An authentication method and system for Internet of Vehicles, a terminal and a storage medium

Abstract

The application discloses an authentication method and system for Internet of Vehicles, a terminal and a storage medium. The application comprises the following steps: deploying a BSF network element in a cellular network, completing identity authentication between a V2X device and the BSF network element, and enabling a NAF server to safely acquire user information and a key from the BSF network element. Based on the shared key between the NAF server and the V2X device, mutual identity confirmation is performed between the V2X device and the NAF server, and then the V2X device acquires relevant certificates from the NAF server to realize communication. The above process avoids direct authentication between the V2X device and the NAF server, and guarantees the safety and reliability of V2X communication.

Description

Technical Field

[0001] This application relates to, but is not limited to, V2X vehicle networking, and particularly to a V2X authentication method, system, terminal, and storage medium. Background Technology

[0002] With the development of Vehicle-to-Everything (V2X) communication, secure and reliable communication is crucial for safe driving. A prerequisite for V2X communication is authentication between the V2X device and the server. Currently, V2X devices use Public Key Infrastructure (PKI) authentication, specifically, the V2X device requests an authentication certificate from the server using its Vehicle Identification Number (VIN) before communicating. If a V2X device requests a certificate only once and consistently uses the same key, the information is more likely to be compromised. Conversely, if a V2X device frequently requests certificates to obtain different keys, the probability of intercepting critical information such as the vehicle's VIN increases, making the vehicle easier to track and potentially allowing its location information to be forged.

[0003] Therefore, existing authentication methods between V2X devices and servers cannot guarantee the security and reliability of communication, which can lead to the leakage and forgery of information in V2X communication. Summary of the Invention

[0004] The following is an overview of the subject matter described in detail herein. This overview is not intended to limit the scope of the claims.

[0005] This application provides a V2X authentication method, system, terminal, and storage medium. By deploying a Bootstrapping Server Function (BSF) network element in the cellular network, authentication is completed between the V2X device and the BSF network element. The Network Application Function (NAF) server can securely obtain user information and keys from the BSF. Based on the shared key between the NAF server and the V2X device, the V2X device and the NAF server mutually verify each other's identities. The V2X device then obtains the relevant certificate from the NAF server to achieve communication. This process avoids direct authentication between the V2X device and the NAF server, ensuring the security and reliability of V2X communication.

[0006] Firstly, embodiments of this application provide an authentication method for a vehicle-to-everything (V2X) network, comprising at least the following steps: a V2X device accesses the network; the V2X device initiates an authentication request to a BSF (Blockchain Service Provider) network element; the V2X device connects to the BSF network element and performs AKA (Automatic Access Authentication) to confirm the legitimacy of the V2X's identity; the V2X device determines whether authentication with the BSF network element is successful; if successful, it generates a key and establishes a secure communication channel with the BSF network element; the BSF network element guides the V2X device to request authentication from an NAF (Network Address Provider) server; after receiving the connection request from the V2X device, the NAF server requests authentication information from the BSF network element; the BSF network element sends a positive response to the NAF server; the NAF server and the V2X device mutually confirm and establish a secure transmission channel. This authentication method separates identity authentication and certificate authorization through the BSF network element, ensuring the security and reliability of V2X communication.

[0007] Secondly, this application also provides another authentication method for vehicle-to-everything (V2X) networks, which includes at least the following steps: A BSF network element obtains an authentication data set (rand, autn, XRES); the BSF network element sends the first authentication data rand and the second authentication data autn to the V2X device; the V2X device performs an AKA operation on the received rand to obtain the fourth authentication data autn and the fifth authentication data RES; when the second authentication data autn matches the fourth authentication data autn, it determines whether the third authentication data XRES matches the fifth authentication data RES; if the third authentication data XRES matches the fifth authentication data RES, the V2X device and the BSF network element successfully authenticate; the BSF network element obtains the sixth authentication data IK and the seventh authentication data CK; the V2X device performs an AKA operation on the received first authentication data rand to obtain the sixth authentication data IK and the seventh authentication data CK; the V2X device and the BSF network element generate a key based on the sixth authentication data IK and the seventh authentication data CK.

[0008] Thirdly, embodiments of this application also provide an authentication system for vehicle-to-everything (V2X) networks, including at least: an NAF server, a BSF network element, and a V2X device; the BSF network element includes a secure boot module and a first external communication module; the NAF server includes a certificate management module and a second external communication module; the V2X device includes an electronic certificate management module and an electronic certificate application module.

[0009] Fourthly, embodiments of this application also provide a terminal, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first or second aspect as above.

[0010] Fifthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for performing the methods described in the first or second aspects above.

[0011] This application embodiment deploys BSF network elements in the cellular network, enabling the identity authentication process to be completed between the BSF network elements and the V2X devices, while the certificate authorization process is completed between the NAF server and the V2X devices. The separation of the identity authentication process and the certificate authorization process ensures the security and reliability of V2X communication.

[0012] Meanwhile, the BSF network element provides the NAF server address to the V2X device. Therefore, the V2X device does not need to have the NAF server address built in. When the NAF server changes its address due to upgrades or other reasons, the V2X device does not need to be upgraded to update the NAF address, which reduces the maintenance cost of the V2X system.

[0013] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0014] The accompanying drawings are used to provide a further understanding of the technical solutions of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of this application and do not constitute a limitation on the technical solutions of this application.

[0015] Figure 1 A flowchart illustrating the V2X authentication method provided in this application embodiment;

[0016] Figure 2 This is a flowchart illustrating a method for a V2X device to request identity verification from an NAF server, as provided in another embodiment of this application.

[0017] Figure 3 This is a schematic diagram of a method for authenticating V2X device identity using a BSF network element, provided in another embodiment of this application.

[0018] Figure 4 A schematic flowchart of a V2X authentication method provided in another embodiment of this application;

[0019] Figure 5 A schematic diagram of the modules of the V2X authentication system provided in this application embodiment. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0021] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0022] In the description of the embodiments of this application, unless otherwise expressly limited, terms such as setting, installing, and connecting should be interpreted broadly, and those skilled in the art can reasonably determine the specific meaning of the above terms in the embodiments of this application in combination with the specific content of the technical solution.

[0023] A V2X communication system mainly consists of a device layer, a network layer, and an application layer. The device layer includes V2X devices, which can be vehicles, roadside units (RSUs), pedestrians, and other terminals that can communicate with the server. The network layer includes various communication networks such as cellular networks and WiFi that enable communication between V2X devices and the server. The application layer includes servers that provide vehicle-to-everything (V2X) services.

[0024] The Universal Subscriber Identity Module (USIM) is an upgraded SIM card used for user identification. In addition to supporting multiple applications, the USIM card features upgraded security algorithms and adds two-way authentication between the card and the network, effectively preventing hacker attacks on the card.

[0025] Electronic authentication services (Certificate Authority, CA) refer to activities that provide authenticity and reliability verification for parties involved in electronic signatures. CA certificates are issued by CA certification centers, which are authoritative bodies responsible for issuing and managing digital certificates. They are trusted third parties and bear the responsibility for verifying the legitimacy of public keys in the public key system. Root certificates are certificates issued by a CA certification center to itself; they are the starting point of the trust chain, and installing a root certificate signifies trust in that CA certification center.

[0026] In real-world V2X applications, such as collision warnings at intersections, when falsified information from an unauthenticated vehicle is broadcast to the public via the RSU, other vehicles receiving this message may mistakenly believe that a vehicle is at the intersection, thus issuing false alarms.

[0027] Based on this, embodiments of this application provide a V2X authentication method, system, terminal, and storage medium. By deploying BSF network elements in the cellular network, identity authentication is completed between the V2X device and the BSF network elements. The NAF server can securely obtain user information and keys from the BSF network elements. Based on the shared key between the NAF server and the V2X device, the V2X device and the NAF server mutually verify each other's identities. The V2X device then obtains the relevant certificate from the NAF server to achieve communication. This process avoids direct authentication between the V2X device and the NAF server, ensuring the security and reliability of V2X communication.

[0028] The embodiments of this application will be further described below with reference to the accompanying drawings.

[0029] One embodiment of this application discloses a V2X authentication method.

[0030] Figure 1 This is a flowchart illustrating the V2X authentication method provided in an embodiment of this application. Figure 1 The method shown includes at least the following steps:

[0031] Step S100: Access the cellular network.

[0032] In this embodiment of the application, the V2X device, BSF network element and NAF server need to access the cellular network.

[0033] In one embodiment, the V2X device determines whether a certificate request is required. A certificate request is required in the following situations: the V2X device lacks a PCA root certificate and a public key certificate; or the V2X device has a PCA root certificate and a public key certificate but the public key certificate has expired; or the V2X device has a PCA root certificate and a public key certificate but the public key certificate cannot decrypt its communication content. Specifically, this includes situations where the public key certificate has expired or the V2X device has not updated its certificate. The PCA root certificate is a type of CA root certificate. If the conditions for requiring a certificate are met, step S110 is executed; otherwise, step S240 is executed.

[0034] Step S110: The V2X device initiates an authentication request to the BSF network element.

[0035] In one embodiment, the BSF network element determines whether the number of authentication requests initiated by the V2X device exceeds a predetermined number, such as 10. If the number of authentication requests does not exceed the predetermined number, step S120 is executed; if it exceeds the predetermined number, step S240 is executed. The above determination mechanism can effectively prevent unauthorized devices from maliciously attempting multiple authentication attempts.

[0036] Step S120: The BSF network element authenticates the V2X device. If the authentication conditions are met, the BSF network element generates a key and notifies the V2X device of the authentication result, then proceeds to step S130; if the authentication conditions are not met, then proceeds to step S110.

[0037] Step S130: The V2X device determines whether the authentication was successful based on the authentication result notified by the BSF network element in step S120. If the authentication is successful, proceed to step S140; if the authentication fails, proceed to step S110.

[0038] Step S140: The V2X device generates a key, and the BSF network element establishes a communication channel with the V2X device. The BSF network element uses this channel to guide the V2X device and the NAF server to mutually verify their identities.

[0039] Step S150: The BSF network element guides the V2X device to initiate a connection request to the NAF server.

[0040] Figure 2 This is a flowchart illustrating a method for a V2X device to request identity verification from an NAF server, as provided in another embodiment of this application. The method includes at least the following steps:

[0041] Step S151: The BSF network element sends the NAF server address to the V2X device. Since the V2X device can obtain the NAF server address from the information sent by the BSF network element, it does not need to have the NAF server address built into the V2X device. When the NAF server changes its address due to upgrades or other reasons, the V2X device does not need to upgrade to update the NAF address, thus reducing the maintenance cost of the V2X system.

[0042] Step S152: The V2X device, carrying its generated key and USIM information, initiates a connection request to the NAF server.

[0043] Step S160: The NAF server requests the key and user identity information from the BSF network element.

[0044] In one embodiment, after receiving the connection request and USIM information sent by the V2X device, the NAF server requests the key and user identity information from the BSF network element.

[0045] Step S170: The BSF network element determines whether the user's key and the user's legitimate identity information exist as described in step S160.

[0046] In one embodiment, the BSF network element processes the received request from the NAF server and provides a corresponding response, determining whether the user's legitimate identity information and key exist based on the USIM information. If the user's legitimate identity information exists, the BSF network element returns a positive response to the NAF server and executes step S180; if the user's legitimate identity information does not exist, the BSF network element returns a negative response to the NAF server.

[0047] Step S180: The BSF network element sends the user's key and user identity information from step S160 to the NAF server.

[0048] Step S190: The NAF server determines whether the response returned by the BSF network element is a positive response. If it is a positive response, proceed to step S200; otherwise, proceed to step S210.

[0049] Step S200: The NAF server verifies the identity of the V2X device and establishes a communication channel.

[0050] In one embodiment, the NAF server obtains the key from the BSF network element and the key carried by the V2X device to realize identity verification between the NAF server and the V2X device. After identity verification, a communication channel between the NAF server and the V2X device is established.

[0051] Step S210: The NAF server notifies the V2X device that the connection is refused and executes step S110.

[0052] Step S220: The V2X device requests a certificate from the NAF server.

[0053] In one embodiment, the V2X device triggers the USIM to generate a public key and private key pair, stores the public key and private key, and then the V2X device reports the user identity information to the NAF server and applies for a PCA root certificate and a public key certificate.

[0054] Step S230: Store the certificate.

[0055] In one embodiment, the V2X device stores the obtained PCA root certificate and public key certificate on the V2X device.

[0056] Step S240: End.

[0057] Figure 3This is a schematic flowchart illustrating a method for authenticating V2X device identity using a BSF network element, provided in another embodiment of this application. In this embodiment, the BSF network element employs the AKA authentication method, which includes at least the following steps:

[0058] Step S121: The BSF network element obtains a set of authentication data from the HSS, sends some of the information to the V2X device, and then executes step S122.

[0059] In one embodiment, the authentication data includes at least the following information: random query number rand, network authentication token autn, expected authentication XRES, integrity key IK, and confidentiality key CK. The BSF network element sends rand and autn to the V2X device.

[0060] Step S122: The USIM of the V2X device performs AKA calculation on the received information.

[0061] In one embodiment, the USIM of the V2X device performs an AKA operation on the received rand to obtain the autn, and then performs an authentication response RES, IK, CK. The obtained autn is compared with the autn sent by the BSF network element. If the results are inconsistent, step S120 is executed; if the results are consistent, RES is returned to the BSF network element and step S123 is executed.

[0062] Step S123: The BSF network element compares RES with XRES. If the results match, the BSF network element generates a key based on IK and CK; if the results do not match, proceed to step S121.

[0063] Through the above steps, the BSF network element enables the authentication of V2X devices.

[0064] Figure 4 This application discloses an application management method flow in another embodiment of the present application.

[0065] V2X devices, BSF network elements and NAF servers need to access the cellular network.

[0066] The V2X device determines whether a certificate is required. If the conditions for requiring a certificate are met, the V2X device initiates an authentication request to the BSF network element.

[0067] The BSF network element determines whether the number of authentication requests initiated by the V2X device exceeds 10. If the number of authentication requests does not exceed 10, the BSF network element performs identity authentication on the V2X device.

[0068] Specifically, the BSF network element obtains a set of authentication data from the HSS, including the machine query number rand, the network authentication token autn, the expected authentication XRES, the integrity key IK, and the confidentiality key CK. The BSF network element then sends rand and autn to the V2X device.

[0069] The USIM of the V2X device performs an AKA operation on the received information to obtain the authentication response RES, IK, CK, and compares the obtained authentication response AUTN with the authentication response AUTN sent by the BSF network element. If the results match, RES is returned to the BSF network element.

[0070] The BSF network element compares RES with XRES. If the results match, the BSF network element generates a key based on IK and CK and notifies the V2X device of the authentication result.

[0071] The V2X device determines whether the authentication was successful based on the authentication result notified by the BSF network element. If the authentication is successful, the V2X device generates a key, and the BSF network element establishes a communication channel with the V2X device.

[0072] The BSF network element guides the V2X device to initiate a connection request to the NAF server. Specifically, the BSF network element sends the NAF server address to the V2X device. The V2X device, carrying its generated key and USIM information, initiates a connection request to the NAF server.

[0073] The NAF server requests the key and user identity information from the BSF network element.

[0074] The BSF network element determines whether the user's key and legitimate identity information exist. If the user's legitimate identity information exists, the BSF network element returns a positive response to the NAF server and sends the user's key and identity information to the NAF server.

[0075] The NAF server determines whether the response returned by the BSF network element is an affirmative response. If it is an affirmative response, the AF server verifies the identity of the V2X device and establishes a communication channel.

[0076] The V2X device requests a certificate from the NAF server. The V2X device triggers the USIM to generate a public and private key pair, stores the public and private keys, and then reports the user's identity information to the NAF server and requests a PCA root certificate and a public key certificate.

[0077] V2X device storage certificate.

[0078] The process has ended.

[0079] Figure 5The schematic diagram of the V2X authentication system provided in this application embodiment includes at least an NAF server, a BSF network element, and a V2X device. The NAF server includes a certificate management module and a second external communication module; the BSF network element includes a secure boot module and a first external communication module; and the V2X terminal includes an electronic certificate management module and an electronic certificate application module.

[0080] The Secure Boot module is used to guide the V2X device to perform secure authentication with the cellular network and apply for a CA root certificate and public key certificate from the NAF server; the External Communication module is used to obtain authentication information and communicate with the NAF server.

[0081] The certificate management module is used to generate certificates based on the identity information of the V2X device and the public key requested by the V2X device, and to respond to requests to download the certificates. The second external communication module is used to communicate with BSF network elements via signaling, guiding the NAF server to obtain the V2X key and identity information from the BSF network elements.

[0082] The electronic certificate application module is responsible for responding to BSF's guidance, generating public-private key pairs, and applying for a CA root certificate and public key certificate from the NAF server. The electronic certificate management module is responsible for certificate management and application, checking the existence of the CA root certificate, and periodically checking the validity of the public key certificate.

[0083] Based on this, the aforementioned V2X authentication system can separate the identity authentication process from the certificate authorization process in the V2X system, thus ensuring the security and reliability of V2X communication.

[0084] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0085] The above is a detailed description of the preferred embodiments of this application. However, this application is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. An authentication method for Internet of Vehicles, characterized in that, Comprising: Initiating an authentication request to a bootstrap server function network element; Identity authentication with the bootstrap server function network element; Establishing a secure communication channel with the bootstrap server function network element; Receiving the network application function server address sent by the bootstrap server function network element; Sending authentication information to the network application function server and initiating a connection request; Identity confirmation with the network application function server, establishing a secure communication channel; Generating a public key and a private key; Applying for a CA root certificate and a public key certificate from the network application function server.

2. The method of claim 1, wherein, Also comprising: Storing the CA root certificate and the public key certificate.

3. The method of claim 1, wherein, The identity authentication with the bootstrap server function network element comprises: Connecting with the bootstrap server function network element; Receiving the first authentication data group sent by the bootstrap server function network element; Based on the first authentication data group, performing AKA operation to obtain the second authentication data group; When the second authentication data group is consistent with the first authentication data group, the identity authentication is successful.

4. The method of claim 3, wherein, The identity confirmation with the network application function server comprises: The network application function server confirms the authentication information to the bootstrap server function network element; The network application function server receives the positive response of the bootstrap server function network element; Identity confirmation with the network application function server.

5. The method of claim 4, wherein, The authentication information at least includes one of the following: key information; global user identification card information; user identity information.

6. An authentication method for Internet of Vehicles, characterized in that, Comprising: The bootstrap server function network element obtains the first authentication data, the second authentication data, and the third authentication data; The bootstrap server function network element sends the first authentication data and the second authentication data to the Internet of Vehicles device; The Internet of Vehicles device performs authentication operation on the received first data and obtains the fourth authentication data and the fifth authentication data; When the second authentication data is consistent with the fourth authentication data, the bootstrap server function network element judges whether the fifth authentication data is consistent with the third authentication data; If the fifth authentication data is consistent with the third authentication data, the Internet of Vehicles device and the bootstrap server function network element are authenticated successfully, and a secure communication channel is established; The Internet of Vehicles device receives the network application function server address sent by the bootstrap server function network element; The Internet of Vehicles device sends authentication information to the network application function server and initiates a connection request; The Internet of Vehicles device and the network application function server perform identity confirmation, and establish a secure communication channel; The Internet of Vehicles device generates a public key and a private key; The Internet of Vehicles device applies for a CA root certificate and a public key certificate from the network application function server.

7. The method of claim 6, wherein, Also comprising: The bootstrap server function network element obtains the sixth authentication data and the seventh authentication data; The Internet of Vehicles device performs AKA operation on the received first authentication data and obtains the sixth authentication data and the seventh authentication data; Generating a key according to the sixth authentication data and the seventh authentication data.

8. An authentication system for Internet of Vehicles, characterized by, Comprising: The network application function server, the bootstrap server function network element, and the Internet of Vehicles device; The bootstrap server function network element comprises a secure boot guiding module and a first external communication module, and the secure boot guiding module is used for guiding the Internet of Vehicles device to perform security authentication with the cellular network and applying for a CA root certificate and a public key certificate from the network application function server; The network application function server comprises a certificate management module and a second external communication module, the certificate management module is used for generating a certificate according to identity information of the Internet of Vehicles device and a public key requested by the Internet of Vehicles device and responding to a request for downloading the certificate; The Internet of Vehicles device comprises an electronic certificate management module and an electronic certificate application module.

9. The system of claim 8, wherein: The first external communication module is used for obtaining authentication information and communicating with the network application function server; The second external communication module is used for obtaining a shared key and identity information of V2X from the bootstrapping server function network element in a signaling communication mode; The electronic certificate application module is responsible for responding to a bootstrapping service of the BSF, generating a public-private key pair and applying for a CA root certificate and a public key certificate from the network application function server; The electronic certificate management module is responsible for management and application of the certificate, detecting whether the CA root certificate exists and periodically detecting validity of the public key certificate.

10. A terminal comprising: Memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the method of any one of claims 1 to 7 when executing the computer program.

11. A computer readable storage medium storing computer executable instructions for performing the method of any one of claims 1 to 7.

Images