TEE-based vehicle engineering mode authentication method, system and device, and storage medium

Abstract

The invention belongs to the technical field of vehicle engineering mode authentication, and particularly relates to a TEE-based vehicle engineering mode authentication method, system and device and a storage medium, and the method comprises the steps: obtaining pre-collected vehicle engineering mode request data, and generating a one-time password based on a vehicle VIN code contained in the request data; responding to the password input by the user side, generating a one-time password in the TEE, and comparing the one-time password with the input password to realize authentication of the vehicle engineering mode; and if the comparison result is consistent, entering a vehicle engineering mode, and executing a symmetric key updatable mechanism. Through the scheme, authentication of the vehicle engineering mode can be efficiently and safely completed, and safe access of engineering modes such as vehicle diagnosis, debugging, testing, development and parameter setting based on a trusted execution environment is realized, so that the overall safety and reliability of a vehicle system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle engineering mode authentication, and specifically to a vehicle engineering mode authentication method, system, device and storage medium based on TEE. Background Art

[0002] With the rapid development of automotive electronics, the vehicle's engineering mode is becoming increasingly important. Engineering mode is primarily used for vehicle diagnosis, debugging, testing, development, and parameter setting, and is typically not accessible to ordinary users because it could affect the vehicle's normal operation or safety. However, existing engineering mode authentication methods have many problems:

[0003] 1. High dependency on diagnostic tools: Many vehicles require specialized diagnostic tools (such as OBD-II interface devices) to enter engineering mode. These tools need to be purchased separately, and different diagnostic tools often vary by vehicle model. This creates inconvenience for dealers and after-sales service, increasing costs and operational complexity.

[0004] 2. Specific operating procedures are easily leaked: Some vehicles enter engineering mode through specific operating procedures (such as a key combination). These operating procedures can be circulated on various automotive social media platforms, increasing vehicle safety risks. If these procedures are maliciously exploited, they could threaten the normal operation of the vehicle and the safety of drivers, passengers, and pedestrians. They could also cause financial losses to the manufacturer, such as affecting the value-added services provided by the manufacturer.

[0005] 3. Insufficient security: Some existing authentication methods cannot effectively prevent the reuse and leakage of passwords or operating steps, which poses a risk of being exploited by attackers and makes it difficult to ensure the security of the vehicle engineering model and user privacy.

[0006] Therefore, there is an urgent need for a safer, more convenient and efficient vehicle engineering mode authentication method to solve the problems existing in the existing technology. Summary of the Invention

[0007] Based on this, it is necessary to provide a TEE-based vehicle engineering mode authentication method, system, device and storage medium to address the above technical problems. By utilizing the security features of TEE, the one-time password mechanism and the symmetric key update mechanism, it effectively solves the problems existing in the existing vehicle engineering mode authentication method, such as insufficient security, dependence on diagnostic tools, and easy leakage of operation steps.

[0008] In order to achieve the above-mentioned object of the invention, the present invention adopts the following technical solutions:

[0009] In a first aspect, the present invention provides a vehicle engineering mode authentication method based on TEE, the method comprising:

[0010] Obtain pre-collected vehicle engineering mode request data and generate a one-time password based on the vehicle VIN code contained in the request data;

[0011] In response to the password entered by the user, a one-time password is generated in the TEE and compared with the input password to achieve vehicle engineering mode authentication;

[0012] If the comparison results are consistent, the vehicle engineering mode is entered and the symmetric key update mechanism is executed.

[0013] Optionally, obtaining pre-collected vehicle engineering mode request data includes:

[0014] According to the TEE authentication network configuration, the vehicle communication interface receives the request signal transmitted from the manufacturer's application; the transmitted request signal is analyzed to obtain the vehicle engineering mode request data carried by the request signal.

[0015] Optionally, generating a one-time password based on the vehicle VIN code included in the request data includes:

[0016] Read the vehicle VIN code contained in the request data;

[0017] The VIN code is encrypted with a symmetric key to generate a parameter K, which is combined with a time step parameter C set by the manufacturer to generate a one-time password through the HMAC-SHA-256 algorithm; and the one-time password is displayed to the user.

[0018] Optionally, generate a one-time password using the following formula:

[0019] TOTP(K,C)=truncate(HMAC(K,C));

[0020] Among them, K is the parameter generated by encrypting the VIN code with a preset symmetric key; C is the time step parameter.

[0021] Optionally, the step of responding to the password input by the user terminal and generating a one-time password in the TEE, and comparing the generated one-time password with the input password to achieve vehicle engineering mode authentication includes:

[0022] Obtain the one-time password entered by the user in the engineering mode entry interface of the vehicle computer and pass it to the TEE;

[0023] Inside the TEE, a one-time password is generated based on the same symmetric key, VIN code, time step parameters, and HMAC-SHA-256 algorithm, and compared with the input one-time password;

[0024] If the comparison results are consistent, the TEE sends a successful authentication signal to the vehicle computer, and the vehicle computer enters the engineering mode interface, opening the vehicle diagnosis, debugging, testing, development and parameter setting operations to the user;

[0025] If the comparison results are inconsistent, the TEE sends an authentication failure signal to the vehicle computer, and the vehicle computer prompts the user that the authentication failed and cannot enter the engineering mode.

[0026] Optionally, the execution of the symmetric key update mechanism includes: generating an asymmetric key in the TEE before the vehicle leaves the factory.

[0027] Key pair;

[0028] Export the public key and save it on the manufacturer's server. Use the public key to encrypt the symmetric key and transmit it to the vehicle.

[0029] The private key is used to decrypt in the TEE, obtain the symmetric key, and update it in the TEE secure storage area.

[0030] In a second aspect, the present invention provides a vehicle engineering mode authentication system based on TEE, the system comprising:

[0031] The recognition module is used to collect real-time monitoring data of vehicle driving, input the pre-established violation behavior recognition model, and predict the violation behavior of the vehicle during driving;

[0032] The application verification module is used to scan the application manifest file based on the in-vehicle voice service to verify the application capabilities if it determines that there is a violation of traffic regulations or irregular driving behavior that poses a safety risk;

[0033] A first reminder module is used to send a first reminder message to the driver after the verification is completed to correct the driving behavior;

[0034] The second reminder module is used to respond to the road congestion message displayed by the navigation device, generate a navigation plan based on the vehicle position and the environmental road information around the vehicle position, and send a second reminder message to the driver side to replan the route.

[0035] In a third aspect, the present invention provides an electronic device, comprising:

[0036] at least one processor; and,

[0037] a memory communicatively connected to the at least one processor; wherein,

[0038] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform any one of the methods according to the first aspect.

[0039] The TEE-based vehicle engineering mode authentication method, system, device, and storage medium proposed above utilize TEE as a secure computing environment to ensure that the one-time password generation and authentication process is performed in a trusted environment, effectively preventing the risk of password tampering or theft and improving the security of authentication.

[0040] The present invention adopts a one-time password mechanism. A new password is required each time the engineering mode is entered, and the password becomes invalid upon expiration. This avoids the risk of leakage caused by repeated use or long-term validity of traditional passwords, and enhances the security of engineering mode access.

[0041] To further enhance security, this invention supports symmetric key updates. Before a vehicle leaves the factory, an asymmetric key pair is generated in the TEE, and the public key is exported and stored on the manufacturer's server. The manufacturer encrypts the symmetric key using the public key and transmits it to the vehicle. The vehicle decrypts the symmetric key using the private key in the TEE and updates it in the TEE's secure storage area. This process can be repeated for future symmetric key updates, ensuring timely key updates and security, adapting to evolving security requirements.

[0042] The above-mentioned TEE-based vehicle engineering mode authentication method, system, device and storage medium realize safe and convenient access control to the vehicle engineering mode without adding specific diagnostic tools, and the operation steps cannot be repeated. The single password expires and becomes invalid, and there is no possibility of leakage, which effectively improves the security of the vehicle engineering mode and the level of user privacy protection. The method has high security, convenience and reliability, is easy to promote and apply, can provide more effective protection for the vehicle engineering mode, ensure the normal operation of the vehicle and user privacy, and is of great significance to improving the overall safety of the vehicle and user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly describes the drawings required for the specific embodiments or the description of the prior art. Similar elements or parts are generally identified by similar reference numerals throughout the drawings. Elements or parts in the drawings are not necessarily drawn to scale.

[0044] Figure 1 This is a flow chart of the vehicle engineering mode authentication method based on TEE provided by the present invention;

[0045] Figure 2 This is a schematic diagram of the structure of the vehicle engineering mode authentication device based on TEE provided by the present invention;

[0046] Figure 3 It is a diagram of the internal structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0047] The following embodiments of the technical solution of the present invention will be described in detail with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention and are therefore only examples and are not intended to limit the scope of protection of the present invention.

[0048] It should be noted that, unless otherwise specified, the technical or scientific terms used in this application should have the common meanings understood by those skilled in the art to which the present invention belongs.

[0049] The present invention provides a TEE-based vehicle engineering mode authentication method, system, device, and storage medium, specifically relating to a one-time password authentication scheme based on a Trusted Execution Environment (TEE), which is used for access control in engineering modes such as vehicle diagnosis, debugging, testing, development, and parameter setting.

[0050] A Trusted Execution Environment (TEE) is a secure area within the CPU that ensures the confidentiality and integrity of programs and data within it. A TEE is an isolated execution environment that can provide security features, such as isolated execution, ensuring the integrity of applications running alongside the TEE, and protecting the confidentiality of their assets. Generally speaking, a TEE provides a more secure execution space for trusted software, offering greater security than an operating system (OS) and greater functionality than a secure element (SE). The following describes embodiments of the present invention with reference to the accompanying drawings.

[0051] Example 1: Please refer to Figure 1 , Example 1 of the present invention provides a TEE-based vehicle engineering mode authentication method, the specific steps of the method include:

[0052] Real-time collection of vehicle driving monitoring data includes: when the vehicle enters a traffic control area, the real-time monitoring mode is turned on, the vehicle's external camera captures the traffic police's gesture image data on the road ahead, and the internal camera collects the current video stream;

[0053] S101 obtains pre-collected vehicle engineering mode request data and generates a one-time password based on the vehicle VIN code contained in the request data;

[0054] S102 responds to the password input by the user and generates a one-time password in the TEE. By comparing it with the input password, the vehicle engineering mode is authenticated.

[0055] If the comparison results are consistent in S103, the vehicle engineering mode is entered and the symmetric key update mechanism is executed.

[0056] In the above step S101, the acquisition of pre-collected vehicle engineering mode request data includes:

[0057] According to the TEE authentication network configuration, the vehicle communication interface receives the request signal transmitted from the manufacturer's application; the transmitted request signal is analyzed to obtain the vehicle engineering mode request data carried by the request signal.

[0058] In the above step S101, generating a one-time password based on the vehicle VIN code included in the request data includes:

[0059] Read the vehicle VIN code contained in the request data;

[0060] The VIN code is encrypted with a symmetric key to generate a parameter K, which is combined with a time step parameter C set by the manufacturer to generate a one-time password through the HMAC-SHA-256 algorithm; and the one-time password is displayed to the user.

[0061] In the above embodiment, the one-time password is generated by the following formula:

[0062] TOTP(K,C)=truncate(HMAC(K,C));

[0063] Among them, K is the parameter generated by encrypting the VIN code with a preset symmetric key; C is the time step parameter.

[0064] In step S102 above, the one-time password generated in the TEE in response to the password input by the user terminal is compared with the input password to achieve the authentication of the vehicle engineering mode, including:

[0065] Obtain the one-time password entered by the user in the engineering mode entry interface of the vehicle computer and pass it to the TEE;

[0066] Inside the TEE, a one-time password is generated based on the same symmetric key, VIN code, time step parameters, and HMAC-SHA-256 algorithm, and compared with the input one-time password;

[0067] If the comparison results are consistent, the TEE sends a successful authentication signal to the vehicle computer, and the vehicle computer enters the engineering mode interface, opening the vehicle diagnosis, debugging, testing, development and parameter setting operations to the user;

[0068] If the comparison results are inconsistent, the TEE sends an authentication failure signal to the vehicle computer, and the vehicle computer prompts the user that the authentication failed and cannot enter the engineering mode.

[0069] In the above step S103, the execution of the symmetric key update mechanism includes: generating a symmetric key in the TEE before the vehicle leaves the factory.

[0070] into an asymmetric key pair;

[0071] Export the public key and save it on the manufacturer's server. Use the public key to encrypt the symmetric key and transmit it to the vehicle.

[0072] The private key is used to decrypt in the TEE, obtain the symmetric key, and update it in the TEE secure storage area.

[0073] Based on the same inventive concept, the embodiment of the present application also provides a vehicle engineering mode authentication system based on TEE, the system comprising: a communication acquisition terminal installed at the vehicle and a communication receiving terminal installed at the receiving side;

[0074] The communication acquisition terminal includes:

[0075] Data acquisition module, used to collect vehicle engineering mode request data;

[0076] The data transmission module is used to transmit the collected request data through the pre-established TEE authentication network configuration parameters;

[0077] The communication receiving terminal includes:

[0078] A data receiving module, configured to receive a request signal transmitted by the communication acquisition terminal through the vehicle communication interface according to the TEE authentication network configuration;

[0079] A data parsing module, configured to parse the transmitted request signal to obtain vehicle engineering mode request data carried by the request signal;

[0080] The security authentication module is used to authenticate the vehicle engineering mode.

[0081] Optionally, based on the above methods S101-S103 and the TEE-based vehicle engineering mode authentication system, an embodiment of the present invention proposes a vehicle engineering mode authentication method, comprising the following steps:

[0082] 1. One-time Password Acquisition: Users enter their Vehicle Identification Number (VIN) through the manufacturer's app or website to obtain a one-time password. This app or website uses a specific algorithm to generate the one-time password. The parameter K is derived from the VIN encrypted with a preset symmetric key. The time step parameter C is determined by the manufacturer. HMAC uses the SHA-2 or higher algorithm, and the number of cipher bits is also determined by the manufacturer.

[0083] 2. Password Entry and Authentication: The user enters the one-time password into the vehicle's engineering mode entry. All authentication calculations are performed within the TEE. Specifically, after the password is entered into the TEE, the TEE uses the same algorithm to generate the one-time password and compares it with the entered password. If the comparison is successful, authentication is successful, and the user can enter engineering mode. If the comparison fails, authentication fails, and the user cannot enter engineering mode.

[0084] Example 1:

[0085] Obtaining a one-time password: The user installs the manufacturer's app on their phone, opens it, and enters the vehicle's VIN. The app uses a pre-configured algorithm to encrypt the VIN with a symmetric key to generate parameter K. Combined with the manufacturer's specified time step parameter C, the app generates a one-time password using the HMAC-SHA-256 algorithm and displays the password to the user. For example, if the manufacturer specifies a 6-digit password length and a 30-second time step, the user will receive a new 6-digit one-time password every 30 seconds.

[0086] Enter password and authenticate: The user enters the one-time password they received on the vehicle's Engineering Mode entry screen. The vehicle transmits the entered password to the TEE, which uses the same algorithm (based on the same symmetric key, VIN number, time step parameters, and HMAC-SHA-256 algorithm) to generate the one-time password and compares it with the entered password. If the comparison results match, the TEE sends a successful authentication signal to the vehicle, and the vehicle enters the Engineering Mode interface, where the user can perform vehicle diagnostics, debugging, testing, development, and parameter settings. If the comparison results are inconsistent, the TEE sends an authentication failure signal to the vehicle, notifying the user that the authentication failed and preventing entry into Engineering Mode.

[0087] Also includes:

[0088] 3. TEE application: Using TEE as a secure computing environment ensures that the generation and authentication process of one-time passwords are carried out in a trusted environment, effectively preventing the risk of password tampering or theft, and improving the security of authentication.

[0089] 4. One-time password authentication: A one-time password mechanism is used. A new password is required each time you enter the engineering mode, and the password will become invalid after it expires. This avoids the risk of leakage caused by repeated use or long-term validity of traditional passwords, and enhances the security of engineering mode access.

[0090] 5. Symmetric Key Updateability: To further enhance security, this invention supports symmetric key updates. Before a vehicle leaves the factory, an asymmetric key pair is generated in the TEE, and the public key is exported and stored on the manufacturer's server. The manufacturer encrypts the symmetric key using the public key and transmits it to the vehicle. The vehicle decrypts the symmetric key using the private key in the TEE and updates it in the TEE's secure storage area. Future symmetric key updates can be repeated, ensuring timely key updates and security, adapting to evolving security requirements.

[0091] Example 2: Symmetric key update process

[0092] Key generation and storage before vehicle shipment: During the vehicle production process, a pair of asymmetric keys (public and private) is generated within the vehicle's TEE. The public key is exported and saved to the manufacturer's server, while the private key is securely stored in the TEE's secure storage area.

[0093] Symmetric key encryption and transmission: When the manufacturer needs to update the symmetric key, it first generates a new symmetric key. It then encrypts the new symmetric key using the public key previously stored on the server, generating a ciphertext. The manufacturer then transmits this ciphertext to the vehicle via a secure communication channel.

[0094] Vehicle-side key decryption and update: After receiving the encrypted ciphertext, the vehicle passes it to the TEE. The TEE decrypts the ciphertext using the previously generated and stored private key to obtain a new symmetric key. The TEE then stores the new symmetric key in its secure storage area, replacing the old one, completing the symmetric key update process. The updated symmetric key is used for subsequent one-time password generation and authentication, ensuring authentication security.

[0095] Example 3: After-sales application

[0096] When a user sends their vehicle to an official after-sales service for repair or maintenance, after-sales staff can obtain a one-time password through the manufacturer's application. After entering the vehicle's VIN code, the application generates a one-time password and displays it to the staff. The staff enters the password into the engineering mode entry of the vehicle computer, and the vehicle computer completes the authentication process in the TEE. If the authentication is successful, the staff can enter the engineering mode to perform vehicle diagnosis and repair operations. Because the password is one-time, even if a third party obtains the password, it cannot be used again, effectively preventing unauthorized access to the engineering mode and ensuring vehicle safety and user privacy. At the same time, the entire process does not require the use of specific diagnostic tools, simplifying the after-sales operation process and improving work efficiency.

[0097] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0098] Based on the same inventive concept, the embodiment of the present application also provides a TEE-based vehicle engineering mode authentication device for implementing the above-mentioned TEE-based vehicle engineering mode authentication method. The implementation solution provided by the device is similar to the implementation solution described in the method of Example 1 above. Therefore, the specific limitations in the embodiments of one or more TEE-based vehicle engineering mode authentication devices provided below can be found in the above-mentioned limitations on a TEE-based vehicle engineering mode authentication method, and will not be repeated here.

[0099] In one embodiment, the present invention also provides a vehicle engineering mode authentication device based on TEE, such as Figure 2 As shown, it includes: an acquisition module 11, an authentication module 12 and an update module 13, wherein:

[0100] An acquisition module 11 is configured to acquire pre-collected vehicle engineering mode request data and generate a one-time password based on the vehicle VIN code included in the request data;

[0101] The authentication module 12 is used to respond to the password input by the user and generate a one-time password in the TEE. By comparing it with the input password, it can realize the authentication of the vehicle engineering mode.

[0102] The updating module 13 is used to enter the vehicle engineering mode and execute the symmetric key update mechanism if the comparison results are consistent.

[0103] At the same time, the present application also provides a computer-readable storage medium and an electronic device. In one embodiment, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method of any one of steps S101 to S103 is implemented.

[0104] In one embodiment, an electronic device is provided. The electronic device may be a terminal, and its internal structure diagram may be as follows: Figure 3As shown. The electronic device includes a processor, memory, a communication interface, a display screen, and an input device connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The communication interface of the electronic device is used to communicate with an external terminal in a wired or wireless manner. The wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication), or other technologies. When the computer program is executed by the processor, it implements any one of the methods from S101 to S104. The display screen of the electronic device can be a liquid crystal display screen or an electronic ink display screen. The input device of the electronic device can be a touch layer covering the display screen, or a key, trackball, or touchpad provided on the housing of the electronic device, or an external keyboard, touchpad, or mouse.

[0105] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0106] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0107] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0108] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0109] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0110] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the scope of the claims of the present invention to be approved.

Claims

1. A vehicle engineering mode authentication method based on TEE, characterized in that: The method comprises: Obtain pre-collected vehicle engineering mode request data and generate a one-time password based on the vehicle VIN code contained in the request data; In response to the password entered by the user, a one-time password is generated in the TEE and compared with the input password to achieve vehicle engineering mode authentication; If the comparison results are consistent, the vehicle engineering mode is entered and the symmetric key update mechanism is executed.

2. The method according to claim 1, wherein The obtaining of pre-collected vehicle engineering mode request data includes: According to the TEE authentication network configuration, the vehicle communication interface receives the request signal transmitted from the manufacturer's application; the transmitted request signal is analyzed to obtain the vehicle engineering mode request data carried by the request signal.

3. The method according to claim 1, wherein The generating of a one-time password based on the vehicle VIN code included in the request data includes: Read the vehicle VIN code contained in the request data; The VIN code is encrypted with a symmetric key to generate a parameter K, which is combined with a time step parameter C set by the manufacturer to generate a one-time password through the HMAC-SHA-256 algorithm; and the one-time password is displayed to the user.

4. The method according to claim 1, wherein Generate a one-time password using the following formula: TOTP(K,C)=truncate(HMAC(K,C)); Among them, K is the parameter generated by encrypting the VIN code with a preset symmetric key; C is the time step parameter.

5. The method according to claim 4, wherein The response to the password input by the user terminal and the generation of a one-time password in the TEE are compared with the input password to achieve the authentication of the vehicle engineering mode, including: Obtain the one-time password entered by the user in the engineering mode entry interface of the vehicle computer and pass it to the TEE; Inside the TEE, a one-time password is generated based on the same symmetric key, VIN code, time step parameters, and HMAC-SHA-256 algorithm, and compared with the input one-time password; If the comparison results are consistent, the TEE sends a successful authentication signal to the vehicle computer, and the vehicle computer enters the engineering mode interface, opening the vehicle diagnosis, debugging, testing, development and parameter setting operations to the user; If the comparison results are inconsistent, the TEE sends an authentication failure signal to the vehicle computer, and the vehicle computer prompts the user that the authentication failed and cannot enter the engineering mode.

6. The method according to claim 1, wherein The execution of the symmetric key update mechanism includes: generating an asymmetric key pair in the TEE before the vehicle leaves the factory; Export the public key and save it on the manufacturer's server. Use the public key to encrypt the symmetric key and transmit it to the vehicle. The private key is used to decrypt in the TEE, obtain the symmetric key, and update it in the TEE secure storage area.

7. A vehicle engineering mode authentication system based on TEE, characterized in that: The system comprises: a communication collection terminal installed at the vehicle and a communication receiving terminal installed at the receiving side; The communication acquisition terminal includes: Data acquisition module, used to collect vehicle engineering mode request data; The data transmission module is used to transmit the collected request data through the pre-established TEE authentication network configuration parameters; The communication receiving terminal includes: A data receiving module, configured to receive a request signal transmitted by the communication acquisition terminal through the vehicle communication interface according to the TEE authentication network configuration; A data parsing module, configured to parse the transmitted request signal to obtain vehicle engineering mode request data carried by the request signal; The security authentication module is used to authenticate the vehicle engineering mode.

8. A vehicle engineering mode authentication device based on TEE, characterized in that: The device comprises: An acquisition module, configured to acquire pre-collected vehicle engineering mode request data and generate a one-time password based on the vehicle VIN code contained in the request data; The authentication module is used to respond to the password entered by the user and generate a one-time password in the TEE. By comparing it with the input password, it can realize the authentication of the vehicle engineering mode. The update module is used to enter the vehicle engineering mode and execute the symmetric key update mechanism if the comparison results are consistent.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 6.

Images