Controller Area Network Bus Based Security Communications Method, Apparatus, and System

A controller area network (CAN) bus based security communications apparatus applied to a CAN bus electronic controller (ECU), comprising:

• a receiver configured to receive a random number from a gateway ECU;
• a processor coupled to the receiver and configured to:
• allocate a key to a first CAN identifier;
• determine a count value of the first CAN identifier according to a quantity of CAN packets transmitted by the CAN bus by using the first CAN identifier;
• generate a first information authentication code based on the key of the first CAN identifier, the count value of the first CAN identifier, data of a first CAN packet, and the random number, wherein the first CAN packet is a packet to be sent by the CAN bus ECU;
• transmit the first CAN packet using the first CAN identifier;
• perform an encryption operation based on a second CAN packet and the key of the first CAN identifier to obtain a first encryption operation result;
• perform an equal-length encryption operation on the first encryption operation result, the first information authentication code, the count value of the first CAN identifier, and the data of the first CAN packet to obtain the first CAN packet on which encrypted authentication is performed, wherein the second CAN packet is a historical CAN packet of the CAN bus ECU;
• and
• transmit the first CAN packet on which encrypted authentication is performed.

A controller area network (CAN) bus based security communications apparatus applied to a second CAN bus electronic control unit (ECU), comprising:

• a receiver configured to receive a first CAN packet on which encrypted authentication is performed and a random number from a gateway ECU;
• and
• a processor coupled to the receiver and configured to:
• decrypt the first CAN packet on which encrypted authentication is performed to obtain a decryption information authentication code, decryption data of the first CAN packet, and a decryption count value of a first CAN identifier;
• generate a second information authentication code based on a key of the first CAN identifier, the random number, the decryption count value of the first CAN identifier, and the decryption data of the first CAN packet;
• determine whether the first decryption information authentication code and the second information authentication code are consistent;
• and
• determine that the first CAN packet on which encrypted authentication is performed is valid when the first decryption information authentication code and the second information authentication code are consistent and the decryption count value of the first CAN identifier is valid.

A method implemented by a controller area network (CAN) bus based security communication system, comprising:

• obtaining, by a CAN bus electronic control unit (ECU) of the CAN bus based security communication system, a random number from a gateway ECU;
• allocating, by a CAN bus ECU, a key to a first CAN identifier;
• determining, by the CAN bus ECU, a count value of the first CAN identifier according to a quantity of CAN packets transmitted by the CAN bus by using the first CAN identifier;
• generating, by the CAN bus ECU, a first information authentication code based on the key of the first CAN identifier, the count value of the first CAN identifier, data of a first CAN packet, and the random number, wherein the first CAN packet is a packet to be sent by the CAN bus ECU;
• transmitting, by a CAN bus ECU, the first CAN packet using the first CAN identifier;
• performing, by the CAN bus ECU, an encryption operation based on a second CAN packet and the key of the first CAN identifier to obtain a first encryption operation result;
• performing an equal-length encryption operation on the first encryption operation result, the first information authentication code, the count value of the first CAN identifier, and the data of the first CAN packet to obtain the first CAN packet on which encrypted authentication is performed;
• and
• transmitting the first CAN packet on which encrypted authentication is performed, wherein the second CAN packet is a historical CAN packet of the first CAN bus ECU.

A method implemented by a controller area network (CAN) bus based security communication system, comprising:

• obtaining, by a CAN bus electronic control unit (ECU) of the CAN bus based security communication system, a first CAN packet on which encrypted authentication is performed;
• decrypting the CAN bus ECU, the first CAN packet on which encrypted authentication is performed to obtain a first decryption information authentication code, decryption data of the first CAN packet, and a decryption count value of a first CAN identifier;
• obtaining, by the CAN bus ECU, a random number from a gateway ECU of the CAN bus based security communication system;
• generating a second information authentication code based on a key of the first CAN identifier, the random number, the decryption count value of the first CAN identifier, and the decryption data of the first CAN packet;
• and
• determining that the first CAN packet on which encrypted authentication is performed is valid when the decryption information authentication code and the second information authentication code are consistent, and the decryption count value of the first CAN identifier is valid.