Research And Implementation Of Automotive OTA Security Based On Automotive Ethernet Backbone Network

With the continuous advancement of technology,the automotive industry is gradually undergoing a transformation towards intelligence and connectivity.The application of Over-The-Air(OTA)technology has played an undeniable role in the revolution of the automotive industry.Simultaneously,the traditional distributed electronic-electrical architecture based on CAN and LIN buses can no longer meet the growing demands of information transmission and interaction.In this context,Automotive Ethernet has emerged as the backbone network for intelligent vehicles,and the OTA upgrade of intelligent vehicles based on Automotive Ethernet is becoming an inevitable trend.Currently,research on automotive OTA security technology primarily focuses on the security of OTA servers,security during vehiclecloud transmission,and security during vehicle-side flashing processes.However,the transmission of OTA data within the Automotive Ethernet still lacks a systematically effective encryption and authentication mechanism,resulting in numerous security vulnerabilities when applying OTA technology to intelligent vehicles based on the Automotive Ethernet backbone network.Therefore,the main work of this paper is as follows:Firstly,the security threats of OTA data transmission in the Automotive Ethernet backbone network are analyzed through attack tree modeling,including threats of information theft,key leakage,false node infiltration,replay attacks,and tampering attacks.Based on the analysis of security threats,the security requirements are derived,and a comprehensive security requirement is proposed for the overall architecture of secure communication in the Automotive Ethernet backbone network.Secondly,the dynamic key algorithm and secure communication methods for the overall architecture of secure communication are elaborated upon.In the dynamic key generation algorithm,a dynamic key preprocessing algorithm based on time,identity,and communication information is proposed by incorporating the nonlinear data processing approach of the Advanced Encryption Standard(AES)algorithm.This algorithm yields secure dynamic key preprocessing values.To address the shortcomings of the traditional Message Digest Algorithm 5(MD5),the research combines it with the Hash-based Message Authentication Code(HMAC)algorithm and integrates the dynamic key preprocessing values into the HMAC-MD5 algorithm.The dynamic key preprocessing values are adjusted based on the data transmission identifier to further mitigate replay attacks.The adjusted dynamic key preprocessing values are then used to generate dynamic keys using the HMAC-MD5 algorithm with the integrated preprocessing values.Moreover,based on the dynamic key algorithm,a dynamic key-based mutual authentication algorithm is employed to achieve bidirectional authentication between the gateway and new devices.Drawing on the trust chain structure commonly used in technologies such as blockchain and certificate authentication,in conjunction with dynamic key preprocessing values,a time-based trust chain identity authentication algorithm is utilized.This algorithm enables the gateway to perform legitimate identity checks on all controllers based on the authentication credentials on the timebased trust chain and the current time.Furthermore,data encryption is conducted using dynamic keys to ensure data confidentiality and counter information theft threats.Additionally,the MD5 algorithm is utilized to generate digests,ensuring data integrity against tampering attacks.Lastly,to validate the reliability of the proposed security methods,an experimental testbed is constructed comprising a cloud server,in-vehicle gateway,domain controller,and attack nodes.The experimental analysis assesses the feasibility,security,and timeliness of the security methods.The results demonstrate that,without the addition of extra hardware nodes,this method efficiently ensures confidentiality,authenticity,integrity,and freshness of OTA data within the Automotive Ethernet backbone network,while also ensuring key security.