Authentication method and apparatus

Abstract

The application provides an authentication method and device, which can solve the problem that the authentication process is easy to be attacked or cracked due to the verification of the access right of the access device in the service unit, thereby improving the security of the authentication process, and can be applied to a terminal device. The method comprises the following steps: a first device interacts with a second device through a first service unit, transmits first seed and second seed and other information, stores key information, such as a first key, which is avoided to be leaked, in a first authentication unit, and only performs an authentication operation in the first authentication unit to determine whether the second device has access right.

Description

Technical Field

[0001] This application relates to the field of communications, and more particularly to an authentication method and apparatus. Background Technology

[0002] With the development of communication technology, data interaction between devices is increasing. To prevent data leakage, when a device receives a data request from an accessing device, it often verifies whether the accessing device has the necessary permissions. For example, an in-vehicle electronic control unit (ECU) will first verify the permissions of the requesting diagnostic tool before providing data to the diagnostic tool or receiving firmware updates from it.

[0003] However, the direct authentication of access permissions within the business unit by the accessed device makes it easy for malicious actors to exploit business information within the business unit to attack or crack the authentication process of the accessed device, thereby gaining access rights. For example, they could use remotely accessible programs within the ECU to send key materials and other key information to the malicious actor's terminal, potentially leading to data leakage of the accessed device and even, in severe cases, modification of the program within the accessed device. Therefore, improving the security of the authentication process is a pressing technical problem that needs to be solved. Summary of the Invention

[0004] This application provides an authentication method and apparatus that can solve the problem that the authentication process is easily attacked or cracked due to the verification of access permissions to devices in business units, thereby improving the security of the authentication process.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] A first aspect provides an authentication method applied to a first device, which may include a first service unit and a first authentication unit. The authentication method includes: the first service unit receiving a first request from a second device, the first request being for requesting a first seed; the first service unit sending the first request to a first authentication unit; the first authentication unit sending a first response to the first service unit, the first response including the first seed; the first service unit sending the first response to the second device; the first service unit receiving a second seed from the second device; the first service unit sending the second seed to the first authentication unit; the first authentication unit determining a third seed based on a first key and the second seed, wherein the first key is determined based on the first seed; the first authentication unit determining a matching result between the third seed and the first seed; the first authentication unit sending the matching result to the first service unit; and the first service unit sending the matching result to the second device.

[0007] Based on the authentication method described in the first aspect, the first device interacts with the second device through a first business unit, transmitting information such as a first seed and a second seed. Meanwhile, the first authentication unit stores key information, such as a first key, to prevent leakage, and the authentication operation is performed only within the first authentication unit to determine whether the second device has access rights. In this way, the authentication operation in the first authentication unit is separated from the business information in the first business unit, solving the problem that the authentication process is vulnerable to attack or cracking due to verifying access rights within the business unit, thereby improving the security of the authentication process.

[0008] In one possible design, the authentication method described in the first aspect may further include: a first authentication unit determining a first key based on first key material, a first key generation algorithm, and a first seed. The first key material and the first key generation algorithm may be stored in the first authentication unit. This achieves isolation between business information and authentication-related information, preventing the theft of relevant information during the authentication process using business information, thereby ensuring the security of the authentication process.

[0009] Optionally, the first request may include an access level. Accordingly, before the first authentication unit determines the first key based on the first key material, the first key generation algorithm, and the first seed, the authentication method described in the first aspect may further include: the first authentication unit determining the first key material and the first key generation algorithm based on the access level. The access level may be related to the purpose of the second device's access request. For example, if access request 1 sent by the second device can be used to request access to the first device's data, then access request 1 may correspond to access level 1; if access request 2 sent by the second device can be used to request modification of the first device's program, then access request 2 may correspond to access level 4. Thus, the first device can determine the purpose of the second device's access to the first device based on the access level, thereby determining the corresponding first key material and first key generation algorithm for the access purpose, further improving the security of the authentication process.

[0010] Furthermore, if the second authentication unit also stores the correspondence between the set of second key materials and the second key generation algorithm and the access level, and the first authentication unit stores multiple sets of first key materials and first key generation algorithms, then the first authentication unit can quickly determine the set of first key materials and first key generation algorithms corresponding to the second key materials and the second key generation algorithm according to the access level, thereby improving authentication efficiency.

[0011] In another possible design, the sending of the second seed by the first business unit to the first authentication unit may include: the first business unit sending the second seed and identification information to the first authentication unit, the identification information corresponding to the first key. Accordingly, before the first authentication unit determines the third seed based on the first key and the second seed, the authentication method described in the first aspect may further include: the first authentication unit determining the first key based on the identification information. In this way, the first authentication unit and the first business unit can transmit only the identification information, without transmitting the key itself, thereby achieving isolation between the key information and the business information in the first business unit, further improving the security of the authentication process.

[0012] Furthermore, if the first device needs to verify the permissions of multiple second devices, the first authentication unit may store multiple first keys. After the first device receives the second seeds from multiple second devices, the first authentication unit can also quickly determine the corresponding first key based on the identification information corresponding to the first key, thereby improving the efficiency of the first authentication unit in verifying permissions.

[0013] Furthermore, the authentication method described in the first aspect may further include: a first authentication unit sending identification information to a first business unit, the identification information being determined based on a first key. In this way, generating identification information corresponding to the first key in the first authentication unit can prevent malicious actors from attacking and cracking the first key through business information, thereby improving the security of the authentication process.

[0014] Optionally, the authentication method described in the first aspect may further include: the first authentication unit deleting the first key. Thus, when the second device accesses the first device again, the first authentication unit can regenerate the key to re-verify the second device's permissions, preventing malicious actors from impersonating the second device to access the first device after the second device's access ends, thereby further improving the security of the authentication process.

[0015] Secondly, an authentication method is provided, applied to a second device, which may include a second service unit and a second authentication unit. The authentication method includes: the second authentication unit sending a first request to the second service unit, the first request being for requesting a first seed; the second service unit sending the first request to the first device; the second service unit receiving a first response from the first device, the first response including the first seed; the second service unit sending the first response to the second authentication unit; the second authentication unit sending a second seed to the second service unit; wherein the second seed is determined based on the first seed and a second key, and the second key is determined based on the first seed; the second service unit sending the second seed to the first device; and the second service unit receiving a matching result sent from the first device.

[0016] In one possible design, the method described in the second aspect above may further include: a second authentication unit determining a second key based on second key material, a second key generation algorithm, and a first seed. The second key material and the second key generation algorithm may be stored in the second authentication unit.

[0017] Optionally, the method described in the second aspect above may further include: the second authentication unit deleting the second key.

[0018] Furthermore, the technical effects of the authentication method described in the second aspect can be referred to the technical effects of the authentication method described in the first aspect, and will not be repeated here.

[0019] Thirdly, an authentication device is provided. The authentication device includes a first service unit and a first authentication unit. The first service unit is configured to receive a first request from a second device, the first request requesting a first seed. The first service unit is further configured to send the first request to a first authentication unit. The first authentication unit is configured to send a first response to the first service unit, the first response including the first seed. The first service unit is further configured to send the first response to the second device. The first service unit is further configured to receive a second seed from the second device. The first service unit is further configured to send the second seed to the first authentication unit. The first authentication unit is further configured to determine a third seed based on a first key and the second seed. The first key is determined based on the first seed. The first authentication unit is further configured to determine a matching result between the third seed and the first seed. The first authentication unit is further configured to send a matching result to the first service unit. The first service unit is further configured to send the matching result to the second device.

[0020] In one possible design, the first authentication unit is further configured to determine the first key based on the first key material, the first key generation algorithm, and the first seed, wherein the first key material and the first key generation algorithm are stored in the first authentication unit.

[0021] Optionally, the first request may include an access level. Accordingly, the first authentication unit is further configured to determine the first key material and the first key generation algorithm based on the access level.

[0022] In another possible design, the first business unit is further configured to send a second seed and identification information to the first authentication unit, the identification information corresponding to the first key. The first authentication unit is further configured to determine the first key based on the identification information.

[0023] Furthermore, the first authentication unit is also used to send identification information to the first business unit, the identification information being determined based on the first key.

[0024] Optionally, the first authentication unit is also used to delete the first key.

[0025] Optionally, the first business unit and the first authentication unit can also be integrated into a single unit, such as a processing unit. The processing unit is used to implement the processing functions of the authentication device described in the third aspect.

[0026] Optionally, the authentication device described in the third aspect may further include a storage unit storing a program or instructions. When the processing unit executes the program or instructions, the authentication device described in the third aspect can perform the authentication method described in the first aspect.

[0027] Optionally, the authentication device described in the third aspect may further include a transceiver unit. The transceiver unit is used to implement the transceiver functions of the authentication device described in the third aspect. Further, the transceiver unit may include a receiving unit and a sending unit. The receiving unit and the sending unit are respectively used to implement the receiving function and the sending function of the authentication device described in the third aspect.

[0028] It should be noted that the authentication device described in the third aspect may be a terminal device, or a chip (system) or other component or assembly that can be set in the terminal device, or a device that includes the terminal device. This application does not limit this.

[0029] It should be understood that the authentication apparatus described in the third aspect includes modules, units, or means that implement the authentication method described in the first aspect. These modules, units, or means can be implemented in hardware, software, or by hardware executing corresponding software. The hardware or software includes one or more modules or units for performing the functions involved in the aforementioned authentication method.

[0030] Furthermore, the technical effects of the authentication device described in the third aspect can be referenced by the technical effects of the authentication method described in the first aspect, and will not be repeated here.

[0031] Fourthly, an authentication device is provided. The authentication device includes: a second service unit and a second authentication unit; wherein the second authentication unit is configured to send a first request to the second service unit, the first request being for requesting a first seed. The second service unit is configured to send the first request to a first device. The second service unit is further configured to receive a first response from the first device, the first response including the first seed. The second service unit is further configured to send the first response to the second authentication unit. The second authentication unit is further configured to send a second seed to the second service unit. The second seed is determined based on the first seed and a second key, the second key being determined based on the first seed. The second service unit is further configured to send the second seed to the first device. The second service unit is further configured to receive a matching result sent from the first device.

[0032] In one possible design, the second authentication unit is further configured to determine the second key based on the second key material, the second key generation algorithm, and the first seed. The second key material and the second key generation algorithm are stored in the second authentication unit.

[0033] Optionally, the second authentication unit is also used to delete the second key.

[0034] Optionally, the second business unit and the second authentication unit can also be integrated into a single unit, such as a processing unit. The processing unit is used to implement the processing functions of the authentication device described in the fourth aspect.

[0035] Optionally, the authentication device described in the fourth aspect may further include a storage unit storing a program or instructions. When the processing unit executes the program or instructions, the authentication device described in the fourth aspect can perform the authentication method described in the second aspect.

[0036] Optionally, the authentication device described in the fourth aspect may further include a transceiver unit. The transceiver unit is used to implement the transceiver functions of the authentication device described in the fourth aspect. Further, the transceiver unit may include a receiving unit and a sending unit. The receiving unit and the sending unit are respectively used to implement the receiving function and the sending function of the authentication device described in the fourth aspect.

[0037] It should be noted that the authentication device described in the fourth aspect may be a terminal device, or a chip (system) or other component or assembly that can be set in the terminal device, or a device that includes the terminal device. This application does not limit it in this regard.

[0038] It should be understood that the authentication apparatus described in the fourth aspect includes modules, units, or means that implement the authentication method described in the second aspect above. These modules, units, or means can be implemented in hardware, software, or by hardware executing corresponding software. The hardware or software includes one or more modules or units for performing the functions involved in the aforementioned authentication method.

[0039] Furthermore, the technical effects of the authentication device described in the fourth aspect can be referenced by the technical effects of the authentication method described in the second aspect, and will not be repeated here.

[0040] Fifthly, an authentication device is provided. This authentication device is used to perform the authentication method described in the first or second aspect.

[0041] In this application, the authentication device described in the fifth aspect may be the first device described in the first aspect, or the second device described in the second aspect, or may be a chip (system) or other component or assembly disposed in the aforementioned devices, or a device containing the aforementioned devices.

[0042] It should be understood that the authentication apparatus described in the fifth aspect includes modules, units, or means that implement the authentication methods described in the first or second aspect above. These modules, units, or means can be implemented in hardware, software, or by hardware executing corresponding software. The hardware or software includes one or more modules or units for performing the functions involved in any of the authentication methods described above.

[0043] Furthermore, the technical effects of the authentication device described in the fifth aspect can be referenced from the technical effects of the authentication method described in the first or second aspect, and will not be repeated here.

[0044] A sixth aspect provides an authentication apparatus. The authentication apparatus includes a processor configured to perform the authentication method described in the first or second aspect.

[0045] In one possible design, the authentication device described in the sixth aspect may further include a transceiver. This transceiver may be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the authentication device described in the sixth aspect and other authentication devices.

[0046] In one possible design, the authentication device described in the sixth aspect may further include a memory. This memory may be integrated with the processor or disposed separately. The memory may be used to store computer programs and / or data involved in the authentication method described in the first or second aspect.

[0047] In this application, the authentication device described in the sixth aspect may be the first device in the first aspect, the second device in the second aspect, or a chip (system) or other component or assembly disposed in the aforementioned devices, or a device comprising the aforementioned devices.

[0048] Furthermore, the technical effects of the authentication device described in the sixth aspect can be referenced from the technical effects of the authentication method described in the first or second aspect, and will not be repeated here.

[0049] A seventh aspect provides an authentication device. The authentication device includes a processor coupled to a memory, the processor executing a computer program stored in the memory to cause the authentication device to perform the authentication method described in the first or second aspect.

[0050] In one possible design, the authentication device described in the seventh aspect may further include a transceiver. This transceiver may be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the authentication device described in the seventh aspect and other authentication devices.

[0051] In this application, the authentication device described in the seventh aspect may be the first device in the first aspect, the second device in the second aspect, or a chip (system) or other component or assembly disposed in the aforementioned devices, or a device comprising the aforementioned devices.

[0052] Furthermore, the technical effects of the authentication device described in the seventh aspect can be referenced from the technical effects of the authentication method described in the first or second aspect, and will not be repeated here.

[0053] Eighthly, an authentication apparatus is provided, comprising: a processor and a memory; the memory is used to store a computer program, which, when executed by the processor, causes the authentication apparatus to perform the authentication method described in the first or second aspect.

[0054] In one possible design, the authentication device described in the eighth aspect may further include a transceiver. This transceiver may be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the authentication device described in the eighth aspect and other authentication devices.

[0055] In this application, the authentication device described in the eighth aspect may be the first device in the first aspect, the second device in the second aspect, or a chip (system) or other component or assembly disposed in the aforementioned devices, or a device comprising the aforementioned devices.

[0056] Furthermore, the technical effects of the authentication device described in the eighth aspect can be referenced from the technical effects of the authentication method described in the first or second aspect, and will not be repeated here.

[0057] A ninth aspect provides an authentication apparatus comprising: a processor; the processor being configured to be coupled to a memory and, after reading a computer program from the memory, to execute an authentication method as described in the first or second aspect according to the computer program.

[0058] In one possible design, the authentication device described in the ninth aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the authentication device described in the ninth aspect and other authentication devices.

[0059] In this application, the authentication device described in the ninth aspect may be the first device in the first aspect, the second device in the second aspect, or a chip (system) or other component or assembly disposed in the aforementioned devices, or a device comprising the aforementioned devices.

[0060] Furthermore, the technical effects of the authentication device described in the ninth aspect can be referenced by referring to the technical effects of the authentication method described in the first or second aspect, and will not be repeated here.

[0061] In a tenth aspect, a processor is provided. The processor is used to execute the authentication method described in the first or second aspect.

[0062] Eleventhly, an authentication system is provided. The authentication system includes a first device and a second device.

[0063] In a twelfth aspect, a computer-readable storage medium is provided, comprising: a computer program or instructions; when the computer program or instructions are executed on a computer, the computer causes the computer to perform the authentication method described in the first or second aspect.

[0064] In a thirteenth aspect, a computer program product is provided, comprising a computer program or instructions that, when executed on a computer, cause the computer to perform the authentication method described in the first or second aspect. Attached Figure Description

[0065] Figure 1 This is a schematic diagram of the interaction of an authentication system;

[0066] Figure 2 Schematic diagram of the authentication system provided in the embodiments of this application Figure 1 ;

[0067] Figure 3 Schematic diagram of the authentication system provided in the embodiments of this application Figure 2 ;

[0068] Figure 4 Flowchart of the authentication method provided in the embodiments of this application Figure 1 ;

[0069] Figure 5 Interaction diagram of the authentication system provided in the embodiments of this application Figure 1 ;

[0070] Figure 6 Flowchart of the authentication method provided in the embodiments of this application Figure 2 ;

[0071] Figure 7 Interaction diagram of the authentication system provided in the embodiments of this application Figure 2 ;

[0072] Figure 8 Schematic diagram of the authentication device provided in the embodiments of this application Figure 1 ;

[0073] Figure 9 Schematic diagram of the authentication device provided in the embodiments of this application Figure 2 ;

[0074] Figure 10Schematic diagram of the authentication device provided in the embodiments of this application Figure 3 . Detailed Implementation

[0075] The existing technical solutions will now be described in conjunction with the accompanying drawings.

[0076] In the Unified Diagnostic Services (UDS) protocol, if a diagnostic instrument needs to access data in the electronic control unit (ECU), the ECU will pre-verify the diagnostic instrument's permissions. The specific implementation of this authentication method can be found below. Figure 1 The authentication system shown.

[0077] refer to Figure 1 The authentication system includes a diagnostic tool and an electronic control unit (ECU). The diagnostic tool and ECU store key materials and key generation algorithms, respectively. The diagnostic tool can initiate a secure access request to the ECU, which requests the ECU to return a random seed.

[0078] Therefore, the electronic control unit can generate a first random number (seed) and return it to the diagnostic instrument. This first random number is used to request the diagnostic instrument to generate the corresponding key using the same key generation method as the electronic control unit. Furthermore, the electronic control unit can generate a first key based on its stored key generation algorithm and key materials, as well as the first random number.

[0079] After receiving the returned first random number, the diagnostic instrument can use the same key generation method as the electronic control unit (ECU), that is, generate a second key (key') based on its stored key generation algorithm and key materials, as well as the first random number. Furthermore, the diagnostic instrument can use the second key to encrypt the first random number, obtaining a second random number (seed'), and send this second random number to the ECU. This second random number corresponds to the second key.

[0080] Accordingly, the electronic control unit can use the previously generated first key to decrypt the second random number, obtain a third random number (seed"), and compare the first and third random numbers. If they are the same, it indicates that the electronic control unit can confirm that the diagnostic instrument uses the same key generation method as the electronic control unit and can generate the same key as the electronic control unit. That is, it confirms that the key materials and key generation algorithm stored in the diagnostic instrument are the same as those stored in the electronic control unit. In this case, the electronic control unit can confirm that the diagnostic instrument has access rights and returns the comparison result of the first and third random numbers to the diagnostic instrument. Similarly, if they are different, the electronic control unit can confirm that the diagnostic instrument does not have access rights, returns the comparison result to the diagnostic instrument, and rejects the access request.

[0081] In the aforementioned authentication system, the electronic control unit (ECU) directly verifies the diagnostic instrument's permissions within the operational environment, even placing key materials and encryption algorithms within this environment. This operational environment contains not only the information required for authentication but also operational information, such as the ECU's management program or programs for remotely accessing the ECU's data. Consequently, malicious actors can easily exploit this additional operational information to gain access to the ECU, attack or crack the authentication process within the operational environment, and steal key materials and encryption algorithms, resulting in extremely low security for the authentication process.

[0082] To enhance the security of the authentication process, this application provides an authentication method that improves security by setting up a business unit and an authentication unit, and performing authentication operations only in the authentication unit, which is isolated from the business operation environment. The technical solution of this application will be described below with reference to the accompanying drawings.

[0083] The technical solution of this application can be applied to various authentication systems or various communication systems that need to perform authentication methods, such as wireless fidelity (WiFi) systems, vehicle to everything (V2X) communication systems, device-to-device (D2D) communication systems, and vehicle networking communication systems.

[0084] This application will present various aspects, embodiments, or features relating to systems that may include multiple devices, components, modules, etc. It should be understood and appreciated that individual systems may include additional devices, components, modules, etc., and / or may not include all the devices, components, modules, etc. discussed in conjunction with the accompanying drawings. Furthermore, combinations of these approaches are also possible.

[0085] Furthermore, in the embodiments of this application, words such as "exemplarily" and "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as an "example" in this application should not be construed as being better or more advantageous than other embodiments or designs. Rather, the use of the word "example" is intended to present the concept in a specific manner.

[0086] In the embodiments of this application, the terms "information," "signal," "message," "channel," and "singaling" may sometimes be used interchangeably. It should be noted that, without emphasizing their distinction, they all convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing their distinction, they all convey the same meaning.

[0087] In the embodiments of this application, sometimes the subscript such as W1 may be mistakenly written as a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0088] First, let's introduce the technical terms used in the embodiments of this application.

[0089] 1. Security Sandbox: A security mechanism in the field of computer security that provides an isolated environment for running programs. Security sandboxes typically strictly control the resources that applications can access. For example, access to the network, access to the computer system, and reading data on the computer are usually prohibited or strictly restricted in a security sandbox.

[0090] For ease of understanding, the following will be used as an example. Figure 2 and Figure 3 Taking the authentication system shown in the figure as an example, the authentication system to which the authentication method provided in the embodiments of this application is applicable will be described in detail.

[0091] In one possible design scheme, Figure 2 Schematic diagram of the authentication system provided in the embodiments of this application Figure 1 .like Figure 2 As shown, the authentication system includes a first device and a second device. The first device can be one or more, and may include a first business unit and a first authentication unit. Correspondingly, the second device can be one or more, and may include a second business unit and a second authentication unit.

[0092] For example, if a first service unit of a first device receives an access request from a second service unit of a second device, the first device can perform authentication services in its first authentication unit, and the second device can also perform corresponding authentication services in its second authentication unit. This allows the first device to verify whether the second device has access rights. Specific implementation details can be found below. Figures 4-5 The method embodiments shown are not described in detail here.

[0093] Optionally, when there are multiple second devices, Figure 2The first device shown may include multiple first service units (as described above) Figure 2 (Not shown in the diagram), different first service units are used to receive access requests from different second devices and forward the access requests to the first security unit, so that the first device can verify the permissions of multiple second devices simultaneously. Specific implementation methods can be found in the following method embodiments, which will not be repeated here.

[0094] Optionally, when there are multiple first devices, Figure 2 The second device shown may include multiple second service units (as described above) Figure 2 (Not shown in the diagram), different second service units can receive corresponding access requests from the second authentication unit and send access requests to their respective first devices, thereby enabling a second device to send authentication requests to multiple first devices to access multiple second devices. Specific implementation details can be found in the following method embodiments, and will not be elaborated upon here.

[0095] In another possible design scheme, Figure 3 Schematic diagram of the architecture of the authentication system to which the authentication method provided in the embodiments of this application is applicable. Figure 2 .like Figure 3 As shown, the authentication system includes a first device and a third device. The first device can be one or more, and may include a first business unit and a first authentication unit. The third device can be one or more, and may include a third business unit.

[0096] For example, if the first device receives an access request from the third device, the third device can also perform the authentication method using existing technology, that is, directly perform the authentication service in the third service unit, while the first device can perform the authentication service in the first authentication unit. Thus, the first device can verify whether the third device has access rights. Specific implementation methods can be found below. Figures 6-7 The method embodiments shown are not described in detail here.

[0097] Optionally, when there are multiple third devices, Figure 3 The first device shown may include multiple first service units (as described above) Figure 3 (Not shown in the diagram), different first service units are used to receive access requests from different third devices and forward the access requests to the first security unit, so that the first device can verify the permissions of multiple third devices simultaneously. Specific implementation methods can be found in the following method embodiments, which will not be repeated here.

[0098] The following is combined with Figure 2 and Figure 3 The two authentication systems shown are explained in detail. Figure 2 The first and second devices shown, and Figure 3 The first and third devices shown.

[0099] The first, second, and third devices can be terminals that access the aforementioned authentication system and have wireless transceiver capabilities, or chips or chip systems that can be installed in such terminals. These terminal devices can also be referred to as user devices, access terminals, user units, remote terminals, mobile devices, user terminals, terminals, wireless communication devices, user agents, or user equipment. In the embodiments of this application, the terminal device can be a wireless terminal in self-driving vehicles, a wireless terminal in transportation safety, an in-vehicle terminal, or an RSU with terminal functionality. The terminal device in this application can also be an in-vehicle module, in-vehicle component, in-vehicle chip, or in-vehicle unit built into a vehicle as one or more components or units, such as a diagnostic tool or an in-vehicle electronic control unit. The vehicle can implement the authentication method provided in this application through the built-in in-vehicle module, in-vehicle component, in-vehicle chip, or in-vehicle unit.

[0100] Accordingly, the first service unit, the second service unit, the third service unit, the first authentication unit, and the second authentication unit can be chips, chip systems, or other components or parts installed in the aforementioned device. The functions of the first service unit, the second service unit, and the third service unit can be implemented through the computing unit in the aforementioned device. They can interact with other devices and exchange information required during the authentication process, such as access requests and random seeds, with the corresponding authentication units. The functions of the first authentication unit and the second authentication unit can be implemented through the security unit in the aforementioned device. They can execute authentication methods within their built-in security sandbox, or they can use hardware encryption to encrypt and store the corresponding key materials and key encryption algorithms. Specific implementation methods can be found in the following method embodiments, which will not be elaborated upon here.

[0101] It should be noted that the scheme in this application embodiment can also be applied to other authentication systems, and the corresponding name can be replaced by the name of the corresponding function in other authentication systems.

[0102] It should be understood that Figure 2 or Figure 3 This is a simplified illustration for ease of understanding only. The authentication system may also include other first devices, and / or other second devices. Figure 2 or Figure 3 It was not drawn in the middle.

[0103] The following will combine Figures 4-7 The authentication method provided in the embodiments of this application will be described in detail.

[0104] For example, Figure 4Flowchart of the authentication method provided in the embodiments of this application Figure 1 This authentication method can be applied to Figure 2 The authentication system shown below is an example of... Figure 2 The authentication system shown is an example.

[0105] like Figure 4 As shown, the authentication method includes the following steps:

[0106] S401, the second authentication unit sends a first request to the second service unit, and the second service unit receives the first request from the second authentication unit. The first request is used to request a first seed (seed1).

[0107] Specifically, the second authentication unit and the second service unit can transmit the first request through an internal bus or signal line. This application embodiment does not limit the specific implementation of the information transmission between the second authentication unit and the second service unit.

[0108] S402, the second business unit sends a first request to the first business unit, and the first business unit receives the first request from the second business unit.

[0109] For example, the second authentication unit can be Figure 2 The second authentication unit and the second service unit in the second device shown can be... Figure 2 The second device shown contains a second service unit. The second authentication unit can store authentication-related information, such as a first request and a second key, and can also perform authentication operations, such as determining the first request and generating the second key. The second service unit only forwards the authentication-related information and does not perform any authentication operations, thereby improving the security of the authentication process. The first request can be an authentication request, and the first seed can be a random number generated by the first device, which can be used to verify the permissions of the second device. The specific implementation of the first seed can be found in the relevant content of S416 below, and will not be repeated here.

[0110] Specifically, when the second device needs to access data in the first device, the second authentication unit of the second device can generate a first request and send it to the second service unit. The second service unit can then forward this first request to the first device so that the first device can determine the second device's permissions. In this way, the second service unit in the second device can forward authentication-related information and perform business operations that exclude authentication, while the second authentication unit can only perform authentication operations. This ensures that authentication operations are separated from business information within the second service unit, preventing the theft of key information using business information and thus improving the security of the authentication process in the second device.

[0111] It should be noted that the first device can verify the permissions of a second device that has a second authentication unit and a second service unit configured, as well as the permissions of an existing second device that only has a service unit configured. For specific implementation details, please refer to the following: Figure 6 The method embodiments shown are not described in detail here.

[0112] Furthermore, the second service unit and the first service unit can transmit messages, such as the first request, via wired or wireless means. Wired means can include transmission methods such as cables, optical fibers, and network cables, while wireless means can include wireless connections based on one or more wireless communication protocols. This application does not limit the specific implementation of information transmission between the second service unit and the first service unit.

[0113] S403, the first business unit sends a first request to the first authentication unit, and the first authentication unit receives the first request from the first business unit.

[0114] S404, the first authentication unit sends a first response to the first service unit, and the first service unit receives the first response from the first authentication unit. The first response includes a first seed.

[0115] Specifically, in S403 and S404 above, the first service unit and the first authentication unit can transmit the first request and the first response through an internal bus or signal line. The specific implementation of the information transmission between the first service unit and the first authentication unit in this application embodiment is not limited.

[0116] For example, the first business unit can be Figure 2 The first service unit and the first authentication unit in the first device shown can be... Figure 2 The first authentication unit in the first device shown is capable of storing authentication-related information, such as a first seed and a first key (key1), and can also perform authentication operations, such as generating the first seed and the first key. The first service unit only forwards authentication-related information, such as the first and second seeds, without performing authentication operations, thereby improving the security of the authentication process. The first seed can be a pseudo-random number from a pseudo-random number sequence calculated using a deterministic algorithm, where the pseudo-random number sequence is uniformly distributed from [0,1]. It should be noted that the aforementioned pseudo-random number is merely one example of the first seed, and the specific implementation of the first seed in this application embodiment is not limited.

[0117] When the first device receives a first request, the first service unit can forward the request to the first authentication unit. The first authentication unit then generates a random number as a first seed, which is forwarded to the second device by the first service unit. This allows both the first and second devices to generate corresponding keys based on the same first seed, and then use these keys to verify the second device's authorization. In this way, the first service unit in the first device can forward authentication-related information and perform business operations that exclude authentication, while the first authentication unit can only perform authentication operations. This ensures that authentication operations are separated from the business information within the first service unit, preventing the theft of key information using business information and thus improving the security of the authentication process in the first device.

[0118] It should be noted that the first business unit can establish a session between the first device and the second device based on the first request, and generate and return the corresponding session identifier to the second device.

[0119] For example, the session identifier may include the device identifier of the first device or the address identifier of the first device. Thus, if the first device needs to verify the permissions of multiple second devices simultaneously, when the first service unit receives information from the second device again, the first service unit can perform corresponding actions based on the session identifier, such as sending the session identifier to the first authentication unit to find the first seed corresponding to the second device. The specific implementation of the session identifier can be found in the relevant descriptions of S412 or S413 below, and will not be repeated here.

[0120] S405, the first authentication unit determines the first key based on the first seed.

[0121] For example, the first key is a key generated by the first authentication unit based on the first seed. The first key can be used to decrypt the second seed transmitted by the second device to obtain the third seed. By comparing whether the decrypted third seed is the same as the first seed, the authorization of the first device can be verified. The specific implementation of authentication using the first key can be referred to the relevant description of S413 below, and will not be repeated here.

[0122] In one possible design, in step S405 above, the first authentication unit determines the first key based on the first seed. This can include: the first authentication unit determining the first key based on the first key material, the first key generation algorithm, and the first seed. Thus, generating the first key within the first authentication unit can be isolated from other business processes within the business unit, thereby improving the security of the authentication process.

[0123] The first key material and the first key generation algorithm are stored in the first authentication unit.

[0124] For example, the first key material can be a set of data pre-set in the first authentication unit before leaving the factory, and the first key generation algorithm can be an algorithm pre-set in the first authentication unit before leaving the factory. This algorithm is used to generate a corresponding key based on the key material and the first seed, so that the generated first key can correspond to the first key material and the first key generation algorithm. For example, it can be an encryption algorithm such as Advanced Encryption Standard (AES) or RSA. It should be noted that the above encryption algorithms are only a few examples of first key generation algorithms, and the specific implementation of the first key generation algorithm is not limited in the embodiments of this application.

[0125] Accordingly, before the first device and the second device leave the factory, the same key material and key generation algorithm can be encapsulated in the first authentication unit of the first device and the second authentication unit of the second device with access rights. This allows the first device to verify the permissions of the second device during the verification process, enabling both devices to generate the same key based on the same random seed. Consequently, the second device can access the data in the first device after being authenticated by the first device. Specifically, the implementation of the first key material and the first key generation algorithm can be found in the relevant description of S416 below, and will not be repeated here.

[0126] It should be noted that the first authentication unit can store multiple first key materials and multiple first key generation algorithms. When the first device receives requests from different second devices, the first authentication unit can use the first key material and first key generation algorithm corresponding to the second device to generate a corresponding key, thereby verifying the permissions of the corresponding second device. The specific implementation method for determining the first key material and the first key generation algorithm is described below.

[0127] Optionally, the aforementioned first request may include an access level (level ID). Accordingly, before the aforementioned first authentication unit determines the first key based on the first key material, the first key generation algorithm, and the first seed, Figure 4 The authentication method shown may further include: the first authentication unit determining the first key material and the first key generation algorithm according to the access level.

[0128] For example, the access level can be information used to characterize the purpose of the access request. Accordingly, the first authentication unit can store the correspondence between the set of first key materials and the first key generation algorithm and the access level. The first authentication unit can determine the first key materials and the first key generation algorithm corresponding to the access request according to different access levels.

[0129] For example, suppose the access level represents the degree of danger, such as levels 1 to N, where N is a positive integer. If the purpose of the access request is for a second device to access data in a first device, the second authentication unit can set the access level corresponding to the access request to level 2. Accordingly, the first authentication unit can select a set A of first key materials and first key generation algorithms based on the access level of level 2. If the purpose of the access request is for a second device to modify a program in a first device, the second authentication unit can set the access level corresponding to the access request to level 5. Accordingly, the first authentication unit can select a set B of first key materials and first key generation algorithms based on the access level of level 5.

[0130] In this way, the first device can determine the purpose of the second device accessing the first device based on the access level, and thus determine the corresponding first key material and first key generation algorithm for the access purpose, that is, to specifically verify the first device's permissions and improve the security of the authentication process.

[0131] It should be noted that an access level can correspond to a set of key generation algorithms and key materials, and a set of key generation algorithms and key materials can correspond to one or more access levels. The embodiments of this application do not limit the specific correspondence between the set of key generation algorithms and key materials and the access level.

[0132] Furthermore, if the second authentication unit also stores the correspondence between the set of second key materials and the second key generation algorithm and the access level, and the first authentication unit stores multiple sets of first key materials and first key generation algorithms, then the first authentication unit can quickly determine the set of first key materials and first key generation algorithms corresponding to the second key materials and the second key generation algorithm based on the access level, thereby improving authentication efficiency.

[0133] Continuing with the example above, suppose the second authentication unit stores a set C of second key materials and second key generation algorithms, and set C corresponds to access level 2. Then, the first authentication unit can quickly determine the set A of first key materials and first key generation algorithms corresponding to set B based on access level 2. The specific implementation of the first key materials and first key generation algorithms can be found in the relevant description of S416 below, and will not be repeated here.

[0134] Optionally, the first authentication unit may also determine the corresponding first key material and first key generation algorithm based on the device identifier of the second device.

[0135] For example, the device identifier of the second device may be the identifier information determined by the first business unit according to the first request, and the first authentication unit may pre-store the correspondence between the set of first key materials and the set of first key generation algorithms and the device identifier. Thus, when the first authentication unit stores multiple sets of first key materials and first key generation algorithms, the first authentication unit can quickly determine the set of first key materials and first key generation algorithms corresponding to the second key materials and first key generation algorithms in the second device based on the device identifier, thereby improving authentication efficiency.

[0136] Optionally, Figure 4 The authentication method shown may also include: the first authentication unit sending identification information (key id) to the first business unit, the identification information being determined based on the first key.

[0137] For example, the identification information can be the identifier of the first key. In this way, the first key is stored in the first authentication unit, and the first business unit and the first authentication unit can transmit only the identification information without transmitting the key itself, thus achieving isolation between business information and the first key, preventing the theft of the first key using business information, and ensuring the security of the authentication process. The specific implementation method for determining the first key based on the identification information can be found in the relevant description of S413 below, and will not be repeated here.

[0138] It should be noted that if the first authentication unit needs to verify the permissions of multiple second devices simultaneously, it may store multiple first keys. The first authentication unit can also quickly determine the corresponding first key based on the identification information associated with the first key, thereby improving the efficiency of the first authentication unit in verifying permissions.

[0139] It should be noted that S405 can be executed after the first authentication unit determines the first seed, i.e., after S404, or before the first device decrypts using the first key, i.e., before S413. The embodiments of this application do not limit the execution order of S405; S405 can be executed before or after any of the steps S406-S412.

[0140] S406, the first service unit sends a first response to the second service unit, and the second service unit receives the first response from the first service unit. The first response includes a first seed.

[0141] Specifically, the second service unit and the first service unit can transmit the first response via wired or wireless means. For specific implementation details, please refer to the relevant description of S402 above, which will not be repeated here.

[0142] S407, the second business unit sends a first response to the second authentication unit, and the second authentication unit receives the first response from the second business unit.

[0143] Specifically, the second service unit and the second authentication unit can transmit the first response through a communication bus or signal line. The specific implementation of the information transmission between the second service unit and the second authentication unit can be referred to the relevant description of S401 above, and will not be repeated here.

[0144] S408, the second authentication unit determines the second key (key2) based on the first seed.

[0145] For example, the second key is a key generated by the second authentication unit based on the first seed. The second key can be used to encrypt the first seed transmitted by the first device to obtain the second seed (seed2). The first device can then decrypt the second seed using the first key to obtain the third seed (seed3). The first device can then compare the third seed with the first seed to verify whether it has the necessary permissions.

[0146] It should be noted that by having the first business unit interact with the second device, and by having the second business unit forward the first seed to the second authentication unit, business information and authentication operations can be separated, preventing malicious actors from attacking the authentication unit through business information, thereby improving the security of the authentication process.

[0147] Optionally, in step S408 above, the second authentication unit determining the second key based on the first seed may include: the second authentication unit determining the second key based on the second key material, the second key generation algorithm, and the first seed. In this way, generating the second key in the second authentication unit can be separated from other services in the second business unit, thereby improving the security of the authentication process.

[0148] The second key material and the second key generation algorithm are stored in the second authentication unit.

[0149] For example, the specific implementation of the second key material and the second key generation algorithm is similar to the implementation of the first key material and the first key generation algorithm in S405 above, and will not be repeated here.

[0150] It should be noted that during the key generation process, both the first and second devices use the same first seed and their own stored key materials and key generation algorithms to generate corresponding first and second keys, respectively. Thus, by verifying whether the first and second keys generated by the second device are the same, it can be determined whether the key materials and key generation algorithms stored in the first and second devices are identical. Therefore, the first device can identify the second device, which has the same key materials and key generation algorithm, as the second device with access rights. The specific implementation of verifying the identity of the first and second keys can be found in the relevant description of S416 below, and will not be repeated here.

[0151] Optionally, if in S404 above, the first service unit establishes a session between the first device and the second device according to the first request and generates a corresponding session identifier, then the first response may also include the session identifier. In this way, the first device and the second device can subsequently use the session identifier to identify the information exchanged between them. The specific implementation of the session identifier can be found in the relevant descriptions in S412 or S413 below, and will not be repeated here.

[0152] Furthermore, if the second authentication unit stores a set of multiple second key materials and second key generation algorithms so that the second device can pass the authentication process of multiple first devices, the second authentication unit can quickly determine the corresponding set of second key materials and second key generation algorithms based on the aforementioned session identifier or the device identifier of the first device, thereby obtaining the corresponding second key and improving authentication efficiency.

[0153] S409, the second authentication unit determines the second seed based on the first seed and the second key.

[0154] For example, the second authentication unit can use the second key to encrypt the first seed to obtain the second seed, which is the ciphertext corresponding to the first seed. Thus, by encrypting the first seed in the second authentication unit, the encryption process can be isolated from other business information, thereby preventing malicious actors from stealing the second key during the encryption process and improving the security of the authentication process.

[0155] It should be noted that since the second seed is the ciphertext corresponding to the first seed encrypted with the second key, the first key can be used to decrypt the second seed later. This allows comparison of the decrypted seed with the first seed to verify whether the first and second keys are the same. The specific implementation of the second seed can be found in the relevant description of S413 below, and will not be repeated here.

[0156] Optionally, such as Figure 4The authentication method shown may further include: the second authentication unit deleting the second key. Thus, when the second device accesses the first device again, the second authentication unit can regenerate the key to re-verify the second device's permissions, preventing malicious actors from impersonating the second device to access the first device after the second device's access ends, thereby further enhancing the security of the authentication process.

[0157] It should be noted that the step of the second authentication unit deleting the second key can be performed after the second seed is determined, that is, after S409, or after receiving the matching result from the first device, that is, after S416. The embodiments of this application do not limit the execution order of the step of the second authentication unit deleting the second key, and can be performed before or after any of the steps S410-S416.

[0158] S410, the second authentication unit sends the second seed to the second service unit, and the second service unit receives the second seed from the second authentication unit.

[0159] Specifically, the second authentication unit and the second service unit can transmit the second seed through an internal bus or signal line. The specific implementation of the transmission of the second seed between the second authentication unit and the second service is similar to the specific implementation of the transmission of the first request in S401 above, and will not be repeated here.

[0160] S411, the second service unit sends a second seed to the first service unit, and the first service unit receives the second seed from the second service unit.

[0161] Specifically, the second service unit and the first service unit can transmit the second seed via wired or wireless means. The specific implementation of transmitting the second seed between the second service unit and the first service unit is similar to the specific implementation of transmitting the first request in S402 above, or similar to the specific implementation of transmitting the first response in S406 above, and will not be described again here.

[0162] S412, the first service unit sends the second seed to the first authentication unit, and the first authentication unit receives the second seed from the first service unit.

[0163] Thus, through the forwarding between the second business unit and the first business unit, the first authentication unit can receive the second seed from the second authentication unit, thereby isolating the authentication process from other business information and improving the security of the authentication process. The specific implementation of the second seed can be found in the relevant description of S413 below, and will not be repeated here.

[0164] Optionally, if the first response in S406 above also includes a session identifier, then in S411 above, the second service unit sending a second seed to the first service unit and the first service unit receiving the second seed from the second service unit may include: the second service unit sending a second seed and a session identifier to the first service unit, and the first service unit receiving the second seed and the session identifier from the second service unit.

[0165] Furthermore, in the above S412, the first service unit sends a second seed to the first authentication unit, and the first authentication unit receives the second seed from the first service unit, which may include: the first service unit sending the second seed and a session identifier to the first authentication unit, and the first authentication unit receiving the second seed and the session identifier from the first service unit.

[0166] Thus, when the first device verifies the permissions of multiple second devices simultaneously, the first device can quickly find information related to the authentication process of the second device based on the session identifier. For example, the second authentication unit can quickly determine the first seed corresponding to the second seed based on the session identifier. The specific implementation of the session identifier can be found in the relevant description of S413 below, and will not be repeated here.

[0167] Furthermore, the first authentication unit and the first service unit can transmit the second seed through an internal bus or signal line. The specific implementation of transmitting the second seed between the first authentication unit and the first service is similar to the specific implementation of transmitting the first request and the first response in S403 or S404 above, and will not be repeated here.

[0168] S413, the first authentication unit determines the third seed based on the first key and the second seed.

[0169] For example, the first authentication unit can use the first key to decrypt the second seed to obtain the third seed, which is the plaintext corresponding to the second seed. Thus, since the second seed is obtained by the second device encrypting the first seed using the second key, the first authentication unit can determine whether the first key and the second key are the same by comparing the third seed and the first seed. This allows the unit to determine whether the second device possesses the same key materials and key generation algorithm as the first device, and ultimately, whether the second device has the necessary access rights. The specific implementation of comparing the third seed and the first seed can be found in the description of S414 below, and will not be repeated here.

[0170] Optionally, in S412 above, the first service unit sends a second seed to the first authentication unit, and the first authentication unit receives the second seed from the first service unit. This may include: the first service unit sending the second seed and identification information to the first authentication unit, and the first authentication unit receiving the second seed and identification information from the first service unit. The identification information corresponds to the first key. Accordingly, prior to S413 above, Figure 4 The authentication method shown may further include: the first authentication unit determining the first key based on the identification information.

[0171] For example, the first business unit can send identification information to the first authentication unit, so that the first authentication unit can call the first key corresponding to the identification information, thereby achieving isolation between the business information in the first business unit and the first key, and thus improving the security of the first key storage.

[0172] Furthermore, when the first authentication unit stores multiple first keys, the first authentication unit can also quickly find the first key corresponding to the second seed based on the identification information, thereby improving the efficiency of verifying the permissions of the second device.

[0173] Optionally, if in S411 above, the first service unit receives the second seed and session identifier from the second device, then before the first service unit sends the second seed and identifier information to the first authentication unit, Figure 4 The authentication method shown may also include: the first business unit determining the corresponding identification information based on the session identifier.

[0174] For example, when the first device verifies the permissions of multiple second devices simultaneously, the first service unit can store multiple identification information. The first service unit can directly determine the identification information corresponding to the second seed based on the session identifier, thereby improving authentication efficiency.

[0175] Optionally, the above Figure 4 The authentication method shown may also include: the first authentication unit deleting the first key.

[0176] In this way, when the second device accesses the first device again, the first authentication unit can regenerate the key to re-verify the second device's permissions, preventing malicious actors from impersonating the second device to access the first device after the second device's access ends, thereby further improving the security of the authentication process.

[0177] It should be noted that the step of the first authentication unit deleting the first key can be performed after the third seed is determined, that is, after S413, or after the matching result is sent to the second device, that is, after S416. The embodiments of this application do not limit the execution order of the step of the first authentication unit deleting the first key, and can be performed before or after any of the steps S414-S416.

[0178] S414, the first authentication unit determines the matching result between the third seed and the first seed.

[0179] S415, the first authentication unit sends the matching result to the first service unit, and the first service unit receives the matching result from the first authentication unit.

[0180] Specifically, the first authentication unit and the first service unit can transmit the matching result through an internal bus or signal line. The specific implementation method for transmitting the matching result between the first authentication unit and the first service is similar to the specific implementation method for transmitting the first request and the first response in S403 or S404 above, and will not be repeated here.

[0181] S416, the first service unit sends the matching result to the second service unit, and the second service unit receives the matching result from the first service unit.

[0182] For example, the matching result can be used to characterize whether the second device has access rights. If the matching result is that the third seed is the same as the first seed, it can be said that the first key generated by the first device is the same as the second key generated by the second device. This can be used to determine that the first key material and the first key generation algorithm in the first device are the same as the second key material and the second key generation algorithm in the second device. Therefore, it can be said that the second device has the right to access the first device, and the first device can allow the second device to access.

[0183] Correspondingly, if the matching result is that the third seed is different from the first seed, it may indicate that the first key generated by the first device and the second key generated by the second device are different. Therefore, the first key material and the first key generation algorithm in the first device may be different from the second key material and the second key generation algorithm in the second device. This may further indicate that the second device does not have permission to access the first device, and the first device may not allow the second device to access it.

[0184] In this way, the first device determines the matching result of the first seed and the third seed in the first authentication unit, and then the second business unit forwards the matching result to the second business unit, thereby isolating the authentication process from other business information and improving the security of the authentication process.

[0185] It should be noted that the first authentication unit can determine the corresponding first seed based on the first key, or it can quickly determine the corresponding first seed directly based on the session identifier information. The specific implementation of the first authentication unit determining the first seed in this application embodiment is not specifically limited.

[0186] It should be noted that in S416, if the matching result shows that the third seed is the same as the first seed, the first service unit can send the matching result to the second service unit. If the matching result shows that the third seed is different from the first seed, and the second device has a timeout mechanism set, that is, the second device starts timing when executing S411 above, and when the timing duration reaches the preset duration, the second device determines that the authentication of the first device has failed, and the first device rejects the access request, then the first service unit may not send the matching result to the second service unit. If the matching result shows that the third seed is different from the first seed, and the second device has not set a timeout mechanism, then the first service unit can also send the matching result to the second service unit, that is, S416 is an optional step.

[0187] Furthermore, the second service unit and the first service unit can transmit the matching result via wired or wireless means. The specific implementation method for transmitting the matching result between the second service unit and the first service unit can be found in the specific implementation method for transmitting the first request in S402 above, and will not be repeated here.

[0188] Furthermore, after the second device learns the matching result, if the matching result is the same, the second device can send an access request corresponding to the access level to the first device. The access request can be used to request data corresponding to the first device, or it can be used to request the first device to receive a program from the second device. The specific implementation of the access request is not limited in this application embodiment.

[0189] Accordingly, if the matching results are different, the second device is rejected by the first device, so the second device can send a second request to the first device. The second request can be used to request the first device to re-verify the access rights of the second device. The embodiments of this application do not limit the steps that the second device performs after authentication is completed.

[0190] Based on the above Figure 4 The aforementioned authentication method involves a first device interacting with a second device through a first business unit, transmitting information such as a first seed and a second seed. The first authentication unit stores confidential key information, such as a first key, and performs authentication operations only within this unit to determine if the second device has access rights. This separates the authentication operations in the first authentication unit from the business information in the first business unit, addressing the vulnerability of the authentication process to attacks or breaches caused by verifying access rights within the business unit, thereby improving the security of the authentication process.

[0191] For example, Figure 5 Interaction diagram of the authentication system provided in the embodiments of this application Figure 1 This authentication system can specifically achieve the above. Figure 4 The authentication method shown is shown.

[0192] like Figure 5 As shown, the authentication system includes an electronic control unit and a diagnostic instrument. The electronic control unit may include a first computing unit and a first security unit, and the diagnostic instrument may include a second computing unit and a second security unit.

[0193] The first device mentioned above can be Figure 5 The electronic control unit shown above, the second device can be Figure 5 The diagnostic instrument shown is shown. Figure 4 The function of the first authentication unit shown can be determined by Figure 5 The first security unit shown is implemented, Figure 4 The function of the first business unit shown can be determined by Figure 5 The first computing unit shown is implemented. Figure 4 The function of the second authentication unit shown can be determined by Figure 5 The second security unit shown is implemented, Figure 4 The function of the second business unit shown can be provided by Figure 5 The second computing unit shown is implemented.

[0194] like Figure 5 The second security unit of the diagnostic instrument can initiate a security access request to the second computing unit, and the second computing unit can send the security access request to the first computing unit of the electronic control unit. The first computing unit sends the security access request to the first security unit. The security access request can be used to request the electronic control unit to return a random seed.

[0195] Therefore, the first security unit can generate a first seed (seed1) and send it to the first computing unit, which then forwards the first seed to the diagnostic instrument. The second computing unit can also forward the first seed to the second security unit. This first random number is used to request the second security unit to generate the corresponding key using the same key generation method as the first security unit. Furthermore, the first security unit can generate a first key (key1) based on the first seed and its stored key generation algorithm and key materials.

[0196] After receiving the returned first seed, the second security unit can use the same key generation method as the first security unit, that is, generate a second key (key2) based on the first seed and its stored key generation algorithm and key materials. Furthermore, the second security unit can use the second key to encrypt the first seed, obtaining the second seed (seed2), and then forward the second seed to the first security unit sequentially through the second computing unit and the first computing unit.

[0197] Accordingly, the first security unit can use the previously generated first key to decrypt the second seed, obtaining the third seed (seed3), and compare whether the first seed and the third seed are the same. If they are the same, it indicates that the first security unit can confirm that the second security unit uses the same key generation method as the first security unit and can generate the same key as the first security unit. That is, it confirms that the key materials and key generation algorithm stored in the second security unit are the same as those stored in the first security unit. In this case, the first security unit can confirm that the diagnostic instrument corresponding to the second security unit has access rights and returns the comparison result of the first seed and the third seed to the diagnostic instrument. The electronic control unit can then allow the diagnostic instrument to access. Similarly, if they are not the same, the first security unit can confirm that the diagnostic instrument does not have access rights and returns the comparison result to the diagnostic instrument. The electronic control unit can then reject the diagnostic instrument's access request.

[0198] In this way, authentication-related information such as keys, key materials, and key generation algorithms are all stored in the secure unit, and the authentication operation is performed by the secure unit. This ensures that the authentication operation is separated from the business information in the computing unit, which can prevent criminals from using business information to steal authentication-related information, thereby improving the security of the authentication process.

[0199] For example, Figure 6 Flowchart of the authentication method provided in the embodiments of this application Figure 2 This authentication method can be applied to Figure 3 The authentication system shown below. Figure 3 The communication system shown is used as an example for illustration.

[0200] like Figure 6 As shown, the authentication method includes the following steps:

[0201] S601, the third service unit sends a third request to the first service unit, and the first service unit receives the third request from the third service unit. The third request is used to request a fourth seed (seed4).

[0202] For example, the third business unit can be Figure 3 The third authentication unit in the third device shown can have the first service unit as follows: Figure 3The first service unit in the first device shown is illustrated. The third service unit can store authentication-related information and perform authentication operations, and can also perform other services besides authentication operations, such as the management service of the third device, the update service of the third device, etc. The specific implementation method of the authentication operation of the third service unit can be referred to the above. Figure 4 The specific implementation of the second authentication unit shown is not described here.

[0203] S602, the first business unit sends a third request to the first authentication unit, and the first authentication unit receives the third request from the first business unit.

[0204] S603, the first authentication unit sends a third response to the third service unit, and the third service unit receives the third response from the first authentication unit. The third response includes a fourth seed.

[0205] S604, the first authentication unit determines the third key (key3) based on the fourth seed.

[0206] S605, the first service unit sends a third response to the third service unit, and the third service unit receives the third response from the first service unit. The third response includes a fourth seed.

[0207] For the specific implementation of S602-S605, please refer to S403-S406 above, which will not be repeated here.

[0208] S606, the third business unit determines the fourth key (key4) based on the fourth seed.

[0209] S607, the third business unit determines the fifth seed (seed5) based on the fourth seed and the fourth key.

[0210] S608, the third service unit sends the fifth seed to the first service unit, and the first service unit receives the fifth seed from the third service unit.

[0211] For example, the third device can directly perform authentication-related services in the third business unit. The specific implementation of authentication by the third business unit can be referred to the relevant content of S408-S411 above, and will not be repeated here.

[0212] S609, the first service unit sends the fifth seed to the first authentication unit, and the first authentication unit receives the fifth seed from the first service unit.

[0213] S610, the first authentication unit determines the sixth seed (seed6) based on the third key and the fifth seed.

[0214] S611, the first authentication unit determines the matching result between the fourth seed and the sixth seed.

[0215] S612, the first authentication unit sends the matching result to the first service unit, and the first service unit receives the matching result from the first authentication unit.

[0216] S613, the first service unit sends the matching result to the third service unit, and the third service unit receives the matching result from the first service unit.

[0217] For the specific implementation of S609-S613, please refer to S412-S416 above, which will not be repeated here.

[0218] Based on the above Figure 5 The authentication method described above allows the first device to verify, for example, Figure 2 The second device shown has permissions configured with business units and authentication units, and can also verify, for example... Figure 3 The permissions shown are only for a third device with a business unit configured. The authentication method performed by existing devices can be the same as the authentication method performed by existing technologies, thus achieving compatibility between the authentication method provided in this application embodiment and existing technologies.

[0219] The following is based on the above. Figure 3 Taking the architecture of the authentication system shown above as an example, the above will be explained in detail. Figure 6 The authentication method shown is implemented in the authentication system.

[0220] For example, Figure 7 Interaction diagram of the authentication system provided in the embodiments of this application Figure 2 This authentication system can specifically achieve the above. Figure 6 The authentication method shown is shown.

[0221] like Figure 7 As shown, the authentication system includes an electronic control unit and a diagnostic tool. The electronic control unit may include a first computing unit and a first security unit, and the diagnostic tool may include a third computing unit.

[0222] The first device mentioned above can be Figure 7 The electronic control unit shown above, the aforementioned third device can be Figure 7 The diagnostic instrument shown is shown. Figure 6 The first authentication unit shown can be Figure 7 The first security unit shown is Figure 6 The first business unit shown can be Figure 7 The first computing unit shown. Figure 6 The third business unit shown can be Figure 7 The third computing unit shown.

[0223] like Figure 7The diagnostic instrument performs the above-mentioned operations in the third computing unit. Figure 6 The authentication methods described include actions such as the third computing unit sending a secure access request to the first computing unit, and the third computing unit using the same key generation method as the first security unit, i.e., generating a fourth key based on a fourth seed and its own stored key generation algorithm and key materials. The specific implementation of the electronic control unit can be referenced above. Figure 5 The electronic control unit shown will not be described in detail here.

[0224] Thus, in combination with the above Figure 5 and Figure 7 The electronic control unit can adopt the above-mentioned Figure 4 The authentication method shown is verified in the first authentication unit. Figure 5 The permissions for the diagnostic instrument shown can also be configured as described above. Figure 6 The authentication method shown is verified in the first authentication unit. Figure 7 The permissions of the diagnostic instrument shown are configured to ensure that the authentication method provided in this application is compatible with existing technologies.

[0225] The above combination Figures 4-7 The authentication method provided in the embodiments of this application is described in detail below. Figures 8-10 This document describes in detail the authentication apparatus used to perform the authentication methods provided in the embodiments of this application.

[0226] For example, Figure 8 This is a schematic diagram of the authentication device provided in the embodiments of this application. Figure 1 .like Figure 8 As shown, the authentication device 800 includes a first service unit 801 and a first authentication unit 802. For ease of explanation, Figure 8 Only the main components of the authentication device are shown.

[0227] In some embodiments, the authentication device 800 may be applicable Figure 2 In the authentication system shown, the following is executed: Figure 4 The authentication method shown in the diagram has the functionality of the first device, or is applicable to... Figure 3 In the authentication system shown, the following is executed: Figure 6 The function of the first device in the authentication method shown.

[0228] The first service unit 801 is used to receive a first request from the second device, the first request being used to request a first seed.

[0229] The first business unit 801 is also used to send a first request to the first authentication unit 802.

[0230] The first authentication unit 802 is used to send a first response to the first business unit 801, the first response including a first seed.

[0231] The first service unit 801 is also used to send a first response to the second device.

[0232] The first service unit 801 is also used to receive a second seed from the second device.

[0233] The first business unit 801 is also used to send the second seed to the first authentication unit 802.

[0234] The first authentication unit 802 is further configured to determine a third seed based on the first key and the second seed. The first key is determined based on the first seed.

[0235] The first authentication unit 802 is also used to determine the matching result between the third seed and the first seed.

[0236] The first authentication unit 802 is also used to send the matching result to the first business unit 801.

[0237] The first service unit 801 is also used to send matching results to the second device.

[0238] In one possible design, the first authentication unit 802 is further configured to determine the first key based on the first key material, the first key generation algorithm, and the first seed, wherein the first key material and the first key generation algorithm are stored in the first authentication unit 802.

[0239] Optionally, the first request may include an access level. Accordingly, the first authentication unit 802 is further configured to determine the first key material and the first key generation algorithm based on the access level.

[0240] In another possible design, the first business unit 801 is further configured to send a second seed and identification information to the first authentication unit 802, wherein the identification information corresponds to the first key. The first authentication unit 802 is further configured to determine the first key based on the identification information.

[0241] Furthermore, the first authentication unit 802 is also used to send identification information to the first business unit 801, the identification information being determined based on the first key.

[0242] Optionally, the first authentication unit 802 is also used to delete the first key.

[0243] Optionally, the first business unit 801 and the first authentication unit 802 can also be integrated into a single unit, such as a processing unit. The processing unit is used to implement the processing functions of the authentication device 800.

[0244] Optionally, the authentication device 800 may also include a storage unit ( Figure 8 (Not shown in the image), this storage unit stores programs or instructions. When the processing unit executes the program or instructions, the authentication device 800 can perform operations. Figures 4-7 The steps of any of the authentication methods shown in the examples.

[0245] Optionally, the first service unit 801 may further include a transceiver subunit ( Figure 8 (Not shown in the image), this transceiver subunit is used to implement the transmitting and receiving functions of the first service unit 801. Further, the transceiver subunit may include a receiving subunit and a transmitting subunit (…). Figure 8 (Not shown in the image). The receiving subunit and the transmitting subunit are used to implement the receiving and transmitting functions of the first service unit 801, respectively.

[0246] It should be understood that the first service unit 801 and the first authentication unit 802 involved in the authentication device 800 can be implemented by a processor or processor-related circuit components, and can be a processor or processing unit. Taking the authentication device 800 as an electronic control unit as an example, the first service unit 801 can be a Diagnostic Secure Access Component (DIAG_SA), and the first authentication unit 802 can be a Diagnostic Secure Access Target Component (DIAG_TA). The transceiver unit can be implemented by a transceiver or transceiver-related circuit components, and can be a transceiver or transceiver module.

[0247] It should be noted that the authentication device 800 can be a terminal device, such as an in-vehicle terminal, or a chip (system) or other component or assembly that can be set in the terminal device, or a device containing the terminal device, such as a vehicle. This application does not limit this.

[0248] Furthermore, the technical effectiveness of the authentication device 800 can be referenced in section [number missing]. Figures 4-7 The technical effects of any of the authentication methods shown in the examples are not elaborated here.

[0249] For example, Figure 9 This is a schematic diagram of the authentication device provided in the embodiments of this application. Figure 2 .like Figure 9 As shown, the authentication device 900 includes: a second business unit 901 and a second authentication unit 902. For ease of explanation, Figure 9 Only the main components of the authentication device are shown.

[0250] In some embodiments, the authentication device 900 may be applicable to Figure 2 In the authentication system shown, the following is executed: Figure 4 The function of the second device in the authentication method shown.

[0251] The second authentication unit 902 is used to send a first request to the second business unit 901, and the first request is used to request the first seed.

[0252] The second service unit 901 is used to send a first request to the first device.

[0253] The second service unit 901 is also configured to receive a first response from the first device, the first response including a first seed.

[0254] The second business unit 901 is also used to send a first response to the second authentication unit 902.

[0255] The second authentication unit 902 is also used to send a second seed to the second service unit 901. The second seed is determined based on the first seed and the second key, and the second key is determined based on the first seed.

[0256] The second service unit 901 is also used to send a second seed to the first device.

[0257] The second service unit 901 is also used to receive matching results sent from the first device.

[0258] In one possible design, the second authentication unit 902 is further configured to determine a second key based on the second key material, the second key generation algorithm, and the first seed. The second key material and the second key generation algorithm are stored in the second authentication unit 902.

[0259] Optionally, the second authentication unit 902 is also used to delete the second key.

[0260] Optionally, the second business unit 901 and the second authentication unit 902 can also be integrated into a single unit, such as a processing unit. The processing unit is used to implement the processing functions of the authentication device 900.

[0261] Optionally, the authentication device 900 may also include a storage unit ( Figure 9 (Not shown in the image), this storage unit stores programs or instructions. When the processing unit executes the program or instructions, the authentication device 900 can perform operations. Figures 4-7 The steps of any of the authentication methods shown in the examples.

[0262] Optionally, the second service unit 901 may further include a transceiver subunit ( Figure 9 (Not shown in the image), this transceiver subunit is used to implement the transmitting and receiving functions of the second service unit 901. Further, the transceiver subunit may include a receiving subunit and a transmitting subunit (…). Figure 9 (Not shown in the image). The receiving subunit and the transmitting subunit are used to implement the receiving and transmitting functions of the second service unit 901, respectively.

[0263] It should be understood that the second service unit 901 and the second authentication unit 902 involved in the authentication device 900 can be implemented by a processor or processor-related circuit components, and can be a processor or processing unit. The transceiver unit can be implemented by a transceiver or transceiver-related circuit components, and can be a transceiver or transceiver module.

[0264] It should be noted that the authentication device 900 can be a terminal device, such as an on-board diagnostic terminal, or a chip (system) or other component or assembly that can be set in the terminal device, or a device containing the terminal device, such as a vehicle. This application does not limit this.

[0265] Furthermore, the technical effectiveness of the authentication device 900 can be referenced in section [number missing]. Figures 4-7 The technical effects of any of the authentication methods shown in the examples are not elaborated here.

[0266] For example, Figure 10 Schematic diagram of the authentication device provided in the embodiments of this application Figure 3 The authentication device can be a terminal device or a network device, or it can be a chip (system) or other component or assembly that can be installed in the terminal device or network device. For example... Figure 10 As shown, the authentication device 1000 may include a processor 1001. Optionally, the authentication device 1000 may also include a memory 1002 and / or a transceiver 1003. The processor 1001 is coupled to the memory 1002 and the transceiver 1003, for example, they may be connected via a communication bus.

[0267] The following is combined with Figure 10 A detailed description of each component of the authentication device 1000 is provided below:

[0268] The processor 1001 is the control center of the authentication device 1000. It can be a single processor or a collective term for multiple processing elements. For example, the processor 1001 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement the embodiments of this application, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0269] Optionally, the processor 1001 can perform various functions of the authentication device 1000 by running or executing software programs stored in the memory 1002 and calling data stored in the memory 1002.

[0270] In a specific implementation, as one example, the processor 1001 may include one or more CPUs, for example... Figure 10 CPU0 and CPU1 are shown in the diagram.

[0271] In a specific implementation, as one example, the authentication device 1000 may also include multiple processors, for example... Figure 2 The processors 1001 and 1004 are shown. Each of these processors can be a single-core processor or a multi-core processor. Here, "processor" can refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0272] In addition, processor 1001 or processor 1004 can be used to implement the processing functions of the first service unit and / or the first authentication unit in the first device, or to implement the processing functions of the second service unit and / or the second authentication unit in the second device.

[0273] The memory 1002 is used to store the software program that executes the solution of this application, and is controlled by the processor 1001 to execute it. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0274] Optionally, the memory 1002 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 1002 may be integrated with the processor 1001 or may exist independently, and may be accessed through the interface circuit of the authentication device 1000. Figure 10 (Not shown in the image) is coupled to the processor 1001, and this embodiment does not specifically limit this.

[0275] Transceiver 1003 is used for communication with other authentication devices. For example, if authentication device 1000 is a terminal device, transceiver 1003 can be used to communicate with a network device or with another terminal device. Again, for example, if authentication device 1000 is a network device, transceiver 1003 can be used to communicate with a terminal device or with another network device.

[0276] In addition, the transceiver 1003 can be used to implement the transmission and reception function of the first service unit in the first device or to implement the transmission and reception function of the second service unit in the second device.

[0277] Optionally, transceiver 1003 may include a receiver and a transmitter. Figure 10 (Not shown separately). The receiver is used to implement the receiving function, and the transmitter is used to implement the sending function.

[0278] Optionally, the transceiver 1003 can be integrated with the processor 1001, or it can exist independently and be connected to the interface circuit of the authentication device 1000. Figure 10 (Not shown in the image) is coupled to the processor 1001, and this embodiment does not specifically limit this.

[0279] It should be noted that, Figure 10 The structure of the authentication device 1000 shown does not constitute a limitation on the authentication device. An actual authentication device may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0280] Furthermore, the technical effects of the authentication device 1000 can be referred to the technical effects of the authentication method described in the above method embodiments, and will not be repeated here.

[0281] This application also provides a chip system, including: a processor coupled to a memory, the memory being used to store programs or instructions, wherein when the program or instructions are executed by the processor, the chip system implements the methods in any of the above method embodiments.

[0282] Optionally, the chip system may contain one or more processors. These processors can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor, implemented by reading software code stored in memory.

[0283] Optionally, the chip system may contain one or more memories. The memory may be integrated with the processor or disposed separately from it; this application does not limit this. For example, the memory may be a non-transient processor, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or disposed separately on different chips. This application does not specifically limit the type of memory or the arrangement of the memory and processor.

[0284] For example, the chip system may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a micro controller unit (MCU), a programmable logic device (PLD), or other integrated chips.

[0285] This application provides an authentication system. The authentication system includes the first device and the second device described above.

[0286] It should be understood that the processor in the embodiments of this application can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0287] It should also be understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0288] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0289] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0290] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0291] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0292] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0293] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0294] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0295] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0296] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0297] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0298] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An authentication method characterized by, The method is applied to a first device, the first device comprising a first service unit and a first authentication unit, and the method comprises: The first service unit receives a first request from a second device, the first request being used to request a first seed; The first service unit sends the first request to the first authentication unit; The first authentication unit sends a first response to the first service unit, the first response comprising the first seed; The first service unit sends the first response to the second device; The first service unit receives a second seed from the second device; The first service unit sends the second seed to the first authentication unit; The first authentication unit determines a third seed according to a first key and the second seed, wherein the first key is determined according to the first seed; The first authentication unit determines a matching result of the third seed and the first seed; The first authentication unit sends the matching result to the first service unit; The first service unit sends the matching result to the second device.

2. The authentication method of claim 1, wherein, The method further comprises: The first authentication unit determines the first key according to a first key material, a first key generation algorithm and the first seed, wherein the first key material and the first key generation algorithm are stored in the first authentication unit.

3. The authentication method of claim 2, wherein, The first request comprises an access level, and before the first authentication unit determines the first key according to the first key material, the first key generation algorithm and the first seed, the method further comprises: The first authentication unit determines the first key material and the first key generation algorithm according to the access level.

4. The authentication method according to any one of claims 1 to 3, characterized in that, The first service unit sends the second seed to the first authentication unit, comprising: The first service unit sends the second seed and identification information to the first authentication unit, wherein the identification information corresponds to the first key; Before the first authentication unit determines the third seed according to the first key and the second seed, the method further comprises: The first authentication unit determines the first key according to the identification information.

5. The authentication method of claim 4, wherein, The method further comprises: The first authentication unit sends the identification information to the first service unit, wherein the identification information is determined according to the first key.

6. The authentication method according to any one of claims 1 to 3, 5, characterized in that, The method further comprises: The first authentication unit deletes the first key.

7. An authentication method characterized by, The method is applied to a second device, the second device comprising a second service unit and a second authentication unit, and the method comprises: The second authentication unit sends a first request to the second service unit, the first request being used to request a first seed; The second service unit sends the first request to a first device; The second service unit receives a first response from the first device, the first response comprising the first seed; The second service unit sends the first response to the second authentication unit; The second authentication unit sends a second seed to the second service unit, wherein the second seed is determined according to the first seed and a second key, and the second key is determined according to the first seed; The second service unit sends the second seed to the first device; The second service unit receives the matching result sent from the first device.

8. The authentication method of claim 7, wherein, The method further comprises: The second authentication unit determines the second key according to second key material, a second key generation algorithm and the first seed, the second key material and the second key generation algorithm being stored in the second authentication unit.

9. The authentication method according to claim 7 or 8, characterized in that, The method further comprises: The second authentication unit deletes the second key.

10. An authentication apparatus characterized by comprising: The authentication apparatus comprises a first service unit and a first authentication unit; wherein, The first service unit is configured to receive a first request from a second device, the first request being used to request a first seed; The first service unit is further configured to send the first request to the first authentication unit; The first authentication unit is configured to send a first response to the first service unit, the first response comprising the first seed; The first service unit is further configured to send the first response to the second device; The first service unit is further configured to receive a second seed from the second device; The first service unit is further configured to send the second seed to the first authentication unit; The first authentication unit is further configured to determine a third seed according to a first key and the second seed, the first key being determined according to the first seed; The first authentication unit is further configured to determine a matching result of the third seed and the first seed; The first authentication unit is further configured to send the matching result to the first service unit; The first service unit is further configured to send the matching result to the second device.

11. The authentication apparatus according to claim 10, wherein The first authentication unit is further configured to determine the first key according to first key material, a first key generation algorithm and the first seed, the first key material and the first key generation algorithm being stored in the first authentication unit.

12. The authentication apparatus according to claim 11, characterized by The first request comprises an access level, The first authentication unit is further configured to determine the first key material and the first key generation algorithm according to the access level.

13. The authentication apparatus according to any one of claims 10-12, wherein The first service unit is further configured to send the second seed and identification information corresponding to the first key to the first authentication unit; The first authentication unit is further configured to determine the first key according to the identification information.

14. The authentication apparatus according to claim 13, wherein The first authentication unit is further configured to send the identification information to the first service unit, the identification information being determined according to the first key.

15. The authentication apparatus according to any one of claims 10-12, 14, wherein The first authentication unit is further configured to delete the first key.

16. The authentication apparatus according to any one of claims 10 to 12, 14, characterized by, The apparatus is a terminal device or a chip in a terminal device.

17. An authentication device, characterized by The authentication apparatus comprises a second service unit and a second authentication unit; wherein, The second authentication unit is configured to send a first request to the second service unit, the first request being used to request a first seed; The second service unit is configured to send the first request to the first device. The second service unit is further configured to receive a first response from the first device, the first response comprising the first seed. The second service unit is further configured to send the first response to the second authentication unit. The second authentication unit is further configured to send a second seed to the second service unit, the second seed being determined according to the first seed and a second key, the second key being determined according to the first seed. The second service unit is further configured to send the second seed to the first device. The second service unit is further configured to receive a matching result from the first device.

18. The authentication apparatus of claim 17, wherein The second authentication unit is further configured to determine the second key according to a second key material, a second key generation algorithm and the first seed, the second key material and the second key generation algorithm being stored in the second authentication unit.

19. The authentication apparatus of claim 17 or 18, wherein The second authentication unit is further configured to delete the second key.

20. The authentication apparatus according to claim 17 or 18, characterized by The apparatus is a terminal device or a chip in a terminal device.

21. An authentication device, characterized by The authentication apparatus is configured to perform the authentication method of any one of claims 1-9.

22. An authentication device, characterized by The authentication apparatus comprises a processor; and wherein The processor is configured to perform the authentication method of any one of claims 1-9.

23. An authentication device, characterized by Comprising: a processor coupled with a memory; The processor is configured to execute a computer program stored in the memory to cause the authentication apparatus to perform the authentication method of any one of claims 1-9.

24. An authentication device, characterized by Comprising: a processor; The processor is configured to execute a computer program to cause the authentication apparatus to perform the authentication method of any one of claims 1-9.

25. An authentication device, comprising: Comprising: a processor and an interface circuit; and wherein The interface circuit is configured to receive code instructions and transmit to the processor; The processor is configured to execute the code instructions to perform the method of any one of claims 1-9.

26. An authentication device, characterized by The authentication apparatus comprises a processor and a transceiver, the transceiver being configured to exchange information between the authentication apparatus and other authentication apparatuses, and the processor being configured to execute program instructions to perform the authentication method of any one of claims 1-9.

27. A processor, comprising: Comprising: The processor is configured to perform the authentication method of any one of claims 1-9.

28. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a computer program or instructions, which, when executed on a computer, cause the computer to perform the authentication method of any one of claims 1-9.

29. A computer program product, characterised in that, The computer program product comprises a computer program or instructions, which, when executed on a computer, cause the computer to perform the authentication method of any one of claims 1-9.

Images