CN115834121A - Vehicle-mounted communication system and vehicle-mounted communication method - Google Patents

Abstract

The invention relates to a vehicle-mounted communication system, a vehicle-mounted communication method, a computer storage medium, a computer device and a vehicle. An in-vehicle communication system according to an aspect of the present invention includes: an on-board diagnostic unit; and a central gateway communicatively connected with the on-board diagnostics unit and deployed with a firewall policy, wherein the central gateway is configured to receive data from the on-board diagnostics unit and selectively send the received data to a vehicle control unit based on the firewall policy.

Description

In-vehicle communication system and in-vehicle communication method

technical field

The present invention relates to the field of vehicle communication, and more specifically relates to a vehicle communication system, a vehicle communication method, a computer storage medium, computer equipment and a vehicle.

Background technique

Diagnostics are performed on on-board systems in order to monitor the behavior of vehicle components and thereby monitor the functional performance of the entire vehicle. Diagnosis is to be understood as the recognition of a fault and the determination of the cause of the fault based on the detected data.

At present, in the process of diagnosing the on-board system, most of them adopt the UDS unified diagnosis protocol, and send and receive data by connecting the diagnostic equipment to the port of the on-board diagnostic system. However, since the UDS unified diagnostic protocol lacks access control policies for data sent and received via the port of the OBD system, malicious attackers may gain access to key services in the vehicle's internal network through the port of the OBD system, thereby affecting the vehicle. User experience even threatens driving safety.

For example, most of the current vehicle communication systems realize vehicle communication via CAN (Controller Area Network) channel, LIN (Local Interconnect Network, local interconnection network) channel or Ethernet. If an effective access control strategy is implemented for the data sent and received, malicious attackers may gain access to the vehicle control unit through the port of the on-board diagnostic system, thereby threatening the driving safety of vehicle users.

Contents of the invention

In order to solve or at least alleviate one or more of the above problems, the following technical solutions are provided.

According to a first aspect of the present invention, there is provided a vehicular communication system, said system comprising: a vehicular diagnostic unit; and a central gateway communicatively connected to said vehicular diagnostic unit and deployed with a firewall policy, wherein said central gateway configures receiving data from the on-board diagnostic unit and selectively sending the received data to a vehicle control unit based on the firewall policy.

According to the vehicle communication system according to an embodiment of the present invention, wherein the central gateway is further configured to: receive data via one or more of CAN bus, LIN bus and Ethernet channel; and selectively based on the firewall policy The received data is sent to a vehicle control unit.

According to one embodiment of the present invention or the vehicle communication system described in any one of the above embodiments, wherein the central gateway includes: a processor configured to communicate with the vehicle diagnostic unit via a CAN interface; a switch configured to being communicatively connected with the on-board diagnostic unit and the processor via Ethernet; and a router configured to be communicatively connected with the switch via Ethernet and transfer the received data via a CAN bus and/or a LIN bus to sent to the vehicle control unit.

According to one embodiment of the present invention or the vehicle communication system described in any one of the above embodiments, the firewall policy includes: dividing the vehicle communication network into a first broadcast domain and a second broadcast domain based on a virtual local area network; data received by the onboard diagnostic unit to identify the received data as data accessing an external network and data not accessing an external network; and configuring the first broadcast domain for communication of data accessing an external network, and The second broadcast domain is configured for communication of data that does not access external networks.

According to one embodiment of the present invention or the vehicle communication system described in any one of the above embodiments, in the processor of the central gateway, the firewall policy includes: pre-configuring the relationship between the CAN identifier and the routing identifier matching the data received from the OBD via the CAN interface with the preconfigured mapping table; responding to the data received from the OBD via the CAN interface with the preconfigured mapping table matching to send the data to the vehicle control unit via the router via the CAN bus and/or the LIN bus; and in response to the data received from the OBD via the CAN interface from the on-board diagnostic unit not matching the pre-configured mapping match and discard the data.

According to an embodiment of the present invention or the vehicle communication system described in any of the above embodiments, wherein the mapping table between the pre-configured CAN identifier and the routing identifier includes: an initial mapping table, which is configured to establish the a mapping relationship between a CAN identifier and a data block corresponding to the routing identifier; and a forwarding mapping table configured to establish the CAN identifier and the CAN used to transmit the data block corresponding to the routing identifier. Mapping relationship between buses.

According to one embodiment of the present invention or the vehicle communication system described in any one of the above embodiments, the firewall policy further includes: matching the data received from the vehicle diagnostic unit via the CAN interface with the initial mapping table; discarding data received from the OBD via a CAN interface in response to the data not matching the initial mapping table; in response to data received from the OBD unit via a CAN interface matching the initial mapping table further matching the data to the forwarding mapping table; sending the data to the vehicle control unit via the router via a CAN bus and/or a LIN bus in response to the data matching the forwarding mapping table ; and discarding the data in response to the data not matching the forwarding map.

According to one embodiment of the present invention or the vehicle communication system described in any one of the above embodiments, in the switch of the central gateway, the firewall policy includes: pre-configuring a mapping table between IP addresses and ports; identifying a destination IP address and a destination port for data received from the OBD via Ethernet; and performing a mapping table between the identified destination IP address and destination port and the pre-configured IP address and port matching; sending the data over Ethernet to the vehicle control unit in response to the identified target IP address and target port matching a mapping table between the pre-configured IP addresses and ports; and in response to The identified target IP address and target port do not match the pre-configured mapping table between the IP address and port, and the data is discarded.

The vehicular communication system according to an embodiment of the present invention or any one of the above embodiments, wherein a destination IP address and a destination port of data received from the OBD via Ethernet are identified using a 3-state content addressable memory.

According to a second aspect of the present invention, there is provided an on-board communication method, which includes: receiving data from an on-board diagnostic unit; deploying a firewall policy at a central gateway communicatively connected to the on-board diagnostic unit; and based on the A firewall policy selectively sends said received data to a vehicle control unit.

According to the vehicle communication method according to an embodiment of the present invention, the method further includes: receiving data via one or more of CAN bus, LIN bus and Ethernet channel; and selectively sending the data based on the firewall policy The received data is sent to the vehicle control unit.

According to one embodiment of the present invention or the vehicle communication method described in any one of the above embodiments, the central gateway includes: a processor configured to communicate with the vehicle diagnostic unit via a CAN interface; a switch configured to being communicatively connected with the on-board diagnostic unit and the processor via Ethernet; and a router configured to be communicatively connected with the switch via Ethernet and transfer the received data via a CAN bus and/or a LIN bus to sent to the vehicle control unit.

According to one embodiment of the present invention or the vehicle communication method described in any one of the above embodiments, the firewall policy includes: dividing the vehicle communication network into a first broadcast domain and a second broadcast domain based on a virtual local area network; data received by the onboard diagnostic unit to identify the received data as data accessing an external network and data not accessing an external network; and configuring the first broadcast domain for communication of data accessing an external network, and The second broadcast domain is configured for communication of data that does not access external networks.

According to one embodiment of the present invention or the vehicle-mounted communication method described in any one of the above embodiments, in the processor of the central gateway, the firewall policy includes: pre-configuring the relationship between the CAN identifier and the routing identifier matching the data received from the OBD via the CAN interface with the preconfigured mapping table; responding to the data received from the OBD via the CAN interface with the preconfigured mapping table matching to send the data to the vehicle control unit via the router via the CAN bus and/or the LIN bus; and in response to the data received from the OBD via the CAN interface from the on-board diagnostic unit not matching the pre-configured mapping match and discard the data.

According to one embodiment of the present invention or the vehicle communication method described in any one of the above embodiments, wherein the mapping table between the pre-configured CAN identifier and the routing identifier includes: an initial mapping table configured to establish the a mapping relationship between a CAN identifier and a data block corresponding to the routing identifier; and a forwarding mapping table configured to establish the CAN identifier and the CAN used to transmit the data block corresponding to the routing identifier. Mapping relationship between buses.

According to one embodiment of the present invention or the vehicle communication method described in any one of the above embodiments, the firewall policy further includes: matching the data received from the vehicle diagnostic unit via the CAN interface with the initial mapping table; discarding data received from the OBD via a CAN interface in response to the data not matching the initial mapping table; in response to data received from the OBD unit via a CAN interface matching the initial mapping table further matching the data to the forwarding mapping table; sending the data to the vehicle control unit via the router via a CAN bus and/or a LIN bus in response to the data matching the forwarding mapping table ; and discarding the data in response to the data not matching the forwarding map.

According to one embodiment of the present invention or the vehicle-mounted communication method described in any one of the above embodiments, in the switch of the central gateway, the firewall policy includes: pre-configuring a mapping table between IP addresses and ports; identifying a destination IP address and a destination port for data received from the OBD via Ethernet; and performing a mapping table between the identified destination IP address and destination port and the pre-configured IP address and port matching; sending the data over Ethernet to the vehicle control unit in response to the identified target IP address and target port matching a mapping table between the pre-configured IP addresses and ports; and in response to The identified target IP address and target port do not match the pre-configured mapping table between the IP address and port, and the data is discarded.

In the vehicle communication method according to one embodiment of the present invention or any one of the above embodiments, a target IP address and a target port of data received from the OBD via Ethernet are identified by using a 3-state content addressable memory.

According to a third aspect of the present invention, a computer storage medium is provided, the computer storage medium includes instructions, and the instructions execute the steps of the vehicle communication method according to the second aspect of the present invention when running.

According to a fourth aspect of the present invention, there is provided a computer device, including a memory, a processor, and a computer program stored on the memory and run on the processor. When the processor executes the computer program, the second computer program according to the present invention is realized. The steps of the in-vehicle communication method described in the aspect.

According to a fifth aspect of the present invention, there is provided a vehicle comprising the in-vehicle communication system according to the first aspect of the present invention.

The solution for in-vehicle communication according to one or more embodiments of the present invention can be implemented by deploying a firewall policy at the central gateway such that data received from the on-board diagnostic unit passes through the deployed firewall policy before being sent to the vehicle control unit. Detection and interception, so as to effectively block the network attacker's access to key services in the vehicle's internal network through the port of the on-board diagnostic system, and improve the user experience of the vehicle and the safety performance of driving.

Description of drawings

The above and/or other aspects and advantages of the present invention will become clearer and easier to understand through the following descriptions in conjunction with the various aspects of the accompanying drawings, in which the same or similar elements are denoted by the same reference numerals. In said attached drawings:

FIG. 1 shows a schematic diagram of a vehicle communication system according to one or more embodiments of the present invention.

FIG. 2 shows a schematic diagram of a vehicle communication system according to one or more embodiments of the present invention.

Fig. 3 shows a flowchart of a vehicle communication method according to one or more embodiments of the present invention.

Figure 4 shows a block diagram of a computer device in accordance with one or more embodiments of the invention.

Detailed ways

The following description of specific embodiments is merely exemplary in nature, and is not intended to limit the disclosed technology or the application and uses of the disclosed technology. Furthermore, there is no intention to be bound by any expressed or implied theory presented in the preceding technical field, background or the following detailed description.

In the following detailed description of the embodiments, numerous specific details are set forth in order to provide a thorough understanding of the disclosed technology. It will be apparent, however, to one of ordinary skill in the art that the disclosed technology may be practiced without these specific details. In other instances, well known features have not been described in detail to avoid unnecessarily complicating the description.

Words such as "comprising" and "comprising" mean that in addition to the units and steps that are directly and explicitly stated in the specification, the technical solution of the present invention does not exclude other units and steps that are not directly or explicitly stated. situation. Words such as "first" and "second" do not denote the order of elements in terms of time, space, size, etc. but are merely used to distinguish elements.

Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 shows a schematic diagram of a vehicle communication system according to one or more embodiments of the present invention.

As shown in FIG. 1 , the vehicular communication system 100 includes a vehicular diagnostic unit 110 and a central gateway 120 , the central gateway 120 is communicatively connected to the vehicular diagnostic unit 110 and deployed with a firewall policy, wherein the central gateway 120 can be configured to receive information from the vehicular diagnostic unit 110 Data is received and selectively sent to the vehicle control unit 130 based on firewall policies.

Optionally, the central gateway 120 can adopt a main body communication network architecture including CAN communication, LIN communication and Ethernet communication, and it operates as a key interaction node of vehicle communication data, so it is necessary to design at the central gateway 120 for communicating from vehicle to vehicle The data received by the diagnostic unit 110 and the data received via one or more of the CAN bus, the LIN bus and the Ethernet channel are subjected to security detection and interception firewall policies.

According to one or more embodiments of the present invention, the firewall policy deployed at the central gateway 120 can guarantee that the data received from the OBD unit 110 and the data received via one or more of CAN bus, LIN bus and Ethernet channel Before being received by the corresponding vehicle control unit 130 , it is firstly detected and intercepted by the firewall policy, and cannot bypass the firewall policy deployed at the central gateway 120 to directly access the corresponding vehicle control unit 130 . According to one or more embodiments of the present invention, the firewall policy deployed at the central gateway 120 can guarantee that the data received from the OBD unit 110 and the data received via one or more of CAN bus, LIN bus and Ethernet channel Routing is performed according to the whitelist policy that minimizes access rights, and data that does not comply with the routing policy is discarded.

In one embodiment, the firewall policy deployed at the central gateway 120 may include: dividing the vehicle communication network into a first broadcast domain and a second broadcast domain based on virtual local area network technology; detecting data received from the vehicle diagnostic unit 110 to The received data is identified as data accessing the external network and data not accessing the external network; and configuring the divided first broadcast domain for communication of data accessing the external network, and configuring the divided second broadcast domain to use Communication of data that does not access external networks. Thus, the data that will not be accessed by the external network is isolated through the virtual local area network technology, so that the data that accesses the external network cannot directly access the corresponding service in the internal isolation area through the central gateway 120 .

Optionally, the central gateway 120 can be connected with one or more vehicle control units 130 via an external bus, wherein the external bus can be based on one or more of the CAN protocol, the LIN protocol and the Ethernet protocol. Communication between the vehicle control units 130 is established.

In one embodiment, central gateway 120 may be configured to: receive data via one or more of CAN bus, LIN bus, and Ethernet channel; and selectively send the received data to vehicle control unit 130 based on firewall policy .

It should be noted that the firewall policy deployed at the central gateway 120 may not only be applicable to detecting and Interception, other data passing through the central gateway 120 may also be detected and intercepted by firewall policies deployed at the central gateway 120 without departing from the spirit and scope of the present invention.

Exemplarily, the vehicle control unit 130 is a device for controlling the vehicle, or a device for controlling auxiliary equipment mounted on the vehicle. The vehicle control unit 130 may include, but is not limited to, be configured to provide control of engine operating components (eg, idle control components, fuel delivery components, emission control components, etc.) and monitoring of engine operating components (eg, status of engine diagnostic codes) ), configured to manage various power control functions (such as exterior lighting, interior lighting, keyless entry, remote compartment closed state), a radio transceiver module configured to communicate with the key fob or other local vehicle device, a radio transceiver module configured to provide control over heating and cooling system components (e.g., compressor clutch and blower control, temperature sensor information, etc.) control and monitoring of the climate control management module, etc.

FIG. 2 shows a schematic diagram of a vehicle communication system according to one or more embodiments of the present invention.

As shown in FIG. 2 , the vehicular communication system 200 includes a vehicular diagnostic unit 210 and a central gateway 220 , the central gateway 220 is communicatively connected to the vehicular diagnostic unit 210 and is deployed with a firewall policy, wherein the central gateway 220 can be configured to receive information from the vehicular diagnostic unit 210 Data is received and selectively sent to the vehicle control unit 230 based on firewall policies.

Optionally, the central gateway 220 may include: a processor 2201 configured to be communicatively connected to the OBD unit 210 via a CAN interface; a switch 2202 configured to be communicatively connected to the OBD unit 210 and the processor 2201 via Ethernet and a router 2203 configured to communicatively connect with the switch 2202 via Ethernet and to transmit data received from the on-board diagnostic unit 210 to the vehicle control unit 130 via the CAN bus and/or the LIN bus. Exemplarily, the firewall policies deployed at the central gateway 220 may include one or more firewall policies deployed at one or more of the processor 2201, the switch 2202, and the router 2203 to Data and data received via one or more of CAN bus, LIN bus and Ethernet channel are detected and intercepted.

In one embodiment, the firewall policy deployed at the central gateway 220 may include: dividing the vehicle communication network into a first broadcast domain and a second broadcast domain based on virtual local area network technology; detecting data received from the vehicle diagnostic unit 210 to The received data is identified as data accessing the external network and data not accessing the external network; and configuring the divided first broadcast domain for communication of data accessing the external network, and configuring the divided second broadcast domain to use Communication of data that does not access external networks. Therefore, the data that will not be accessed by the external network is isolated through the virtual local area network technology, so that the data that accesses the external network cannot directly access the corresponding service in the internal isolation area through the central gateway 220 .

In one embodiment, as shown in FIG. 2, at the processor 2201 of the central gateway 220, the firewall policy may include: pre-configuring a mapping table between CAN identifiers and routing identifiers; Data received by unit 210 is matched against a pre-configured mapping table; data is sent via router 2203 over the CAN bus and/or LIN bus to the vehicle control unit 230; and discarding data received from the on-board diagnostic unit 210 via the CAN interface in response to the data not matching the pre-configured mapping table. Optionally, the pre-configured mapping table between the CAN identifier and the routing identifier may include: an initial mapping table configured to establish a mapping relationship between the CAN identifier and the data block corresponding to the routing identifier; and forwarding A mapping table configured to establish a mapping relationship between the CAN identifier and the CAN bus for transmitting the data block corresponding to the routing identifier, which defines the forwarding rules of the CAN message between the CAN buses.

In one embodiment, at the processor 2201 of the central gateway 220, the firewall policy may further include: matching the data received from the OBD unit 210 via the CAN interface with the initial mapping table; 210 discarding the data received if it does not match the initial mapping table; further matching the data to the forwarding mapping table in response to the data received from the OBD unit 210 via the CAN interface matching the initial mapping table; responding to the The data matches the forwarding mapping table and sends the data to the vehicle control unit 230 through the CAN bus and/or the LIN bus via the router 2203; and discards the forwarding mapping table in response to the data not matching the forwarding mapping table data. By deploying a firewall policy including an initial mapping table and a forwarding mapping table at the processor 2201 of the central gateway 220 , the efficiency and accuracy of detection and interception of data received from the OBD unit 210 can be improved.

In another embodiment, as shown in FIG. 2, at the switch 2202 of the central gateway 220, the firewall policy may include: pre-configuring a mapping table between an IP address and a port, which represents a mapping table of accessible services; Identify the destination IP address and destination port of data received from the OBD unit 210 via Ethernet; match the identified destination IP address and destination port with a pre-configured mapping table between IP addresses and ports; respond to the sending said data over Ethernet to the vehicle control unit 230 by matching the identified target IP address and target port with a pre-configured mapping table between IP addresses and ports; and responding to the identified target IP address and target port The port does not match the pre-configured mapping table between IP addresses and ports and the data is discarded. For example, the source IP address, destination IP address, and destination port of data received from the OBD unit 210 via Ethernet may be identified using Tri-State Content Addressable Memory (TCAM). By utilizing the TCAM to identify the source IP address, destination IP address, and destination port of data received from the OBD unit 210 via Ethernet, both exact match lookup and fuzzy match lookup can be realized, thereby enabling shortened data recognition time and improved data quality. Identification flexibility.

In one embodiment, in order to further improve the security of the vehicle communication, the communication between the vehicle and the cloud can adopt strategies such as TLS (Transport Layer Security) two-way authentication and CA certificate verification. During the TLS two-way authentication process, the cloud can send the public key to the vehicle, and the vehicle can respond by sending its public key to the cloud.

In one embodiment, in order to further prevent network attackers from launching malicious attacks on key services in the vehicle's internal network through the port of the on-board diagnostic system, AES symmetric encryption technology can be used for on-board diagnosis identity authentication.

The vehicular communication system proposed according to one aspect of the present invention is able to efficiently deploy the firewall policy at the central gateway so that the data received from the vehicular diagnostic unit is detected and intercepted by the deployed firewall policy before being sent to the vehicle control unit. Blocking network attackers' access to key services in the vehicle's internal network through the port of the on-board diagnostic system improves the user experience of the vehicle and the safety performance of driving.

Fig. 3 shows a flowchart of a vehicle communication method according to one or more embodiments of the present invention.

As shown in FIG. 3, the vehicle communication method according to one or more embodiments of the present invention includes the following steps:

Step 310: Receive data from OBD;

Step 320: Deploying a firewall policy on the central gateway, which is communicatively connected to the vehicle diagnostic unit; and

STEP 330 : Selectively sending the received data to the vehicle control unit based on the firewall policy.

Optionally, the central gateway may include: a processor configured to communicatively couple with the OBD via a CAN interface; a switch configured to communicatively couple with the OBD and the processor via Ethernet; and a router configured to is communicatively connected to the switch via Ethernet and transmits data received from the on-board diagnostic unit to the vehicle control unit via the CAN bus and/or the LIN bus. Exemplarily, the firewall policies deployed at the central gateway may include one or more firewall policies deployed at one or more of processors, switches, and routers to Detect and intercept received data from one or more of the , LIN bus, and Ethernet channels

In one embodiment, in step 320, the firewall policy deployed at the central gateway may include: dividing the vehicular communication network into a first broadcast domain and a second broadcast domain based on virtual local area network technology; detecting data received from the vehicular diagnostic unit , to identify the received data as data accessing the external network and data not accessing the external network; and configuring the divided first broadcast domain for communication of data accessing the external network, and the divided second broadcast domain Configured for communication of data that does not access external networks. Therefore, the data that will not be accessed by the external network is isolated through the virtual local area network technology, so that the data that accesses the external network cannot directly access the corresponding services in the internal isolation area through the central gateway.

In one embodiment, in step 320, at the processor of the central gateway, the deployed firewall policy may include: pre-configuring a mapping table between CAN identifiers and routing identifiers; matching the data with the preconfigured mapping table; sending the data via the router to the vehicle control unit via the CAN bus and/or the LIN bus in response to the data received from the OBD unit via the CAN interface matching the preconfigured mapping table; and Data received from the on-board diagnostic unit via the CAN interface is discarded in response to the data not matching a pre-configured mapping table. Optionally, the pre-configured mapping table between the CAN identifier and the routing identifier may include: an initial mapping table configured to establish a mapping relationship between the CAN identifier and the data block corresponding to the routing identifier; and forwarding A mapping table configured to establish a mapping relationship between the CAN identifier and the CAN bus for transmitting the data block corresponding to the routing identifier, which defines the forwarding rules of the CAN message between the CAN buses.

In one embodiment, in step 320, at the processor of the central gateway, the deployed firewall policy may further include: matching the data received from the OBD via the CAN interface with the initial mapping table; discarding data received from the OBD that does not match the initial mapping table; further matching the data to a forwarding map in response to data received from the OBD via the CAN interface matching the initial mapping table; responding sending the data to a vehicle control unit via a CAN bus and/or a LIN bus via a router if the data matches the forwarding map; and discarding the forwarding map in response to the data not matching the forwarding map data. By deploying a firewall policy including an initial mapping table and a forwarding mapping table at a processor of the central gateway, the efficiency and accuracy of detection and interception of data received from an on-board diagnostic unit can be improved.

In another embodiment, in step 320, at the switch of the central gateway, the firewall policy may include: pre-configuring a mapping table between IP addresses and ports, which represents a mapping table of accessible services; Destination IP address and destination port of data received from the OBD; matching the identified destination IP address and destination port with a pre-configured mapping table between IP addresses and ports; responding to the identified destination IP sending said data over Ethernet to the vehicle control unit in response to the identified target IP address and target port matching the pre-configured IP address and port mapping table; The mapping table between address and port does not match and the data is discarded. For example, a tri-state content addressable memory (TCAM) may be utilized to identify the source IP address, destination IP address, and destination port of data received from the OBD via Ethernet. By using TCAM to identify the source IP address, destination IP address and destination port of data received from the OBD via Ethernet, both exact match lookup and fuzzy match lookup can be realized, thereby reducing data recognition time and improving data recognition flexibility.

In one embodiment, in order to further improve the security of the vehicle communication, the communication between the vehicle and the cloud can adopt strategies such as TLS (Transport Layer Security) two-way authentication and CA certificate verification. During the TLS two-way authentication process, the cloud can send the public key to the vehicle, and the vehicle can respond by sending its public key to the cloud.

In one embodiment, in order to further prevent network attackers from launching malicious attacks on key services in the vehicle's internal network through the port of the on-board diagnostic system, AES symmetric encryption technology can be used for on-board diagnosis identity authentication.

The vehicle communication method proposed according to one aspect of the present invention can deploy a firewall policy at the central gateway, so that the data received from the vehicle diagnostic unit can be detected and intercepted by the deployed firewall policy before being sent to the vehicle control unit, thereby effectively Blocking network attackers' access to key services in the vehicle's internal network through the port of the on-board diagnostic system improves the user experience of the vehicle and the safety performance of driving.

Figure 4 is a block diagram of a computer device according to one embodiment of the present invention. As shown in FIG. 4 , the computer device 400 includes a memory 410 , a processor 420 and a computer program 430 stored on the memory 410 and executable on the processor 420 . When the processor 420 executes the computer program 430, various steps of the above-mentioned vehicle communication method are implemented.

In addition, as described above, the present invention can also be implemented as a computer storage medium in which a program for causing a computer to execute the in-vehicle communication method according to an aspect of the present invention is stored.

Here, as the computer storage medium, disks (for example, magnetic disks, optical disks, etc.), cards (for example, memory cards, optical cards, etc.), semiconductor memories (for example, ROM, nonvolatile memory, etc.), Computer storage media in various forms such as tapes (eg, magnetic tapes, cassette tapes, etc.).

Where applicable, various embodiments provided by the present disclosure may be implemented using hardware, software, or a combination of hardware and software. Also, where applicable, various hardware components and/or software components set forth herein may be combined into composite components comprising software, hardware, and/or both without departing from the scope of the present disclosure. Where applicable, the various hardware components and/or software components set forth herein may be divided into sub-components comprising software, hardware, or both without departing from the scope of the present disclosure. Additionally, where applicable, it is contemplated that software components may be implemented as hardware components, and vice versa.

Software according to the present disclosure, such as program code and/or data, may be stored on one or more computer storage media. It is also contemplated that the software identified herein can be implemented using one or more general purpose or special purpose computers and/or computer systems, networked and/or otherwise. Where applicable, the order of individual steps described herein may be changed, combined into compound steps and/or divided into sub-steps to provide features described herein.

The embodiments and examples presented herein are provided in order to best illustrate embodiments of the invention and its particular applications in accordance with, and thereby enable those skilled in the art to make and use the invention. However, those skilled in the art will appreciate that the foregoing description and examples are provided for purposes of illustration and example only. The presented description is not intended to be exhaustive or to limit the invention to the precise forms disclosed.

Claims (10)

1. A vehicle communication system, characterized in that said system comprises: on-board diagnostic unit; and a central gateway communicatively coupled to the OBD and deployed with a firewall policy, wherein the central gateway is configured to receive data from the OBD and selectively transmit the received data based on the firewall policy to the vehicle control unit. 2. The system of claim 1, wherein the central gateway is further configured to: receiving data via one or more of a CAN bus, a LIN bus, and an Ethernet channel; and selectively sending said received data to a vehicle control unit based on said firewall policy, Wherein said central gateway includes: a processor configured to communicatively couple with the on-board diagnostic unit via a CAN interface; a switch configured to communicatively couple with the OBD and the processor via Ethernet; and A router configured to be communicatively connected to said switch via Ethernet and to transmit said received data to a vehicle control unit via a CAN bus and/or a LIN bus. 3. The system of claim 1, wherein the firewall policy comprises: dividing the vehicle communication network into a first broadcast domain and a second broadcast domain based on a virtual local area network; detecting data received from the OBD to identify the received data as data accessing an external network and data not accessing an external network; and configuring the first broadcast domain for communication of data accessing an external network, and configuring the second broadcast domain for communication of data not accessing an external network, Wherein in the processor of the central gateway, the firewall policy includes: Pre-configure the mapping table between CAN identifiers and routing identifiers; matching data received from the OBD via a CAN interface to the pre-configured mapping table; sending data received from the OBD via the CAN interface to the vehicle control unit via the router via a CAN bus and/or a LIN bus in response to the data being received from the OBD matching the preconfigured mapping table; and discarding data received from the OBD via a CAN interface in response to the data not matching the preconfigured mapping table, Wherein the mapping table between the preconfigured CAN identifier and the routing identifier includes: an initial mapping table configured to establish a mapping relationship between the CAN identifier and a data block corresponding to the routing identifier; and a forwarding mapping table configured to establish a mapping relationship between the CAN identifier and a CAN bus for transmitting a data block corresponding to the routing identifier, Wherein the firewall policy further includes: matching data received from the OBD via a CAN interface to the initial mapping table; discarding data received from the OBD via a CAN interface in response to the data not matching the initial mapping table; further matching the data received from the OBD via a CAN interface to the forwarding map in response to the data being received from the OBD matching the initial map; sending the data to the vehicle control unit via the router over a CAN bus and/or a LIN bus in response to the data matching the forwarding map; and discarding the data in response to the data not matching the forwarding map, Wherein in the switch of the central gateway, the firewall policy includes: Pre-configure the mapping table between IP address and port; identifying a destination IP address and destination port for data received from the OBD via Ethernet; matching the identified target IP address and target port with a mapping table between the pre-configured IP address and port; sending the data over Ethernet to the vehicle control unit in response to the identified target IP address and target port matching a mapping table between the pre-configured IP addresses and ports; and discarding the data in response to a mismatch between the identified destination IP address and destination port and a mapping table between the preconfigured IP addresses and ports, wherein a destination IP address and a destination port of data received from the OBD via Ethernet are identified using ternary content addressable memory. 4. A vehicle communication method, characterized in that the method comprises: receiving data from the on-board diagnostic unit; deploying a firewall policy at a central gateway communicatively coupled to the OBD; and The received data is selectively sent to a vehicle control unit based on the firewall policy. 5. The method of claim 4, wherein the method further comprises: receiving data via one or more of a CAN bus, a LIN bus, and an Ethernet channel; and selectively sending said received data to a vehicle control unit based on said firewall policy, Wherein said central gateway includes: a processor configured to communicatively couple with the on-board diagnostic unit via a CAN interface; a switch configured to communicatively couple with the OBD and the processor via Ethernet; and A router configured to be communicatively connected to said switch via Ethernet and to transmit said received data to a vehicle control unit via a CAN bus and/or a LIN bus. 6. The method of claim 4, wherein the firewall policy comprises: dividing the vehicle communication network into a first broadcast domain and a second broadcast domain based on a virtual local area network; detecting data received from the OBD to identify the received data as data accessing an external network and data not accessing an external network; and configuring the first broadcast domain for communication of data accessing an external network, and configuring the second broadcast domain for communication of data not accessing an external network, Wherein in the processor of the central gateway, the firewall policy includes: Pre-configure the mapping table between CAN identifiers and routing identifiers; matching data received from the OBD via a CAN interface to the pre-configured mapping table; sending data received from the OBD via the CAN interface to the vehicle control unit via the router via a CAN bus and/or a LIN bus in response to the data being received from the OBD matching the preconfigured mapping table; and discarding data received from the OBD via a CAN interface in response to the data not matching the preconfigured mapping table, Wherein the mapping table between the preconfigured CAN identifier and the routing identifier includes: an initial mapping table configured to establish a mapping relationship between the CAN identifier and a data block corresponding to the routing identifier; and a forwarding mapping table configured to establish a mapping relationship between the CAN identifier and a CAN bus for transmitting a data block corresponding to the routing identifier, Wherein said firewall policy further includes: matching data received from the OBD via a CAN interface to the initial mapping table; discarding data received from the OBD via a CAN interface in response to the data not matching the initial mapping table; further matching the data received from the OBD via a CAN interface to the forwarding map in response to the data being received from the OBD matching the initial map; sending the data to the vehicle control unit via the router over a CAN bus and/or a LIN bus in response to the data matching the forwarding map; and discarding the data in response to the data not matching the forwarding map, Wherein in the switch of the central gateway, the firewall policy includes: Pre-configure the mapping table between IP address and port; identifying a destination IP address and destination port for data received from the OBD via Ethernet; matching the identified target IP address and target port with a mapping table between the pre-configured IP address and port; sending the data over Ethernet to the vehicle control unit in response to the identified target IP address and target port matching a mapping table between the pre-configured IP addresses and ports; and The data is discarded in response to a mismatch between the identified destination IP address and destination port and the pre-configured mapping table between IP addresses and ports. 7. The method of claim 6, wherein a destination IP address and a destination port of data received from the OBD via Ethernet are identified using a ternary content addressable memory. 8. A computer storage medium, characterized in that the computer storage medium comprises instructions, and the instructions execute the vehicle communication method according to any one of claims 4 to 7 when running. 9. A computer device, characterized in that the computer device includes a memory, a processor, and a computer program stored on the memory and operable on the processor, wherein the computer program is implemented when the processor executes the program The vehicle communication method according to any one of claims 4 to 7. 10. A vehicle, characterized by comprising the in-vehicle communication system according to any one of claims 1 to 3.

Images