk U disk
  • mobile hard disk ROM
  • RAM random access memory
  • disk or CD etc.
  • a computer device which can be a personal computer, server, or network device, etc. to execute the methods described in the various embodiments of the present application.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center is by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • wire eg, coaxial cable, fiber optic, digital subscriber line (DSL)
  • wireless eg, infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer, or a data storage device such as a server, data center, etc., which includes one or more available media integrated.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Small-Scale Networks (AREA)

Abstract

本申请提供了一种数据传输方法以及装置，应用在智能汽车、网联汽车上，用于为待传输的数据选择合适的保护策略，均衡ECU的计算资源。该方法包括：第一ECU获取待发送数据；第一ECU从多种保护策略中确定与待发送数据对应的保护策略，多种保护策略包括针对待发送数据的多种不同的封装方式，多种保护策略中包括对待发送数据进行处理的计算量不同的至少两种保护策略；第一ECU根据待发送数据对应的保护策略对待发送数据进行封装，得到封装报文；第一ECU向第二ECU发送封装报文，第一ECU和第二ECU是车辆内的任意两个ECU。

Description

一种数据传输方法以及装置 技术领域
本申请涉及汽车领域，尤其涉及一种数据传输方法以及装置。
背景技术
随着车载娱乐、导航、辅助驾驶等汽车电子系统的迅速发展，车载网络的通信数据明显增加。例如，在车辆内引进了具有高吞吐量的IEEE 802.3以太网技术，以太网逐步成为了车载网络的骨干网。
作为骨干网，以太网承载许多通信业务，比如视频点播，软件升级，监控数据上传，交互控制，诊断等大量数据。而在车内通信的环境下，车辆内的数据传输的安全性至关重要。在现有的方案中，针对车辆内传输的数据，进行了各种安全保护，如完整性保护、防重放攻击保护或者机密性保护等。然而，车内以太网的通信量大，针对数据进行保护的计算量也就越大，需要较高的硬件性能支撑该计算量。因此，如何在硬件性能支撑的前提下，对传输的数据进行有效保护，成为亟待解决的问题。
发明内容
本申请实施例提供了一种数据传输方法以及装置，用于为待传输的数据选择合适的保护策略，均衡ECU的计算资源。
有鉴于此，本申请第一方面提供一种数据传输方法，该方法包括：第一电子控制单元(electrical control unit，ECU)获取待发送数据，本申请所提及的第一ECU和第二ECU是同一车辆内的多个ECU中的任意两个ECU；第一ECU从多种保护策略中确定与待发送数据对应的保护策略，多种保护策略包括针对待发送数据的多种不同的封装方式，多种保护策略中包括针对待发送数据的计算量不同的至少两种保护策略，即在分别使用该至少两种保护策略对数据进行保护时，所需的计算量是不相同的；第一ECU根据待发送数据对应的保护策略对待发送数据进行封装，得到封装报文；第一ECU向第二ECU发送封装报文。
在本申请实施方式中，第一ECU可以从多种保护策略中选择与待发送数据匹配的保护策略，可以根据保护策略的重要程度来选择合适的保护策略。该多种保护策略中可以包括计算量不同的保护策略，本申请中所提及的计算量是指使用保护策略对待发送数据进行保护时所需的计算量，当待发送数据的重要程度越高时，所选择的保护策略对应的计算量通常也就越高，当待发送数据的重要程度越低时，所选择的保护策略对应的计算量通常也就越低。针对不同的数据，可以选择与之匹配的保护策略，从而均衡车辆内针对ECU之间传输的数据的计算量，使重要程度高的数据可以更高程度的被保护，并减少针对重要程度低的数据进行保护的计算量，从而使车辆内的ECU的计算资源可以得到更有效的利用，在车辆内硬件的性能支撑的基础上实现对传输的数据的有效保护。
本申请提供的方法可以应用于车辆，该车辆中包括多个电子控制单元(electrical control unit，ECU)，第一ECU和第二ECU为多个ECU中的任意两个ECU，且通常多个ECU 之间通过以太网连接。
在一种可能的实施方式中，第一ECU从多种保护策略中确定与待发送数据对应的保护策略，可以包括：第一ECU根据待发送数据中包括的标识，从多种保护策略中确定与待发送数据对应的保护策略，待发送数据中包括的标识包括产生待发送数据的ECU的标识或者待发送数据的数据类型的标识。
在本申请实施方式中，可以根据产生数据的ECU或者待发送数据的数据类型来选择合适的保护策略，从而针对不同类型或者不同ECU产生的数据可以选择与之匹配的保护策略，从而平衡车辆内针对ECU之间传输的数据的计算量，使重要程度高的数据可以更高程度的被保护，并减少针对重要程度低的数据进行保护的计算量，从而使车辆内的ECU的计算资源可以得到更有效的利用。
在一种可能的实施方式中，若待发送数据中包括的标识包括产生待发送数据的ECU的标识，第一ECU根据待发送数据中包括的标识，从多种保护策略中确定与待发送数据对应的保护策略，可以包括：第一ECU根据标识以及映射关系确定待发送数据的安全等级，映射关系包括了车辆内的ECU的标识和安全等级之间的关系，车辆内的每个ECU对应的安全等级是根据车辆内的ECU类型确定；第一ECU根据安全等级从多种保护策略中确定与待发送数据对应的保护策略。
本申请实施方式中，可以通过安全等级来表示待发送数据的重要程度，不同类型的ECU具有匹配的安全等级，从而后续可以根据安全等级来选择匹配的保护策略，尤其在车辆内的ECU越来越多的情况下，通过为ECU的类型来为每个ECU分配安全等级，可以实现对车辆内的ECU的高效管理，提高数据传输效率。并且，每个安全等级具有匹配的保护策略，可以使重要程度高的数据可以更高程度的被保护，并减少针对重要程度低的数据进行保护的计算量，从而使车辆内的ECU的计算资源可以得到更有效的利用。
通常，待发送数据的安全等级与保护策略对应的计算量呈正相关关系，即待发送数据的安全等级越高，则对应的保护策略对应的计算量也就越大，从而可以实现对安全等级高的数据进行保护程度更高的保护，提高重要数据的安全性。
在一种可能的实施方式中，封装报文中包括待发送数据对应的保护策略的标识，保护策略的标识用于第二ECU确定对封装报文的解析方式。
因此，本申请实施方式中，可以根据封装报文所携带的保护策略的标识，来使第二ECU识别出对应的保护策略，使第二ECU可以快速、准确地识别出封装报文的保护策略，进而确定合适的解析方式。
在一种可能的实施方式中，至少两种保护策略中的每种保护策略包括以下一项或者多项策略：无保护，防重放攻击保护，完整性保护或机密性保护，无保护表示对待发送数据不进行保护，防重放攻击保护表示对待发送数据进行针对重放攻击的保护，完整性保护表示在针对待发送数据生成完整性校验码，完整性校验码用于第二ECU校验封装报文是否完整，机密性保护表示对待发送数据进行加密处理。
因此，本申请实施方式中，提供了无保护，防重放攻击保护，完整性保护或机密性保护来对待发送数据进行保护，不同的保护策略可能具有不同的计算量，从而可以选择与待 发送数据匹配的保护策略，平衡车辆内的ECU的计算资源，提高计算资源的有效利用率。
在一种可能的实施方式中，若待发送数据对应的保护策略包括防重放攻击保护，则封装报文中携带防重放计数器，防重放计数器的值在第一ECU每向第二ECU发送一帧报文之后改变，以使第二ECU在防重放计数器的值不在预设范围内时丢弃封装报文；
若待发送数据对应的保护策略包括完整性保护，则封装报文中包括完整性校验码，完整性校验码用于第二ECU校验对封装报文解析得到的数据是否完整；
若待发送数据对应的保护策略包括机密性保护，则封装报文中的净荷包括密文，密文为使用预设的加密算法对待发送数据进行加密得到。
因此，在本申请实施方式中，针对不同的策略，封装报文中可以包括对应的数据，从而提供了一种封装报文的格式。
在一种可能的实施方式中，封装报文为SOME/IP报文。通常，SOME/IP报文是一种小型的保护，ECU可以对数据进行快速封装得到SOME/IP报文，本申请针对SOME/IP报文进行保护。
在一种可能的实施方式中，若待发送数据对应的保护策略包括完整性保护或机密性保护，则在第一ECU根据待发送数据对应的保护策略对待发送数据进行封装之前，方法还包括：第一ECU根据预设的预共享密钥PSK生成派生密钥，派生密钥用于对待发送数据进行完整性保护或机密性保护。
因此，在本申请实施方式中，可以通过共享密钥来生成派生密钥，从而完整对待发送数据的完整性保护或者机密性行保护，提高封装报文的安全性。
第二方面，本申请提供一种数据传输方法，应用于车辆，车辆中包括多个电子控制单元ECU，第一ECU和第二ECU为多个ECU中的任意两个ECU，多个ECU之间通过以太网连接，该方法包括：第二ECU接收第一ECU发送的封装报文；第二ECU获取封装报文对应的保护策略，封装报文对应的保护策略包括第一ECU得到封装报文的封装方式；第二ECU根据保护策略对封装报文进行解析，得到解析结果。
在本申请实施方式中，第二ECU在接收到第一ECU发送的封装报文之后，可以确定与该封装报文对应的保护策略，并根据该保护策略对封装报文进行解析。第一ECU可以从多种保护策略中选择封装报文对应的保护策略，针对不同的数据，可以选择与之匹配的保护策略，从而平衡车辆内针对ECU之间传输的数据的计算量，使重要程度高的数据可以更高程度的被保护，并减少针对重要程度低的数据进行保护的计算量，从而使车辆内的ECU的计算资源可以得到更有效的利用。
在一种可能的实施方式中，封装报文对应的保护策略包括以下一项或者多项策略：无保护，防重放攻击保护，完整性保护或机密性保护，无保护表示对待发送数据不进行保护，防重放攻击保护表示对待发送数据进行针对防重放攻击的保护，完整性保护表示在封装报文中添加完整性校验码，完整性校验码用于在对封装报文进行解析时，校验解析得到的数据是否完整，机密性保护表示对待发送数据进行加密处理。
本申请实施方式中，提供了无保护，防重放攻击保护，完整性保护或机密性保护来对待发送数据进行保护，不同的保护策略可能具有不同的计算量，从而可以选择与待发送数 据匹配的保护策略，平衡车辆内的ECU的计算资源，提高计算资源的有效利用率。
在一种可能的实施方式中，若封装报文对应的保护策略中包括防重放攻击保护，则封装报文的报头中包括防重放计数器的值；该方法还可以包括：若第二ECU确定封装包括中包括的防重放计数器的值不在预设范围内，则丢弃封装报文。
本申请实施方式中，可以利用防重放计数器来进行重放保护，第二ECU可以丢弃防重放计数器的值不在预设范围内的封装报文，从而避免重放攻击。
在一种可能的实施方式中，若封装报文对应的保护策略包括完整性保护，则封装报文中包括完整性校验码；在第二ECU根据保护策略对封装报文进行解析之后，方法还包括：结合完整性校验码确定解析结果是否完整；若解析结果不完整，则丢弃解析结果。
本申请实施方式中，在得到封装报文的解析结果之后，可以验证解析结果是否完整，若不完整，则丢弃解析结果，避免使用无效的数据。
在一种可能的实施方式中，若待发送数据对应的保护策略包括机密性保护，则第二ECU根据保护策略对封装报文进行解析，可以包括：结合预设的解密算法，对封装报文所包括的净荷进行解密，得到解析结果。本申请实施方式中，若第一ECU对待发送数据进行了加密，则封装报文所包括的净荷是密文，第二ECU可以根据解密算法对该密文，从而提高封装报文的安全性。
在一种可能的实施方式中，封装报文中包括待发送数据对应的保护策略的标识。
第三方面，本申请提供一种第一ECU，该第一ECU具有实现上述第一方面数据传输方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第四方面，本申请提供一种第二ECU，该第二ECU具有实现上述第二方面数据传输方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第五方面，本申请实施例提供一种ECU，包括：处理器和存储器，其中，处理器和存储器通过线路互联，处理器调用存储器中的程序代码用于执行上述第一方面任一项或第二方面任一项所示的数据传输方法中与处理相关的功能。
第六方面，本申请实施例提供了一种数据传输装置，该数据传输装置也可以称为数字处理芯片或者芯片，芯片包括处理单元和通信接口，处理单元通过通信接口获取程序指令，程序指令被处理单元执行，处理单元用于执行如上述第一方面、第一方面任一可选实施方式中、第二方面或第二方面任一可选实施方式中与处理相关的功能。
第七方面，本申请实施例提供了一种车辆，该车辆内包括了至少一个ECU，该至少一个ECU用于执行如上述第一方面、第一方面任一可选实施方式中、第二方面或第二方面任一可选实施方式中的步骤。
第八方面，本申请实施例提供了一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行上述第一方面、第一方面任一可选实施方式、第二方面或第二方面任一可选实施方式中的方法。
第九方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运 行时，使得计算机执行上述第一方面、第一方面任一可选实施方式、第二方面或第二方面任一可选实施方式中的方法。
第十方面，本申请提供一种数据传输系统，包括至少一个ECU，该至少一个ECU用于执行上述第一方面、第一方面任一可选实施方式、第二方面或第二方面任一可选实施方式中的方法的步骤。
附图说明
图1为本申请实施例提供的一种车辆的结构示意图；
图2为本申请提供的一种数据传输系统的结构示意图；
图3为本申请提供的一种ECU传输数据的方式；
图4A为本申请提供的另一种ECU传输数据的方式；
图4B为本申请提供的另一种ECU传输数据的方式；
图5为本申请提供的一种数据传输方法的流程示意图；
图6为本申请提供的一种封装报文的格式示意图；
图7为本申请提供的一种ECU结构示意图；
图8为本申请提供的另一种ECU结构示意图；
图9为本申请提供的另一种ECU结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请实施例提供的数据传输方法可以应用于各种和车辆相关的场景，如对车辆进行行车路径规划、监控车辆状态或远程控制车辆等场景。此外，本申请也可以应用于对各类机器人进行行车路径规划、监控车辆状态或远程控制车辆等场景，例如货运机器人、探测机器人、扫地机器人或其他类型的机器人，此处以货运机器人为例对应用场景作进一步描述，当货运机器人在进行运输时，可以实时对货运机器人的状态进行监控、规划运输路径或者远程控制等，从而安全稳定地完成运输。
下面结合附图，对本申请的实施例进行描述。本领域普通技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为了便于理解本方案，本申请实施例中首先结合图1对本申请提供的车辆的结构进行介绍，请先参阅图1，图1为本申请实施例提供的车辆的一种结构示意图，车辆100可以配置为自动驾驶模式。例如，车辆100可以在处于自动驾驶模式中的同时控制自身，并且可通过人为操作来确定车辆及其周边环境的当前状态，确定周边环境中的是否存在障碍物，基于障碍物的信息来控制车辆100。在车辆100处于自动驾驶模式中时，也可以将车辆100置为在没有和人交互的情况下操作。
车辆100可包括各种子系统，例如行进系统102、传感器系统104、控制系统106、一个或多个外围设备108以及电源110、计算机系统112和用户接口116。可选地，车辆100可包括更多或更少的子系统，并且每个子系统可包括多个部件。另外，车辆100的每个子系统和部件可以通过有线或者无线互连。
行进系统102可包括为车辆100提供动力运动的组件。在一个实施例中，行进系统102可包括引擎118、能量源119、传动装置120和车轮/轮胎121。
其中，引擎118可以是内燃引擎、电动机、空气压缩引擎或其他类型的引擎组合，例如，汽油发动机和电动机组成的混动引擎，内燃引擎和空气压缩引擎组成的混动引擎。引擎118将能量源119转换成机械能量。能量源119的示例包括汽油、柴油、其他基于石油的燃料、丙烷、其他基于压缩气体的燃料、乙醇、太阳能电池板、电池和其他电力来源。能量源119也可以为车辆100的其他系统提供能量。传动装置120可以将来自引擎118的机械动力传送到车轮121。传动装置120可包括变速箱、差速器和驱动轴。在一个实施例中，传动装置120还可以包括其他器件，比如离合器。其中，驱动轴可包括可耦合到一个或多个车轮121的一个或多个轴。
传感器系统104可包括感测关于车辆100周边的环境的信息的若干个传感器。例如，传感器系统104可包括定位系统122(定位系统可以是全球定位GPS系统，也可以是北斗系统或者其他定位系统)、惯性测量单元(inertial measurement unit，IMU)124、雷达126、激光测距仪128以及相机130。传感器系统104还可包括被监视车辆100的内部系统的传感器(例如，车内空气质量监测器、燃油量表、机油温度表等)。来自这些传感器中的一个或多个的传感数据可用于检测对象及其相应特性(位置、形状、方向、速度等)。这种检测和识别是自主车辆100的安全操作的关键功能。在本申请以下实施方式中提及的传感器，即可以是雷达126、激光测距仪128或者相机130等。
其中，定位系统122可用于估计车辆100的地理位置。IMU 124用于基于惯性加速度来感知车辆100的位置和朝向变化。在一个实施例中，IMU 124可以是加速度计和陀螺仪的组合。雷达126可利用无线电信号来感知车辆100的周边环境内的物体，具体可以表现为毫米波雷达或激光雷达。在一些实施例中，除了感知物体以外，雷达126还可用于感知物体的速度和/或前进方向。激光测距仪128可利用激光来感知车辆100所位于的环境中的物体。在一些实施例中，激光测距仪128可包括一个或多个激光源、激光扫描器以及一个或多个检测器，以及其他系统组件。相机130可用于捕捉车辆100的周边环境的多个图像。相机130可以是静态相机或视频相机。
控制系统106为控制车辆100及其组件的操作。控制系统106可包括各种部件，其中包括转向系统132、油门134、制动单元136、计算机视觉系统140、线路控制系统142以及障碍避免系统144。
其中，转向系统132可操作来调整车辆100的前进方向。例如在一个实施例中可以为方向盘系统。油门134用于控制引擎118的操作速度并进而控制车辆100的速度。制动单元136用于控制车辆100减速。制动单元136可使用摩擦力来减慢车轮121。在其他实施例中，制动单元136可将车轮121的动能转换为电流。制动单元136也可采取其他形式来 减慢车轮121转速从而控制车辆100的速度。计算机视觉系统140可以操作来处理和分析由相机130捕捉的图像以便识别车辆100周边环境中的物体和/或特征。所述物体和/或特征可包括交通信号、道路边界和障碍体。计算机视觉系统140可使用物体识别算法、运动中恢复结构(Structure from Motion，SFM)算法、视频跟踪和其他计算机视觉技术。在一些实施例中，计算机视觉系统140可以用于为环境绘制地图、跟踪物体、估计物体的速度等等。线路控制系统142用于确定车辆100的行驶路线以及行驶速度。在一些实施例中，线路控制系统142可以包括横向规划模块1421和纵向规划模块1422，横向规划模块1421和纵向规划模块1422分别用于结合来自障碍避免系统144、GPS 122和一个或多个预定地图的数据为车辆100确定行驶路线和行驶速度。障碍避免系统144用于识别、评估和避免或者以其他方式越过车辆100的环境中的障碍体，前述障碍体具体可以表现为实际障碍体和可能与车辆100发生碰撞的虚拟移动体。在一个实例中，控制系统106可以增加或替换地包括除了所示出和描述的那些以外的组件。或者也可以减少一部分上述示出的组件。
车辆100通过外围设备108与外部传感器、其他车辆、其他计算机系统或用户之间进行交互。外围设备108可包括无线数据传输系统146、车载电脑148、麦克风150和/或扬声器152。在一些实施例中，外围设备108为车辆100的用户提供与用户接口116交互的手段。例如，车载电脑148可向车辆100的用户提供信息。用户接口116还可操作车载电脑148来接收用户的输入。车载电脑148可以通过触摸屏进行操作。在其他情况中，外围设备108可提供用于车辆100与位于车内的其它设备通信的手段。例如，麦克风150可从车辆100的用户接收音频(例如，语音命令或其他音频输入)。类似地，扬声器152可向车辆100的用户输出音频。无线数据传输系统146可以直接地或者经由通信网络来与一个或多个设备无线通信。例如，无线数据传输系统146可使用3G蜂窝通信，例如CDMA、EVD0、GSM/GPRS，或者4G蜂窝通信，例如LTE。或者5G蜂窝通信。无线数据传输系统146可利用无线局域网(wireless local area network，WLAN)通信。在一些实施例中，无线数据传输系统146可利用红外链路、蓝牙或ZigBee与设备直接通信。其他无线协议，例如各种车辆数据传输系统，例如，无线数据传输系统146可包括一个或多个专用短程通信(dedicated short range communications，DSRC)设备，这些设备可包括车辆和/或路边台站之间的公共和/或私有数据通信。
电源110可向车辆100的各种组件提供电力。在一个实施例中，电源110可以为可再充电锂离子或铅酸电池。这种电池的一个或多个电池组可被配置为电源为车辆100的各种组件提供电力。在一些实施例中，电源110和能量源119可一起实现，例如一些全电动车中那样。
车辆100的部分或所有功能受计算机系统112控制。计算机系统112可包括至少一个处理器113，处理器113执行存储在例如存储器114这样的非暂态计算机可读介质中的指令115。计算机系统112还可以是采用分布式方式控制车辆100的个体组件或子系统的多个计算设备。处理器113可以是任何常规的处理器，诸如商业可获得的中央处理器(central processing unit，CPU)。可选地，处理器113可以是诸如专用集成电路(application specific integrated circuit，ASIC)或其它基于硬件的处理器的专用设备。尽管图1功 能性地图示了处理器、存储器、和在相同块中的计算机系统112的其它部件，但是本领域的普通技术人员应该理解该处理器、或存储器实际上可以包括不存储在相同的物理外壳内的多个处理器、或存储器。例如，存储器114可以是硬盘驱动器或位于不同于计算机系统112的外壳内的其它存储介质。因此，对处理器113或存储器114的引用将被理解为包括可以并行操作或者可以不并行操作的处理器或存储器的集合的引用。不同于使用单一的处理器来执行此处所描述的步骤，诸如转向组件和减速组件的一些组件每个都可以具有其自己的处理器，所述处理器只执行与特定于组件的功能相关的计算。
在此处所描述的各个方面中，处理器113可以位于远离车辆100并且与车辆100进行无线通信。在其它方面中，此处所描述的过程中的一些在布置于车辆100内的处理器113上执行而其它则由远程处理器113执行，包括采取执行单一操纵的必要步骤。
在一些实施例中，存储器114可包含指令115(例如，程序逻辑)，指令115可被处理器113执行来执行车辆100的各种功能，包括以上描述的那些功能。存储器114也可包含额外的指令，包括向行进系统102、传感器系统104、控制系统106和外围设备108中的一个或多个发送数据、从其接收数据、与其交互和/或对其进行控制的指令。除了指令115以外，存储器114还可存储数据，例如道路地图、路线信息，车辆的位置、方向、速度以及其它这样的车辆数据，以及其他信息。这种信息可在车辆100在自主、半自主和/或手动模式中操作期间被车辆100和计算机系统112使用。用户接口116，用于向车辆100的用户提供信息或从其接收信息。可选地，用户接口116可包括在外围设备108的集合内的一个或多个输入/输出设备，例如无线数据传输系统146、车载电脑148、麦克风150或扬声器152等。
计算机系统112可基于从各种子系统(例如，行进系统102、传感器系统104和控制系统106)以及从用户接口116接收的输入来控制车辆100的功能。例如，计算机系统112可以用个can总线和车辆100内的其他系统或者部件进行通信，如计算机系统112可利用来自控制系统106的输入以便控制转向系统132来避免由传感器系统104和障碍避免系统144检测到的障碍体。在一些实施例中，计算机系统112可操作来对车辆100及其子系统的许多方面提供控制。
可选地，上述这些组件中的一个或多个可与车辆100分开安装或关联。例如，存储器114可以部分或完全地与车辆100分开存在。上述组件可以按有线和/或无线方式来通信地耦合在一起。
可选地，上述组件只是一个示例，实际应用中，上述各个模块中的组件有可能根据实际需要增添或者删除，图1不应理解为对本申请实施例的限制。本申请提供的数据传输方法，可以由计算机系统112、雷达126、激光测距仪128或者外围设备，如车载电脑148或者其他车载终端等来执行。例如，本申请提供的数据传输方法可以由车载电脑148来执行，车载电脑148可以为车辆规划行车路径以及对应的速度曲线，并根据行车路径生成控制指令，将控制指令发送至计算机系统112，由计算机系统112控制车辆的控制系统106中的转向系统132、油门134、制动单元136、计算机视觉系统140、线路控制系统142或者障碍避免系统144等，从而实现车辆的自动驾驶。
上述车辆100可以为轿车、卡车、摩托车、公共汽车、船、飞机、直升飞机、割草机、娱乐车、游乐场车辆、施工设备、电车、高尔夫球车、火车、和手推车等，本申请实施例不做特别的限定。
本申请提供的车辆，可以包括多个ECU，本申请提供的数据传输方法，可以应用于车辆内的ECU之间传输数据，提高数据传输的效率，使对传输的报文的加密方式与ECU的硬件性能相匹配。
示例性地，本申请还提供一种车辆，如图2所示。其中，车辆内包括多个ECU，每个ECU可以连接对应的控制器。如车身控制模块(body control module，BCM)控制器、人机接口(human machine interface，HMI)控制器、高级驾驶辅助系统(advanced driving assistance system，ADAS)控制器或者整车控制器(Vehicle Control Unit,VCU)控制器等，控制器之间或者控制器与OBD或者远程通信箱(telematics BOX，TBOX)之间通过网关连接。也可以理解为，一个控制器可以对一个或者多个ECU进行管理或者控制。该ECU可以是前述图1中所述的各个系统中的ECU。可以理解为，该车辆内可以包括了多种控制模块，每个控制模块包括或者连接了一个或者多个ECU，如前述的行进系统102、传感器系统104、转向系统132、油门134、制动单元136等，每个控制模块内包括了一个或者多个ECU，用于控制车辆的引擎、车轮、转向、油门或者制动等。
随着车载娱乐、导航、辅助驾驶等汽车电子系统的迅速发展，车载网络的通信数据明显增加，汽车行业引进了具有高吞吐量的IEEE 802.3以太网技术，以太网今年逐步成为了车载网络的骨干网。示例性地，以两个ECU为例，该两个ECU之间传输数据的过程可以参阅图3。其中，ECU1可以通过网关与ECU2进行通信。ECU1和ECU2之间可以通过网关进行数据传输，传输数据的格式可以使用SOME/IP(Scalable service-Oriented MiddlewarE over IP protocol)的封装格式，从而实现数据的稳定、安全的传输。
SOME/IP，是一种灵活的基于IP协议的面向服务的中间件。SOME/IP主要应用场景可以包括：远程过程调用(remote procedure call，RPC)、发布/订阅(publish/subscribe)或服务发现(service discovery)等场景。然而，以太网承载的通信流量大，如果全部数据进行加密保护，车载系统的硬件性能不足以支撑。本申请针对通信流量小而且安全等级高的SOME/IP进行保护，包括完整性保护、机密性保护或者防重放攻击保护等，从而实现设备的性能和数据传输的安全之间的平衡。
在一些场景中，还可以根据ECU的计算能力分为强ECU和弱ECU，比如可以根据计算速度来区分，强ECU的计算速度快与弱ECU。通常，按照TLS/IPSec协议对数据进行处理所需的计算量也较大，而SOME/IP协议所需的通信流量小。如图4A和图4B所示，强ECU之间和强ECU之间可以采用SOME/IP协议来传输数据，也可以采用TLS/IPSec协议来传输数据，而与弱ECU之间的数据传输则可以使用SOME/IP协议来传输。
下面对本申请提供的数据传输方法进行详细介绍。需要说明的是，本申请提供的数据传输方法可以应用于车辆，该车辆内包括了多个ECU，下面以其中的任意两个ECU，以下分别称为第一ECU和第二ECU为例，对本申请提供的数据传输方法进行详细介绍。
参阅图5，本申请提供的一种数据传输方法的流程示意图，如下所述。
501、第一ECU获取待发送数据的安全等级。
该安全等级用于表示待发送数据的重要程度，该安全等级可以包括预先划定的多种分类，重要程度不同的数据，对应的保护策略可能也不同。
通常，可以预先设定每个ECU对应的安全等级，或者为每种类型的数据设定安全等级等。例如，若ECU用于控制车辆行进或者辅助车辆行进等，则该ECU对应的安全等级较高，若ECU用于控制车辆的媒体，如音乐、电台、视频或者录像等，则该ECU的安全等级则较低。
可选地，可以预先设置数据中携带的标识和安全等级的映射关系，该标识可以是数据类型的标识或者产生该数据的ECU的标识等。
可选地，该映射关系可以是ECU的标识和安全等级的关系。车辆内的每个ECU的安全等级是根据车辆内的ECU类型确定的。通常，车辆内的ECU可以分为多种类型，例如，可以分为控制车辆油门的ECU，控制车辆制动的ECU，控制车辆转向的ECU，控制车辆引擎的ECU，传感器的ECU，车载终端中的ECU，扬声器中的ECU等。可以理解为，前述图1中所示的各个系统中，每个部件内具有一个或者多个ECU，可以基于每个ECU传输的数据的重要程度为每个ECU设置安全等级。
例如，如表1所示，可以为每个ECU设置对应的安全等级，可以使用每个ECU的标识和该安全等级来进行映射。
ECU标识 安全等级
8859(油门中的ECU) 5
8860(制动中的ECU) 5
8870(转向中的ECU) 5
8896(引擎中的ECU) 5
8898(扬声器中的ECU) 1
8905(显示屏中的ECU) 1
… …
表1
通常，安全等级越高，表示ECU的数据的重要程度也就越高，如车辆的油门、制动、转向或者引擎中的ECU用于控制车辆的加速、减速或转向等，与车辆的行车安全息息相关，后续可以为重要程度高的ECU对应保护程度更高的保护策略，从而提高重要的ECU所传输的数据的安全性，提高车辆的行车安全性，从而提高用户的安全性。
需要说明的是，本申请中的步骤501为可选步骤，即也可以无需获取待发送数据的安全等级，具体可以根据实际应用场景调整，此处并不作为限定。
可选地，该映射关系可以是数据类型的标识和安全等级的关系。该数据类型可以包括车辆的控制数据或者媒体数据等，车辆的控制数据又可以分为控制车辆行进的数据或者控制车辆的辅助部件的数据，该辅助部件如车辆的车窗、电动座椅、空调等，且控制车辆行进的数据的安全等级通常高于控制车辆的辅助部件的数据。媒体数据可以包括音频、视频或者图像等数据。通常，媒体数据的数据量较大，若对该媒体数据进行保护，则可能需要 耗费较大的计算资源，且媒体数据的重要程度通常不高于车辆的控制数据，因此，可以为媒体数据设置较低的安全等级。
例如，可以提前设置数据类型和安全等级之间的关系，如表2所示。
数据类型 安全等级
A(行进控制指令) 5
B(传感器数据) 4
C(通信数据) 3
D(辅助控制数据) 2
E(媒体数据) 1
… …
表2
其中，数据类型A表示控制车辆行进的指令，如车辆的转向系统内的多个ECU之间传输的数据、油门中的ECU、制动单元中的ECU或者引擎ECU或者传动装置中的ECU等传输的控制车辆转向、加速或减速等操作的指令或数据，对应安全等级5，即安全等级最高，表示重要程度也就越高。数据类型B可以包括车辆内的传感器，如IMU、雷达或者激光测距仪等采集到的数据等，对应安全等级4。数据类型C表示车辆与其他设备进行通信的数据，如车辆通过车载蓝牙与用户的手机建立连接或者与用户的蓝牙耳机建立连接等，对应安全等级3。数据类型D表示对车辆内的设备进行控制的数据，如调节车辆的后视镜、雨刮或者座椅等的控制数据，对应安全等级2。数据类型E包括了车辆内传输的视频或者音频数据等媒体数据，如车辆内的FM电台的数据，显示屏中播放的视频等，对应安全等级1，即安全等级最低。
因此，本申请实施方式中，可以按照数据的类型来设置安全等级，控制车辆转向、加速或减速等操作的指令或数据影响车辆的行车安全性，因此重要程度较高，后续可以为其设置保护程度较高的保护策略，从而提高车辆的行车安全性。
502、第一ECU确定与待发送数据对应的保护策略。
在第一ECU获取到待发送数据之后，从多种保护策略中确定与该待发送数据匹配的保护策略。
保护策略可以理解为针对数据是否进行封装的方式，如是否进行加密或者是否增加校验码等。多种保护策略包括了针对待发送数据进行封装的多种不同的方式。如可以预先设定多种包括策略，如不保护、对待发送数据进行加密、对待发送数据增加校验或者对待发送数据既进行加密也增加校验等。
该多种保护策略中至少有两种保护策略对待发送数据进行处理的计算量不相同。例如，第一保护策略所包括的策略的数量覆盖且多于第二保护策略所包括的策略，则使用第一保护策略对数据进行保护时所需的计算量，大于使用第二保护策略对数据进行保护时所需的计算量。
示例性地，每种保护策略可以包括但不限于以下一项或者多项策略：无保护，防重放攻击保护，完整性保护或机密性保护等。
无保护表示对待发送数据不进行保护，如不加密，也不增加校验码等，此时待发送数据传输的安全性较差。
防重放攻击保护表示对待发送数据进行针对重放攻击(Replay Attacks)的保护，如可以防止其他设备利用历史数据来获取ECU之间传输的数据。可以理解的是，重放攻击(Replay Attacks)又称重播攻击、回放攻击，是指攻击者向接收设备发送一个接收设备已接收过的包，来达到欺骗接收设备的目的，从而窃取数据，本申请实施方式中，可以通过防重放攻击保护，来提高ECU的数据安全性。
完整性保护表示在封装报文中添加完整性校验码，完整性校验码用于在对封装报文进行解析时，校验解析得到的数据是否完整，以避免出现数据接收不完全或者部分内容接收不正确等。例如，可以对待发送数据通过预设的校验算法进行计算，得到完整性校验码，并添加至报文中，接收设备接收到报文之后，可以通过该预设的算法以及该完整性校验码，对报文中的净荷进行校验，判断净荷中的数据是否完整。
机密性保护表示对待发送数据进行加密处理，以防止其他设备在窃取到该待发送数据时解析到该待发送数据所包括的内容。例如，可以使用预置的密钥来得到派生密钥，然后使用该派生密钥对待发送数据中的全部或者部分数据进行加密，得到加密后的密文，将该密文封装在报文的净荷内，因此，即使其他设备接收到该报文，也无法解析到该报文所包括的内容，提高了报文的安全性。
通常，若保护策略为不对数据进行保护，则该保护策略对应的计算量是非常少的，且通常保护策略所包括的测量越多，使用该保护策略对数据进行保护时所需的计算量也就越多。
为便于理解，示例性地，以其中几种策略组成的保护策略为例进行示例性说明。如表3所示。
保护策略 防重放攻击保护 完整性保护 机密性保护
1      
6 √ √  
7 √ √ √
… … … …
表3
其中，标识1即表示保护策略1，标识6即表示保护策略6，以此类推。保护策略1即无保护，保保护策略6包括了完整性保护和完整性保护；保护策略7同时包括防重放攻击保护、完整性保护和机密性保护。保护策略7对数据进行保护所需的计算量，大于保护策略1和保护策略6对数据进行保护所需的计算量。
需要说明的是，在表3的示例中，不同的保护策略针对数据进行保护的计算量可能相同也可能不同，具体需要根据实际应用场景确定，本申请仅仅是示例性说明。
在本申请中，从多种保护策略中选择与待发送数据匹配的保护策略的方式可以有多种，可以是通过前述步骤501中所提及的安全等级来确定保护策略，也可以是直接根据待发送 数据所包括的内容来确定保护策略等，下面以这两种方式为例，分别对确定与待发送数据对应的保护策略的具体方式进行说明。
方式一、直接根据待发送数据所包括的内容来确定保护策略
在本方式一中，可以无需获知待发送数据对应的安全等级，即可以无需执行前述的步骤501。
具体地，根据待发送数据自身携带的内容，如产生该待发送数据的ECU的标识，该待发送数据的标识或者该待发送数据的数据量大小等，从预先设定的多种保护策略中选择合适的保护策略。
在本方式中，可以提前设置每个ECU所对应的保护策略或者每种数据类型所对应的保护策略。示例性地，可以提前生成映射表，该映射表中可以包括每个ECU的标识和对应的保护策略的标识，或者，该映射表中可以包括数据类型和保护策略的标识。例如，可以为控制车辆行进的ECU设置保护程度更高的保护策略。
例如，结合前述表3中的保护策略的标识，包括了每个ECU的标识和对应的保护策略的标识的映射表可以如表4所示，当然，以下的ECU仅仅是示例性的一部分ECU，具体可以根据实际应用场景进行调整ECU的标识和对应的保护策略，本申请对此并不作限定。
ECU标识 保护策略
8859(油门中的ECU) 7
8860(制动中的ECU) 7
8870(转向中的ECU) 7
8896(引擎中的ECU) 7
8898(扬声器中的ECU) 1
8905(显示屏中的ECU) 1
… …
表4
其中，该标识为8859、8860、8870和8896的ECU对应保护策略7，同时包括防重放攻击保护、完整性保护和机密性保护，标识为8898的ECU和标识为8905的ECU对应保护策略1，即无保护。通常，对于车辆内传输的控制车辆的行进的ECU传输的数据重要程度较高，可以选择更安全的保护策略，以保证重要的数据的传输，提高车辆的行车安全性。针对车辆内影音娱乐对应的ECU传输的媒体数据，则相对于控制车辆行进的ECU传输的数据而言重要程度较低，为降低车辆内影音娱乐对应的ECU传输的数据进行封装的计算量，可以选择计算量较少的保护策略，从而提高车辆内ECU的运行效率，进而提高车辆的行车安全性。
因此，若提前设置了ECU的标识和保护策略的关系，若待发送数据为第一ECU产生，则第一ECU可以选择匹配的保护策略，或者，若待发送数据中包括了产生该待发送数据的ECU的标识，则可以根据该标识选择与产生该待发送数据的标识匹配的保护策略。
又例如，结合前述表3中的保护策略的标识，包括了数据类型对应的保护策略的标识的映射表可以如表5所示，当然，以下仅仅是示例性地列举了几种数据类型，具体可以根 据实际应用场景进行调整具体的数据类型和对应的保护策略，本申请对此不作限定。
数据类型 保护策略
A(行进控制指令) 7
B(传感器数据) 6
C(通信数据) 6
D(辅助控制数据) 6
E(媒体数据) 1
… …
表5
其中，数据类型A表示控制车辆行进的指令，如车辆的转向系统内的多个ECU之间传输的数据、油门中的ECU、制动单元中的ECU或者引擎ECU或者传动装置中的ECU等传输的控制车辆转向、加速或减速等操作的指令或数据，对应的保护策略对应保护策略7，同时包括防重放攻击保护、完整性保护和机密性保护。数据类型B可以包括车辆内的传感器，如IMU、雷达或者激光测距仪等采集到的数据等，对应保护策略6，包括了完整性保护和机密性保护。数据类型C表示车辆与其他设备进行通信的数据，如车辆通过车载蓝牙与用户的手机建立连接或者与用户的蓝牙耳机建立连接等，对应保护策略6，即完整性保护和机密性保护。数据类型D表示对车辆内的设备进行控制的数据，如调节车辆的后视镜、雨刮或者座椅等的控制数据。数据类型E包括了车辆内传输的视频或者音频数据等，如车辆内的FM电台的数据，显示屏中播放的视频等，对应保护策略1，即不保护。因此，通常针对控制车辆行进等于车辆的行车相关的数据的保护程度较高，对应的保护策略包括的计算量也就越大，而对于影音娱乐对应的媒体数据，如音频或者视频等数据，数据量大，占用的带宽大，若进行保护则将耗费更多的计算资源，因此，通过不保护的方式降低针对媒体数据的计算量，从而提高车辆对其他数据的计算效率。
因此，若待发送数据中包括了数据类型，则可以根据该待发送数据包括的数据类型来选择匹配的保护策略。
在本方式一中，可以根据数据的类型或者产生数据的ECU来选择匹配的保护策略，使重要程度高的数据可以选择保护程度高的保护策略，而重要程度低的数据则可以选择保护程度低的数据，从而使重要程度高的数据可以有足够的计算量来保护，提高数据的安全性，可以减少重要程度低的数据所占用的计算量，从而均衡分配车辆内的ECU的计算量，提高车辆内的计算效率，进而提高车辆的行车安全性。
方式二、通过安全等级来选择匹配的保护策略
在本方式二中，可以通过前述步骤502中确定的待发送数据的安全等级，然后从多种保护策略中选择与该安全等级匹配的保护策略。通常，待发送数据的安全等级越高，选择的保护策略的保护程度也就越高，而针对发送数据进行计算的计算量通常也就越大。
示例性地，可以提前设定安全等级与保护策略之间的映射关系，在确定待发送数据的安全等级之后，即可根据该映射关系，从多种保护策略中选择与待发送数据的安全等级匹配的保护策略。
例如，安全等级与保护策略之间的映射关系可以如表6所示，当然，此处仅仅是示例性说明，安全等级与保护策略之间的映射关系的具体内容可以根据实际应用场景机芯调整，此处并不作为限定。
安全等级 保护策略
5 7
4 6
3 1
… …
表6
其中，安全等级可以参阅前述步骤501的介绍，该保护策略可以参阅前述表3的相关描述，此处不再赘述。
在本方式中，可以选择与待发送数据的安全等级匹配的保护策略，以进行后续的封装。因此，安全等级高的数据，可以对应保护程度高的保护策略，以提高数据传输的安全性，从而提高车辆行车的安全性。而对于安全等级低的数据，则可以选择保护程度低的保护策略，从而降低对该数据进行保护的计算量，有效提高了车辆内的ECU的计算资源利用率。
503、第一ECU根据待发送数据对应的保护策略对待发送数据进行封装。
其中，在为待发送数据从多种保护策略中选择了匹配的保护策略之后，即可根据选择的保护策略对待发送数据进行封装，得到封装报文。
具体地，若待发送数据对应的保护策略为不保护，则可以直接为该待发送数据添加报头，得到封装报文。
若待发送数据对应的保护策略包括了一种或者多种策略，则可以根据该多种策略对待发送数据进行封装，得到封装报文。
示例性地，以其中几种策略，如防重放攻击保护，完整性保护或机密性保护为例，对待发送数据的封装过程进行示例性说明。
防重放攻击保护：第一ECU和第二ECU传输可以为传输数据设置防重放计数器，可以由第一ECU设置，也可以由第二ECU设置。在第一ECU每向第二ECU发送一帧数据之后，该计数器加1，因此，当第二ECU接收到封装报文时，仅当该封装报文中包括的计数器的值大于第二ECU本地存储的计数器的值时，才继续解析该报文，否则丢弃该报文。并且，在第二ECU解析该封装报文之后，将本地的计数器更新为该封装报文中携带的计数器的值。因此，在防重放攻击保护中，可以通过计数器的方式，防止其他设备对第一设备和第二设备进行重放攻击，避免数据被窃取。
完整性保护：第一ECU可以通过预先设定的算法，如消息摘要算法(message digest，MD)、安全散列算法(secure Hash algorithm，SHA)、消息认证码算法(message authentication code，MAC)算法、哈希运算消息认证码(Hash-based Message Authentication Code，HMAC)、分组密码(Counter with CBC-MAC，CCM)算法、CMAC(cipher-based message authentication code)算法或者AES-GMAC(Galois message  authentication code mode,伽罗瓦消息验证码)-128算法等完整性校验算法，将待发送数据作为输入，输出针对待发送数据的完整性校验码，并携带在封装报文中。以使第二设备在接收到封装报文时，可以根据该完整性校验码，验证封装报文中的净荷是否完整。
机密性保护：即通过预设的加密算法对待发送数据进行加密，得到对应的密文，该密文即封装报文所包括的净荷。例如，可以预先设定共享密钥(pre-shared key，PSK)，在每次传输数据时，生成派生密钥，然后通过该派生密钥以及加密算法，如对称算法(data encryption standard，DES)、国际数据加密算法(international data encryption algorithm，IDEA)、分组密码(counter with CBC-MAC，CCM)算法、高级加密标准(advanced encryption standard，AES)算法、或者AES-GMAC-128算法等，输出待发送数据对应的密文，然后将该密文添加至封装报文内。在第二ECU接收到该封装报文之后，即可对通过对应的解密算法，对封装报文中的密文进行解密，得到该密文对应的明文，即前述的待发送数据。
因此，在本申请实施方式中，针对不同的数据，可以选择与之匹配的保护策略，从而平衡车辆内针对ECU之间传输的数据的计算量，使重要程度高的数据可以更高程度的被保护，并减少针对重要程度低的数据进行保护的计算量，从而使车辆内的ECU的计算资源可以得到更有效的利用。
示例性地，封装报文的报文可是可以参阅图6。其中，该封装报文中可以包括：以太首部、IP首部、传输控制协议(transmission control protocol,TCP)/用户数据报协议(user datagram protocol，UDP)首部、SOME/IP首部、起始帧、数据安全类型(以下表示为SecTag)、帧类型、封装帧/事件块个数(optional)、防重放计数器、世界统一时间(coordinated universal Time，UTC)、净荷(payload)和用于完整性校验的校验码(MIC)。
通常，以太首部、IP首部、TCP/UDP首部、SOME/IP首部等即报头，可以包括对应的协议的源地址、目的地址、端口号等信息。
起始帧通常为固定值。
SecTag即本申请前述的保护策略的类型，例如，保护策略可以分为多种：0:不校验，不加密，不防重放；1：校验，不加密，防重放；2：校验，加密，防重放。
防重放计数器PN在每发送一帧以太报文之后加1，用于防重放攻击。
封装帧/事件块个数(optional)表示报文内封装的数据帧的个数。
Payload中即包括了需要发送至第二ECU的数据。
MIC为用于完整性校验的校验码。
对待发送数据进行封装的过程可以包括：在设置了以太首部、IP首部、TCP/UDP首部、SOME/IP首部之后，设置SecTag，即与待发送数据匹配的保护策略的标识。
若SecTag＝1或2，则设置PN的值，在第一ECU本地的PN的值的基础上加1。
若SecTag＝1或2，使用CMAC(cipher-based message authentication code)算法、分组密码(Counter with CBC-MAC，CCM)算法、哈希运算消息认证码(Hash-based Message Authentication Code，HMAC)或者AES-GMAC(Galois message authentication code mode,伽罗瓦消息验证码)-128算法生成待发送数据的完整性校验码，即MIC。
若SecTag＝2，则可以通过分组密码(Counter with CBC-MAC，CCM)算法、高级加密标准(advanced encryption standard，AES)算法、或者AES-GMAC-128算法将待发送数据的全部或者部分数据转换为密文，并填充于Payload内。
通常，AES-GCM-128算法可以同时输出完整性校验码和密文，AES-GCM-128算法可以表示为：(C,T)＝AES-GCM-128(K,IV,A,P)。
其中：
K为预置的密钥或者派生密钥，派生密钥为对设置的密钥进行派生得到。
IV为32-bit防重放计数器。
A：如果不加密，则A为净荷，若加密，则A为从SOME/IP首部中的第一bit至UTC(coordinated universal time)之间的数据。
P：如果不加密，则P为空，若加密，则数据可以从SOME/IP首部中取UTC至完整性校验码(MIC)之间的数据，即净荷段。
C为密文，即封装报文中的净荷部分。
T为128位的消息验证码(message authentication code,MAC)，前述的MIC取128位MAC中的任意32位，如高32位或者低32位等。
此外，若车辆的硬件设备支持AES算法，则在使用AES-GCM-128算法进行加密或者添加完整性校验码时，可以调用硬件进行加速，提高计算效率。
并且，AES算法的计算速度快，及时计算能力弱的ECU也可以无时延地处理报文，提高车辆内的报文的计算速度，提高车辆内的数据传输效率，使车辆内的数据可以得到快速传输，进而提高车辆的行车安全性。
504、第一ECU向第二ECU发送封装报文。
在第一ECU对待发送数据按照匹配的保护策略进行封装，得到封装之后，第一ECU即可通过有线网想第二ECU发送该封装报文。
505、第二ECU获取封装报文对应的保护策略。
其中，在第二ECU接收到封装报文之后，确定该封装报文的保护策略，根据该保护策略来确定如何对该封装报文进行解析。
具体地，该封装报文中可以携带保护策略的标识，如前述图6中的数据安全类型。因此，第二ECU可以直接从该封装报文的APP首部读取到保护策略的标识，并根据该标识确定对应的保护策略。
示例性地，该保护策略可以包括但不限于以下一项或者多项策略：无保护，防重放攻击保护，完整性保护或机密性保护等。每项策略的具体内容可以参阅前述步骤502中的相关描述，此处不再赘述。
在一种可能的实施方式中，封装报文中可以携带产生该封装报文所包括的数据ECU的标识或者该封装报文所包括的数据的类型的标识，第二设备可以根据产生该封装报文所包括的数据ECU的标识或者该封装报文所包括的数据的类型的标识来确定对应的保护策略。具体的确定方式与前述步骤502中的相关描述类似，此处不再赘述。
506、第二ECU根据保护策略对封装报文进行解析，得到解析结果。
其中，若封装报文对应的保护策略为不保护，则第二ECU可以直接读取封装报文的净荷，得到解析结果。
若封装报文对应的保护策略中包括了防重放攻击保护，则封装报文的报头中包括防重放计数器的值，第二ECU可以读取该防重放计数器的值，与本地的防重放计数器的值进行对比，若封装报文中的防重放计数器的值不大于本地防重放计数器的值，则丢该封装报文，否则继续对该封装报文进行解析。
若封装报文对应的保护策略中包括完整性保护，则封装报文中包括了完整性校验码，第二ECU可以根据该完整性校验码对封装报文的净荷进行校验，若校验通过，且未进行加密，在可以直接读取该封装报文中的净荷，得到解析结果；若校验通过，且进行了加密，则可以继续对该封装报文的净荷进行解密。
若封装报文对应的保护策略包括了解密，则可以通过预先设定的算法，对封装报文的净荷进行解密，得到明文，即解析结果。
需要说明的是，对封装报文进行完整性校验和解密可以是同时进行的，也可以是分别进行的，若分别进行，则可以先进行解密，也可以先进行完整性校验，其执行顺序与第一ECU封装时进行加密和计算完整性校验的顺序相关，具体可以根据实际应用场景确定，本申请对此不作限定。
示例性地，继续参阅前述图6，以图6中所示的封装报文的结构进行示例性说明。
当SecTag＝0，则不对封装报文进行校验，也不进行解密。此外，当SecTag＝0时，封装报文中所携带的防重放计数器、MIC等与保护策略相关的bit位可以复用为其他数据，从而提高资源的利用率。
若SecTag＝1或2，则读取PN的值，若小于本地PN的值，则丢弃该报文，若不小于本地PN的值，则继续下一步解析。
若SecTag＝1，则利用封装报文中携带的完整性校验码对净荷进行校验，若校验通过，则读取该净荷，得到解析结果。
若SecTag＝2，出了对净荷进行完整性校验，还对净荷进行解密，得到明文，即解析结果。
例如，以AES-GCM-128算法为例，可以使用AES-GCM-128算法仅进行完整性校验，也可以使用AES-GCM-128算法同时进行完整性校验和解密。AES-GCM-128算法可以表示为：
P or Fail＝AES-GCM-128(K,IV,C,A,T)。
K为预置的密钥或者派生密钥，派生密钥为对设置的密钥进行派生得到。
IV为32-bit防重放计数器。
A：如果不加密，则A为净荷，若加密，则A为从SOME/IP首部中的第一bit至UTC(coordinated universal time)之间的数据。
T为128位的消息验证码(message authentication code,MAC)，MIC取128位MAC中的任意32位，如高32位或者低32位等。
当校验和解密成功时，即可输出明文P，当校验和解析失败时，即返回Fail，表示解析失败或者校验未通过。
因此，在本申请实施方式中，第一ECU可以从多种保护策略中选择与待发送数据匹配的保护策略，可以根据保护策略的重要程度来选择合适的保护策略。该多种保护策略中可以包括计算量不同的保护策略，当待发送数据的重要程度越高时，所选择的保护策略的计算量通常也就越高，当待发送数据的重要程度越低时，所选择的保护策略的计算量通常也就越低，使重要程度高的数据可以更高程度的被保护，并减少针对重要程度低的数据进行保护的计算量，从而使车辆内的ECU的计算资源可以得到更有效的利用。相应地，第二ECU针对重要程度越高的封装报文，解析所耗费的计算量也就越高，而针对重要程度越低的封装报文，解析所耗费的计算量也就越低，从而可以均衡车辆内的ECU的计算资源，提高计算资源的有效利用率，使重要的报文可以安全、稳定以及高效地传输。
前述对本申请提供的数据传输的方法的流程进行了详细介绍，下面基于前述的方法，对本申请提供的装置进行详细介绍。
首先，参阅图7，本申请提供一种ECU的结构示意图，该ECU用于执行前述由第一ECU执行的步骤，以下将图7所示的本申请提供的一种ECU称为第一ECU。该第一ECU应用于车辆，车辆中包括多个电子控制单元ECU，第一ECU和第二ECU为多个ECU中的任意两个ECU，多个ECU之间通过以太网连接，第一ECU包括：
获取模块701，用于获取待发送数据；
确定模块702，用于从多种保护策略中确定与待发送数据对应的保护策略，多种保护策略包括针对待发送数据的多种不同的封装方式，多种保护策略中包括针对待发送数据的计算量不同的至少两种保护策略；
封装模块703，用于根据待发送数据对应的保护策略对待发送数据进行封装，得到封装报文；
收发模块704，用于向第二ECU发送封装报文。
在一种可能的实施方式中，确定模块702，具体用于根据待发送数据中包括的标识，从多种保护策略中确定与待发送数据对应的保护策略，待发送数据中包括的标识包括产生待发送数据的ECU的标识或者待发送数据的数据类型的标识。
在一种可能的实施方式中，若待发送数据中包括的标识包括产生待发送数据的ECU的标识，确定模块702，具体用于：根据标识以及映射关系确定待发送数据的安全等级，映射关系包括了车辆内的ECU的标识和安全等级之间的关系，车辆内的每个ECU对应的安全等级是根据车辆内的ECU类型确定；根据安全等级从多种保护策略中确定与待发送数据对应的保护策略。
在一种可能的实施方式中，封装报文中包括待发送数据对应的保护策略的标识，保护策略的标识用于第二ECU确定对封装报文的解析方式。
在一种可能的实施方式中，至少两种保护策略中的每种保护策略包括以下一项或者多项策略：无保护，防重放攻击保护，完整性保护或机密性保护，无保护表示对待发送数据不进行保护，防重放攻击保护表示对待发送数据进行针对重放攻击的保护，完整性保护表示在针对待发送数据生成完整性校验码，完整性校验码用于第二ECU校验封装报文是否完整，机密性保护表示对待发送数据进行加密处理。
在一种可能的实施方式中，若待发送数据对应的保护策略包括防重放攻击保护，则封装报文中携带防重放计数器，防重放计数器的值在第一ECU每向第二ECU发送一帧报文之后改变，以使第二ECU在防重放计数器的值不在预设范围内时丢弃封装报文；
若待发送数据对应的保护策略包括完整性保护，则封装报文中包括完整性校验码，完整性校验码用于第二ECU校验对封装报文解析得到的数据是否完整；
若待发送数据对应的保护策略包括机密性保护，则封装报文中的净荷包括密文，密文为使用预设的加密算法对待发送数据进行加密得到。
在一种可能的实施方式中，封装报文为SOME/IP报文。
参阅图8，本申请提供的另一种ECU的结构示意图，该ECU可以用于执行前述方法中由第二ECU执行的步骤，以下将图8所示的本申请提供的另一种ECU称为第二ECU。该第二ECU应用于车辆中，该车辆内包括了多个ECU，第一ECU和第二ECU是该多个ECU中的任意两个。该第二ECU可以包括：
收发模块801，用于接收第一ECU发送的封装报文；
获取模块802，用于获取封装报文对应的保护策略，封装报文对应的保护策略包括第一ECU得到封装报文的封装方式；
解析模块803，用于根据保护策略对封装报文进行解析，得到解析结果。
在一种可能的实施方式中，封装报文对应的保护策略包括以下一项或者多项策略：无保护，防重放攻击保护，完整性保护或机密性保护，无保护表示对待发送数据不进行保护，防重放攻击保护表示对待发送数据进行针对防重放攻击的保护，完整性保护表示在封装报文中添加完整性校验码，完整性校验码用于在对封装报文进行解析时，校验解析得到的数据是否完整，机密性保护表示对待发送数据进行加密处理。
在一种可能的实施方式中，若封装报文对应的保护策略中包括防重放攻击保护，则封装报文的报头中包括防重放计数器的值；解析模块803，还用于若封装包括中包括的防重放计数器的值不在预设范围内，则丢弃封装报文。
在一种可能的实施方式中，若封装报文对应的保护策略包括完整性保护，则封装报文中包括完整性校验码；解析模块803，还用于结合完整性校验码确定解析结果是否完整；若解析结果不完整，则丢弃解析结果。
在一种可能的实施方式中，若待发送数据对应的保护策略包括机密性保护，解析模块803，具体用于结合预设的解密算法，对封装报文所包括的净荷进行解密，得到解析结果。
在一种可能的实施方式中，封装报文中包括待封装报文对应的保护策略的标识，以使获取模块可以根据该标识识别出封装报文对应的保护策略。
请参阅图9，本申请提供的另一种ECU的结构示意图，如下所述。
该ECU可以包括处理器901、收发器903和存储器902。该处理器901、收发器903和存储器902通过线路互联。其中，存储器902中存储有程序指令和数据。
存储器902中存储了前述图5中的步骤对应的程序指令以及数据。
处理器901用于执行前述图5中任一实施例所示的第一ECU或者第二ECU执行的方法步骤。
该ECU还可以包括收发器903，用于接收或者发送数据。
本申请实施例中还提供一种计算机可读存储介质，该计算机可读存储介质中存储有用于生成车辆行驶速度的程序，当其在计算机上行驶时，使得计算机执行如前述图5所示实施例描述的方法中第一ECU或者第二ECU执行的步骤。
可选地，前述的图9中所示的ECU为芯片。
本申请实施例还提供一种数据传输系统，该数据传输系统中包括至少一个ECU，该至少一个ECU可以用于执行前述图5中任意实施例中第一ECU或者第二ECU执行的方法步骤。
本申请实施例还提供一种车辆，该车辆中包括至少一个ECU，该至少一个ECU可以用于执行前述图5中任意实施例中第一ECU或者第二ECU执行的方法步骤。
本申请实施例还提供了一种ECU，该ECU也可以称为数字处理芯片或者芯片，芯片包括处理单元和通信接口，处理单元通过通信接口获取程序指令，程序指令被处理单元执行，处理单元用于执行前述图5中任一实施例所示的第一ECU或者第二ECU执行的方法步骤。
本申请实施例还提供了一种ECU，该ECU也可以称为数字处理芯片或者芯片，芯片包括处理单元和通信接口，处理单元通过通信接口获取程序指令，程序指令被处理单元执行，处理单元用于执行前述图5中任一实施例所示的第一ECU或者第二ECU执行的方法步骤。
本申请实施例还提供一种数字处理芯片。该数字处理芯片中集成了用于实现上述处理器901，或者处理器901的功能的电路和一个或者多个接口。当该数字处理芯片中集成了存储器时，该数字处理芯片可以完成前述实施例中的任一个或多个实施例的方法步骤。当该数字处理芯片中未集成存储器时，可以通过通信接口与外置的存储器连接。该数字处理芯片根据外置的存储器中存储的程序代码来实现上述实施例中第一ECU或者第二ECU执行的动作。
本申请实施例还提供一种数字处理芯片。该数字处理芯片中集成了用于实现上述处理器901，或者处理器901的功能的电路和一个或者多个接口。当该数字处理芯片中集成了存储器时，该数字处理芯片可以完成前述实施例中的任一个或多个实施例的方法步骤。当该数字处理芯片中未集成存储器时，可以通过通信接口与外置的存储器连接。该数字处理芯片根据外置的存储器中存储的程序代码来实现上述实施例中第一ECU或者第二ECU执行的动作。
本申请实施例中还提供一种包括计算机程序产品，当其在计算机上行驶时，使得计算机执行如前述图5所示实施例描述的方法中第一ECU或者第二ECU所执行的步骤。
本申请实施例提供的ECU可以为芯片，芯片包括：处理单元和通信单元，所述处理单元例如可以是处理器，所述通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指令，以使服务器内的芯片执行上述图5所示实施例描述的数据传输方法。可选地，所述存储单元为所述芯片内的存储单元，如寄存器、缓存等，所述存储单元还可以是所述无线接入设备端内的位于所述芯片外部的存储单元，如只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)等。
具体地，前述的处理单元或者处理器可以是中央处理器(central processing unit， CPU)、网络处理器(neural-network processing unit，NPU)、图形处理器(graphics processing unit，GPU)、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit,ASIC)或现场可编程逻辑门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者也可以是任何常规的处理器等。
另外需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本申请提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本申请而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘、U盘、移动硬盘、只读存储器(read only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。 应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。

Claims (22)

  1. 一种数据传输方法，其特征在于，第一ECU和第二ECU为同一车辆内的多个ECU中的任意两个ECU，所述方法包括：
    所述第一ECU获取待发送数据；
    所述第一ECU从多种保护策略中确定与所述待发送数据对应的保护策略，所述多种保护策略包括针对所述待发送数据的多种不同的封装方式，所述多种保护策略中包括对所述待发送数据进行处理的计算量不同的至少两种保护策略；
    所述第一ECU根据所述待发送数据对应的保护策略对所述待发送数据进行封装，得到封装报文；
    所述第一ECU向所述第二ECU发送所述封装报文。
  2. 根据权利要求1所述的方法，其特征在于，所述第一ECU从多种保护策略中确定与所述待发送数据对应的保护策略，包括：
    所述第一ECU根据所述待发送数据中包括的标识，从多种保护策略中确定与所述待发送数据对应的保护策略，所述待发送数据中包括的标识包括产生所述待发送数据的ECU的标识或者所述待发送数据的数据类型的标识。
  3. 根据权利要求2所述的方法，其特征在于，若所述待发送数据中包括的标识包括产生所述待发送数据的ECU的标识，所述第一ECU根据所述待发送数据中包括的标识，从多种保护策略中确定与所述待发送数据对应的保护策略，包括：
    所述第一ECU根据所述标识以及映射关系确定所述待发送数据的安全等级，所述映射关系包括了所述车辆内的ECU的标识和安全等级之间的关系，所述车辆内的每个ECU对应的安全等级是根据所述车辆内的ECU类型确定；
    所述第一ECU根据所述安全等级从所述多种保护策略中确定与所述待发送数据对应的保护策略。
  4. 根据权利要求1-3中任一项所述的方法，其特征在于，所述封装报文中包括所述待发送数据对应的保护策略的标识，所述待发送数据对应的保护策略的标识用于所述第二ECU识别出待发送数据对应的保护策略。
  5. 根据权利要求1-4中任一项所述的方法，其特征在于，所述至少两种保护策略中的每种保护策略包括以下一项或者多项策略：
    无保护，防重放攻击保护，完整性保护或机密性保护，所述无保护表示对所述待发送数据不进行保护，所述防重放攻击保护表示对所述待发送数据进行针对重放攻击的保护，所述完整性保护表示在针对所述待发送数据生成完整性校验码，所述完整性校验码用于所述第二ECU校验所述封装报文是否完整，所述机密性保护表示对所述待发送数据进行加密处理。
  6. 根据权利要求1-5中任一项所述的方法，其特征在于，所述封装报文为SOME/IP报文。
  7. 一种数据传输方法，其特征在于，第一ECU和第二ECU为同一车辆中的多个ECU中 的任意两个ECU，所述方法包括：
    所述第二ECU接收所述第一ECU发送的封装报文；
    所述第二ECU获取所述封装报文对应的保护策略，所述封装报文对应的保护策略包括所述第一ECU得到所述封装报文的封装方式；
    所述第二ECU根据所述保护策略对所述封装报文进行解析，得到解析结果。
  8. 根据权利要求7所述的方法，其特征在于，所述封装报文对应的保护策略包括以下一项或者多项策略：无保护，防重放攻击保护，完整性保护或机密性保护，所述无保护表示对所述待发送数据不进行保护，所述防重放攻击保护表示对所述待发送数据进行针对防重放攻击的保护，所述完整性保护表示在所述封装报文中添加完整性校验码，所述完整性校验码用于在对所述封装报文进行解析时，校验解析得到的数据是否完整，所述机密性保护表示对所述待发送数据进行加密处理。
  9. 根据权利要求7或8所述的方法，其特征在于，所述封装报文中包括所述封装报文对应的保护策略的标识，所述封装报文对应的保护策略的标识用于所述第二ECU识别出所述封装报文对应的保护策略。
  10. 一种第一ECU，其特征在于，应用于车辆，所述车辆中包括多个电子控制单元ECU，所述第一ECU和第二ECU为所述多个ECU中的任意两个ECU，所述多个ECU之间通过以太网连接，所述第一ECU包括：
    获取模块，用于获取待发送数据；
    确定模块，用于从多种保护策略中确定与所述待发送数据对应的保护策略，所述多种保护策略包括针对所述待发送数据的多种不同的封装方式，所述多种保护策略中包括对所述待发送数据进行处理的计算量不同的至少两种保护策略；
    封装模块，用于根据所述待发送数据对应的保护策略对所述待发送数据进行封装，得到封装报文；
    收发模块，用于向所述第二ECU发送所述封装报文。
  11. 根据权利要求10所述的第一ECU，其特征在于，
    所述确定模块，具体用于根据所述待发送数据中包括的标识，从多种保护策略中确定与所述待发送数据对应的保护策略，所述待发送数据中包括的标识包括产生所述待发送数据的ECU的标识或者所述待发送数据的数据类型的标识。
  12. 根据权利要求11所述的第一ECU，其特征在于，若所述待发送数据中包括的标识包括产生所述待发送数据的ECU的标识，所述确定模块，具体用于：
    根据所述标识以及映射关系确定所述待发送数据的安全等级，所述映射关系包括了所述车辆内的ECU的标识和安全等级之间的关系，所述车辆内的每个ECU对应的安全等级是根据所述车辆内的ECU类型确定；
    根据所述安全等级从所述多种保护策略中确定与所述待发送数据对应的保护策略。
  13. 根据权利要求10-12中任一项所述的第一ECU，其特征在于，所述封装报文中包括所述待发送数据对应的保护策略的标识，所述保护策略的标识用于所述第二ECU确定对 所述封装报文的解析方式。
  14. 根据权利要求10-13中任一项所述的第一ECU，其特征在于，所述至少两种保护策略中的每种保护策略包括以下一项或者多项策略：
    无保护，防重放攻击保护，完整性保护或机密性保护，所述无保护表示对所述待发送数据不进行保护，所述防重放攻击保护表示对所述待发送数据进行针对重放攻击的保护，所述完整性保护表示在针对所述待发送数据生成完整性校验码，所述完整性校验码用于所述第二ECU校验所述封装报文是否完整，所述机密性保护表示对所述待发送数据进行加密处理。
  15. 根据权利要求10-14中任一项所述的第一ECU，其特征在于，所述封装报文为SOME/IP报文。
  16. 一种第二ECU，其特征在于，应用于车辆，所述车辆中包括多个电子控制单元ECU，第一ECU和第二ECU为所述多个ECU中的任意两个ECU，所述多个ECU之间通过以太网连接，所述第二ECU包括：
    收发模块，用于接收所述第一ECU发送的封装报文；
    获取模块，用于获取所述封装报文对应的保护策略，所述封装报文对应的保护策略包括所述第一ECU得到所述封装报文的封装方式；
    解析模块，用于根据所述保护策略对所述封装报文进行解析，得到解析结果。
  17. 根据权利要求16所述的第二ECU，其特征在于，所述封装报文对应的保护策略包括以下一项或者多项策略：
    无保护，防重放攻击保护，完整性保护或机密性保护，所述无保护表示对所述待发送数据不进行保护，所述防重放攻击保护表示对所述待发送数据进行针对防重放攻击的保护，所述完整性保护表示在所述封装报文中添加完整性校验码，所述完整性校验码用于在对所述封装报文进行解析时，校验解析得到的数据是否完整，所述机密性保护表示对所述待发送数据进行加密处理。
  18. 根据权利要求16或17所述的第二ECU，其特征在于，所述封装报文中包括所述待发送数据对应的保护策略的标识。
  19. 一种ECU，其特征在于，包括处理器，所述处理器和存储器耦合，所述存储器存储有程序，当所述存储器存储的程序指令被所述处理器执行时实现权利要求1-6或者7-9中任一项所述的方法。
  20. 一种计算机可读存储介质，包括程序，当其被处理单元所执行时，执行如权利要求1-6或者7-9中任一项所述的方法。
  21. 一种车辆，其特征在于，所述车辆包括至少一个ECU，所述至少一个ECU；
    所述至少一个ECU用于执行如权利要求1-6或者7-9中任一项所述的方法。
  22. 一种数据传输系统，其特征在于，所述数据传输系统包括至少一个ECU，所述至少一个ECU用于执行如权利要求1-6或者7-9中任一项所述的方法。
PCT/CN2020/112114 2020-08-28 2020-08-28 一种数据传输方法以及装置 WO2022041122A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
CN202080004586.2A CN112602303A (zh) 2020-08-28 2020-08-28 一种数据传输方法以及装置
EP20950792.0A EP4099591A4 (en) 2020-08-28 2020-08-28 DATA TRANSMISSION METHOD AND APPARATUS
PCT/CN2020/112114 WO2022041122A1 (zh) 2020-08-28 2020-08-28 一种数据传输方法以及装置
US17/973,767 US20230067338A1 (en) 2020-08-28 2022-10-26 Data Transmission Method and Apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/112114 WO2022041122A1 (zh) 2020-08-28 2020-08-28 一种数据传输方法以及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/973,767 Continuation US20230067338A1 (en) 2020-08-28 2022-10-26 Data Transmission Method and Apparatus

Publications (1)

Publication Number Publication Date
WO2022041122A1 true WO2022041122A1 (zh) 2022-03-03

Family

ID=75208101

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/112114 WO2022041122A1 (zh) 2020-08-28 2020-08-28 一种数据传输方法以及装置

Country Status (4)

Country Link
US (1) US20230067338A1 (zh)
EP (1) EP4099591A4 (zh)
CN (1) CN112602303A (zh)
WO (1) WO2022041122A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115001873A (zh) * 2022-08-04 2022-09-02 国汽智控(北京)科技有限公司 车辆数据保护方法、装置及存储介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022049497A1 (en) * 2020-09-03 2022-03-10 Marvell Asia Pte Ltd Safety extension for precision time protocol (ptp)
JP2022171100A (ja) * 2021-04-30 2022-11-11 株式会社オートネットワーク技術研究所 車載通信システム、中継装置および中継方法
CN113359680B (zh) * 2021-06-28 2023-05-23 潍柴动力股份有限公司 一种数据采集方法及车载终端
CN114374556A (zh) * 2022-01-07 2022-04-19 苏州挚途科技有限公司 车辆的通信网络安全管理方法、装置及电子设备
US11956188B1 (en) * 2022-12-13 2024-04-09 Infineon Technologies Ag Security aware routing in an in-vehicle communication network
CN116781450B (zh) * 2023-08-23 2023-10-27 长沙普洛电气设备有限公司 基于can总线的通信方法及相关装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106549940A (zh) * 2016-10-13 2017-03-29 北京奇虎科技有限公司 车辆数据传输方法及系统
US20180131522A1 (en) * 2016-11-07 2018-05-10 Ford Global Technologies, Llc Controller area network message authentication
WO2018214487A1 (zh) * 2017-05-25 2018-11-29 华为技术有限公司 一种控制器区域网总线安全通信方法、装置及系统
CN108989024A (zh) * 2018-06-29 2018-12-11 百度在线网络技术（北京）有限公司 控制在车辆中电子控制单元间通信的方法、装置、设备、存储介质以及相应车辆
CN109672538A (zh) * 2019-02-13 2019-04-23 北京仁信证科技有限公司 一种轻量级车载总线安全通信方法及安全通信系统

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3491774B1 (en) * 2016-09-23 2024-02-21 Apple Inc. Secure communication of network traffic
CN108965218B (zh) * 2017-05-25 2020-09-29 华为技术有限公司 一种控制器区域网总线安全通信方法、装置及系统
US10009325B1 (en) * 2017-12-07 2018-06-26 Karamba Security End-to-end communication security
US10791125B2 (en) * 2018-01-03 2020-09-29 Ford Global Technologies, Llc End-to-end controller protection and message authentication
EP3547191A1 (en) * 2018-03-30 2019-10-02 AO Kaspersky Lab System and method of generating rules for blocking a computer attack on a vehicle
CN110377002B (zh) * 2019-06-06 2021-07-30 西安电子科技大学 一种自适应的车内can总线安全控制方法及系统
CN110635893B (zh) * 2019-09-21 2020-10-20 吉林大学 一种车载以太网信息安全防护方法
CN110912690A (zh) * 2019-11-01 2020-03-24 中国第一汽车股份有限公司 一种数据加密和解密方法、车辆和存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106549940A (zh) * 2016-10-13 2017-03-29 北京奇虎科技有限公司 车辆数据传输方法及系统
US20180131522A1 (en) * 2016-11-07 2018-05-10 Ford Global Technologies, Llc Controller area network message authentication
WO2018214487A1 (zh) * 2017-05-25 2018-11-29 华为技术有限公司 一种控制器区域网总线安全通信方法、装置及系统
CN108989024A (zh) * 2018-06-29 2018-12-11 百度在线网络技术（北京）有限公司 控制在车辆中电子控制单元间通信的方法、装置、设备、存储介质以及相应车辆
CN109672538A (zh) * 2019-02-13 2019-04-23 北京仁信证科技有限公司 一种轻量级车载总线安全通信方法及安全通信系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4099591A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115001873A (zh) * 2022-08-04 2022-09-02 国汽智控(北京)科技有限公司 车辆数据保护方法、装置及存储介质

Also Published As

Publication number Publication date
US20230067338A1 (en) 2023-03-02
EP4099591A4 (en) 2023-05-10
EP4099591A1 (en) 2022-12-07
CN112602303A (zh) 2021-04-02

Similar Documents

Publication Publication Date Title
WO2022041122A1 (zh) 一种数据传输方法以及装置
JP7178346B2 (ja) 車両監視装置、不正検知サーバ、および、制御方法
WO2022056894A1 (zh) 车辆通信方法和通信装置
CN103563337B (zh) 用于选择式地检验所接收的车对x讯息的数据安全序列的方法和车对x通信系统
US10530816B2 (en) Method for detecting the use of unauthorized security credentials in connected vehicles
US20190378355A1 (en) Remote vehicle electronics configuration
US10185323B2 (en) System and method to reduce vehicle resource depletion risk
CN105050868A (zh) 用于检测和防止对交通工具的攻击的设备
US20180350023A1 (en) System and method to condition vehicle availability on demand
CN112655184B (zh) 一种安全保护方法、装置、智能汽车以及存储介质
US20220407716A1 (en) Authenticated point cloud data
US20230034996A1 (en) Data verification method and apparatus
WO2022268127A1 (zh) 一种ota升级方法、装置及计算机可读存储介质
US20220158843A1 (en) Diagnostic over ip authentication
Elhadeedy et al. Using ethernet or a wireless harness and named data networking in autonomous tractor-trailer communication
WO2022134965A1 (zh) 一种算力资源的配置方法及设备
CN113132074B (zh) 信息传输方法、通信设备与系统、计算机可读存储介质
US11254286B2 (en) System and method to disable automated driving mode based on vehicle operation context
CN112956156B (zh) 一种证书申请方法及装置
CN117707818A (zh) 故障日志存储方法、装置及系统
WO2024032438A1 (zh) 车辆安全访问方法、系统及相关装置
WO2022239319A1 (ja) 通信装置、通信方法、及び、車両
CN114827108B (zh) 车辆升级方法、装置、存储介质、芯片及车辆
US11753028B1 (en) Pedal control system and method for an electric vehicle
Cao et al. Analysis and Design of Direct Yaw-Moment Control for Distributed Drive Electric Vehicles Considering Replay Attacks

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2020950792

Country of ref document: EP

Effective date: 20220830

NENP Non-entry into the national phase

Ref country code: DE