Vehicle network security authentication device, vehicle network equipment and vehicle network security authentication method

Abstract

An embodiment of the present invention provides an in-vehicle network security authentication device, an in-vehicle network device, and an in-vehicle network security authentication method. The device includes: a first TLS communication module for establishing a TLS communication connection with the in-vehicle network device; an initialization module for sending a temporary login password to the in-vehicle network device that initially establishes a TLS communication connection with the first TLS communication module and receiving a device address code fed back by the in-vehicle network device and binding and storing the temporary login password and device address code; a login management module for comparing the temporary login password and device address code sent by the in-vehicle network device with a pre-bound temporary login password and device address code, and issuing a disconnection instruction when it is determined that they do not match; and a certificate management module for generating a temporary digital certificate in response to a certificate signing request and returning the temporary digital certificate to the in-vehicle network device. This embodiment can effectively improve the security of data transmission between in-vehicle network devices.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of vehicle-mounted device network communication technology, and in particular to a vehicle-mounted network security authentication device, a vehicle-mounted network device, and a vehicle-mounted network security authentication method. Background Art

[0002] At present, with the development of intelligent and networked motor vehicles, motor vehicles are usually equipped with on-board network devices such as network cameras, driving recorders, and on-board multimedia devices. When two on-board network devices interact with each other, information leakage and malicious attacks are prone to occur, affecting the security of data transmission. For this reason, motor vehicles are usually equipped with on-board network security authentication devices.

[0003] An existing in-vehicle network security authentication method is mainly based on the key matching principle. However, the key distribution and update of traditional in-vehicle network devices usually need to be implemented through a generally less secure network connection. However, the less secure network connection lacks sufficient security measures, such as encrypted communication and authentication. The key can be easily intercepted or tampered during transmission, resulting in very poor data transmission security. Summary of the Invention

[0004] The technical problem to be solved by the embodiments of the present invention is to provide an in-vehicle network security authentication device that can effectively improve the security of data transmission between in-vehicle network devices.

[0005] A further technical problem to be solved by the embodiments of the present invention is to provide an in-vehicle network device that can effectively improve the security of data transmission between in-vehicle network devices.

[0006] A further technical problem to be solved by the embodiments of the present invention is to provide an in-vehicle network security authentication method that can effectively improve the security of data transmission between in-vehicle network devices.

[0007] In order to solve the above technical problems, the embodiment of the present invention provides the following technical solution: an in-vehicle network security authentication device, comprising:

[0008] A first TLS communication module is used to verify the CA certificate pre-stored in the vehicle network device and establish a TLS communication connection with the vehicle network device to achieve two-way secure communication;

[0009] an initialization module, connected to the first TLS communication module, configured to send a temporary login password to the in-vehicle network device that has initially established a TLS communication connection with the first TLS communication module via the first TLS communication module, receive a device address code fed back by the in-vehicle network device, and bind the temporary login password and the device address code to each other and store them;

[0010] a login management module connected to the first TLS communication module, configured to compare the temporary login password and device address code sent by the in-vehicle network device via the first TLS communication module with the temporary login password and device address code that are bound and saved in advance, and to issue a disconnection instruction to the first TLS communication module if it is determined that they do not match; and

[0011] A certificate management module is connected to the first TLS communication module and the login management module, and is used to respond to the certificate signing request sent by the vehicle network device via the first TLS communication module, generate a temporary digital certificate based on the public key and device address code included in the certificate signing request, and send the temporary digital certificate back to the vehicle network device via the first TLS communication module.

[0012] Furthermore, the device further comprises:

[0013] An update control module is connected to the first TLS communication module and is used to randomly send password update instructions and / or certificate update instructions to the vehicle network device through the first TLS communication module to control the vehicle network device to update the pre-stored temporary login password and / or CA certificate accordingly.

[0014] On the other hand, in order to solve the above-mentioned further technical problems, an embodiment of the present invention provides the following technical solution: an in-vehicle network device, comprising:

[0015] A memory, pre-stored with a CA certificate;

[0016] a second TLS communication module, connected to the memory, configured to establish a TLS communication connection with the vehicle-mounted network security authentication device based on the CA certificate, receive a temporary login password sent by the vehicle-mounted network security authentication device, and store the temporary login password in the memory;

[0017] a certificate request module, connected to the second TLS communication module and the memory, respectively, for sending the temporary login password and the device address code of the in-vehicle network device to the in-vehicle network security authentication device through the second TLS communication module, and regenerating an asymmetric key pair accordingly each time the in-vehicle network device system is restarted, packaging the device address code and the public key in the asymmetric key pair to generate certificate signing request information, sending the certificate signing request information to the in-vehicle network security authentication device through the second TLS communication module, and then receiving and storing the temporary digital certificate generated and sent by the in-vehicle network security authentication device based on the public key and the device address code;

[0018] a third TLS communication module, connected to the certificate request module and the memory, configured to establish a new TLS communication connection based on the CA certificate with a third TLS communication module of another in-vehicle network device that also establishes a TLS communication connection with the in-vehicle network security authentication device and is to perform application layer data interaction;

[0019] a two-way authentication module, connected to the third TLS communication module, configured to verify the temporary digital certificate of the other party with the two-way authentication module of the other in-vehicle network device through the third TLS communication module; and

[0020] An application layer data interaction module is connected to the two-way authentication module and the third TLS communication module, and is used to interact with the application layer data interaction module of the other vehicle network device based on the new TLS communication connection after the temporary digital certificate of the other party is verified.

[0021] Furthermore, the vehicle network device further includes:

[0022] An update processing module is connected to the second TLS communication module and the memory, respectively, and is used to receive password update instructions and / or certificate update instructions sent by the on-board network security authentication device through the second TLS communication module, and update the temporary login password and / or CA certificate in the memory according to the password update instructions and / or the certificate update instructions.

[0023] Furthermore, the memory is a hardware security module or a security chip.

[0024] On the other hand, in order to solve the above-mentioned further technical problems, the embodiment of the present invention provides the following technical solution: a vehicle network security authentication method, comprising the following steps:

[0025] Verify the CA certificate pre-stored in the vehicle network device and establish a TLS communication connection with the vehicle network device to achieve two-way secure communication;

[0026] Sending a temporary login password to the vehicle network device that establishes the TLS communication connection for the first time and receiving the device address code fed back by the vehicle network device, and binding the temporary login password and the device address code to each other and saving them;

[0027] comparing the temporary login password and device address code sent by the in-vehicle network device based on the TLS communication connection with the temporary login password and device address code that are bound and saved in advance, and disconnecting the TLS communication connection if it is determined that they do not match; and

[0028] In response to the certificate signing request sent by the in-vehicle network device based on the TLS communication connection, a temporary digital certificate is generated based on the public key and device address code included in the certificate signing request, and the temporary digital certificate is returned to the in-vehicle network device based on the TLS communication connection.

[0029] Furthermore, the method further comprises:

[0030] Based on the TLS communication connection, a password update instruction and / or a certificate update instruction is randomly sent to the vehicle network device to control the vehicle network device to correspondingly update a pre-stored temporary login password and / or CA certificate.

[0031] On the other hand, in order to solve the above-mentioned further technical problems, the embodiment of the present invention provides the following technical solution: a vehicle network security authentication method, comprising the following steps:

[0032] Establishing a TLS communication connection with the vehicle-mounted network security authentication device based on the pre-stored CA certificate;

[0033] receiving a temporary login password sent by the vehicle-mounted network security authentication device based on the TLS communication connection and saving the temporary login password;

[0034] Sending the temporary login password and the device address code of the in-vehicle network device to the in-vehicle network security authentication device based on the TLS communication connection;

[0035] Regenerate an asymmetric key pair accordingly each time the in-vehicle network device system is restarted, and package the device address code and the public key in the asymmetric key pair to generate certificate signing request information;

[0036] Sending the certificate signing request information to the in-vehicle network security authentication device based on the TLS communication connection, then receiving and saving the temporary digital certificate generated and sent by the in-vehicle network security authentication device based on the public key and the device address code;

[0037] Establishing a new TLS communication connection based on the CA certificate with another vehicle network device that also establishes a TLS communication connection with the vehicle network security authentication device and is about to perform application layer data interaction;

[0038] Mutual verification of the temporary digital certificate of the other party with the other in-vehicle network device based on the new TLS communication connection; and

[0039] After the temporary digital certificates of each other are mutually verified and passed, application layer data interaction is performed with the other in-vehicle network device based on the new TLS communication connection.

[0040] Furthermore, the method further comprises:

[0041] A password update instruction and / or a certificate update instruction sent by the in-vehicle network security authentication device is received based on the TLS communication connection, and a stored temporary login password and / or CA certificate is updated according to the password update instruction and / or the certificate update instruction respectively.

[0042] Furthermore, a hardware security module or a security chip is used to store the CA certificate and the temporary login password.

[0043] After adopting the above technical solution, the embodiment of the present invention has at least the following beneficial effects: the first TLS communication module of the embodiment of the present invention realizes two-way secure communication between the vehicle-mounted network device and the vehicle-mounted network device by verifying the CA certificate pre-stored in the vehicle-mounted network device. The TLS communication connection is a communication method with data encryption and protection, which can effectively protect the transmitted data. When the TLS communication connection is first established, the initialization module sends a temporary login password to the vehicle-mounted network device and receives the device address code fed back by the vehicle-mounted network device, and binds the temporary login password and the device address code to each other and saves them. Therefore, when the TLS communication connection is established subsequently, the login management module can judge the temporary login password and the device address code sent by the vehicle-mounted network device. The TLS communication connection with the vehicle network device is immediately disconnected when there is a mismatch, thereby effectively preventing external malicious devices from impersonating the vehicle network device to attack and authenticate, thereby improving security; further, the certificate management module receives the certificate signing request information sent by the vehicle network device through the TLS communication connection, generates a temporary digital certificate corresponding to the public key and the device address code based on the public key and the device address code in the certificate signing request information, and sends the temporary digital certificate to the corresponding vehicle network device through the TLS communication connection, thereby achieving effective authentication of the corresponding vehicle network device and improving the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a principle block diagram of the connection between an optional embodiment of the vehicle-mounted network security authentication device of the present invention and a vehicle-mounted network device.

[0045] Figure 2 This is a flowchart of the steps of an optional embodiment of the vehicle-mounted network security authentication method of the present invention.

[0046] Figure 3 This is a flowchart of another optional embodiment of the vehicle-mounted network security authentication method of the present invention. DETAILED DESCRIPTION

[0047] The present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the following exemplary embodiments and descriptions are only used to explain the present invention and are not intended to limit the present invention. Moreover, the embodiments and features in the embodiments of the present application may be combined with each other unless there is a conflict.

[0048] like Figure 1 As shown, an optional embodiment of the present invention provides a vehicle-mounted network security authentication device 1, comprising:

[0049] The first TLS communication module 10 is used to verify the CA certificate pre-stored in the vehicle network device and establish a TLS (Transport Layer Security) communication connection with the vehicle network device 3 to achieve two-way secure communication;

[0050] an initialization module 12 connected to the first TLS communication module 10, configured to send a temporary login password to the in-vehicle network device 3 that has initially established a TLS communication connection with the first TLS communication module 10 via the first TLS communication module 10, receive a device address code fed back by the in-vehicle network device 3, and bind the temporary login password and the device address code to each other and store them;

[0051] a login management module 14 connected to the first TLS communication module 10, configured to compare the temporary login password and device address code sent by the in-vehicle network device 3 via the first TLS communication module 10 with the temporary login password and device address code that are bound and saved in advance, and to issue a disconnection instruction to the first TLS communication module 10 if it is determined that they do not match; and

[0052] The certificate management module 16 is connected to the first TLS communication module 10 and the login management module 14, and is used to respond to the certificate signing request sent by the vehicle network device 3 via the first TLS communication module 10 and generate a temporary digital certificate based on the public key and device address code contained in the certificate signing request and send the temporary digital certificate back to the vehicle network device 3 via the first TLS communication module 10.

[0053] In the embodiment of the present invention, the first TLS communication module 10 verifies the CA certificate pre-stored in the vehicle network device 3 and establishes a TLS communication connection with the vehicle network device 3 to achieve two-way secure communication. The TLS communication connection is a communication method with data encryption and protection, which can effectively protect the transmitted data. When the TLS communication connection is first established, the initialization module 12 sends a temporary login password to the vehicle network device 3 and receives the device address code fed back by the vehicle network device 3 and binds the temporary login password and the device address code to each other and saves them. When the TLS communication connection is established subsequently, the login management module 14 can determine whether the temporary login password and the device address code sent by the vehicle network device 3 are pre-bound and pre-protected. The stored temporary login password and the device address code match, thereby judging whether the vehicle network device 3 is legal. If they do not match, the TLS communication connection with the vehicle network device 3 is immediately disconnected, thereby effectively preventing external malicious devices from impersonating the vehicle network device 3 to attack and authenticate, thereby improving security; further, the certificate management module 16 receives the certificate signing request information sent by the vehicle network device 3 through the TLS communication connection, and generates a temporary digital certificate corresponding to the public key and the device address code based on the public key and the device address code in the certificate signing request information, and sends the temporary digital certificate to the corresponding vehicle network device 3 through the TLS communication connection, thereby achieving effective authentication of the corresponding vehicle network device 3 and improving the security of data transmission.

[0054] In an optional embodiment of the present invention, the device 1 further includes:

[0055] The update control module 18 is connected to the first TLS communication module 10 and is used to randomly send password update instructions and / or certificate update instructions to the vehicle network device 3 through the first TLS communication module 10 to control the vehicle network device 3 to update the pre-stored temporary login password and / or CA certificate accordingly.

[0056] In this embodiment, the update control module 18 randomly sends password update instructions and certificate update instructions to the vehicle network device 3 to control the vehicle network device 3 to update the pre-stored temporary login password and CA certificate, thereby effectively preventing the temporary login password from being leaked and the private key in the asymmetric key pair from being leaked or guessed, thereby improving security.

[0057] On the other hand, Figure 1 As shown, an embodiment of the present invention provides a vehicle network device 3, including:

[0058] Memory 30, pre-stored with CA certificate;

[0059] A second TLS communication module 31 is connected to the memory 30 and is used to establish a TLS communication connection with the vehicle network security authentication device 1 based on the CA certificate and receive a temporary login password sent by the vehicle network security authentication device 1 and store the temporary login password in the memory 30;

[0060] a certificate request module 32 connected to the second TLS communication module 31 and the memory 30, respectively, for sending the temporary login password and the device address code of the vehicle-mounted network device 3 to the vehicle-mounted network security authentication device 1 through the second TLS communication module 31, and regenerating an asymmetric key pair accordingly each time the vehicle-mounted network device 3 system is restarted, packaging the device address code and the public key in the asymmetric key pair to generate a certificate signing request message, and sending the certificate signing request message to the vehicle-mounted network security authentication device 1 through the second TLS communication module 31, and then receiving and storing the temporary digital certificate generated and sent by the vehicle-mounted network security authentication device 1 based on the public key and the device address code;

[0061] a third TLS communication module 33 connected to the certificate request module 32 and the memory 30 , configured to establish a new TLS communication connection based on the CA certificate with a third TLS communication module 33 of another vehicle network device 3 that also establishes a TLS communication connection with the vehicle network security authentication device 1 and is to perform application layer data interaction;

[0062] a two-way authentication module 34 connected to the third TLS communication module 33 and configured to mutually verify the temporary digital certificate of the other party with the two-way authentication module 34 of the other vehicle network device 3 through the third TLS communication module 33; and

[0063] The application layer data interaction module 35 is connected to the two-way authentication module 34 and the third TLS communication module 33, and is used to perform application layer data interaction with the application layer data interaction module 35 of the other vehicle network device 3 based on the new TLS communication connection after the mutual verification of the temporary digital certificate of the other party is passed.

[0064] The second TLS communication module 31 of the embodiment of the present invention establishes a TLS communication connection with the on-board network security authentication device 1 based on a pre-stored CA certificate. The TLS communication connection is a communication method with data encryption and protection, which can effectively protect the transmitted data. When the TLS communication connection is first established, the device address code is sent to the on-board network security authentication device 1 through the TLS communication connection and a temporary login password is received. When a TLS communication connection is subsequently established with the on-board network security authentication device 1, the on-board network security authentication device 1 can verify the device address code and temporary login password of the on-board network device 3, thereby determining whether the on-board network device 3 is legal. When the temporary login password and the device address code are successfully verified, the certificate request module 32 can generate an asymmetric key pair each time the system is restarted and package the device address code and the public key in the asymmetric key pair to generate a certificate signing request information, and send the certificate signing request information to the on-board network security authentication device 1, that is, request the on-board network security authentication device 1 to perform identity authentication. When the on-board network security authentication device 1 confirms the identity of the on-board network device 3 according to the certificate signing request information After the copy is verified to be legitimate, a temporary digital certificate is immediately issued to the on-board network device 3, completing its own security authentication. The temporary digital certificate and asymmetric key have a short lifespan, corresponding only to the duration of the software system running on the on-board network device 3. That is, when the system is restarted, the temporary digital certificate and asymmetric key are automatically deleted, necessitating a new temporary digital certificate to prevent leakage of the network device's private key. The third TLS communication module 33 can then establish a new TLS communication connection with the other on-board network device 3 with which it wishes to communicate. During this establishment, both parties' CA certificates must be mutually verified to ensure security. Furthermore, after the new TLS communication connection is established, both parties send their temporary digital certificates and device address codes (which can be the device address codes in their own operating system sockets) to the other party via the two-way authentication module 34. The other party then verifies whether the device address code sent by the other party matches the device address code contained in the temporary digital certificate. If the verification is successful, the application layer data exchange module 35 can then conduct application layer data exchange, i.e., data transmission, through the third TLS communication module 33, ensuring strong security.

[0065] Specifically, the temporary digital certificate also includes the certificate's validity period (issue date and expiration date), digital signature, identity information of the on-board network security authentication device 1, and certificate serial number. In addition, the asymmetric key and the temporary digital certificate are usually stored in the random access memory (RAM) of the on-board network device 3. When the system is restarted, the temporary digital certificate and asymmetric key will be automatically deleted.

[0066] In an optional embodiment of the present invention, Figure 1 As shown, the vehicle network device 3 also includes:

[0067] The update processing module 36 is connected to the second TLS communication module 31 and the memory 30, respectively, and is configured to receive a password update instruction and / or a certificate update instruction from the in-vehicle network security authentication device 1 via the second TLS communication module 31, and update the temporary login password and / or CA certificate in the memory 30 according to the password update instruction and / or the certificate update instruction. In this embodiment, the update processing module 36 also updates the temporary login password and CA certificate in the memory 30 according to the password update instruction and the certificate update instruction sent by the in-vehicle network security authentication device 1, thereby effectively preventing the temporary login password from being leaked and the private key of the asymmetric key pair from being leaked or guessed, thereby improving security.

[0068] In the specific implementation, it can be understood that before the car leaves the factory, the on-board network device 3 will pre-install the CA certificate, and then establish a TLS communication connection with the on-board network security authentication device 1 for the first time, and obtain and save the temporary login password from the on-board network security authentication device 1. Then, the on-board network security authentication device 1 will bind the temporary login password of each on-board network device 3 with the device address code; of course, before the car leaves the factory, each initialized on-board network device 3 is legal; in addition, the device address code can be the IP address and / or MAC address of the on-board network device 3.

[0069] In an optional embodiment of the present invention, the memory 30 is a hardware security module (HSM) or a security chip. In this embodiment, the use of a hardware security module or security chip to store temporary login passwords and CA certificates provides excellent physical protection and encryption performance, thereby enhancing data security.

[0070] On the other hand, if Figure 2 As shown, an embodiment of the present invention provides a vehicle-mounted network security authentication method, comprising the following steps:

[0071] S11: Verify the CA certificate pre-stored in the vehicle network device 3 and establish a TLS communication connection with the vehicle network device to achieve two-way secure communication;

[0072] S12: Sending a temporary login password to the in-vehicle network device 3 that establishes the TLS communication connection for the first time, receiving a device address code fed back by the in-vehicle network device 3, and binding the temporary login password and the device address code to each other and saving them;

[0073] S13: comparing the temporary login password and device address code sent by the in-vehicle network device 3 based on the TLS communication connection with the temporary login password and device address code that are bound and saved in advance, and disconnecting the TLS communication connection if it is determined that they do not match; and

[0074] S14: In response to the certificate signing request sent by the vehicle network device 3 based on the TLS communication connection, a temporary digital certificate is generated based on the public key and device address code included in the certificate signing request, and the temporary digital certificate is sent back to the vehicle network device 3 based on the TLS communication connection.

[0075] The embodiment of the present invention adopts the above method, and realizes two-way secure communication with the vehicle network device 3 by verifying the CA certificate pre-stored in the vehicle network device 3. The TLS communication connection is a communication method with data encryption and protection, which can effectively protect the transmitted data. When the TLS communication connection is first established, a temporary login password is sent to the vehicle network device 3 and the device address code fed back by the vehicle network device 3 is received. The temporary login password and the device address code are bound to each other and saved. When the TLS communication connection is established subsequently, the temporary login password and the device address code sent by the vehicle network device 3 can be judged by comparing them with the temporary login password and the device address code that are bound to each other in advance and saved in advance. Whether the password and the device address code match is used to determine whether the vehicle network device 3 is legal. If they do not match, the TLS communication connection with the vehicle network device 3 is immediately disconnected, thereby effectively preventing external malicious devices from impersonating the vehicle network device 3 to attack and authenticate, thereby improving security; further, the certificate signing request information sent by the vehicle network device 3 is received through the TLS communication connection, and a temporary digital certificate corresponding to the public key and device address code is generated based on the public key and device address code in the certificate signing request information, and the temporary digital certificate is sent to the corresponding vehicle network device 3 through the TLS communication connection, thereby achieving effective authentication of the corresponding vehicle network device 3 and improving the security of data transmission.

[0076] In an optional embodiment of the present invention, the method further includes:

[0077] Based on the TLS communication connection, a password update instruction and / or a certificate update instruction is randomly sent to the vehicle network device 3 to control the vehicle network device 3 to update the stored temporary login password and / or CA certificate accordingly.

[0078] In this embodiment, a password update instruction and a certificate update instruction are randomly sent to the vehicle network device 3 to control the vehicle network device 3 to update the stored temporary login password and CA certificate respectively, thereby effectively preventing the temporary login password from being leaked and the private key in the asymmetric key pair from being leaked or guessed, thereby improving security.

[0079] On the other hand, Figure 3 As shown, an embodiment of the present invention provides a vehicle-mounted network security authentication method, comprising the following steps:

[0080] S21: Establishing a TLS communication connection with the vehicle-mounted network security authentication device 1 based on the pre-stored CA certificate;

[0081] S22: receiving a temporary login password sent by the vehicle-mounted network security authentication device 1 based on the TLS communication connection and saving the temporary login password;

[0082] S23: sending the temporary login password and the device address code of the vehicle network device 3 to the vehicle network security authentication device 1 based on the TLS communication connection;

[0083] S24: regenerate an asymmetric key pair each time the vehicle network device 3 system is restarted, and package the device address code and the public key in the asymmetric key pair to generate a certificate signing request message; and

[0084] S25: sending the certificate signing request information to the in-vehicle network security authentication device 1 based on the TLS communication connection, then receiving and saving the temporary digital certificate generated and sent by the in-vehicle network security authentication device 1 based on the public key and the device address code;

[0085] S26: establishing a new TLS communication connection based on the CA certificate with another in-vehicle network device 3 that also establishes a TLS communication connection with the in-vehicle network security authentication device 1 and is to perform application layer data interaction;

[0086] S27: Mutual verification of the temporary digital certificate of the other party with the other in-vehicle network device 3 based on the new TLS communication connection;

[0087] S28: After the temporary digital certificates of each other are mutually verified, application layer data interaction is performed with the other in-vehicle network device 3 based on the new TLS communication connection.

[0088] The embodiment of the present invention uses the above method to establish a TLS communication connection with the on-board network security authentication device 1 based on the pre-stored CA certificate. The TLS communication connection is a communication method with data encryption and protection, which can effectively protect the transmitted data. When the TLS communication connection is first established, the device address code is sent to the on-board network security authentication device 1 through the TLS communication connection and a temporary login password is received. When the TLS communication connection is subsequently established with the on-board network security authentication device 1, the on-board network security authentication device 1 can verify the device address code and temporary login password of the on-board network device 3, thereby determining whether the on-board network device 3 is legal. When the temporary login password and the device address code are successfully verified, an asymmetric key pair can be generated each time the system is restarted, and the device address code and the public key in the asymmetric key pair can be packaged to generate a certificate signing request message, and the certificate signing request message is sent to the on-board network security authentication device 1, that is, the on-board network security authentication device 1 is requested to perform identity authentication. When the on-board network security authentication device 1 confirms the on-board network according to the certificate signing request information After device 3 confirms its identity, it issues a temporary digital certificate to vehicle network device 3, completing its own security authentication. Both the temporary digital certificate and the asymmetric key have a short lifespan, corresponding only to the duration of the software system on vehicle network device 3. This means that upon system restart, the temporary digital certificate and the asymmetric key are automatically deleted, necessitating a new temporary digital certificate application to prevent leakage of the network device's private key. A new TLS communication connection can then be established with the other vehicle network device 3 that requires communication. During this establishment, both parties' CA certificates must be mutually verified to ensure security. Furthermore, after the new TLS communication connection is established, both parties send their temporary digital certificates and device address codes (which can be the device address codes in their own operating system sockets) to the other party via the two-way authentication module 34. The other party verifies whether the device address code sent by the other party matches the device address code contained in the temporary digital certificate. If verification is successful, application-layer data exchange, i.e., data transmission, can be performed via the third TLS communication module 33, ensuring high security.

[0089] In an optional embodiment of the present invention, the method further includes:

[0090] A password update instruction and / or certificate update instruction from the vehicle-mounted network security authentication device is received based on the TLS communication connection, and the stored temporary login password and / or CA certificate are updated according to the password update instruction and / or certificate update instruction, respectively. In this embodiment, the temporary login password and CA certificate are stored according to the password update instruction and certificate update instruction sent by the vehicle-mounted network security authentication device 1, thereby effectively preventing the temporary login password from being leaked and the private key of the asymmetric key pair from being leaked or guessed, thereby improving security.

[0091] In an optional embodiment of the present invention, a hardware security module or security chip is used to store the CA certificate and the temporary login password. In this embodiment, the use of a hardware security module or security chip to store the temporary login password and CA certificate provides good physical protection and encryption performance, thereby improving data security.

[0092] If the functions described in the embodiments of the present invention are implemented as software modules or units and sold or used as independent products, they can be stored in a storage medium readable by a computing device. Based on this understanding, the portion of the embodiments of the present invention that contributes to the prior art or the portion of the technical solution can be embodied in the form of a software product, stored in a storage medium and including instructions for causing a computing device (which can be a personal computer, server, mobile computing device, or network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage media include various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks. The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the same or similar portions of the various embodiments.

[0093] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which fall within the scope of protection of the present invention.

Claims

1. A vehicle-mounted network security authentication device, characterized in that: The device comprises: A first TLS communication module is used to verify the CA certificate pre-stored in the vehicle network device and establish a TLS communication connection with the vehicle network device to achieve two-way secure communication; an initialization module, connected to the first TLS communication module, configured to send a temporary login password to the in-vehicle network device that has initially established a TLS communication connection with the first TLS communication module via the first TLS communication module, receive a device address code fed back by the in-vehicle network device, and bind the temporary login password and the device address code to each other and store them; a login management module connected to the first TLS communication module, configured to compare the temporary login password and device address code sent by the in-vehicle network device via the first TLS communication module with the temporary login password and device address code that are bound and saved in advance, and to issue a disconnection instruction to the first TLS communication module if it is determined that they do not match; and A certificate management module is connected to the first TLS communication module and the login management module, and is used to respond to the certificate signing request sent by the vehicle network device via the first TLS communication module, generate a temporary digital certificate based on the public key and device address code included in the certificate signing request, and send the temporary digital certificate back to the vehicle network device via the first TLS communication module.

2. The vehicle-mounted network security authentication device according to claim 1, wherein: The device further comprises: An update control module is connected to the first TLS communication module and is used to randomly send password update instructions and / or certificate update instructions to the vehicle network device through the first TLS communication module to control the vehicle network device to update the pre-stored temporary login password and / or CA certificate accordingly.

3. A vehicle-mounted network device, characterized in that: The vehicle network device includes: A memory, pre-stored with a CA certificate; a second TLS communication module, connected to the memory, configured to establish a TLS communication connection with the vehicle-mounted network security authentication device based on the CA certificate, receive a temporary login password sent by the vehicle-mounted network security authentication device, and store the temporary login password in the memory; a certificate request module, connected to the second TLS communication module and the memory, respectively, for sending the temporary login password and the device address code of the in-vehicle network device to the in-vehicle network security authentication device through the second TLS communication module, and regenerating an asymmetric key pair accordingly each time the in-vehicle network device system is restarted, packaging the device address code and the public key in the asymmetric key pair to generate certificate signing request information, sending the certificate signing request information to the in-vehicle network security authentication device through the second TLS communication module, and then receiving and storing the temporary digital certificate generated and sent by the in-vehicle network security authentication device based on the public key and the device address code; a third TLS communication module, connected to the certificate request module and the memory, configured to establish a new TLS communication connection based on the CA certificate with a third TLS communication module of another in-vehicle network device that also establishes a TLS communication connection with the in-vehicle network security authentication device and is to perform application layer data interaction; a two-way authentication module, connected to the third TLS communication module, configured to verify the temporary digital certificate of the other party with the two-way authentication module of the other in-vehicle network device through the third TLS communication module; and An application layer data interaction module is connected to the two-way authentication module and the third TLS communication module, and is used to interact with the application layer data interaction module of the other vehicle network device based on the new TLS communication connection after the temporary digital certificate of the other party is verified.

4. The vehicle-mounted network device according to claim 3, wherein: The vehicle network device further includes: An update processing module is connected to the second TLS communication module and the memory, respectively, and is used to receive password update instructions and / or certificate update instructions sent by the on-board network security authentication device through the second TLS communication module, and update the temporary login password and / or CA certificate in the memory according to the password update instructions and / or the certificate update instructions.

5. The vehicle-mounted network device according to claim 3, wherein: The memory is a hardware security module or a security chip.

6. A vehicle-mounted network security authentication method, characterized in that: The method comprises the following steps: Verify the CA certificate pre-stored in the vehicle network device and establish a TLS communication connection with the vehicle network device to achieve two-way secure communication; Sending a temporary login password to the vehicle network device that establishes the TLS communication connection for the first time and receiving the device address code fed back by the vehicle network device, and binding the temporary login password and the device address code to each other and saving them; comparing the temporary login password and device address code sent by the in-vehicle network device based on the TLS communication connection with the temporary login password and device address code that are bound and saved in advance, and disconnecting the TLS communication connection if it is determined that they do not match; and In response to the certificate signing request sent by the in-vehicle network device based on the TLS communication connection, a temporary digital certificate is generated based on the public key and device address code included in the certificate signing request, and the temporary digital certificate is returned to the in-vehicle network device based on the TLS communication connection.

7. The vehicle-mounted network security authentication method according to claim 6, wherein: The method further comprises: Based on the TLS communication connection, a password update instruction and / or a certificate update instruction is randomly sent to the vehicle network device to control the vehicle network device to correspondingly update a pre-stored temporary login password and / or CA certificate.

8. A vehicle-mounted network security authentication method, characterized in that: The method comprises the following steps: Establishing a TLS communication connection with the vehicle-mounted network security authentication device based on the pre-stored CA certificate; receiving a temporary login password sent by the vehicle-mounted network security authentication device based on the TLS communication connection and saving the temporary login password; Sending the temporary login password and the device address code of the vehicle network device to the vehicle network security authentication device based on the TLS communication connection; Regenerate an asymmetric key pair accordingly each time the in-vehicle network device system is restarted, and package the device address code and the public key in the asymmetric key pair to generate a certificate signing request message; Sending the certificate signing request information to the in-vehicle network security authentication device based on the TLS communication connection, then receiving and saving the temporary digital certificate generated and sent by the in-vehicle network security authentication device based on the public key and the device address code; Establishing a new TLS communication connection based on the CA certificate with another vehicle network device that also establishes a TLS communication connection with the vehicle network security authentication device and is about to perform application layer data interaction; Mutual verification of the temporary digital certificate of the other party with the other in-vehicle network device based on the new TLS communication connection; and After the temporary digital certificate of the other party is verified, application layer data interaction is performed with the other vehicle network device based on the new TLS communication connection.

9. The vehicle-mounted network security authentication method according to claim 8, wherein: The method further comprises: A password update instruction and / or a certificate update instruction sent by the in-vehicle network security authentication device is received based on the TLS communication connection, and a stored temporary login password and / or CA certificate is updated according to the password update instruction and / or the certificate update instruction respectively.

10. The vehicle-mounted network security authentication method according to claim 8, wherein: A hardware security module or a security chip is used to store the CA certificate and the temporary login password.

Images