Vehicle communication method, server, system and storage medium

Abstract

The present application relates to a vehicle communication method, a server and a system, and a storage medium, the method comprising: sending a request message to a server to request a virtual key, the virtual key being used to initiate a control request to a vehicle; sending a request end identity according to feedback information from the server; and receiving a virtual key, the virtual key being encrypted by a private key of the vehicle, including a vehicle identity, user information, a public key number of the vehicle, a firewall key, a first symmetric key, the request end identity, and a valid time period of the virtual key. The method can realize remote safety control of a vehicle.

Description

Technical Field

[0001] The present application relates to the field of vehicle remote control, and in particular, to a vehicle communication method, a vehicle communication server, a vehicle communication system, and a storage medium. Background Art

[0002] In the prior art, the remote vehicle control function based on T-BOX has been widely used, but T-BOX remote vehicle control is implemented based on the public network. Usually, the APP initiates a control request to the background, and the background sends the control instruction to the T-BOX, and the T-BOX forwards the control instruction to the specific execution component for execution. This method is greatly affected by network coverage.

[0003] At present, the entry and start methods of automobiles have evolved from the initial mechanical physical key, to the remote control key, to the later PEPS system, and then to the T-BOX remote vehicle control. Although the current remote vehicle control can get rid of the physical key when there is a network, it still has to rely on the physical key when there is no network. Therefore, it is necessary to design a vehicle control method that can remotely and safely control the vehicle without public network coverage. Summary of the invention

[0004] Embodiments of the present application provide a vehicle communication method, a vehicle communication server, a vehicle communication system, and a storage medium for implementing remote safety control of a vehicle.

[0005] According to one aspect of the present application, a vehicle communication method is provided, comprising: sending a request message to a server to request a virtual key, wherein the virtual key is used to initiate a control request to a vehicle; sending an identity of the requesting side according to feedback information from the server; and receiving a virtual key, wherein the virtual key is encrypted with a private key of the vehicle, and comprises a vehicle identity, user information, a public key number of the vehicle, a firewall key, a first symmetric key, an identity of the requesting side, and a valid time period of the virtual key, wherein the first symmetric key is used to establish a reliable connection between the requesting side and the vehicle side.

[0006] In some embodiments of the present application, optionally, the method also includes: establishing a communication connection with the vehicle end; sending the virtual key to the vehicle end; sending a first encrypted random number encrypted by the first symmetric key and receiving a second encrypted random number encrypted by the first symmetric key from the vehicle end; generating a second symmetric key based on the first encrypted random number and the second encrypted random number; and encrypting the user information and the requesting end identity with the second symmetric key and sending them to the vehicle end for verification.

[0007] In some embodiments of the present application, optionally, the method also includes: sending a control command to the vehicle end; receiving command verification information from the vehicle end, the command verification information is generated by encrypting the first encrypted random number and the requesting end identity using the second symmetric key; generating command verification information, the command verification information is generated by encrypting the first encrypted random number and the requesting end identity using the second symmetric key; determining whether the command verification information is the same as the command verification information, if so, proceeding to the following steps, otherwise ending the process: generating a temporary random number and sending it to the vehicle end; and generating temporary verification information and sending it to the vehicle end, the temporary verification information is generated by encrypting the temporary random number and the requesting end identity using the second symmetric key.

[0008] According to another aspect of the present application, a vehicle communication server is provided, comprising: a communication unit configured to receive user information, a public key number of a vehicle end, and a firewall key seed; a storage unit configured to store the user information, the public key number of the vehicle end, and the firewall key lookup table, wherein the firewall key lookup table includes a correspondence between the firewall key seed and the firewall key; and an execution unit configured to: use the communication unit to receive request information for requesting a virtual key from a request end, wherein the virtual key is used to initiate a control request for the vehicle end; use the communication unit to send feedback information to the request end to request an identity of the request end; use the communication unit to receive the identity of the request end; generate a virtual key encrypted by a private key of the vehicle end, which includes a vehicle identity, user information, the public key number of the vehicle end, a firewall key, a first symmetric key, the identity of the request end, and a valid time period of the virtual key, wherein the firewall key is generated according to the firewall key seed and the firewall key lookup table; and use the communication unit to send the virtual key to the request end.

[0009] According to another aspect of the present application, a vehicle communication system is provided, including: a first communication unit, which is configured to send a public key number and a firewall key seed of a vehicle end to a service end; a second communication unit, which is configured to establish communication with a request end using an end-to-end communication link; a vehicle execution unit, which is configured to: establish a communication connection with the request end through the second communication unit; initiate a security authentication request to the request end through the second communication unit, and if the authentication is passed, proceed to the following steps, otherwise end the process: receive a virtual key from the request end through the second communication unit, and the virtual key is encrypted with a private key of the vehicle end, including a vehicle identity, user information, the public key number of the vehicle end, a firewall key, a first symmetric key, the request end identity, the virtual key The virtual key is valid for a certain period of time, and the first symmetric key is used to establish a reliable connection between the requesting end and the vehicle end; the public key of the vehicle end is used to decrypt the virtual key, and the vehicle identity and the valid period of the virtual key are verified. If the authentication is passed, the following steps are performed, otherwise the process ends: a second encrypted random number encrypted by the first symmetric key is sent through the second communication unit and a first encrypted random number encrypted by the first symmetric key is received from the requesting end; a second symmetric key is generated based on the first encrypted random number and the second encrypted random number; and identity authentication information is received from the vehicle end through the second communication unit and verified, and the identity authentication information is generated by encrypting the user information and the identity of the requesting end with the second symmetric key.

[0010] In some embodiments of the present application, optionally, the vehicle execution unit is also configured to: receive a control command from the requesting end through the second communication unit; and verify the communication connection, and forward the control command to the vehicle controller if the verification passes.

[0011] In some embodiments of the present application, optionally, the vehicle execution unit is configured to verify the communication connection in the following manner: receiving a control command from the requesting end through the second communication unit; generating command verification information based on the first encrypted random number and the requesting end identity through the second symmetric key encryption and sending it to the requesting end through the second communication unit; receiving a temporary random number and temporary verification information through the second communication unit, the temporary verification information being generated based on the temporary random number and the requesting end identity through the second symmetric key encryption; generating temporary verification information based on the temporary random number and the requesting end identity through the second symmetric key encryption; and forwarding the control command when the temporary verification information is the same as the temporary verification information.

[0012] In some embodiments of the present application, optionally, the virtual key also includes a number, and the vehicle execution unit is further configured to: send the number of the virtual key to the server for verification through the first communication unit; receive the verification result from the server through the first communication unit; and maintain the communication connection established by the second communication unit if the verification is passed, and disconnect the connection if the verification fails.

[0013] In some embodiments of the present application, optionally, the vehicle execution unit is also configured to send the virtual key serial number to the server for verification at predetermined intervals.

[0014] According to another aspect of the present application, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, and wherein when the instructions are executed by a processor, the processor is caused to execute any one of the methods described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above and other objects and advantages of the present application will become more fully apparent from the following detailed description in conjunction with the accompanying drawings, wherein the same or similar elements are represented by the same reference numerals.

[0016] Figure 1 A vehicle communication method according to an embodiment of the present application is shown.

[0017] Figure 2 A mechanism for generating a virtual key according to an embodiment of the present application is shown.

[0018] Figure 3 A vehicle communication method according to an embodiment of the present application is shown.

[0019] Figure 4 A connection establishment authentication mechanism according to an embodiment of the present application is shown.

[0020] Figure 5 A vehicle communication method according to an embodiment of the present application is shown.

[0021] Figure 6 A control encryption mechanism according to an embodiment of the present application is shown.

[0022] Figure 7 A vehicle communication server according to an embodiment of the present application is shown.

[0023] Figure 8 A vehicle communication system according to an embodiment of the present application is shown.

[0024] Fig. 9 A virtual key verification mechanism according to an embodiment of the present application is shown.

[0025] Fig.10 A control command rolling code mechanism according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0026] For the purpose of brevity and illustration, the principles of the present application are described herein mainly with reference to its exemplary embodiments. However, those skilled in the art will readily recognize that the same principles are equally applicable to all types of vehicle communication methods, servers and systems, and storage media, and that these same or similar principles may be implemented therein, and any such changes do not depart from the true spirit and scope of the present application.

[0027] According to one aspect of the present application, a vehicle communication method is provided. Figure 1 As shown, the vehicle communication method 10 includes the following steps. In step S101, a request message is sent to the server to request a virtual key, and the virtual key is used to initiate a control request for a specific vehicle end. In step S102, the request end identity is sent according to the feedback information of the server. In step S103, the virtual key is received. Among them, the virtual key is encrypted by the private key of the vehicle end, including the vehicle identity, user information, the public key number of the vehicle end, the firewall key, the first symmetric key, the request end identity, and the virtual key valid time period. The first symmetric key is used to establish a reliable connection between the request end and the vehicle end.

[0028] For example, Figure 2 A more specific virtual key (abbreviated as VK) generation solution model is shown, which shows the way to obtain various information constituting the virtual key and the key application and issuance process. The numbers in the circle in the figure represent the feasible execution order, and the same numbers represent that they can be performed in the same step. First, in step S101, the user can add a key in the request end (such as a mobile phone) APP, that is, apply for a virtual key from the background server (or called the server, background). Subsequently, in step S102, the background captures the mobile phone DUID (device unique identifier of the storage device) and other data that can represent the mobile phone identity information through the SDK. Finally, in step S103, the background combines the vehicle VIN (Vehicle Identification Number, frame number), user registration information (GUID, for example, can be a mobile phone number), public key serial number (each vehicle-side Bluetooth module has a unique public key, recorded as key*), the vehicle-side firewall key (Firewall key), the key validity period and other information into a virtual key, encrypts it with the vehicle-side private key, and calculates the SHA256 value and sends it to the mobile phone APP.

[0029] like Figure 2As shown in the figure, the key factors that constitute the virtual key include the vehicle VIN number, GUID, Key*, Firewallkey, C-SK, DUID, and key validity period, where: VIN represents the vehicle VIN number, which can be uploaded to the background as a unique identifier when the vehicle leaves the factory. key* represents an asymmetric encryption key, and the key* number can be uploaded when the vehicle end ignites. Firewallseed / key represents the firewall seed / key. When the vehicle end T-BOX detects the key* upload, it can request the vehicle firewall to upload the seed synchronously. The seed can be saved in the background until the background receives a request to apply for a virtual key and requests the firewall key from the encryption and decryption server. GUID represents the data saved in the background when the user registers and binds the vehicle. When the background receives a request to apply for a virtual key, the GUID information can be obtained from the user information management platform. DUID represents the mobile device identifier. When the background receives a request to apply for a virtual key, the background can apply to the APP for it. In addition, when the user applies for a virtual key from the background, he will be required to fill in the effective period of the virtual key and provide it to the background. Regarding C-SK symmetric encryption, when the background packages the virtual key, it will apply for a random key C-SK from the encryption and decryption system. Each virtual key corresponds to a different C-SK. C-SK can be used for encryption during the Bluetooth connection between the APP and the vehicle.

[0030] In some embodiments of the present application, Figure 3 As shown, the vehicle communication method 10 also includes the following steps. In step S111, a communication connection is established with the vehicle end; in step S112, a virtual key is sent to the vehicle end; in step S113, a first encrypted random number encrypted by a first symmetric key is sent and a second encrypted random number encrypted by the first symmetric key is received from the vehicle end; in step S114, a second symmetric key is generated according to the first encrypted random number and the second encrypted random number; and in step S115, the user information and the request end identity are encrypted by the second symmetric key and sent to the vehicle end for verification.

[0031] For example, Figure 4 A more specific three-stage authentication process model of Bluetooth connection between the requesting end APP and the vehicle-side Bluetooth module is shown. During the Bluetooth connection process and authentication process, after the mobile phone APP obtains the virtual key, it can search for the vehicle within the Bluetooth sensing range of the vehicle. The user clicks on the connection to trigger the Bluetooth connection. The Bluetooth connection is divided into two stages, physical connection and secure connection. The physical connection is the connection that the Bluetooth physical layer intends to establish a Bluetooth channel (marked as "Bluetooth channel establishment" in the figure), and the secure connection can be divided into the following three stages.

[0032] Phase 1: On the basis of establishing a connection at the Bluetooth physical layer, the vehicle-side Bluetooth module actively initiates the first authentication request. For example, within about 100 ms, the vehicle-side initiates a security authentication request to the mobile phone. After receiving the security authentication request, the SDK will first detect whether the mobile phone environment is safe. After confirming that there is no security problem, the virtual key information will be sub-packaged and sent to the vehicle-side Bluetooth module. The vehicle-side first performs SHA256 verification to ensure data integrity, and then decrypts the virtual key according to its own stored key* to obtain the GUID, DUID, VIN, and virtual key validity period for subsequent verification. At the same time, compare whether the obtained VIN is consistent with the vehicle-side bus VIN, and whether the current time on the vehicle-side is within the virtual key validity period. If the verification is successful, the APP is notified that the first phase is completed and enters the second phase of BT-SK generation; if the verification fails, the Bluetooth connection is disconnected.

[0033] Phase 2: The APP and the Bluetooth module generate random numbers at the same time, and then encrypt them with the C-SK in the virtual key to generate encrypted random numbers A and B, and exchange them. After the exchange, A+B is combined and a temporary BT-SK is generated according to AES 128. After the vehicle-side Bluetooth module generates BT-SK, it sets the Temp exchange status to True and notifies the APP to enter the third phase.

[0034] Phase 3: The mobile phone APP needs to encrypt the DUID and GUID with BT-SK and send it to the vehicle-side Bluetooth module for verification. After receiving the data, the Bluetooth module decrypts it with BT-SK and compares it with the GUID and DUID information obtained through decryption. If they are consistent, the secure connection is completed; if they are inconsistent, the Bluetooth module actively disconnects.

[0035] In addition, after the three-stage authentication is completed, the Bluetooth module needs to upload the virtual key number to the background for validity verification. After receiving the valid verification result returned by T-BOX, the Bluetooth security connection is maintained. If it is invalid, the Bluetooth connection is immediately disconnected. At this point, the Bluetooth connection process is completed.

[0036] In some embodiments of the present application, Figure 5As shown, the vehicle communication method 10 also includes the following steps. In step S121, a control command is sent to the vehicle end. In step S122, command verification information is received from the vehicle end. Among them, the command verification information is generated by encrypting the first encrypted random number and the requesting end identity through the second symmetric key; in step S123, command verification information is generated. Among them, the command verification information is generated by encrypting the first encrypted random number and the requesting end identity through the second symmetric key. In step S124, it is determined whether the command verification information and the command verification information are the same. If so, the following steps are entered, otherwise the process ends. In step S125, a temporary random number is generated and sent to the vehicle end; and in step S126, temporary verification information is generated and sent to the vehicle end. Among them, the temporary verification information is generated by encrypting the temporary random number and the requesting end identity through the second symmetric key.

[0037] Figure 6 A more specific control encryption process model of APP sending commands to the vehicle side is shown. After APP establishes a secure connection with the vehicle-side Bluetooth module, verification is required each time a command is sent. After successful verification, the vehicle-side Bluetooth module forwards the command to the vehicle-side execution module for execution. The specific encryption and decryption process may include the following process. First, APP sends a control command to the vehicle side, and the verification process begins. The vehicle-side Bluetooth module uses BT-SK to encrypt the currently saved random number A and the device ID of the mobile phone (for example, DUID) with AES 256 (BT-SK) to generate SR1 and sends it to APP; APP also uses BT-SK to encrypt the saved random number A and device ID with AES 256 to generate SR1*. If APP determines that SR1=SR1*, proceed to the next step. APP generates a random number A*, and sends the random number A* to the vehicle-side Bluetooth module, and at the same time encrypts the random number A* and the device ID with BT-SK with AES 256 to generate SR2* and send it to the vehicle side. After receiving the random number A*, the Bluetooth module generates SR2 in the same way. If the Bluetooth module determines that SR2=SR2*, it considers that the command authentication is successful and forwards the command to the execution module on the vehicle side. At the same time, the Bluetooth module generates a new random number B and sends it to the APP for the next verification.

[0038] According to another aspect of the present application, a vehicle communication server is provided. Figure 7 As shown, the vehicle communication server 70 includes a communication unit 701, a storage unit 702 and an execution unit 703. The communication unit 701 is configured to receive user information, a public key number of the vehicle end, and a firewall key seed. Return to Figure 2 The vehicle communication server 70 can be implemented as the background (server), and the background can communicate with the vehicle side (vehicle side) and the mobile phone side (requesting side) through the communication unit 701.

[0039] The storage unit 702 is configured to store user information, a public key number of the vehicle end, and a firewall key lookup table, wherein the firewall key lookup table includes a correspondence between a firewall key seed and a firewall key. Figure 2 The backend (server) in the system may include such a storage unit 702 for storing data for implementing basic functions.

[0040] Figure 2 The backend server in may also include an execution unit 703, wherein the execution unit 703 is configured to perform the following operations: Receive request information for requesting a virtual key from a requesting end using the communication unit 701. The virtual key is used to initiate a control request for the vehicle end. Send feedback information to the requesting end using the communication unit 701 to request the identity of the requesting end. Receive the identity of the requesting end using the communication unit 701. Generate a virtual key encrypted by the private key of the vehicle end, which includes the vehicle identity, user information, the public key number of the vehicle end, the firewall key, the first symmetric key, the identity of the requesting end, and the effective time period of the virtual key, wherein the firewall key is generated according to the firewall key seed and the firewall key lookup table. Send the virtual key to the requesting end using the communication unit 701. This part may also be combined with the description Figure 2 The contents are combined to illustrate the specific working principle of the vehicle communication server 70.

[0041] According to another aspect of the present application, a vehicle communication system is provided. Figure 8 As shown, the vehicle communication system 80 includes a first communication unit 801, a second communication unit 802 and a vehicle execution unit 803. The first communication unit 801 is configured to send the public key number and firewall key seed of the vehicle end to the service end. The first communication unit 801 can be a communication module working in a public network, for example, Figure 2 The vehicle end shown in provides public network access capability.

[0042] The second communication unit 802 is configured to establish communication with the requesting end using an end-to-end communication link. The second communication unit 802 may be a communication module that meets the Bluetooth standard, and may be Figure 2 The vehicle end shown in FIG. 8 provides end-to-end access services. Specifically, the second communication unit 802 can act as Figure 4 and Figure 6 The vehicle-side Bluetooth module shown in the figure and implements its functions, specifically, it can be implemented in cooperation with the vehicle execution unit 803 which will be described in detail below, and the above description of the vehicle-side Bluetooth module is also quoted here.

[0043] The vehicle execution unit 803 is configured to perform the following operations. Establish a communication connection with the requesting end through the second communication unit 802; initiate a security authentication request to the requesting end through the second communication unit 802, if the authentication is passed, enter the following steps, otherwise end the process: receive a virtual key from the requesting end through the second communication unit 802, the virtual key is encrypted by the private key of the vehicle end, including the vehicle identity, user information, the public key number of the vehicle end, the firewall key, the first symmetric key, the requesting end identity, and the virtual key valid time period, the first symmetric key is used to establish a reliable connection between the requesting end and the vehicle end; decrypt the virtual key using the public key of the vehicle end, and verify the vehicle identity and the virtual key valid time period therein, if the authentication is passed, enter the following steps, otherwise end the process: send the second encrypted random number encrypted by the first symmetric key through the second communication unit 802 and receive the first encrypted random number encrypted by the first symmetric key from the requesting end; generate a second symmetric key according to the first encrypted random number and the second encrypted random number; and receive and verify the identity authentication information from the vehicle end through the second communication unit 802, the identity authentication information is generated by encrypting the user information and the requesting end identity with the second symmetric key.

[0044] In some embodiments of the present application, see Figure 6 The vehicle execution unit 803 (vehicle-side Bluetooth module) is also configured to: receive a control command from the requesting end through the second communication unit 802; and verify the communication connection, and forward the control command to the vehicle controller if the verification passes.

[0045] In some embodiments of the present application, see Figure 6 In combination with the above description of the vehicle-side Bluetooth module, the vehicle execution unit 803 is configured to verify the communication connection in the following manner: receiving a control command from the requesting end through the second communication unit 802; generating command verification information based on the first encrypted random number and the requesting end identity through the second symmetric key encryption and sending it to the requesting end through the second communication unit 802; receiving a temporary random number and temporary verification information through the second communication unit 802, and the temporary verification information is generated based on the temporary random number and the requesting end identity through the second symmetric key encryption; generating temporary verification information based on the temporary random number and the requesting end identity through the second symmetric key encryption; and forwarding the control command when the temporary verification information is the same as the temporary verification information.

[0046] In some embodiments of the present application, the virtual key also includes a number, and the vehicle execution unit 803 is further configured to: send the number of the virtual key to the server for verification through the first communication unit 801; receive the verification result from the server through the first communication unit 801; and maintain the communication connection established by the second communication unit 802 if the verification is passed, and disconnect the connection if the verification is not passed. In some embodiments of the present application, the vehicle execution unit 803 is further configured to send the number of the virtual key to the server for verification at predetermined intervals.

[0047] like Fig. 9 As shown, the new virtual key goes to the background to verify the validity during the first Bluetooth connection, and sends the virtual key number to the background through T-BOX (in some examples of the present invention, equivalent to the first communication unit 801), and the background feedbacks the validity result. If the feedback virtual key is valid, the Bluetooth connection remains. If it is invalid, the Bluetooth module (in some examples of the present invention, equivalent to the second communication unit 802) actively disconnects the Bluetooth connection. Every 15 minutes after the vehicle is awakened, the Bluetooth module sends the virtual key number to the background to verify the validity of the virtual key, and the processing method of the Bluetooth verification result is the same as above.

[0048] like Fig.10 As shown, before the Bluetooth module sends a CS-Command each time, it needs to refer to the firewall window opening logic to open the firewall window and send the key decoded by the virtual key to the firewall. The counter CS Counter is used for the command rolling code between the Bluetooth module and the body control module. Each time BLE sends a CS Command, it sends this counter counter and uses counter+1 for the next transmission. After receiving it, the body control module needs to confirm that the counter received from the Bluetooth module is greater than the counter stored in the body control module itself. If it is less than or equal to, the command will not be executed. If it is greater and within a certain window range (calibrable, 1024 times by default), a functional operation is performed and its own counter is equal to the received Bluetooth module counter. When the body control module matches the Bluetooth module, it sends its own CS Counter to the Bluetooth module through the CSAuthentication signal, and the Bluetooth module synchronizes this CS Counter in the learning mode.

[0049] The requesting end (for example, the mobile phone end) of the present invention may include an SDK architecture model, which may be specifically designed as follows. This SDK provides two partial APIs, one related to Bluetooth and the other for data storage. In the Bluetooth communication model, the mobile phone serves as the master device and the vehicle end serves as the slave device. The main process includes downloading and saving the APP locally through the server API, and then communicating with the vehicle end through the Bluetooth API. The vehicle end, as a slave device, continuously broadcasts. After the mobile phone end searches for this device during the search process, it can initiate a connection. After the connection, the slave device will no longer send broadcasts, and other devices will not be able to search for this slave device, that is, the slave device can only be connected to one master device.

[0050] In some examples of this application, strategies such as AES128, AES256, asymmetric encryption, SHA256, and white box encryption can be used to effectively prevent network attacks.

[0051] According to another aspect of the present application, a computer-readable storage medium is provided, in which instructions are stored. When the instructions are executed by a processor, the processor executes any one of the vehicle communication methods described above. The computer-readable medium referred to in the present application includes various types of computer storage media, which can be any available medium that can be accessed by a general-purpose or special-purpose computer. For example, the computer-readable medium can include RAM, ROM, EPROM, EEPROM, etc. 2 PROM, register, hard disk, removable disk, CD-ROM or other optical disk storage, disk storage or other magnetic storage device, or can be used to carry or store the desired program code unit in the form of instruction or data structure and can be accessed by general or special purpose computer, or general or special purpose processor any other temporary or non-temporary medium. As used herein, the disk usually copies data magnetically, while the dish uses laser to optically copy data. The above combination should also be included in the protection scope of computer-readable medium. Exemplary storage medium is coupled to the processor so that the processor can read and write information from / to the storage medium. In an alternative solution, the storage medium can be integrated into the processor. The processor and the storage medium can reside in the ASIC. The ASIC can reside in the user terminal. In an alternative solution, the processor and the storage medium can reside in the user terminal as discrete components.

[0052] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Those skilled in the art can think of other feasible changes or substitutions based on the technical scope disclosed in the present application, and such changes or substitutions are all included in the protection scope of the present application. In the absence of conflict, the implementation modes of the present application and the features in the implementation modes can also be combined with each other. The protection scope of the present application shall be subject to the description of the claims.

Claims

1. A vehicle communication method, comprising: Sending a request message to the server to request a virtual key, where the virtual key is used to initiate a control request for the vehicle; Sending a request end identity according to the feedback information of the server end; Receive a virtual key, the virtual key is encrypted by the private key of the vehicle end, and includes a vehicle identification, user information, a public key number of the vehicle end, a firewall key, a first symmetric key, an identification of the requesting end, and a valid time period of the virtual key, the first symmetric key is used to establish a reliable connection between the requesting end and the vehicle end, and the virtual key also includes a number, which is sent to the service end for verification at predetermined intervals; Establishing a communication connection with the vehicle end; Sending the virtual key to the vehicle end; Sending a first encrypted random number encrypted by the first symmetric key and receiving a second encrypted random number encrypted by the first symmetric key from the vehicle end; Generate a second symmetric key according to the first encrypted random number and the second encrypted random number; as well as The user information and the requesting end identity are encrypted with the second symmetric key and sent to the vehicle end for verification.

2. The method according to claim 1, further comprising: Sending a control command to the vehicle terminal; Receiving command verification information from the vehicle end, the command verification information being generated by encrypting the first encrypted random number and the requesting end identity using the second symmetric key; Generate command verification information, where the command verification information is generated by encrypting the first encrypted random number and the request end identity using the second symmetric key; Determine whether the command verification information is the same as the command check information. If yes, proceed to the following steps. If no, end the process: Generate a temporary random number and send it to the vehicle end; and Generate temporary verification information and send it to the vehicle end, wherein the temporary verification information is generated by encrypting the temporary random number and the requesting end identity using the second symmetric key.

3. A vehicle communication server, comprising: A communication unit configured to receive user information, a public key number of the vehicle end, and a firewall key seed; a storage unit configured to store the user information, the public key number of the vehicle end, and the firewall key lookup table, wherein the firewall key lookup table includes a correspondence between the firewall key seed and the firewall key; as well as An execution unit configured to: Using the communication unit to receive request information for requesting a virtual key from a requesting end, the virtual key is used to initiate a control request for a vehicle end; Using the communication unit to send feedback information to the requesting end to request an identity of the requesting end; Receiving the requesting end identity by using the communication unit; Generate a virtual key encrypted by the private key of the vehicle end, which includes a vehicle identity, user information, a public key number of the vehicle end, a firewall key, a first symmetric key, an identity of the requesting end, and a valid time period of the virtual key, wherein the firewall key is generated according to the firewall key seed and the firewall key lookup table; Sending the virtual key to the requesting end using the communication unit; as well as The serial number of the virtual key is verified at predetermined intervals.

4. A vehicle communication system, comprising: A first communication unit configured to send a public key number and a firewall key seed of the vehicle end to the service end; a second communication unit configured to establish communication with the requesting end using the end-to-end communication link; A vehicle execution unit configured to: Establishing a communication connection with the requesting end through the second communication unit; Initiate a security authentication request to the requesting end through the second communication unit, and if the authentication is successful, proceed to the following steps, otherwise end the process: receiving a virtual key from the requesting end through the second communication unit, the virtual key being encrypted by the private key of the vehicle end and including a vehicle identification, user information, a public key number of the vehicle end, a firewall key, a first symmetric key, an identification of the requesting end, and a valid time period of the virtual key, the first symmetric key being used to establish a reliable connection between the requesting end and the vehicle end, the virtual key also including a number, and the number being sent to the service end for verification at predetermined intervals; The public key of the vehicle is used to decrypt the virtual key, and the vehicle identity and the effective time period of the virtual key are verified. If the authentication is successful, the following steps are performed, otherwise the process ends: Sending, through the second communication unit, a second encrypted random number encrypted by the first symmetric key and receiving, from the requesting end, a first encrypted random number encrypted by the first symmetric key; Generate a second symmetric key according to the first encrypted random number and the second encrypted random number; as well as The identity verification information from the vehicle end is received and verified through the second communication unit, and the identity verification information is generated by encrypting the user information and the requesting end identity identifier with the second symmetric key.

5. The system according to claim 4, wherein the vehicle execution unit is further configured to: receiving a control command from the requesting end through the second communication unit; and The communication connection is verified, and the control command is forwarded to the vehicle controller if the verification is successful.

6. The system according to claim 5, wherein the vehicle execution unit is configured to verify the communication connection by: receiving a control command from the requesting end through the second communication unit; Generate command verification information according to the first encrypted random number and the request end identity through encryption with the second symmetric key and send it to the request end through the second communication unit; Receiving a temporary random number and temporary verification information through the second communication unit, wherein the temporary verification information is generated by encrypting the temporary random number and the requesting end identity through the second symmetric key; Generate temporary verification information according to the temporary random number and the request end identity through encryption with the second symmetric key; as well as The control command is forwarded if the temporary verification information is the same as the temporary authentication information.

7. The system according to claim 6, wherein the virtual key further comprises a serial number, and the vehicle execution unit is further configured to: send the serial number of the virtual key to the service end for verification via the first communication unit; receiving a verification result from the server through the first communication unit; and If the verification is successful, the communication connection established by the second communication unit is maintained; if the verification is not successful, the connection is disconnected.

8. A computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, characterized in that: When the instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 2.

Images