一种车载网络安全防护机制的研究

发布时间：2018-03-14 10:00

本文选题：车载网络　切入点：汽车ECU　出处：《成都信息工程大学》2017年硕士论文　论文类型：学位论文

【摘要】：本文是在四川省科技厅支撑项目(项目编号:2016GZ0343)的资助下完成的。论文以研究汽车车载网络信息安全为目的,详细分析了汽车存在的信息安全隐患,归纳了已有的攻击方式和对应的防御手段,提出了一套综合三个安全策略的车载网络安全防护机制。本文的主要研究工作如下所示:(1)总结国外和国内对汽车信息安全开展的相关研究。车企、安全企业和高校各自研究着不同的方向,对攻击研究较多,对防御研究较少,且研究零散,缺乏系统的安全防御方案,对汽车信息安全的研究仍处于起步阶段。(2)分析汽车的信息安全威胁。首先分析汽车与外界通信的入口:物理接触、短距离接口、长距离接口,详述了各自存在的安全隐患和已有的攻击方式;之后分析了车载网络内部总线的安全缺陷,重点分析了CAN(Controller Area Network:局域控制总线)总线的广播报文、仲裁等机制会带来的安全隐患;最后分析了汽车ECU(Electronic Control Unit:电控单元)易被篡改植入病毒的缺陷。针对这些威胁,给出了相应防御手段思考。(3)设计密钥管理方案。汽车存在的信息安全威胁,核心问题在于车载网络缺乏信息安全机制,而网络安全的重点在于密钥安全,本文在分析了计算机网络的PKI方案和无线传感网络的密钥矩阵方案后,选择了密钥矩阵算法进行改进后作为车载网络的密钥管理方案。应用该方案,服务器预先给ECU分配密钥生成算法,ECU通信时通过交换各自的序列号就能计算出同样的密钥。(4)设计ECU身份验证、固件完整性检测、加密通信方案。在本方案中,采用线上、本地结合的验证方式,通过比对加密的序列号验证ECU身份,通过比对加密的哈希值验证ECU固件完整性,ECU通信时,为了防重放攻击,在报文中添加随机数和时间戳,应用改进密钥矩阵算法生成密钥,用AES算法加密通信。经过计算分析,本方案被暴力获取密钥的概率为-73′10,当安全参数l(27)90时,密钥生成时间快于NTRU(Number Theory Research Unit)公钥算法,最慢为10ms,加密时间为466ms,解密时间为352ms。(5)提出CAN总线信息熵数学模型。在分析了基于概率统计、基于知识规则、基于人工智能的三大类入侵检测算法后,选中了属于概率统计类的信息熵算法作为本套安全模型的入侵检测算法,因为它能分析加密数据流的规律。在分析CAN总线的报文ID号和周期性后,计算出了CAN总线的信息熵和相对熵数学模型。经过理论分析,该模型能够检测出CAN总线中出现了新ID号报文、报文频率发生改变,并通过仿真实验验证了分析结论。(6)设计基于信息熵的入侵检测方案、响应策略。根据CAN总线的广播特性,采用了基于网络的入侵检测结构,将检测点安置在总线网络上,并且为了定位攻击源,给每个子网都安置检测点。在汽车开动后,入侵检测系统开始周期性地统计CAN总线报文的ID和频率,并计算信息熵和相对熵,与记录比对,检测是否出现异常。根据攻击的危害程度,本文将攻击分为一般、严重、致命危险,并提供了对应的视觉、声音、触觉提醒策略,以及切断外网,让ECU进入安全模式的响应策略。实验结果表明,本文提出的车载网络安全防护机制能有效地保护车载网络通信安全,保障汽车不受外部攻击和内部攻击的干扰,确保ECU的可用性。
[Abstract]:This paper is supporting the project in science and Technology Department of Sichuan province (project number: 2016GZ0343) supported by the thesis. For the purpose of vehicle network information security, a detailed analysis of the information security risks existing in cars, summarizes the existing defense attack means and corresponding, put forward a set of network security protection mechanism for vehicle three a comprehensive security strategy. The main research work of this paper are as follows: (1) summary of foreign and domestic related research of automobile information security development. Car prices, security companies and universities have different research directions, to attack more studies on defense research, and the study is scattered, the lack of security defense scheme research on vehicle information system, security is still in its infancy. (2) analysis of information security threats. Firstly, entrance car communication with the outside world: physical contact, short distance and long distance interface. From the interface, detailing their existing security risks and the attack; after analyzing the security flaws of the internal bus vehicle network, focuses on the analysis of the CAN (Controller Area Network: local bus control) broadcast message bus, arbitration mechanism will bring security risks; finally analyzes the automobile ECU (Electronic Control Unit: electronic control unit) defect is easily tampered with the implantation of the virus. In response to these threats, gives the corresponding thinking means of defense. (3) the design of key management schemes. Potential threats to information security, the core problem is the lack of vehicle network information security mechanism, and the focus of network security is the key to safety, based on the analysis of the key matrix PKI scheme computer network and wireless sensor network, choose the key matrix algorithm was improved as a key management scheme for vehicle network. The application of the scheme, The server previously assigned to the ECU key generation algorithm, calculate the ECU communication by exchanging sequence numbers can the same key. (4) the design of ECU authentication, firmware integrity detection, encryption using online communication scheme. In this scheme, and combined with local authentication methods, by comparing the encrypted serial number verification ECU identity verification, ECU firmware integrity by comparing the hash value encrypted, ECU communication, in order to prevent replay attacks, add a random number and time stamp in the message, using the improved key generation algorithm of encryption key matrix, communication with the AES algorithm. Through calculation and analysis, the probability of this scheme by violence to obtain the key for -73 '10 and when the safety parameters of L (27) 90, key generation time faster than NTRU (Number Theory Research Unit) public key algorithm, the slowest 10ms encryption, decryption time is 466ms, time is 352ms. (5) proposed CAN bus information entropy model. Based on the analysis of probability and statistics, based on knowledge rules, detection algorithm based on artificial intelligence three categories after the invasion, selected the information entropy algorithm belongs to probability and statistics as the intrusion detection algorithm of this set of security model, because it can analysis the encrypted data stream in the law. In the analysis of CAN bus message ID number and cycle after the CAN bus information entropy and relative entropy model. Through theoretical analysis, the model can detect the emergence of new ID CAN bus message, message frequency changes, and the conclusions are verified by simulation experiment. (6) the design of intrusion detection scheme based on information entropy, response strategy radio. According to the characteristics of CAN bus, the network intrusion detection based on the structure, the detection points are arranged at the bus network, and to locate the source of the attack to each detection point. In the resettlement car after the invasion Detection system ID and frequency periodic statistics CAN bus message, and calculate the information entropy and relative entropy, and record comparison, detection is abnormal. According to the degree of harm of attack, the attack will be divided into general, serious, life-threatening, and provides the corresponding sound, visual, tactile and prompting strategy cut the net, let ECU response strategy into safe mode. The experimental results show that the protective mechanism of vehicle network security is proposed in this paper can effectively protect the safety of vehicle network communication, interference and ensure the car from inside and outside, to ensure the availability of ECU.

【学位授予单位】：成都信息工程大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：U463.67;TP393.08

【相似文献】