SecOC key management method, system, device and vehicle

Abstract

The invention relates to the technical field of vehicle safety, in particular to a SecOC secret key management method, system and device and a vehicle, and the method comprises the steps that a SecOC secret key ciphertext and related authentication information are acquired from a diagnostic apparatus end, a target ECU decrypts the SecOC secret key ciphertext by using a preset PreKEK, a SecOCKey to be filled is acquired, and the SecOCKey to be filled is stored in the diagnostic apparatus end; the SecOC key ciphertext is a ciphertext obtained by encrypting a vehicle exclusive key generated by the KMS according to the key management request; an initial secret key PreSecOCKey in the target ECU is replaced by a SecOCKey, and the PreSecOCKey and the PreKEK are randomly generated by a KMS (Keyboard Management System) and are preset on an ECU production line; and writing the SecOCKey into the secure storage of the target ECU, and verifying whether the SecOCKey is successfully stored by using the authentication information, and if so, starting the SecOCKey as the vehicle exclusive key. According to the method, the SecOCKey generated by the KMS is used as a vehicle exclusive key to replace an initial key PreSecOCKey pre-filled in the target ECU, so that the safety of vehicle key management is improved.

Description

Technical Field

[0001] The present invention relates to the field of vehicle safety technology, and in particular to a SecOC key management method, system, device and vehicle. Background Art

[0002] The automobile's secure onboard communication technology (SecOC) is used to ensure the authenticity and integrity of communications between vehicle ECUs, allowing the ECUs to identify forged or replayed signals and thus avoid attacks. Currently, most vehicles use one key per vehicle, meaning that the keys of all SecOC components deployed in a vehicle are the same. Once leaked, this will affect the security of in-vehicle interactive information, thereby affecting vehicle safety. Summary of the invention

[0003] The present invention aims to provide a SecOC key management method, system, device and vehicle, which are used to improve the security of vehicle key management.

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] In a first aspect, a SecOC key management method is provided, including:

[0006] Obtain the SecOC key ciphertext and related authentication information from the diagnostic instrument, and the target ECU decrypts the SecOC key ciphertext using the preset public key Pre_KEK to obtain the SecOCKey to be filled, wherein the SecOC key ciphertext is the ciphertext obtained by encrypting the vehicle-specific key generated by the key management system KMS according to the key management request;

[0007] Replace the initial key Pre_SecOCKey in the target ECU with the SecOCKey, wherein the Pre_SecOCKey and the Pre_KEK are generated by the KMS system and preset on the ECU production line;

[0008] The SecOCKey is written into the secure storage of the target ECU, and the authentication information is used to verify whether the SecOCKey is successfully stored. If so, the SecOCKey is enabled as a vehicle-specific key.

[0009] Furthermore, before obtaining the SecOC key ciphertext and related authentication information from the diagnostic instrument, it also includes: writing the vehicle VIN code into the target ECU, wherein the vehicle VIN code is obtained by the diagnostic instrument by scanning the code or using the vehicle OBD interface, and written to the target ECU through the data identifier DID.

[0010] Furthermore, the vehicle-specific key generated by the KMS system according to the key management request is encrypted using the Pre_KEK and AES_GCM algorithms to obtain the SecOC key ciphertext;

[0011] In response to the UDS 31 routine service initiated by the diagnostic instrument, the target ECU obtains the SecOC key ciphertext and authentication information from the diagnostic instrument; wherein the authentication information is the authentication information carried by the AES_GCM algorithm itself, including the initialization vector IV, the data integrity verification parameter TAG, and the additional authentication data AAD, wherein the additional authentication data AAD includes the key type type, the random number nonce and the corresponding parameter cmac.

[0012] Furthermore, before the target ECU uses the preset public key Pre_KEK to decrypt the SecOC key ciphertext, it also includes: determining the type of key to be filled according to the routine description and the key type type in the additional authentication data AAD, and obtaining the current filling status; after decrypting the SecOC key ciphertext, judging whether the plain text of the decrypted SecOCKey is complete according to the data integrity verification parameter TAG in the authentication information, if the decryption fails or the authentication fails, recording the corresponding fault code DTC.

[0013] Furthermore, after obtaining the SecOCKey to be filled, it also includes: using the authentication information to determine whether the SecOCKey has been tampered with; specifically including: reading the authentication information, obtaining the random number nonce preset in the additional authentication data AAD, and then calling the cryptographic operation interface, using the SecOCKey as the key, and using the AES_128_CMAC algorithm to calculate the cmac value corresponding to the random number nonce; comparing the calculated cmac value with the value of the parameter cmac preset in the additional authentication data AAD, if the two are the same, it is determined that the SecOCKey has not been tampered with, otherwise the corresponding DTC is recorded.

[0014] Furthermore, the use of the authentication information to verify whether the SecOCKey is stored successfully includes: calling a cryptographic operation interface to use the SecOCKey written into the target ECU as a key, and using the AES_128_CMAC algorithm to calculate a cmac value corresponding to the random number nonce; comparing the calculated cmac value with the value of a parameter cmac preset in the additional authentication data AAD, and if the two are the same, it is determined that the SecOCKey is stored successfully, otherwise the corresponding DTC is recorded.

[0015] Furthermore, the method further comprises: the target ECU feeds back the key filling result to the diagnostic instrument end, and clears the related DTC after the SecOCKey filling is successful.

[0016] In a second aspect, a SecOC key management system is also provided, including:

[0017] The SecOCKey acquisition module is used to obtain the SecOC key ciphertext and related authentication information from the diagnostic instrument. The target ECU decrypts the SecOC key ciphertext using the preset public key Pre_KEK to obtain the SecOCKey to be filled, wherein the SecOC key ciphertext is the ciphertext obtained by encrypting the vehicle-specific key generated by the KMS system according to the key management request;

[0018] A key filling module, used for replacing the initial key Pre_SecOCKey in the target ECU with the SecOCKey, wherein the Pre_SecOCKey and the Pre_KEK are generated by the KMS system and preset on the ECU production line;

[0019] The key storage module is used to write the SecOCKey into the secure storage of the target ECU and verify whether the SecOCKey is stored successfully using the authentication information. If so, the SecOCKey is enabled as a vehicle-specific key.

[0020] Based on the same inventive concept, the present invention also provides an electronic device, comprising: a memory and a processor; the processor is used to read and execute a computer program stored in the memory to implement the aforementioned SecOC key management method.

[0021] Based on the same inventive concept, the present invention also provides a vehicle, which adopts the aforementioned SecOC key management method, or includes the aforementioned SecOC key management system.

[0022] Technical effects and advantages of the present invention:

[0023] 1. The KMS system generates a vehicle-specific SecOC key based on the key management request. The diagnostic instrument sends the SecOC key to the target ECU in ciphertext to ensure the confidentiality and integrity of the key to be installed during transmission.

[0024] 2. The target ECU decrypts the SecOC key ciphertext using the preset Pre_KEK. The decrypted SecOCKey is used to replace the initial key Pre_SecOCKey pre-installed in the target ECU. After the SecOCKey is written into the secure storage of the target ECU and verified, the SecOC module enables the SecOCKey as the vehicle-specific key, thereby improving the security of vehicle key management.

[0025] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 This is a flow chart of the SecOC key management method in the first embodiment of the present invention;

[0028] Figure 2 This is a UDS instruction timing diagram for single key filling in the first embodiment of the present invention;

[0029] Figure 3 FIG. 1 is a schematic diagram of the structure of the SecOC key management system in the second embodiment of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] In order to solve the problem of insufficient security of vehicle key management in the prior art, the first embodiment of the present invention discloses a SecOC key management method, such as Figure 1 As shown, the method includes:

[0032] Step S1, obtaining the SecOC key ciphertext and related authentication information from the diagnostic instrument, and the target ECU decrypting the SecOC key ciphertext using the preset public key Pre_KEK to obtain the SecOCKey to be filled, wherein the SecOC key ciphertext is the ciphertext obtained by encrypting the vehicle-specific key generated by the key management system KMS according to the key management request;

[0033] In step S1, the key management system KMS generates a vehicle-specific SecOC key, namely, SecOCKey, according to the key management request, and obtains the SecOC key ciphertext after symmetric encryption using the public key Pre_KEK; the diagnostic instrument sends the SecOC key ciphertext to the target ECU to ensure the confidentiality and integrity of the key to be filled during the transmission process; after receiving the SecOC key ciphertext, the target ECU uses the pre-filled Pre_KEK to decrypt the SecOC key ciphertext through the corresponding decryption algorithm to obtain the SecOCKey to be filled.

[0034] Step S2, replacing the initial key Pre_SecOCKey in the target ECU with the SecOCKey, wherein Pre_SecOCKey and Pre_KEK are generated by the KMS system and preset on the ECU production line;

[0035] Pre_SecOCKey is the initial key randomly generated by the KMS system and pre-installed in the vehicle ECU. It is generally stored in the HSM security zone, key = Pre_SecOCKey. The initial key is encrypted, fused, and derived to achieve a one-car-one-key state, that is, the entire vehicle uses the same key, so the security is insufficient. Since the initial key Pre_SecOCKey is set in the target ECU, it can be used to distinguish whether the vehicle SecOC module has gone through the initial key filling step. When the initial key is empty, the production line is stagnant, which can prevent illegal parts from being installed on the vehicle. A public key Pre_KEK is also set in the target ECU. The confidentiality level of Pre_KEK is higher than that of Pre_SecOCKey. Therefore, Pre_KEK needs to be distributed confidentially and be managed by a dedicated person. The target ECU uses the Pre_KEK to decrypt the SecOC key ciphertext obtained from the diagnostic instrument. The decrypted SecOCKey replaces the initial key Pre_SecOCKey pre-installed in the target ECU. Specifically, when the target ECU receives the SecOCKey injected by the production line electrical inspection equipment, it directly overwrites the Pre_SecOCKey in the HSM security zone, key = SecOCKey, thereby realizing SecOCKey filling. In this way, the original vehicle key Pre_SecOCKey is replaced with the vehicle-specific key SecOCKey of the SecOC module.

[0036] Step S3: write the SecOCKey into the secure storage of the target ECU, and use the authentication information to verify whether the SecOCKey is stored successfully. If so, enable the SecOCKey as the vehicle-specific key.

[0037] According to an embodiment of the present invention, after the SecOCKey is loaded into the target ECU, it also needs to be written into the secure storage of the target ECU. After the SecOCKey is written into the secure storage of the target ECU and passes the authentication information verification, the SecOC module enables the SecOCKey as a vehicle-specific key, thereby improving the security of vehicle key management.

[0038] According to a preferred embodiment, before obtaining the SecOC key ciphertext and related authentication information from the diagnostic instrument, it also includes: writing the vehicle VIN code into the target ECU, wherein the vehicle VIN code is obtained by the diagnostic instrument by scanning the code or using the vehicle OBD interface, and written to the target ECU through the data identifier DID. In actual applications, each car has a unique vehicle identification code VIN (Vehicle Identification Number), which is generally composed of a 17-digit string of letters and numbers, and contains important information about the car, such as manufacturer, year of production, production plant, engine type, model, etc.

[0039] In addition, the Tester (such as a diagnostic instrument or an electric tester) uses the UDS protocol to fill the key for the target ECU. "Filling" is a UDS 31 routine. The Tester sends the key to be filled to the target ECU. According to the UDS protocol specification, before performing key filling, the Tester must first pass the ECU's 27 authentication.

[0040] According to a preferred embodiment, the vehicle-specific key generated by the KMS system according to the key management request is encrypted using Pre_KEK and AES_GCM algorithms to obtain the SecOC key ciphertext. AES is a symmetric key block encryption algorithm, and GCM refers to the symmetric encryption algorithm using the Counter mode. GCM can provide encryption and integrity verification of information, and can also provide integrity verification of additional messages. For example, the KMS system and the target ECU use the AES_GCM_128 algorithm to encrypt and decrypt the SecOCKey for authentication.

[0041] In this embodiment, in response to the UDS 31 routine service initiated by the diagnostic instrument, the target ECU obtains the SecOC key ciphertext and authentication information from the diagnostic instrument; wherein, the authentication information is the authentication information carried by the AES_GCM algorithm, including the initialization vector IV (Initialisation Vector), the data integrity verification parameter TAG, and the additional authentication data AAD (Additional Authenticated Data), wherein the initialization vector IV is randomly selected, and the additional authentication data AAD is used for identity authentication, including the key type type, the random number nonce and the corresponding parameter cmac.

[0042] According to a preferred embodiment, before the target ECU uses the preset public key Pre_KEK to decrypt the SecOC key ciphertext, it also includes: determining the type of the key to be filled according to the above-mentioned UDS 31 routine description and the key type type in the additional authentication data AAD, and obtaining the current filling state. For example, the key type type in AAD can be SecOCKey, Pre_SecOCKey or empty, and by determining the type of the key to be filled, it is determined which filling link has not been passed at present.

[0043] Furthermore, the target ECU uses Pre_KEK to decrypt the SecOC key ciphertext to obtain the plaintext of SecOCKey, and then determines whether the plaintext of SecOCKey is complete based on the data integrity verification parameter TAG in the authentication information. If the decryption fails or the authentication fails, the corresponding fault code DTC is recorded.

[0044] According to a preferred embodiment, after obtaining the SecOCKey to be filled, the first verification is performed: using the authentication information to determine whether the SecOCKey has been tampered with. Specifically, the authentication information is read to obtain the random number nonce preset in the additional authentication data AAD, and then the cryptographic operation interface is called, the SecOCKey to be filled is used as the key, and the AES_128_CMAC algorithm is used to calculate the cmac value corresponding to the random number nonce; the calculated cmac value is compared with the value of the parameter cmac preset in the additional authentication data AAD. If the two are the same, it is determined that the SecOCKey has not been tampered with, otherwise the corresponding DTC is recorded.

[0045] Furthermore, after the SecOCKey is loaded into the target ECU, it is also necessary to write it into the secure storage of the target ECU, such as writing it into eMMC, HSM, SE or TEE. If an abnormality occurs during the writing process, the ECU needs to be able to sense this abnormality. Therefore, a second verification is also performed in this embodiment, that is, the authentication information is used to verify whether the SecOCKey is successfully stored. According to a preferred embodiment, the authentication information is used to verify whether the SecOCKey is successfully stored, specifically including: reading the authentication information, obtaining the random number nonce preset in the additional authentication data AAD, and then calling the cryptographic operation interface, using the SecOCKey written into the target ECU as the key, and using the AES_128_CMAC algorithm to calculate the cmac value corresponding to the random number nonce; comparing the calculated cmac value with the value of the parameter cmac preset in the additional authentication data AAD, if the two are the same, it is judged that the SecOCKey is stored successfully, otherwise the corresponding DTC is recorded. After the SecOCKey is written into the secure storage of the target ECU and the verification is passed, the SecOC module enables the SecOCKey as the vehicle-specific key.

[0046] According to a preferred embodiment, after the filling routine is completed, the target ECU feeds back the key filling result to the diagnostic instrument end, specifically through the UDS 71 routine service, and the key filling result is success or failure. In addition, after the SecOCKey is successfully filled, the target ECU also needs to clear the related DTCs, including DTCs of decryption failure or authentication integrity failure, DTCs of first verification failure, DTCs of second verification failure, and DTCs generated by other programs. Since when the ECU filled with the new key communicates with the ECU that has not updated the SecOC key, communication errors will occur due to the difference in the SecOC key, so the ECU needs to clear the DTCs of the SecOC related network after updating the SecOC key.

[0047] The SecOC key management method provided by the present invention has the following technical effects:

[0048] 1. The KMS system generates a vehicle-specific SecOC key based on the key management request. The diagnostic instrument sends the SecOC key to the target ECU in ciphertext to ensure the confidentiality and integrity of the key to be installed during transmission.

[0049] 2. Since the target ECU is set with the initial key Pre_SecOCKey, it can be used to distinguish whether the vehicle SecOC module has gone through the initial key filling step. When the initial key is empty, the production line is stopped, which can prevent illegal parts from being loaded on the vehicle;

[0050] 3. The target ECU decrypts the SecOC key ciphertext using the preset Pre_KEK. The decrypted SecOCKey is used to replace the initial key Pre_SecOCKey pre-installed in the target ECU. After the SecOCKey is written into the secure storage of the target ECU and verified, the SecOC module enables the SecOCKey as the vehicle-specific key, thereby improving the security of vehicle key management.

[0051] The following is a detailed description through a specific embodiment:

[0052] Example 1

[0053] The premise of the SecOC key filling business process is that the ECU has preset the initial key Pre_SecOCKey and the public key Pre_KEK on the component production line. Pre_SecOCKey and Pre_KEK are generated on the key management system KMS of the original equipment manufacturer OEM and transmitted to the component manufacturer through a secure channel.

[0054] like Figure 2 As shown in the figure, the UDS instruction sequence for single key filling includes:

[0055] ①The tester obtains the vehicle VIN code by scanning the code or using the OBD interface;

[0056] The diagnostic tool Tester can be anything that implements the UDS communication protocol, such as an actual hardware device (diagnostic instrument or electric tester), or a host computer software that implements the UDS protocol, or even a system test script that implements the UDS protocol. Tester can obtain the vehicle VIN code by scanning the code in the OEM production line scenario, and obtain the vehicle VIN code through the OBD interface in the after-sales scenario.

[0057] ② Tester sends a service request to ECU (UDS10 03 command): requesting ECU to enter extended session mode;

[0058] ECU replies with a positive response (UDS 50 03 command);

[0059] ③ Tester sends a diagnostic request to ECU (UDS27 01 command): asks ECU for a random number seed;

[0060] ECU responds (UDS 67 01+seed command): Sends the generated random number seed seed to the Tester;

[0061] ④Tester sends a diagnostic request to ECU (UDS27 02+key command): the key calculated by the security algorithm based on the random number seed is sent to ECU;

[0062] ECU responds (UDS 67 02 command): compares the key from the Tester with the key calculated by itself, unlocks the security level, and replies that the verification is passed if they are consistent;

[0063] Among them, ③ and ④ are used to 27 authenticate the vehicle ECU;

[0064] ⑤Tester sends a service request to ECU (UDS2E DID+VIN command): writes VIN code to ECU through data identifier DID;

[0065] ECU replies with a positive response (UDS 6E DID command);

[0066] ⑥Tester sends a service request to ECU (UDS 31 01RID+filling data instruction): request ECU to execute RID31 routine and send filling data to ECU;

[0067] ECU responds (UDS 71 01RID + filling result): starts the filling procedure and replies the filling result to the Tester;

[0068] In this step, the filling data includes the SecOC key ciphertext KeyCiphertext and the authentication information carried by the AES_GCM_128 algorithm. Table 1 is the authentication parameter table of the AES_GCM_128 algorithm. The authentication parameters include the initialization vector IV, the data integrity verification parameter TAG, the additional authentication data AAD, etc. The additional authentication data AAD is used for identity authentication, including the key type type, the random number nonce, and the parameter cmac corresponding to the nonce. Table 2 is a reference table for encrypting and authenticating the SecOC key plaintext KeyPlaintext using the Pre_KEK and AES_GCM_128 algorithms to obtain the ciphertext KeyCiphertext. Table 3 is the filling parameter table of the key filling 31 routine. Table 4 is the routine description definition table of the key filling 31 routine.

[0069] Table 1

[0070]

[0071] Table 2

[0072]

[0073] Table 3

[0074]

[0075]

[0076] Table 4

[0077] RID RID Meaning 0xDD42 Filling SecOCKey 0xDD4D Filling Pre_SecOCKey

[0078] The ECU executes the RID 31 routine to perform key filling. The specific steps include:

[0079] 1) Determine the type of key to be filled

[0080] Get the type of key to be filled according to RID&AAD: When RID=DD42 and type=0x05 in AAD, it means that the key to be filled is SecOCKey, which is generally used for OEM production line filling and after-sales filling; When RID=DD4D and type=0x00 in AAD, it means that the key to be filled is Pre_SecOCKey, which is generally used for ECU production line filling;

[0081] 2) Decrypt SecOC key ciphertext

[0082] ECU calls the cryptographic operation interface, uses Pre_KEK as the key, uses the AES_GCM_128 algorithm, and uses the filling data as the parameter to perform decryption + authentication calculations to obtain the plaintext data KeyPlaintext of SecOCKey, and determines whether the plaintext of the SecOCKey is complete based on the data integrity verification parameter TAG in the authentication information. If decryption fails or authentication fails, ECU will record a DTC (F10000) for the failure of decryption using the AES_GCM_128 algorithm in this routine, and the existing key in the ECU will not be updated. Correspondingly, Tester also records a DTC (U310000);

[0083] 3) First key verification

[0084] Before writing to the secure environment, the ECU reads the authentication information, obtains the random number nonce preset in the additional authentication data AAD, and calls the cryptographic operation interface to use the decrypted SecOCKey as the key, and uses the AES_128_CMAC algorithm to calculate the cmac value corresponding to the random number nonce, and then compares the calculated cmac value with the preset parameter cmac value. If the two are the same, it is determined that the SecOCKey has not been tampered with, otherwise the ECU records a corresponding DTC (F10200), and the existing key in the ECU will not be updated. Correspondingly, the Tester also records a DTC (U310200);

[0085] 4) Securely store SecOCKey

[0086] Write SecOCKey to the secure storage of the ECU. If writing to the secure environment fails, a corresponding DTC (F101200) is recorded, and the existing key in the ECU will not be updated. Correspondingly, the Tester also records a DTC (U310100);

[0087] 5) Second key verification

[0088] Using the SecOCKey written into the ECU as the key, the AES_128_CMAC algorithm is used to calculate the cmac value corresponding to the random number nonce, and then the calculated cmac value is compared with the preset parameter cmac value. If the two are the same, it is determined that the SecOCKey is stored successfully, otherwise the ECU records a corresponding DTC (F10300), and the existing key in the ECU will not be updated. Correspondingly, the Tester also records a DTC (U310300). Table 5 is the key filling DTC information table recorded by the Tester.

[0089] Table 5

[0090]

[0091] 6) Set the key to take effect

[0092] After the ECU verifies that the SecOCKey is securely stored successfully, the SecOC module immediately enables the SecOCKey as the vehicle's exclusive key;

[0093] 7) Set the SecOC key status

[0094] The ECU writes the type of the SecOC key to be filled via the data identifier DID (F08A):

[0095] If the ECU has not loaded any SecOC key, set F08A to 0x00; if the type of the key loaded in the ECU is SecOCKey, set F08A to 0x01; if the type of the key loaded in the ECU is Pre_SecOCKey, set F08A to 0x02; for other loading types, do not modify the value of F08A. Table 6 is a description table of the meaning of the SecOC key loading DID.

[0096] Table 6

[0097]

[0098] 8) Feedback filling results

[0099] ECU feeds back the filling result to Tester through UDS 71 01 service. If UDS 71 01RID 00 is fed back, it means the filling is successful. If UDS 71 01RID 01 is fed back, it means the filling fails. Table 7 is the filling parameter table of the key filling 71 routine.

[0100] Table 7

[0101]

[0102]

[0103] ⑦ Tester sends a service request (UDS14SecOC DTC command) to ECU: requesting ECU to clear DTCs related to SecOC network;

[0104] ECU replies with a positive response (UDS 54 command);

[0105] ⑧Tester sends a service request to ECU (UDS11 01 command): requesting ECU to reset;

[0106] The ECU replies with a positive response (UDS 51 01 command) and performs a reset operation.

[0107] The second embodiment of the present invention also provides a SecOC key management system, such as Figure 3 As shown, the system comprises:

[0108] The SecOCKey acquisition module is used to obtain the SecOC key ciphertext and related authentication information from the diagnostic instrument, and use the preset public key Pre_KEK to decrypt the SecOC key ciphertext to obtain the SecOCKey to be filled, wherein the SecOC key ciphertext is the ciphertext obtained after the vehicle-specific key generated by the KMS system according to the key management request is encrypted;

[0109] The key filling module is used to replace the initial key Pre_SecOCKey in the target ECU with SecOCKey, where Pre_SecOCKey and Pre_KEK are generated by the KMS system and preset on the ECU production line;

[0110] The key storage module is used to write SecOCKey into the secure storage of the target ECU and use the authentication information to determine whether SecOCKey is stored successfully. If so, SecOCKey is enabled as the vehicle-specific key.

[0111] Regarding the system in the above embodiment, the specific manner in which each unit module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0112] Based on the same inventive concept, an embodiment of the present invention further provides an electronic device, including: a memory and a processor, wherein the processor is used to read and execute a computer program stored in the memory to implement the aforementioned SecOC key management method.

[0113] Based on the same inventive concept, an embodiment of the present invention further provides a vehicle, wherein the vehicle adopts the aforementioned SecOC key management method, or includes the aforementioned SecOC key management system.

[0114] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0115] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, the functional modules in the various embodiments of the present invention may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0116] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0117] It should be noted that, for the convenience of description, the aforementioned method embodiments are all described as a series of action combinations, but those skilled in the art should be aware that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0118] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0119] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A SecOC key management method, characterized in that: The method comprises: Obtain the SecOC key ciphertext and related authentication information from the diagnostic instrument, and the target ECU decrypts the SecOC key ciphertext using the preset public key Pre_KEK to obtain the SecOCKey to be filled, wherein the SecOC key ciphertext is the ciphertext obtained by encrypting the vehicle-specific key generated by the key management system KMS according to the key management request; Replace the initial key Pre_SecOCKey in the target ECU with the SecOCKey, wherein the Pre_SecOCKey and the Pre_KEK are generated by the KMS system and preset on the ECU production line; The SecOCKey is written into the secure storage of the target ECU, and the authentication information is used to verify whether the SecOCKey is stored successfully. If so, the SecOCKey is enabled as the vehicle-specific key.

2. The method according to claim 1, characterized in that Before obtaining the SecOC key ciphertext and related authentication information from the diagnostic instrument, the following steps are also required: The vehicle VIN code is written into the target ECU, wherein the vehicle VIN code is obtained by the diagnostic instrument by scanning the code or using the vehicle OBD interface, and is written into the target ECU through the data identifier DID.

3. The method according to claim 1, characterized in that The vehicle-specific key generated by the KMS system according to the key management request is encrypted using the Pre_KEK and AES_GCM algorithms to obtain the SecOC key ciphertext; In response to the UDS 31 routine service initiated by the diagnostic instrument, the target ECU obtains the SecOC key ciphertext and authentication information from the diagnostic instrument; The authentication information is the authentication information carried by the AES_GCM algorithm, including the initialization vector IV, the data integrity verification parameter TAG, and the additional authentication data AAD, wherein the additional authentication data AAD includes the key type type, the random number nonce and the corresponding parameter cmac.

4. The method according to claim 3, characterized in that: Before the target ECU uses the preset public key Pre_KEK to decrypt the SecOC key ciphertext, it also includes: According to the routine description and the key type type in the additional authentication data AAD, determine the type of key to be filled, and obtain the current filling status; After decrypting the SecOC key ciphertext, it is determined whether the plaintext of the decrypted SecOCKey is complete according to the data integrity verification parameter TAG in the authentication information. If the decryption fails or the authentication fails, the corresponding fault code DTC is recorded.

5. The method according to claim 3, characterized in that: After obtaining the SecOCKey to be filled, it also includes: Using the authentication information to determine whether the SecOCKey has been tampered with; The step of using the authentication information to determine whether the SecOCKey has been tampered with specifically includes: Read the authentication information, obtain the random number nonce preset in the additional authentication data AAD, and then call the cryptographic operation interface, use the SecOCKey as the key, and use the AES_128_CMAC algorithm to calculate the cmac value corresponding to the random number nonce; The calculated cmac value is compared with the value of the parameter cmac preset in the additional authentication data AAD. If the two are the same, it is determined that the SecOCKey has not been tampered with, otherwise the corresponding DTC is recorded.

6. The method according to claim 3, characterized in that The using the authentication information to verify whether the SecOCKey is successfully stored includes: Call the cryptographic operation interface to use the SecOCKey written into the target ECU as the key, and use the AES_128_CMAC algorithm to calculate the cmac value corresponding to the random number nonce; The calculated cmac value is compared with the value of the parameter cmac preset in the additional authentication data AAD. If the two are the same, it is determined that the SecOCKey is stored successfully, otherwise the corresponding DTC is recorded.

7. The method according to any one of claims 4 to 6, characterized in that: The method further comprises: The target ECU feeds back the key filling result to the diagnostic instrument end, and clears the related DTC after the SecOCKey filling is successful.

8. A SecOC key management system, characterized in that: The system comprises: The SecOCKey acquisition module is used to obtain the SecOC key ciphertext and related authentication information from the diagnostic instrument. The target ECU decrypts the SecOC key ciphertext using the preset public key Pre_KEK to obtain the SecOCKey to be filled, wherein the SecOC key ciphertext is the ciphertext obtained by encrypting the vehicle-specific key generated by the KMS system according to the key management request; A key filling module, used for replacing the initial key Pre_SecOCKey in the target ECU with the SecOCKey, wherein the Pre_SecOCKey and the Pre_KEK are generated by the KMS system and preset on the ECU production line; The key storage module is used to write the SecOCKey into the secure storage of the target ECU and verify whether the SecOCKey is stored successfully using the authentication information. If so, the SecOCKey is enabled as a vehicle-specific key.

9. An electronic device, characterized in that: include: Memory, processor; The processor is used to read and execute the computer program stored in the memory to implement the method according to any one of claims 1 to 7.

10. A vehicle, characterized in that: The vehicle adopts the method according to any one of claims 1 to 7, or includes the system according to claim 8.

Images